Preliminary version of rpkid et al with all the TLS code ripped out.

Not quite ready for cutover yet, may need some conversion tools and
instructions, but checking this into a branch (well, sort of) so that
others can look at the code changes involved, try it out themselves,
etc.  At some point this will merge back into rpkid/ directory and
there will be only one, without TLS, but converting the testbed is
going to require a flag day, so need to keep the TLS version around
until then.

svn path=/rpkid.without_tls; revision=3449

38 files changed, 6359 insertions, 0 deletions

diff --git a/rpkid.without_tls/tests/Makefile b/rpkid.without_tls/tests/Makefile
new file mode 100644
index 00000000..8b5faf52
--- /dev/null
+++ b/rpkid.without_tls/tests/Makefile
@@ -0,0 +1,66 @@
+# $Id$
+
+all: protocol-samples
+
+clean:
+	rm -rf smoketest.dir left-right-protocol-samples publication-protocol-samples yamltest.dir
+
+protocol-samples: left-right-protocol-samples/.stamp publication-protocol-samples/.stamp
+
+left-right-protocol-samples/.stamp: left-right-protocol-samples.xml split-protocol-samples.xsl 
+	rm -rf left-right-protocol-samples
+	mkdir  left-right-protocol-samples
+	xsltproc --param verbose 0 --stringparam dir left-right-protocol-samples split-protocol-samples.xsl left-right-protocol-samples.xml
+	touch $@
+
+publication-protocol-samples/.stamp: publication-protocol-samples.xml split-protocol-samples.xsl 
+	rm -rf publication-protocol-samples
+	mkdir  publication-protocol-samples
+	xsltproc --param verbose 0 --stringparam dir publication-protocol-samples split-protocol-samples.xsl publication-protocol-samples.xml
+	touch $@
+
+parse-test: protocol-samples
+	python xml-parse-test.py
+
+all-tests:: parse-test
+
+all-tests:: 
+	python smoketest.py -y smoketest.1.yaml
+
+all-tests::
+	python smoketest.py -y smoketest.2.yaml
+
+test all-tests::
+	python smoketest.py -y smoketest.3.yaml
+
+all-tests::
+	python smoketest.py -y smoketest.4.yaml
+
+all-tests::
+	python smoketest.py -y smoketest.5.yaml
+
+test all-tests::
+	python smoketest.py -y smoketest.6.yaml
+
+all-tests::
+	python smoketest.py -y smoketest.7.yaml
+
+profile: all
+	find smoketest.dir -name '*.prof' -delete
+	python smoketest.py -y smoketest.2.yaml -p
+	for i in smoketest.dir/*.prof; do python -c "import pstats;pstats.Stats('$$i').sort_stats('time').print_stats()"; done
+
+# This isn't a full exercise of the yamltest framework, but is
+# probably as good as we can do under make.
+
+YAMLTEST_CONFIG = smoketest.1.yaml
+
+yamltest:
+	rm -rf yamltest.dir
+	python sql-cleaner.py
+	python yamltest.py ${YAMLTEST_CONFIG}
+
+backup:
+	python sql-dumper.py
+	tar cvvzf yamltest.backup.$$(TZ='' date +%Y.%m.%d.%H.%M.%S).tgz screenlog.* yamltest.dir backup.*.sql
+	rm backup.*.sql
diff --git a/rpkid.without_tls/tests/POW b/rpkid.without_tls/tests/POW
new file mode 120000
index 00000000..5ddce7b5
--- /dev/null
+++ b/rpkid.without_tls/tests/POW
@@ -0,0 +1 @@
+../POW
\ No newline at end of file
diff --git a/rpkid.without_tls/tests/left-right-protocol-samples.xml b/rpkid.without_tls/tests/left-right-protocol-samples.xml
new file mode 100644
index 00000000..94727558
--- /dev/null
+++ b/rpkid.without_tls/tests/left-right-protocol-samples.xml
@@ -0,0 +1,1093 @@
+<!-- -*- SGML -*-
+  -  $Id$
+  -
+  - Copyright (C) 2010  Internet Systems Consortium ("ISC")
+  - 
+  - Permission to use, copy, modify, and distribute this software for any
+  - purpose with or without fee is hereby granted, provided that the above
+  - copyright notice and this permission notice appear in all copies.
+  - 
+  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  - PERFORMANCE OF THIS SOFTWARE.
+  - 
+  - Portions copyright (C) 2007-2008  American Registry for Internet Numbers ("ARIN")
+  -
+  - Permission to use, copy, modify, and distribute this software for any
+  - purpose with or without fee is hereby granted, provided that the above
+  - copyright notice and this permission notice appear in all copies.
+  -
+  - THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  - AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  - PERFORMANCE OF THIS SOFTWARE.
+  -
+  -
+  - This is a collection of sample left-right protocol PDU samples
+  - to use as test cases for the left-right protocol RelaxNG schema.
+  -->
+
+<completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="create" tag="a000" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="create" tag="a000" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="set" self_handle="42"
+		rekey="yes"
+		reissue="yes"
+		revoke="yes"
+		run_now="yes"
+		publish_world_now="yes"
+		crl_interval="3600"
+		regen_margin="86400"
+		use_hsm="no">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</self>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="set" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="get" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="get" self_handle="42">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</self>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="list"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="list" self_handle="42">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</self>
+	<self action="list" self_handle="99"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="destroy" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<self action="destroy" self_handle="42"/>
+    </msg>
+    
+    <!-- ==== -->
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="create" self_handle="42" bsc_handle="17"
+		generate_keypair="yes"
+		key_type="rsa"
+		hash_alg="sha256"
+		key_length="2048">
+	    <signing_cert>
+		MIIDHTCCAgWgAwIBAgIJAKUUCoKn9ovVMA0GCSqGSIb3DQEBBQUAMCYxJDAiBgNV
+		BAMTG1Rlc3QgQ2VydGlmaWNhdGUgQWxpY2UgUm9vdDAeFw0wNzA4MDExOTUzMDda
+		Fw0wNzA4MzExOTUzMDdaMCQxIjAgBgNVBAMTGVRlc3QgQ2VydGlmaWNhdGUgQWxp
+		Y2UgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmLngkGT5kWsXd
+		IgLeV+5zNvcDt0+D4cds1cu+bw6Y/23z1+ooA8fU1gXQ28bl6ELM8WRLHgcntqzr
+		5UX6S1xPdNfFYt8z4E1ZuvwCPsxcSwVdlYRvzAGNQivDpcJ75Mf5DTeDpr6wm7yn
+		2pzxvQIet5djOX51RVGA3hOwCbhq2ceHs0ZruWG3T70H3Sa1ZVxP7m0DJlsSZa6v
+		3oEeFOKZQlqrgeU74mJyLAGx/fNbIw+UBrvejfjZobIv985vQ06DZ5S2AquQ2bht
+		O/2bW3yqeOjH98YK0zlOpYtaZ2fyx4JLjHCspoki6+4W9UG+TuqdkB20mRsr25XT
+		9kLuwIGZAgMBAAGjUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFF6I4IR33h/s
+		vOa4Vsw2icPo8TgaMB8GA1UdIwQYMBaAFG9ed1KlOQDyB+k7Yeb8LSjG5FDtMA0G
+		CSqGSIb3DQEBBQUAA4IBAQDVzBuGyXIq/rfMjoNKIHTUgppkc+FjS02cFASpB5mk
+		ksSpGWYHMZKlqz47qDi44KAG+kmPIPOT0em81+/VGeY1oizJyKSeNDhNboth5oTu
+		ShDr4flTQCoYvRxm1wh8WIIg09nwibzGztuV1XxtdzfQV5kK5bMBlDXnUfAYydsO
+		jc52x5f4tgdcfBhjnMzkCAx2kvw5Wp3NekkOKl5YYnPK++zT9IBwqrqJmsJvyLPO
+		vvqVBYkoBWRbmcy6wVU8JpYegNNgVRbi6zeAq33gS75m9uy+4z8Ql6DqVF0s/y+/
+		240tLCW62X98EzrALKsxhkqVZCtdc5HSRaOQr0K3I03S
+	    </signing_cert>
+	</bsc>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="create" self_handle="42" bsc_handle="17">
+	    <pkcs10_request>cmVxdWVzdAo=</pkcs10_request>
+	</bsc>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="set" self_handle="42" bsc_handle="17">
+	    <signing_cert>
+		MIIDHTCCAgWgAwIBAgIJAKUUCoKn9ovVMA0GCSqGSIb3DQEBBQUAMCYxJDAiBgNV
+		BAMTG1Rlc3QgQ2VydGlmaWNhdGUgQWxpY2UgUm9vdDAeFw0wNzA4MDExOTUzMDda
+		Fw0wNzA4MzExOTUzMDdaMCQxIjAgBgNVBAMTGVRlc3QgQ2VydGlmaWNhdGUgQWxp
+		Y2UgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmLngkGT5kWsXd
+		IgLeV+5zNvcDt0+D4cds1cu+bw6Y/23z1+ooA8fU1gXQ28bl6ELM8WRLHgcntqzr
+		5UX6S1xPdNfFYt8z4E1ZuvwCPsxcSwVdlYRvzAGNQivDpcJ75Mf5DTeDpr6wm7yn
+		2pzxvQIet5djOX51RVGA3hOwCbhq2ceHs0ZruWG3T70H3Sa1ZVxP7m0DJlsSZa6v
+		3oEeFOKZQlqrgeU74mJyLAGx/fNbIw+UBrvejfjZobIv985vQ06DZ5S2AquQ2bht
+		O/2bW3yqeOjH98YK0zlOpYtaZ2fyx4JLjHCspoki6+4W9UG+TuqdkB20mRsr25XT
+		9kLuwIGZAgMBAAGjUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFF6I4IR33h/s
+		vOa4Vsw2icPo8TgaMB8GA1UdIwQYMBaAFG9ed1KlOQDyB+k7Yeb8LSjG5FDtMA0G
+		CSqGSIb3DQEBBQUAA4IBAQDVzBuGyXIq/rfMjoNKIHTUgppkc+FjS02cFASpB5mk
+		ksSpGWYHMZKlqz47qDi44KAG+kmPIPOT0em81+/VGeY1oizJyKSeNDhNboth5oTu
+		ShDr4flTQCoYvRxm1wh8WIIg09nwibzGztuV1XxtdzfQV5kK5bMBlDXnUfAYydsO
+		jc52x5f4tgdcfBhjnMzkCAx2kvw5Wp3NekkOKl5YYnPK++zT9IBwqrqJmsJvyLPO
+		vvqVBYkoBWRbmcy6wVU8JpYegNNgVRbi6zeAq33gS75m9uy+4z8Ql6DqVF0s/y+/
+		240tLCW62X98EzrALKsxhkqVZCtdc5HSRaOQr0K3I03S
+	    </signing_cert>
+	    <signing_cert_crl>
+		MIIBfjBoAgEBMA0GCSqGSIb3DQEBCwUAMCYxJDAiBgNVBAMTG1Rlc3QgQ2VydGlm
+		aWNhdGUgUklSIFNFTEYtMRcNMDgwNTAxMDQ1MjAxWhcNMDgwNTMxMDQ1MjAxWqAO
+		MAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBACTbbaYh+f4EtXFIKPwH
+		K2NYq/MrhE2BnHDyA43siryddtac1E2bOtXPkC74nY5yGm4wZU07qPovJNGu1McG
+		J2hV2uUyAN00lJU3EikrS1ewz7vqjINar1ZUMDkh0wMYKLB9S8SdwNvCf1vcjshz
+		yasBRse9PCH1R0bmDaP8FZM47P55dKiijaN87HQKyZPOExFslnWH+Nr+mAF1xost
+		pwGcc3jreVZWbtQ2RdUDJYcNrSSCH8JYqd5ZgAYcE53xxy43rKcULz054GDFcS/B
+		rprwJgfrjkPttAl80cfrVOUl77ZFfFxzOeHCmQMl9VSoCxmWvnBCBBO4H7meJ7NO
+		gyc=
+	    </signing_cert_crl>
+	</bsc>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="set" self_handle="42" bsc_handle="17"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="get" self_handle="42" bsc_handle="17"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="get" self_handle="42" bsc_handle="17">
+	    <signing_cert>
+		MIIDHTCCAgWgAwIBAgIJAKUUCoKn9ovVMA0GCSqGSIb3DQEBBQUAMCYxJDAiBgNV
+		BAMTG1Rlc3QgQ2VydGlmaWNhdGUgQWxpY2UgUm9vdDAeFw0wNzA4MDExOTUzMDda
+		Fw0wNzA4MzExOTUzMDdaMCQxIjAgBgNVBAMTGVRlc3QgQ2VydGlmaWNhdGUgQWxp
+		Y2UgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmLngkGT5kWsXd
+		IgLeV+5zNvcDt0+D4cds1cu+bw6Y/23z1+ooA8fU1gXQ28bl6ELM8WRLHgcntqzr
+		5UX6S1xPdNfFYt8z4E1ZuvwCPsxcSwVdlYRvzAGNQivDpcJ75Mf5DTeDpr6wm7yn
+		2pzxvQIet5djOX51RVGA3hOwCbhq2ceHs0ZruWG3T70H3Sa1ZVxP7m0DJlsSZa6v
+		3oEeFOKZQlqrgeU74mJyLAGx/fNbIw+UBrvejfjZobIv985vQ06DZ5S2AquQ2bht
+		O/2bW3yqeOjH98YK0zlOpYtaZ2fyx4JLjHCspoki6+4W9UG+TuqdkB20mRsr25XT
+		9kLuwIGZAgMBAAGjUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFF6I4IR33h/s
+		vOa4Vsw2icPo8TgaMB8GA1UdIwQYMBaAFG9ed1KlOQDyB+k7Yeb8LSjG5FDtMA0G
+		CSqGSIb3DQEBBQUAA4IBAQDVzBuGyXIq/rfMjoNKIHTUgppkc+FjS02cFASpB5mk
+		ksSpGWYHMZKlqz47qDi44KAG+kmPIPOT0em81+/VGeY1oizJyKSeNDhNboth5oTu
+		ShDr4flTQCoYvRxm1wh8WIIg09nwibzGztuV1XxtdzfQV5kK5bMBlDXnUfAYydsO
+		jc52x5f4tgdcfBhjnMzkCAx2kvw5Wp3NekkOKl5YYnPK++zT9IBwqrqJmsJvyLPO
+		vvqVBYkoBWRbmcy6wVU8JpYegNNgVRbi6zeAq33gS75m9uy+4z8Ql6DqVF0s/y+/
+		240tLCW62X98EzrALKsxhkqVZCtdc5HSRaOQr0K3I03S
+	    </signing_cert>
+	</bsc>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="list" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="get" self_handle="42" bsc_handle="17">
+	    <signing_cert>
+		MIIDHTCCAgWgAwIBAgIJAKUUCoKn9ovVMA0GCSqGSIb3DQEBBQUAMCYxJDAiBgNV
+		BAMTG1Rlc3QgQ2VydGlmaWNhdGUgQWxpY2UgUm9vdDAeFw0wNzA4MDExOTUzMDda
+		Fw0wNzA4MzExOTUzMDdaMCQxIjAgBgNVBAMTGVRlc3QgQ2VydGlmaWNhdGUgQWxp
+		Y2UgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDmLngkGT5kWsXd
+		IgLeV+5zNvcDt0+D4cds1cu+bw6Y/23z1+ooA8fU1gXQ28bl6ELM8WRLHgcntqzr
+		5UX6S1xPdNfFYt8z4E1ZuvwCPsxcSwVdlYRvzAGNQivDpcJ75Mf5DTeDpr6wm7yn
+		2pzxvQIet5djOX51RVGA3hOwCbhq2ceHs0ZruWG3T70H3Sa1ZVxP7m0DJlsSZa6v
+		3oEeFOKZQlqrgeU74mJyLAGx/fNbIw+UBrvejfjZobIv985vQ06DZ5S2AquQ2bht
+		O/2bW3yqeOjH98YK0zlOpYtaZ2fyx4JLjHCspoki6+4W9UG+TuqdkB20mRsr25XT
+		9kLuwIGZAgMBAAGjUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFF6I4IR33h/s
+		vOa4Vsw2icPo8TgaMB8GA1UdIwQYMBaAFG9ed1KlOQDyB+k7Yeb8LSjG5FDtMA0G
+		CSqGSIb3DQEBBQUAA4IBAQDVzBuGyXIq/rfMjoNKIHTUgppkc+FjS02cFASpB5mk
+		ksSpGWYHMZKlqz47qDi44KAG+kmPIPOT0em81+/VGeY1oizJyKSeNDhNboth5oTu
+		ShDr4flTQCoYvRxm1wh8WIIg09nwibzGztuV1XxtdzfQV5kK5bMBlDXnUfAYydsO
+		jc52x5f4tgdcfBhjnMzkCAx2kvw5Wp3NekkOKl5YYnPK++zT9IBwqrqJmsJvyLPO
+		vvqVBYkoBWRbmcy6wVU8JpYegNNgVRbi6zeAq33gS75m9uy+4z8Ql6DqVF0s/y+/
+		240tLCW62X98EzrALKsxhkqVZCtdc5HSRaOQr0K3I03S
+	    </signing_cert>
+	</bsc>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="destroy" self_handle="42" bsc_handle="17"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<bsc action="destroy" self_handle="42" bsc_handle="17"/>
+    </msg>
+    
+    <!-- ==== -->
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="create" self_handle="42" parent_handle="666"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		sia_base="rsync://repo.foo.example/wombat/"
+		bsc_handle="17"
+		repository_handle="120"
+		sender_name="tweedledee"
+		recipient_name="tweedledum">
+	    <bpki_cms_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_cert>
+	    <bpki_cms_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_glue>
+	</parent>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="create" self_handle="42" parent_handle="666"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="set" self_handle="42" parent_handle="666"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		sia_base="rsync://repo.foo.example/wombat/"
+		bsc_handle="17"
+		repository_handle="120"
+		rekey="yes"
+		reissue="yes"
+		revoke="yes">
+	    <bpki_cms_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_cert>
+	    <bpki_cms_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_glue>
+	</parent>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="set" self_handle="42" parent_handle="666"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="get" self_handle="42" parent_handle="666"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="get" self_handle="42" parent_handle="666"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		sia_base="rsync://repo.foo.example/wombat/"
+		bsc_handle="17"
+		repository_handle="120">
+	    <bpki_cms_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_cert>
+	    <bpki_cms_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_glue>
+	</parent>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="list" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="list" self_handle="42" parent_handle="666"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		sia_base="rsync://repo.foo.example/wombat/"
+		bsc_handle="17"
+		repository_handle="120">
+	    <bpki_cms_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_cert>
+	    <bpki_cms_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cms_glue>
+	</parent>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="destroy" self_handle="42"
+    parent_handle="666"/> </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<parent action="destroy" self_handle="42" parent_handle="666"/>
+    </msg>
+    
+    <!-- ==== -->
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="create" self_handle="42" child_handle="3"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</child>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="create" self_handle="42" child_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="set" self_handle="42" child_handle="3"
+		bsc_handle="17"
+		reissue="yes">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</child>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="set" self_handle="42" child_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="get" self_handle="42" child_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="get" self_handle="42" child_handle="3"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</child>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="list" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="list" self_handle="42" child_handle="3"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</child>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="destroy" self_handle="42" child_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<child action="destroy" self_handle="42" child_handle="3"/>
+    </msg>
+    
+    <!-- ==== -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="create" self_handle="42" repository_handle="120"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</repository>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="create" self_handle="42" repository_handle="120"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="set" self_handle="42" repository_handle="120"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</repository>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="set" self_handle="42" repository_handle="120"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="get" self_handle="42" repository_handle="120"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="get" self_handle="42" repository_handle="120"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</repository>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="list" self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="list" self_handle="42" repository_handle="120"
+		peer_contact_uri="https://re.bar.example/bandicoot/"
+		bsc_handle="17">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</repository>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="destroy" self_handle="42" repository_handle="120"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<repository action="destroy" self_handle="42" repository_handle="120"/>
+    </msg>
+
+    <!-- ==== -->
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_resources self_handle="42" child_handle="289"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_resources self_handle="42" child_handle="289"
+			valid_until="2008-04-01T00:00:00Z"
+			ipv4="10.0.0.44/32,10.3.0.44/32"
+			ipv6="fe80:deed:f00d::/48,fe80:dead:beef:2::-fe80:dead:beef:2::49"
+			asn="666"/>
+    </msg>
+    
+    <!-- === -->
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_roa_requests self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_roa_requests self_handle="42"
+			asn="666"
+			ipv4="10.0.0.44/32,10.3.0.44/32"
+			ipv6="fe80:deed:f00d::/48,fe80:dead:beef::/48-56"
+			/>
+	<list_roa_requests self_handle="42"
+			asn="12345"
+			ipv4="10.0.0.44/32"
+			ipv6="2002:a00::/48-56"
+			/>
+    </msg>
+    
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_received_resources self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_received_resources self_handle="42"
+				 parent_handle="Alice"
+				 notBefore="2010-02-22T03:44:23Z"
+				 notAfter="2011-02-21T11:03:49Z"
+				 uri="rsync://arin.rpki.net/arin/1/Du4MhiSkjd_3bPL7c2trEkJBZ-U.cer"
+				 sia_uri="rsync://arin.rpki.net/arin/isc/ISC-94-Z/2/"
+				 aia_uri="rsync://arin.rpki.net/arin/arin.cer"
+				 asn="1280,3557"
+				 ipv4="149.20.0.0/16,192.5.4.0/23,204.152.184.0/21"/>
+	<list_received_resources self_handle="42"
+				 parent_handle="Bob"
+				 uri="rsync://arin.rpki.net/arin/1/uWqpa8GkcEDBZkEsmOEofeDKk9s.cer"
+				 notBefore="2010-02-22T03:44:20Z"
+				 notAfter="2011-02-21T11:03:49Z"
+				 sia_uri="rsync://arin.rpki.net/arin/isc/ISC-94/1/"
+				 aia_uri="rsync://arin.rpki.net/arin/arin.cer"
+				 asn="27318-27322,30122-30134,33071-33082,53459,393221"
+				 ipv4="192.158.248.0-192.158.252.255,192.228.80.0-192.228.92.255,199.6.0.0-199.6.14.255,199.254.27.0/24"
+				 ipv6="2001:4f8::/32,2001:500::/48,2001:500:2e::/47,2001:500:60::-2001:500:7c:ffff:ffff:ffff:ffff:ffff,2001:500:85::/48"/>
+    </msg>
+
+    
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_published_objects self_handle="42"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<list_published_objects self_handle="42" uri="rsync://rpki.example.org/rpki/DEMEtlxZrZes7TNGbe7XwVSMgW0.crl">
+		MIIBrjCBlwIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygwQzQzMDRCNjVDNTlBRDk3
+		QUNFRDMzNDY2REVFRDdDMTU0OEM4MTZEFw0wOTA5MjgyMDUxNDlaFw0wOTA5MjgyMTUxNDla
+		oDAwLjAfBgNVHSMEGDAWgBQMQwS2XFmtl6ztM0Zt7tfBVIyBbTALBgNVHRQEBAICAWkwDQYJ
+		KoZIhvcNAQELBQADggEBAIRT1nriWsvZO9QtLKEiO7SZE3YZqMqDXS1auGBxEZtcLyF93ct6
+		dstbiWHXjlHLztgePXh970BsTYhiVbKKnZvS0pjI8a9vr9b2Dyia3QG8ArV0zXVKhAGku5v+
+		RG9d+f/VH0GMQ8ITcjJOKOaK0afv1KmQsydAb8KLKAGhCs7zeuztQG2k3YP6BE2OOPYK9fYk
+		EGHz0kPGp/oD/PJJfmPlKD4Uk4mSvM6e5ksgKg0BnxoU9RMkWjAeGVxk0F+SDG5sPmCsVOgB
+		fBk4i7H945v/zs7bLLMJxTs8+ao4iCDuknjbGhjWmi9xrTXDtcCXx607rPDkJQcJE2WnRS/U
+		HIA=
+	</list_published_objects>
+	<list_published_objects self_handle="42" uri="rsync://rpki.example.org/rpki/DEMEtlxZrZes7TNGbe7XwVSMgW0.mnf">
+		MIIHBQYJKoZIhvcNAQcCoIIG9jCCBvICAQMxDTALBglghkgBZQMEAgEwggEfBgsqhkiG9w0B
+		CRABGqCCAQ4EggEKMIIBBgICAWoYDzIwMDkwOTI4MjA1MTQ5WhgPMjAwOTA5MjgyMTUxNDla
+		BglghkgBZQMEAgEwgdIwRBYfREVNRXRseFpyWmVzN1ROR2JlN1h3VlNNZ1cwLmNybAMhAPgd
+		nO/fVdSWmPrnxJAf4JXrf0J/dHv9en+Tsqrz4WjcMEQWH2xkdnhjSEdkcjNvS0hjUGotZ3Vr
+		bWV0TlJaMC5yb2EDIQAxseZlGDtfsvDOBv1X2ElR8k/V78ynwSBGM22F5DYXUTBEFh94b3BO
+		R2NzQl9wN2VhZllxWGF0bVZWOEhaZDAucm9hAyEAKIKdRZhS1tawepRzVXtdP1imh6zPymWp
+		dCjYJUDqzY2gggQLMIIEBzCCAu+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQD
+		EygwQzQzMDRCNjVDNTlBRDk3QUNFRDMzNDY2REVFRDdDMTU0OEM4MTZEMB4XDTA5MDkxODIx
+		NDE1NFoXDTEwMDkxMzExMDcwOVowMzExMC8GA1UEAxMoMEQ3MjU5REEyNEY5OTRFNTVCN0E2
+		NkQxMDBEOUE5REJFMURGODIwNzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKwo
+		COG8kQMKuAVMOe5eTlasUpFQ2OT2VNmJtJ7NPQ1rLm1ahVUcTXUn7p+ikmJYpwFRACZ6htgF
+		n51RL43lm/pITTSVc1A6fofkrnoNImwMG8Pj8Z46H6kbJOM69NW5asjvA5DfSu73cltGHPRg
+		DQqt1k/3+aWqPWiYS7OGbQdDYGmy3T5VNlc+DBzyAM2VxNrLNF5Imv1NbfLw0Bp/gvayeApe
+		AjhjraCP7ZQxyXesLbBZrjQz1MXpi4DOZtY8gYwaMNgeU56jR9tpM5IDY5zSPHKZyJVvLQnT
+		iQfMKasHYMcFDtDrRH7t+YQlmt40uby0YsIIcv5FWJf1OBHnyYcCAwEAAaOCASQwggEgMB0G
+		A1UdDgQWBBQNclnaJPmU5Vt6ZtEA2anb4d+CBzAfBgNVHSMEGDAWgBQMQwS2XFmtl6ztM0Zt
+		7tfBVIyBbTBaBgNVHR8EUzBRME+gTaBLhklyc3luYzovL2FyaW4ucnBraS5uZXQvYXJpbi9p
+		c2MvSVNDLTk0LVovMi9ERU1FdGx4WnJaZXM3VE5HYmU3WHdWU01nVzAuY3JsMFgGCCsGAQUF
+		BwEBBEwwSjBIBggrBgEFBQcwAoY8cnN5bmM6Ly9hcmluLnJwa2kubmV0L2FyaW4vMS9ERU1F
+		dGx4WnJaZXM3VE5HYmU3WHdWU01nVzAuY2VyMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIw
+		DgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQCZtr0XdjKRitItHi7UfUx6hTp2
+		BOwoaNoOCEKw+dRMDYEgfRKbWSRd3gyVR3F1DV41aT1vDm56+WoN2Td1WEi2H0q22f1iIKuS
+		m0MkOpdqVZGOYHLTErv22XzDf7ifdGo3RkW7QOQ3D1n6Qraft5AB3aHskCofvPx3CBGFHKWh
+		N5HXnh+J/Bly2EwxPYs4yibx6K8stnxwIwsmo7DvjdPwv+VnrmIb7pxOpvqHjEQEs7Wy9Y47
+		NP3Ym2YLwbIqAuN6F9kF7DeCanBt0HeFqMsOowz11ll1xBAwcpz/bxVwyAwWUoJNncoJCrjz
+		n2gPGYKqW80qgQwL8vBLFtBevZbyMYIBqjCCAaYCAQOAFA1yWdok+ZTlW3pm0QDZqdvh34IH
+		MAsGCWCGSAFlAwQCAaBrMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABGjAcBgkqhkiG9w0B
+		CQUxDxcNMDkwOTI4MjA1MTQ5WjAvBgkqhkiG9w0BCQQxIgQgYA8+0xE+taAr6cM6tEAt4Wh6
+		BWT8Xu76a6YSZt9hb2kwDQYJKoZIhvcNAQEBBQAEggEAmD/WNppqwMtpQw+RkqIbcg3HT7fg
+		RRK+ehJfcyCqP/t7vUu65cAcz02gbT3LHZDkqtGD9WjgjoxSVNrYiS+4TEQbt0AXrSQFqr9F
+		ud2eujpeGpx56VVYgE/Jef9MfiYXSjWj9oveEWR1OdRFVCn6TW6+t1n6OMTNhnDxYt9t4NZV
+		OCK95aHm9vi7d8CMZfPnZMQuXiNmHberYkxLu5LZJ84C2GqGbyBllkFp2KUGKoWgMyeKkk0q
+		yML8lQJAFAyjnXJ+doGbqfTUpVH4q4drqRb73WbL0zf/Z2HGwhDlTmsAdjparWdQcfXIVrJF
+		ynS1fab9XZfj+VtBFKjooDjaLw==
+	</list_published_objects>
+	<list_published_objects self_handle="42" uri="rsync://rpki.example.org/rpki/ldvxcHGdr3oKHcPj-gukmetNRZ0.roa">
+		MIIGnQYJKoZIhvcNAQcCoIIGjjCCBooCAQMxDTALBglghkgBZQMEAgEwMQYLKoZIhvcNAQkQ
+		ARigIgQgMB4CAg3lMBgwFgQCAAEwEDAGAwQAwAUEMAYDBADABQWgggSTMIIEjzCCA3egAwIB
+		AgIBAjANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygwQzQzMDRCNjVDNTlBRDk3QUNFRDMz
+		NDY2REVFRDdDMTU0OEM4MTZEMB4XDTA5MDkxODIyNTkzM1oXDTEwMDkxMzExMDcwOVowMzEx
+		MC8GA1UEAxMoOTVEQkYxNzA3MTlEQUY3QTBBMURDM0UzRkEwQkE0OTlFQjRENDU5RDCCASIw
+		DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALpn7TNbq1aYIa9fQG660Rz3dUfpx/dZEOJc
+		/PD5sxLSBCgcMJKGUb7RGajyI4pbIwVax1w+A4Ie38YjSl6p95FdwBMDX2w6OwePdLwDC+0R
+		zCf2p/F4Go79glYssEKjFGYvUDwm8SwJ3dr8XdlgdjbT4zIrMZj9SVOgreeNGOU+jcn8HvX3
+		94/0w49JDzPwKmHzGSlBTunzQ4pYZyZ2R+rDKuTJqRslEdD5KOFjNV2s4owWkhJzCermBj2u
+		CFExS+0Fc0In9Q3X5PcTMp2L1Gj4sdgc2Kbc8VTWU7kgF5M/15HThgRy+Ldx/b05w22mJV7L
+		6yMkNGfRpn4CxLFD0U8CAwEAAaOCAawwggGoMB0GA1UdDgQWBBSV2/FwcZ2vegodw+P6C6SZ
+		601FnTAfBgNVHSMEGDAWgBQMQwS2XFmtl6ztM0Zt7tfBVIyBbTBaBgNVHR8EUzBRME+gTaBL
+		hklyc3luYzovL2FyaW4ucnBraS5uZXQvYXJpbi9pc2MvSVNDLTk0LVovMi9ERU1FdGx4WnJa
+		ZXM3VE5HYmU3WHdWU01nVzAuY3JsMFgGCCsGAQUFBwEBBEwwSjBIBggrBgEFBQcwAoY8cnN5
+		bmM6Ly9hcmluLnJwa2kubmV0L2FyaW4vMS9ERU1FdGx4WnJaZXM3VE5HYmU3WHdWU01nVzAu
+		Y2VyMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwDgYDVR0PAQH/BAQDAgeAMGUGCCsGAQUF
+		BwELBFkwVzBVBggrBgEFBQcwC4ZJcnN5bmM6Ly9hcmluLnJwa2kubmV0L2FyaW4vaXNjL0lT
+		Qy05NC1aLzIvbGR2eGNIR2RyM29LSGNQai1ndWttZXROUlowLnJvYTAfBggrBgEFBQcBBwEB
+		/wQQMA4wDAQCAAEwBgMEAcAFBDANBgkqhkiG9w0BAQsFAAOCAQEAIjdpXxwxe9sK9RkqzvDP
+		to3zdDhpLf29XqKKkNhux2pXXeMcRR5vNN13mguuxaO/uQtrFTBgk8EJn7CfhmIoZpZClcAS
+		cvIyYSBbc/VspOdmPH2DnQGFjBk/qpEUs3W3Us5/w6x2BnjuUtRBj5eQQ5kydtHTy/URSX7i
+		K76ngiTsDL6e77UVu8KY+EutZU3b2HH73qfeP8L4HJ2rpm5tnHZEECcAHS20bhqTqyuECcuK
+		FBhQA2Ye8LtVg/CbZixZNqb5bfcCj72HzsZAKC57gzu/ROJ43wINcwgCkYUeWM8eoFJoYCaQ
+		z1avg/vDGBrZtkNQQJt9mXoxaJF25YEuRDGCAaowggGmAgEDgBSV2/FwcZ2vegodw+P6C6SZ
+		601FnTALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARgwHAYJKoZI
+		hvcNAQkFMQ8XDTA5MDkxODIyNTkzM1owLwYJKoZIhvcNAQkEMSIEIEU7rNCYuAgPtZckEMP4
+		MMUl4hMwvLJ4KWHgg1fZNkJMMA0GCSqGSIb3DQEBAQUABIIBAA6fqD9/VisrRFIqRbwFpG/B
+		fkmnZGPequD7JPgJR/O/7ofUe1yunPugdPoDe+bTrEaUfyj6xAcdXXwR2fKHF8HyCPMclqCB
+		aQNZH/nHnawrwOXem8qwnKRyn7hOXyKPxar4VIVg90JFttgaM/l9W++PV02KQS8GlFRymvpg
+		Eca4THQ5/VWe/3V5dAOEGFUl0/WAjYId+jYzF9oHKSeZTqWmpvDaX4Pc+xkydw18kQBsovnv
+		+N931gu2r5I/XB/MGgGvXNWozK7RuMn55i5hMqI2NQs+/b7/AQU0+/i3g7SlLA8iZwHq49U2
+		ZXRCjLXcy0tQOWVsMnGfReN8oNDhHbc=
+	</list_published_objects>
+	<list_published_objects self_handle="42" uri="rsync://rpki.example.org/rpki/xopNGcsB_p7eafYqXatmVV8HZd0.roa">
+		MIIGoQYJKoZIhvcNAQcCoIIGkjCCBo4CAQMxDTALBglghkgBZQMEAgEwMAYLKoZIhvcNAQkQ
+		ARigIQQfMB0CAgUAMBcwFQQCAAEwDzAFAwMAlRQwBgMEA8yYuKCCBJgwggSUMIIDfKADAgEC
+		AgEDMA0GCSqGSIb3DQEBCwUAMDMxMTAvBgNVBAMTKDBDNDMwNEI2NUM1OUFEOTdBQ0VEMzM0
+		NjZERUVEN0MxNTQ4QzgxNkQwHhcNMDkwOTE4MjI1OTU1WhcNMTAwOTEzMTEwNzA5WjAzMTEw
+		LwYDVQQDEyhDNjhBNEQxOUNCMDFGRTlFREU2OUY2MkE1REFCNjY1NTVGMDc2NUREMIIBIjAN
+		BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2z9OLSVMT632SBjbKcwfnZtkIOeaFG8oRZKe
+		u6q7E3krOxXuK2Yxafz5d2+FJBBFHWSmtKuHpeR2rkUWOZlgIWny6u9hb7vzt2wvuEXjBI7H
+		Bn3sNgGOIgHyuWjUxWyy6gr1K4x437XaMUeMx7xy/82DSgqyK0298EoiPlg8wQau38WFx+FZ
+		cu2Bnf3prc2l3oSRKNPAE7l4P6DKnjy3VPQT6xCt5PEscVDFzkMeJXrGe48GwJzV0ZbUQHeZ
+		/eMAsWyZIp5K4kciU6A552ImLjim64HXaviyHiv0rHAUImBoK5AbnpH1yOZ93StqD0iFEJMF
+		HubclLRuJRFomX05DwIDAQABo4IBsTCCAa0wHQYDVR0OBBYEFMaKTRnLAf6e3mn2Kl2rZlVf
+		B2XdMB8GA1UdIwQYMBaAFAxDBLZcWa2XrO0zRm3u18FUjIFtMFoGA1UdHwRTMFEwT6BNoEuG
+		SXJzeW5jOi8vYXJpbi5ycGtpLm5ldC9hcmluL2lzYy9JU0MtOTQtWi8yL0RFTUV0bHhaclpl
+		czdUTkdiZTdYd1ZTTWdXMC5jcmwwWAYIKwYBBQUHAQEETDBKMEgGCCsGAQUFBzAChjxyc3lu
+		YzovL2FyaW4ucnBraS5uZXQvYXJpbi8xL0RFTUV0bHhaclplczdUTkdiZTdYd1ZTTWdXMC5j
+		ZXIwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAOBgNVHQ8BAf8EBAMCB4AwZQYIKwYBBQUH
+		AQsEWTBXMFUGCCsGAQUFBzALhklyc3luYzovL2FyaW4ucnBraS5uZXQvYXJpbi9pc2MvSVND
+		LTk0LVovMi94b3BOR2NzQl9wN2VhZllxWGF0bVZWOEhaZDAucm9hMCQGCCsGAQUFBwEHAQH/
+		BBUwEzARBAIAATALAwMAlRQDBAPMmLgwDQYJKoZIhvcNAQELBQADggEBAMmzrOxl/SA7uEHR
+		4D5jCMNFZaKkh9Shf2Uqg+JpD88BPVLdBDHmG7CmFSI42puZk76SIrXLjyaUv3kP4wKNXOug
+		c3/80bynPgT+25kTeJc5T4Th735fzJZantqfG+uBQmC2Rk5mihTAL1wweIBFBYcmjAWSmuo9
+		N84XWOikQnkPLAsiX75mT1E2BZB5te6UruWHRtlMggNvE72zrZBYAhk+bCC5HdkAhwA3dah5
+		SsMSOoGgniFoWlLq3COV+ga1OkJgYVRQHXGP7Fjh7YCU2yUygKaf5Yniqh1ijbjJvVz419QY
+		ZflO9//gP3IM5ClbnWR4RhzZFKJ4DGz+lDmHIugxggGqMIIBpgIBA4AUxopNGcsB/p7eafYq
+		XatmVV8HZd0wCwYJYIZIAWUDBAIBoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEYMBwG
+		CSqGSIb3DQEJBTEPFw0wOTA5MTgyMjU5NTVaMC8GCSqGSIb3DQEJBDEiBCC4ptBgQZ1Ktxau
+		h1foPe9MJiB8XZJ21ynmZ7BPTWLQVTANBgkqhkiG9w0BAQEFAASCAQBlAxAGN2Tcvi8tF5qk
+		ECahrFZn0qvOw9tQRKNwwC5SRUQWQcd6Pi7g0znLVS0Y5iOZB7QvHiuPXvVAR7cxwjRlEZy2
+		kmERAbrq7ROweJjb9L5JsacRSWUfG7JQjdqMSGLOf3gqlidBnDrKlNIWfyGntpZZFmIGKo9X
+		5U8PWrCGkb+2AZT/tpt0eMGRhdgGX0n987dEhUbU7k9dZZXA7ou/g1MSL2HHfH17mL9rQqzN
+		UwHopIkNlG0ljGy7xI2wjjcvUCDi0Ns/asqxlz6icHgXhrhLyZy3JlcjG7/v2dm0MdZLFg4m
+		FN/5lE6Ayt2VEDfVNRfMzD6ezxb8PZc2astn
+	</list_published_objects>
+
+    </msg>
+
+    <!-- === -->
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<report_error self_handle="42" error_code="your_hair_is_on_fire">text string</report_error>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/left-right-spec/">
+	<report_error self_handle="42" error_code="your_hair_is_on_fire"/>
+    </msg>
+
+</completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint>
diff --git a/rpkid.without_tls/tests/myrpki-xml-parse-test.py b/rpkid.without_tls/tests/myrpki-xml-parse-test.py
new file mode 100644
index 00000000..5aaf5cbf
--- /dev/null
+++ b/rpkid.without_tls/tests/myrpki-xml-parse-test.py
@@ -0,0 +1,101 @@
+"""
+Test parser and display tool for myrpki.xml files.
