368 files changed, 1836 insertions, 2097 deletions

diff --git a/Makefile.in b/Makefile.in
index 1247ff0d..28f3d4c8 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,32 +1,212 @@
 # $Id$
 
-PYTHON = @PYTHON@
+CFLAGS		= @CFLAGS@
+LDFLAGS		= @LDFLAGS@ @POW_LDFLAGS@
+LIBS		= @LIBS@
 
-abs_top_builddir = @abs_top_builddir@
+PYTHON		= @PYTHON@
+INSTALL		= @INSTALL@ -m 555 
+TRANG		= @TRANG@
 
-SUBDIRS = @TOP_LEVEL_SUBDIRS@
+prefix		= @prefix@
+exec_prefix	= @exec_prefix@
+datarootdir	= @datarootdir@
+datadir		= @datadir@
+localstatedir	= @localstatedir@
+sharedstatedir	= @sharedstatedir@
+sysconfdir	= @sysconfdir@
+bindir		= @bindir@
+sbindir		= @sbindir@
+libexecdir	= @libexecdir@
+sysconfdir	= @sysconfdir@
+
+abs_builddir	= @abs_builddir@
+abs_top_srcdir	= @abs_top_srcdir@
+abs_top_builddir= @abs_top_builddir@
+srcdir          = @srcdir@
+
+OPENSSL_TARGET	= @OPENSSL_TARGET@
+RP_TARGET	= @RP_TARGET@
+CA_TARGET	= @CA_TARGET@
+
+WSGI_DAEMON_PROCESS		= @WSGI_DAEMON_PROCESS@
+WSGI_PROCESS_GROUP		= @WSGI_PROCESS_GROUP@
+RCYNIC_DIR			= @RCYNIC_DIR@
+RCYNIC_USER			= @RCYNIC_USER@
+RCYNIC_GROUP			= @RCYNIC_GROUP@
+RCYNIC_HTML_DIR			= @RCYNIC_HTML_DIR@
+RRDTOOL				= @RRDTOOL@
+APACHE_VERSION			= @APACHE_VERSION@
+WSGI_PYTHON_EGG_CACHE_DIR	= @WSGI_PYTHON_EGG_CACHE_DIR@
+WSGI_PYTHON_EGG_CACHE_USER	= @WSGI_PYTHON_EGG_CACHE_USER@
+
+SETUP_PY_INSTALL_LAYOUT = @SETUP_PY_INSTALL_LAYOUT@
+SETUP_PY_ROOT = `${PYTHON} -c 'import sys; print "--root " + sys.argv[1] if sys.argv[1] else ""' '${DESTDIR}'`
+
+POW_SO		= rpki/POW/_POW.so
+
+RNGS =	schemas/relaxng/left-right-schema.rng		\
+	schemas/relaxng/up-down-schema.rng		\
+	schemas/relaxng/publication-schema.rng		\
+	schemas/relaxng/myrpki.rng			\
+	schemas/relaxng/router-certificate-schema.rng
+
+SQLS =	schemas/sql/rpkid.sql				\
+	schemas/sql/pubd.sql
 
 default: all
 
-test:: all
+all: VERSION rpki/autoconf.py setup_autoconf.py
+
+clean: 
+	rm -rf build dist autom4te.cache rpki/autoconf.py setup_autoconf.py setup_autoconf.pyc
+
+test: all
+
+distclean: clean
+	rm -f Makefile config.log config.status
+
+uninstall: deinstall
+
+all:	    	${OPENSSL_TARGET}-all		rpki-all	${RP_TARGET}-all	${CA_TARGET}-all 
+clean:		${OPENSSL_TARGET}-clean		rpki-clean	${RP_TARGET}-clean	${CA_TARGET}-clean 
+test:		${OPENSSL_TARGET}-test		rpki-test	${RP_TARGET}-test	${CA_TARGET}-test 
+distclean:	${OPENSSL_TARGET}-distclean	rpki-distclean	${RP_TARGET}-distclean	${CA_TARGET}-distclean 
+install:					rpki-install	${RP_TARGET}-install	${CA_TARGET}-install 
+deinstall:					rpki-deinstall	${RP_TARGET}-deinstall	${CA_TARGET}-deinstall
+
+openssl-all:		; cd openssl;	${MAKE} all
+openssl-clean:		; cd openssl;	${MAKE} clean
+openssl-test:		; cd openssl;	${MAKE} test
+openssl-distclean:	; cd openssl;	${MAKE} distclean
+
+rp-all:			; cd rp;	${MAKE} all
+rp-clean:		; cd rp;	${MAKE} clean
+rp-test:		; cd rp;	${MAKE} test
+rp-distclean:		; cd rp;	${MAKE} distclean
+rp-install:		; cd rp;	${MAKE} install
+rp-deinstall:		; cd rp;	${MAKE} deinstall
+
+ca-all:			; cd ca;	${MAKE} all
+ca-clean:		; cd ca;	${MAKE} clean
+ca-test:		; cd ca;	${MAKE} test
+ca-distclean:		; cd ca;	${MAKE} distclean
+ca-install:		; cd ca;	${MAKE} install
+ca-deinstall:		; cd ca;	${MAKE} deinstall
+
+noop-all noop-clean noop-test noop-distclean noop-install noop-deinstall:
+	@true
 
-all:: VERSION
+rpki-all:					\
+	setup_autoconf.py			\
+	${RNGS}					\
+	${abs_top_srcdir}/h/rpki/sk_manifest.h	\
+	${abs_top_srcdir}/h/rpki/sk_roa.h	\
+	${abs_top_srcdir}/rpki/relaxng.py	\
+	${abs_top_srcdir}/rpki/sql_schemas.py	\
+	${POW_SO}				\
+	build/stamp
 
-all install clean test distclean deinstall uninstall::
-	@for i in ${SUBDIRS}; do echo "Making $@ in $$i"; (cd $$i && ${MAKE} $@); done
+rpki-clean:
+	rm -rf build dist ${POW_SO} h/rpki/*.h.tmp rpki/*.py.tmp
+	find . -type f -name '*.py[co]' -delete
 
-export:
-	svn export http://subvert-rpki.hactrn.net/
-	tar czf subvert-rpki.hactrn.net-$$(date +%Y.%m.%d).tar.gz subvert-rpki.hactrn.net
-	rm -rf subvert-rpki.hactrn.net
+rpki-test: all
+	@echo Running unit tests
+	PWD=`pwd`; for i in rpki/*.py; do echo "[$$i]"; PYTHONPATH=$$PWD ${PYTHON} $$i; done
 
-distclean clean::
-	rm -rf build autom4te.cache
+rpki-distclean:
+	rm -f installed
 
-distclean::
-	rm -rf Makefile config.log config.status
+rpki-install:
+	${PYTHON} setup.py install ${SETUP_PY_ROOT} ${SETUP_PY_INSTALL_LAYOUT} --record installed
+
+rpki-deinstall:
+	xargs rm -fv <installed
 
 VERSION: .FORCE
 	${PYTHON} buildtools/make-version.py
 
+rpki/autoconf.py: Makefile
+	@echo 'Generating $@';							\
+	(echo '# Automatically generated.  DO NOT EDIT.';			\
+	 echo ;									\
+	 echo 'bindir	      = "${bindir}"';					\
+	 echo 'datarootdir    = "${datarootdir}"';				\
+	 echo 'localstatedir  = "${localstatedir}"';				\
+	 echo 'sbindir	      = "${sbindir}"';					\
+	 echo 'sharedstatedir = "${sharedstatedir}"';				\
+	 echo 'sysconfdir     = "${sysconfdir}"';				\
+	 echo 'libexecdir     = "${libexecdir}"';				\
+	 echo ;									\
+	 echo 'WSGI_DAEMON_PROCESS	    = "${WSGI_DAEMON_PROCESS}"';	\
+	 echo 'WSGI_PROCESS_GROUP	    = "${WSGI_PROCESS_GROUP}"';		\
+	 echo 'RCYNIC_DIR		    = "${RCYNIC_DIR}"';			\
+	 echo 'RCYNIC_USER		    = "${RCYNIC_USER}"';		\
+	 echo 'RCYNIC_GROUP		    = "${RCYNIC_GROUP}"';		\
+	 echo 'RCYNIC_HTML_DIR		    = "${RCYNIC_HTML_DIR}"';		\
+	 echo 'RRDTOOL			    = "${RRDTOOL}"';			\
+	 echo 'APACHE_VERSION		    = "${APACHE_VERSION}"';		\
+	 echo 'WSGI_PYTHON_EGG_CACHE_DIR    = "${WSGI_PYTHON_EGG_CACHE_DIR}"';	\
+	 echo 'WSGI_PYTHON_EGG_CACHE_USER   = "${WSGI_PYTHON_EGG_CACHE_USER}"';	\
+	) > $@
+
+setup_autoconf.py: rpki/autoconf.py
+	@echo 'Generating $@';					\
+	(cat rpki/autoconf.py;					\
+	 echo ;							\
+	 echo 'CFLAGS         = """${CFLAGS}"""';               \
+	 echo 'LDFLAGS        = """${LDFLAGS}"""';              \
+	 echo 'LIBS           = """${LIBS}"""';                 \
+	 echo 'RP_TARGET      = """${RP_TARGET}"""';		\
+	 echo 'CA_TARGET      = """${CA_TARGET}"""';		\
+	) > $@
+
 .FORCE:
+
+${POW_SO}: .FORCE setup_autoconf.py
+	${PYTHON} setup.py build_ext --inplace
+
+build/stamp: .FORCE setup_autoconf.py
+	${PYTHON} setup.py build
+	touch $@
+
+${abs_top_srcdir}/h/rpki/sk_manifest.h: ${abs_top_srcdir}/h/rpki/manifest.h
+	${PYTHON} buildtools/defstack.py h/rpki/manifest.h >$@.tmp
+	mv $@.tmp $@
+
+${abs_top_srcdir}/h/rpki/sk_roa.h: ${abs_top_srcdir}/h/rpki/roa.h
+	${PYTHON} buildtools/defstack.py h/rpki/roa.h >$@.tmp
+	mv $@.tmp $@
+
+${abs_top_srcdir}/rpki/relaxng.py: buildtools/make-relaxng.py ${RNGS}
+	cd schemas/relaxng; ${PYTHON} ${abs_top_srcdir}/buildtools/make-relaxng.py *.rng >$@.tmp
+	mv $@.tmp $@
+
+${abs_top_srcdir}/rpki/sql_schemas.py: buildtools/make-sql-schemas.py ${SQLS}
+	cd schemas/sql; ${PYTHON} ${abs_top_srcdir}/buildtools/make-sql-schemas.py >$@.tmp
+	mv $@.tmp $@
+
+schemas/relaxng/left-right-schema.rng: schemas/relaxng/left-right-schema.rnc
+	${TRANG} schemas/relaxng/left-right-schema.rnc schemas/relaxng/left-right-schema.rng
+
+schemas/relaxng/up-down-schema.rng: schemas/relaxng/up-down-schema.rnc
+	${TRANG} schemas/relaxng/up-down-schema.rnc schemas/relaxng/up-down-schema.rng
+
+schemas/relaxng/publication-schema.rng: schemas/relaxng/publication-schema.rnc
+	${TRANG} schemas/relaxng/publication-schema.rnc schemas/relaxng/publication-schema.rng
+
+schemas/relaxng/myrpki.rng: schemas/relaxng/myrpki.rnc
+	${TRANG} schemas/relaxng/myrpki.rnc schemas/relaxng/myrpki.rng
+
+schemas/relaxng/router-certificate-schema.rng: schemas/relaxng/router-certificate-schema.rnc
+	${TRANG} schemas/relaxng/router-certificate-schema.rnc schemas/relaxng/router-certificate-schema.rng
+
+lint:
+	find rpki -name '*.py' | xargs pylint --rcfile ${abs_top_srcdir}/buildtools/pylint.rc
+
+tags: Makefile
+	find rpki rp ca schemas -type f \
+		\( -name '*.[ch] -o -name '*.py' -o -name '*.sql' -o -name '*.rnc' \) \
+		! -name relaxng.py ! -name sql_schemas.py -print | \
+	etags -
diff --git a/buildtools/debian-skeleton/control b/buildtools/debian-skeleton/control
index 0d9272b1..a91c21ca 100644
--- a/buildtools/debian-skeleton/control
+++ b/buildtools/debian-skeleton/control
@@ -15,6 +15,7 @@ Depends: ${shlibs:Depends}, ${misc:Depends}, python (>= 2.7), rrdtool, rsync, xi
 Description: rpki.net relying party tools
  "Relying party" validation tools from the rpki.net toolkit.
  See the online documentation at http://rpki.net/.
+Replaces: rpki-ca (<= 0.5767)
 
 Package: rpki-ca
 Architecture: any
diff --git a/buildtools/debian-skeleton/rpki-ca.install b/buildtools/debian-skeleton/rpki-ca.install
index fe3e4fed..ffae5103 100644
--- a/buildtools/debian-skeleton/rpki-ca.install
+++ b/buildtools/debian-skeleton/rpki-ca.install
@@ -1,4 +1,4 @@
 etc/rpki/rpki-confgen.xml
-usr/lib
+usr/lib/rpki
 usr/sbin
-usr/share
+usr/share/rpki
diff --git a/buildtools/debian-skeleton/rpki-rp.install b/buildtools/debian-skeleton/rpki-rp.install
index 710f6ef2..ce17bb14 100644
--- a/buildtools/debian-skeleton/rpki-rp.install
+++ b/buildtools/debian-skeleton/rpki-rp.install
@@ -2,4 +2,5 @@ etc/rcynic.conf
 etc/rpki/trust-anchors
 etc/xinetd.d/rpki-rtr
 usr/bin
+usr/lib/python2.7
 var/rcynic
diff --git a/buildtools/defstack.py b/buildtools/defstack.py
index 4d93ce66..757516f3 100644
--- a/buildtools/defstack.py
+++ b/buildtools/defstack.py
@@ -22,6 +22,7 @@
 # PERFORMANCE OF THIS SOFTWARE.
 
 import fileinput
+import os.path
 import sys
 import re
 
@@ -76,7 +77,9 @@ token = None
 for line in fileinput.input():
 
   if token is None:
-    token = "".join(c if c.isalnum() else "_" for c in fileinput.filename().upper())
+    path = fileinput.filename().split(os.path.sep)
+    path = os.path.join(path[-2], path[-1]) if len(path) > 1 else path[-1]
+    token = "".join(c if c.isalnum() else "_" for c in path.upper())
     sys.stdout.write(header.replace("%", token))
 
   if "DECLARE_STACK_OF" in line:
diff --git a/buildtools/freebsd-skeleton/rpki-ca/Makefile b/buildtools/freebsd-skeleton/rpki-ca/Makefile
index 71f38436..cf095aa1 100644
--- a/buildtools/freebsd-skeleton/rpki-ca/Makefile
+++ b/buildtools/freebsd-skeleton/rpki-ca/Makefile
@@ -51,4 +51,18 @@ CONFIGURE_ARGS= --disable-target-installation --disable-runtime-dependencies --d
 pre-install:
 	@test -d ${STAGEDIR}${PREFIX}/etc/rc.d || mkdir -p ${STAGEDIR}${PREFIX}/etc/rc.d
 
+# Kludge to cope with setup.py insisting on including egg info every
+# time it is called, which creates a problem for the way we use it.
+#
+# The real solution for this would be for the FreeBSD port system to
+# grow up and let us build multiple binary packages from a single
+# port, at which point this kludge will no longer be necessary (and
+# this port will merge with rpki-rp).
+#
+# Until that glorious day, just whack the egg info, which should be a
+# duplicate of the one that rpki-rp installs.
+
+post-install:
+	find ${STAGEDIR} -name '*.egg-info' -delete
+
 .include <bsd.port.mk>
diff --git a/buildtools/make-version.py b/buildtools/make-version.py
index af513b5d..a73a89ab 100644
--- a/buildtools/make-version.py
+++ b/buildtools/make-version.py
@@ -63,7 +63,7 @@ if v == unknown:
     sys.stderr.write("Warning: Could not determine software version\n")
 
 if old is None or v != old:
+  with open("rpki/version.py", "w") as f:
+    f.write("VERSION = \"%s\"\n" % v)
   with open("VERSION", "w") as f:
     f.write(v + "\n")
-  with open("rpkid/rpki/version.py", "w") as f:
-    f.write("VERSION = \"%s\"\n" % v)
diff --git a/rpkid/Doxyfile b/ca/Doxyfile
index 33f39f4b..33f39f4b 100644
--- a/rpkid/Doxyfile
+++ b/ca/Doxyfile
diff --git a/rpkid/Makefile.in b/ca/Makefile.in
index d36a3163..1a5e732a 100644
--- a/rpkid/Makefile.in
+++ b/ca/Makefile.in
@@ -33,61 +33,14 @@ APACHE_VERSION			= @APACHE_VERSION@
 WSGI_PYTHON_EGG_CACHE_DIR	= @WSGI_PYTHON_EGG_CACHE_DIR@
 WSGI_PYTHON_EGG_CACHE_USER	= @WSGI_PYTHON_EGG_CACHE_USER@
 