+
+$Id$
+
+Copyright (C) 2009--2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+"""
+
+import lxml.etree, rpki.resource_set, base64, subprocess
+
+relaxng = lxml.etree.RelaxNG(file = "myrpki.rng")
+
+tree = lxml.etree.parse("myrpki.xml").getroot()
+
+if False:
+  print lxml.etree.tostring(tree, pretty_print = True, encoding = "us-ascii", xml_declaration = True)
+
+relaxng.assertValid(tree)
+
+def showitems(x):
+  if False:
+    for k, v in x.items():
+      if v:
+        print " ", k, v
+
+def tag(t):
+  return "{http://www.hactrn.net/uris/rpki/myrpki/}" + t
+
+print "My handle:", tree.get("handle")
+
+print "Children:"
+for x in tree.getiterator(tag("child")):
+  print " ", x
+  print "  Handle:", x.get("handle")
+  print "  ASNS:  ", rpki.resource_set.resource_set_as(x.get("asns"))
+  print "  IPv4:  ", rpki.resource_set.resource_set_ipv4(x.get("v4"))
+  print "  Valid: ", x.get("valid_until")
+  showitems(x)
+print
+
+print "ROA requests:"
+for x in tree.getiterator(tag("roa_request")):
+  print " ", x
+  print "  ASN: ", x.get("asn")
+  print "  IPv4:", rpki.resource_set.roa_prefix_set_ipv4(x.get("v4"))
+  print "  IPv6:", rpki.resource_set.roa_prefix_set_ipv6(x.get("v6"))
+  showitems(x)
+print
+
+def showpem(label, b64, kind):
+  cmd = ("openssl", kind, "-noout", "-text", "-inform", "DER")
+  if kind == "x509":
+    cmd += ("-certopt", "no_pubkey,no_sigdump")
+  p = subprocess.Popen(cmd, stdin = subprocess.PIPE, stdout = subprocess.PIPE)
+  text = p.communicate(input = base64.b64decode(b64))[0]
+  if p.returncode != 0:
+    raise subprocess.CalledProcessError(returncode = p.returncode, cmd = cmd)
+  print label, text
+
+for x in tree.getiterator(tag("child")):
+  cert = x.findtext(tag("bpki_certificate"))
+  if cert:
+    showpem("Child", cert, "x509")
+
+for x in tree.getiterator(tag("parent")):
+  print "Parent URI:", x.get("service_uri")
+  cert = x.findtext(tag("bpki_certificate"))
+  if cert:
+    showpem("Parent", cert, "x509")
+
+ca = tree.findtext(tag("bpki_ca_certificate"))
+if ca:
+  showpem("CA", ca, "x509")
+
+bsc = tree.findtext(tag("bpki_bsc_certificate"))
+if bsc:
+  showpem("BSC EE", bsc, "x509")
+
+repo = tree.findtext(tag("bpki_repository_certificate"))
+if repo:
+  showpem("Repository", repo, "x509")
+
+req = tree.findtext(tag("bpki_bsc_pkcs10"))
+if req:
+  showpem("BSC EE", req, "req")
+
+crl = tree.findtext(tag("bpki_crl"))
+if crl:
+  showpem("CA", crl, "crl")
diff --git a/rpkid.without_tls/tests/publication-protocol-samples.xml b/rpkid.without_tls/tests/publication-protocol-samples.xml
new file mode 100644
index 00000000..12df2785
--- /dev/null
+++ b/rpkid.without_tls/tests/publication-protocol-samples.xml
@@ -0,0 +1,370 @@
+<!-- -*- SGML -*-
+  -  $Id$
+  -
+  - Copyright (C) 2008	American Registry for Internet Numbers ("ARIN")
+  -
+  - Permission to use, copy, modify, and distribute this software for any
+  - purpose with or without fee is hereby granted, provided that the above
+  - copyright notice and this permission notice appear in all copies.
+  -
+  - THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  - AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  - PERFORMANCE OF THIS SOFTWARE.
+  -
+  -
+  - This is a collection of sample publication protocol PDU samples
+  - to use as test cases for the publication protocol RelaxNG schema.
+  -->
+
+<completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint>
+    
+    <msg xmlns="http://www.hactrn.net/uris/rpki/publication-spec/" type="query" version="1">
+	<config action="set">
+	    <bpki_crl>
+		MIIBezBlAgEBMA0GCSqGSIb3DQEBCwUAMCMxITAfBgNVBAMTGFRlc3QgQ2VydGlm
+		aWNhdGUgcHViZCBUQRcNMDgwNjAyMjE0OTQ1WhcNMDgwNzAyMjE0OTQ1WqAOMAww
+		CgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBAFWCWgBl4ljVqX/CHo+RpqYt
+		vmKMnjPVflMXUB7i28RGP4DAq4l7deDU7Q82xEJyE4TXMWDWAV6UG6uUGum0VHWO
+		cj9ohqyiZUGfOsKg2hbwkETm8sAENOsi1yNdyKGk6jZ16aF5fubxQqZa1pdGCSac
+		1/ZYC5sLLhEz3kmz+B9z9mXFVc5TgAh4dN3Gy5ftF8zZAFpDGnS4biCnRVqhGv6R
+		0Lh/5xmii+ZU6kNDhbeMsjJg+ZOmtN+wMeHSIbjiy0WuuaZ3k2xSh0C94anrHBZA
+		vvCRhbazjR0Ef5OMZ5lcllw3uO8IHuoisHKkehy4Y0GySdj98fV+OuiRTH9vt/M=
+	    </bpki_crl>
+	</config>
+    </msg>
+
+    <msg xmlns="http://www.hactrn.net/uris/rpki/publication-spec/" type="reply" version="1">
+	<config action="set"/>
+    </msg>
+
+    <msg xmlns="http://www.hactrn.net/uris/rpki/publication-spec/" type="query" version="1">
+	<config action="get"/>
+    </msg>
+
+    <msg xmlns="http://www.hactrn.net/uris/rpki/publication-spec/" type="reply" version="1">
+	<config action="get">
+	    <bpki_crl>
+		MIIBezBlAgEBMA0GCSqGSIb3DQEBCwUAMCMxITAfBgNVBAMTGFRlc3QgQ2VydGlm
+		aWNhdGUgcHViZCBUQRcNMDgwNjAyMjE0OTQ1WhcNMDgwNzAyMjE0OTQ1WqAOMAww
+		CgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQADggEBAFWCWgBl4ljVqX/CHo+RpqYt
+		vmKMnjPVflMXUB7i28RGP4DAq4l7deDU7Q82xEJyE4TXMWDWAV6UG6uUGum0VHWO
+		cj9ohqyiZUGfOsKg2hbwkETm8sAENOsi1yNdyKGk6jZ16aF5fubxQqZa1pdGCSac
+		1/ZYC5sLLhEz3kmz+B9z9mXFVc5TgAh4dN3Gy5ftF8zZAFpDGnS4biCnRVqhGv6R
+		0Lh/5xmii+ZU6kNDhbeMsjJg+ZOmtN+wMeHSIbjiy0WuuaZ3k2xSh0C94anrHBZA
+		vvCRhbazjR0Ef5OMZ5lcllw3uO8IHuoisHKkehy4Y0GySdj98fV+OuiRTH9vt/M=
+	    </bpki_crl>
+	</config>
+    </msg>
+
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="create" client_handle="3" base_uri="rsync://wombat.invalid/">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</client>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="create" client_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="set" client_handle="3">
+	    <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+	</client>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="set" client_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="get" client_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="get" client_handle="3" base_uri="rsync://wombat.invalid/">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</client>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="list"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="list" client_handle="3">
+	    <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+	</client>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="destroy" client_handle="3"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<client action="destroy" client_handle="3"/>
+    </msg>
+    
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<certificate action="publish" uri="rsync://wombat.invalid/testbed/RIR/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.cer">
+	    MIIE+jCCA+KgAwIBAgIBDTANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhERjRBODAxN0U2
+	    NkE5RTkxNzJFNDYxMkQ4Q0Y0QzgzRjIzOERFMkEzMB4XDTA4MDUyMjE4MDUxMloXDTA4MDUy
+	    NDE3NTQ1M1owMzExMC8GA1UEAxMoOEZCODIxOEYwNkU1MEFCNzAyQTdEOTZEQzhGMENEQ0Q4
+	    MjhGN0YxNzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMeziKp0k5nP7v6SZoNs
+	    XIMQYRgNtC6Fr/9Xm/1yQHomiPqHUk47rHhGojYiK5AhkrwoYhkH4UjJl2iwklDYczXuaBU3
+	    F5qrKlZ4aZnjIxdlP7+hktVpeApL6yuJTUAYeC3UIxnLDVdD6phydZ/FOQluffiNDjzteCCv
+	    oyOUatqt8WB+oND6LToHp028g1YUYLHG6mur0dPdcHOVXLSmUDuZ1HDz1nDuYvIVKjB/MpH9
+	    aW9XeaQ6ZFIlZVPwuuvI2brR+ThH7Gv27GL/o8qFdC300VQfoTZ+rKPGDE8K1cI906BL4kiw
+	    x9z0oiDcE96QCz+B0vsjc9mGaA1jgAxlXWsCAwEAAaOCAhcwggITMB0GA1UdDgQWBBSPuCGP
+	    BuUKtwKn2W3I8M3Ngo9/FzAfBgNVHSMEGDAWgBTfSoAX5mqekXLkYS2M9Mg/I43iozBVBgNV
+	    HR8ETjBMMEqgSKBGhkRyc3luYzovL2xvY2FsaG9zdDo0NDAwL3Rlc3RiZWQvUklSLzEvMzBx
+	    QUYtWnFucEZ5NUdFdGpQVElQeU9ONHFNLmNybDBFBggrBgEFBQcBAQQ5MDcwNQYIKwYBBQUH
+	    MAKGKXJzeW5jOi8vbG9jYWxob3N0OjQ0MDAvdGVzdGJlZC9XT01CQVQuY2VyMBgGA1UdIAEB
+	    /wQOMAwwCgYIKwYBBQUHDgIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwgZsG
+	    CCsGAQUFBwELBIGOMIGLMDQGCCsGAQUFBzAFhihyc3luYzovL2xvY2FsaG9zdDo0NDAwL3Rl
+	    c3RiZWQvUklSL1IwLzEvMFMGCCsGAQUFBzAKhkdyc3luYzovL2xvY2FsaG9zdDo0NDAwL3Rl
+	    c3RiZWQvUklSL1IwLzEvajdnaGp3YmxDcmNDcDlsdHlQRE56WUtQZnhjLm1uZjAaBggrBgEF
+	    BQcBCAEB/wQLMAmgBzAFAgMA/BUwPgYIKwYBBQUHAQcBAf8ELzAtMCsEAgABMCUDAwAKAzAO
+	    AwUAwAACAQMFAcAAAiAwDgMFAsAAAiwDBQDAAAJkMA0GCSqGSIb3DQEBCwUAA4IBAQCEhuH7
+	    jtI2PJY6+zwv306vmCuXhtu9Lr2mmRw2ZErB8EMcb5xypMrNqMoKeu14K2x4a4RPJkK4yATh
+	    M81FPNRsU5mM0acIRnAPtxjHvPME7PHN2w2nGLASRsZmaa+b8A7SSOxVcFURazENztppsolH
+	    eTpm0cpLItK7mNpudUg1JGuFo94VLf1MnE2EqARG1vTsNhel/SM/UvOArCCOBvf0Gz7kSuup
+	    DSZ7qx+LiDmtEsLdbGNQBiYPbLrDk41PHrxdx28qIj7ejZkRzNFw/3pi8/XK281h8zeHoFVu
+	    6ghRPy5dbOA4akX/KG6b8XIx0iwPYdLiDbdWFbtTdPcXBauY
+	</certificate>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<certificate action="publish" uri="rsync://wombat.invalid/testbed/RIR/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.cer"/>
+    </msg>
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<certificate action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.cer"/>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<certificate action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.cer"/>
+    </msg>
+
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<crl action="publish" uri="rsync://wombat.invalid/testbed/RIR/1/30qAF-ZqnpFy5GEtjPTIPyON4qM.crl">
+	    MIIBwzCBrAIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhERjRBODAxN0U2NkE5RTkx
+	    NzJFNDYxMkQ4Q0Y0QzgzRjIzOERFMkEzFw0wODA1MjIxODA0MTZaFw0wODA1MjIxODA1MTZa
+	    MBQwEgIBAhcNMDgwNTIyMTc1ODQwWqAvMC0wHwYDVR0jBBgwFoAU30qAF+ZqnpFy5GEtjPTI
+	    PyON4qMwCgYDVR0UBAMCAQYwDQYJKoZIhvcNAQELBQADggEBAKkM0Fb/pJpHVHWZyjp4wojH
+	    W2KkvA/DFtBiz3moxocSnkDVP3QI19uVvqdC6nH3hJyFmsAMwULR0f1XU/V4j+X+FqYEl6Nv
+	    p8zAEPIB4r8xbEFs7udRwXRAjkJmOQbv9aomF2i+d7jpTFVJxShZWOgsoGEhIy/aktKQrOIR
+	    c4ZDrXpQwXVj2Y7+cGVfQ4gvnPOdlyLcnNovoegazATvA3EcidBNPWRg7XTCz0LVBEB7JgPd
+	    nNyXRg35HdMEHBl7U9uUQJXP7S02oaQ1ehNDMfaJPgBBpQtAnM1lIzJfevd9+e4ywGsRpxAV
+	    8wxTXSPd1jwuKtS0kwrgsrQ8Ya85xUE=
+	</crl>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<crl action="publish" uri="rsync://wombat.invalid/testbed/RIR/1/30qAF-ZqnpFy5GEtjPTIPyON4qM.crl"/>
+    </msg>
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<crl action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/1/30qAF-ZqnpFy5GEtjPTIPyON4qM.crl"/>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<crl action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/1/30qAF-ZqnpFy5GEtjPTIPyON4qM.crl"/>
+    </msg>
+
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<manifest action="publish" uri="rsync://wombat.invalid/testbed/RIR/R0/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.mnf">
+	    MIIHCgYJKoZIhvcNAQcCoIIG+zCCBvcCAQMxDTALBglghkgBZQMEAgEwggEeBgsqhkiG9w0B
+	    CRABGqCCAQ0EggEJMIIBBQIBEhgPMjAwODA1MjIxODA1MTVaGA8yMDA4MDUyMjE4MDYxNVoG
+	    CWCGSAFlAwQCATCB0jBEFh9ZbTVUTzRJYnlDb0pNZ3E2R2o4dG41Mng5U0UuY2VyAyEA4L8Z
+	    WMyuhOx+o6kUfsRR++QjSaRaATy4UOeVtjvZVqYwRBYfWnRxbjB3NEVFbU9hclAzQmd1SUY3
+	    MDhhNTM4LmNlcgMhAGQI1gYJotxWmwzcmpLNFZJ656uWOjcPYANlbNz80xm8MEQWH2xxa1Vx
+	    RHEwMDBESW9ZVjlybXdLTGdrN2F6by5jZXIDIQB7jRAEpkPvc4s4PX9vDvnTifj3BIE145FO
+	    1ne2kEejVqCCBBEwggQNMIIC9aADAgECAgEFMA0GCSqGSIb3DQEBCwUAMDMxMTAvBgNVBAMT
+	    KDhGQjgyMThGMDZFNTBBQjcwMkE3RDk2REM4RjBDRENEODI4RjdGMTcwHhcNMDgwNTIyMTc1
+	    NzQ5WhcNMDgwNTI0MTc1NDUzWjAzMTEwLwYDVQQDEyhERkRBMjMyMUJENEVCMDNFQTE1RkUy
+	    N0NGRkRGMEFGRkU1QjBFNjY4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2/Gk
+	    AHW5pDqye0+TvUp7sl0rVgmTfeHpVp18ypxvuovogVJgkjEtBEikfaFU0646wYD6JM6IJFJX
+	    lWLWd7bVmhkWViKuZL0VmT2wpUToNHCLUGUQUVVX8R7oSHFdTArv2AqH+6yt0LmczDH1y2M6
+	    2Tgkz9wZ9ryyuPx3VX4PkHzUMlkGFICj1fvyXkcAu8jBaxR9UME1c413TPaMi6lMh1HUmtVN
+	    LJMP5+/SnwEAW/Z3dPClCFIgQXK3nAKPVzAIwADEiqhK7cSchhO7ikI1CVt0XzG4n7oaILc3
+	    Hq/DAxyiutw5GlkUlKPri2YJzJ3+H4P+TveSa/b02fVA5csm/QIDAQABo4IBKjCCASYwHQYD
+	    VR0OBBYEFN/aIyG9TrA+oV/ifP/fCv/lsOZoMB8GA1UdIwQYMBaAFI+4IY8G5Qq3AqfZbcjw
+	    zc2Cj38XMFgGA1UdHwRRME8wTaBLoEmGR3JzeW5jOi8vbG9jYWxob3N0OjQ0MDAvdGVzdGJl
+	    ZC9SSVIvUjAvMS9qN2doandibENyY0NwOWx0eVBETnpZS1BmeGMuY3JsMGAGCCsGAQUFBwEB
+	    BFQwUjBQBggrBgEFBQcwAoZEcnN5bmM6Ly9sb2NhbGhvc3Q6NDQwMC90ZXN0YmVkL1JJUi8x
+	    L2o3Z2hqd2JsQ3JjQ3A5bHR5UEROellLUGZ4Yy5jZXIwGAYDVR0gAQH/BA4wDDAKBggrBgEF
+	    BQcOAjAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBADpsE9HfgVTgmX1WeJTE
+	    fm87CXuOoGH85RFiAngSt5kR4gYCyadklOZ7Eta+ERUZVu4tcKO6sJOTuHPfVrAvR0VpgH+j
+	    PvXboYWSfwJdi00BC28ScrVM2zarA7B10+J6Oq8tbFlAyVBkrbuPet/axmndBtGWhrBTynGl
+	    nc/5L371Lxy6CrOYqXO0Qx3SrOKaailAe3zTIpHQeACqnPdL00zIBw/hVy/VNaH1wy+FmhAz
+	    TsmsQUrMyovJcu/ry5w0KHlP8BTnqfykikCWR+Lw0VQHmpJGAbtrmsOeIbfLY1zl7A81lDAl
+	    AG/ZH1DUdDOUIXMLHWur+D2rwjp7RL16LHYxggGqMIIBpgIBA4AU39ojIb1OsD6hX+J8/98K
+	    /+Ww5mgwCwYJYIZIAWUDBAIBoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqG
+	    SIb3DQEJBTEPFw0wODA1MjIxODA1MTVaMC8GCSqGSIb3DQEJBDEiBCBj/GjEQw3LgKPf5DTz
+	    8eu1fcp6/cQjqqne6ZqFkF42azANBgkqhkiG9w0BAQEFAASCAQBOY0uHNMwy/o1nFANSgha5
+	    PZxt8fz+wTrbeomCb+lxqQKq1clcSiQORVGc8NmqC8sS5OR3eTw/3qnK9yPHxz2UQ4hn1pBa
+	    +Zy5veM61qMaXCw6w98EyNcvUfA1AkezAjkabfHQDs3o4Ezh49thXXyRcBoF+O6Lmi+LZbT2
+	    4jvfFbaXW9zsb6/DaoDkeHnlk+YYgfSP4wOnkK5uqxtDW8QpMPq3GGdIp0oJDkzEdj7VsWIL
+	    9JP2mxxL8fTPVUyAPOmURYwYDXqhke2O9eVDiCYhrEfB8/84Rint4Cj8n5aCujnAtqtwxHpD
+	    0NRYO/V1MjhG+ARy1vRH1Dm0r92RBam3
+	</manifest>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<manifest action="publish" uri="rsync://wombat.invalid/testbed/RIR/R0/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.mnf"/>
+    </msg>
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<manifest action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/R0/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.mnf"/>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<manifest action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/R0/1/j7ghjwblCrcCp9ltyPDNzYKPfxc.mnf"/>
+    </msg>
+
+    <!-- === -->
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<roa action="publish" uri="rsync://wombat.invalid/testbed/RIR/R0/1/lqkUqDq000DIoYV9rmwKLgk7azo.roa">
+	    MIIGmwYJKoZIhvcNAQcCoIIGjDCCBogCAQMxDTALBglghkgBZQMEAgEwKgYLKoZIhvcNAQkQ
+	    ARigGwQZMBcCAgKaMBEwDwQCAAEwCTAHAwUACgMALKCCBJgwggSUMIIDfKADAgECAgEJMA0G
+	    CSqGSIb3DQEBCwUAMDMxMTAvBgNVBAMTKDhGQjgyMThGMDZFNTBBQjcwMkE3RDk2REM4RjBD
+	    RENEODI4RjdGMTcwHhcNMDgwNTIyMTc1ODI0WhcNMDgwNTI0MTc1NDUzWjAzMTEwLwYDVQQD
+	    Eyg5NkE5MTRBODNBQjREMzQwQzhBMTg1N0RBRTZDMEEyRTA5M0I2QjNBMIIBIjANBgkqhkiG
+	    9w0BAQEFAAOCAQ8AMIIBCgKCAQEApoK50BjW5bcF4gsdaYhndtVADZvQk3RCsvuqDElF6uLi
+	    9BYQq/NHyDOIMyJtvCmzjdv3Y135n1sNO7YvssqHlt7dMfCQTD5ND1GpFnQLdWP7stWM5AbO
+	    nJV6+PtDITUA/QHOli7Do0YCUgR6G+1QJsMu0DK+TRSzBJ6WP7WIYOBOOg3y/NKc1rkWhS1Q
+	    dcQepbHgQYZHzzpjNDR6+oYVuhuUEWx1P6O4pv/p+tpE0SDua7jBjMywIYHkPQBecf2IX1RU
+	    WNojB9dJlnRx5YUUneP2SvF2MrmdDbclgzwhf6alqD2OjiMuoBOG8yeTKcuhzCMnrFAklbst
+	    6x3Rnq9BswIDAQABo4IBsTCCAa0wHQYDVR0OBBYEFJapFKg6tNNAyKGFfa5sCi4JO2s6MB8G
+	    A1UdIwQYMBaAFI+4IY8G5Qq3AqfZbcjwzc2Cj38XMFgGA1UdHwRRME8wTaBLoEmGR3JzeW5j
+	    Oi8vbG9jYWxob3N0OjQ0MDAvdGVzdGJlZC9SSVIvUjAvMS9qN2doandibENyY0NwOWx0eVBE
+	    TnpZS1BmeGMuY3JsMGAGCCsGAQUFBwEBBFQwUjBQBggrBgEFBQcwAoZEcnN5bmM6Ly9sb2Nh
+	    bGhvc3Q6NDQwMC90ZXN0YmVkL1JJUi8xL2o3Z2hqd2JsQ3JjQ3A5bHR5UEROellLUGZ4Yy5j
+	    ZXIwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAOBgNVHQ8BAf8EBAMCB4AwYwYIKwYBBQUH
+	    AQsEVzBVMFMGCCsGAQUFBzALhkdyc3luYzovL2xvY2FsaG9zdDo0NDAwL3Rlc3RiZWQvUklS
+	    L1IwLzEvbHFrVXFEcTAwMERJb1lWOXJtd0tMZ2s3YXpvLnJvYTAgBggrBgEFBQcBBwEB/wQR
+	    MA8wDQQCAAEwBwMFAAoDACwwDQYJKoZIhvcNAQELBQADggEBAL8iHwsyGOYhhIf3nVuL361y
+	    TOJSP8SR0mtQLHULPl+GkYk+5MRNWtL8ucTXFvniYJtOCXEGGEIO9eDXvkQIXQSz/qbF9URQ
+	    fuf38ghRza257syVhal6UHTgCFYuRIO9CUjcU1vkWUxH05BBIHlYdtlIQbAG/mRsCPCEgSmG
+	    bbQaomGlUOqmJMlKxLLcoAtz2vDrwVotgHyfS5h2mgINFjnlLcNLTci+sfs7/aQAkDYx7K98
+	    se/ZlMorvGkFNhHoOTcGIrWkYsfkbTygVwWRm278PaB3o4449Kvsg/gb8BZeHXRs68cr5Mcf
+	    jP7Q6jeypjTgDBnwb1yzoJIKWszFuSgxggGqMIIBpgIBA4AUlqkUqDq000DIoYV9rmwKLgk7
+	    azowCwYJYIZIAWUDBAIBoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEYMBwGCSqGSIb3
+	    DQEJBTEPFw0wODA1MjIxNzU4MjRaMC8GCSqGSIb3DQEJBDEiBCDCyf9v9Wed515TRp2WwnyM
+	    1rk6dB///X+aqIym2e9jdTANBgkqhkiG9w0BAQEFAASCAQAFvzrHeRPW+wn4WSyoyBEq0zKS
+	    Cyh5tu1qTR0NHs6Rr/p8Pk81P1HQLND/U+znJZKLWlO2niEHUXPIicPDYchbj8ApH9VxKA+1
+	    lCWllOzFAsYyZFr3/VNs9pVp2eT4F9eEYBrBVDSNrD72MMTlWm1T5MEXqltTJJOCKzUEX96x
+	    91iW6A+4erop7S8hpCnxqkTin4bFVreqYcGc4CC4bh+L9pPqJnURcEk7Qeu/WEHQBm38voB4
+	    S11qRZNrJMQ99oiJR7hXDIBm66HjGqoUL2gPCfpgJEVVnM9pVv2k889z4eTTck2Qj54gga2W
+	    Xkvw4Je420aDx88s9T2+PqXcbZ4g
+	</roa>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<roa action="publish" uri="rsync://wombat.invalid/testbed/RIR/R0/1/lqkUqDq000DIoYV9rmwKLgk7azo.roa"/>
+    </msg>
+
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<roa action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/R0/1/lqkUqDq000DIoYV9rmwKLgk7azo.roa"/>
+    </msg>
+
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<roa action="withdraw" uri="rsync://wombat.invalid/testbed/RIR/R0/1/lqkUqDq000DIoYV9rmwKLgk7azo.roa"/>
+    </msg>
+
+    <!-- === -->
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<report_error error_code="your_hair_is_on_fire">text string</report_error>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+	<report_error error_code="your_hair_is_on_fire"/>
+    </msg>
+    
+</completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint>
diff --git a/rpkid.without_tls/tests/rcynic.conf b/rpkid.without_tls/tests/rcynic.conf
new file mode 100644
index 00000000..44661dbd
--- /dev/null
+++ b/rpkid.without_tls/tests/rcynic.conf
@@ -0,0 +1,13 @@
+# $Id$
+#
+# rcynic configuration for looking at yamltest results.
+
+[rcynic]
+xml-summary		= rcynic.xml
+jitter			= 0
+use-links		= yes
+use-syslog		= no
+use-stderr		= yes
+log-level		= log_debug
+
+trust-anchor		= yamltest.dir/RIR/publication/root.cer
diff --git a/rpkid.without_tls/tests/rootd.yaml b/rpkid.without_tls/tests/rootd.yaml
new file mode 100644
index 00000000..2ee5dcd4
--- /dev/null
+++ b/rpkid.without_tls/tests/rootd.yaml
@@ -0,0 +1,24 @@
+# $Id$
+---
+version:                1
+posturl:                https://localhost:4401/up-down/1
+recipient-id:           "rootd"
+sender-id:              "RIR"
+
+cms-cert-file:          RIR-RPKI-EE.cer
+cms-key-file:           RIR-RPKI-EE.key
+cms-ca-cert-file:       rootd-TA.cer
+cms-cert-chain-file:    [ RIR-RPKI-CA.cer ]
+
+ssl-cert-file:          RIR-RPKI-EE.cer
+ssl-key-file:           RIR-RPKI-EE.key
+ssl-ca-cert-file:       rootd-TA.cer
+
+requests:
+  list:
+    type:               list
+  issue:
+    type:               issue
+    class:              1
+    sia:
+      -                 rsync://localhost:4400/testbed/RIR/
diff --git a/rpkid.without_tls/tests/rpki b/rpkid.without_tls/tests/rpki
new file mode 120000
index 00000000..8d289d0b
--- /dev/null
+++ b/rpkid.without_tls/tests/rpki
@@ -0,0 +1 @@
+../rpki
\ No newline at end of file
diff --git a/rpkid.without_tls/tests/smoketest.1.yaml b/rpkid.without_tls/tests/smoketest.1.yaml
new file mode 100644
index 00000000..4b4ad02d
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.1.yaml
@@ -0,0 +1,80 @@
+# $Id$
+
+# Copyright (C) 2009  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+#
+# Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+name:           RIR
+crl_interval:   5m
+regen_margin:   2m
+valid_for:      2d
+kids:
+  - name: R0
+    kids:
+      - name: Alice
+        ipv4: 192.0.2.1-192.0.2.33
+        asn:  64533
+        roa_request:
+          - asn: 42
+            ipv4: 192.0.2.32/32
+      - name: Bob
+        ipv4: 192.0.2.44-192.0.2.100
+    ipv4: 10.3.0.0/16
+    roa_request:
+      - asn: 666
+        ipv4: 10.3.0.44/32
+---
+- shell set -x; cd ../../../rtr-origin && python rtr-origin.py --cronjob ../../rpkid/smoketest.dir/rcynic-data/authenticated && python rtr-origin.py --show
+---
+- name: R0
+  rekey:
+---
+- name: R0
+  revoke:
+---
+- name: Alice
+  valid_add:   10
+- name: R0
+  roa_request_add:
+    - asn: 17
+      ipv4: 10.3.0.1/32, 10.0.0.44/32
+---
+- shell set -x; cd ../../../rtr-origin && python rtr-origin.py --cronjob ../../rpkid/smoketest.dir/rcynic-data/authenticated && python rtr-origin.py --show
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
diff --git a/rpkid.without_tls/tests/smoketest.2.yaml b/rpkid.without_tls/tests/smoketest.2.yaml
new file mode 100644
index 00000000..0cdec650
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.2.yaml
@@ -0,0 +1,126 @@
+# $Id$
+
+# Copyright (C) 2009  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+#
+# Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+name:           RIR
+valid_for:      2d
+kids:
+  - name: R0
+    kids:
+      - name: Alice
+        hosted_by: R0
+        ipv4: 192.0.2.1-192.0.2.33
+        asn:  64533
+      - name: Bob
+        hosted_by: R0
+        ipv4: 192.0.2.44-192.0.2.100
+  - name: R1
+    kids:
+      - name: Carol
+        hosted_by: R1
+        ipv6: 2001:db8::44-2001:db8::100
+      - name: Dave
+        hosted_by: R1
+        ipv6: 2001:db8::10:0:44/128
+        asn:  64544
+  - name: R2
+    kids:
+      - name: Elena
+        hosted_by: R2
+        ipv4: 10.0.0.0/24
+        ipv6: 2001:db8::a00:0/120
+      - name: Frank
+        hosted_by: R2
+        ipv4: 10.3.0.0/24
+        ipv6: 2001:db8::a03:0/120
+  - name: R3
+    kids:
+      - name: Ginny
+        hosted_by: R3
+        asn:  64534-64540
+      - name: Harry
+        hosted_by: R3
+        asn:  666-677
+  - name: R4
+    kids:
+      - name: Ilse
+        hosted_by: R4
+        ipv4: 10.3.0.0/16
+      - name: Jack
+        hosted_by: R4
+        ipv4: 10.2.0.0/16
+  - name: R5
+    kids:
+      - name: Kari
+        hosted_by: R5
+        asn:  222-233
+      - name: Leon
+        hosted_by: R5
+        asn:  244-255
+  - name: R6
+    kids:
+      - name: Mary
+        hosted_by: R6
+        ipv4: 10.77.0.0/16
+      - name: Neal
+        hosted_by: R6
+        ipv4: 10.66.0.0/16
+  - name: R7
+    kids:
+      - name: Olga
+        hosted_by: R7
+        ipv4: 10.88.0.0/16
+      - name: Piet
+        hosted_by: R7
+        ipv4: 10.99.0.0/16
+  - name: R8
+    kids:
+      - name: Qi
+        hosted_by: R8
+        asn:  111-122
+      - name: Rex
+        hosted_by: R8
+        asn:  333-344
+  - name: R9
+    kids:
+      - name: Sandra
+        hosted_by: R9
+        asn:  555-566
+      - name: Thad
+        hosted_by: R9
+        asn:  577-588
+---
+- name: Alice
+  add_as: 33
+---
+- name: Alice
+  sub_as: 33
+---
+- name: Alice
+  valid_for: 365d
diff --git a/rpkid.without_tls/tests/smoketest.3.yaml b/rpkid.without_tls/tests/smoketest.3.yaml
new file mode 100644
index 00000000..0885e2f7
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.3.yaml
@@ -0,0 +1,71 @@
+# $Id$
+
+# Copyright (C) 2009-2010  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+#
+# Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+name:           RIR
+crl_interval:   2d
+regen_margin:   1h
+valid_for:      90d
+kids:
+  - name: R0
+    kids:
+      - name: Alice
+        ipv4: 192.0.2.0-192.0.2.33
+        ipv6: 2002:0a00::/32
+        asn:  64533
+        roa_request:
+          - asn: 42
+            ipv4: 192.0.2.0/30-32,192.0.2.32/32
+            ipv6: 2002:0a00::/32-128
+      - name: Bob
+        ipv4: 192.0.2.44-192.0.2.100
+    ipv4: 10.3.0.0/16
+    roa_request:
+      - asn: 666
+        ipv4: 10.3.0.0/23
+---
+#- shell find publication -type f -name '*.roa' -print -exec ../../../utils/print_roa/print_roa {} \;
+#- shell find publication -type f -name '*.mnf' -print -exec ../../../utils/print_manifest/print_manifest {} \;
+#---
+#- shell find publication -type f -name '*.roa' -print -exec ../../../utils/print_roa/print_roa {} \;
+#- shell find publication -type f -name '*.mnf' -print -exec ../../../utils/print_manifest/print_manifest {} \;
+#---
+- shell set -x; cd ../../../rtr-origin && python rtr-origin.py --cronjob ../../rpkid/smoketest.dir/rcynic-data/authenticated && python rtr-origin.py --show
+---
+- name: Alice
+  roa_request_del:
+    - asn: 42
+      ipv4: 192.0.2.0/30-32,192.0.2.32/32
+      ipv6: 2002:0a00::/32-128
+  roa_request_add:
+    - asn: 666
+      ipv4: 192.0.2.0/30-32,192.0.2.32/32
+      ipv6: 2002:0a00::/32-128
+---
+- shell set -x; cd ../../../rtr-origin && python rtr-origin.py --cronjob ../../rpkid/smoketest.dir/rcynic-data/authenticated && python rtr-origin.py --show
diff --git a/rpkid.without_tls/tests/smoketest.4.yaml b/rpkid.without_tls/tests/smoketest.4.yaml
new file mode 100644
index 00000000..ee447daa
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.4.yaml
@@ -0,0 +1,28 @@
+# $Id$
+
+# Copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# This is a test of what happens when certificates go missing in action.
+
+name:           RIR
+valid_for:      -10
+kids:
+  - name: R0
+    kids:
+      - name: Alice
+        ipv4: 192.0.2.1-192.0.2.33
+        asn:  64533
+---
+---
diff --git a/rpkid.without_tls/tests/smoketest.5.yaml b/rpkid.without_tls/tests/smoketest.5.yaml
new file mode 100644
index 00000000..c6304dfc
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.5.yaml
@@ -0,0 +1,65 @@
+# $Id$
+
+# Copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+rootd:
+  lifetime:     2m30s
+name:           RIR
+crl_interval:   1m30s
+regen_margin:   2m
+valid_for:      1h
+kids:
+  - name: R0
+    kids:
+      - name: Alice
+        ipv4: 192.0.2.1-192.0.2.33
+        asn:  64533
+        roa_request:
+          - asn: 42
+            ipv4: 192.0.2.32/32
+      - name: Bob
+        ipv4: 192.0.2.44-192.0.2.100
+    ipv4: 10.3.0.0/16
+    roa_request:
+      - asn: 666
+        ipv4: 10.3.0.44/32
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
+---
+- sleep 30
diff --git a/rpkid.without_tls/tests/smoketest.6.yaml b/rpkid.without_tls/tests/smoketest.6.yaml
new file mode 100644
index 00000000..dbcc06e3
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.6.yaml
@@ -0,0 +1,54 @@
+# $Id$
+
+# Copyright (C) 2009  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+name:           RIR
+valid_for:      2d
+kids:
+  - name: Alice
+    hosted_by: RIR
+    kids:
+      - name: Betty
+        hosted_by: RIR
+        kids:
+          - name: Carol
+            hosted_by: RIR
+            kids:
+              - name: Dana
+                hosted_by: RIR
+                kids:
+                  - name: Eve
+                    hosted_by: RIR
+                    kids:
+                      - name: Fiona
+                        hosted_by: RIR
+                        ipv4: 192.0.2.1-192.0.2.33
+                        asn:  64533
+                        ipv6: 2001:db8::44-2001:db8::100
+                        roa_request:
+                          - asn: 64533
+                            ipv6: 2001:db8::80/121
+---
+- name: Fiona
+  add_as: 33
+---
+- name: Fiona
+  sub_as: 33
+---
+---
+---
+---
+#- name: Fiona
+#  valid_for: 365d
diff --git a/rpkid.without_tls/tests/smoketest.7.yaml b/rpkid.without_tls/tests/smoketest.7.yaml
new file mode 100644
index 00000000..6fee5bac
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.7.yaml
@@ -0,0 +1,72 @@
+# $Id$
+
+# Copyright (C) 2009  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# Test configuration to generate some initial ROAs for Pradosh to use
+# in testing his code, until Randy has the live testbed set up.
+
+# Python code to remove overlaps in a set of prefixes (needed to take
+# something like this peval output and feed it into smoketest.py):
+#
+#   import rpki.resource_set
+#
+#   r = rpki.resource_set.resource_set_ipv4()
+#
+#   for p in prefixes:
+#     r = r.union(rpki.resource_set.resource_set_ipv4(p))
+#
+#   print r
+#
+#
+# where "prefixes" is a sequence of prefixes in text form, eg, what
+# you'd get if you applied .split(", ") to the peval output below.
+
+
+# ran.psg.com:/usr/home/randy> peval as3130
+# ({198.180.152.0/24, 198.180.153.0/24, 198.180.152.0/25, 198.180.152.128/25, 198.180.150.0/24, 198.180.151.0/24, 198.133.206.0/24, 192.83.230.0/24, 147.28.0.0/16, 147.28.128.0/17, 147.28.128.0/18, 147.28.192.0/18, 147.28.192.0/19, 147.28.192.0/20, 147.28.192.0/21, 147.28.192.0/22, 147.28.192.0/23, 147.28.192.0/24, 147.28.192.0/25, 147.28.192.0/26, 147.28.128.0/19, 147.28.128.0/20, 147.28.128.0/21, 147.28.128.0/22, 147.28.128.0/23, 147.28.128.0/24, 147.28.128.0/25, 147.28.128.0/26})
+# 
+# ran.psg.com:/usr/home/randy> peval as2914
+# ({216.167.0.0/17, 216.105.240.0/24, 216.44.0.0/16, 216.42.0.0/16, 213.198.0.0/17, 213.130.32.0/19, 212.119.0.0/19, 212.105.160.0/19, 211.130.96.0/19, 211.1.32.0/19, 211.1.60.0/22, 211.1.48.0/23, 211.1.32.0/20, 210.175.160.0/19, 209.243.96.0/20, 209.243.70.0/23, 209.238.0.0/16, 209.227.0.0/17, 209.207.128.0/17, 209.189.0.0/17, 209.170.0.0/18, 209.168.0.0/17, 209.162.64.0/18, 209.157.0.0/16, 209.139.128.0/18, 209.139.0.0/17, 209.130.0.0/17, 209.124.0.0/19, 209.112.96.0/20, 209.107.64.0/19, 209.107.0.0/18, 209.75.0.0/16, 209.70.0.0/16, 209.69.0.0/16, 209.59.32.0/19, 209.57.0.0/16, 209.43.128.0/17, 209.41.0.0/18, 209.39.0.0/16, 209.24.0.0/16, 209.21.0.0/18, 208.55.0.0/16, 207.241.0.0/17, 207.207.128.0/19, 207.206.0.0/17, 207.201.128.0/18, 207.199.0.0/17, 207.198.128.0/17, 207.197.128.0/17, 207.196.0.0/17, 207.195.240.0/20, 207.159.0.0/18, 207.158.192.0/18, 207.156.128.0/17, 207.153.128.0/17, 207.152.64.0/18, 207.150.128.0/19, 207.150.0.0/17, 207.137.0.0/16, 207.126.254.0/23, 207.126.240.0/21, 207.111.64.0/18, 207.97.0.0/17, 207.91.64.0/18, 207.71.64.0/18, 207.67.128.0/17, 207.58.0.0/17, 207.56.0.0/15, 207.55.192.0/19, 207.55.128.0/18, 207.33.0.0/16, 207.32.64.0/18, 207.31.192.0/18, 207.22.64.0/18, 207.21.128.0/18, 207.21.0.0/17, 207.20.0.0/16, 206.252.0.0/19, 206.239.0.0/16, 206.222.32.0/19, 206.213.64.0/18, 206.197.192.0/24, 206.197.81.0/24, 206.184.0.0/16, 206.183.192.0/19, 206.169.194.0/24, 206.169.195.0/24, 206.169.186.0/24, 206.169.41.0/24, 206.166.128.0/18, 206.163.192.0/19, 206.163.128.0/18, 206.163.0.0/17, 206.86.0.0/16, 206.82.32.0/19, 206.80.32.0/19, 206.68.0.0/15, 206.58.0.0/16, 206.55.0.0/18, 206.54.0.0/18, 206.52.0.0/16, 206.50.0.0/16, 206.14.0.0/16, 205.238.0.0/18, 205.212.0.0/16, 205.157.128.0/20, 205.153.56.0/22, 205.149.160.0/19, 205.146.0.0/16, 204.247.0.0/16, 204.245.128.0/17, 204.233.0.0/16, 204.227.160.0/19, 204.200.0.0/14, 204.194.176.0/21, 204.170.0.0/15, 204.156.128.0/19, 204.156.0.0/19, 204.142.0.0/15, 204.141.0.0/16, 204.108.0.0/23, 204.75.146.0/24, 204.68.197.0/24, 204.62.232.0/24, 204.57.32.0/19, 204.42.0.0/16, 204.0.0.0/14, 204.0.43.0/24, 203.215.136.0/23, 203.208.120.0/21, 203.208.120.0/22, 203.208.124.0/22, 203.208.120.0/23, 203.208.122.0/23, 203.208.124.0/23, 203.208.126.0/23, 203.208.120.0/24, 203.208.121.0/24, 203.208.122.0/24, 203.208.123.0/24, 203.208.124.0/24, 203.208.125.0/24, 203.208.126.0/24, 203.208.127.0/24, 203.208.80.0/21, 203.208.80.0/22, 203.208.84.0/22, 203.208.80.0/23, 203.208.82.0/23, 203.208.84.0/23, 203.208.86.0/23, 203.208.80.0/24, 203.208.81.0/24, 203.208.82.0/24, 203.208.83.0/24, 203.208.84.0/24, 203.208.85.0/24, 203.208.86.0/24, 203.208.87.0/24, 203.205.112.0/20, 203.131.240.0/20, 203.131.248.0/21, 203.105.64.0/19, 203.105.80.0/21, 203.105.72.0/22, 203.78.192.0/20, 203.33.3.0/24, 203.32.132.0/24, 203.20.71.0/24, 203.12.225.0/24, 202.237.244.0/24, 202.163.134.0/24, 202.163.132.0/24, 202.163.128.0/22, 202.163.128.0/24, 202.163.129.0/24, 202.163.130.0/24, 202.163.131.0/24, 202.153.208.0/20, 202.69.224.0/20, 202.68.64.0/20, 202.68.64.0/21, 202.68.72.0/21, 202.68.64.0/22, 202.68.68.0/22, 202.68.72.0/22, 202.68.76.0/22, 202.68.64.0/23, 202.68.66.0/23, 202.68.68.0/23, 202.68.70.0/23, 202.68.72.0/23, 202.68.74.0/23, 202.68.76.0/23, 202.68.78.0/23, 202.68.64.0/24, 202.68.65.0/24, 202.68.66.0/24, 202.68.67.0/24, 202.68.68.0/24, 202.68.69.0/24, 202.68.70.0/24, 202.68.71.0/24, 202.68.72.0/24, 202.68.73.0/24, 202.68.74.0/24, 202.68.75.0/24, 202.68.76.0/24, 202.68.77.0/24, 202.68.78.0/24, 202.68.79.0/24, 202.47.16.0/20, 202.23.124.0/24, 200.15.0.0/16, 199.245.16.0/20, 199.240.0.0/16, 199.236.0.0/14, 199.234.0.0/16, 199.224.0.0/20, 199.217.128.0/17, 199.212.0.0/24, 199.201.197.0/24, 199.184.226.0/24, 199.184.212.0/24, 199.164.210.0/24, 199.103.128.0/17, 199.73.40.0/23, 199.73.32.0/21, 199.4.64.0/18, 198.252.194.0/23, 198.247.0.0/16, 198.232.16.0/24, 198.172.0.0/15, 198.170.0.0/15, 198.170.208.0/24, 198.138.0.0/15, 198.106.0.0/15, 198.104.0.0/16, 198.88.0.0/16, 198.87.0.0/16, 198.84.16.0/20, 198.66.0.0/16, 198.64.0.0/15, 198.63.0.0/16, 195.234.244.0/22, 192.220.0.0/16, 192.217.0.0/16, 192.204.0.0/16, 192.195.85.0/24, 192.159.82.0/24, 192.147.176.0/22, 192.147.175.0/24, 192.147.160.0/21, 192.108.74.0/23, 192.102.248.0/24, 192.80.12.0/22, 192.67.240.0/23, 192.67.236.0/22, 192.41.219.0/24, 192.41.171.0/24, 192.11.188.0/24, 170.253.0.0/16, 170.250.0.0/16, 170.249.64.0/19, 170.249.0.0/19, 168.143.0.0/16, 165.254.0.0/16, 164.162.0.0/16, 161.58.0.0/16, 159.230.128.0/20, 159.230.138.0/24, 157.238.0.0/16, 157.107.0.0/16, 154.37.0.0/16, 140.174.0.0/16, 131.103.0.0/16, 130.94.0.0/16, 130.94.60.0/24, 129.250.0.0/16, 129.192.196.0/22, 129.7.136.0/24, 128.242.0.0/16, 128.241.0.0/16, 128.241.83.0/29, 128.121.0.0/16, 125.56.144.0/21, 125.56.152.0/21, 124.40.0.0/18, 124.40.0.0/19, 124.40.32.0/19, 122.255.80.0/20, 120.29.160.0/19, 120.29.144.0/21, 119.161.104.0/21, 118.215.168.0/21, 118.215.136.0/21, 118.215.64.0/21, 118.214.208.0/21, 118.214.216.0/21, 117.104.128.0/19, 117.104.64.0/18, 117.103.176.0/20, 116.51.16.0/21, 96.17.167.0/24, 96.17.157.0/24, 96.17.155.0/24, 96.17.32.0/20, 96.16.224.0/21, 96.16.232.0/21, 96.16.240.0/21, 96.16.248.0/21, 96.6.224.0/20, 96.6.176.0/20, 96.6.144.0/20, 96.6.40.0/24, 91.186.160.0/19, 89.238.138.0/24, 83.231.128.0/17, 82.112.96.0/19, 81.93.208.0/20, 81.93.176.0/20, 81.93.189.0/24, 81.25.192.0/20, 81.20.64.0/20, 81.19.96.0/20, 80.68.16.0/21, 72.247.200.0/21, 72.247.128.0/21, 72.247.125.0/24, 72.247.56.0/22, 72.247.52.0/22, 72.246.32.0/21, 69.192.96.0/20, 69.192.32.0/20, 69.192.48.0/20, 69.55.56.0/23, 69.41.176.0/21, 69.41.168.0/21, 69.41.166.0/23, 69.41.165.0/24, 69.41.160.0/24, 66.249.144.0/24, 66.187.28.0/24, 64.7.64.0/19, 62.73.160.0/19, 61.251.96.0/20, 61.213.160.0/19, 61.213.144.0/20, 61.200.80.0/20, 61.200.80.0/21, 61.200.88.0/21, 61.120.144.0/20, 61.120.144.0/21, 61.120.152.0/21, 61.114.112.0/20, 61.114.120.0/21, 61.114.112.0/22, 61.58.32.0/20, 61.28.200.0/24, 61.28.199.0/24, 60.254.153.0/24, 60.254.132.0/22, 59.151.184.0/22})
+# 
+# ran.psg.com:/usr/home/randy> peval as1239
+# ({207.7.0.0/18, 204.248.180.0/25, 204.241.122.0/24, 204.217.244.0/24, 203.98.192.0/19, 193.188.96.0/23, 192.77.142.0/24, 192.31.36.0/24, 192.31.32.0/22, 192.23.224.0/21, 192.23.208.0/20, 192.23.76.0/24, 192.23.75.0/24, 163.183.0.0/16, 157.245.70.0/24, 134.32.0.0/16, 129.87.0.0/16, 85.237.96.0/19, 72.246.128.0/20, 65.168.150.0/23, 65.168.149.0/24, 63.172.252.0/22, 63.171.143.128/25, 63.169.52.128/25})
+# 
+# ran.psg.com:/usr/home/randy> peval as701 
+# ({208.91.236.0/22, 203.33.196.0/24, 203.27.251.0/24, 198.80.148.0/24, 198.80.131.0/24, 157.130.103.144/30, 140.222.224.0/24, 65.243.171.0/24, 63.122.162.212/30, 63.116.191.0/24, 63.81.136.0/24, 17.0.0.0/8, 17.128.0.0/9})
+
+
+name:           Alice
+
+valid_for:      2d
+
+ipv4:           17.0.0.0/8,59.151.184.0/22,60.254.132.0/22,60.254.153.0/24,61.28.199.0-61.28.200.255,61.58.32.0/20,61.114.112.0/20,61.120.144.0/20,61.200.80.0/20,61.213.144.0-61.213.191.255,61.251.96.0/20,62.73.160.0/19,63.81.136.0/24,63.116.191.0/24,63.122.162.212/30,63.169.52.128/25,63.171.143.128/25,63.172.252.0/22,64.7.64.0/19,65.168.149.0-65.168.151.255,65.243.171.0/24,66.187.28.0/24,66.249.144.0/24,69.41.160.0/24,69.41.165.0-69.41.183.255,69.55.56.0/23,69.192.32.0/19,69.192.96.0/20,72.246.32.0/21,72.246.128.0/20,72.247.52.0-72.247.59.255,72.247.125.0/24,72.247.128.0/21,72.247.200.0/21,80.68.16.0/21,81.19.96.0/20,81.20.64.0/20,81.25.192.0/20,81.93.176.0/20,81.93.208.0/20,82.112.96.0/19,83.231.128.0/17,85.237.96.0/19,89.238.138.0/24,91.186.160.0/19,96.6.40.0/24,96.6.144.0/20,96.6.176.0/20,96.6.224.0/20,96.16.224.0/19,96.17.32.0/20,96.17.155.0/24,96.17.157.0/24,96.17.167.0/24,116.51.16.0/21,117.103.176.0/20,117.104.64.0-117.104.159.255,118.214.208.0/20,118.215.64.0/21,118.215.136.0/21,118.215.168.0/21,119.161.104.0/21,120.29.144.0/21,120.29.160.0/19,122.255.80.0/20,124.40.0.0/18,125.56.144.0/20,128.121.0.0/16,128.241.0.0-128.242.255.255,129.7.136.0/24,129.87.0.0/16,129.192.196.0/22,129.250.0.0/16,130.94.0.0/16,131.103.0.0/16,134.32.0.0/16,140.174.0.0/16,140.222.224.0/24,147.28.0.0/16,154.37.0.0/16,157.107.0.0/16,157.130.103.144/30,157.238.0.0/16,157.245.70.0/24,159.230.128.0/20,161.58.0.0/16,163.183.0.0/16,164.162.0.0/16,165.254.0.0/16,168.143.0.0/16,170.249.0.0/19,170.249.64.0/19,170.250.0.0/16,170.253.0.0/16,192.11.188.0/24,192.23.75.0-192.23.76.255,192.23.208.0-192.23.231.255,192.31.32.0-192.31.36.255,192.41.171.0/24,192.41.219.0/24,192.67.236.0-192.67.241.255,192.77.142.0/24,192.80.12.0/22,192.83.230.0/24,192.102.248.0/24,192.108.74.0/23,192.147.160.0/21,192.147.175.0-192.147.179.255,192.159.82.0/24,192.195.85.0/24,192.204.0.0/16,192.217.0.0/16,192.220.0.0/16,193.188.96.0/23,195.234.244.0/22,198.63.0.0-198.66.255.255,198.80.131.0/24,198.80.148.0/24,198.84.16.0/20,198.87.0.0-198.88.255.255,198.104.0.0/16,198.106.0.0/15,198.133.206.0/24,198.138.0.0/15,198.170.0.0-198.173.255.255,198.180.150.0-198.180.153.255,198.232.16.0/24,198.247.0.0/16,198.252.194.0/23,199.4.64.0/18,199.73.32.0-199.73.41.255,199.103.128.0/17,199.164.210.0/24,199.184.212.0/24,199.184.226.0/24,199.201.197.0/24,199.212.0.0/24,199.217.128.0/17,199.224.0.0/20,199.234.0.0/16,199.236.0.0-199.240.255.255,199.245.16.0/20,200.15.0.0/16,202.23.124.0/24,202.47.16.0/20,202.68.64.0/20,202.69.224.0/20,202.153.208.0/20,202.163.128.0-202.163.132.255,202.163.134.0/24,202.237.244.0/24,203.12.225.0/24,203.20.71.0/24,203.27.251.0/24,203.32.132.0/24,203.33.3.0/24,203.33.196.0/24,203.78.192.0/20,203.98.192.0/19,203.105.64.0/19,203.131.240.0/20,203.205.112.0/20,203.208.80.0/21,203.208.120.0/21,203.215.136.0/23,204.0.0.0/14,204.42.0.0/16,204.57.32.0/19,204.62.232.0/24,204.68.197.0/24,204.75.146.0/24,204.108.0.0/23,204.141.0.0-204.143.255.255,204.156.0.0/19,204.156.128.0/19,204.170.0.0/15,204.194.176.0/21,204.200.0.0/14,204.217.244.0/24,204.227.160.0/19,204.233.0.0/16,204.241.122.0/24,204.245.128.0/17,204.247.0.0/16,204.248.180.0/25,205.146.0.0/16,205.149.160.0/19,205.153.56.0/22,205.157.128.0/20,205.212.0.0/16,205.238.0.0/18,206.14.0.0/16,206.50.0.0/16,206.52.0.0/16,206.54.0.0/18,206.55.0.0/18,206.58.0.0/16,206.68.0.0/15,206.80.32.0/19,206.82.32.0/19,206.86.0.0/16,206.163.0.0-206.163.223.255,206.166.128.0/18,206.169.41.0/24,206.169.186.0/24,206.169.194.0/23,206.183.192.0/19,206.184.0.0/16,206.197.81.0/24,206.197.192.0/24,206.213.64.0/18,206.222.32.0/19,206.239.0.0/16,206.252.0.0/19,207.7.0.0/18,207.20.0.0-207.21.191.255,207.22.64.0/18,207.31.192.0/18,207.32.64.0/18,207.33.0.0/16,207.55.128.0-207.55.223.255,207.56.0.0-207.58.127.255,207.67.128.0/17,207.71.64.0/18,207.91.64.0/18,207.97.0.0/17,207.111.64.0/18,207.126.240.0/21,207.126.254.0/23,207.137.0.0/16,207.150.0.0-207.150.159.255,207.152.64.0/18,207.153.128.0/17,207.156.128.0/17,207.158.192.0-207.159.63.255,207.195.240.0-207.196.127.255,207.197.128.0/17,207.198.128.0-207.199.127.255,207.201.128.0/18,207.206.0.0/17,207.207.128.0/19,207.241.0.0/17,208.55.0.0/16,208.91.236.0/22,209.21.0.0/18,209.24.0.0/16,209.39.0.0/16,209.41.0.0/18,209.43.128.0/17,209.57.0.0/16,209.59.32.0/19,209.69.0.0-209.70.255.255,209.75.0.0/16,209.107.0.0-209.107.95.255,209.112.96.0/20,209.124.0.0/19,209.130.0.0/17,209.139.0.0-209.139.191.255,209.157.0.0/16,209.162.64.0/18,209.168.0.0/17,209.170.0.0/18,209.189.0.0/17,209.207.128.0/17,209.227.0.0/17,209.238.0.0/16,209.243.70.0/23,209.243.96.0/20,210.175.160.0/19,211.1.32.0/19,211.130.96.0/19,212.105.160.0/19,212.119.0.0/19,213.130.32.0/19,213.198.0.0/17,216.42.0.0/16,216.44.0.0/16,216.105.240.0/24,216.167.0.0/17
+
+roa_request:
+
+  - asn: 3130
+    ipv4: 198.180.152.0/24,198.180.153.0/24,198.180.152.0/25,198.180.152.128/25,198.180.150.0/24,198.180.151.0/24,198.133.206.0/24,192.83.230.0/24,147.28.0.0/16-24
+
+  - asn: 2914