-RPKID_INSTALL_TARGETS	= @RPKID_INSTALL_TARGETS@
-
-SETUP_PY_INSTALL_LAYOUT = @SETUP_PY_INSTALL_LAYOUT@
-
-SETUP_PY_ROOT = `${PYTHON} -c 'import sys; print "--root " + sys.argv[1] if sys.argv[1] else ""' '${DESTDIR}'`
-
-POW_SO = rpki/POW/_POW.so
-
-all:: rpki/autoconf.py setup_autoconf.py rpki/relaxng.py myrpki.rng rpki/sql_schemas.py ${POW_SO} build/stamp
-
-.FORCE:
-
-${POW_SO}: .FORCE setup_autoconf.py
-	${PYTHON} setup.py build_ext --inplace
-
-build/stamp: .FORCE setup_autoconf.py
-	${PYTHON} setup.py build
-	touch $@
+CA_INSTALL_TARGETS	= @CA_INSTALL_TARGETS@
 
 clean::
-	rm -rf ${POW_SO} build dist
-
-RNGS = left-right-schema.rng up-down-schema.rng publication-schema.rng myrpki.rng router-certificate-schema.rng
-
-rpki/relaxng.py: ${abs_top_srcdir}/buildtools/make-relaxng.py ${RNGS}
-	${PYTHON} ${abs_top_srcdir}/buildtools/make-relaxng.py ${RNGS} >$@.tmp
-	mv $@.tmp $@
-
-left-right-schema.rng: left-right-schema.rnc
-	${TRANG} left-right-schema.rnc left-right-schema.rng
-
-up-down-schema.rng: up-down-schema.rnc
-	${TRANG} up-down-schema.rnc up-down-schema.rng
-
-publication-schema.rng: publication-schema.rnc
-	${TRANG} publication-schema.rnc publication-schema.rng
-
-myrpki.rng: myrpki.rnc
-	${TRANG} myrpki.rnc myrpki.rng
-
-router-certificate-schema.rng: router-certificate-schema.rnc
-	${TRANG} router-certificate-schema.rnc router-certificate-schema.rng
-
-rpki/sql_schemas.py: ${abs_top_srcdir}/buildtools/make-sql-schemas.py rpkid.sql pubd.sql
-	${PYTHON} ${abs_top_srcdir}/buildtools/make-sql-schemas.py >$@.tmp
-	mv $@.tmp $@
-
-clean::
-	find . -type f -name '*.py[co]' -delete
 	cd tests; $(MAKE) $@
 
-install:: ${RPKID_INSTALL_TARGETS}
+install:: ${CA_INSTALL_TARGETS}
 
 install-always:: all
-	${PYTHON} setup.py install ${SETUP_PY_ROOT} ${SETUP_PY_INSTALL_LAYOUT} --record installed
 	@echo
 	@echo "== Default configuration file location is ${sysconfdir}/rpki.conf =="
 	@echo
@@ -96,82 +49,20 @@ install-always:: all
 
 uninstall deinstall::
 	-${libexecdir}/rpkigui-apache-conf-gen --remove --verbose
-	xargs rm -fv <installed
 
 distclean::
 	rm -f installed
 
-dont-run-trang:
-	touch *.rng
-
-relaxng: left-right-schema.rng up-down-schema.rng publication-schema.rng
-	cd tests; $(MAKE) protocol-samples
-	xmllint --noout --relaxng  left-right-schema.rng  tests/left-right-protocol-samples/*.xml
-	xmllint --noout --relaxng     up-down-schema.rng     tests/up-down-protocol-samples/*.xml
-	xmllint --noout --relaxng publication-schema.rng tests/publication-protocol-samples/*.xml
-
-unit-tests: all
-	PWD=`pwd`; for i in rpki/*.py; do echo "[$$i]"; PYTHONPATH=$$PWD ${PYTHON} $$i; done
-
-all-tests:: unit-tests
-
-all-tests:: relaxng
-
-test all-tests parse-test profile yamltest yamlconf:: all
+test all-tests relaxng parse-test profile yamltest yamlconf:: all
 	cd tests; $(MAKE) $@
 
-tags: Makefile
-	find . -type d -name build -prune -o -type f \( -name '*.py' -o -name '*.sql' -o -name '*.rnc' -o -name '*.py.in' \) ! -name relaxng.py ! -name sql_schemas.py -print | etags -
-
-lint:
-	pylint --rcfile ${abs_top_srcdir}/buildtools/pylint.rc rpki/*.py rpki/irdb/*.py *.py tests/*.py
-
-# Documentation
-
-doc/pubd.dot: pubd.sql
-	sh ${abs_top_srcdir}/buildtools/graphviz-sql.sh $? >$@
-
-doc/rpkid.dot: rpkid.sql
-	sh ${abs_top_srcdir}/buildtools/graphviz-sql.sh $? >$@
-
-.SUFFIXES: .dot .png .pdf .eps
-
-.dot.pdf:
-	dot -Tps2 $? | ps2pdf - $@
-
-.dot.eps:
-	dot -o $@ -Teps $?
-
-.dot.png:
-	dot -o $@ -Tpng $?
-
-dot: doc/pubd.dot doc/rpkid.dot
-
-eps: doc/pubd.eps doc/rpkid.eps doc/rpkid-bpki.eps doc/pubd-bpki.eps
-
-png: doc/pubd.png doc/rpkid.png doc/rpkid-bpki.png doc/pubd-bpki.png
-
-pdf: doc/pubd.pdf doc/rpkid.pdf doc/rpkid-bpki.pdf doc/pubd-bpki.pdf
-
-docclean:
-	rm -rf doc/html doc/latex doc/xml
-	rm -f  doc/*.eps doc/*.pdf doc/*.png
-	rm -f doc/pubd.dot doc/rpkid.dot
-
-html: dot eps png
-	TZ='' IMAGE_PATH=${abs_builddir}/doc doxygen
-
-docs: dot eps png html pdf
-
-##
-
-distclean:: clean docclean
+distclean:: clean
 	cd tests; ${MAKE} $@
-	rm -f TAGS Makefile
+	rm -f Makefile
 
 all:: examples/rpki.conf
 
-examples/rpki.conf: rpki/autoconf.py rpki-confgen rpki-confgen.xml
+examples/rpki.conf: ${abs_top_srcdir}/rpki/autoconf.py rpki-confgen rpki-confgen.xml
 	${PYTHON} rpki-confgen \
 		--read-xml rpki-confgen.xml \
 		--autoconf \
@@ -185,41 +76,6 @@ examples/rpki.conf: rpki/autoconf.py rpki-confgen rpki-confgen.xml
 clean::
 	rm -f examples/rpki.conf
 
-rpki/autoconf.py: Makefile
-	@echo 'Generating $@';							\
-	(echo '# Automatically generated.  DO NOT EDIT.';			\
-	 echo ;									\
-	 echo 'bindir	      = "${bindir}"';					\
-	 echo 'datarootdir    = "${datarootdir}"';				\
-	 echo 'localstatedir  = "${localstatedir}"';				\
-	 echo 'sbindir	      = "${sbindir}"';					\
-	 echo 'sharedstatedir = "${sharedstatedir}"';				\
-	 echo 'sysconfdir     = "${sysconfdir}"';				\
-	 echo 'libexecdir     = "${libexecdir}"';				\
-	 echo ;									\
-	 echo 'WSGI_DAEMON_PROCESS	    = "${WSGI_DAEMON_PROCESS}"';	\
-	 echo 'WSGI_PROCESS_GROUP	    = "${WSGI_PROCESS_GROUP}"';		\
-	 echo 'RCYNIC_HTML_DIR		    = "${RCYNIC_HTML_DIR}"';		\
-	 echo 'APACHE_VERSION		    = "${APACHE_VERSION}"';		\
-	 echo 'WSGI_PYTHON_EGG_CACHE_DIR    = "${WSGI_PYTHON_EGG_CACHE_DIR}"';	\
-	 echo 'WSGI_PYTHON_EGG_CACHE_USER   = "${WSGI_PYTHON_EGG_CACHE_USER}"';	\
-	) > $@
-
-clean::
-	rm -f rpki/autoconf.py
-
-setup_autoconf.py: rpki/autoconf.py
-	@echo 'Generating $@';					\
-	(cat rpki/autoconf.py;					\
-	 echo ;							\
-	 echo 'CFLAGS         = """${CFLAGS}"""';               \
-	 echo 'LDFLAGS        = """${LDFLAGS}"""';              \
-	 echo 'LIBS           = """${LIBS}"""';                 \
-	) > $@
-
-clean::
-	rm -f setup_autoconf.py setup_autoconf.pyc
-
 install-postconf: \
 	install-user install-egg-cache install-conf install-apache install-mysql install-django install-bpki install-cron
 
@@ -268,7 +124,8 @@ install-apache:
 	${libexecdir}/rpkigui-apache-conf-gen --install --verbose
 
 install-mysql:
-	${sbindir}/rpki-sql-setup
+	${sbindir}/rpki-sql-setup --create-if-missing
+	${sbindir}/rpki-sql-setup --apply-upgrades --verbose
 
 install-django:
 	${sbindir}/rpki-manage syncdb --noinput
diff --git a/rpkid/README b/ca/README
index 91d372de..91d372de 100644
--- a/rpkid/README
+++ b/ca/README
diff --git a/rpkid/examples/asns.csv b/ca/examples/asns.csv
index 9d742740..9d742740 100644
--- a/rpkid/examples/asns.csv
+++ b/ca/examples/asns.csv
diff --git a/rpkid/examples/prefixes.csv b/ca/examples/prefixes.csv
index ece18d32..ece18d32 100644
--- a/rpkid/examples/prefixes.csv
+++ b/ca/examples/prefixes.csv
diff --git a/rpkid/examples/roas.csv b/ca/examples/roas.csv
index e4ec3074..e4ec3074 100644
--- a/rpkid/examples/roas.csv
+++ b/ca/examples/roas.csv
diff --git a/rpkid/examples/rsyncd.conf b/ca/examples/rsyncd.conf
index faf1dd0d..faf1dd0d 100644
--- a/rpkid/examples/rsyncd.conf
+++ b/ca/examples/rsyncd.conf
diff --git a/rpkid/irbe_cli b/ca/irbe_cli
index 9deac6d6..9deac6d6 100755
--- a/rpkid/irbe_cli
+++ b/ca/irbe_cli
diff --git a/rpkid/irdbd b/ca/irdbd
index 493e3d72..493e3d72 100755
--- a/rpkid/irdbd
+++ b/ca/irdbd
diff --git a/rpkid/pubd b/ca/pubd
index 7d8ecbfa..7d8ecbfa 100755
--- a/rpkid/pubd
+++ b/ca/pubd
diff --git a/rpkid/rootd b/ca/rootd
index cb59f958..cb59f958 100755
--- a/rpkid/rootd
+++ b/ca/rootd
diff --git a/rpkid/tests/rpki b/ca/rpki
index 8d289d0b..8d289d0b 120000
--- a/rpkid/tests/rpki
+++ b/ca/rpki
diff --git a/rpkid/rpki-confgen b/ca/rpki-confgen
index f531bee8..f531bee8 100755
--- a/rpkid/rpki-confgen
+++ b/ca/rpki-confgen
diff --git a/rpkid/rpki-confgen.xml b/ca/rpki-confgen.xml
index e0ed273a..e0ed273a 100644
--- a/rpkid/rpki-confgen.xml
+++ b/ca/rpki-confgen.xml
diff --git a/rpkid/portal-gui/scripts/rpki-manage b/ca/rpki-manage
index 0d581ce9..0d581ce9 100755
--- a/rpkid/portal-gui/scripts/rpki-manage
+++ b/ca/rpki-manage
diff --git a/rpkid/rpki-sql-backup b/ca/rpki-sql-backup
index 0b2d079d..0b2d079d 100755
--- a/rpkid/rpki-sql-backup
+++ b/ca/rpki-sql-backup
diff --git a/rpkid/rpki-sql-setup b/ca/rpki-sql-setup
index 40a78532..40a78532 100755
--- a/rpkid/rpki-sql-setup
+++ b/ca/rpki-sql-setup
diff --git a/rpkid/rpki-start-servers b/ca/rpki-start-servers
index edaffb2e..edaffb2e 100755
--- a/rpkid/rpki-start-servers
+++ b/ca/rpki-start-servers
diff --git a/rpkid/portal-gui/rpki.wsgi b/ca/rpki.wsgi
index 72ba75ac..72ba75ac 100644
--- a/rpkid/portal-gui/rpki.wsgi
+++ b/ca/rpki.wsgi
diff --git a/rpkid/rpkic b/ca/rpkic
index 333a5eb7..333a5eb7 100755
--- a/rpkid/rpkic
+++ b/ca/rpkic
diff --git a/rpkid/rpkid b/ca/rpkid
index a4cc6cd3..a4cc6cd3 100755
--- a/rpkid/rpkid
+++ b/ca/rpkid
diff --git a/rpkid/portal-gui/scripts/rpkigui-apache-conf-gen b/ca/rpkigui-apache-conf-gen
index 6201c364..6201c364 100755
--- a/rpkid/portal-gui/scripts/rpkigui-apache-conf-gen
+++ b/ca/rpkigui-apache-conf-gen
diff --git a/rpkid/portal-gui/scripts/rpkigui-check-expired b/ca/rpkigui-check-expired
index eb0c7fbb..eb0c7fbb 100755
--- a/rpkid/portal-gui/scripts/rpkigui-check-expired
+++ b/ca/rpkigui-check-expired
diff --git a/rpkid/portal-gui/scripts/rpkigui-import-routes b/ca/rpkigui-import-routes
index 234a865b..234a865b 100755
--- a/rpkid/portal-gui/scripts/rpkigui-import-routes
+++ b/ca/rpkigui-import-routes
diff --git a/rpkid/portal-gui/scripts/rpkigui-query-routes b/ca/rpkigui-query-routes
index 1f698f23..1f698f23 100755
--- a/rpkid/portal-gui/scripts/rpkigui-query-routes
+++ b/ca/rpkigui-query-routes
diff --git a/rpkid/portal-gui/scripts/rpkigui-rcynic b/ca/rpkigui-rcynic
index 8fb91a70..8fb91a70 100755
--- a/rpkid/portal-gui/scripts/rpkigui-rcynic
+++ b/ca/rpkigui-rcynic
diff --git a/rpkid/tests/Makefile.in b/ca/tests/Makefile.in
index b63e8dc3..9796dd2b 100644
--- a/rpkid/tests/Makefile.in
+++ b/ca/tests/Makefile.in
@@ -22,6 +22,13 @@ publication-protocol-samples/.stamp: publication-protocol-samples.xml split-prot
 	xsltproc --param verbose 0 --stringparam dir publication-protocol-samples split-protocol-samples.xsl publication-protocol-samples.xml
 	touch $@
 
+relaxng: protocol-samples
+	xmllint --noout --relaxng ../../schemas/relaxng/left-right-schema.rng  left-right-protocol-samples/*.xml
+	xmllint --noout --relaxng ../../schemas/relaxng/up-down-schema.rng     up-down-protocol-samples/*.xml
+	xmllint --noout --relaxng ../../schemas/relaxng/publication-schema.rng publication-protocol-samples/*.xml
+
+all-tests:: relaxng
+
 parse-test: protocol-samples
 	${PYTHON} xml-parse-test.py
 
diff --git a/rpkid/tests/left-right-protocol-samples.xml b/ca/tests/left-right-protocol-samples.xml
index 7b97386d..7b97386d 100644
--- a/rpkid/tests/left-right-protocol-samples.xml
+++ b/ca/tests/left-right-protocol-samples.xml
diff --git a/rpkid/tests/myrpki-xml-parse-test.py b/ca/tests/myrpki-xml-parse-test.py
index 10b9cd58..10b9cd58 100644
--- a/rpkid/tests/myrpki-xml-parse-test.py
+++ b/ca/tests/myrpki-xml-parse-test.py
diff --git a/rpkid/tests/old_irdbd.py b/ca/tests/old_irdbd.py
index d258e4c0..d258e4c0 100644
--- a/rpkid/tests/old_irdbd.py
+++ b/ca/tests/old_irdbd.py
diff --git a/rpkid/tests/old_irdbd.sql b/ca/tests/old_irdbd.sql
index e773bb2e..e773bb2e 100644
--- a/rpkid/tests/old_irdbd.sql
+++ b/ca/tests/old_irdbd.sql
diff --git a/rpkid/tests/publication-protocol-samples.xml b/ca/tests/publication-protocol-samples.xml
index 96b095a7..96b095a7 100644
--- a/rpkid/tests/publication-protocol-samples.xml
+++ b/ca/tests/publication-protocol-samples.xml
diff --git a/rpkid/tests/rcynic.conf b/ca/tests/rcynic.conf
index ea31fe58..ea31fe58 100644
--- a/rpkid/tests/rcynic.conf
+++ b/ca/tests/rcynic.conf
diff --git a/rpkid/tests/revoke.yaml b/ca/tests/revoke.yaml
index 2edb8335..ae53f0d8 100644
--- a/rpkid/tests/revoke.yaml
+++ b/ca/tests/revoke.yaml
@@ -54,7 +54,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -67,7 +67,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 
@@ -81,7 +81,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -92,7 +92,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -105,7 +105,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -118,7 +118,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -129,7 +129,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -142,7 +142,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -155,7 +155,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -166,7 +166,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -179,7 +179,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -192,7 +192,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -203,7 +203,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -216,7 +216,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -229,7 +229,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -240,7 +240,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -253,7 +253,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -266,7 +266,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -277,7 +277,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -290,7 +290,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -303,7 +303,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -314,7 +314,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -327,7 +327,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -340,7 +340,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -351,7 +351,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -364,7 +364,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -377,7 +377,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
@@ -388,7 +388,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -401,7 +401,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - name: R0
@@ -414,7 +414,7 @@ kids:
   cd rcynic-data;
   pax -rwl . ../$dir; find . -type f -name '*.cer' |
   sort |
-  xargs ../../../../utils/uri/uri -s
+  xargs ../../../../rp/utils/uri -s
   >../${dir%.data}.uris;
   sleep 1
 - sleep 30
diff --git a/rpkid/tests/rootd.yaml b/ca/tests/rootd.yaml
index 2ee5dcd4..2ee5dcd4 100644
--- a/rpkid/tests/rootd.yaml
+++ b/ca/tests/rootd.yaml
diff --git a/ca/tests/rpki b/ca/tests/rpki
new file mode 120000
index 00000000..8d289d0b
--- /dev/null
+++ b/ca/tests/rpki
@@ -0,0 +1 @@
+../rpki
\ No newline at end of file
diff --git a/rpkid/tests/smoketest.1.yaml b/ca/tests/smoketest.1.yaml
index 914aaae4..0e9acb85 100644
--- a/rpkid/tests/smoketest.1.yaml
+++ b/ca/tests/smoketest.1.yaml
@@ -52,8 +52,8 @@ kids:
 