+    ipv4: 216.167.0.0/17,216.105.240.0/24,216.44.0.0/16,216.42.0.0/16,213.198.0.0/17,213.130.32.0/19,212.119.0.0/19,212.105.160.0/19,211.130.96.0/19,211.1.32.0/19,211.1.60.0/22,211.1.48.0/23,211.1.32.0/20,210.175.160.0/19,209.243.96.0/20,209.243.70.0/23,209.238.0.0/16,209.227.0.0/17,209.207.128.0/17,209.189.0.0/17,209.170.0.0/18,209.168.0.0/17,209.162.64.0/18,209.157.0.0/16,209.139.128.0/18,209.139.0.0/17,209.130.0.0/17,209.124.0.0/19,209.112.96.0/20,209.107.64.0/19,209.107.0.0/18,209.75.0.0/16,209.70.0.0/16,209.69.0.0/16,209.59.32.0/19,209.57.0.0/16,209.43.128.0/17,209.41.0.0/18,209.39.0.0/16,209.24.0.0/16,209.21.0.0/18,208.55.0.0/16,207.241.0.0/17,207.207.128.0/19,207.206.0.0/17,207.201.128.0/18,207.199.0.0/17,207.198.128.0/17,207.197.128.0/17,207.196.0.0/17,207.195.240.0/20,207.159.0.0/18,207.158.192.0/18,207.156.128.0/17,207.153.128.0/17,207.152.64.0/18,207.150.128.0/19,207.150.0.0/17,207.137.0.0/16,207.126.254.0/23,207.126.240.0/21,207.111.64.0/18,207.97.0.0/17,207.91.64.0/18,207.71.64.0/18,207.67.128.0/17,207.58.0.0/17,207.56.0.0/15,207.55.192.0/19,207.55.128.0/18,207.33.0.0/16,207.32.64.0/18,207.31.192.0/18,207.22.64.0/18,207.21.128.0/18,207.21.0.0/17,207.20.0.0/16,206.252.0.0/19,206.239.0.0/16,206.222.32.0/19,206.213.64.0/18,206.197.192.0/24,206.197.81.0/24,206.184.0.0/16,206.183.192.0/19,206.169.194.0/24,206.169.195.0/24,206.169.186.0/24,206.169.41.0/24,206.166.128.0/18,206.163.192.0/19,206.163.128.0/18,206.163.0.0/17,206.86.0.0/16,206.82.32.0/19,206.80.32.0/19,206.68.0.0/15,206.58.0.0/16,206.55.0.0/18,206.54.0.0/18,206.52.0.0/16,206.50.0.0/16,206.14.0.0/16,205.238.0.0/18,205.212.0.0/16,205.157.128.0/20,205.153.56.0/22,205.149.160.0/19,205.146.0.0/16,204.247.0.0/16,204.245.128.0/17,204.233.0.0/16,204.227.160.0/19,204.200.0.0/14,204.194.176.0/21,204.170.0.0/15,204.156.128.0/19,204.156.0.0/19,204.142.0.0/15,204.141.0.0/16,204.108.0.0/23,204.75.146.0/24,204.68.197.0/24,204.62.232.0/24,204.57.32.0/19,204.42.0.0/16,204.0.0.0/14,204.0.43.0/24,203.215.136.0/23,203.208.120.0/21,203.208.120.0/22,203.208.124.0/22,203.208.120.0/23,203.208.122.0/23,203.208.124.0/23,203.208.126.0/23,203.208.120.0/24,203.208.121.0/24,203.208.122.0/24,203.208.123.0/24,203.208.124.0/24,203.208.125.0/24,203.208.126.0/24,203.208.127.0/24,203.208.80.0/21,203.208.80.0/22,203.208.84.0/22,203.208.80.0/23,203.208.82.0/23,203.208.84.0/23,203.208.86.0/23,203.208.80.0/24,203.208.81.0/24,203.208.82.0/24,203.208.83.0/24,203.208.84.0/24,203.208.85.0/24,203.208.86.0/24,203.208.87.0/24,203.205.112.0/20,203.131.240.0/20,203.131.248.0/21,203.105.64.0/19,203.105.80.0/21,203.105.72.0/22,203.78.192.0/20,203.33.3.0/24,203.32.132.0/24,203.20.71.0/24,203.12.225.0/24,202.237.244.0/24,202.163.134.0/24,202.163.132.0/24,202.163.128.0/22,202.163.128.0/24,202.163.129.0/24,202.163.130.0/24,202.163.131.0/24,202.153.208.0/20,202.69.224.0/20,202.68.64.0/20,202.68.64.0/21,202.68.72.0/21,202.68.64.0/22,202.68.68.0/22,202.68.72.0/22,202.68.76.0/22,202.68.64.0/23,202.68.66.0/23,202.68.68.0/23,202.68.70.0/23,202.68.72.0/23,202.68.74.0/23,202.68.76.0/23,202.68.78.0/23,202.68.64.0/24,202.68.65.0/24,202.68.66.0/24,202.68.67.0/24,202.68.68.0/24,202.68.69.0/24,202.68.70.0/24,202.68.71.0/24,202.68.72.0/24,202.68.73.0/24,202.68.74.0/24,202.68.75.0/24,202.68.76.0/24,202.68.77.0/24,202.68.78.0/24,202.68.79.0/24,202.47.16.0/20,202.23.124.0/24,200.15.0.0/16,199.245.16.0/20,199.240.0.0/16,199.236.0.0/14,199.234.0.0/16,199.224.0.0/20,199.217.128.0/17,199.212.0.0/24,199.201.197.0/24,199.184.226.0/24,199.184.212.0/24,199.164.210.0/24,199.103.128.0/17,199.73.40.0/23,199.73.32.0/21,199.4.64.0/18,198.252.194.0/23,198.247.0.0/16,198.232.16.0/24,198.172.0.0/15,198.170.0.0/15,198.170.208.0/24,198.138.0.0/15,198.106.0.0/15,198.104.0.0/16,198.88.0.0/16,198.87.0.0/16,198.84.16.0/20,198.66.0.0/16,198.64.0.0/15,198.63.0.0/16,195.234.244.0/22,192.220.0.0/16,192.217.0.0/16,192.204.0.0/16,192.195.85.0/24,192.159.82.0/24,192.147.176.0/22,192.147.175.0/24,192.147.160.0/21,192.108.74.0/23,192.102.248.0/24,192.80.12.0/22,192.67.240.0/23,192.67.236.0/22,192.41.219.0/24,192.41.171.0/24,192.11.188.0/24,170.253.0.0/16,170.250.0.0/16,170.249.64.0/19,170.249.0.0/19,168.143.0.0/16,165.254.0.0/16,164.162.0.0/16,161.58.0.0/16,159.230.128.0/20,159.230.138.0/24,157.238.0.0/16,157.107.0.0/16,154.37.0.0/16,140.174.0.0/16,131.103.0.0/16,130.94.0.0/16,130.94.60.0/24,129.250.0.0/16,129.192.196.0/22,129.7.136.0/24,128.242.0.0/16,128.241.0.0/16,128.241.83.0/29,128.121.0.0/16,125.56.144.0/21,125.56.152.0/21,124.40.0.0/18,124.40.0.0/19,124.40.32.0/19,122.255.80.0/20,120.29.160.0/19,120.29.144.0/21,119.161.104.0/21,118.215.168.0/21,118.215.136.0/21,118.215.64.0/21,118.214.208.0/21,118.214.216.0/21,117.104.128.0/19,117.104.64.0/18,117.103.176.0/20,116.51.16.0/21,96.17.167.0/24,96.17.157.0/24,96.17.155.0/24,96.17.32.0/20,96.16.224.0/21,96.16.232.0/21,96.16.240.0/21,96.16.248.0/21,96.6.224.0/20,96.6.176.0/20,96.6.144.0/20,96.6.40.0/24,91.186.160.0/19,89.238.138.0/24,83.231.128.0/17,82.112.96.0/19,81.93.208.0/20,81.93.176.0/20,81.93.189.0/24,81.25.192.0/20,81.20.64.0/20,81.19.96.0/20,80.68.16.0/21,72.247.200.0/21,72.247.128.0/21,72.247.125.0/24,72.247.56.0/22,72.247.52.0/22,72.246.32.0/21,69.192.96.0/20,69.192.32.0/20,69.192.48.0/20,69.55.56.0/23,69.41.176.0/21,69.41.168.0/21,69.41.166.0/23,69.41.165.0/24,69.41.160.0/24,66.249.144.0/24,66.187.28.0/24,64.7.64.0/19,62.73.160.0/19,61.251.96.0/20,61.213.160.0/19,61.213.144.0/20,61.200.80.0/20,61.200.80.0/21,61.200.88.0/21,61.120.144.0/20,61.120.144.0/21,61.120.152.0/21,61.114.112.0/20,61.114.120.0/21,61.114.112.0/22,61.58.32.0/20,61.28.200.0/24,61.28.199.0/24,60.254.153.0/24,60.254.132.0/22,59.151.184.0/22
+
+  - asn: 1239
+    ipv4: 207.7.0.0/18,204.248.180.0/25,204.241.122.0/24,204.217.244.0/24,203.98.192.0/19,193.188.96.0/23,192.77.142.0/24,192.31.36.0/24,192.31.32.0/22,192.23.224.0/21,192.23.208.0/20,192.23.76.0/24,192.23.75.0/24,163.183.0.0/16,157.245.70.0/24,134.32.0.0/16,129.87.0.0/16,85.237.96.0/19,72.246.128.0/20,65.168.150.0/23,65.168.149.0/24,63.172.252.0/22,63.171.143.128/25,63.169.52.128/25
+
+  - asn: 701 
+    ipv4: 208.91.236.0/22,203.33.196.0/24,203.27.251.0/24,198.80.148.0/24,198.80.131.0/24,157.130.103.144/30,140.222.224.0/24,65.243.171.0/24,63.122.162.212/30,63.116.191.0/24,63.81.136.0/24,17.0.0.0/8,17.128.0.0/9
+
+---
+- shell set -x; find publication -type f -name '*.roa' -print -exec ../../../utils/print_roa/print_roa {} \;
+- shell set -x; cd ../../../rtr-origin && python rtr-origin.py --cronjob ../../rpkid/smoketest.dir/rcynic-data/authenticated && python rtr-origin.py --show
diff --git a/rpkid.without_tls/tests/smoketest.8.yaml b/rpkid.without_tls/tests/smoketest.8.yaml
new file mode 100644
index 00000000..cd6d1e7a
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.8.yaml
@@ -0,0 +1,41 @@
+# $Id$
+
+# Copyright (C) 2009-2010  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+name:           RIR
+valid_for:      2d
+kids:
+  - name: Alice
+    hosted_by: RIR
+    kids:
+      - name: Betty
+        hosted_by: RIR
+        kids:
+          - name: Carol
+            hosted_by: RIR
+            kids:
+              - name: Dana
+                hosted_by: RIR
+                kids:
+                  - name: Eve
+                    hosted_by: RIR
+                    kids:
+                      - name: Fiona
+                        hosted_by: RIR
+                        ipv4: 10.0.0.0/8
+                        asn:  64533
+                        roa_request:
+                          - asn: 64533
+                            ipv4: 10.0.0.0/24
diff --git a/rpkid.without_tls/tests/smoketest.9.yaml b/rpkid.without_tls/tests/smoketest.9.yaml
new file mode 100644
index 00000000..3efc4f08
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.9.yaml
@@ -0,0 +1,849 @@
+# $Id$
+
+# Copyright (C) 2009-2010  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+#
+# Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+name:           RIR
+crl_interval:   30s
+regen_margin:   30s
+valid_for:      2m
+kids:
+  - name: R0
+    kids:
+      - name: Alice
+        ipv4: 192.0.2.1-192.0.2.33
+        asn:  64533
+        roa_request:
+          - asn: 42
+            ipv4: 192.0.2.32/32
+      - name: Bob
+        ipv4: 192.0.2.44-192.0.2.100
+    ipv4: 10.3.0.0/16
+    roa_request:
+      - asn: 666
+        ipv4: 10.3.0.44/32
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
+---
+- sleep 15
+- name: RIR
+  valid_for: 2m
+- name: R0
+  valid_for: 2m
+- name: Alice
+  valid_for: 2m
+- name: Bob
+  valid_for: 2m
diff --git a/rpkid.without_tls/tests/smoketest.clean.sql b/rpkid.without_tls/tests/smoketest.clean.sql
new file mode 100644
index 00000000..9f5ff9fb
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.clean.sql
@@ -0,0 +1,54 @@
+-- $Id$
+
+-- Copyright (C) 2009  Internet Systems Consortium ("ISC")
+--
+-- Permission to use, copy, modify, and distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+-- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+-- Clean up databases left behind by smoketest.py et al.
+
+DROP DATABASE IF EXISTS irdb0;
+DROP DATABASE IF EXISTS irdb1;
+DROP DATABASE IF EXISTS irdb2;
+DROP DATABASE IF EXISTS irdb3;
+DROP DATABASE IF EXISTS irdb4;
+DROP DATABASE IF EXISTS irdb5;
+DROP DATABASE IF EXISTS irdb6;
+DROP DATABASE IF EXISTS irdb7;
+DROP DATABASE IF EXISTS irdb8;
+DROP DATABASE IF EXISTS irdb9;
+DROP DATABASE IF EXISTS irdb10;
+DROP DATABASE IF EXISTS irdb11;
+DROP DATABASE IF EXISTS rpki0;
+DROP DATABASE IF EXISTS rpki1;
+DROP DATABASE IF EXISTS rpki2;
+DROP DATABASE IF EXISTS rpki3;
+DROP DATABASE IF EXISTS rpki4;
+DROP DATABASE IF EXISTS rpki5;
+DROP DATABASE IF EXISTS rpki6;
+DROP DATABASE IF EXISTS rpki7;
+DROP DATABASE IF EXISTS rpki8;
+DROP DATABASE IF EXISTS rpki9;
+DROP DATABASE IF EXISTS rpki10;
+DROP DATABASE IF EXISTS rpki11;
+DROP DATABASE IF EXISTS pubd0;
+DROP DATABASE IF EXISTS pubd1;
+DROP DATABASE IF EXISTS pubd2;
+DROP DATABASE IF EXISTS pubd3;
+DROP DATABASE IF EXISTS pubd4;
+DROP DATABASE IF EXISTS pubd5;
+DROP DATABASE IF EXISTS pubd6;
+DROP DATABASE IF EXISTS pubd7;
+DROP DATABASE IF EXISTS pubd8;
+DROP DATABASE IF EXISTS pubd9;
+DROP DATABASE IF EXISTS pubd10;
+DROP DATABASE IF EXISTS pubd11;
diff --git a/rpkid.without_tls/tests/smoketest.py b/rpkid.without_tls/tests/smoketest.py
new file mode 100644
index 00000000..2c461a09
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.py
@@ -0,0 +1,1482 @@
+"""
+Test framework to configure and drive a collection of rpkid.py and
+irdbd.py instances under control of a master script.
+
+Usage: python smoketest.py [ { -c | --config } config_file ]
+                           [ { -h | --help } ]
+                           [ { -p | --profile } ]
+                           [ { -y | --yaml }   yaml_script ]
+
+Default config_file is smoketest.conf, override with --config option.
+
+Default yaml_script is smoketest.yaml, override with -yaml option.
+
+yaml_script is a YAML file describing the tests to be run, and is
+intended to be implementation agnostic.
+
+config_file contains settings for various implementation-specific
+things that don't belong in yaml_script.
+
+$Id$
+
+Copyright (C) 2009--2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+"""
+
+from __future__ import with_statement
+
+import os, yaml, warnings, subprocess, signal, time, getopt, sys
+import rpki.resource_set, rpki.sundial, rpki.x509, rpki.http
+import rpki.log, rpki.left_right, rpki.config, rpki.publication, rpki.async
+
+# Silence warning while loading MySQLdb in Python 2.6, sigh
+if hasattr(warnings, "catch_warnings"):
+  with warnings.catch_warnings():
+    warnings.simplefilter("ignore", DeprecationWarning)
+    import MySQLdb
+else:
+  import MySQLdb
+
+os.environ["TZ"] = "UTC"
+time.tzset()
+
+cfg_file = "smoketest.conf"
+
+yaml_script = None
+profile = False
+
+opts, argv = getopt.getopt(sys.argv[1:], "c:hpy:?", ["config=", "help", "profile", "yaml="])
+for o, a in opts:
+  if o in ("-h", "--help", "-?"):
+    print __doc__
+    sys.exit(0)
+  elif o in ("-c", "--config"):
+    cfg_file = a
+  elif o in ("-p", "--profile"):
+    profile = True
+  elif o in ("-y", "--yaml"):
+    yaml_script = a
+if argv:
+  print __doc__
+  raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %s" % argv
+
+cfg = rpki.config.parser(cfg_file, "smoketest", allow_missing = True)
+
+# Load the YAML script early, so we can report errors ASAP
+
+if yaml_script is None:
+  yaml_script  = cfg.get("yaml_script", "smoketest.yaml")
+try:
+  yaml_script = [y for y in yaml.safe_load_all(open(yaml_script))]
+except:
+  print __doc__
+  raise
+
+# Define port allocator early, so we can use it while reading config
+
+def allocate_port():
+  """
+  Allocate a TCP port number.
+  """
+  global base_port
+  p = base_port
+  base_port += 1
+  return p
+
+# Most filenames in the following are relative to the working directory.
+
+smoketest_name = cfg.get("smoketest_name", "smoketest")
+smoketest_dir  = cfg.get("smoketest_dir",  smoketest_name + ".dir")
+
+irdb_db_pass   = cfg.get("irdb_db_pass",   "fnord")
+rpki_db_pass   = cfg.get("rpki_db_pass",   "fnord")
+pubd_db_pass   = cfg.get("pubd_db_pass",   "fnord")
+pubd_db_name   = cfg.get("pubd_db_name",   "pubd0")
+pubd_db_user   = cfg.get("pubd_db_user",   "pubd")
+
+base_port      = int(cfg.get("base_port",  "4400"))
+
+rsyncd_port    = allocate_port()
+rootd_port     = allocate_port()
+pubd_port      = allocate_port()
+
+rsyncd_module  = cfg.get("rsyncd_module",  smoketest_name)
+rootd_sia      = cfg.get("rootd_sia",      "rsync://localhost:%d/%s/" % (rsyncd_port, rsyncd_module))
+
+rootd_name     = cfg.get("rootd_name",     "rootd")
+rsyncd_name    = cfg.get("rsyncd_name",    "rsyncd")
+rcynic_name    = cfg.get("rcynic_name",    "rcynic")
+pubd_name      = cfg.get("pubd_name",      "pubd")
+
+prog_python    = cfg.get("prog_python",    "python")
+prog_rpkid     = cfg.get("prog_rpkid",     "../../rpkid.py")
+prog_irdbd     = cfg.get("prog_irdbd",     "../../irdbd.py")
+prog_poke      = cfg.get("prog_poke",      "../../testpoke.py")
+prog_rootd     = cfg.get("prog_rootd",     "../../rootd.py")
+prog_pubd      = cfg.get("prog_pubd",      "../../pubd.py")
+prog_openssl   = cfg.get("prog_openssl",   "../../../openssl/openssl/apps/openssl")
+prog_rsyncd    = cfg.get("prog_rsyncd",    "rsync")
+prog_rcynic    = cfg.get("prog_rcynic",    "../../../rcynic/rcynic")
+
+rcynic_stats   = cfg.get("rcynic_stats",   "echo ; ../../../rcynic/show.sh %s.xml ; echo" % rcynic_name)
+
+rpki_sql_file  = cfg.get("rpki_sql_file",  "../rpkid.sql")
+irdb_sql_file  = cfg.get("irdb_sql_file",  "../irdbd.sql")
+pub_sql_file   = cfg.get("pub_sql_file",   "../pubd.sql")
+
+startup_delay  = int(cfg.get("startup_delay", "10"))
+
+rsyncd_dir     = None
+pubd_ta        = None
+pubd_irbe_key  = None
+pubd_irbe_cert = None
+pubd_pubd_cert = None
+
+def main():
+  """
+  Main program.
+  """
+
+  rpki.log.use_syslog = False
+  rpki.log.init(smoketest_name)
+  rpki.log.info("Starting")
+
+  pubd_process = None
+  rootd_process = None
+  rsyncd_process = None
+
+  rpki_sql = mangle_sql(rpki_sql_file)
+  irdb_sql = mangle_sql(irdb_sql_file)
+  pubd_sql = mangle_sql(pub_sql_file)
+
+  rpki.log.info("Initializing test directory")
+
+  # Connect to test directory, creating it if necessary
+  try:
+    os.chdir(smoketest_dir)
+  except OSError:
+    os.makedirs(smoketest_dir)
+    os.chdir(smoketest_dir)
+
+  # Discard everything but keys, which take a while to generate
+  for root, dirs, files in os.walk(".", topdown = False):
+    for file in files:
+      if not file.endswith(".key"):
+        os.remove(os.path.join(root, file))
+    for dir in dirs:
+      os.rmdir(os.path.join(root, dir))
+
+  rpki.log.info("Reading master YAML configuration")
+  y = yaml_script.pop(0)
+
+  rpki.log.info("Constructing internal allocation database")
+  db = allocation_db(y)
+
+  rpki.log.info("Constructing BPKI keys and certs for rootd")
+  setup_bpki_cert_chain(rootd_name, ee = ("RPKI",))
+
+  rpki.log.info("Constructing BPKI keys and certs for pubd")
+  setup_bpki_cert_chain(pubd_name, ee = ("PUBD", "IRBE"))
+
+  for a in db:
+    a.setup_bpki_certs()
+
+  setup_publication(pubd_sql)
+  setup_rootd(db.root, y.get("rootd", {}))
+  setup_rsyncd()
+  setup_rcynic()
+
+  for a in db.engines:
+    a.setup_conf_file()
+    a.setup_sql(rpki_sql, irdb_sql)
+    a.sync_sql()
+
+  try:
+
+    rpki.log.info("Starting rootd")
+    rootd_process = subprocess.Popen((prog_python, prog_rootd, "-d", "-c", rootd_name + ".conf"))
+
+    rpki.log.info("Starting pubd")
+    pubd_process = subprocess.Popen((prog_python, prog_pubd, "-d", "-c", pubd_name + ".conf") + (("-p", pubd_name + ".prof") if profile else ()))
+
+    rpki.log.info("Starting rsyncd")
+    rsyncd_process = subprocess.Popen((prog_rsyncd, "--daemon", "--no-detach", "--config", rsyncd_name + ".conf"))
+
+    # Start rpkid and irdbd instances
+    for a in db.engines:
+      a.run_daemons()
+
+    # From this point on we'll be running event-driven, so the rest of
+    # the code until final exit is all closures.
+
+    def start():
+      rpki.async.iterator(db.engines, create_rpki_objects, created_rpki_objects)
+
+    def create_rpki_objects(iterator, a):
+      a.create_rpki_objects(iterator)
+
+    def created_rpki_objects():
+
+      # Setup keys and certs and write YAML files for leaves
+      for a in db.leaves:
+        a.setup_yaml_leaf()
+
+      # Set pubd's BPKI CRL
+      set_pubd_crl(yaml_loop)
+
+    def yaml_loop():
+
+      # This is probably where we should be updating expired BPKI
+      # objects, particular CRLs
+
+      rpki.log.info("Running cron for all RPKI engines")
+      rpki.async.iterator(db.engines, run_cron, run_yaml)
+
+    def run_cron(iterator, a):
+      a.run_cron(iterator)
+
+    def run_yaml():
+
+      # Run all YAML clients
+      for a in db.leaves:
+        a.run_yaml()
+
+      # Run rcynic to check results
+      run_rcynic()
+
+      # Apply next delta if we have one; otherwise, we're done.
+      if yaml_script:
+        rpki.log.info("Applying deltas")
+        db.apply_delta(yaml_script.pop(0), apply_delta_done)
+      else:
+        rpki.log.info("No more deltas to apply, done")
+        rpki.async.exit_event_loop()
+
+    def apply_delta_done():
+
+      # Resync IRDBs
+      for a in db.engines:
+        a.sync_sql()
+
+      # Loop until we run out of control YAML
+      yaml_loop()
+
+    rpki.log.info("Sleeping %d seconds while daemons start up" % startup_delay)
+    rpki.async.timer(start).set(rpki.sundial.timedelta(seconds = startup_delay))
+    rpki.async.event_loop()
+
+    # At this point we have gone into event-driven code.
+
+    rpki.log.info("Event loop exited normally")
+
+  except Exception, e:
+
+    rpki.log.info("Event loop exited with an exception: %r" % e)
+    rpki.log.traceback()
+
+  finally:
+
+    rpki.log.info("Cleaning up")
+    for a in db.engines:
+      a.kill_daemons()
+    for proc, name in ((rootd_process,  "rootd"),
+                       (pubd_process,   "pubd"),
+                       (rsyncd_process, "rsyncd")):
+      if proc is not None:
+        rpki.log.info("Killing %s, pid %s" % (name, proc.pid))
+        try:
+          os.kill(proc.pid, signal.SIGTERM)
+        except OSError:
+          pass
+        proc.wait()
+
+def cmd_sleep(cb, interval):
+  """
+  Set an alarm, then wait for it to go off.
+  """
+  howlong = rpki.sundial.timedelta.parse(interval)
+  rpki.log.info("Sleeping %r" % howlong)
+  rpki.async.timer(cb).set(howlong)
+
+def cmd_shell(cb, *cmd):
+  """
+  Run a shell command.
+  """
+  cmd = " ".join(cmd)
+  status = subprocess.call(cmd, shell = True)
+  rpki.log.info("Shell command returned status %d" % status)
+  cb()
+
+def cmd_echo(cb, *words):
+  """Echo some text to the log."""
+  rpki.log.note(" ".join(words))
+  cb()
+
+## @var cmds
+# Dispatch table for commands embedded in delta sections
+
+cmds = { "sleep" : cmd_sleep,
+         "shell" : cmd_shell,
+         "echo"  : cmd_echo }
+
+class roa_request(object):
+  """
+  Representation for a roa_request object.
+  """
+
+  def __init__(self, asn, ipv4, ipv6):
+    self.asn = asn
+    self.v4 = rpki.resource_set.roa_prefix_set_ipv4("".join(ipv4.split())) if ipv4 else None
+    self.v6 = rpki.resource_set.roa_prefix_set_ipv6("".join(ipv6.split())) if ipv6 else None
+
+  def __eq__(self, other):
+    return self.asn == other.asn and self.v4 == other.v4 and self.v6 == other.v6
+
+  def __hash__(self):
+    v4 = tuple(self.v4) if self.v4 is not None else None
+    v6 = tuple(self.v6) if self.v6 is not None else None
+    return self.asn.__hash__() + v4.__hash__() + v6.__hash__()
+
+  def __str__(self):
+    if self.v4 and self.v6: s = str(self.v4) + "," + str(self.v6)
+    elif self.v4:           s = str(self.v4)
+    else:                   s = str(self.v6)
+    return "%s: %s" % (self.asn, s)
+
+  @classmethod
+  def parse(cls, yaml):
+    return cls(yaml.get("asn"), yaml.get("ipv4"), yaml.get("ipv6"))
+    
+class allocation_db(list):
+  """
+  Representation of all the entities and allocations in the test
+  system.  Almost everything is generated out of this database.
+  """
+
+  def __init__(self, yaml):
+    """
+    Initialize database from the (first) YAML document.
+    """
+
+    list.__init__(self)
+    self.root = allocation(yaml, self)
+    assert self.root.is_root()
+    if self.root.crl_interval is None:
+      self.root.crl_interval = rpki.sundial.timedelta.parse(cfg.get("crl_interval", "1d")).convert_to_seconds()
+    if self.root.regen_margin is None:
+      self.root.regen_margin = rpki.sundial.timedelta.parse(cfg.get("regen_margin", "1d")).convert_to_seconds()
+    for a in self:
+      if a.sia_base is None:
+        a.sia_base = (rootd_sia if a.is_root() else a.parent.sia_base) + a.name + "/"
+      if a.base.valid_until is None:
+        a.base.valid_until = a.parent.base.valid_until
+      if a.crl_interval is None:
+        a.crl_interval = a.parent.crl_interval
+      if a.regen_margin is None:
+        a.regen_margin = a.parent.regen_margin
+      i = 0
+      for j in xrange(4):
+        i = a.sia_base.index("/", i) + 1
+      a.client_handle = a.sia_base[i:].rstrip("/")
+    self.root.closure()
+    self.map = dict((a.name, a) for a in self)
+    self.engines = [a for a in self if a.is_engine()]
+    self.leaves = [a for a in self if a.is_leaf()]
+    for i, a in enumerate(self.engines):
+      a.set_engine_number(i)
+    for a in self:
+      if a.is_hosted():
+        a.hosted_by = self.map[a.hosted_by]
+        a.hosted_by.hosts.append(a)
+        assert a.is_twig(), "%s is not twig" % a.name
+        assert not a.hosted_by.is_hosted(), "%s is hosted by a hosted entity" % a.name
+
+  def apply_delta(self, delta, cb):
+    """
+    Apply a delta or run a command.
+    """
+
+    def loop(iterator, d):
+      if isinstance(d, str):
+        c = d.split()
+        cmds[c[0]](iterator, *c[1:])
+      else:
+        self.map[d["name"]].apply_delta(d, iterator)
+
+    def done():
+      self.root.closure()
+      cb()
+
+    if delta is None:
+      cb()
+    else:
+      rpki.async.iterator(delta, loop, done)
+
+  def dump(self):
+    """
+    Print content of the database.
+    """
+    for a in self:
+      print a
+
+class allocation(object):
+
+  parent       = None
+  irdb_db_name = None
+  irdb_port    = None
+  rpki_db_name = None
+  rpki_port    = None
+  crl_interval = None
+  regen_margin = None
+
+  def __init__(self, yaml, db, parent = None):
+    """
+    Initialize one entity and insert it into the database.
+    """
+    db.append(self)
+    self.name = yaml["name"]
+    self.parent = parent
+    self.kids = [allocation(k, db, self) for k in yaml.get("kids", ())]
+    valid_until = None
+    if "valid_until" in yaml:
+      valid_until = rpki.sundial.datetime.fromdatetime(yaml.get("valid_until"))
+    if valid_until is None and "valid_for" in yaml:
+      valid_until = rpki.sundial.now() + rpki.sundial.timedelta.parse(yaml["valid_for"])
+    self.base = rpki.resource_set.resource_bag(
+      asn = rpki.resource_set.resource_set_as(yaml.get("asn")),
+      v4 = rpki.resource_set.resource_set_ipv4(yaml.get("ipv4")),
+      v6 = rpki.resource_set.resource_set_ipv6(yaml.get("ipv6")),
+      valid_until = valid_until)
+    self.sia_base = yaml.get("sia_base")
+    if "crl_interval" in yaml:
+      self.crl_interval = rpki.sundial.timedelta.parse(yaml["crl_interval"]).convert_to_seconds()
+    if "regen_margin" in yaml:
+      self.regen_margin = rpki.sundial.timedelta.parse(yaml["regen_margin"]).convert_to_seconds()
+    self.roa_requests = [roa_request.parse(y) for y in yaml.get("roa_request", yaml.get("route_origin", ()))]
+    for r in self.roa_requests:
+      if r.v4:
+        self.base.v4 = self.base.v4.union(r.v4.to_resource_set())
+      if r.v6:
+        self.base.v6 = self.base.v6.union(r.v6.to_resource_set())
+    self.hosted_by = yaml.get("hosted_by")
+    self.extra_conf = yaml.get("extra_conf", [])
+    self.hosts = []
+
+  def closure(self):
+    """
+    Compute the transitive resource closure.
+    """
+    resources = self.base
+    for kid in self.kids:
+      resources = resources.union(kid.closure())
+    self.resources = resources
+    return resources
+
+  def apply_delta(self, yaml, cb):
+    """
+    Apply deltas to this entity.
+    """
+
+    rpki.log.info("Applying delta: %s" % yaml)
+
+    def loop(iterator, kv):
+      if kv[0] == "name":
+        iterator()
+      else:
+        getattr(self, "apply_" + kv[0])(kv[1], iterator)
+
+    rpki.async.iterator(yaml.items(), loop, cb)
+
+  def apply_add_as(self, text, cb):
+    self.base.asn = self.base.asn.union(rpki.resource_set.resource_set_as(text))
+    cb()
+
+  def apply_add_v4(self, text, cb):
+    self.base.v4 = self.base.v4.union(rpki.resource_set.resource_set_ipv4(text))
+    cb()
+
+  def apply_add_v6(self, text, cb):
+    self.base.v6 = self.base.v6.union(rpki.resource_set.resource_set_ipv6(text))
+    cb()
+
+  def apply_sub_as(self, text, cb):
+    self.base.asn = self.base.asn.difference(rpki.resource_set.resource_set_as(text))
+    cb()
+
+  def apply_sub_v4(self, text, cb):
+    self.base.v4 = self.base.v4.difference(rpki.resource_set.resource_set_ipv4(text))
+    cb()
+
+  def apply_sub_v6(self, text, cb):
+    self.base.v6 = self.base.v6.difference(rpki.resource_set.resource_set_ipv6(text))
+    cb()
+
+  def apply_valid_until(self, stamp, cb):
+    self.base.valid_until = rpki.sundial.datetime.fromdatetime(stamp)
+    cb()
+
+  def apply_valid_for(self, text, cb):
+    self.base.valid_until = rpki.sundial.now() + rpki.sundial.timedelta.parse(text)
+    cb()
+
+  def apply_valid_add(self, text, cb):
+    self.base.valid_until += rpki.sundial.timedelta.parse(text)
+    cb()
+
+  def apply_valid_sub(self, text, cb):
+    self.base.valid_until -= rpki.sundial.timedelta.parse(text)
+    cb()
+
+  def apply_roa_request_add(self, yaml, cb):
+    for y in yaml:
+      r = roa_request.parse(y)
+      if r not in self.roa_requests:
+        self.roa_requests.append(r)
+    cb()
+
+  def apply_roa_request_del(self, yaml, cb):
+    for y in yaml:
+      r = roa_request.parse(y)
+      if r in self.roa_requests:
+        self.roa_requests.remove(r)
+    cb()
+
+  def apply_rekey(self, target, cb):
+
+    def done(e):
+      if isinstance(e, Exception):
+        rpki.log.traceback()
+        raise e
+      cb()
+
+    if self.is_leaf():
+      raise RuntimeError, "Can't rekey YAML leaf %s, sorry" % self.name
+    elif target is None:
+      rpki.log.info("Rekeying <self/> %s" % self.name)
+      self.call_rpkid([rpki.left_right.self_elt.make_pdu(action = "set", self_handle = self.name, rekey = "yes")], cb = done)
+    else:
+      rpki.log.info("Rekeying <parent/> %s %s" % (self.name, target))
+      self.call_rpkid([rpki.left_right.parent_elt.make_pdu(action = "set", self_handle = self.name, parent_handle = target, rekey = "yes")], cb = done)
+
+  def apply_revoke(self, target, cb):
+
+    def done(e):
+      if isinstance(e, Exception):
+        rpki.log.traceback()
+        raise e
+      cb()
+
+    if self.is_leaf():
+      rpki.log.info("Attempting to revoke YAML leaf %s" % self.name)
+      subprocess.check_call((prog_python, prog_poke, "-y", self.name + ".yaml", "-r", "revoke"))
+      cb()
+    elif target is None:
+      rpki.log.info("Revoking <self/> %s" % self.name)
+      self.call_rpkid([rpki.left_right.self_elt.make_pdu(action = "set", self_handle = self.name, revoke = "yes")], cb = done)
+    else:
+      rpki.log.info("Revoking <parent/> %s %s" % (self.name, target))
+      self.call_rpkid([rpki.left_right.parent_elt.make_pdu(action = "set", self_handle = self.name, parent_handle = target, revoke = "yes")], cb = done)
+
+  def __str__(self):
+    s = self.name + "\n"
+    if self.resources.asn:      s += "  ASN: %s\n" % self.resources.asn
+    if self.resources.v4:       s += " IPv4: %s\n" % self.resources.v4
+    if self.resources.v6:       s += " IPv6: %s\n" % self.resources.v6
+    if self.kids:               s += " Kids: %s\n" % ", ".join(k.name for k in self.kids)
+    if self.parent:             s += "   Up: %s\n" % self.parent.name
+    if self.sia_base:           s += "  SIA: %s\n" % self.sia_base
+    return s + "Until: %s\n" % self.resources.valid_until
+
+  def is_leaf(self):
+    #return not self.kids and not self.roa_requests
+    return False
+
+  def is_root(self):
+    return self.parent is None
+
+  def is_twig(self):
+    return not self.is_leaf() and not self.is_root()
+
+  def is_hosted(self):
+    return self.hosted_by is not None
+
+  def is_engine(self):
+    return not self.is_leaf() and not self.is_hosted()
+
+  def set_engine_number(self, n):
+    """
+    Set the engine number for this entity.
+    """
+    self.irdb_db_name = "irdb%d" % n
+    self.irdb_port    = allocate_port()
+    self.rpki_db_name = "rpki%d" % n
+    self.rpki_port    = allocate_port()
+
+  def get_rpki_port(self):
+    """
+    Get rpki port to use for this entity.
+    """
+    if self.is_hosted():
+      assert self.hosted_by.rpki_port is not None
+      return self.hosted_by.rpki_port
+    else:
+      assert self.rpki_port is not None
+      return self.rpki_port
+
+  def setup_bpki_certs(self):
+    """
+    Create BPKI certificates for this entity.
+    """
+    rpki.log.info("Constructing BPKI keys and certs for %s" % self.name)
+    if self.is_leaf():
+      setup_bpki_cert_chain(self.name, ee = ("RPKI",))
+    else:
+      setup_bpki_cert_chain(name = self.name,
+                            ee = ("RPKI", "IRDB", "IRBE"),
+                            ca = ("SELF",))
+      self.rpkid_ta   = rpki.x509.X509(PEM_file = self.name + "-TA.cer")
+      self.irbe_key   = rpki.x509.RSA( PEM_file = self.name + "-IRBE.key")
+      self.irbe_cert  = rpki.x509.X509(PEM_file = self.name + "-IRBE.cer")
+      self.rpkid_cert = rpki.x509.X509(PEM_file = self.name + "-RPKI.cer")
+
+  def setup_conf_file(self):
+    """
+    Write config files for this entity.
+    """
+    rpki.log.info("Writing config files for %s" % self.name)
+    assert self.rpki_port is not None
+    d = { "my_name"      : self.name,
+          "irdb_db_name" : self.irdb_db_name,
+          "irdb_db_pass" : irdb_db_pass,
+          "irdb_port"    : self.irdb_port,
+          "rpki_db_name" : self.rpki_db_name,
+          "rpki_db_pass" : rpki_db_pass,
+          "rpki_port"    : self.rpki_port }
+    f = open(self.name + ".conf", "w")
+    f.write(conf_fmt_1 % d)
+    for line in self.extra_conf:
+      f.write(line + "\n")
+    f.close()
+
+  def setup_sql(self, rpki_sql, irdb_sql):
+    """
+    Set up this entity's IRDB.
+    """
+    rpki.log.info("Setting up MySQL for %s" % self.name)
+    db = MySQLdb.connect(user = "rpki", db = self.rpki_db_name, passwd = rpki_db_pass)
+    cur = db.cursor()
+    db.autocommit(True)
+    for sql in rpki_sql:
+      cur.execute(sql)
+    db.close()
+    db = MySQLdb.connect(user = "irdb", db = self.irdb_db_name, passwd = irdb_db_pass)
+    cur = db.cursor()
+    db.autocommit(True)
+    for sql in irdb_sql:
+      cur.execute(sql)
+    for s in [self] + self.hosts:
+      for kid in s.kids:
+        cur.execute("INSERT registrant (registrant_handle, registry_handle, valid_until) VALUES (%s, %s, %s)",
+                    (kid.name, s.name, kid.resources.valid_until.to_sql()))
+    db.close()
+
+  def sync_sql(self):
+    """
+    Whack this entity's IRDB to match our master database.  We do this
+    once during setup, then do it again every time we apply a delta to
+    this entity.
+    """
+    rpki.log.info("Updating MySQL data for IRDB %s" % self.name)
+    db = MySQLdb.connect(user = "irdb", db = self.irdb_db_name, passwd = irdb_db_pass)
+    cur = db.cursor()
+    db.autocommit(True)
+    cur.execute("DELETE FROM registrant_asn")
+    cur.execute("DELETE FROM registrant_net")
+    cur.execute("DELETE FROM roa_request_prefix")
+    cur.execute("DELETE FROM roa_request")
+    for s in [self] + self.hosts:
+      for kid in s.kids:
+        cur.execute("SELECT registrant_id FROM registrant WHERE registrant_handle = %s AND registry_handle = %s", (kid.name, s.name))
+        registrant_id = cur.fetchone()[0]
+        for as_range in kid.resources.asn:
+          cur.execute("INSERT registrant_asn (start_as, end_as, registrant_id) VALUES (%s, %s, %s)", (as_range.min, as_range.max, registrant_id))
+        for v4_range in kid.resources.v4:
+          cur.execute("INSERT registrant_net (start_ip, end_ip, version, registrant_id) VALUES (%s, %s, 4, %s)", (v4_range.min, v4_range.max, registrant_id))
+        for v6_range in kid.resources.v6:
+          cur.execute("INSERT registrant_net (start_ip, end_ip, version, registrant_id) VALUES (%s, %s, 6, %s)", (v6_range.min, v6_range.max, registrant_id))
+        cur.execute("UPDATE registrant SET valid_until = %s WHERE registrant_id = %s", (kid.resources.valid_until.to_sql(), registrant_id))
+      for r in s.roa_requests:
+        cur.execute("INSERT roa_request (roa_request_handle, asn) VALUES (%s, %s)", (s.name, r.asn))
+        roa_request_id = cur.lastrowid
+        for version, prefix_set in ((4, r.v4), (6, r.v6)):
+          if prefix_set:
+            cur.executemany("INSERT roa_request_prefix (roa_request_id, prefix, prefixlen, max_prefixlen, version) VALUES (%s, %s, %s, %s, %s)",
+                            ((roa_request_id, x.prefix, x.prefixlen, x.max_prefixlen, version) for x in prefix_set))
+    db.close()
+
+  def run_daemons(self):
+    """
+    Run daemons for this entity.
+    """
+    rpki.log.info("Running daemons for %s" % self.name)
+    self.rpkid_process = subprocess.Popen((prog_python, prog_rpkid, "-d", "-c", self.name + ".conf") + (("-p", self.name + ".prof") if profile else ()))
+    self.irdbd_process = subprocess.Popen((prog_python, prog_irdbd, "-d", "-c", self.name + ".conf"))
+
+  def kill_daemons(self):
+    """
+    Kill daemons for this entity.
+    """
+    rpki.log.info("Killing daemons for %s" % self.name)
+    try:
+      for proc in (self.rpkid_process, self.irdbd_process):
+        try:
+          rpki.log.info("Killing pid %d" % proc.pid)
+          os.kill(proc.pid, signal.SIGTERM)
+        except OSError:
+          pass
+        proc.wait()
+    except AttributeError:
+      pass
+
+  def call_rpkid(self, pdus, cb):
+    """
+    Send a left-right message to this entity's RPKI daemon and return
+    the response.
+
+    If this entity is hosted (does not run its own RPKI daemon), all
+    of this happens with the hosting RPKI daemon.
+    """
+
+    rpki.log.info("Calling rpkid for %s" % self.name)
+
+    if self.is_hosted():
+      rpki.log.info("rpkid %s is hosted by rpkid %s, switching" % (self.name, self.hosted_by.name))
+      self = self.hosted_by
+      assert not self.is_hosted()
+
+    assert isinstance(pdus, (list, tuple))
+    assert self.rpki_port is not None
+
+    q_msg = rpki.left_right.msg.query(*pdus)
+    q_cms = rpki.left_right.cms_msg()
+    q_der = q_cms.wrap(q_msg, self.irbe_key, self.irbe_cert)
+    q_url = "http://localhost:%d/left-right" % self.rpki_port
+
+    rpki.log.debug(q_cms.pretty_print_content())
+
+    def done(r_der):
+      rpki.log.info("Callback from rpkid %s" % self.name)
+      r_cms = rpki.left_right.cms_msg(DER = r_der)
+      r_msg = r_cms.unwrap((self.rpkid_ta, self.rpkid_cert))
+      rpki.log.debug(r_cms.pretty_print_content())
+      assert r_msg.is_reply()
+      for r_pdu in r_msg:
+        assert not isinstance(r_pdu, rpki.left_right.report_error_elt)
+      cb(r_msg)
+
+    def lose(e):
+      raise
+
+    rpki.http.client(
+      url          = q_url,
+      msg          = q_der,
+      callback     = done,
+      errback      = lose)
+
+  def cross_certify(self, certificant, reverse = False):
+    """
+    Cross-certify and return the resulting certificate.
+    """
+
+    if reverse:
+      certifier = certificant
+      certificant = self.name + "-SELF"
+    elif self.is_leaf():
+      certifier = self.name + "-TA"
+    else:
+      certifier = self.name + "-SELF"
+    certfile = certifier + "-" + certificant + ".cer"
+
+    rpki.log.info("Cross certifying %s into %s's BPKI (%s)" % (certificant, certifier, certfile))
+
+    child = rpki.x509.X509(Auto_file = certificant + ".cer")
+    parent = rpki.x509.X509(Auto_file = certifier + ".cer")
+    keypair = rpki.x509.RSA(Auto_file = certifier + ".key")
+    serial_file = certifier + ".srl"
+
+    now = rpki.sundial.now()
+    notAfter = now + rpki.sundial.timedelta(days = 30)
+
+    try:
+      f = open(serial_file, "r")
+      serial = f.read()
+      f.close()
+      serial = int(serial.splitlines()[0], 16)
+    except IOError:
+      serial = 1
+
+    x = parent.cross_certify(keypair, child, serial, notAfter, now)
+
+    f = open(serial_file, "w")
+    f.write("%02x\n" % (serial + 1))
+    f.close()
+
+    f = open(certfile, "w")
+    f.write(x.get_PEM())
+    f.close()
+
+    rpki.log.debug("Cross certified (%s) issuer %s [%s] subject %s [%s]" % (certfile, x.getIssuer(), x.hAKI(), x.getSubject(), x.hSKI()))
+    return x
+
+  def create_rpki_objects(self, cb):
+    """
+    Create RPKI engine objects for this engine.
+
+    Root node of the engine tree is special, it too has a parent but
+    that one is the magic self-signed micro engine.
+
+    The rest of this is straightforward.  There are a lot of objects
+    to create, but we can do batch them all into one honking PDU, then
+    issue one more PDU to set BSC EE certificates based on the PKCS
+    #10 requests we get back when we tell rpkid to generate BSC keys.
+    """
+
+    assert not self.is_hosted() and not self.is_leaf()
+
+    selves = [self] + self.hosts
+
+    for i, s in enumerate(selves):
+      rpki.log.info("Creating RPKI objects for [%d] %s" % (i, s.name))
+
+    rpkid_pdus = []
+    pubd_pdus = []
+
+    for s in selves:
+
+      rpkid_pdus.append(rpki.left_right.self_elt.make_pdu(
+        action = "create",
+        self_handle = s.name,
+        crl_interval = s.crl_interval,
+        regen_margin = s.regen_margin,
+        bpki_cert = (s.cross_certify(s.hosted_by.name + "-TA", reverse = True)
+                     if s.is_hosted() else
+                     rpki.x509.X509(Auto_file = s.name + "-SELF.cer"))))
+
+      rpkid_pdus.append(rpki.left_right.bsc_elt.make_pdu(
+        action = "create",
+        self_handle = s.name,
+        bsc_handle = "b",
+        generate_keypair = True))
+
+      pubd_pdus.append(rpki.publication.client_elt.make_pdu(
+        action = "create",
+        client_handle = s.client_handle,
+        base_uri = s.sia_base,
+        bpki_cert = s.cross_certify(pubd_name + "-TA", reverse = True)))
+
+      rpkid_pdus.append(rpki.left_right.repository_elt.make_pdu(
+        action = "create",
+        self_handle = s.name,
+        bsc_handle = "b",
+        repository_handle = "r",
+        bpki_cert = s.cross_certify(pubd_name + "-TA"),
+        peer_contact_uri = "http://localhost:%d/client/%s" % (pubd_port, s.client_handle)))
+
+      for k in s.kids:
+        rpkid_pdus.append(rpki.left_right.child_elt.make_pdu(
+          action = "create",
+          self_handle = s.name,
+          child_handle = k.name,
+          bsc_handle = "b",
+          bpki_cert = s.cross_certify(k.name + ("-TA" if k.is_leaf() else "-SELF"))))
+
+      if s.is_root():
+        rootd_cert = s.cross_certify(rootd_name + "-TA")
+        rpkid_pdus.append(rpki.left_right.parent_elt.make_pdu(
+            action = "create",
+            self_handle = s.name,
+            parent_handle = "rootd",
+            bsc_handle = "b",
+            repository_handle = "r",
+            sia_base = s.sia_base,
+            bpki_cms_cert = rootd_cert,
+            sender_name = s.name,
+            recipient_name = "rootd",
+            peer_contact_uri = "http://localhost:%s/" % rootd_port))
+      else:
+        rpkid_pdus.append(rpki.left_right.parent_elt.make_pdu(
+          action = "create",
+          self_handle = s.name,
+          parent_handle = s.parent.name,
+          bsc_handle = "b",
+          repository_handle = "r",
+          sia_base = s.sia_base,
+          bpki_cms_cert = s.cross_certify(s.parent.name + "-SELF"),
+          sender_name = s.name,
+          recipient_name = s.parent.name,
+          peer_contact_uri = "http://localhost:%s/up-down/%s/%s" % (s.parent.get_rpki_port(), s.parent.name, s.name)))
+
+    def one():
+      call_pubd(pubd_pdus, cb = two)
+
+    def two(vals):
+      self.call_rpkid(rpkid_pdus, cb = three)
+
+    def three(vals):
+
+      bsc_dict = dict((b.self_handle, b) for b in vals if isinstance(b, rpki.left_right.bsc_elt))
+
+      bsc_pdus = []
+
+      for s in selves:
+        b = bsc_dict[s.name]
+
+        rpki.log.info("Issuing BSC EE cert for %s" % s.name)
+        cmd = (prog_openssl, "x509", "-req", "-sha256", "-extfile", s.name + "-RPKI.conf", "-extensions", "req_x509_ext", "-days", "30",
+               "-CA", s.name + "-SELF.cer", "-CAkey",    s.name + "-SELF.key", "-CAcreateserial", "-text")
+        signer = subprocess.Popen(cmd, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE)
+        signed = signer.communicate(input = b.pkcs10_request.get_PEM())
+        if not signed[0]:
+          rpki.log.warn(signed[1])
+          raise RuntimeError, "Couldn't issue BSC EE certificate"
+        s.bsc_ee = rpki.x509.X509(PEM = signed[0])
+        s.bsc_crl = rpki.x509.CRL(PEM_file = s.name + "-SELF.crl")
+        rpki.log.info("BSC EE cert for %s SKI %s" % (s.name, s.bsc_ee.hSKI()))
+
+        bsc_pdus.append(rpki.left_right.bsc_elt.make_pdu(
+          action = "set",
+          self_handle = s.name,
+          bsc_handle = "b",
+          signing_cert = s.bsc_ee,
+          signing_cert_crl = s.bsc_crl))
+
+      self.call_rpkid(bsc_pdus, cb = four)
+
+    def four(vals):
+      cb()
+
+    one()
+
+  def setup_yaml_leaf(self):
+    """
+    Generate certificates and write YAML scripts for leaf nodes.
+
+    We're cheating a bit here: properly speaking, we can't generate
+    issue or revoke requests without knowing the class, which is
+    generated on the fly, but at the moment the test case is
+    simplistic enough that the class will always be "1", so we just
+    wire in that value for now.
+
+    Well, ok, we just broke that assumption.  Now we do something even
+    nastier, just to eke a bit more life out of this kludge.  This
+    really needs to be rewritten, but it may require a different tool
+    than testpoke.
+    """
+
+    if not os.path.exists(self.name + ".key"):
+      rpki.log.info("Generating RPKI key for %s" % self.name)
+      subprocess.check_call((prog_openssl, "genrsa", "-out", self.name + ".key", "2048" ),
+                            stdout = subprocess.PIPE, stderr = subprocess.STDOUT)
+    ski = rpki.x509.RSA(PEM_file = self.name + ".key").gSKI()
+
+    if self.parent.is_hosted():
+      parent_host = self.parent.hosted_by.name
+    else:
+      parent_host = self.parent.name
+
+    self.cross_certify(self.parent.name + "-SELF")
+    self.cross_certify(parent_host + "-TA")
+
+    rpki.log.info("Writing leaf YAML for %s" % self.name)
+    f = open(self.name + ".yaml", "w")
+    f.write(yaml_fmt_1 % {
+      "parent_name"  : self.parent.name,
+      "parent_host"  : parent_host,
+      "my_name"      : self.name,
+      "http_port"    : self.parent.get_rpki_port(),
+      "class_name"   : 2 if self.parent.is_hosted() else 1,
+      "sia"          : self.sia_base,
+      "ski"          : ski })
+    f.close()
+
+  def run_cron(self, cb):
+    """
+    Trigger cron run for this engine.
+    """
+
+    rpki.log.info("Running cron for %s" % self.name)
+
+    assert self.rpki_port is not None
+
+    def done(result):
+      assert result == "OK", 'Expected "OK" result from cronjob, got %r' % result
+      cb()
+
+    rpki.http.client(
+      url      = "http://localhost:%d/cronjob" % self.rpki_port,
+      msg      = "Run cron now, please",
+      callback = done,
+      errback  = done)
+
+  def run_yaml(self):
+    """
+    Run YAML scripts for this leaf entity.  Since we're not bothering
+    to check the class list returned by the list command, the issue
+    command may fail, so we treat failure of the list command as an
+    error, but only issue a warning when issue fails.
+    """
+
+    rpki.log.info("Running YAML for %s" % self.name)
+    subprocess.check_call((prog_python, prog_poke, "-y", self.name + ".yaml", "-r", "list"))
+    if subprocess.call((prog_python, prog_poke, "-y", self.name + ".yaml", "-r", "issue")) != 0:
+      rpki.log.warn("YAML issue command failed for %s, continuing" % self.name)
+
+def setup_bpki_cert_chain(name, ee = (), ca = ()):
+  """
+  Build a set of BPKI certificates.
+  """
+  s = "exec >/dev/null 2>&1\n"
+  #s = "set -x\n"
+  for kind in ("TA",) + ee + ca:
+    d = { "name"    : name,
+          "kind"    : kind,
+          "ca"      : "false" if kind in ee else "true",
+          "openssl" : prog_openssl }
+    f = open("%(name)s-%(kind)s.conf" % d, "w")
+    f.write(bpki_cert_fmt_1 % d)
+    f.close()
+    if not os.path.exists("%(name)s-%(kind)s.key" % d):
+      s += bpki_cert_fmt_2 % d
+    s += bpki_cert_fmt_3 % d
+  d = { "name" : name, "openssl" : prog_openssl }
+  s += bpki_cert_fmt_4 % d
+  for kind in ee + ca:
+    d["kind"] =  kind
+    s += bpki_cert_fmt_5 % d
+  for kind in ("TA",) + ca:
+    d["kind"] =  kind
+    s += bpki_cert_fmt_6 % d
+  subprocess.check_call(s, shell = True)
+
+def setup_rootd(rpkid, rootd_yaml):
+  """
+  Write the config files for rootd.
+  """
+  rpkid.cross_certify(rootd_name + "-TA", reverse = True)
+  rpki.log.info("Writing config files for %s" % rootd_name)
+  d = { "rootd_name" : rootd_name,
+        "rootd_port" : rootd_port,
+        "rpkid_name" : rpkid.name,
+        "rootd_sia"  : rootd_sia,
+        "rsyncd_dir" : rsyncd_dir,
+        "openssl"    : prog_openssl,
+        "lifetime"   : rootd_yaml.get("lifetime", "30d") }
+  f = open(rootd_name + ".conf", "w")
+  f.write(rootd_fmt_1 % d)
+  f.close()
+  s = "exec >/dev/null 2>&1\n"
+  #s = "set -x\n"
+  if not os.path.exists(rootd_name + ".key"):
+    s += rootd_fmt_2 % d
+  s += rootd_fmt_3 % d
+  subprocess.check_call(s, shell = True)
+
+def setup_rcynic():
+  """
+  Write the config file for rcynic.
+  """
+  rpki.log.info("Config file for rcynic")
+  d = { "rcynic_name" : rcynic_name,
+        "rootd_name"  : rootd_name,
+        "rootd_sia"   : rootd_sia }
+  f = open(rcynic_name + ".conf", "w")
+  f.write(rcynic_fmt_1 % d)
+  f.close()
+
+def setup_rsyncd():
+  """
+  Write the config file for rsyncd.
+  """
+  rpki.log.info("Config file for rsyncd")
+  d = { "rsyncd_name"   : rsyncd_name,
+        "rsyncd_port"   : rsyncd_port,
+        "rsyncd_module" : rsyncd_module,
+        "rsyncd_dir"    : rsyncd_dir }
+  f = open(rsyncd_name + ".conf", "w")
+  f.write(rsyncd_fmt_1 % d)
+  f.close()
+
+def setup_publication(pubd_sql):
+  """
+  Set up publication daemon.
+  """
+  rpki.log.info("Configure publication daemon")
+  pubd_dir = os.getcwd() + "/publication/"
+  assert rootd_sia.startswith("rsync://")
+  i = 0
+  for j in xrange(4):
+    i = rootd_sia.index("/", i + 1)
+  global rsyncd_dir
+  rsyncd_dir = pubd_dir.rstrip("/") + rootd_sia[i:]
+  os.makedirs(rsyncd_dir)
+  db = MySQLdb.connect(db = pubd_db_name, user = pubd_db_user, passwd = pubd_db_pass)
+  cur = db.cursor()
+  db.autocommit(True)
+  for sql in pubd_sql:
+    cur.execute(sql)
+  db.close()
+  d = { "pubd_name"    : pubd_name,
+        "pubd_port"    : pubd_port,
+        "pubd_db_name" : pubd_db_name,
+        "pubd_db_user" : pubd_db_user,
+        "pubd_db_pass" : pubd_db_pass,
+        "pubd_dir"     : pubd_dir }
+  f = open(pubd_name + ".conf", "w")
+  f.write(pubd_fmt_1 % d)
+  f.close()
+  global pubd_ta
+  global pubd_irbe_key
+  global pubd_irbe_cert
+  global pubd_pubd_cert
+  pubd_ta        = rpki.x509.X509(Auto_file = pubd_name + "-TA.cer")
+  pubd_irbe_key  = rpki.x509.RSA( Auto_file = pubd_name + "-IRBE.key")
+  pubd_irbe_cert = rpki.x509.X509(Auto_file = pubd_name + "-IRBE.cer")
+  pubd_pubd_cert = rpki.x509.X509(Auto_file = pubd_name + "-PUBD.cer")
+
+def call_pubd(pdus, cb):
+  """
+  Send a publication message to publication daemon and return the
+  response.
+  """
+  rpki.log.info("Calling pubd")
+  q_msg = rpki.publication.msg.query(*pdus)
+  q_cms = rpki.publication.cms_msg()
+  q_der = q_cms.wrap(q_msg, pubd_irbe_key, pubd_irbe_cert)
+  q_url = "http://localhost:%d/control" % pubd_port
+
+  rpki.log.debug(q_cms.pretty_print_content())
+
+  def call_pubd_cb(r_der):
+    r_cms = rpki.publication.cms_msg(DER = r_der)
+    r_msg = r_cms.unwrap((pubd_ta, pubd_pubd_cert))
+    rpki.log.debug(r_cms.pretty_print_content())
+    assert r_msg.is_reply()
+    for r_pdu in r_msg:
+      assert not isinstance(r_pdu, rpki.publication.report_error_elt)
+    cb(r_msg)
+
+  def call_pubd_eb(e):
+    rpki.log.warn("Problem calling pubd: %s" % e)
+    rpki.log.traceback()
+
+  rpki.http.client(
+    url          = q_url,
+    msg          = q_der,
+    callback     = call_pubd_cb,
+    errback      = call_pubd_eb)
+
+def set_pubd_crl(cb):
+  """
+  Whack publication daemon's bpki_crl.  This must be configured before
+  publication daemon starts talking to its clients, and must be
+  updated whenever we update the CRL.
+  """
+  rpki.log.info("Setting pubd's BPKI CRL")
+  call_pubd([rpki.publication.config_elt.make_pdu(action = "set", bpki_crl = rpki.x509.CRL(Auto_file = pubd_name + "-TA.crl"))],
+            cb = lambda ignored: cb())
+
+def run_rcynic():
+  """
+  Run rcynic to see whether what was published makes sense.
+  """
+  rpki.log.info("Running rcynic")
+  env = os.environ.copy()
+  env["TZ"] = ""
+  subprocess.check_call((prog_rcynic, "-c", rcynic_name + ".conf"), env = env)
+  subprocess.call(rcynic_stats, shell = True, env = env)
+
+def mangle_sql(filename):
+  """
+  Mangle an SQL file into a sequence of SQL statements.
+  """
+  
+  # There is no pretty way to do this.  Just shut your eyes, it'll be
+  # over soon.