 ---
 - shell set -x;
-  rtr_origin='python ../../../rtr-origin/rtr-origin.py';
-  $rtr_origin --cronjob rcynic-data/authenticated &&
+  rtr_origin='../../../rp/rpki-rtr/rtr-origin';
+  $rtr_origin --scan-roas ../../../rp/utils/scan_roas --scan-routercerts ../../../rp/utils/scan_routercerts --cronjob rcynic-data/authenticated &&
   $rtr_origin --show
 ---
 - name: R0
@@ -70,8 +70,8 @@ kids:
       ipv4: 10.3.0.1/32, 10.0.0.44/32
 ---
 - shell set -x;
-  rtr_origin='python ../../../rtr-origin/rtr-origin.py';
-  $rtr_origin --cronjob rcynic-data/authenticated &&
+  rtr_origin='../../../rp/rpki-rtr/rtr-origin';
+  $rtr_origin --scan-roas ../../../rp/utils/scan_roas --scan-routercerts ../../../rp/utils/scan_routercerts --cronjob rcynic-data/authenticated &&
   $rtr_origin --show
 ---
 - sleep 30
diff --git a/rpkid/tests/smoketest.2.yaml b/ca/tests/smoketest.2.yaml
index 0cdec650..0cdec650 100644
--- a/rpkid/tests/smoketest.2.yaml
+++ b/ca/tests/smoketest.2.yaml
diff --git a/rpkid/tests/smoketest.3.yaml b/ca/tests/smoketest.3.yaml
index e6a10a12..df308ebe 100644
--- a/rpkid/tests/smoketest.3.yaml
+++ b/ca/tests/smoketest.3.yaml
@@ -51,18 +51,18 @@ kids:
         ipv4: 10.3.0.0/23
 ---
 #- shell find publication -type f -name '*.roa'
-#        -print -exec ../../../utils/print_roa/print_roa {} \;
+#        -print -exec ../../../rp/utils/print_roa {} \;
 #- shell find publication -type f -name '*.mft'
-#        -print -exec ../../../utils/print_manifest/print_manifest {} \;
+#        -print -exec ../../../rp/utils/print_manifest {} \;
 #---
 #- shell find publication -type f -name '*.roa'
-#        -print -exec ../../../utils/print_roa/print_roa {} \;
+#        -print -exec ../../../rp/utils/print_roa {} \;
 #- shell find publication -type f -name '*.mft'
-#        -print -exec ../../../utils/print_manifest/print_manifest {} \;
+#        -print -exec ../../../rp/utils/print_manifest {} \;
 #---
 - shell set -x;
-  rtr_origin=../../../rtr-origin/rtr-origin;
-  $rtr_origin --cronjob rcynic-data/authenticated &&
+  rtr_origin=../../../rp/rpki-rtr/rtr-origin;
+  $rtr_origin --scan-roas ../../../rp/utils/scan_roas --scan-routercerts ../../../rp/utils/scan_routercerts --cronjob rcynic-data/authenticated &&
   $rtr_origin --show
 ---
 - name: Alice
@@ -76,6 +76,6 @@ kids:
       ipv6: 2002:0a00::/32-128
 ---
 - shell set -x;
-  rtr_origin=../../../rtr-origin/rtr-origin;
-  $rtr_origin --cronjob rcynic-data/authenticated &&
+  rtr_origin=../../../rp/rpki-rtr/rtr-origin;
+  $rtr_origin --scan-roas ../../../rp/utils/scan_roas --scan-routercerts ../../../rp/utils/scan_routercerts --cronjob rcynic-data/authenticated &&
   $rtr_origin --show
diff --git a/rpkid/tests/smoketest.4.yaml b/ca/tests/smoketest.4.yaml
index c0d446bc..c0d446bc 100644
--- a/rpkid/tests/smoketest.4.yaml
+++ b/ca/tests/smoketest.4.yaml
diff --git a/rpkid/tests/smoketest.5.yaml b/ca/tests/smoketest.5.yaml
index c6304dfc..c6304dfc 100644
--- a/rpkid/tests/smoketest.5.yaml
+++ b/ca/tests/smoketest.5.yaml
diff --git a/rpkid/tests/smoketest.6.yaml b/ca/tests/smoketest.6.yaml
index e8d65433..e8d65433 100644
--- a/rpkid/tests/smoketest.6.yaml
+++ b/ca/tests/smoketest.6.yaml
diff --git a/rpkid/tests/smoketest.7.yaml b/ca/tests/smoketest.7.yaml
index fedd2fff..2da48770 100644
--- a/rpkid/tests/smoketest.7.yaml
+++ b/ca/tests/smoketest.7.yaml
@@ -70,8 +70,8 @@ roa_request:
 ---
 - shell set -x;
   find publication -type f -name '*.roa'
-       -print -exec ../../../utils/print_roa/print_roa {} \;
+       -print -exec ../../../rp/utils/print_roa {} \;
        ;
-  rtr_origin=../../../rtr-origin/rtr-origin;
-  $rtr_origin --cronjob rcynic-data/authenticated &&
+  rtr_origin=../../../rp/rpki-rtr/rtr-origin;
+  $rtr_origin --scan-roas ../../../rp/utils/scan_roas --scan-routercerts ../../../rp/utils/scan_routercerts --cronjob rcynic-data/authenticated &&
   $rtr_origin --show
diff --git a/rpkid/tests/smoketest.8.yaml b/ca/tests/smoketest.8.yaml
index cd6d1e7a..cd6d1e7a 100644
--- a/rpkid/tests/smoketest.8.yaml
+++ b/ca/tests/smoketest.8.yaml
diff --git a/rpkid/tests/smoketest.9.yaml b/ca/tests/smoketest.9.yaml
index 3efc4f08..3efc4f08 100644
--- a/rpkid/tests/smoketest.9.yaml
+++ b/ca/tests/smoketest.9.yaml
diff --git a/rpkid/tests/smoketest.clean.sql b/ca/tests/smoketest.clean.sql
index 9f5ff9fb..9f5ff9fb 100644
--- a/rpkid/tests/smoketest.clean.sql
+++ b/ca/tests/smoketest.clean.sql
diff --git a/rpkid/tests/smoketest.py b/ca/tests/smoketest.py
index 28bedaa4..e5f5a754 100644
--- a/rpkid/tests/smoketest.py
+++ b/ca/tests/smoketest.py
@@ -115,14 +115,14 @@ prog_poke      = cfg.get("prog_poke",      "../testpoke.py")
 prog_rootd     = cfg.get("prog_rootd",     "../../rootd")
 prog_pubd      = cfg.get("prog_pubd",      "../../pubd")
 prog_rsyncd    = cfg.get("prog_rsyncd",    "rsync")
-prog_rcynic    = cfg.get("prog_rcynic",    "../../../rcynic/rcynic")
+prog_rcynic    = cfg.get("prog_rcynic",    "../../../rp/rcynic/rcynic")
 prog_openssl   = cfg.get("prog_openssl",   "../../../openssl/openssl/apps/openssl")
 
-rcynic_stats   = cfg.get("rcynic_stats",   "echo ; ../../../rcynic/rcynic-text %s.xml ; echo" % rcynic_name)
+rcynic_stats   = cfg.get("rcynic_stats",   "echo ; ../../../rp/rcynic/rcynic-text %s.xml ; echo" % rcynic_name)
 
-rpki_sql_file  = cfg.get("rpki_sql_file",  "../rpkid.sql")
+rpki_sql_file  = cfg.get("rpki_sql_file",  "../../schemas/sql/rpkid.sql")
 irdb_sql_file  = cfg.get("irdb_sql_file",  "old_irdbd.sql")
-pub_sql_file   = cfg.get("pub_sql_file",   "../pubd.sql")
+pub_sql_file   = cfg.get("pub_sql_file",   "../../schemas/sql/pubd.sql")
 
 startup_delay  = int(cfg.get("startup_delay", "10"))
 
diff --git a/rpkid/tests/smoketest.setup.sql b/ca/tests/smoketest.setup.sql
index 326988f1..326988f1 100644
--- a/rpkid/tests/smoketest.setup.sql
+++ b/ca/tests/smoketest.setup.sql
diff --git a/rpkid/tests/split-protocol-samples.xsl b/ca/tests/split-protocol-samples.xsl
index 8800b6da..8800b6da 100644
--- a/rpkid/tests/split-protocol-samples.xsl
+++ b/ca/tests/split-protocol-samples.xsl
diff --git a/rpkid/tests/sql-cleaner.py b/ca/tests/sql-cleaner.py
index c5b25ac2..c5b25ac2 100644
--- a/rpkid/tests/sql-cleaner.py
+++ b/ca/tests/sql-cleaner.py
diff --git a/rpkid/tests/sql-dumper.py b/ca/tests/sql-dumper.py
index f4a7681d..f4a7681d 100644
--- a/rpkid/tests/sql-dumper.py
+++ b/ca/tests/sql-dumper.py
diff --git a/rpkid/tests/testpoke.py b/ca/tests/testpoke.py
index fd5ab206..fd5ab206 100644
--- a/rpkid/tests/testpoke.py
+++ b/ca/tests/testpoke.py
diff --git a/rpkid/tests/testpoke.xsl b/ca/tests/testpoke.xsl
index 91658b0b..91658b0b 100644
--- a/rpkid/tests/testpoke.xsl
+++ b/ca/tests/testpoke.xsl
diff --git a/rpkid/tests/testpoke.yaml b/ca/tests/testpoke.yaml
index f2b2c618..f2b2c618 100644
--- a/rpkid/tests/testpoke.yaml
+++ b/ca/tests/testpoke.yaml
diff --git a/rpkid/tests/up-down-protocol-samples/Makefile b/ca/tests/up-down-protocol-samples/Makefile
index 10ee791a..10ee791a 100644
--- a/rpkid/tests/up-down-protocol-samples/Makefile
+++ b/ca/tests/up-down-protocol-samples/Makefile
diff --git a/rpkid/tests/up-down-protocol-samples/error_response.xml b/ca/tests/up-down-protocol-samples/error_response.xml
index 83af6649..83af6649 100644
--- a/rpkid/tests/up-down-protocol-samples/error_response.xml
+++ b/ca/tests/up-down-protocol-samples/error_response.xml
diff --git a/rpkid/tests/up-down-protocol-samples/issue1.xml b/ca/tests/up-down-protocol-samples/issue1.xml
index 4b8366f9..4b8366f9 100644
--- a/rpkid/tests/up-down-protocol-samples/issue1.xml
+++ b/ca/tests/up-down-protocol-samples/issue1.xml
diff --git a/rpkid/tests/up-down-protocol-samples/issue2.xml b/ca/tests/up-down-protocol-samples/issue2.xml
index a991cbcd..a991cbcd 100644
--- a/rpkid/tests/up-down-protocol-samples/issue2.xml
+++ b/ca/tests/up-down-protocol-samples/issue2.xml
diff --git a/rpkid/tests/up-down-protocol-samples/issue_response.xml b/ca/tests/up-down-protocol-samples/issue_response.xml
index 1ee34f62..1ee34f62 100644
--- a/rpkid/tests/up-down-protocol-samples/issue_response.xml
+++ b/ca/tests/up-down-protocol-samples/issue_response.xml
diff --git a/rpkid/tests/up-down-protocol-samples/list.xml b/ca/tests/up-down-protocol-samples/list.xml
index 01a803f3..01a803f3 100644
--- a/rpkid/tests/up-down-protocol-samples/list.xml
+++ b/ca/tests/up-down-protocol-samples/list.xml
diff --git a/rpkid/tests/up-down-protocol-samples/list_response.xml b/ca/tests/up-down-protocol-samples/list_response.xml
index 09634955..09634955 100644
--- a/rpkid/tests/up-down-protocol-samples/list_response.xml
+++ b/ca/tests/up-down-protocol-samples/list_response.xml
diff --git a/rpkid/tests/up-down-protocol-samples/revoke.xml b/ca/tests/up-down-protocol-samples/revoke.xml
index eb4b3efb..eb4b3efb 100644
--- a/rpkid/tests/up-down-protocol-samples/revoke.xml
+++ b/ca/tests/up-down-protocol-samples/revoke.xml
diff --git a/rpkid/tests/up-down-protocol-samples/revoke_response.xml b/ca/tests/up-down-protocol-samples/revoke_response.xml
index 9f4ebacc..9f4ebacc 100644
--- a/rpkid/tests/up-down-protocol-samples/revoke_response.xml
+++ b/ca/tests/up-down-protocol-samples/revoke_response.xml
diff --git a/rpkid/tests/xml-parse-test.py b/ca/tests/xml-parse-test.py
index 42b54695..42b54695 100644
--- a/rpkid/tests/xml-parse-test.py
+++ b/ca/tests/xml-parse-test.py
diff --git a/rpkid/tests/yamlconf.py b/ca/tests/yamlconf.py
index 3c71d3cd..3c71d3cd 100644
--- a/rpkid/tests/yamlconf.py
+++ b/ca/tests/yamlconf.py
diff --git a/rpkid/tests/yamltest-test-all.sh b/ca/tests/yamltest-test-all.sh
index 8daea04e..4bd5c560 100644
--- a/rpkid/tests/yamltest-test-all.sh
+++ b/ca/tests/yamltest-test-all.sh
@@ -43,9 +43,9 @@ do
   do
     sleep 30
     date
-    ../../rcynic/rcynic
-    ../../rcynic/rcynic-text rcynic.xml
-    ../../utils/scan_roas/scan_roas rcynic-data/authenticated
+    ../../rp/rcynic/rcynic
+    ../../rp/rcynic/rcynic-text rcynic.xml
+    ../../rp/utils/scan_roas rcynic-data/authenticated
     date
     echo "$title"
   done
diff --git a/rpkid/tests/yamltest.py b/ca/tests/yamltest.py
index 5eb3bd2f..5eb3bd2f 100644
--- a/rpkid/tests/yamltest.py
+++ b/ca/tests/yamltest.py
diff --git a/rpkid/upgrade-scripts/upgrade-rpkid-to-0.5709.py b/ca/upgrade-scripts/upgrade-rpkid-to-0.5709.py
index aa8e3ec1..aa8e3ec1 100644
--- a/rpkid/upgrade-scripts/upgrade-rpkid-to-0.5709.py
+++ b/ca/upgrade-scripts/upgrade-rpkid-to-0.5709.py
diff --git a/configure b/configure
index 4a512935..585948cc 100755
--- a/configure
+++ b/configure
@@ -582,7 +582,7 @@ PACKAGE_STRING='rpkitools 1.0'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
-ac_unique_file="rcynic/rcynic.c"
+ac_unique_file="rp/rcynic/rcynic.c"
 # Factoring default headers for most tests.
 ac_includes_default="\
 #include <stdio.h>
@@ -625,15 +625,19 @@ WSGI_PROCESS_GROUP
 WSGI_DAEMON_PROCESS
 OPENSSL_SO_GLOB
 OPENSSL_CONFIG_COMMAND
-TOP_LEVEL_SUBDIRS
+CA_TARGET
+RP_TARGET
+OPENSSL_TARGET
 WSGI_PYTHON_EGG_CACHE_USER
 WSGI_PYTHON_EGG_CACHE_DIR
 SETUP_PY_INSTALL_LAYOUT
-RPKID_INSTALL_TARGETS
+CA_INSTALL_TARGETS
 RTR_ORIGIN_INSTALL_TARGETS
 RCYNIC_INSTALL_TARGETS
 RCYNIC_HTML_DIR
 RCYNIC_STATIC_RSYNC
+RCYNIC_GROUP
+RCYNIC_USER
 RCYNIC_CRON_USER
 RCYNIC_CONF_TA_DIR
 RCYNIC_CONF_DATA
@@ -714,7 +718,7 @@ PATH_SEPARATOR
 SHELL'
 ac_subst_files='RCYNIC_MAKE_RULES
 RTR_ORIGIN_MAKE_RULES
-RPKID_MAKE_RULES'
+CA_MAKE_RULES'
 ac_user_opts='
 enable_option_checking
 with_system_openssl
@@ -4257,43 +4261,86 @@ case $enable_runtime_dependencies in
 		;;
 esac
 
+# Figure out whether we want RP tools, CA tools, or both
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether user wants the RP tools" >&5
+$as_echo_n "checking whether user wants the RP tools... " >&6; }
+case $enable_rp_tools in
+     yes|no)
+		build_rp_tools=$enable_rp_tools
+		;;
+     *)
+		as_fn_error $? "Unrecognized value for --enable-rp-tools: $enable_rp_tools" "$LINENO" 5
+		;;
+esac
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $build_rp_tools" >&5
+$as_echo "$build_rp_tools" >&6; }
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether user wants the CA tools" >&5
+$as_echo_n "checking whether user wants the CA tools... " >&6; }
+case $enable_ca_tools in
+     yes|no)
+		build_ca_tools=$enable_ca_tools
+		;;
+     *)
+		as_fn_error $? "Unrecognized value for --enable-ca-tools: $enable_ca_tools" "$LINENO" 5
+		;;
+esac
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $build_ca_tools" >&5
+$as_echo "$build_ca_tools" >&6; }
+
+if test $build_rp_tools = no && test $build_ca_tools = no
+then
+	as_fn_error $? "Building with neither RP tools nor CA tools makes no sense" "$LINENO" 5
+fi
+
 # Figure out whether we need to build our own OpenSSL library or can
 # use the system libraries.  We're looking for two recent features:
 # CMS and RFC 3779 support.  We also have to check whether the user
 # has an opinion on all this.  In the "auto" case (no
 # --with-system-openssl option specified in any form), we may need to
 # check a platform-specific location (eg, /usr/local on FreeBSD).
+#
+# At this point all of the C code is in the RP tools package, so we can
+# skip all this if we're just building the CA tools.
 
-old_CFLAGS="$CFLAGS"
-old_LDFLAGS="$LDFLAGS"
+if test $build_rp_tools = no
+then
 
-case $with_system_openssl in
-	yes|auto)
-		if test $CFLAGS_or_LDFLAGS_were_set = no
-		then
-			case $host_os in
-			freebsd*)
-				CFLAGS="-I/usr/local/include $CFLAGS"
-				LDFLAGS="-L/usr/local/lib $LDFLAGS"
-				;;
-			esac
-		fi
-		;;
-	no|/usr)
-		:
-		;;
+	build_openssl=no
 
-	*)
-		CFLAGS="-I$with_system_openssl/include $CFLAGS"
-		LDFLAGS="-L$with_system_openssl/lib $LDFLAGS"
-esac
+else
 
-case $with_system_openssl in
-	no)
-		have_usable_openssl=no
-		;;
-	*)
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for v3_addr_validate_path in -lcrypto" >&5
+	old_CFLAGS="$CFLAGS"
+	old_LDFLAGS="$LDFLAGS"
+
+	case $with_system_openssl in
+		yes|auto)
+			if test $CFLAGS_or_LDFLAGS_were_set = no
+			then
+				case $host_os in
+				freebsd*)
+					CFLAGS="-I/usr/local/include $CFLAGS"
+					LDFLAGS="-L/usr/local/lib $LDFLAGS"
+					;;
+				esac
+			fi
+			;;
+		no|/usr)
+			:
+			;;
+
+		*)
+			CFLAGS="-I$with_system_openssl/include $CFLAGS"
+			LDFLAGS="-L$with_system_openssl/lib $LDFLAGS"
+	esac
+
+	case $with_system_openssl in
+		no)
+			have_usable_openssl=no
+			;;
+		*)
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for v3_addr_validate_path in -lcrypto" >&5
 $as_echo_n "checking for v3_addr_validate_path in -lcrypto... " >&6; }
 if ${ac_cv_lib_crypto_v3_addr_validate_path+:} false; then :
   $as_echo_n "(cached) " >&6
@@ -4336,7 +4383,7 @@ else
 fi
 
 
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CMS_verify in -lcrypto" >&5
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CMS_verify in -lcrypto" >&5
 $as_echo_n "checking for CMS_verify in -lcrypto... " >&6; }
 if ${ac_cv_lib_crypto_CMS_verify+:} false; then :
   $as_echo_n "(cached) " >&6
@@ -4379,65 +4426,80 @@ else
 fi
 
 
-		if test $system_openssl_has_rfc3779 = yes && test $system_openssl_has_cms = yes
-		then
-			have_usable_openssl=yes
-		else
-			have_usable_openssl=no
-		fi
-esac
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether system OpenSSL library is usable" >&5
+$as_echo_n "checking whether system OpenSSL library is usable... " >&6; }
+			if test $system_openssl_has_rfc3779 = yes && test $system_openssl_has_cms = yes
+			then
+				have_usable_openssl=yes
+			else
+				have_usable_openssl=no
+			fi
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_usable_openssl" >&5
+$as_echo "$have_usable_openssl" >&6; }
+	esac
 
-case $with_system_openssl in
-     yes)
-		build_openssl=no
-		if test $have_usable_openssl = no
-		then
-			as_fn_error $? "Can't find OpenSSL crypto library with CMS and RFC 3779 support, try --with-system-openssl=/path/to/openssl" "$LINENO" 5
-		fi
-		;;
-     no)
-		build_openssl=yes
-		;;
-     auto)
-		if test $have_usable_openssl = no
-		then
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we need to build a private copy of OpenSSL" >&5
+$as_echo_n "checking whether we need to build a private copy of OpenSSL... " >&6; }
+	case $with_system_openssl in
+	     yes)
+			build_openssl=no
+			if test $have_usable_openssl = no
+			then
+				as_fn_error $? "Can't find OpenSSL crypto library with CMS and RFC 3779 support, try --with-system-openssl=/path/to/openssl" "$LINENO" 5
+			fi
+			;;
+	     no)
 			build_openssl=yes
-		else
+			;;
+	     auto)
+			if test $have_usable_openssl = no
+			then
+				build_openssl=yes
+			else
+				build_openssl=no
+			fi
+			;;
+	     *)
 			build_openssl=no
-		fi
-		;;
-     *)
-		build_openssl=no
-		if test $have_usable_openssl = no
-		then
-			as_fn_error $? "Can't find OpenSSL crypto library with CMS and RFC 3779 support in $with_system_openssl" "$LINENO" 5
-		fi
-esac
+			if test $have_usable_openssl = no
+			then
+				as_fn_error $? "Can't find OpenSSL crypto library with CMS and RFC 3779 support in $with_system_openssl" "$LINENO" 5
+			fi
+	esac
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $build_openssl" >&5
+$as_echo "$build_openssl" >&6; }
 
-if test $build_openssl = yes
-then
-	CFLAGS="$old_CFLAGS"
-	LDFLAGS="$old_LDFLAGS"
-fi
+	build_openssl_asm=undefined
 
-case $enable_openssl_asm in
-     yes|no)
-		build_openssl_asm=$enable_openssl_asm
-		;;
-     auto)
-		case $host in
-			x86_64-*-linux*)
-				build_openssl_asm=no
+	if test $build_openssl = yes
+	then
+		CFLAGS="$old_CFLAGS"
+		LDFLAGS="$old_LDFLAGS"
+
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable assembly code in OpenSSL" >&5
+$as_echo_n "checking whether to enable assembly code in OpenSSL... " >&6; }
+		case $enable_openssl_asm in
+		     yes|no)
+				build_openssl_asm=$enable_openssl_asm
+				;;
+		     auto)
+				case $host in
+					x86_64-*-linux*)
+						build_openssl_asm=no
+						;;
+					*)
+						build_openssl_asm=yes
+						;;
+				esac
 				;;
-			*)
-				build_openssl_asm=yes
+		     *)
+				as_fn_error $? "Unrecognized value for --enable-openssl-asm: $enable_openssl_asm" "$LINENO" 5
 				;;
 		esac
-		;;
-     *)
-		as_fn_error $? "Unrecognized value for --enable-openssl-asm: $enable_openssl_asm" "$LINENO" 5
-		;;
-esac
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_openssl_asm" >&5
+$as_echo "$enable_openssl_asm" >&6; }
+	fi
+fi
 
 # RCYNIC_DIR is a "precious" argument variable to this script (see
 # autoconf doc), which means that autoconf is careful with whatever
@@ -4541,6 +4603,14 @@ esac
 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $use_rcynic_jail" >&5
 $as_echo "$use_rcynic_jail" >&6; }
 
+# Perhaps there should be a way to set these, but for now just
+# wire them in here so at least they're consistent in all Makefiles.
+
+RCYNIC_USER=rcynic
+
+RCYNIC_GROUP=rcynic
+
+
 if test $use_rcynic_jail = yes && test "X$LD_STATIC_FLAG" != "X"
 then
 	RCYNIC_STATIC_RSYNC='static-rsync/rsync'
@@ -4571,28 +4641,28 @@ $as_echo "$enable_target_installation" >&6; }
 # rcynic jail setup is complicated enough that it's simplest to have
 # different rule sets for different platforms.  Icky, but....
 # rpki-rtr isn't as complicated, but has similar issues, same hack.
-# rpkid isn't as complicated either, but same hack.
+# ca isn't as complicated either, but same hack.
 
 case $host_os in
 	darwin*)
-		RCYNIC_MAKE_RULES='rcynic/rules.darwin.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.darwin.mk'
-		RPKID_MAKE_RULES='rpkid/rules.darwin.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.darwin.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.darwin.mk'
+		CA_MAKE_RULES='ca/rules.darwin.mk'
 		;;
 	freebsd*)
-		RCYNIC_MAKE_RULES='rcynic/rules.freebsd.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.freebsd.mk'
-		RPKID_MAKE_RULES='rpkid/rules.freebsd.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.freebsd.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.freebsd.mk'
+		CA_MAKE_RULES='ca/rules.freebsd.mk'
 		;;
 	linux*)
-		RCYNIC_MAKE_RULES='rcynic/rules.linux.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.linux.mk'
-		RPKID_MAKE_RULES='rpkid/rules.linux.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.linux.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.linux.mk'
+		CA_MAKE_RULES='ca/rules.linux.mk'
 		;;
 	*)
-		RCYNIC_MAKE_RULES='rcynic/rules.unknown.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.unknown.mk'
-		RPKID_MAKE_RULES='rpkid/rules.unknown.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.unknown.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.unknown.mk'
+		CA_MAKE_RULES='ca/rules.unknown.mk'
 		;;
 esac
 
@@ -4603,6 +4673,8 @@ esac
 # Where to put HTML files is similarly platform dependent, we have to know.
 # rcynic-cron will skip generating HTML files if it has no place to put them.
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking where rcynic-html output should go" >&5
+$as_echo_n "checking where rcynic-html output should go... " >&6; }
 case $host_os in
 	freebsd*)
 		RCYNIC_HTML_DIR="/usr/local/www/apache${APACHE_VERSION}/data/rcynic"
@@ -4621,6 +4693,8 @@ case $host_os in
 		RCYNIC_HTML_DIR=''
 		;;
 esac
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $RCYNIC_HTML_DIR" >&5
+$as_echo "$RCYNIC_HTML_DIR" >&6; }
 
 
 
@@ -4629,7 +4703,7 @@ esac
 
 RCYNIC_INSTALL_TARGETS='install-always'
 RTR_ORIGIN_INSTALL_TARGETS='install-always'
-RPKID_INSTALL_TARGETS='install-always'
+CA_INSTALL_TARGETS='install-always'
 
 if test $use_rcynic_jail = yes
 then
@@ -4640,7 +4714,7 @@ if test $enable_target_installation = yes
 then
 	RCYNIC_INSTALL_TARGETS="$RCYNIC_INSTALL_TARGETS install-postconf"
 	RTR_ORIGIN_INSTALL_TARGETS="$RTR_ORIGIN_INSTALL_TARGETS install-postconf"
-	RPKID_INSTALL_TARGETS="$RPKID_INSTALL_TARGETS install-postconf"
+	CA_INSTALL_TARGETS="$CA_INSTALL_TARGETS install-postconf"
 fi
 
 
@@ -4652,36 +4726,24 @@ fi
 # we do have Python, we need to check for required packages and
 # versions.
 
-have_python=no
-have_acceptable_python=no
-have_python_h=no
-have_django=no
-have_acceptable_django=no
-have_lxml=no
-have_mysqldb=no
-have_pyyaml=no
-have_vobject=no
-have_django_south=no
-have_acceptable_django_south=no
-have_argparse=no
-
-if test "x$PYTHON" != "x"
+if test "x$PYTHON" = "x"
 then
-	have_python=yes
+	as_fn_error $? "I can't find a Python binary at all, this isn't going to work.  Perhaps you need to set PATH?" "$LINENO" 5
+fi
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python version 2.6 or higher" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python version 2.6 or higher" >&5
 $as_echo_n "checking for Python version 2.6 or higher... " >&6; }
-	have_acceptable_python=`$PYTHON -c 'import sys; print "yes" if sys.version_info[0] == 2 and sys.version_info[1] >= 6 else "no"'`
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_acceptable_python" >&5
+have_acceptable_python=`$PYTHON -c 'import sys; print "yes" if sys.version_info[0] == 2 and sys.version_info[1] >= 6 else "no"'`
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_acceptable_python" >&5
 $as_echo "$have_acceptable_python" >&6; }
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking distutils to find out where Python.h should be" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking distutils to find out where Python.h should be" >&5
 $as_echo_n "checking distutils to find out where Python.h should be... " >&6; }
-	python_h=`$PYTHON -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_inc() + "/Python.h"'`
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $python_h" >&5
+python_h=`$PYTHON -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_inc() + "/Python.h"'`
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $python_h" >&5
 $as_echo "$python_h" >&6; }
 
-	as_ac_Header=`$as_echo "ac_cv_header_$python_h" | $as_tr_sh`
+as_ac_Header=`$as_echo "ac_cv_header_$python_h" | $as_tr_sh`
 ac_fn_c_check_header_mongrel "$LINENO" "$python_h" "$as_ac_Header" "$ac_includes_default"
 if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
   have_python_h=yes
@@ -4691,194 +4753,166 @@ fi
 
 
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for lxml.etree" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for lxml.etree" >&5
 $as_echo_n "checking for lxml.etree... " >&6; }
-	if $PYTHON -c 'import lxml.etree' 2>/dev/null
-	then
-		have_lxml=yes
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_lxml" >&5
+if $PYTHON -c 'import lxml.etree' 2>/dev/null; then have_lxml=yes; else have_lxml=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_lxml" >&5
 $as_echo "$have_lxml" >&6; }
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for MySQLdb" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for MySQLdb" >&5
 $as_echo_n "checking for MySQLdb... " >&6; }
-	if $PYTHON -c 'import MySQLdb' 2>/dev/null
-	then
-		have_mysqldb=yes
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_mysqldb" >&5
+if $PYTHON -c 'import MySQLdb' 2>/dev/null; then have_mysqldb=yes; else have_mysqldb=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_mysqldb" >&5
 $as_echo "$have_mysqldb" >&6; }
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django" >&5
 $as_echo_n "checking for Django... " >&6; }
-	if $PYTHON -c 'import django' 2>/dev/null
-	then
-		have_django="yes"
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_django" >&5
+if $PYTHON -c 'import django' 2>/dev/null; then have_django=yes; else have_django=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_django" >&5
 $as_echo "$have_django" >&6; }
 
-	if test $have_django = yes
-	then
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django 1.3.7 or higher" >&5
+if test $have_django = yes
+then
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django 1.3.7 or higher" >&5
 $as_echo_n "checking for Django 1.3.7 or higher... " >&6; }
-		have_acceptable_django=`$PYTHON -c "import django; print 'no' if django.VERSION < (1, 3, 7) else 'yes'"`
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_acceptable_django" >&5
+	have_acceptable_django=`$PYTHON -c "import django; print 'no' if django.VERSION < (1, 3, 7) else 'yes'"`
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_acceptable_django" >&5
 $as_echo "$have_acceptable_django" >&6; }
-	fi
+else
+	have_acceptable_django=no
+fi
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for PyYAML" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for PyYAML" >&5
 $as_echo_n "checking for PyYAML... " >&6; }
-	if $PYTHON -c 'import yaml' 2>/dev/null
-	then
-		have_pyyaml=yes
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_pyyaml" >&5
+if $PYTHON -c 'import yaml' 2>/dev/null; then have_pyyaml=yes; else have_pyyaml=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_pyyaml" >&5
 $as_echo "$have_pyyaml" >&6; }
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for vobject" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for vobject" >&5
 $as_echo_n "checking for vobject... " >&6; }
-	if $PYTHON -c 'import vobject' 2>/dev/null
-	then
-		have_vobject=yes
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_vobject" >&5
+if $PYTHON -c 'import vobject' 2>/dev/null; then have_vobject=yes; else have_vobject=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_vobject" >&5
 $as_echo "$have_vobject" >&6; }
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django South" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django South" >&5
 $as_echo_n "checking for Django South... " >&6; }
-	if $PYTHON -c 'import south' 2>/dev/null
-	then
-		have_django_south=yes
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_django_south" >&5
+if $PYTHON -c 'import south' 2>/dev/null; then have_django_south=yes; else have_django_south=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_django_south" >&5
 $as_echo "$have_django_south" >&6; }
 
-	if test $have_django_south = yes
-	then
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django South 0.7.5 or later" >&5
+if test $have_django_south = yes
+then
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for Django South 0.7.5 or later" >&5
 $as_echo_n "checking for Django South 0.7.5 or later... " >&6; }
-		have_acceptable_django_south=`$PYTHON -c "import south; print 'no' if map(int,south.__version__.split('.')) < [0, 7, 5] else 'yes'"`
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_acceptable_django_south" >&5
+	have_acceptable_django_south=`$PYTHON -c "import south; print 'no' if map(int,south.__version__.split('.')) < [0, 7, 5] else 'yes'"`
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_acceptable_django_south" >&5
 $as_echo "$have_acceptable_django_south" >&6; }
-	fi
+else
+	have_acceptable_django_south=no
+fi
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for argparse" >&5
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for argparse" >&5
 $as_echo_n "checking for argparse... " >&6; }
-	if $PYTHON -c 'import argparse' 2>/dev/null
-	then
-		have_argparse=yes
-	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_argparse" >&5
+if $PYTHON -c 'import argparse' 2>/dev/null; then have_argparse=yes; else have_argparse=no; fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $have_argparse" >&5
 $as_echo "$have_argparse" >&6; }
-fi
 
-ok=yes
+# Warnings and dependency errors.  Exit on fatal errors deferred until
+# the very end of this, so we can warn the user about all known
+# problems in a single pass.  Errors that prevent build or basic
+# installation are always fatal; errors that prevent proper operation
+# at runtime or during post-installation setup can be converted to
+# warnings by --disable-runtime-dependencies.
 