+  
+  f = open(filename)
+  statements = " ".join(" ".join(word for word in line.expandtabs().split(" ") if word)
+                        for line in [line.strip(" \t\n") for line in f.readlines()]
+                        if line and not line.startswith("--")).rstrip(";").split(";")
+  f.close()
+  return [stmt.strip() for stmt in statements]
+
+bpki_cert_fmt_1 = '''\
+[ req ]
+distinguished_name      = req_dn
+x509_extensions         = req_x509_ext
+prompt                  = no
+default_md              = sha256
+
+[ req_dn ]
+CN                      = Test Certificate %(name)s %(kind)s
+
+[ req_x509_ext ]
+basicConstraints        = critical,CA:%(ca)s
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always
+
+
+[ ca ]
+default_ca = ca_default
+
+[ ca_default ]
+
+certificate             = %(name)s-%(kind)s.cer
+serial                  = %(name)s-%(kind)s.srl
+private_key             = %(name)s-%(kind)s.key
+database                = %(name)s-%(kind)s.idx
+crlnumber               = %(name)s-%(kind)s.cnm
+default_crl_days        = 30
+default_md              = sha256
+'''
+
+bpki_cert_fmt_2 = '''\
+%(openssl)s genrsa -out %(name)s-%(kind)s.key 2048 &&
+'''
+
+bpki_cert_fmt_3 = '''\
+%(openssl)s req -new -sha256 -key %(name)s-%(kind)s.key -out %(name)s-%(kind)s.req -config %(name)s-%(kind)s.conf &&
+touch %(name)s-%(kind)s.idx &&
+echo >%(name)s-%(kind)s.cnm 01 &&
+'''
+
+bpki_cert_fmt_4 = '''\
+%(openssl)s x509 -req -sha256 -in %(name)s-TA.req -out %(name)s-TA.cer -extfile %(name)s-TA.conf -extensions req_x509_ext -signkey %(name)s-TA.key -days 60 -text \
+'''
+
+bpki_cert_fmt_5 = ''' && \
+%(openssl)s x509 -req -sha256 -in %(name)s-%(kind)s.req -out %(name)s-%(kind)s.cer -extfile %(name)s-%(kind)s.conf -extensions req_x509_ext -days 30 -text \
+                     -CA %(name)s-TA.cer -CAkey %(name)s-TA.key -CAcreateserial \
+'''
+
+bpki_cert_fmt_6 = ''' && \
+%(openssl)s ca -batch -gencrl -out %(name)s-%(kind)s.crl -config %(name)s-%(kind)s.conf \
+'''
+
+yaml_fmt_1 = '''---
+version:                1
+posturl:                http://localhost:%(http_port)s/up-down/%(parent_name)s/%(my_name)s
+recipient-id:           "%(parent_name)s"
+sender-id:              "%(my_name)s"
+
+cms-cert-file:          %(my_name)s-RPKI.cer
+cms-key-file:           %(my_name)s-RPKI.key
+cms-ca-cert-file:       %(my_name)s-TA.cer
+cms-crl-file:           %(my_name)s-TA.crl
+cms-ca-certs-file:
+  -                     %(my_name)s-TA-%(parent_name)s-SELF.cer
+
+ssl-cert-file:          %(my_name)s-RPKI.cer
+ssl-key-file:           %(my_name)s-RPKI.key
+ssl-ca-cert-file:       %(my_name)s-TA.cer
+ssl-ca-certs-file:
+  -                     %(my_name)s-TA-%(parent_host)s-TA.cer
+
+# We're cheating here by hardwiring the class name
+
+requests:
+  list:
+    type:                       list
+  issue:
+    type:                       issue
+    class:                      %(class_name)s
+    sia:
+      -                         %(sia)s
+    cert-request-key-file:      %(my_name)s.key
+  revoke:
+    type:                       revoke
+    class:                      %(class_name)s
+    ski:                        %(ski)s
+'''
+
+conf_fmt_1 = '''\
+
+[irdbd]
+
+startup-message = This is %(my_name)s irdbd
+
+sql-database    = %(irdb_db_name)s
+sql-username    = irdb
+sql-password    = %(irdb_db_pass)s
+bpki-ta         = %(my_name)s-TA.cer
+rpkid-cert      = %(my_name)s-RPKI.cer
+irdbd-cert      = %(my_name)s-IRDB.cer
+irdbd-key       = %(my_name)s-IRDB.key
+http-url       = http://localhost:%(irdb_port)d/
+
+[irbe_cli]
+
+rpkid-bpki-ta   = %(my_name)s-TA.cer
+rpkid-cert      = %(my_name)s-RPKI.cer
+rpkid-irbe-cert = %(my_name)s-IRBE.cer
+rpkid-irbe-key  = %(my_name)s-IRBE.key
+rpkid-url       = http://localhost:%(rpki_port)d/left-right
+
+[rpkid]
+
+startup-message = This is %(my_name)s rpkid
+
+sql-database    = %(rpki_db_name)s
+sql-username    = rpki
+sql-password    = %(rpki_db_pass)s
+
+bpki-ta         = %(my_name)s-TA.cer
+rpkid-key       = %(my_name)s-RPKI.key
+rpkid-cert      = %(my_name)s-RPKI.cer
+irdb-cert       = %(my_name)s-IRDB.cer
+irbe-cert       = %(my_name)s-IRBE.cer
+
+irdb-url        = http://localhost:%(irdb_port)d/
+
+server-host     = localhost
+server-port     = %(rpki_port)d
+
+use-internal-cron = false
+'''
+
+rootd_fmt_1 = '''\
+
+[rootd]
+
+bpki-ta                 = %(rootd_name)s-TA.cer
+rootd-bpki-cert         = %(rootd_name)s-RPKI.cer
+rootd-bpki-key          = %(rootd_name)s-RPKI.key
+rootd-bpki-crl          = %(rootd_name)s-TA.crl
+child-bpki-cert         = %(rootd_name)s-TA-%(rpkid_name)s-SELF.cer
+
+server-port             = %(rootd_port)s
+
+rpki-root-dir           = %(rsyncd_dir)s
+rpki-base-uri           = %(rootd_sia)s
+rpki-root-cert-uri      = %(rootd_sia)s%(rootd_name)s.cer
+
+rpki-root-key           = %(rootd_name)s.key
+rpki-root-cert          = %(rootd_name)s.cer
+
+rpki-subject-pkcs10     = %(rootd_name)s.subject.pkcs10
+rpki-subject-lifetime   = %(lifetime)s
+
+rpki-root-crl           = Bandicoot.crl
+rpki-root-manifest      = Bandicoot.mnf
+
+rpki-class-name         = Wombat
+rpki-subject-cert       = Wombat.cer
+
+[req]
+default_bits            = 2048
+encrypt_key             = no
+distinguished_name      = req_dn
+#req_extensions          = req_x509_ext
+prompt                  = no
+default_md              = sha256
+default_days            = 60
+
+[req_dn]
+CN                      = Completely Bogus Test Root (NOT FOR PRODUCTION USE)
+
+[req_x509_ext]
+basicConstraints        = critical,CA:true
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always
+
+[req_x509_rpki_ext]
+basicConstraints        = critical,CA:true
+subjectKeyIdentifier    = hash
+keyUsage                = critical,keyCertSign,cRLSign
+subjectInfoAccess       = 1.3.6.1.5.5.7.48.5;URI:%(rootd_sia)s,1.3.6.1.5.5.7.48.10;URI:%(rootd_sia)sBandicoot.mnf
+sbgp-autonomousSysNum   = critical,AS:0-4294967295
+sbgp-ipAddrBlock        = critical,IPv4:0.0.0.0/0,IPv6:0::/0
+certificatePolicies     = critical, @rpki_certificate_policy
+
+[rpki_certificate_policy]
+
+policyIdentifier = 1.3.6.1.5.5.7.14.2
+'''
+
+rootd_fmt_2 = '''\
+%(openssl)s genrsa -out %(rootd_name)s.key 2048 &&
+'''
+
+rootd_fmt_3 = '''\
+%(openssl)s rsa -pubout -outform DER -in %(rootd_name)s.key -out %(rootd_name)s.pkey  &&
+%(openssl)s req -new -sha256 -key %(rootd_name)s.key -out %(rootd_name)s.req -config %(rootd_name)s.conf -text -extensions req_x509_rpki_ext &&
+%(openssl)s x509 -req -sha256 -in %(rootd_name)s.req -out %(rootd_name)s.cer -outform DER -extfile %(rootd_name)s.conf -extensions req_x509_rpki_ext \
+                      -signkey %(rootd_name)s.key &&
+ln -f %(rootd_name)s.cer  %(rsyncd_dir)s
+'''
+
+rcynic_fmt_1 = '''\
+[rcynic]
+xml-summary             = %(rcynic_name)s.xml
+jitter                  = 0
+use-links               = yes
+use-syslog              = no
+use-stderr              = yes
+log-level               = log_debug
+#trust-anchor            = %(rootd_name)s.cer
+trust-anchor-uri-with-key = %(rootd_sia)s%(rootd_name)s.cer %(rootd_name)s.pkey
+'''
+
+rsyncd_fmt_1 = '''\
+port                    = %(rsyncd_port)d
+address                 = localhost
+
+[%(rsyncd_module)s]
+read only               = yes
+transfer logging        = yes
+use chroot              = no
+path                    = %(rsyncd_dir)s
+comment                 = RPKI test
+'''
+
+pubd_fmt_1 = '''\
+[pubd]
+
+sql-database            = %(pubd_db_name)s
+sql-username            = %(pubd_db_user)s
+sql-password            = %(pubd_db_pass)s
+bpki-ta                 = %(pubd_name)s-TA.cer
+pubd-cert               = %(pubd_name)s-PUBD.cer
+pubd-key                = %(pubd_name)s-PUBD.key
+irbe-cert               = %(pubd_name)s-IRBE.cer
+server-host             = localhost
+server-port             = %(pubd_port)d
+publication-base        = %(pubd_dir)s
+'''
+
+main()
diff --git a/rpkid.without_tls/tests/smoketest.setup.sql b/rpkid.without_tls/tests/smoketest.setup.sql
new file mode 100644
index 00000000..326988f1
--- /dev/null
+++ b/rpkid.without_tls/tests/smoketest.setup.sql
@@ -0,0 +1,112 @@
+-- $Id$
+--
+-- Run this manually under the MySQL CLI to set up databases for testdb.py.
+-- testdb.py doesn't do this automatically because it requires privileges
+-- that smoketest.py doesn't (or at least shouldn't) have.
+
+-- Copyright (C) 2009  Internet Systems Consortium ("ISC")
+--
+-- Permission to use, copy, modify, and distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+-- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+-- 
+-- Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+--
+-- Permission to use, copy, modify, and distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+-- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+
+CREATE DATABASE irdb0;
+CREATE DATABASE irdb1;
+CREATE DATABASE irdb2;
+CREATE DATABASE irdb3;
+CREATE DATABASE irdb4;
+CREATE DATABASE irdb5;
+CREATE DATABASE irdb6;
+CREATE DATABASE irdb7;
+CREATE DATABASE irdb8;
+CREATE DATABASE irdb9;
+CREATE DATABASE irdb10;
+CREATE DATABASE irdb11;
+
+CREATE DATABASE rpki0;
+CREATE DATABASE rpki1;
+CREATE DATABASE rpki2;
+CREATE DATABASE rpki3;
+CREATE DATABASE rpki4;
+CREATE DATABASE rpki5;
+CREATE DATABASE rpki6;
+CREATE DATABASE rpki7;
+CREATE DATABASE rpki8;
+CREATE DATABASE rpki9;
+CREATE DATABASE rpki10;
+CREATE DATABASE rpki11;
+
+CREATE DATABASE pubd0;
+CREATE DATABASE pubd1;
+CREATE DATABASE pubd2;
+CREATE DATABASE pubd3;
+CREATE DATABASE pubd4;
+CREATE DATABASE pubd5;
+CREATE DATABASE pubd6;
+CREATE DATABASE pubd7;
+CREATE DATABASE pubd8;
+CREATE DATABASE pubd9;
+CREATE DATABASE pubd10;
+CREATE DATABASE pubd11;
+
+GRANT ALL ON irdb0.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb1.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb2.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb3.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb4.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb5.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb6.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb7.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb8.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb9.*  TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb10.* TO irdb@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON irdb11.* TO irdb@localhost IDENTIFIED BY 'fnord';
+
+GRANT ALL ON rpki0.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki1.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki2.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki3.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki4.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki5.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki6.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki7.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki8.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki9.*  TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki10.* TO rpki@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON rpki11.* TO rpki@localhost IDENTIFIED BY 'fnord';
+
+GRANT ALL ON pubd0.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd1.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd2.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd3.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd4.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd5.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd6.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd7.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd8.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd9.*  TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd10.* TO pubd@localhost IDENTIFIED BY 'fnord';
+GRANT ALL ON pubd11.* TO pubd@localhost IDENTIFIED BY 'fnord';
diff --git a/rpkid.without_tls/tests/split-protocol-samples.xsl b/rpkid.without_tls/tests/split-protocol-samples.xsl
new file mode 100644
index 00000000..8800b6da
--- /dev/null
+++ b/rpkid.without_tls/tests/split-protocol-samples.xsl
@@ -0,0 +1,40 @@
+<!--  -*- SGML -*-
+  - $Id$
+  -
+  - Copyright (C) 2007-2008  American Registry for Internet Numbers ("ARIN")
+  -
+  - Permission to use, copy, modify, and distribute this software for any
+  - purpose with or without fee is hereby granted, provided that the above
+  - copyright notice and this permission notice appear in all copies.
+  -
+  - THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  - AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  - PERFORMANCE OF THIS SOFTWARE.
+ --> 
+
+<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"
+               xmlns:exsl="http://exslt.org/common"
+	       extension-element-prefixes="exsl">
+
+  <xsl:param name="dir">.</xsl:param>
+  <xsl:param name="verbose" select="1"/>
+
+  <xsl:strip-space elements="*"/>
+
+  <xsl:template match="/completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint">
+    <xsl:for-each select="*">
+      <xsl:variable name="filename" select="concat($dir, '/pdu.', format-number(position(), '000'), '.xml')"/>
+      <xsl:if test="$verbose">
+        <xsl:message><xsl:text>Writing </xsl:text><xsl:value-of select="$filename"/></xsl:message>
+      </xsl:if>
+      <exsl:document href="{$filename}" indent="yes" encoding="US-ASCII">
+        <xsl:comment>Automatically generated, do not edit.</xsl:comment>
+        <xsl:copy-of select="." />
+      </exsl:document>
+    </xsl:for-each>
+  </xsl:template>
+</xsl:transform>
diff --git a/rpkid.without_tls/tests/sql-cleaner.py b/rpkid.without_tls/tests/sql-cleaner.py
new file mode 100644
index 00000000..7900ddf9
--- /dev/null
+++ b/rpkid.without_tls/tests/sql-cleaner.py
@@ -0,0 +1,33 @@
+"""
+(Re)Initialize SQL tables used by these programs.
+
+$Id$
+
+Copyright (C) 2009--2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+"""
+
+import subprocess, rpki.config
+
+cfg = rpki.config.parser("yamltest.conf", "yamltest", allow_missing = True)
+
+for name in ("rpkid", "irdbd", "pubd"):
+
+  username = cfg.get("%s_sql_username" % name, name[:4])
+  password = cfg.get("%s_sql_password" % name, "fnord")
+
+  for i in xrange(12):
+    subprocess.check_call(
+      ("mysql", "-u", username, "-p" + password, "%s%d" % (name[:4], i)),
+      stdin = open("../%s.sql" % name))
diff --git a/rpkid.without_tls/tests/sql-dumper.py b/rpkid.without_tls/tests/sql-dumper.py
new file mode 100644
index 00000000..933b7a2c
--- /dev/null
+++ b/rpkid.without_tls/tests/sql-dumper.py
@@ -0,0 +1,32 @@
+"""
+Dump backup copies of SQL tables used by these programs.
+
+$Id$
+
+Copyright (C) 2009--2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+"""
+
+import subprocess, rpki.config
+
+cfg = rpki.config.parser("yamltest.conf", "yamltest")
+
+for name in ("rpkid", "irdbd", "pubd"):
+
+  username = cfg.get("%s_sql_username" % name, name[:4])
+  password = cfg.get("%s_sql_password" % name, "fnord")
+
+  cmd = ["mysqldump", "-u", username, "-p" + password, "--databases", name[:4]]
+  cmd.extend("%s%d" % (name[:4], i) for i in xrange(12))
+  subprocess.check_call(cmd, stdout = open("backup.%s.sql" % name, "w"))
diff --git a/rpkid.without_tls/tests/testpoke.py b/rpkid.without_tls/tests/testpoke.py
new file mode 100644
index 00000000..0e9c06cd
--- /dev/null
+++ b/rpkid.without_tls/tests/testpoke.py
@@ -0,0 +1,169 @@
+"""
+Trivial RPKI up-down protocol client, for testing.
+
+Configuration file is YAML to be compatable with APNIC rpki_poke.pl tool.
+
+Usage: python testpoke.py [ { -y | --yaml }    configfile ]
+                          [ { -r | --request } requestname ]
+                          [ { -d | --debug } ]
+                          [ { -h | --help } ]
+
+Default configuration file is testpoke.yaml, override with --yaml option.
+
+$Id$
+
+Copyright (C) 2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+"""
+
+import os, time, getopt, sys, yaml
+import rpki.resource_set, rpki.up_down, rpki.left_right, rpki.x509
+import rpki.http, rpki.config, rpki.exceptions
+import rpki.relaxng, rpki.oids, rpki.log, rpki.async
+
+os.environ["TZ"] = "UTC"
+time.tzset()
+
+def usage(code):
+  print __doc__
+  sys.exit(code)
+
+yaml_file = "testpoke.yaml"
+yaml_cmd = None
+debug = False
+
+opts, argv = getopt.getopt(sys.argv[1:], "y:r:h?d", ["yaml=", "request=", "help", "debug"])
+for o, a in opts:
+  if o in ("-h", "--help", "-?"):
+    usage(0)
+  elif o in ("-y", "--yaml"):
+    yaml_file = a
+  elif o in ("-r", "--request"):
+    yaml_cmd = a
+  elif o in ("-d", "--debug"):
+    debug = True
+if argv:
+  usage(1)
+
+rpki.log.init("testpoke")
+
+if debug:
+  rpki.log.set_trace(True)
+
+f = open(yaml_file)
+yaml_data = yaml.load(f)
+f.close()
+
+if yaml_cmd is None and len(yaml_data["requests"]) == 1:
+  yaml_cmd = yaml_data["requests"].keys()[0]
+
+if yaml_cmd is None:
+  usage(1)
+
+yaml_req = yaml_data["requests"][yaml_cmd]
+
+def get_PEM(name, cls, y = yaml_data):
+  if name in y:
+    return cls(PEM = y[name])
+  if name + "-file" in y:
+    return cls(PEM_file = y[name + "-file"])
+  return None
+
+def get_PEM_chain(name, cert = None):
+  chain = []
+  if cert is not None:
+    chain.append(cert)
+  if name in yaml_data:
+    chain.extend([rpki.x509.X509(PEM = x) for x in yaml_data[name]])
+  elif name + "-file" in yaml_data:
+    chain.extend([rpki.x509.X509(PEM_file = x) for x in yaml_data[name + "-file"]])
+  return chain
+
+def query_up_down(q_pdu):
+  q_msg = rpki.up_down.message_pdu.make_query(
+    payload = q_pdu,
+    sender = yaml_data["sender-id"],
+    recipient = yaml_data["recipient-id"])
+  q_der = rpki.up_down.cms_msg().wrap(q_msg, cms_key, cms_certs, cms_crl)
+
+  def done(r_der):
+    r_cms = rpki.up_down.cms_msg(DER = r_der)
+    r_msg = r_cms.unwrap([cms_ta] + cms_ca_certs)
+    print r_cms.pretty_print_content()
+    try:
+      r_msg.payload.check_response()
+    except (rpki.async.ExitNow, SystemExit):
+      raise
+    except Exception, e:
+      fail(e)
+
+  rpki.http.want_persistent_client = False
+
+  rpki.http.client(
+    msg          = q_der,
+    url          = yaml_data["posturl"],
+    callback     = done,
+    errback      = fail)
+
+def do_list():
+  query_up_down(rpki.up_down.list_pdu())
+
+def do_issue():
+  q_pdu = rpki.up_down.issue_pdu()
+  req_key = get_PEM("cert-request-key", rpki.x509.RSA, yaml_req) or cms_key
+  sia = ((rpki.oids.name2oid["id-ad-caRepository"], ("uri", yaml_req["sia"][0])),
+         (rpki.oids.name2oid["id-ad-rpkiManifest"], ("uri", yaml_req["sia"][0] + req_key.gSKI() + ".mnf")))
+  q_pdu.class_name = yaml_req["class"]
+  q_pdu.pkcs10 = rpki.x509.PKCS10.create_ca(req_key, sia)
+  query_up_down(q_pdu)
+
+def do_revoke():
+  q_pdu = rpki.up_down.revoke_pdu()
+  q_pdu.class_name = yaml_req["class"]
+  q_pdu.ski = yaml_req["ski"]
+  query_up_down(q_pdu)
+
+dispatch = { "list" : do_list, "issue" : do_issue, "revoke" : do_revoke }
+
+def fail(e):
+  if debug:
+    rpki.log.traceback()
+  sys.exit("Testpoke failed: %s" % e)
+
+cms_ta         = get_PEM("cms-ca-cert", rpki.x509.X509)
+cms_cert       = get_PEM("cms-cert", rpki.x509.X509)
+cms_key        = get_PEM("cms-key", rpki.x509.RSA)
+cms_crl        = get_PEM("cms-crl", rpki.x509.CRL)
+cms_certs      = get_PEM_chain("cms-cert-chain", cms_cert)
+cms_ca_certs   = get_PEM_chain("cms-ca-certs")
+
+try:
+  dispatch[yaml_req["type"]]()
+  rpki.async.event_loop()
+except Exception, e:
+  fail(e)
diff --git a/rpkid.without_tls/tests/testpoke.xsl b/rpkid.without_tls/tests/testpoke.xsl
new file mode 100644
index 00000000..91658b0b
--- /dev/null
+++ b/rpkid.without_tls/tests/testpoke.xsl
@@ -0,0 +1,78 @@
+<!--  -*- SGML -*-
+  - $Id$
+  -
+  - Copyright (C) 2008  American Registry for Internet Numbers ("ARIN")
+  -
+  - Permission to use, copy, modify, and distribute this software for any
+  - purpose with or without fee is hereby granted, provided that the above
+  - copyright notice and this permission notice appear in all copies.
+  -
+  - THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  - AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  - PERFORMANCE OF THIS SOFTWARE.
+ --> 
+
+<!--
+  - Decoder ring for testpoke.py XML output.  Use this to get a
+  - (somewhat) human-readable listing and to put OpenSSL-style
+  - delimiters onto the certificates so that "openssl x509" can read
+  - the result.  With a tad more work, we could select just one out of
+  - the set of multiple certificates, or output YAML.  For the moment,
+  - I'll settle for being readable by human beings and OpenSSL.
+ --> 
+
+<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"
+	       xmlns:rpkiud="http://www.apnic.net/specs/rescerts/up-down/">
+
+  <xsl:output method="text"/>
+
+  <xsl:param name="show-issuer" select="0"/>
+
+  <xsl:template match="/rpkiud:message[@type = 'list_response']">
+    <xsl:value-of select="concat('[Message]',                 '&#10;',
+                                 'Version:     ', @version,   '&#10;',
+                                 'Sender:      ', @sender,    '&#10;',
+				 'Recipient:   ', @recipient, '&#10;')"/>
+    <xsl:apply-templates select="rpkiud:class"/>
+  </xsl:template>
+
+  <xsl:template match="rpkiud:class">
+    <xsl:value-of select="concat('&#10;',
+				 '[Class]',                               '&#10;',
+				 'Name:        ', @class_name,            '&#10;',
+                                 'Issuer URL:  ', @cert_url,              '&#10;',
+				 'ASNs:        ', @resource_set_as,       '&#10;',
+				 'IPv4:        ', @resource_set_ipv4,     '&#10;',
+				 'IPv6:        ', @resource_set_ipv6,     '&#10;',
+				 'NotAfter:    ', @resource_set_notafter, '&#10;',
+				 'SIA head:    ', @suggested_sia_head,    '&#10;')"/>
+    <xsl:if test="$show-issuer">
+      <xsl:apply-templates select="rpkiud:issuer"/>
+    </xsl:if>
+    <xsl:apply-templates select="rpkiud:certificate"/>
+  </xsl:template>
+
+  <xsl:template match="rpkiud:certificate">
+    <xsl:value-of select="concat('&#10;',
+                                 '[Certificate]',                     '&#10;',
+				 'Subject URL: ', @cert_url,          '&#10;',
+				 'Req ASNs:    ', @resource_set_as,   '&#10;',
+				 'Req IPv4:    ', @resource_set_ipv4, '&#10;',
+				 'Req IPv6:    ', @resource_set_ipv6, '&#10;')"/>
+    <xsl:call-template name="show-pem"/>
+  </xsl:template>
+
+  <xsl:template match="rpkiud:issuer" name="show-pem">
+    <xsl:text>&#10;</xsl:text>
+    <xsl:text>-----BEGIN CERTIFICATE-----</xsl:text>
+    <xsl:text>&#10;</xsl:text>
+    <xsl:value-of select="text()"/>
+    <xsl:text>-----END CERTIFICATE-----</xsl:text>
+    <xsl:text>&#10;</xsl:text>
+  </xsl:template>
+
+</xsl:transform>
diff --git a/rpkid.without_tls/tests/testpoke.yaml b/rpkid.without_tls/tests/testpoke.yaml
new file mode 100644
index 00000000..22e2d35f
--- /dev/null
+++ b/rpkid.without_tls/tests/testpoke.yaml
@@ -0,0 +1,28 @@
+---
+# $Id$
+
+version: 1
+posturl: https://localhost:4433/up-down/1
+recipient-id: wombat
+sender-id: "1"
+
+cms-cert-file: biz-certs/Frank-EE.cer
+cms-key-file: biz-certs/Frank-EE.key
+cms-ca-cert-file: biz-certs/Bob-Root.cer
+cms-cert-chain-file: [ biz-certs/Frank-CA.cer ]
+
+ssl-cert-file: biz-certs/Frank-EE.cer
+ssl-key-file: biz-certs/Frank-EE.key
+ssl-ca-cert-file: biz-certs/Bob-Root.cer
+
+requests:
+  list:
+    type: list
+  issue:
+    type: issue
+    class: 1
+    sia: [ "rsync://bandicoot.invalid/some/where/" ]
+  revoke:
+    type: revoke
+    class: 1
+    ski: "CB5K6APY-4KcGAW9jaK_cVPXKX0"
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/Makefile b/rpkid.without_tls/tests/up-down-protocol-samples/Makefile
new file mode 100644
index 00000000..10ee791a
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/Makefile
@@ -0,0 +1,11 @@
+XMLLINT		= xmllint --noout --relaxng
+JING		= java -jar /usr/local/share/java/classes/jing.jar
+SCHEMA		= ../up-down-medium-schema.rng
+
+all: jing xmllint
+
+jing:
+	${JING}    ${SCHEMA} *.xml
+
+xmllint:
+	${XMLLINT} ${SCHEMA} *.xml
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/error_response.xml b/rpkid.without_tls/tests/up-down-protocol-samples/error_response.xml
new file mode 100644
index 00000000..83af6649
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/error_response.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="error_response">
+    <status>2001</status>
+    <description xml:lang="en-US">[Readable text]</description>
+</message>
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/issue1.xml b/rpkid.without_tls/tests/up-down-protocol-samples/issue1.xml
new file mode 100644
index 00000000..4b8366f9
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/issue1.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="issue">
+    <request class_name="class name"
+             req_resource_set_as="64534-64540"
+	     req_resource_set_ipv4=""
+	     req_resource_set_ipv6="">
+	MIICYTCCAUkCAQAwHDEaMBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWMwggEiMA0G
+	CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi6ElZd/uon9Ur1IKGhr6DXWzPOng
+	KdOJIOlRSWcsQ9qgLNREs5YUqQd3YLlvAe+OVKV0rFpn+DBNEPmsn7h1YQv253zq
+	m1yYeks+xOJZQtMZyg9YDrfIgk7lu6z9kuWIsvxkz244OxiD/OemrvuQNtDhyk2Q
+	QQ8POyrADNl7fehQE/YJc4Kj0uO7ggiHf9K7Dg56KLYlArXZUfwzMkdH/89/vO4A
+	AbsFXi4Dmq2VO8rCxodkdDmqWWuu4KdRGgfyjkyOZS/f8pm64LaKT8AgcnmYAI8N
+	UBM90T6Mvdx0qTOoVh0xeHznAp6NChQSbdM3x3rwhBD+/k0olyZuCIWhAgMBAAGg
+	ADANBgkqhkiG9w0BAQUFAAOCAQEAj9bYIVfREySBzUhQSlbNi9kfdXgivC/4A7pn
+	b4sMm081S05u0QLhyh1XNF/L3/U5yVElVHE8xobM/CuAkXpy7N5GSYj2T28Fmn77
+	1y/xdGg6Jp26OkbrqY3gjQAaMigYg9/6tPAc9fgLiQAJLUUYb2hRqaqu4Ze8RrxU
+	RsnVpAHWYDFWJhNqEp8eErzAVLqxpmoYJKgmpK6TKyYKuf8+xf3Rlkb4+iu2FotR
+	DQrmcd6jmMjp9xLejDEuoPgcfpVP2CB1jUCAIW7yE7+a7vj9Mop1gs61zP8y/p2V
+	rVnXgEy93WZLjQt1D29oKhlcFGtCG4nqIBCDAWVuz/LGACB85w==
+    </request>
+</message>
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/issue2.xml b/rpkid.without_tls/tests/up-down-protocol-samples/issue2.xml
new file mode 100644
index 00000000..a991cbcd
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/issue2.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="issue">