-if test $have_python = no
-then
-	ok=no
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: I can't find a Python binary, perhaps you need to set PATH?" >&5
-$as_echo "$as_me: WARNING: I can't find a Python binary, perhaps you need to set PATH?" >&2;}
-fi
+build_ok=yes
+runtime_ok=yes
 
 if test $have_acceptable_python = no
 then
-	ok=no
+	runtime_ok=no
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI code requires Python version 2.x, for x = 6 or higher." >&5
 $as_echo "$as_me: WARNING: The RPKI code requires Python version 2.x, for x = 6 or higher." >&2;}
 fi
 
-case $enable_rp_tools in
-     yes)	build_rp_tools=yes
-     		;;
-     no)	build_rp_tools=no
-     		;;
-     *)		as_fn_error $? "Unrecognized value for --enable-rp-tools: $enable_rp_tools" "$LINENO" 5
-     		;;
-esac
+if test $build_rp_tools = yes
+then
+	if test $have_python_h = no
+	then
+		build_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: I can't find Python.h.  Python sources are required to build the RP tools." >&5
+$as_echo "$as_me: WARNING: I can't find Python.h.  Python sources are required to build the RP tools." >&2;}
+	fi
+	if test "x$RRDTOOL" = "x"
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: rcynic-html requires rrdtool." >&5
+$as_echo "$as_me: WARNING: rcynic-html requires rrdtool." >&2;}
+	fi
+	if test $use_rcynic_jail = no && test "X$RSYNC" = "X"
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI relying party tools require rsync." >&5
+$as_echo "$as_me: WARNING: The RPKI relying party tools require rsync." >&2;}
+	fi
+fi
 
-case $enable_ca_tools in
-     yes)	build_ca_tools=yes
-		if test $have_python_h = no
-		then
-			ok=no
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: I can't find Python.h.  Python sources are required to build the CA tools." >&5
-$as_echo "$as_me: WARNING: I can't find Python.h.  Python sources are required to build the CA tools." >&2;}
-		fi
-		if test $have_lxml = no
-		then
-			ok=no
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI tools require the Python LXML module." >&5
+if test $build_ca_tools = yes
+then
+	if test $have_lxml = no
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI tools require the Python LXML module." >&5
 $as_echo "$as_me: WARNING: The RPKI tools require the Python LXML module." >&2;}
-		fi
-		if test $have_acceptable_django = no
-		then
-			ok=no
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA tools require Django 1.3.7 or higher." >&5
+	fi
+	if test $have_acceptable_django = no
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA tools require Django 1.3.7 or higher." >&5
 $as_echo "$as_me: WARNING: The RPKI CA tools require Django 1.3.7 or higher." >&2;}
-		fi
-		if test $have_vobject = no
-		then
-			ok=no
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA GUI requires the Python vobject module." >&5
+	fi
+	if test $have_vobject = no
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA GUI requires the Python vobject module." >&5
 $as_echo "$as_me: WARNING: The RPKI CA GUI requires the Python vobject module." >&2;}
-		fi
-		if test $have_acceptable_django_south = no
-		then
-			ok=no
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA tools require Django South 0.7.5 or higher." >&5
+	fi
+	if test $have_acceptable_django_south = no
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA tools require Django South 0.7.5 or higher." >&5
 $as_echo "$as_me: WARNING: The RPKI CA tools require Django South 0.7.5 or higher." >&2;}
-		fi
-		if test $have_argparse = no
-		then
-			ok=no
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA tools require the Python argparse module." >&5
+	fi
+	if test $have_argparse = no
+	then
+		runtime_ok=no
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI CA tools require the Python argparse module." >&5
 $as_echo "$as_me: WARNING: The RPKI CA tools require the Python argparse module." >&2;}
-		fi
-		#
-		# This should be the last test in this group, so that failures get the --disable-ca-tools warning.
-		#
-		if test $ok = no
-		then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script." >&5
-$as_echo "$as_me: WARNING: If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script." >&2;}
-		fi
-		;;
-     no)	build_ca_tools=no
-		;;
-     *)		as_fn_error $? "Unrecognized value for --enable-ca-tools: $enable_ca_tools" "$LINENO" 5;;
-esac
-
-if test $build_ca_tools = yes && test $have_pyyaml = no
-then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: PyYAML missing, so \"make test\" will not work properly." >&5
+	fi
+	if test $have_pyyaml = no
+	then
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: PyYAML missing, so \"make test\" will not work properly." >&5
 $as_echo "$as_me: WARNING: PyYAML missing, so \"make test\" will not work properly." >&2;}
-fi
-
-if test "x$XSLTPROC" = "x"
-then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: xsltproc missing, so \"make test\" will not work properly." >&5
+	fi
+	if test "x$XSLTPROC" = "x"
+	then
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: xsltproc missing, so \"make test\" will not work properly." >&5
 $as_echo "$as_me: WARNING: xsltproc missing, so \"make test\" will not work properly." >&2;}
+	fi
 fi
 
-if test "x$RRDTOOL" = "x"
-then
-	ok=no
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: rcynic-html requires rrdtool." >&5
-$as_echo "$as_me: WARNING: rcynic-html requires rrdtool." >&2;}
-fi
-
-if test $use_rcynic_jail = no && test "X$RSYNC" = "X"
-then
-	ok=no
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: The RPKI relying party tools require rsync." >&5
-$as_echo "$as_me: WARNING: The RPKI relying party tools require rsync." >&2;}
-fi
-
-if test $ok = no
+if test $build_ok = no || test $runtime_ok = no
 then
-	if test $enable_runtime_dependencies = yes
+	if test $build_rp_tools = yes
+	then
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: If you do not wish to install the RPKI RP tools, please specify --disable-rp-tools as an argument to this configure script." >&5
+$as_echo "$as_me: WARNING: If you do not wish to install the RPKI RP tools, please specify --disable-rp-tools as an argument to this configure script." >&2;}
+	fi
+	if test $build_ca_tools = yes
+	then
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script." >&5
+$as_echo "$as_me: WARNING: If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script." >&2;}
+	fi
+	if test $build_ok = no || test $enable_runtime_dependencies = yes
 	then
 		as_fn_error $? "Please correct the problems above then re-run this configuration script." "$LINENO" 5
 	else
@@ -4988,23 +5022,18 @@ else
 $as_echo "$WSGI_PYTHON_EGG_CACHE_DIR" >&6; }
 fi
 
-# Figure out which parts of this package we have to build.
+# Tell the Makefiles and setup.py which parts of this package we've decided to build.
 
-			      TOP_LEVEL_SUBDIRS="h"
-test $build_openssl  = yes && TOP_LEVEL_SUBDIRS="$TOP_LEVEL_SUBDIRS openssl"
-test $build_rp_tools = yes && TOP_LEVEL_SUBDIRS="$TOP_LEVEL_SUBDIRS rcynic utils rtr-origin"
-test $build_ca_tools = yes && TOP_LEVEL_SUBDIRS="$TOP_LEVEL_SUBDIRS rpkid"
+if test $build_openssl  = yes; then OPENSSL_TARGET=openssl; else OPENSSL_TARGET=noop; fi
+if test $build_rp_tools = yes; then      RP_TARGET=rp;	    else      RP_TARGET=noop; fi
+if test $build_ca_tools = yes; then      CA_TARGET=ca;	    else      CA_TARGET=noop; fi
 
 
 
-ac_config_files="$ac_config_files Makefile h/Makefile"
 
 
-if test "X$RCYNIC_STATIC_RSYNC" != "X"
-then
-	ac_config_files="$ac_config_files rcynic/static-rsync/Makefile"
+ac_config_files="$ac_config_files Makefile"
 
-fi
 
 # OpenSSL has its own build system that bears no relationship to
 # anything but itself, and our use of it is a bit weird, so this is a
@@ -5062,36 +5091,41 @@ fi
 
 if test $build_rp_tools = yes
 then
-	ac_config_files="$ac_config_files rcynic/Makefile utils/Makefile utils/find_roa/Makefile utils/hashdir/Makefile utils/print_rpki_manifest/Makefile utils/print_roa/Makefile utils/scan_roas/Makefile utils/scan_routercerts/Makefile utils/uri/Makefile rtr-origin/Makefile"
+	ac_config_files="$ac_config_files rp/Makefile rp/rcynic/Makefile rp/rcynic/static-rsync/Makefile rp/utils/Makefile rp/rpki-rtr/Makefile"
 
 fi
 
 if test $build_ca_tools = yes
 then
-	ac_config_files="$ac_config_files rpkid/Makefile rpkid/tests/Makefile"
-
-fi
+	ac_config_files="$ac_config_files ca/Makefile ca/tests/Makefile"
 
-if test $build_ca_tools = yes &&
-   test "X$enable_wsgi_daemon_mode" = "Xyes"
-then
-	as_fn_error $? "You must specify the user to run the wsgi process as with --enable-wsgi-daemon-mode=USER" "$LINENO" 5
 fi
 
-if test $build_ca_tools = yes &&
-   test "X$enable_wsgi_daemon_mode" != "Xno"
+if test $build_ca_tools = yes
 then
-	save_IFS="$IFS"
-	IFS=':' read user group <<_EOF
+	case $enable_wsgi_daemon_mode in
+	no)
+		;;
+	yes)
+		as_fn_error $? "You must specify the user to run the wsgi process as with --enable-wsgi-daemon-mode=USER" "$LINENO" 5
+		;;
+	*)
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run mod_wsgi daemon mode" >&5
+$as_echo_n "checking how to run mod_wsgi daemon mode... " >&6; }
+		save_IFS="$IFS"
+		IFS=':'
+		read user group <<_EOF
 $enable_wsgi_daemon_mode
 _EOF
-	IFS="$save_IFS"
-	WSGI_DAEMON_PROCESS="WSGIDaemonProcess rpkigui user=$user ${group:+group=}${group} display-name=%{GROUP}"
+		IFS="$save_IFS"
+		WSGI_DAEMON_PROCESS="WSGIDaemonProcess rpkigui user=$user ${group:+group=}${group} display-name=%{GROUP}"
 
-	WSGI_PROCESS_GROUP="WSGIProcessGroup rpkigui"
+		WSGI_PROCESS_GROUP="WSGIProcessGroup rpkigui"
 
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: running mod_wsgi in daemon mode with user \"$user\" and group \"${group:-default}\"" >&5
-$as_echo "running mod_wsgi in daemon mode with user \"$user\" and group \"${group:-default}\"" >&6; }
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: with user \"$user\" and group \"${group:-default}\"" >&5
+$as_echo "with user \"$user\" and group \"${group:-default}\"" >&6; }
+		;;
+	esac
 fi
 
 # Now that we're finally done with all the conditional changes to
@@ -5808,22 +5842,15 @@ for ac_config_target in $ac_config_targets
 do
   case $ac_config_target in
     "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
-    "h/Makefile") CONFIG_FILES="$CONFIG_FILES h/Makefile" ;;
-    "rcynic/static-rsync/Makefile") CONFIG_FILES="$CONFIG_FILES rcynic/static-rsync/Makefile" ;;
     "openssl/Makefile") CONFIG_FILES="$CONFIG_FILES openssl/Makefile" ;;
     "openssl/tests/Makefile") CONFIG_FILES="$CONFIG_FILES openssl/tests/Makefile" ;;
-    "rcynic/Makefile") CONFIG_FILES="$CONFIG_FILES rcynic/Makefile" ;;
-    "utils/Makefile") CONFIG_FILES="$CONFIG_FILES utils/Makefile" ;;
-    "utils/find_roa/Makefile") CONFIG_FILES="$CONFIG_FILES utils/find_roa/Makefile" ;;
-    "utils/hashdir/Makefile") CONFIG_FILES="$CONFIG_FILES utils/hashdir/Makefile" ;;
-    "utils/print_rpki_manifest/Makefile") CONFIG_FILES="$CONFIG_FILES utils/print_rpki_manifest/Makefile" ;;
-    "utils/print_roa/Makefile") CONFIG_FILES="$CONFIG_FILES utils/print_roa/Makefile" ;;
-    "utils/scan_roas/Makefile") CONFIG_FILES="$CONFIG_FILES utils/scan_roas/Makefile" ;;
-    "utils/scan_routercerts/Makefile") CONFIG_FILES="$CONFIG_FILES utils/scan_routercerts/Makefile" ;;
-    "utils/uri/Makefile") CONFIG_FILES="$CONFIG_FILES utils/uri/Makefile" ;;
-    "rtr-origin/Makefile") CONFIG_FILES="$CONFIG_FILES rtr-origin/Makefile" ;;
-    "rpkid/Makefile") CONFIG_FILES="$CONFIG_FILES rpkid/Makefile" ;;
-    "rpkid/tests/Makefile") CONFIG_FILES="$CONFIG_FILES rpkid/tests/Makefile" ;;
+    "rp/Makefile") CONFIG_FILES="$CONFIG_FILES rp/Makefile" ;;
+    "rp/rcynic/Makefile") CONFIG_FILES="$CONFIG_FILES rp/rcynic/Makefile" ;;
+    "rp/rcynic/static-rsync/Makefile") CONFIG_FILES="$CONFIG_FILES rp/rcynic/static-rsync/Makefile" ;;
+    "rp/utils/Makefile") CONFIG_FILES="$CONFIG_FILES rp/utils/Makefile" ;;
+    "rp/rpki-rtr/Makefile") CONFIG_FILES="$CONFIG_FILES rp/rpki-rtr/Makefile" ;;
+    "ca/Makefile") CONFIG_FILES="$CONFIG_FILES ca/Makefile" ;;
+    "ca/tests/Makefile") CONFIG_FILES="$CONFIG_FILES ca/tests/Makefile" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
   esac
diff --git a/configure.ac b/configure.ac
index 4f4aa244..a07f78fc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ AC_INIT([rpkitools], [1.0])
 
 dnl AC_REVISION([$Revision$])
 
-AC_CONFIG_SRCDIR([rcynic/rcynic.c])
+AC_CONFIG_SRCDIR([rp/rcynic/rcynic.c])
 AC_CONFIG_AUX_DIR([buildtools])
 
 # I'm not sure we should really be using the $host_* variables as we
@@ -153,109 +153,157 @@ case $enable_runtime_dependencies in
 		;;
 esac
 
+# Figure out whether we want RP tools, CA tools, or both
+
+AC_MSG_CHECKING([whether user wants the RP tools])
+case $enable_rp_tools in
+     yes|no)
+		build_rp_tools=$enable_rp_tools
+		;;
+     *)
+		AC_MSG_ERROR([Unrecognized value for --enable-rp-tools: $enable_rp_tools])
+		;;
+esac
+AC_MSG_RESULT([$build_rp_tools])
+
+AC_MSG_CHECKING([whether user wants the CA tools])
+case $enable_ca_tools in
+     yes|no)
+		build_ca_tools=$enable_ca_tools
+		;;
+     *)
+		AC_MSG_ERROR([Unrecognized value for --enable-ca-tools: $enable_ca_tools])
+		;;
+esac
+AC_MSG_RESULT([$build_ca_tools])
+
+if test $build_rp_tools = no && test $build_ca_tools = no
+then
+	AC_MSG_ERROR([Building with neither RP tools nor CA tools makes no sense])
+fi
+
 # Figure out whether we need to build our own OpenSSL library or can
 # use the system libraries.  We're looking for two recent features:
 # CMS and RFC 3779 support.  We also have to check whether the user
 # has an opinion on all this.  In the "auto" case (no
 # --with-system-openssl option specified in any form), we may need to
 # check a platform-specific location (eg, /usr/local on FreeBSD).
+#
+# At this point all of the C code is in the RP tools package, so we can
+# skip all this if we're just building the CA tools.
 