+    <request class_name="class name"
+	     req_resource_set_ipv4=""
+	     req_resource_set_ipv6="">
+	MIICYTCCAUkCAQAwHDEaMBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWMwggEiMA0G
+	CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIi6ElZd/uon9Ur1IKGhr6DXWzPOng
+	KdOJIOlRSWcsQ9qgLNREs5YUqQd3YLlvAe+OVKV0rFpn+DBNEPmsn7h1YQv253zq
+	m1yYeks+xOJZQtMZyg9YDrfIgk7lu6z9kuWIsvxkz244OxiD/OemrvuQNtDhyk2Q
+	QQ8POyrADNl7fehQE/YJc4Kj0uO7ggiHf9K7Dg56KLYlArXZUfwzMkdH/89/vO4A
+	AbsFXi4Dmq2VO8rCxodkdDmqWWuu4KdRGgfyjkyOZS/f8pm64LaKT8AgcnmYAI8N
+	UBM90T6Mvdx0qTOoVh0xeHznAp6NChQSbdM3x3rwhBD+/k0olyZuCIWhAgMBAAGg
+	ADANBgkqhkiG9w0BAQUFAAOCAQEAj9bYIVfREySBzUhQSlbNi9kfdXgivC/4A7pn
+	b4sMm081S05u0QLhyh1XNF/L3/U5yVElVHE8xobM/CuAkXpy7N5GSYj2T28Fmn77
+	1y/xdGg6Jp26OkbrqY3gjQAaMigYg9/6tPAc9fgLiQAJLUUYb2hRqaqu4Ze8RrxU
+	RsnVpAHWYDFWJhNqEp8eErzAVLqxpmoYJKgmpK6TKyYKuf8+xf3Rlkb4+iu2FotR
+	DQrmcd6jmMjp9xLejDEuoPgcfpVP2CB1jUCAIW7yE7+a7vj9Mop1gs61zP8y/p2V
+	rVnXgEy93WZLjQt1D29oKhlcFGtCG4nqIBCDAWVuz/LGACB85w==
+    </request>
+</message>
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/issue_response.xml b/rpkid.without_tls/tests/up-down-protocol-samples/issue_response.xml
new file mode 100644
index 00000000..39f6b954
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/issue_response.xml
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="issue_response">
+    <class class_name="ISP5"
+           cert_url="rsync://wombat.example/ISP5"
+	   resource_set_as="64534-64540"
+	   resource_set_ipv4="10.0.0.0/24,10.3.0.0/24"
+	   resource_set_ipv6="2001:db8:0:0:0:0:a00::/120,2001:db8:0:0:0:0:a03::/120"
+	   suggested_sia_head="rsync://wombat.example/fnord/">
+        <certificate cert_url="rsync://wombat.example/ISP5a"
+		     req_resource_set_as=""
+		     req_resource_set_ipv4="10.0.0.0/24"
+		     req_resource_set_ipv6="2001:db8:0:0:0:0:a00::/120">
+	    MIID3jCCAsagAwIBAgIBAzANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIzMB4XDTA3MDgwMTE0NDgyMloXDTA4MDczMTE0NDgyMlowHDEa
+	    MBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWEwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+	    DwAwggEKAoIBAQDmS614KGvmUBtlgdWNK1Z3zbvJR6CqMrAsrB/x5JArwjNv51Ox
+	    0B2rBSedt6HuqE/IWzYj4xLkUVknzf16qtxWBaFzq3ndPIKyj6757MA2OOYCqv2J
+	    YCFSW7YzgHXlf/2sbuzUmiYvfihFFilHffOKctXkZfr0VG+uSDNiwTLxK4MzNmNg
+	    nrzH55ldUdrNL4+DRyCe6cyjcsByvUktxFLqb9pCRnGQx69/n8fdC5aWPEWfwOpl
+	    akPj85LV4XPAbiD1F+XRWNohs+kMTfDovXy374HJ9XDPqCB94mr5G2apyHHWMvhy
+	    PYOZGQ0Ma+n4ks0zF4ZqPa8NBZSrHNQspEXLAgMBAAGjggEqMIIBJjAPBgNVHRMB
+	    Af8EBTADAQH/MB0GA1UdDgQWBBQJ8BQLefsL/6jvVLnsPrmL0Muc7DAfBgNVHSME
+	    GDAWgBSYvgT/gNGrlTmqPfIOZ30AraP9xTAOBgNVHQ8BAf8EBAMCAQYwQgYIKwYB
+	    BQUHAQsENjA0MDIGCCsGAQUFBzAFhiZyc3luYzovL3dvbWJhdHMtci11cy5oYWN0
+	    cm4ubmV0L0lTUDVhLzBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAKGKHJzeW5j
+	    Oi8vd29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvTElSMy5jZXIwOQYIKwYBBQUHAQcB
+	    Af8EKjAoMAwEAgABMAYDBAAKAAAwGAQCAAIwEgMQACABDbgAAAAAAAAAAAoAADAN
+	    BgkqhkiG9w0BAQUFAAOCAQEAkzKZYt3F6vAfWFAQN9M5N9n2klEmL9b9b4K4Vmv9
+	    DPNCBFbtZytCAphWB/FILS60MrvXHCcUoOmtOx3+Cw5D3yKX8Y9z2HbWmw2/7iDo
+	    dxejgwGzI0OFa79vzC5pRwVz9CFFlMiuIShBFpHuSElmWmcxcQTJSXGU1fSGXHvG
+	    Pv6RHSGzFJhUrW5RKOmoIrqk0JyM49R8IRAM+aMA+MOfALRTNAavW0pDlcuy+4wY
+	    AIYRKF4k4ZDYZ9gA/LYnH56xvpEXwRE1bpxgUC5n8wQrdIn5/pJz3R5EgWe4CGOo
+	    n/SMvEfe8d+LEc0C7LmtCwYoDOKENoOF809GVkbV9fjL8w==
+        </certificate>
+        <certificate cert_url="rsync://wombat.example/ISP5b"
+		     req_resource_set_as=""
+		     req_resource_set_ipv4="10.3.0.0/24"
+		     req_resource_set_ipv6="2001:db8:0:0:0:0:a03::/120">
+	    MIID3jCCAsagAwIBAgIBAjANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIzMB4XDTA3MDgwMTE0NDgyMFoXDTA4MDczMTE0NDgyMFowHDEa
+	    MBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+	    DwAwggEKAoIBAQC/j1nY/PodBHApznsBZCFA3FxD/kyviMhim76cco+KpTSKOyON
+	    m4pPv2asaHGc/WhZ9b+fTS611uP6vfNgU1y3EayVC8CHzZmelFeN7AW436r8jjjT
+	    D2VtCWDy4ZiBcthRPkGRsxCV9fXQ+eVcoYX6cSaF49FMAn8U4h5KipZontYWpe+t
+	    tYNizSN0fIJWtNE0U1qKemGfrlRb7/lW3odrQpK8SfS1wzUHShhH0pLGHBZ0dLHp
+	    OTxTEgWd69ycciuXTSchd5Z9TM55DPunuJlrZiAuVpxEtONegMR9eKG0BfcgfSYe
+	    RL9daRU8eiRnvbm1CA8zTa87Lee5qx0r1vtzAgMBAAGjggEqMIIBJjAPBgNVHRMB
+	    Af8EBTADAQH/MB0GA1UdDgQWBBRss2WU/safSlCdTYtAGqH9lxeXkjAfBgNVHSME
+	    GDAWgBSYvgT/gNGrlTmqPfIOZ30AraP9xTAOBgNVHQ8BAf8EBAMCAQYwQgYIKwYB
+	    BQUHAQsENjA0MDIGCCsGAQUFBzAFhiZyc3luYzovL3dvbWJhdHMtci11cy5oYWN0
+	    cm4ubmV0L0lTUDViLzBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAKGKHJzeW5j
+	    Oi8vd29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvTElSMy5jZXIwOQYIKwYBBQUHAQcB
+	    Af8EKjAoMAwEAgABMAYDBAAKAwAwGAQCAAIwEgMQACABDbgAAAAAAAAAAAoDADAN
+	    BgkqhkiG9w0BAQUFAAOCAQEARNgVrXF+6W7sMytC7YyKSt+CpJGZV7AvzKNZKv8k
+	    xazhefrXkrpyK0caz4BtCHbptZFgNR/dDOC9M3wn0PcRTh9ISgW8beNfut16uj1F
+	    fZdylJvNMXa4lt/wfRbzKqPicusCH0nutkRIW2mZuLuAO8v1vKr4umgZU+z/rXWu
+	    glEA7OeBwmvPoqKixbgER5GtnTNySKIVVa1DUo/2CaPT/YjT48P0zXHoy6rnNgcn
+	    2emkoegzzS2cN+5I5I+O8IRnZInqmiPgEgElgEFw+rg6xw23yax5Nyqx12J56tt0
+	    tPWGhrYe1dCwKZajWKn3P9+NMcGQ0d8bw/QU+B3RyVeVfw==
+        </certificate>
+        <certificate cert_url="rsync://wombat.example/ISP5c"
+		     req_resource_set_as="64534-64540"
+		     req_resource_set_ipv4=""
+		     req_resource_set_ipv6="">
+	    MIIDxjCCAq6gAwIBAgIBATANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIzMB4XDTA3MDgwMTE0NDgxOFoXDTA4MDczMTE0NDgxOFowHDEa
+	    MBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWMwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+	    DwAwggEKAoIBAQDIi6ElZd/uon9Ur1IKGhr6DXWzPOngKdOJIOlRSWcsQ9qgLNRE
+	    s5YUqQd3YLlvAe+OVKV0rFpn+DBNEPmsn7h1YQv253zqm1yYeks+xOJZQtMZyg9Y
+	    DrfIgk7lu6z9kuWIsvxkz244OxiD/OemrvuQNtDhyk2QQQ8POyrADNl7fehQE/YJ
+	    c4Kj0uO7ggiHf9K7Dg56KLYlArXZUfwzMkdH/89/vO4AAbsFXi4Dmq2VO8rCxodk
+	    dDmqWWuu4KdRGgfyjkyOZS/f8pm64LaKT8AgcnmYAI8NUBM90T6Mvdx0qTOoVh0x
+	    eHznAp6NChQSbdM3x3rwhBD+/k0olyZuCIWhAgMBAAGjggESMIIBDjAPBgNVHRMB
+	    Af8EBTADAQH/MB0GA1UdDgQWBBQth8Ga+FgrvcL4fjBHs6mIN8nrRjAfBgNVHSME
+	    GDAWgBSYvgT/gNGrlTmqPfIOZ30AraP9xTAOBgNVHQ8BAf8EBAMCAQYwQgYIKwYB
+	    BQUHAQsENjA0MDIGCCsGAQUFBzAFhiZyc3luYzovL3dvbWJhdHMtci11cy5oYWN0
+	    cm4ubmV0L0lTUDVjLzBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAKGKHJzeW5j
+	    Oi8vd29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvTElSMy5jZXIwIQYIKwYBBQUHAQgB
+	    Af8EEjAQoA4wDDAKAgMA/BYCAwD8HDANBgkqhkiG9w0BAQUFAAOCAQEAUGsbhHfl
+	    kwhe3EIkhnARJPgRkWgPCJtJ9konhROT7VlJ0Pim0kSrJWlBWUCLeKvSjQmowP4g
+	    SddHxN4ZoXnSjb0pCDeomrZeViVQ2hxH6L/tHkl5SIEHl9MvFOe8junvgpq9GGAI
+	    CFcibkW7Gp9p4A+GQkns0l9v+wGwuVZmqmJk4YBo7hHZRbg6/IFL1MD3HKeXmn33
+	    lCwFhjUuDIMXRbY/1k5fui13QUolN7mLSk60NvXJ94Tga68c1eCIpapvhxAYw69G
+	    7mOX42aYu1FnidZNj7Lt9jOuW0REHlavrG17HxP5loTuCNtLH1ZIrJcO7rUz9C0D
+	    YqMybYWFUqZHyg==
+        </certificate>
+        <issuer>
+	    MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9URVNU
+	    IEVOVElUWSBSSVIwHhcNMDcwODAxMTQ0ODE4WhcNMDgwNzMxMTQ0ODE4WjAbMRkw
+	    FwYDVQQDExBURVNUIEVOVElUWSBMSVIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+	    MIIBCgKCAQEAoyFXYWSvERjUy96m3K3ZLA8PWJ9+yIVVESZMfPBraBqeagyP5tw9
+	    g1gqzHesGXNvWvNuJKzNGtwdC0xE9W2LChc9hvno/uZg5Z9AauWU6JpWFxccq8GM
+	    N0ArVb8sXtyNyiV/il/u+xaG6+AI0ybl43DFDGv7G49rXPbiSlilNQHqBRs+zoS+
+	    tT9tGBZLaOV5TIh9tqVlozrCMtytj4oF7vbpeoDaEqkPWrXS0zGsPtMZJS0o3nls
+	    zv13ZtXjL6nL+YWMILuihiPwk5UgBHjHxwem/vD0RbvPeCvdzpwIpUZoEEzXBWJs
+	    hlotfwY4wk27RIcAQ3nSj/NrsvRcHLloAQIDAQABo4IBYzCCAV8wDwYDVR0TAQH/
+	    BAUwAwEB/zAdBgNVHQ4EFgQUmL4E/4DRq5U5qj3yDmd9AK2j/cUwHwYDVR0jBBgw
+	    FoAU+7inozZICqCf8C7ci2i8s1xFJdcwDgYDVR0PAQH/BAQDAgEGMEEGCCsGAQUF
+	    BwELBDUwMzAxBggrBgEFBQcwBYYlcnN5bmM6Ly93b21iYXRzLXItdXMuaGFjdHJu
+	    Lm5ldC9MSVIzLzBDBggrBgEFBQcBAQQ3MDUwMwYIKwYBBQUHMAKGJ3JzeW5jOi8v
+	    d29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvUklSLmNlcjAhBggrBgEFBQcBCAEB/wQS
+	    MBCgDjAMMAoCAwD8FgIDAPwcMFEGCCsGAQUFBwEHAQH/BEIwQDASBAIAATAMAwQA
+	    CgAAAwQACgMAMCoEAgACMCQDEAAgAQ24AAAAAAAAAAAKAAADEAAgAQ24AAAAAAAA
+	    AAAKAwAwDQYJKoZIhvcNAQEFBQADggEBAEhmCa7kUuozB6aST0Gd2XStJBcR1oWI
+	    8mZS5WEOjnjbVvuryDEb0fLs3x2HgCHZgZ7IAOg31cNxJpc1Ff6ZYEG+m3LpkcG/
+	    yOMllfOVK8RQSY+nKuya2fm2J3dCOKogEjBW20HwxNd1WgFLrDaOTR9V+iROBPKs
+	    3ppMPp6ksPqEqDU/3N3bLHROIISlFwWHilXuTK5ZAnzncDIQnm+zUuxI/0d3v6Fp
+	    8VxVlNBHqzo0VpakZOkxwqo01qJRsoxVaIxeetGNQ4noPhtj6bEM4Y8xDS9f3R7o
+	    eEHUSTnKonMemm/AB3KZnjwL7rkL2FI1ThmDRO3Z3lprbThjThJF8EU=
+	</issuer>
+    </class>
+</message>
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/list.xml b/rpkid.without_tls/tests/up-down-protocol-samples/list.xml
new file mode 100644
index 00000000..01a803f3
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/list.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="list" />
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/list_response.xml b/rpkid.without_tls/tests/up-down-protocol-samples/list_response.xml
new file mode 100644
index 00000000..9e368f5a
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/list_response.xml
@@ -0,0 +1,169 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="list_response">
+    <class class_name="ISP5"
+           cert_url="rsync://wombat.example/ISP5"
+	   resource_set_as="64534-64540"
+	   resource_set_ipv4="10.0.0.0/24,10.3.0.0/24"
+	   resource_set_ipv6="2001:db8:0:0:0:0:a00::/120,2001:db8:0:0:0:0:a03::/120"
+	   suggested_sia_head="rsync://wombat.example/fnord/">
+        <certificate cert_url="rsync://wombat.example/ISP5a"
+		     req_resource_set_as=""
+		     req_resource_set_ipv4="10.0.0.0/24"
+		     req_resource_set_ipv6="2001:db8:0:0:0:0:a00::/120">
+	    MIID3jCCAsagAwIBAgIBAzANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIzMB4XDTA3MDgwMTE0NDgyMloXDTA4MDczMTE0NDgyMlowHDEa
+	    MBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWEwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+	    DwAwggEKAoIBAQDmS614KGvmUBtlgdWNK1Z3zbvJR6CqMrAsrB/x5JArwjNv51Ox
+	    0B2rBSedt6HuqE/IWzYj4xLkUVknzf16qtxWBaFzq3ndPIKyj6757MA2OOYCqv2J
+	    YCFSW7YzgHXlf/2sbuzUmiYvfihFFilHffOKctXkZfr0VG+uSDNiwTLxK4MzNmNg
+	    nrzH55ldUdrNL4+DRyCe6cyjcsByvUktxFLqb9pCRnGQx69/n8fdC5aWPEWfwOpl
+	    akPj85LV4XPAbiD1F+XRWNohs+kMTfDovXy374HJ9XDPqCB94mr5G2apyHHWMvhy
+	    PYOZGQ0Ma+n4ks0zF4ZqPa8NBZSrHNQspEXLAgMBAAGjggEqMIIBJjAPBgNVHRMB
+	    Af8EBTADAQH/MB0GA1UdDgQWBBQJ8BQLefsL/6jvVLnsPrmL0Muc7DAfBgNVHSME
+	    GDAWgBSYvgT/gNGrlTmqPfIOZ30AraP9xTAOBgNVHQ8BAf8EBAMCAQYwQgYIKwYB
+	    BQUHAQsENjA0MDIGCCsGAQUFBzAFhiZyc3luYzovL3dvbWJhdHMtci11cy5oYWN0
+	    cm4ubmV0L0lTUDVhLzBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAKGKHJzeW5j
+	    Oi8vd29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvTElSMy5jZXIwOQYIKwYBBQUHAQcB
+	    Af8EKjAoMAwEAgABMAYDBAAKAAAwGAQCAAIwEgMQACABDbgAAAAAAAAAAAoAADAN
+	    BgkqhkiG9w0BAQUFAAOCAQEAkzKZYt3F6vAfWFAQN9M5N9n2klEmL9b9b4K4Vmv9
+	    DPNCBFbtZytCAphWB/FILS60MrvXHCcUoOmtOx3+Cw5D3yKX8Y9z2HbWmw2/7iDo
+	    dxejgwGzI0OFa79vzC5pRwVz9CFFlMiuIShBFpHuSElmWmcxcQTJSXGU1fSGXHvG
+	    Pv6RHSGzFJhUrW5RKOmoIrqk0JyM49R8IRAM+aMA+MOfALRTNAavW0pDlcuy+4wY
+	    AIYRKF4k4ZDYZ9gA/LYnH56xvpEXwRE1bpxgUC5n8wQrdIn5/pJz3R5EgWe4CGOo
+	    n/SMvEfe8d+LEc0C7LmtCwYoDOKENoOF809GVkbV9fjL8w==
+        </certificate>
+        <certificate cert_url="rsync://wombat.example/ISP5b"
+		     req_resource_set_as=""
+		     req_resource_set_ipv4="10.3.0.0/24"
+		     req_resource_set_ipv6="2001:db8:0:0:0:0:a03::/120">
+	    MIID3jCCAsagAwIBAgIBAjANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIzMB4XDTA3MDgwMTE0NDgyMFoXDTA4MDczMTE0NDgyMFowHDEa
+	    MBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+	    DwAwggEKAoIBAQC/j1nY/PodBHApznsBZCFA3FxD/kyviMhim76cco+KpTSKOyON
+	    m4pPv2asaHGc/WhZ9b+fTS611uP6vfNgU1y3EayVC8CHzZmelFeN7AW436r8jjjT
+	    D2VtCWDy4ZiBcthRPkGRsxCV9fXQ+eVcoYX6cSaF49FMAn8U4h5KipZontYWpe+t
+	    tYNizSN0fIJWtNE0U1qKemGfrlRb7/lW3odrQpK8SfS1wzUHShhH0pLGHBZ0dLHp
+	    OTxTEgWd69ycciuXTSchd5Z9TM55DPunuJlrZiAuVpxEtONegMR9eKG0BfcgfSYe
+	    RL9daRU8eiRnvbm1CA8zTa87Lee5qx0r1vtzAgMBAAGjggEqMIIBJjAPBgNVHRMB
+	    Af8EBTADAQH/MB0GA1UdDgQWBBRss2WU/safSlCdTYtAGqH9lxeXkjAfBgNVHSME
+	    GDAWgBSYvgT/gNGrlTmqPfIOZ30AraP9xTAOBgNVHQ8BAf8EBAMCAQYwQgYIKwYB
+	    BQUHAQsENjA0MDIGCCsGAQUFBzAFhiZyc3luYzovL3dvbWJhdHMtci11cy5oYWN0
+	    cm4ubmV0L0lTUDViLzBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAKGKHJzeW5j
+	    Oi8vd29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvTElSMy5jZXIwOQYIKwYBBQUHAQcB
+	    Af8EKjAoMAwEAgABMAYDBAAKAwAwGAQCAAIwEgMQACABDbgAAAAAAAAAAAoDADAN
+	    BgkqhkiG9w0BAQUFAAOCAQEARNgVrXF+6W7sMytC7YyKSt+CpJGZV7AvzKNZKv8k
+	    xazhefrXkrpyK0caz4BtCHbptZFgNR/dDOC9M3wn0PcRTh9ISgW8beNfut16uj1F
+	    fZdylJvNMXa4lt/wfRbzKqPicusCH0nutkRIW2mZuLuAO8v1vKr4umgZU+z/rXWu
+	    glEA7OeBwmvPoqKixbgER5GtnTNySKIVVa1DUo/2CaPT/YjT48P0zXHoy6rnNgcn
+	    2emkoegzzS2cN+5I5I+O8IRnZInqmiPgEgElgEFw+rg6xw23yax5Nyqx12J56tt0
+	    tPWGhrYe1dCwKZajWKn3P9+NMcGQ0d8bw/QU+B3RyVeVfw==
+        </certificate>
+        <certificate cert_url="rsync://wombat.example/ISP5c"
+		     req_resource_set_as="64534-64540"
+		     req_resource_set_ipv4=""
+		     req_resource_set_ipv6="">
+	    MIIDxjCCAq6gAwIBAgIBATANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIzMB4XDTA3MDgwMTE0NDgxOFoXDTA4MDczMTE0NDgxOFowHDEa
+	    MBgGA1UEAxMRVEVTVCBFTlRJVFkgSVNQNWMwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+	    DwAwggEKAoIBAQDIi6ElZd/uon9Ur1IKGhr6DXWzPOngKdOJIOlRSWcsQ9qgLNRE
+	    s5YUqQd3YLlvAe+OVKV0rFpn+DBNEPmsn7h1YQv253zqm1yYeks+xOJZQtMZyg9Y
+	    DrfIgk7lu6z9kuWIsvxkz244OxiD/OemrvuQNtDhyk2QQQ8POyrADNl7fehQE/YJ
+	    c4Kj0uO7ggiHf9K7Dg56KLYlArXZUfwzMkdH/89/vO4AAbsFXi4Dmq2VO8rCxodk
+	    dDmqWWuu4KdRGgfyjkyOZS/f8pm64LaKT8AgcnmYAI8NUBM90T6Mvdx0qTOoVh0x
+	    eHznAp6NChQSbdM3x3rwhBD+/k0olyZuCIWhAgMBAAGjggESMIIBDjAPBgNVHRMB
+	    Af8EBTADAQH/MB0GA1UdDgQWBBQth8Ga+FgrvcL4fjBHs6mIN8nrRjAfBgNVHSME
+	    GDAWgBSYvgT/gNGrlTmqPfIOZ30AraP9xTAOBgNVHQ8BAf8EBAMCAQYwQgYIKwYB
+	    BQUHAQsENjA0MDIGCCsGAQUFBzAFhiZyc3luYzovL3dvbWJhdHMtci11cy5oYWN0
+	    cm4ubmV0L0lTUDVjLzBEBggrBgEFBQcBAQQ4MDYwNAYIKwYBBQUHMAKGKHJzeW5j
+	    Oi8vd29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvTElSMy5jZXIwIQYIKwYBBQUHAQgB
+	    Af8EEjAQoA4wDDAKAgMA/BYCAwD8HDANBgkqhkiG9w0BAQUFAAOCAQEAUGsbhHfl
+	    kwhe3EIkhnARJPgRkWgPCJtJ9konhROT7VlJ0Pim0kSrJWlBWUCLeKvSjQmowP4g
+	    SddHxN4ZoXnSjb0pCDeomrZeViVQ2hxH6L/tHkl5SIEHl9MvFOe8junvgpq9GGAI
+	    CFcibkW7Gp9p4A+GQkns0l9v+wGwuVZmqmJk4YBo7hHZRbg6/IFL1MD3HKeXmn33
+	    lCwFhjUuDIMXRbY/1k5fui13QUolN7mLSk60NvXJ94Tga68c1eCIpapvhxAYw69G
+	    7mOX42aYu1FnidZNj7Lt9jOuW0REHlavrG17HxP5loTuCNtLH1ZIrJcO7rUz9C0D
+	    YqMybYWFUqZHyg==
+        </certificate>
+        <issuer>
+	    MIIEFTCCAv2gAwIBAgIBDjANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9URVNU
+	    IEVOVElUWSBSSVIwHhcNMDcwODAxMTQ0ODE4WhcNMDgwNzMxMTQ0ODE4WjAbMRkw
+	    FwYDVQQDExBURVNUIEVOVElUWSBMSVIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+	    MIIBCgKCAQEAoyFXYWSvERjUy96m3K3ZLA8PWJ9+yIVVESZMfPBraBqeagyP5tw9
+	    g1gqzHesGXNvWvNuJKzNGtwdC0xE9W2LChc9hvno/uZg5Z9AauWU6JpWFxccq8GM
+	    N0ArVb8sXtyNyiV/il/u+xaG6+AI0ybl43DFDGv7G49rXPbiSlilNQHqBRs+zoS+
+	    tT9tGBZLaOV5TIh9tqVlozrCMtytj4oF7vbpeoDaEqkPWrXS0zGsPtMZJS0o3nls
+	    zv13ZtXjL6nL+YWMILuihiPwk5UgBHjHxwem/vD0RbvPeCvdzpwIpUZoEEzXBWJs
+	    hlotfwY4wk27RIcAQ3nSj/NrsvRcHLloAQIDAQABo4IBYzCCAV8wDwYDVR0TAQH/
+	    BAUwAwEB/zAdBgNVHQ4EFgQUmL4E/4DRq5U5qj3yDmd9AK2j/cUwHwYDVR0jBBgw
+	    FoAU+7inozZICqCf8C7ci2i8s1xFJdcwDgYDVR0PAQH/BAQDAgEGMEEGCCsGAQUF
+	    BwELBDUwMzAxBggrBgEFBQcwBYYlcnN5bmM6Ly93b21iYXRzLXItdXMuaGFjdHJu
+	    Lm5ldC9MSVIzLzBDBggrBgEFBQcBAQQ3MDUwMwYIKwYBBQUHMAKGJ3JzeW5jOi8v
+	    d29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvUklSLmNlcjAhBggrBgEFBQcBCAEB/wQS
+	    MBCgDjAMMAoCAwD8FgIDAPwcMFEGCCsGAQUFBwEHAQH/BEIwQDASBAIAATAMAwQA
+	    CgAAAwQACgMAMCoEAgACMCQDEAAgAQ24AAAAAAAAAAAKAAADEAAgAQ24AAAAAAAA
+	    AAAKAwAwDQYJKoZIhvcNAQEFBQADggEBAEhmCa7kUuozB6aST0Gd2XStJBcR1oWI
+	    8mZS5WEOjnjbVvuryDEb0fLs3x2HgCHZgZ7IAOg31cNxJpc1Ff6ZYEG+m3LpkcG/
+	    yOMllfOVK8RQSY+nKuya2fm2J3dCOKogEjBW20HwxNd1WgFLrDaOTR9V+iROBPKs
+	    3ppMPp6ksPqEqDU/3N3bLHROIISlFwWHilXuTK5ZAnzncDIQnm+zUuxI/0d3v6Fp
+	    8VxVlNBHqzo0VpakZOkxwqo01qJRsoxVaIxeetGNQ4noPhtj6bEM4Y8xDS9f3R7o
+	    eEHUSTnKonMemm/AB3KZnjwL7rkL2FI1ThmDRO3Z3lprbThjThJF8EU=
+	</issuer>
+    </class>
+    <class class_name="ISP2"
+           cert_url="rsync://wombat.example/ISP2"
+	   resource_set_as=""
+	   resource_set_ipv4="192.0.2.44-192.0.2.100"
+	   resource_set_ipv6="">
+        <certificate cert_url="http://wombat.example/ISP2a,rsync://wombat.example/ISP2a,ftp://wombat.example/ISP2a">
+	    MIIDzDCCArSgAwIBAgIBCTANBgkqhkiG9w0BAQUFADAbMRkwFwYDVQQDExBURVNU
+	    IEVOVElUWSBMSVIxMB4XDTA3MDgwMTE0NDgyMloXDTA4MDczMTE0NDgyMlowGzEZ
+	    MBcGA1UEAxMQVEVTVCBFTlRJVFkgSVNQMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+	    ADCCAQoCggEBANB338Qhrxtaa6inKNdDyJttJdiNf5Er45X9kmCsFBLXI2iFSw7b
+	    K+Y44EjbGDePQMCQWA4/CWdfjj8EdQZgkkLz5EUENZVd6SJCLPZcpn15jOEIGXw1
+	    nTr95/+bKbXuiUfMDYOg4XOvHwmEqAuDzHmIv3wdc9arQhtkmlwZgyud5a1MWAV2
+	    lXAj7qXAMcqip8gdHvLJ8j04gsJT5VSG8nyxc+Hc6YZzCKxZO74vWMFCxYAYjDoK
+	    KjL2/ijQKFKDxjBpUZBZGZvT1MLgUmrBTlmaGOR4Llf5fytddijJycV+5UOhm2jS
+	    Bhy+P2n5wvqeT2jPY2/bbfxnNcCxbgo37DMCAwEAAaOCARkwggEVMA8GA1UdEwEB
+	    /wQFMAMBAf8wHQYDVR0OBBYEFHOyFhrN3NcwYA/6gZX4ovVOlfOtMB8GA1UdIwQY
+	    MBaAFIqUF/lT8luUVFbfdlETKfZxGaizMA4GA1UdDwEB/wQEAwIBBjBBBggrBgEF
+	    BQcBCwQ1MDMwMQYIKwYBBQUHMAWGJXJzeW5jOi8vd29tYmF0cy1yLXVzLmhhY3Ry
+	    bi5uZXQvSVNQMi8wRAYIKwYBBQUHAQEEODA2MDQGCCsGAQUFBzAChihyc3luYzov
+	    L3dvbWJhdHMtci11cy5oYWN0cm4ubmV0L0xJUjEuY2VyMCkGCCsGAQUFBwEHAQH/
+	    BBowGDAWBAIAATAQMA4DBQLAAAIsAwUAwAACZDANBgkqhkiG9w0BAQUFAAOCAQEA
+	    CvG1rzj5fZOV1Oq/SO+NYzxOHIA9egYgQg4NUpmqSz6v17RhR0+3tPfMmzxepTs8
+	    ut23KieOG7RcPGvR2f/CEvedgrrPdTS81wu01qhPWJNqriN6N+Mu8XCK3fUO+t+w
+	    PxLUWqwzrRUcpdy+CMOOGg81Eg7e77iAeJCp648AChUdBRI6HTfp9PlKd25pJ7fj
+	    f654MpKGbTkWXllPkxC1sL4cJUcq4o+Sn1zAKkjXUwAUjp6G6s+mIWZQiZU5Pv8n
+	    lYXvPciYf83+wTBllLGtSFyut8hk6WmiB8rC1/5jS96pJaGRSxejqd0r99GlPre+
+	    QgMe2TRfFuM1esod7j1M1Q==
+        </certificate>
+        <issuer>
+	    MIID9jCCAt6gAwIBAgIBEDANBgkqhkiG9w0BAQUFADAaMRgwFgYDVQQDEw9URVNU
+	    IEVOVElUWSBSSVIwHhcNMDcwODAxMTQ0ODE4WhcNMDgwNzMxMTQ0ODE4WjAbMRkw
+	    FwYDVQQDExBURVNUIEVOVElUWSBMSVIxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+	    MIIBCgKCAQEAr10c+dm71QHhWzbMUfb9hldgqp7H7E4Fr/tRXHrCWMSoV64UYum8
+	    tnJ9z0nISkCCSvQ+MLWUJZ5seIFXQ9aFAo3RnLXXNC/iqX0YJ7VHmkIWyJB/lizd
+	    uJgXH3diSggALeBzDDk3ug+nWVlMfM3iXNeYNhBsiD5FmaaIL/Z/MUm6QisTecKy
+	    8QnZrTekQbZtRqEYBaBTB47gmLLR/Wdod2TV8/4dIjaeJloaqhiUwyx+mq++LJ1e
+	    dSxJ1jcrBh/MY5d+7ixfZ69NYj56HwzhHgLy0gZ1rj8RvI4PE2Q4FDYdXQLsr2XV
+	    uWj0ImYr70dbrTvyr7ZxDJRWinwBNvA6PwIDAQABo4IBRDCCAUAwDwYDVR0TAQH/
+	    BAUwAwEB/zAdBgNVHQ4EFgQUipQX+VPyW5RUVt92URMp9nEZqLMwHwYDVR0jBBgw
+	    FoAU+7inozZICqCf8C7ci2i8s1xFJdcwDgYDVR0PAQH/BAQDAgEGMEEGCCsGAQUF
+	    BwELBDUwMzAxBggrBgEFBQcwBYYlcnN5bmM6Ly93b21iYXRzLXItdXMuaGFjdHJu
+	    Lm5ldC9MSVIxLzBDBggrBgEFBQcBAQQ3MDUwMwYIKwYBBQUHMAKGJ3JzeW5jOi8v
+	    d29tYmF0cy1yLXVzLmhhY3Rybi5uZXQvUklSLmNlcjAaBggrBgEFBQcBCAEB/wQL
+	    MAmgBzAFAgMA/BUwOQYIKwYBBQUHAQcBAf8EKjAoMCYEAgABMCAwDgMFAMAAAgED
+	    BQHAAAIgMA4DBQLAAAIsAwUAwAACZDANBgkqhkiG9w0BAQUFAAOCAQEAcn3dpGAj
+	    ceSZKAuaulzTl0ty64mBPBGFjCXtebJQpeiuDjd0+SyhvpaDNUANNvkyFnQlnPcP
+	    zUZHjrnNrAx+06yEXvYx9KnyBc2C1+DXOySbxxXR253CHZL3Gam4oWcK+z0jOgWD
+	    KQVQ4wAnqYD+u1HxPjsMmK7x7tETckZkj0syTs9kzxqlsTSm8F8Y+ES7E+qNXyR9
+	    OxVgjr70vdgEp9AQftMQZ781SclWz7eLe5sXC1TuIct1sD6NssHGfCaxfFipSjEk
+	    zeU/pZodfREUQSrlVbbb9HU0N59eHfGGKvZ0vojhuWPOrVzpPJGKTI20aQPn+VJ5
+	    KH3Nf1ICSa7Vxw==
+	</issuer>
+    </class>
+</message>
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/revoke.xml b/rpkid.without_tls/tests/up-down-protocol-samples/revoke.xml
new file mode 100644
index 00000000..eb4b3efb
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/revoke.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/" 
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="revoke">
+    <key class_name="ISP5"
+         ski="CfAUC3n7C_-o71S57D65i9DLnOw"/>
+</message>
diff --git a/rpkid.without_tls/tests/up-down-protocol-samples/revoke_response.xml b/rpkid.without_tls/tests/up-down-protocol-samples/revoke_response.xml
new file mode 100644
index 00000000..9f4ebacc
--- /dev/null
+++ b/rpkid.without_tls/tests/up-down-protocol-samples/revoke_response.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<message xmlns="http://www.apnic.net/specs/rescerts/up-down/"
+         version="1"
+	 sender="sender name"
+	 recipient="recipient name"
+	 type="revoke_response">
+    <key class_name="ISP5"
+         ski="CfAUC3n7C_-o71S57D65i9DLnOw"/>
+</message>
diff --git a/rpkid.without_tls/tests/xml-parse-test.py b/rpkid.without_tls/tests/xml-parse-test.py
new file mode 100644
index 00000000..e06ac29f
--- /dev/null
+++ b/rpkid.without_tls/tests/xml-parse-test.py
@@ -0,0 +1,121 @@
+"""
+$Id$
+
+Copyright (C) 2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+"""
+
+import glob, lxml.etree, lxml.sax
+import rpki.up_down, rpki.left_right, rpki.publication, rpki.relaxng
+
+verbose = False
+
+def test(fileglob, rng, sax_handler, encoding, tester = None):
+  files = glob.glob(fileglob)
+  files.sort()
+  for f in files:
+    print "<!--", f, "-->"
+    handler = sax_handler()
+    elt_in = lxml.etree.parse(f).getroot()
+    if verbose:
+      print "<!-- Input -->"
+      print lxml.etree.tostring(elt_in, pretty_print = True, encoding = encoding, xml_declaration = True)
+    rng.assertValid(elt_in)
+    lxml.sax.saxify(elt_in, handler)
+    elt_out = handler.result.toXML()
+    if verbose:
+      print "<!-- Output -->"
+      print lxml.etree.tostring(elt_out, pretty_print = True, encoding = encoding, xml_declaration = True)
+    rng.assertValid(elt_out)
+    if (tester):
+      tester(elt_in, elt_out, handler.result)
+    if verbose:
+      print
+
+def pprint(pairs):
+  if verbose:
+    for thing, name in pairs:
+      if thing is not None:
+        print "[%s]" % name
+        print thing.get_POW().pprint()
+
+def ud_tester(elt_in, elt_out, msg):
+  assert isinstance(msg, rpki.up_down.message_pdu)
+  if isinstance(msg.payload, rpki.up_down.list_response_pdu):
+    for c in msg.payload.classes:
+      pprint([(c.certs[i].cert, ("%s certificate #%d" % (c.class_name, i))) for i in xrange(len(c.certs))] + [(c.issuer, ("%s issuer" % c.class_name))])
+
+def lr_tester(elt_in, elt_out, msg):
+  assert isinstance(msg, rpki.left_right.msg)
+  for obj in msg:
+    if isinstance(obj, rpki.left_right.self_elt):
+      pprint(((obj.bpki_cert,         "BPKI cert"),
+              (obj.bpki_glue,         "BPKI glue")))
+    if isinstance(obj, rpki.left_right.bsc_elt):
+      pprint(((obj.signing_cert,      "Signing certificate"),
+              (obj.signing_cert_crl,  "Signing certificate CRL")))
+      #       (obj.pkcs10_request,    "PKCS #10 request")
+    if isinstance(obj, rpki.left_right.parent_elt):
+      pprint(((obj.bpki_cms_cert,     "CMS certificate"),
+              (obj.bpki_cms_glue,     "CMS glue")))
+    if isinstance(obj, (rpki.left_right.child_elt, rpki.left_right.repository_elt)):
+      pprint(((obj.bpki_cert,         "Certificate"),
+              (obj.bpki_glue,         "Glue")))
+
+def pp_tester(elt_in, elt_out, msg):
+  assert isinstance(msg, rpki.publication.msg)
+  for obj in msg:
+    if isinstance(obj, rpki.publication.client_elt):
+      pprint(((obj.bpki_cert,         "BPKI cert"),
+              (obj.bpki_glue,         "BPKI glue")))
+    if isinstance(obj, rpki.publication.certificate_elt):
+      pprint(((obj.payload,         "RPKI cert"),))
+    if isinstance(obj, rpki.publication.crl_elt):
+      pprint(((obj.payload,         "RPKI CRL"),))
+    if isinstance(obj, rpki.publication.manifest_elt):
+      pprint(((obj.payload,          "RPKI manifest"),))
+    if isinstance(obj, rpki.publication.roa_elt):
+      pprint(((obj.payload,          "ROA"),))
+
+test(fileglob = "up-down-protocol-samples/*.xml",
+     rng = rpki.relaxng.up_down,
+     sax_handler = rpki.up_down.sax_handler,
+     encoding = "utf-8",
+     tester = ud_tester)
+
+test(fileglob = "left-right-protocol-samples/*.xml",
+     rng = rpki.relaxng.left_right,
+     sax_handler = rpki.left_right.sax_handler,
+     encoding = "us-ascii",
+     tester = lr_tester)
+
+test(fileglob = "publication-protocol-samples/*.xml",
+     rng = rpki.relaxng.publication,
+     sax_handler = rpki.publication.sax_handler,
+     encoding = "us-ascii",
+     tester = pp_tester)
diff --git a/rpkid.without_tls/tests/yamltest-test-all.sh b/rpkid.without_tls/tests/yamltest-test-all.sh
new file mode 100644
index 00000000..f6a05237
--- /dev/null
+++ b/rpkid.without_tls/tests/yamltest-test-all.sh
@@ -0,0 +1,50 @@
+#!/bin/sh -
+# $Id$
+
+# Copyright (C) 2009-2010  Internet Systems Consortium ("ISC")
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+ 
+set -x
+
+export TZ=UTC MYRPKI_RNG=$(pwd)/myrpki.rng
+
+test -z "$STY" && exec screen -L sh $0
+
+screen -X split
+screen -X focus
+
+runtime=$((30 * 60))
+
+for yaml in smoketest.*.yaml
+do
+  rm -rf test
+  python sql-cleaner.py 
+  screen python yamltest.py -p yamltest.pid $yaml
+  now=$(date +%s)
+  finish=$(($now + $runtime))
+  date
+  sleep 180
+  date
+  while test $(date +%s) -lt $finish
+  do
+    sleep 30
+    date
+    ../../rcynic/rcynic
+    ../../rcynic/show.sh
+    date
+  done
+  test -r yamltest.pid && kill -INT $(cat yamltest.pid)
+  sleep 30
+  make backup
+done
diff --git a/rpkid.without_tls/tests/yamltest.py b/rpkid.without_tls/tests/yamltest.py
new file mode 100644
index 00000000..9853dbdf
--- /dev/null
+++ b/rpkid.without_tls/tests/yamltest.py
@@ -0,0 +1,727 @@
+"""
+Test framework, using the same YAML test description format as
+smoketest.py, but using the myrpki.py tool to do all the back-end
+work.  Reads YAML file, generates .csv and .conf files, runs daemons
+and waits for one of them to exit.
+
+Much of the YAML handling code lifted from smoketest.py.
+
+Still to do:
+
+- Implement smoketest.py-style delta actions, that is, modify the
+  allocation database under control of the YAML file, dump out new
+  .csv files, and run myrpki.py again to feed resulting changes into
+  running daemons.
+
+$Id$
+
+Copyright (C) 2009--2010  Internet Systems Consortium ("ISC")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+"""
+
+import subprocess, re, os, getopt, sys, yaml, signal, time
+import rpki.resource_set, rpki.sundial, rpki.config, rpki.log, rpki.myrpki
+
+# Nasty regular expressions for parsing config files.  Sadly, while
+# the Python ConfigParser supports writing config files, it does so in
+# such a limited way that it's easier just to hack this ourselves.
+
+section_regexp = re.compile("\s*\[\s*(.+?)\s*\]\s*$")
+variable_regexp = re.compile("\s*([-a-zA-Z0-9_]+)\s*=\s*(.+?)\s*$")
+
+def cleanpath(*names):
+  """
+  Construct normalized pathnames.
+  """
+  return os.path.normpath(os.path.join(*names))
+
+# Pathnames for various things we need
+
+this_dir  = os.getcwd()
+test_dir  = cleanpath(this_dir, "yamltest.dir")
+rpkid_dir = cleanpath(this_dir, "..")
+
+prog_myrpki  = cleanpath(rpkid_dir, "myrpki.py")
+prog_rpkid   = cleanpath(rpkid_dir, "rpkid.py")
+prog_irdbd   = cleanpath(rpkid_dir, "irdbd.py")
+prog_pubd    = cleanpath(rpkid_dir, "pubd.py")
+prog_rootd   = cleanpath(rpkid_dir, "rootd.py")
+prog_openssl = cleanpath(this_dir, "../../openssl/openssl/apps/openssl")
+
+class roa_request(object):
+  """
+  Representation of a ROA request.
+  """
+
+  def __init__(self, asn, ipv4, ipv6):
+    self.asn = asn
+    self.v4 = rpki.resource_set.roa_prefix_set_ipv4("".join(ipv4.split())) if ipv4 else None
+    self.v6 = rpki.resource_set.roa_prefix_set_ipv6("".join(ipv6.split())) if ipv6 else None
+
+  def __eq__(self, other):
+    return self.asn == other.asn and self.v4 == other.v4 and self.v6 == other.v6
+
+  def __hash__(self):
+    v4 = tuple(self.v4) if self.v4 is not None else None
+    v6 = tuple(self.v6) if self.v6 is not None else None
+    return self.asn.__hash__() + v4.__hash__() + v6.__hash__()
+
+  def __str__(self):
+    if self.v4 and self.v6:
+      return "%s: %s,%s" % (self.asn, self.v4, self.v6)
+    else:
+      return "%s: %s" % (self.asn, self.v4 or self.v6)
+
+  @classmethod
+  def parse(cls, yaml):
+    """
+    Parse a ROA request from YAML format.
+    """
+    return cls(yaml.get("asn"), yaml.get("ipv4"), yaml.get("ipv6"))
+    
+class allocation_db(list):
+  """
+  Our allocation database.
+  """
+
+  def __init__(self, yaml):
+    list.__init__(self)
+    self.root = allocation(yaml, self)
+    assert self.root.is_root()
+    if self.root.crl_interval is None:
+      self.root.crl_interval = 24 * 60 * 60
+    if self.root.regen_margin is None:
+      self.root.regen_margin = 24 * 60 * 60
+    for a in self:
+      if a.sia_base is None:
+        if a.runs_pubd():
+          base = "rsync://localhost:%d/rpki/" % a.rsync_port
+        else:
+          base = a.parent.sia_base
+        a.sia_base = base + a.name + "/"
+      if a.base.valid_until is None:
+        a.base.valid_until = a.parent.base.valid_until
+      if a.crl_interval is None:
+        a.crl_interval = a.parent.crl_interval
+      if a.regen_margin is None:
+        a.regen_margin = a.parent.regen_margin
+      a.client_handle = "/".join(a.sia_base.rstrip("/").split("/")[3:])
+    self.root.closure()
+    self.map = dict((a.name, a) for a in self)
+    for a in self:
+      if a.is_hosted():
+        a.hosted_by = self.map[a.hosted_by]
+        a.hosted_by.hosts.append(a)
+        assert not a.is_root() and not a.hosted_by.is_hosted()
+
+  def dump(self):
+    """
+    Show contents of allocation database.
+    """
+    for a in self:
+      a.dump()
+
+
+class allocation(object):
+  """
+  One entity in our allocation database.  Every entity in the database
+  is assumed to hold resources, so needs at least myrpki services.
+  Entities that don't have the hosted_by property run their own copies
+  of rpkid, irdbd, and pubd, so they also need myirbe services.
+  """
+
+  base_port     = 4400
+  parent        = None
+  crl_interval  = None
+  regen_margin  = None
+  rootd_port    = None
+  engine        = -1
+  rpkid_port    = -1
+  irdbd_port    = -1
+  pubd_port     = -1
+  rsync_port    = -1
+  rootd_port    = -1
+
+  @classmethod
+  def allocate_port(cls):
+    """
+    Allocate a TCP port.
+    """
+    cls.base_port += 1
+    return cls.base_port
+
+  base_engine = -1
+
+  @classmethod
+  def allocate_engine(cls):
+    """
+    Allocate an engine number, mostly used to construct MySQL database
+    names.
+    """
+    cls.base_engine += 1
+    return cls.base_engine
+
+  def __init__(self, yaml, db, parent = None):
+    db.append(self)
+    self.name = yaml["name"]
+    self.parent = parent
+    self.kids = [allocation(k, db, self) for k in yaml.get("kids", ())]
+    valid_until = None
+    if "valid_until" in yaml:
+      valid_until = rpki.sundial.datetime.fromdatetime(yaml.get("valid_until"))
+    if valid_until is None and "valid_for" in yaml:
+      valid_until = rpki.sundial.now() + rpki.sundial.timedelta.parse(yaml["valid_for"])
+    self.base = rpki.resource_set.resource_bag(
+      asn = rpki.resource_set.resource_set_as(yaml.get("asn")),
+      v4 = rpki.resource_set.resource_set_ipv4(yaml.get("ipv4")),
+      v6 = rpki.resource_set.resource_set_ipv6(yaml.get("ipv6")),
+      valid_until = valid_until)
+    self.sia_base = yaml.get("sia_base")
+    if "crl_interval" in yaml:
+      self.crl_interval = rpki.sundial.timedelta.parse(yaml["crl_interval"]).convert_to_seconds()
+    if "regen_margin" in yaml:
+      self.regen_margin = rpki.sundial.timedelta.parse(yaml["regen_margin"]).convert_to_seconds()
+    self.roa_requests = [roa_request.parse(y) for y in yaml.get("roa_request", yaml.get("route_origin", ()))]
+    for r in self.roa_requests:
+      if r.v4:
+        self.base.v4 = self.base.v4.union(r.v4.to_resource_set())
+      if r.v6:
+        self.base.v6 = self.base.v6.union(r.v6.to_resource_set())
+    self.hosted_by = yaml.get("hosted_by")
+    self.hosts = []
+    if not self.is_hosted():
+      self.engine = self.allocate_engine()
+      self.rpkid_port = self.allocate_port()
+      self.irdbd_port = self.allocate_port()
+    if self.runs_pubd():
+      self.pubd_port  = self.allocate_port()
+      self.rsync_port = self.allocate_port()
+    if self.is_root():
+      self.rootd_port = self.allocate_port()
+
+  def closure(self):
+    """
+    Compute resource closure of this node and its children, to avoid a
+    lot of tedious (and error-prone) duplication in the YAML file.
+    """
+    resources = self.base
+    for kid in self.kids:
+      resources = resources.union(kid.closure())
+    self.resources = resources
+    return resources
+
+  def dump(self):
+    """
+    Show content of this allocation node.
+    """
+    print str(self)
+
+  def __str__(self):
+    s = self.name + ":\n"
+    if self.resources.asn:      s += "  ASNs: %s\n" % self.resources.asn
+    if self.resources.v4:       s += "  IPv4: %s\n" % self.resources.v4
+    if self.resources.v6:       s += "  IPv6: %s\n" % self.resources.v6
+    if self.kids:               s += "  Kids: %s\n" % ", ".join(k.name for k in self.kids)
+    if self.parent:             s += "    Up: %s\n" % self.parent.name
+    if self.sia_base:           s += "   SIA: %s\n" % self.sia_base
+    if self.is_hosted():        s += "  Host: %s\n" % self.hosted_by.name
+    if self.hosts:              s += " Hosts: %s\n" % ", ".join(h.name for h in self.hosts)
+    for r in self.roa_requests: s += "   ROA: %s\n" % r
+    if not self.is_hosted():    s += " IPort: %s\n" % self.irdbd_port
+    if self.runs_pubd():        s += " PPort: %s\n" % self.pubd_port
+    if not self.is_hosted():    s += " RPort: %s\n" % self.rpkid_port
+    if self.runs_pubd():        s += " SPort: %s\n" % self.rsync_port
+    if self.is_root():          s += " TPort: %s\n" % self.rootd_port
+    return s + " Until: %s\n" % self.resources.valid_until
+
+  def is_root(self):
+    """
+    Is this the root node?
+    """
+    return self.parent is None
+
+  def is_hosted(self):
+    """
+    Is this entity hosted?
+    """
+    return self.hosted_by is not None
+
+  def runs_pubd(self):
+    """
+    Does this entity run a pubd?
+    """
+    return self.is_root() or not (self.is_hosted() or only_one_pubd)
+
+  def path(self, *names):
+    """
+    Construct pathnames in this entity's test directory.
+    """
+    return cleanpath(test_dir, self.name, *names)
+
+  def csvout(self, fn):
+    """
+    Open and log a CSV output file.  We use delimiter and dialect
+    settings imported from the myrpki module, so that we automatically
+    write CSV files in the right format.
+    """
+    path = self.path(fn)
+    print "Writing", path
+    return rpki.myrpki.csv_writer(path)
+
+  def up_down_url(self):
+    """
+    Construct service URL for this node's parent.
+    """
+    parent_port = self.parent.hosted_by.rpkid_port if self.parent.is_hosted() else self.parent.rpkid_port
+    return "http://localhost:%d/up-down/%s/%s" % (parent_port, self.parent.name, self.name)
+
+  def dump_asns(self, fn):
+    """
+    Write Autonomous System Numbers CSV file.
+    """
+    f = self.csvout(fn)
+    for k in self.kids:    
+      f.writerows((k.name, a) for a in k.resources.asn)
+
+  def dump_children(self, fn):
+    """
+    Write children CSV file.
+    """
+    self.csvout(fn).writerows((k.name, k.resources.valid_until, k.path("bpki/resources/ca.cer"))
+                              for k in self.kids)
+
+  def dump_parents(self, fn):
+    """
+    Write parents CSV file.
+    """
+    if self.is_root():
+      self.csvout(fn).writerow(("rootd",
+                                "http://localhost:%d/" % self.rootd_port,
+                                self.path("bpki/servers/ca.cer"),
+                                self.path("bpki/servers/ca.cer"),
+                                self.name,
+                                self.sia_base))
+    else:
+      parent_host = self.parent.hosted_by if self.parent.is_hosted() else self.parent
+      self.csvout(fn).writerow((self.parent.name,
+                                self.up_down_url(),
+                                self.parent.path("bpki/resources/ca.cer"),
+                                parent_host.path("bpki/servers/ca.cer"),
+                                self.name,
+                                self.sia_base))
+
+  def dump_prefixes(self, fn):
+    """
+    Write prefixes CSV file.
+    """
+    f = self.csvout(fn)
+    for k in self.kids:
+      f.writerows((k.name, p) for p in (k.resources.v4 + k.resources.v6))
+
+  def dump_roas(self, fn):
+    """
+    Write ROA CSV file.
+    """
+    group = self.name if self.is_root() else self.parent.name
+    f = self.csvout(fn)
+    for r in self.roa_requests:
+      f.writerows((p, r.asn, group)
+                  for p in (r.v4 + r.v6 if r.v4 and r.v6 else r.v4 or r.v6 or ()))
+
+  def dump_clients(self, fn, db):
+    """
+    Write pubclients CSV file.
+    """
+    if self.runs_pubd():
+      f = self.csvout(fn)
+      f.writerows((s.client_handle, s.path("bpki/resources/ca.cer"), s.sia_base)
+                  for s in (db if only_one_pubd else [self] + self.kids))
+
+  def find_pubd(self):
+    """
+    Walk up tree until we find somebody who runs pubd.
+    """
+    s = self
+    path = [s]
+    while not s.runs_pubd():
+      s = s.parent
+      path.append(s)
+    return s, ".".join(i.name for i in reversed(path))
+
+  def find_host(self):
+    """
+    Figure out who hosts this entity.
+    """
+    return self.hosted_by or self
+
+  def dump_conf(self, fn):
+    """
+    Write configuration file for OpenSSL and RPKI tools.
+    """
+
+    s, ignored = self.find_pubd()
+
+    r = { "handle"              : self.name,
+          "run_rpkid"           : str(not self.is_hosted()),
+          "run_pubd"            : str(self.runs_pubd()),
+          "run_rootd"           : str(self.is_root()),
+          "openssl"             : prog_openssl,
+          "irdbd_sql_database"  : "irdb%d" % self.engine,
+          "rpkid_sql_database"  : "rpki%d" % self.engine,
+          "rpkid_server_host"   : "localhost",
+          "rpkid_server_port"   : str(self.rpkid_port),
+          "irdbd_server_host"   : "localhost",
+          "irdbd_server_port"   : str(self.irdbd_port),
+          "rootd_server_port"   : str(self.rootd_port),
+          "pubd_sql_database"   : "pubd%d" % self.engine,
+          "pubd_server_host"    : "localhost",
+          "pubd_server_port"    : str(s.pubd_port),
+          "publication_rsync_server" : "localhost:%s" % s.rsync_port }
+
+    r.update(config_overrides)
+
+    f = open(self.path(fn), "w")
+    f.write("# Automatically generated, do not edit\n")
+    print "Writing", f.name
+
+    section = None
+    for line in open(cleanpath(rpkid_dir, "examples/myrpki.conf")):
+      m = section_regexp.match(line)
+      if m:
+        section = m.group(1)
+      m = variable_regexp.match(line)
+      option = m.group(1) if m and section == "myrpki" else None
+      if option and option in r:
+        line = "%s = %s\n" % (option, r[option])
+      f.write(line)
+
+    f.close()
+
+  def dump_rsyncd(self, fn):
+    """
+    Write rsyncd configuration file.
+    """
+
+    if self.runs_pubd():
+      f = open(self.path(fn), "w")
+      print "Writing", f.name
+      f.writelines(s + "\n" for s in
+                   ("# Automatically generated, do not edit",
+                    "port         = %d"           % self.rsync_port,
+                    "address      = localhost",
+                    "[rpki]",
+                    "log file     = rsyncd.log",
+                    "read only    = yes",
+                    "use chroot   = no",
+                    "path         = %s"           % self.path("publication"),
+                    "comment      = RPKI test"))
+      f.close()
+
+  def run_configure_daemons(self):
+    """
+    Run configure_daemons if this entity is not hosted by another engine.
+    """
+    if self.is_hosted():
+      print "%s is hosted, skipping configure_daemons" % self.name
+    else:
+      files = [h.path("myrpki.xml") for h in self.hosts]
+      self.run_myrpki("configure_daemons", *[f for f in files if os.path.exists(f)])
+
+  def run_configure_resources(self):
+    """
+    Run configure_resources for this entity.
+    """
+    self.run_myrpki("configure_resources")
+
+  def run_myrpki(self, *args):
+    """
+    Run myrpki.py for this entity.
+    """
+    print 'Running "%s" for %s' % (" ".join(("myrpki",) + args), self.name)
+    subprocess.check_call(("python", prog_myrpki) + args, cwd = self.path())
+
+  def run_python_daemon(self, prog):
+    """
+    Start a Python daemon and return a subprocess.Popen object
+    representing the running daemon.
+    """
+    basename = os.path.basename(prog)
+    p = subprocess.Popen(("python", prog, "-d", "-c", self.path("myrpki.conf")),
+                         cwd = self.path(),
+                         stdout = open(self.path(os.path.splitext(basename)[0] + ".log"), "w"),
+                         stderr = subprocess.STDOUT)
+    print "Running %s for %s: pid %d process %r" % (basename, self.name, p.pid, p)
+    return p
+  
+  def run_rpkid(self):
+    """
+    Run rpkid.
+    """
+    return self.run_python_daemon(prog_rpkid)
+
+  def run_irdbd(self):
+    """
+    Run irdbd.
+    """
+    return self.run_python_daemon(prog_irdbd)
+
+  def run_pubd(self):
+    """
+    Run pubd.
+    """
+    return self.run_python_daemon(prog_pubd)
+
+  def run_rootd(self):
+    """
+    Run rootd.
+    """
+    return self.run_python_daemon(prog_rootd)
+
+  def run_rsyncd(self):
+    """
+    Run rsyncd.
+    """
+    p = subprocess.Popen(("rsync", "--daemon", "--no-detach", "--config", "rsyncd.conf"),
+                         cwd = self.path())
+    print "Running rsyncd for %s: pid %d process %r" % (self.name, p.pid, p)
+    return p
+
+  def run_openssl(self, *args, **kwargs):
+    """
+    Run OpenSSL
+    """
+    env = { "PATH"           : os.environ["PATH"],
+            "BPKI_DIRECTORY" : self.path("bpki/servers"),
+            "OPENSSL_CONF"   : "/dev/null",
+            "RANDFILE"       : ".OpenSSL.whines.unless.I.set.this" }
+    env.update(kwargs)
+    subprocess.check_call((prog_openssl,) + args, cwd = self.path(), env = env)
+
+
+os.environ["TZ"] = "UTC"
+time.tzset()
+
+cfg_file = "yamltest.conf"
+pidfile  = None
+keep_going = False
+
+opts, argv = getopt.getopt(sys.argv[1:], "c:hkp:?", ["config=", "help", "keep_going", "pidfile="])
+for o, a in opts:
+  if o in ("-h", "--help", "-?"):
+    print __doc__
+    sys.exit(0)
+  if o in ("-c", "--config"):
+    cfg_file = a
+  elif o in ("-k", "--keep_going"):
+    keep_going = True
+  elif o in ("-p", "--pidfile"):
+    pidfile = a
+
+# We can't usefully process more than one YAML file at a time, so
+# whine if there's more than one argument left.
+
+if len(argv) > 1:
+  raise rpki.exceptions.CommandParseFailure, "Unexpected arguments %r" % argv
+
+try:
+
+  if pidfile is not None:
+    open(pidfile, "w").write("%s\n" % os.getpid())
+
+  rpki.log.use_syslog = False
+  rpki.log.init("yamltest")
+
+  yaml_file = argv[0] if argv else "smoketest.1.yaml"
+
+  # Allow optional config file for this tool to override default
+  # passwords: this is mostly so that I can show a complete working
+  # example without publishing my own server's passwords.
+
+  cfg = rpki.config.parser(cfg_file, "yamltest", allow_missing = True)
+
+  only_one_pubd = cfg.getboolean("only_one_pubd", True)
+  prog_openssl  = cfg.get("openssl", prog_openssl)
+
+  config_overrides = dict(
+    (k, cfg.get(k))
+    for k in ("rpkid_sql_password", "irdbd_sql_password", "pubd_sql_password",
+              "rpkid_sql_username", "irdbd_sql_username", "pubd_sql_username")
+    if cfg.has_option(k))
+
+  # Start clean
+
+  for root, dirs, files in os.walk(test_dir, topdown = False):
+    for file in files:
+      os.unlink(os.path.join(root, file))
+    for dir in dirs:
+      os.rmdir(os.path.join(root, dir))
+
+  # Read first YAML doc in file and process as compact description of
+  # test layout and resource allocations.  Ignore subsequent YAML docs,
+  # they're for smoketest.py, not this script.
+
+  db = allocation_db(yaml.safe_load_all(open(yaml_file)).next())
+
+  # Show what we loaded
+
+  db.dump()
+
+  # Set up each entity in our test
+
+  for d in db:
+    os.makedirs(d.path())
+    d.dump_asns("asns.csv")
+    d.dump_prefixes("prefixes.csv")
+    d.dump_roas("roas.csv")
+    d.dump_conf("myrpki.conf")
+    d.dump_rsyncd("rsyncd.conf")
+    if False:
+      d.dump_children("children.csv")
+      d.dump_parents("parents.csv")
+      d.dump_clients("pubclients.csv", db)
+
+  # Initialize BPKI and generate self-descriptor for each entity.
+
+  for d in db:
+    d.run_myrpki("initialize")
+
+  # Create publication directories.
+
+  for d in db:
+    if d.is_root() or d.runs_pubd():
+      os.makedirs(d.path("publication"))
+
+  # Create RPKI root certificate.
+
+  print "Creating rootd RPKI root certificate"
+
+  # Should use req -subj here to set subject name.  Later.
+  db.root.run_openssl("x509", "-req", "-sha256", "-outform", "DER",
+                      "-signkey", "bpki/servers/ca.key",
+                      "-in",      "bpki/servers/ca.req",
+                      "-out",     "publication/root.cer",
+                      "-extfile", "myrpki.conf",
+                      "-extensions", "rootd_x509_extensions")
+
+
+  # From here on we need to pay attention to initialization order.  We
+  # used to do all the pre-configure_daemons stuff before running any
+  # of the daemons, but that doesn't work right in hosted cases, so we
+  # have to interleave configuration with starting daemons, just as
+  # one would in the real world for this sort of thing.
+
+  progs = []
+
+  try:
+
+    for d in db:
+
+      print
+      print "Configuring", d.name
+      print
+      if  d.is_root():
+        d.run_myrpki("configure_publication_client", d.path("entitydb", "repositories", "%s.xml" % d.name))
+        print
+        d.run_myrpki("configure_repository", d.path("entitydb", "pubclients", "%s.xml" % d.name))
+        print
+      else:
+        d.parent.run_myrpki("configure_child", d.path("entitydb", "identity.xml"))
+        print
+        d.run_myrpki("configure_parent", d.parent.path("entitydb", "children", "%s.xml" % d.name))
+        print
+        publisher, path = d.find_pubd()
+        publisher.run_myrpki("configure_publication_client", d.path("entitydb", "repositories", "%s.xml" % d.parent.name))
+        print
+        d.run_myrpki("configure_repository", publisher.path("entitydb", "pubclients", "%s.xml" % path))
+        print
+        parent_host = d.parent.find_host()
+        if d.parent is not parent_host:
+          d.parent.run_configure_resources()
+          print
+        parent_host.run_configure_daemons()
+        print
+        if publisher is not parent_host:
+          publisher.run_configure_daemons()
+          print
+
+      print "Running daemons for", d.name
+      if d.is_root():
+        progs.append(d.run_rootd())
+      if not d.is_hosted():
+        progs.append(d.run_irdbd())
+        progs.append(d.run_rpkid())
+      if d.runs_pubd():
+        progs.append(d.run_pubd())
+        progs.append(d.run_rsyncd())
+      if d.is_root() or not d.is_hosted() or d.runs_pubd():
+        print "Giving", d.name, "daemons time to start up"
+        time.sleep(20)
+        print
+      assert all(p.poll() is None for p in progs)
+
+      # Run configure_daemons to set up IRDB and RPKI objects.  Need to
+      # run a second time to push BSC certs out to rpkid.  Nothing
+      # should happen on the third pass.  Oops, when hosting we need to
+      # run configure_resources between passes, since only the hosted
+      # entity can issue the BSC, etc.
+
+      for i in xrange(3):
+        d.run_configure_resources()
+        d.find_host().run_configure_daemons()
+
+    # Run through list again, to be sure we catch hosted cases
+
+    for i in xrange(3):
+      for d in db:
+        d.run_configure_resources()
+        d.run_configure_daemons()
+
+    print "Done initializing daemons"
+
+    # Wait until something terminates.
+
+    signal.signal(signal.SIGCHLD, lambda *dont_care: None)
+    while (any(p.poll() is None for p in progs)
+           if keep_going else
+           all(p.poll() is None for p in progs)):
+      signal.pause()
+
+  finally:
+
+    # Shut everything down.
+
+    signal.signal(signal.SIGCHLD, signal.SIG_DFL)
+    for p in progs:
+      if p.poll() is None:
+        os.kill(p.pid, signal.SIGTERM)
+      print "Program pid %d %r returned %d" % (p.pid, p, p.wait())
+
+finally:
+  if pidfile is not None:
+    os.unlink(pidfile)