-old_CFLAGS="$CFLAGS"
-old_LDFLAGS="$LDFLAGS"
+if test $build_rp_tools = no
+then
 
-case $with_system_openssl in
-	yes|auto)
-		if test $CFLAGS_or_LDFLAGS_were_set = no
-		then
-			case $host_os in
-			freebsd*)
-				CFLAGS="-I/usr/local/include $CFLAGS"
-				LDFLAGS="-L/usr/local/lib $LDFLAGS"
-				;;
-			esac
-		fi
-		;;
-	no|/usr)
-		:
-		;;
+	build_openssl=no
 
-	*)
-		CFLAGS="-I$with_system_openssl/include $CFLAGS"
-		LDFLAGS="-L$with_system_openssl/lib $LDFLAGS"
-esac
+else
 
-case $with_system_openssl in
-	no)
-		have_usable_openssl=no
-		;;
-	*)
-		AC_CHECK_LIB([crypto], [v3_addr_validate_path],
-				       [system_openssl_has_rfc3779=yes],
-				       [system_openssl_has_rfc3779=no])
+	old_CFLAGS="$CFLAGS"
+	old_LDFLAGS="$LDFLAGS"
+
+	case $with_system_openssl in
+		yes|auto)
+			if test $CFLAGS_or_LDFLAGS_were_set = no
+			then
+				case $host_os in
+				freebsd*)
+					CFLAGS="-I/usr/local/include $CFLAGS"
+					LDFLAGS="-L/usr/local/lib $LDFLAGS"
+					;;
+				esac
+			fi
+			;;
+		no|/usr)
+			:
+			;;
 
-		AC_CHECK_LIB([crypto], [CMS_verify],
-				       [system_openssl_has_cms=yes],
-				       [system_openssl_has_cms=no])
+		*)
+			CFLAGS="-I$with_system_openssl/include $CFLAGS"
+			LDFLAGS="-L$with_system_openssl/lib $LDFLAGS"
+	esac
 
-		if test $system_openssl_has_rfc3779 = yes && test $system_openssl_has_cms = yes
-		then
-			have_usable_openssl=yes
-		else
+	case $with_system_openssl in
+		no)
 			have_usable_openssl=no
-		fi
-esac
+			;;
+		*)
+			AC_CHECK_LIB([crypto], [v3_addr_validate_path],
+					       [system_openssl_has_rfc3779=yes],
+					       [system_openssl_has_rfc3779=no])
+
+			AC_CHECK_LIB([crypto], [CMS_verify],
+					       [system_openssl_has_cms=yes],
+					       [system_openssl_has_cms=no])
+
+			AC_MSG_CHECKING([whether system OpenSSL library is usable])
+			if test $system_openssl_has_rfc3779 = yes && test $system_openssl_has_cms = yes
+			then
+				have_usable_openssl=yes
+			else
+				have_usable_openssl=no
+			fi
+			AC_MSG_RESULT([$have_usable_openssl])
+	esac
 
-case $with_system_openssl in
-     yes)
-		build_openssl=no
-		if test $have_usable_openssl = no
-		then
-			AC_MSG_ERROR([Can't find OpenSSL crypto library with CMS and RFC 3779 support, try --with-system-openssl=/path/to/openssl])
-		fi
-		;;
-     no)
-		build_openssl=yes
-		;;
-     auto)
-		if test $have_usable_openssl = no
-		then
+	AC_MSG_CHECKING([whether we need to build a private copy of OpenSSL])
+	case $with_system_openssl in
+	     yes)
+			build_openssl=no
+			if test $have_usable_openssl = no
+			then
+				AC_MSG_ERROR([Can't find OpenSSL crypto library with CMS and RFC 3779 support, try --with-system-openssl=/path/to/openssl])
+			fi
+			;;
+	     no)
 			build_openssl=yes
-		else
+			;;
+	     auto)
+			if test $have_usable_openssl = no
+			then
+				build_openssl=yes
+			else
+				build_openssl=no
+			fi
+			;;
+	     *)
 			build_openssl=no
-		fi
-		;;
-     *)
-		build_openssl=no
-		if test $have_usable_openssl = no
-		then
-			AC_MSG_ERROR([Can't find OpenSSL crypto library with CMS and RFC 3779 support in $with_system_openssl])
-		fi
-esac
+			if test $have_usable_openssl = no
+			then
+				AC_MSG_ERROR([Can't find OpenSSL crypto library with CMS and RFC 3779 support in $with_system_openssl])
+			fi
+	esac
+	AC_MSG_RESULT([$build_openssl])
 
-if test $build_openssl = yes
-then
-	CFLAGS="$old_CFLAGS"
-	LDFLAGS="$old_LDFLAGS"
-fi
+	build_openssl_asm=undefined
 
-case $enable_openssl_asm in
-     yes|no)
-		build_openssl_asm=$enable_openssl_asm
-		;;
-     auto)
-		case $host in
-			x86_64-*-linux*)
-				build_openssl_asm=no
+	if test $build_openssl = yes
+	then
+		CFLAGS="$old_CFLAGS"
+		LDFLAGS="$old_LDFLAGS"
+
+		AC_MSG_CHECKING([whether to enable assembly code in OpenSSL])
+		case $enable_openssl_asm in
+		     yes|no)
+				build_openssl_asm=$enable_openssl_asm
 				;;
-			*)
-				build_openssl_asm=yes
+		     auto)
+				case $host in
+					x86_64-*-linux*)
+						build_openssl_asm=no
+						;;
+					*)
+						build_openssl_asm=yes
+						;;
+				esac
 				;;
-		esac
-		;;
-     *)
-		AC_MSG_ERROR([Unrecognized value for --enable-openssl-asm: $enable_openssl_asm])
-		;;
-esac     
+		     *)
+				AC_MSG_ERROR([Unrecognized value for --enable-openssl-asm: $enable_openssl_asm])
+				;;
+		esac     
+		AC_MSG_RESULT([$enable_openssl_asm])
+	fi
+fi
 
 # RCYNIC_DIR is a "precious" argument variable to this script (see
 # autoconf doc), which means that autoconf is careful with whatever
@@ -355,6 +403,12 @@ AC_SUBST(RCYNIC_CRON_USER)
 
 AC_MSG_RESULT([$use_rcynic_jail])
 
+# Perhaps there should be a way to set these, but for now just
+# wire them in here so at least they're consistent in all Makefiles.
+
+AC_SUBST(RCYNIC_USER,  [rcynic])
+AC_SUBST(RCYNIC_GROUP, [rcynic])
+
 if test $use_rcynic_jail = yes && test "X$LD_STATIC_FLAG" != "X"
 then
 	RCYNIC_STATIC_RSYNC='static-rsync/rsync'
@@ -383,38 +437,39 @@ AC_MSG_RESULT([$enable_target_installation])
 # rcynic jail setup is complicated enough that it's simplest to have
 # different rule sets for different platforms.  Icky, but....
 # rpki-rtr isn't as complicated, but has similar issues, same hack.
-# rpkid isn't as complicated either, but same hack.
+# ca isn't as complicated either, but same hack.
 
 case $host_os in
 	darwin*)
-		RCYNIC_MAKE_RULES='rcynic/rules.darwin.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.darwin.mk'
-		RPKID_MAKE_RULES='rpkid/rules.darwin.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.darwin.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.darwin.mk'
+		CA_MAKE_RULES='ca/rules.darwin.mk'
 		;;
 	freebsd*)
-		RCYNIC_MAKE_RULES='rcynic/rules.freebsd.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.freebsd.mk'
-		RPKID_MAKE_RULES='rpkid/rules.freebsd.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.freebsd.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.freebsd.mk'
+		CA_MAKE_RULES='ca/rules.freebsd.mk'
 		;;
 	linux*)
-		RCYNIC_MAKE_RULES='rcynic/rules.linux.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.linux.mk'
-		RPKID_MAKE_RULES='rpkid/rules.linux.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.linux.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.linux.mk'
+		CA_MAKE_RULES='ca/rules.linux.mk'
 		;;
 	*)
-		RCYNIC_MAKE_RULES='rcynic/rules.unknown.mk'
-		RTR_ORIGIN_MAKE_RULES='rtr-origin/rules.unknown.mk'
-		RPKID_MAKE_RULES='rpkid/rules.unknown.mk'
+		RCYNIC_MAKE_RULES='rp/rcynic/rules.unknown.mk'
+		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.unknown.mk'
+		CA_MAKE_RULES='ca/rules.unknown.mk'
 		;;
 esac
 
 AC_SUBST_FILE(RCYNIC_MAKE_RULES)
 AC_SUBST_FILE(RTR_ORIGIN_MAKE_RULES)
-AC_SUBST_FILE(RPKID_MAKE_RULES)
+AC_SUBST_FILE(CA_MAKE_RULES)
 
 # Where to put HTML files is similarly platform dependent, we have to know.
 # rcynic-cron will skip generating HTML files if it has no place to put them.
 
+AC_MSG_CHECKING([where rcynic-html output should go])
 case $host_os in
 	freebsd*)
 		RCYNIC_HTML_DIR="/usr/local/www/apache${APACHE_VERSION}/data/rcynic"
@@ -433,6 +488,7 @@ case $host_os in
 		RCYNIC_HTML_DIR=''
 		;;
 esac
+AC_MSG_RESULT([$RCYNIC_HTML_DIR])
 
 AC_SUBST(RCYNIC_HTML_DIR)
 
@@ -441,7 +497,7 @@ AC_SUBST(RCYNIC_HTML_DIR)
 
 RCYNIC_INSTALL_TARGETS='install-always'
 RTR_ORIGIN_INSTALL_TARGETS='install-always'
-RPKID_INSTALL_TARGETS='install-always'
+CA_INSTALL_TARGETS='install-always'
 
 if test $use_rcynic_jail = yes
 then
@@ -452,202 +508,162 @@ if test $enable_target_installation = yes
 then
 	RCYNIC_INSTALL_TARGETS="$RCYNIC_INSTALL_TARGETS install-postconf"
 	RTR_ORIGIN_INSTALL_TARGETS="$RTR_ORIGIN_INSTALL_TARGETS install-postconf"
-	RPKID_INSTALL_TARGETS="$RPKID_INSTALL_TARGETS install-postconf"
+	CA_INSTALL_TARGETS="$CA_INSTALL_TARGETS install-postconf"
 fi
 
 AC_SUBST(RCYNIC_INSTALL_TARGETS)
 AC_SUBST(RTR_ORIGIN_INSTALL_TARGETS)
-AC_SUBST(RPKID_INSTALL_TARGETS)
+AC_SUBST(CA_INSTALL_TARGETS)
 
 # Now a bunch of checks to figure out what we can do with Python.  If
 # we don't have Python at all, none of the rest of this matters.  If
 # we do have Python, we need to check for required packages and
 # versions.
 
-have_python=no
-have_acceptable_python=no
-have_python_h=no
-have_django=no
-have_acceptable_django=no
-have_lxml=no
-have_mysqldb=no
-have_pyyaml=no
-have_vobject=no
-have_django_south=no
-have_acceptable_django_south=no
-have_argparse=no
-
-if test "x$PYTHON" != "x"
+if test "x$PYTHON" = "x"
 then
-	have_python=yes
-
-	AC_MSG_CHECKING([for Python version 2.6 or higher])
-	have_acceptable_python=`$PYTHON -c 'import sys; print "yes" if sys.version_info[[0]] == 2 and sys.version_info[[1]] >= 6 else "no"'`
-	AC_MSG_RESULT([$have_acceptable_python])
+	AC_MSG_ERROR([I can't find a Python binary at all, this isn't going to work.  Perhaps you need to set PATH?])
+fi
 
-	AC_MSG_CHECKING([distutils to find out where Python.h should be])
-	python_h=`$PYTHON -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_inc() + "/Python.h"'`
-	AC_MSG_RESULT([$python_h])
+AC_MSG_CHECKING([for Python version 2.6 or higher])
+have_acceptable_python=`$PYTHON -c 'import sys; print "yes" if sys.version_info[[0]] == 2 and sys.version_info[[1]] >= 6 else "no"'`
+AC_MSG_RESULT([$have_acceptable_python])
 
-	AC_CHECK_HEADER([$python_h], [have_python_h=yes], [have_python_h=no])
+AC_MSG_CHECKING([distutils to find out where Python.h should be])
+python_h=`$PYTHON -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_inc() + "/Python.h"'`
+AC_MSG_RESULT([$python_h])
 
-	AC_MSG_CHECKING([for lxml.etree])
-	if $PYTHON -c 'import lxml.etree' 2>/dev/null
-	then
-		have_lxml=yes
-	fi
-	AC_MSG_RESULT([$have_lxml])
+AC_CHECK_HEADER([$python_h], [have_python_h=yes], [have_python_h=no])
 
-	AC_MSG_CHECKING([for MySQLdb])
-	if $PYTHON -c 'import MySQLdb' 2>/dev/null
-	then
-		have_mysqldb=yes
-	fi
-	AC_MSG_RESULT([$have_mysqldb])
+AC_MSG_CHECKING([for lxml.etree])
+if $PYTHON -c 'import lxml.etree' 2>/dev/null; then have_lxml=yes; else have_lxml=no; fi
+AC_MSG_RESULT([$have_lxml])
 
-	AC_MSG_CHECKING([for Django])
-	if $PYTHON -c 'import django' 2>/dev/null
-	then
-		have_django="yes"
-	fi
-	AC_MSG_RESULT([$have_django])
+AC_MSG_CHECKING([for MySQLdb])
+if $PYTHON -c 'import MySQLdb' 2>/dev/null; then have_mysqldb=yes; else have_mysqldb=no; fi
+AC_MSG_RESULT([$have_mysqldb])
 
-	if test $have_django = yes
-	then
-		AC_MSG_CHECKING([for Django 1.3.7 or higher])
-		have_acceptable_django=`$PYTHON -c "import django; print 'no' if django.VERSION < (1, 3, 7) else 'yes'"`
-		AC_MSG_RESULT([$have_acceptable_django])
-	fi
+AC_MSG_CHECKING([for Django])
+if $PYTHON -c 'import django' 2>/dev/null; then have_django=yes; else have_django=no; fi
+AC_MSG_RESULT([$have_django])
 
-	AC_MSG_CHECKING([for PyYAML])
-	if $PYTHON -c 'import yaml' 2>/dev/null
-	then
-		have_pyyaml=yes
-	fi
-	AC_MSG_RESULT([$have_pyyaml])
-
-	AC_MSG_CHECKING([for vobject])
-	if $PYTHON -c 'import vobject' 2>/dev/null
-	then
-		have_vobject=yes
-	fi
-	AC_MSG_RESULT([$have_vobject])
-
-	AC_MSG_CHECKING([for Django South])
-	if $PYTHON -c 'import south' 2>/dev/null
-	then
-		have_django_south=yes
-	fi
-	AC_MSG_RESULT([$have_django_south])
+if test $have_django = yes
+then
+	AC_MSG_CHECKING([for Django 1.3.7 or higher])
+	have_acceptable_django=`$PYTHON -c "import django; print 'no' if django.VERSION < (1, 3, 7) else 'yes'"`
+	AC_MSG_RESULT([$have_acceptable_django])
+else
+	have_acceptable_django=no
+fi
 
-	if test $have_django_south = yes
-	then
-		AC_MSG_CHECKING([for Django South 0.7.5 or later])
-		have_acceptable_django_south=`$PYTHON -c "import south; print 'no' if map(int,south.__version__.split('.')) < [[0, 7, 5]] else 'yes'"`
-		AC_MSG_RESULT([$have_acceptable_django_south])
-	fi
+AC_MSG_CHECKING([for PyYAML])
+if $PYTHON -c 'import yaml' 2>/dev/null; then have_pyyaml=yes; else have_pyyaml=no; fi
+AC_MSG_RESULT([$have_pyyaml])
 
-	AC_MSG_CHECKING([for argparse])
-	if $PYTHON -c 'import argparse' 2>/dev/null
-	then
-		have_argparse=yes
-	fi
-	AC_MSG_RESULT([$have_argparse])
-fi
+AC_MSG_CHECKING([for vobject])
+if $PYTHON -c 'import vobject' 2>/dev/null; then have_vobject=yes; else have_vobject=no; fi
+AC_MSG_RESULT([$have_vobject])
 
-ok=yes
+AC_MSG_CHECKING([for Django South])
+if $PYTHON -c 'import south' 2>/dev/null; then have_django_south=yes; else have_django_south=no; fi
+AC_MSG_RESULT([$have_django_south])
 
-if test $have_python = no
+if test $have_django_south = yes
 then
-	ok=no
-	AC_MSG_WARN([I can't find a Python binary, perhaps you need to set PATH?])
+	AC_MSG_CHECKING([for Django South 0.7.5 or later])
+	have_acceptable_django_south=`$PYTHON -c "import south; print 'no' if map(int,south.__version__.split('.')) < [[0, 7, 5]] else 'yes'"`
+	AC_MSG_RESULT([$have_acceptable_django_south])
+else
+	have_acceptable_django_south=no
 fi
 
-if test $have_acceptable_python = no
-then
-	ok=no
-	AC_MSG_WARN([The RPKI code requires Python version 2.x, for x = 6 or higher.])
-fi
+AC_MSG_CHECKING([for argparse])
+if $PYTHON -c 'import argparse' 2>/dev/null; then have_argparse=yes; else have_argparse=no; fi
+AC_MSG_RESULT([$have_argparse])
 
-case $enable_rp_tools in
-     yes)	build_rp_tools=yes
-     		;;
-     no)	build_rp_tools=no
-     		;;
-     *)		AC_MSG_ERROR([Unrecognized value for --enable-rp-tools: $enable_rp_tools])
-     		;;
-esac
+# Warnings and dependency errors.  Exit on fatal errors deferred until
+# the very end of this, so we can warn the user about all known
+# problems in a single pass.  Errors that prevent build or basic
+# installation are always fatal; errors that prevent proper operation
+# at runtime or during post-installation setup can be converted to
+# warnings by --disable-runtime-dependencies.
 
-case $enable_ca_tools in
-     yes)	build_ca_tools=yes
-		if test $have_python_h = no
-		then
-			ok=no
-			AC_MSG_WARN([I can't find Python.h.  Python sources are required to build the CA tools.])
-		fi
-		if test $have_lxml = no
-		then
-			ok=no
-			AC_MSG_WARN([The RPKI tools require the Python LXML module.])
-		fi
-		if test $have_acceptable_django = no
-		then
-			ok=no
-			AC_MSG_WARN([The RPKI CA tools require Django 1.3.7 or higher.])
-		fi
-		if test $have_vobject = no
-		then
-			ok=no
-			AC_MSG_WARN([The RPKI CA GUI requires the Python vobject module.])
-		fi
-		if test $have_acceptable_django_south = no
-		then
-			ok=no
-			AC_MSG_WARN([The RPKI CA tools require Django South 0.7.5 or higher.])
-		fi
-		if test $have_argparse = no
-		then
-			ok=no
-			AC_MSG_WARN([The RPKI CA tools require the Python argparse module.])
-		fi
-		#
-		# This should be the last test in this group, so that failures get the --disable-ca-tools warning.
-		#
-		if test $ok = no
-		then
-			AC_MSG_WARN([If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script.])
-		fi
-		;;
-     no)	build_ca_tools=no
-		;;
-     *)		AC_MSG_ERROR([Unrecognized value for --enable-ca-tools: $enable_ca_tools]);;
-esac
-
-if test $build_ca_tools = yes && test $have_pyyaml = no
-then
-	AC_MSG_WARN([PyYAML missing, so "make test" will not work properly.])
-fi
+build_ok=yes
+runtime_ok=yes
 
-if test "x$XSLTPROC" = "x"
+if test $have_acceptable_python = no
 then
-	AC_MSG_WARN([xsltproc missing, so "make test" will not work properly.])
+	runtime_ok=no
+	AC_MSG_WARN([The RPKI code requires Python version 2.x, for x = 6 or higher.])
 fi
 
-if test "x$RRDTOOL" = "x"
+if test $build_rp_tools = yes
 then
-	ok=no
-	AC_MSG_WARN([rcynic-html requires rrdtool.])
+	if test $have_python_h = no
+	then
+		build_ok=no
+		AC_MSG_WARN([I can't find Python.h.  Python sources are required to build the RP tools.])
+	fi
+	if test "x$RRDTOOL" = "x"
+	then
+		runtime_ok=no
+		AC_MSG_WARN([rcynic-html requires rrdtool.])
+	fi
+	if test $use_rcynic_jail = no && test "X$RSYNC" = "X"
+	then
+		runtime_ok=no
+		AC_MSG_WARN([The RPKI relying party tools require rsync.])
+	fi
 fi
 
-if test $use_rcynic_jail = no && test "X$RSYNC" = "X"
+if test $build_ca_tools = yes
 then
-	ok=no
-	AC_MSG_WARN([The RPKI relying party tools require rsync.])
+	if test $have_lxml = no
+	then
+		runtime_ok=no
+		AC_MSG_WARN([The RPKI tools require the Python LXML module.])
+	fi
+	if test $have_acceptable_django = no
+	then
+		runtime_ok=no
+		AC_MSG_WARN([The RPKI CA tools require Django 1.3.7 or higher.])
+	fi
+	if test $have_vobject = no
+	then
+		runtime_ok=no
+		AC_MSG_WARN([The RPKI CA GUI requires the Python vobject module.])
+	fi
+	if test $have_acceptable_django_south = no
+	then
+		runtime_ok=no
+		AC_MSG_WARN([The RPKI CA tools require Django South 0.7.5 or higher.])
+	fi
+	if test $have_argparse = no
+	then
+		runtime_ok=no
+		AC_MSG_WARN([The RPKI CA tools require the Python argparse module.])
+	fi
+	if test $have_pyyaml = no
+	then
+		AC_MSG_WARN([PyYAML missing, so "make test" will not work properly.])
+	fi
+	if test "x$XSLTPROC" = "x"
+	then
+		AC_MSG_WARN([xsltproc missing, so "make test" will not work properly.])
+	fi
 fi
 
-if test $ok = no
+if test $build_ok = no || test $runtime_ok = no
 then
-	if test $enable_runtime_dependencies = yes
+	if test $build_rp_tools = yes
+	then
+		AC_MSG_WARN([If you do not wish to install the RPKI RP tools, please specify --disable-rp-tools as an argument to this configure script.])
+	fi
+	if test $build_ca_tools = yes
+	then
+		AC_MSG_WARN([If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script.])
+	fi
+	if test $build_ok = no || test $enable_runtime_dependencies = yes
 	then
 		AC_MSG_ERROR([Please correct the problems above then re-run this configuration script.])
 	else
@@ -750,22 +766,17 @@ else
 	AC_MSG_RESULT([$WSGI_PYTHON_EGG_CACHE_DIR])
 fi
 
-# Figure out which parts of this package we have to build.
+# Tell the Makefiles and setup.py which parts of this package we've decided to build.
 
-			      TOP_LEVEL_SUBDIRS="h"
-test $build_openssl  = yes && TOP_LEVEL_SUBDIRS="$TOP_LEVEL_SUBDIRS openssl"
-test $build_rp_tools = yes && TOP_LEVEL_SUBDIRS="$TOP_LEVEL_SUBDIRS rcynic utils rtr-origin"
-test $build_ca_tools = yes && TOP_LEVEL_SUBDIRS="$TOP_LEVEL_SUBDIRS rpkid"
+if test $build_openssl  = yes; then OPENSSL_TARGET=openssl; else OPENSSL_TARGET=noop; fi
+if test $build_rp_tools = yes; then      RP_TARGET=rp;	    else      RP_TARGET=noop; fi
+if test $build_ca_tools = yes; then      CA_TARGET=ca;	    else      CA_TARGET=noop; fi
 
-AC_SUBST(TOP_LEVEL_SUBDIRS)
+AC_SUBST(OPENSSL_TARGET)
+AC_SUBST(RP_TARGET)
+AC_SUBST(CA_TARGET)
 
-AC_CONFIG_FILES([Makefile
-		 h/Makefile])
-
-if test "X$RCYNIC_STATIC_RSYNC" != "X"
-then
-	AC_CONFIG_FILES([rcynic/static-rsync/Makefile])
-fi
+AC_CONFIG_FILES([Makefile])
 
 # OpenSSL has its own build system that bears no relationship to
 # anything but itself, and our use of it is a bit weird, so this is a
@@ -773,7 +784,8 @@ fi
 
 if test $build_openssl = yes
 then
-	AC_CONFIG_FILES([openssl/Makefile openssl/tests/Makefile])
+	AC_CONFIG_FILES([openssl/Makefile
+			 openssl/tests/Makefile])
 
 	AC_MSG_CHECKING([what configuration target to use when building OpenSSL])
 	case $host in
@@ -818,41 +830,40 @@ fi
 
 if test $build_rp_tools = yes
 then
-	AC_CONFIG_FILES([rcynic/Makefile
-			 utils/Makefile
-			 utils/find_roa/Makefile
-			 utils/hashdir/Makefile
-			 utils/print_rpki_manifest/Makefile
-			 utils/print_roa/Makefile
-			 utils/scan_roas/Makefile
-			 utils/scan_routercerts/Makefile
-			 utils/uri/Makefile
-			 rtr-origin/Makefile])
+	AC_CONFIG_FILES([rp/Makefile
+			 rp/rcynic/Makefile
+			 rp/rcynic/static-rsync/Makefile
+			 rp/utils/Makefile
+			 rp/rpki-rtr/Makefile])
 fi
 
 if test $build_ca_tools = yes
 then
-	AC_CONFIG_FILES([rpkid/Makefile
-			 rpkid/tests/Makefile])
+	AC_CONFIG_FILES([ca/Makefile
+			 ca/tests/Makefile])
 fi
 
-if test $build_ca_tools = yes &&
-   test "X$enable_wsgi_daemon_mode" = "Xyes"
-then
-	AC_MSG_ERROR([You must specify the user to run the wsgi process as with --enable-wsgi-daemon-mode=USER])
-fi
-
-if test $build_ca_tools = yes &&
-   test "X$enable_wsgi_daemon_mode" != "Xno"
+if test $build_ca_tools = yes
 then
-	save_IFS="$IFS"
-	IFS=':' read user group <<_EOF
+	case $enable_wsgi_daemon_mode in
+	no)
+		;;
+	yes)
+		AC_MSG_ERROR([You must specify the user to run the wsgi process as with --enable-wsgi-daemon-mode=USER])
+		;;
+	*)
+		AC_MSG_CHECKING([how to run mod_wsgi daemon mode])
+		save_IFS="$IFS"
+		IFS=':'
+		read user group <<_EOF
 $enable_wsgi_daemon_mode
 _EOF
-	IFS="$save_IFS"
-	AC_SUBST(WSGI_DAEMON_PROCESS, "WSGIDaemonProcess rpkigui user=$user ${group:+group=}${group} display-name=%{GROUP}")
-	AC_SUBST(WSGI_PROCESS_GROUP, "WSGIProcessGroup rpkigui")
-	AC_MSG_RESULT([running mod_wsgi in daemon mode with user "$user" and group "${group:-default}"])
+		IFS="$save_IFS"
+		AC_SUBST(WSGI_DAEMON_PROCESS, "WSGIDaemonProcess rpkigui user=$user ${group:+group=}${group} display-name=%{GROUP}")
+		AC_SUBST(WSGI_PROCESS_GROUP, "WSGIProcessGroup rpkigui")
+		AC_MSG_RESULT([with user "$user" and group "${group:-default}"])
+		;;
+	esac
 fi
 
 # Now that we're finally done with all the conditional changes to
diff --git a/rpkid/doc/pubd-bpki.dot b/doc/pubd-bpki.dot
index 44ad8a90..44ad8a90 100644
--- a/rpkid/doc/pubd-bpki.dot
+++ b/doc/pubd-bpki.dot
diff --git a/rpkid/doc/rpkid-bpki.dot b/doc/rpkid-bpki.dot
index 651591cb..651591cb 100644
--- a/rpkid/doc/rpkid-bpki.dot
+++ b/doc/rpkid-bpki.dot
diff --git a/rpkid/ext/POW.c b/ext/POW.c
index b5d9ccaf..c14e154a 100644
--- a/rpkid/ext/POW.c
+++ b/ext/POW.c
@@ -2655,6 +2655,28 @@ x509_object_set_issuer(x509_object *self, PyObject *args)
   return  NULL;
 }
 
+static char x509_object_get_issuer_hash__doc__[] =
+  "Return the OpenSSL \"name hash\" for this certificate's issuer name.\n"
+  ;
+
+static PyObject *
+x509_object_get_issuer_hash(x509_object *self)
+{
+  ENTERING(x509_object_get_issuer_hash);
+  return Py_BuildValue("k", X509_NAME_hash(X509_get_issuer_name(self->x509)));
+}
+
+static char x509_object_get_subject_hash__doc__[] =
+  "Return the OpenSSL \"name hash\" for this certificate's subject name.\n"
+  ;
+
+static PyObject *
+x509_object_get_subject_hash(x509_object *self)
+{
+  ENTERING(x509_object_get_subject_hash);
+  return Py_BuildValue("k", X509_NAME_hash(X509_get_subject_name(self->x509)));
+}
+
 static char x509_object_get_not_before__doc__[] =
   "Return this certificate's \"notBefore\" value as a datetime.\n"
   ;
@@ -3682,10 +3704,6 @@ x509_object_set_certificate_policies(x509_object *self, PyObject *args)
     return NULL;
 }
 
-/*
- * May want EKU handlers eventually, skip for now.
- */
-
 static char x509_object_pprint__doc__[] =
   "Return a pretty-printed rendition of this certificate.\n"
   ;
@@ -3751,6 +3769,8 @@ static struct PyMethodDef x509_object_methods[] = {
   Define_Method(setCRLDP,               x509_object_set_crldp,                  METH_VARARGS),
   Define_Method(getCertificatePolicies, x509_object_get_certificate_policies,   METH_NOARGS),
   Define_Method(setCertificatePolicies, x509_object_set_certificate_policies,   METH_VARARGS),
+  Define_Method(getIssuerHash,          x509_object_get_issuer_hash,            METH_NOARGS),
+  Define_Method(getSubjectHash,         x509_object_get_subject_hash,           METH_NOARGS),
   Define_Class_Method(pemRead,          x509_object_pem_read,                   METH_VARARGS),
   Define_Class_Method(pemReadFile,      x509_object_pem_read_file,              METH_VARARGS),
   Define_Class_Method(derRead,          x509_object_der_read,                   METH_VARARGS),
@@ -4623,6 +4643,17 @@ crl_object_set_issuer(crl_object *self, PyObject *args)
   return NULL;
 }
 
+static char crl_object_get_issuer_hash__doc__[] =
+  "Return the OpenSSL \"name hash\" for this CRL's issuer name.\n"
+  ;
+
+static PyObject *
+crl_object_get_issuer_hash(crl_object *self)
+{
+  ENTERING(crl_object_get_issuer_hash);
+  return Py_BuildValue("k", X509_NAME_hash(X509_CRL_get_issuer(self->crl)));
+}
+
 /*
  * NB: OpenSSL is confused about the name of this field, probably for
  * backwards compatability with some ancient mistake.  What RFC 5280
@@ -5094,6 +5125,7 @@ static struct PyMethodDef crl_object_methods[] = {
   Define_Method(setAKI,                 crl_object_set_aki,             METH_VARARGS),
   Define_Method(getCRLNumber,           crl_object_get_crl_number,      METH_NOARGS),
   Define_Method(setCRLNumber,           crl_object_set_crl_number,      METH_VARARGS),
+  Define_Method(getIssuerHash,          crl_object_get_issuer_hash,     METH_NOARGS),
   Define_Class_Method(pemRead,          crl_object_pem_read,            METH_VARARGS),
   Define_Class_Method(pemReadFile,      crl_object_pem_read_file,       METH_VARARGS),
   Define_Class_Method(derRead,          crl_object_der_read,            METH_VARARGS),
@@ -8737,10 +8769,6 @@ pkcs10_object_get_extension_oids(pkcs10_object *self)
   return NULL;  
 }
 
-/*
- * May want EKU handlers eventually, skip for now.
- */
-
 static char pkcs10_object_pprint__doc__[] =
   "Return a pretty-printed rendition of this PKCS#10 request.\n"
   ;
diff --git a/h/Makefile.in b/h/Makefile.in
deleted file mode 100644
index d976661b..00000000
--- a/h/Makefile.in
+++ /dev/null
@@ -1,24 +0,0 @@
-# $Id$
-
-PYTHON = @PYTHON@
-
-abs_top_srcdir = @abs_top_srcdir@
-
-all: rpki/sk_manifest.h rpki/sk_roa.h
-
-rpki/sk_manifest.h: rpki/manifest.h
-	${PYTHON} ${abs_top_srcdir}/buildtools/defstack.py rpki/manifest.h >$@.tmp
-	mv $@.tmp $@
-
-rpki/sk_roa.h: rpki/roa.h
-	${PYTHON} ${abs_top_srcdir}/buildtools/defstack.py rpki/roa.h >$@.tmp
-	mv $@.tmp $@
-
-clean:
-	rm -f *.h.tmp
-
-test install deinstall uninstall:
-	@true
-
-distclean: clean
-	rm -f Makefile
diff --git a/h/rpki/sk_manifest.h b/h/rpki/sk_manifest.h
index ead7cbe4..59ff80a5 100644
--- a/h/rpki/sk_manifest.h
+++ b/h/rpki/sk_manifest.h
@@ -1,6 +1,6 @@
 /*
  * Automatically generated, do not edit.
- * Generator $Id: defstack.py 4725 2012-09-19 21:28:34Z sra $
+ * Generator $Id: defstack.py 4878 2012-11-15 22:13:53Z sra $
  */
 
 #ifndef __RPKI_MANIFEST_H__DEFSTACK_H__
diff --git a/h/rpki/sk_roa.h b/h/rpki/sk_roa.h
index cb5c5e17..13036955 100644
--- a/h/rpki/sk_roa.h
+++ b/h/rpki/sk_roa.h
@@ -1,6 +1,6 @@
 /*
  * Automatically generated, do not edit.
- * Generator $Id: defstack.py 4725 2012-09-19 21:28:34Z sra $
+ * Generator $Id: defstack.py 4878 2012-11-15 22:13:53Z sra $
  */
 
 #ifndef __RPKI_ROA_H__DEFSTACK_H__
diff --git a/scripts/analyze-rcynic-history.py b/potpourri/analyze-rcynic-history.py
index b72d0741..b72d0741 100644
--- a/scripts/analyze-rcynic-history.py
+++ b/potpourri/analyze-rcynic-history.py
diff --git a/scripts/analyze-transition.py b/potpourri/analyze-transition.py
index e2125dfb..e2125dfb 100644
--- a/scripts/analyze-transition.py
+++ b/potpourri/analyze-transition.py
diff --git a/scripts/apnic-to-csv.py b/potpourri/apnic-to-csv.py
index 62293a51..62293a51 100644
--- a/scripts/apnic-to-csv.py
+++ b/potpourri/apnic-to-csv.py
diff --git a/scripts/application-x-rpki-mailcap-handler.sh b/potpourri/application-x-rpki-mailcap-handler.sh
index 891987d9..891987d9 100755
--- a/scripts/application-x-rpki-mailcap-handler.sh
+++ b/potpourri/application-x-rpki-mailcap-handler.sh
diff --git a/scripts/arin-to-csv.py b/potpourri/arin-to-csv.py
index a4e7ffc3..a4e7ffc3 100644
--- a/scripts/arin-to-csv.py
+++ b/potpourri/arin-to-csv.py
diff --git a/scripts/cross_certify.py b/potpourri/cross_certify.py
index fab7743b..fab7743b 100644
--- a/scripts/cross_certify.py
+++ b/potpourri/cross_certify.py
diff --git a/scripts/csvgrep.py b/potpourri/csvgrep.py
index 68bdd259..68bdd259 100644
--- a/scripts/csvgrep.py
+++ b/potpourri/csvgrep.py
diff --git a/scripts/expand-roa-prefixes.py b/potpourri/expand-roa-prefixes.py
index ae34ea0a..ae34ea0a 100644
--- a/scripts/expand-roa-prefixes.py
+++ b/potpourri/expand-roa-prefixes.py
diff --git a/scripts/extract-key.py b/potpourri/extract-key.py
index b85c3d55..b85c3d55 100644
--- a/scripts/extract-key.py
+++ b/potpourri/extract-key.py
diff --git a/scripts/fakerootd.py b/potpourri/fakerootd.py
index 6275a2a9..6275a2a9 100644
--- a/scripts/fakerootd.py
+++ b/potpourri/fakerootd.py
diff --git a/scripts/format-application-x-rpki.py b/potpourri/format-application-x-rpki.py
index 184103f9..184103f9 100644
--- a/scripts/format-application-x-rpki.py
+++ b/potpourri/format-application-x-rpki.py
diff --git a/scripts/gc_summary.awk b/potpourri/gc_summary.awk
index b3b1bc6a..b3b1bc6a 100644
--- a/scripts/gc_summary.awk
+++ b/potpourri/gc_summary.awk
diff --git a/scripts/gc_summary.py b/potpourri/gc_summary.py
index 1f6987bf..1f6987bf 100644
--- a/scripts/gc_summary.py
+++ b/potpourri/gc_summary.py
diff --git a/scripts/generate-ripe-root-cert.py b/potpourri/generate-ripe-root-cert.py
index 3407bc51..3407bc51 100644
--- a/scripts/generate-ripe-root-cert.py
+++ b/potpourri/generate-ripe-root-cert.py
diff --git a/scripts/gski.py b/potpourri/gski.py
index 083a59c8..083a59c8 100644
--- a/scripts/gski.py
+++ b/potpourri/gski.py
diff --git a/scripts/guess-roas-from-routeviews.py b/potpourri/guess-roas-from-routeviews.py
index d8fb9c4c..d8fb9c4c 100644
--- a/scripts/guess-roas-from-routeviews.py
+++ b/potpourri/guess-roas-from-routeviews.py
diff --git a/scripts/iana-to-csv.py b/potpourri/iana-to-csv.py
index f803a21e..f803a21e 100644
--- a/scripts/iana-to-csv.py
+++ b/potpourri/iana-to-csv.py
diff --git a/scripts/missing-oids.py b/potpourri/missing-oids.py
index 16316eac..16316eac 100644
--- a/scripts/missing-oids.py
+++ b/potpourri/missing-oids.py
diff --git a/scripts/object-dates.py b/potpourri/object-dates.py
index b99441d6..b99441d6 100644
--- a/scripts/object-dates.py
+++ b/potpourri/object-dates.py
diff --git a/scripts/pcap-to-xml.sh b/potpourri/pcap-to-xml.sh
index 73c30880..73c30880 100644
--- a/scripts/pcap-to-xml.sh
+++ b/potpourri/pcap-to-xml.sh
diff --git a/scripts/print-profile.py b/potpourri/print-profile.py
index 081d2602..081d2602 100644
--- a/scripts/print-profile.py
+++ b/potpourri/print-profile.py
diff --git a/scripts/rcynic-diff.py b/potpourri/rcynic-diff.py
index 327a7b71..327a7b71 100644
--- a/scripts/rcynic-diff.py
+++ b/potpourri/rcynic-diff.py
diff --git a/scripts/rcynic-lta b/potpourri/rcynic-lta
index 4c55db92..4c55db92 100755
--- a/scripts/rcynic-lta
+++ b/potpourri/rcynic-lta
diff --git a/scripts/rcynic-lta.yaml b/potpourri/rcynic-lta.yaml
index ab17a56c..ab17a56c 100644
--- a/scripts/rcynic-lta.yaml
+++ b/potpourri/rcynic-lta.yaml
diff --git a/scripts/repo0-testbed-daily b/potpourri/repo0-testbed-daily
index 576464c4..576464c4 100755
--- a/scripts/repo0-testbed-daily
+++ b/potpourri/repo0-testbed-daily
diff --git a/scripts/repo0-testbed-monthly b/potpourri/repo0-testbed-monthly
index b7ada110..b7ada110 100755
--- a/scripts/repo0-testbed-monthly
+++ b/potpourri/repo0-testbed-monthly
diff --git a/scripts/repo0-testbed-weekly b/potpourri/repo0-testbed-weekly
index 6f1f8ead..6f1f8ead 100755
--- a/scripts/repo0-testbed-weekly
+++ b/potpourri/repo0-testbed-weekly
diff --git a/scripts/ripe-asns-to-csv.py b/potpourri/ripe-asns-to-csv.py
index 50251ce8..50251ce8 100644
--- a/scripts/ripe-asns-to-csv.py
+++ b/potpourri/ripe-asns-to-csv.py
diff --git a/scripts/ripe-prefixes-to-csv.awk b/potpourri/ripe-prefixes-to-csv.awk
index 37327484..37327484 100644
--- a/scripts/ripe-prefixes-to-csv.awk
+++ b/potpourri/ripe-prefixes-to-csv.awk
diff --git a/scripts/ripe-to-csv.awk b/potpourri/ripe-to-csv.awk
index 5325574f..5325574f 100644
--- a/scripts/ripe-to-csv.awk
+++ b/potpourri/ripe-to-csv.awk
diff --git a/scripts/ripe-to-csv.py b/potpourri/ripe-to-csv.py
index b864345b..b864345b 100644
--- a/scripts/ripe-to-csv.py
+++ b/potpourri/ripe-to-csv.py
diff --git a/scripts/roa-to-irr.py b/potpourri/roa-to-irr.py
index 01b2aac8..01b2aac8 100644
--- a/scripts/roa-to-irr.py
+++ b/potpourri/roa-to-irr.py
diff --git a/scripts/rp-sqlite b/potpourri/rp-sqlite
index ee43096d..ee43096d 100755
--- a/scripts/rp-sqlite
+++ b/potpourri/rp-sqlite
diff --git a/scripts/rp-sqlite.yaml b/potpourri/rp-sqlite.yaml
index 4c0a0b8d..4c0a0b8d 100644
--- a/scripts/rp-sqlite.yaml
+++ b/potpourri/rp-sqlite.yaml
diff --git a/potpourri/rpki b/potpourri/rpki
new file mode 120000
index 00000000..8d289d0b
--- /dev/null
+++ b/potpourri/rpki
@@ -0,0 +1 @@
+../rpki
\ No newline at end of file
diff --git a/scripts/rpkidemo b/potpourri/rpkidemo
index fdb4e1bb..fdb4e1bb 100755
--- a/scripts/rpkidemo
+++ b/potpourri/rpkidemo
diff --git a/scripts/rpkidemo.pem b/potpourri/rpkidemo.pem
index f96fdb9e..f96fdb9e 100644
--- a/scripts/rpkidemo.pem
+++ b/potpourri/rpkidemo.pem
diff --git a/rpkid/portal-gui/scripts/rpkigui-flatten-roas.py b/potpourri/rpkigui-flatten-roas.py
index e21c368b..e21c368b 100644
--- a/rpkid/portal-gui/scripts/rpkigui-flatten-roas.py
+++ b/potpourri/rpkigui-flatten-roas.py
diff --git a/rpkid/portal-gui/scripts/rpkigui-reset-demo.py b/potpourri/rpkigui-reset-demo.py
index 0a3a1537..0a3a1537 100644
--- a/rpkid/portal-gui/scripts/rpkigui-reset-demo.py
+++ b/potpourri/rpkigui-reset-demo.py
diff --git a/rpkid/portal-gui/scripts/rpkigui-sync-users.py b/potpourri/rpkigui-sync-users.py
index 9c636e95..9c636e95 100644
--- a/rpkid/portal-gui/scripts/rpkigui-sync-users.py
+++ b/potpourri/rpkigui-sync-users.py
diff --git a/scripts/rrd-rcynic-history.py b/potpourri/rrd-rcynic-history.py
index 8a0d50a8..8a0d50a8 100644
--- a/scripts/rrd-rcynic-history.py
+++ b/potpourri/rrd-rcynic-history.py
diff --git a/scripts/setup-rootd.sh b/potpourri/setup-rootd.sh
index 41a271b8..41a271b8 100644
--- a/scripts/setup-rootd.sh
+++ b/potpourri/setup-rootd.sh
diff --git a/scripts/show-cms-ee-certs.sh b/potpourri/show-cms-ee-certs.sh
index 4f5168c7..4f5168c7 100644
--- a/scripts/show-cms-ee-certs.sh
+++ b/potpourri/show-cms-ee-certs.sh
diff --git a/scripts/show-tracking-data.py b/potpourri/show-tracking-data.py
index 07e0a144..07e0a144 100644
--- a/scripts/show-tracking-data.py
+++ b/potpourri/show-tracking-data.py
diff --git a/scripts/signed-object-dates.py b/potpourri/signed-object-dates.py
index fefd9448..fefd9448 100644
--- a/scripts/signed-object-dates.py
+++ b/potpourri/signed-object-dates.py
diff --git a/scripts/splitbase64.xsl b/potpourri/splitbase64.xsl
index 2b2d2fb1..2b2d2fb1 100644
--- a/scripts/splitbase64.xsl
+++ b/potpourri/splitbase64.xsl
diff --git a/scripts/testbed-rootcert.py b/potpourri/testbed-rootcert.py
index 0716be2f..0716be2f 100644
--- a/scripts/testbed-rootcert.py
+++ b/potpourri/testbed-rootcert.py
diff --git a/scripts/translate-handles.py b/potpourri/translate-handles.py
index 49848277..49848277 100644
--- a/scripts/translate-handles.py
+++ b/potpourri/translate-handles.py
diff --git a/scripts/upgrade-add-ghostbusters.py b/potpourri/upgrade-add-ghostbusters.py
index a8c8a92b..a8c8a92b 100644
--- a/scripts/upgrade-add-ghostbusters.py
+++ b/potpourri/upgrade-add-ghostbusters.py
diff --git a/scripts/verify-bpki.sh b/potpourri/verify-bpki.sh
index 0e36d796..0e36d796 100755
--- a/scripts/verify-bpki.sh
+++ b/potpourri/verify-bpki.sh
diff --git a/scripts/whack-ripe-asns.py b/potpourri/whack-ripe-asns.py
index 9c702271..9c702271 100644
--- a/scripts/whack-ripe-asns.py
+++ b/potpourri/whack-ripe-asns.py
diff --git a/scripts/whack-ripe-prefixes.py b/potpourri/whack-ripe-prefixes.py
index 52ea3f18..52ea3f18 100644
--- a/scripts/whack-ripe-prefixes.py
+++ b/potpourri/whack-ripe-prefixes.py
diff --git a/scripts/x509-dot.py b/potpourri/x509-dot.py
index 42e1543a..42e1543a 100644
--- a/scripts/x509-dot.py
+++ b/potpourri/x509-dot.py
diff --git a/utils/Makefile.in b/rp/Makefile.in
index c89fdff5..2c770a46 100644
--- a/utils/Makefile.in
+++ b/rp/Makefile.in
@@ -1,6 +1,6 @@
 # $Id$
 
-SUBDIRS = uri print_rpki_manifest print_roa hashdir find_roa scan_roas scan_routercerts
+SUBDIRS = rcynic rpki-rtr utils
 
 all clean test distclean install deinstall uninstall::
 	@for i in ${SUBDIRS}; do echo "Making $@ in $$i"; (cd $$i && ${MAKE} $@); done
diff --git a/rcynic/Doxyfile b/rp/rcynic/Doxyfile
index aa183715..aa183715 100644
--- a/rcynic/Doxyfile
+++ b/rp/rcynic/Doxyfile
diff --git a/rcynic/Makefile.in b/rp/rcynic/Makefile.in
index 06f7d9cd..d0edfca3 100644
--- a/rcynic/Makefile.in
+++ b/rp/rcynic/Makefile.in
@@ -50,13 +50,13 @@ RCYNIC_DATA_DIR		= ${RCYNIC_DIR}/data
 RCYNIC_DIR		= @RCYNIC_DIR@
 RCYNIC_DIRS		= ${RCYNIC_TA_DIR} ${RCYNIC_JAIL_DIRS} ${RCYNIC_DATA_DIR} ${RPKIRTR_DIR} ${RPKIRTR_DIR}/sockets
 RCYNIC_GECOS		= RPKI Validation System
-RCYNIC_GROUP		= rcynic
+RCYNIC_GROUP		= @RCYNIC_GROUP@
 RCYNIC_HTML_DIR		= @RCYNIC_HTML_DIR@
 RCYNIC_INSTALL_TARGETS	= @RCYNIC_INSTALL_TARGETS@
 RCYNIC_JAIL_DIRS	= @RCYNIC_JAIL_DIRS@
 RCYNIC_STATIC_RSYNC	= @RCYNIC_STATIC_RSYNC@
 RCYNIC_TA_DIR		= @RCYNIC_TA_DIR@
-RCYNIC_USER		= rcynic
+RCYNIC_USER		= @RCYNIC_USER@
 RPKIRTR_DIR		= ${RCYNIC_DIR}/rpki-rtr
 RPKIRTR_GECOS		= RPKI router server
 RPKIRTR_GROUP		= rpkirtr
@@ -65,11 +65,11 @@ RPKIRTR_USER		= rpkirtr
 
 SCRIPTS = rcynic-text rcynic-html rcynic-svn validation_status rcynic-cron
 
-all: ${BIN} ${SCRIPTS} ${RCYNIC_STATIC_RSYNC}
+all: ${BIN} ${RCYNIC_STATIC_RSYNC}
 
 clean:
 	if test -r static-rsync/Makefile; then cd static-rsync; ${MAKE} $@; fi
-	rm -f ${BIN} ${OBJS} ${SCRIPTS}
+	rm -f ${BIN} ${OBJS}
 
 ${OBJ}: ${SRC} ${GEN}
 
@@ -80,39 +80,6 @@ ${GEN}: ${SRC}
 	${PYTHON} ${abs_top_srcdir}/buildtools/defstack.py ${SRC} >$@.tmp
 	mv $@.tmp $@
 
-COMPILE_PYTHON = \
-	AC_PYTHON_INTERPRETER='${PYTHON}' \
-	AC_RRDTOOL_BINARY='${RRDTOOL}' \
-	${PYTHON} ${abs_top_srcdir}/buildtools/make-rcynic-script.py <$? >$@; \
-	chmod 755 $@
-
-COMPILE_PYTHON_CRON = \
-	AC_PYTHON_INTERPRETER='${PYTHON}' \
-	AC_RCYNIC_USER='${RCYNIC_USER}' \
-	AC_RCYNIC_DIR='${RCYNIC_DIR}' \
-	AC_bindir='${bindir}' \
-	AC_sbindir='${sbindir}' \
-	AC_sysconfdir='${sysconfdir}' \
-	AC_libexecdir='${libexecdir}' \
-	AC_RCYNIC_HTML_DIR='${RCYNIC_HTML_DIR}' \
-	${PYTHON} ${abs_top_srcdir}/buildtools/make-rcynic-script.py <$? >$@; \
-	chmod 755 $@
-
-rcynic-text: rcynic-text.py
-	${COMPILE_PYTHON}
-
-rcynic-html: rcynic-html.py
-	${COMPILE_PYTHON}
-
-rcynic-svn: rcynic-svn.py
-	${COMPILE_PYTHON}
-
-validation_status: validation_status.py
-	${COMPILE_PYTHON}
-
-rcynic-cron: rcynic-cron.py
-	${COMPILE_PYTHON_CRON}
-
 tags: TAGS
 
 TAGS: ${SRC} ${GEN}
diff --git a/rcynic/README b/rp/rcynic/README
index ecc92ac5..ecc92ac5 100644
--- a/rcynic/README
+++ b/rp/rcynic/README
diff --git a/rcynic/bio_f_linebreak.c b/rp/rcynic/bio_f_linebreak.c
index c2d9fb4d..c2d9fb4d 100644
--- a/rcynic/bio_f_linebreak.c
+++ b/rp/rcynic/bio_f_linebreak.c
diff --git a/rcynic/bio_f_linebreak.h b/rp/rcynic/bio_f_linebreak.h
index b5becfa6..b5becfa6 100644
--- a/rcynic/bio_f_linebreak.h
+++ b/rp/rcynic/bio_f_linebreak.h
diff --git a/rcynic/defstack.h b/rp/rcynic/defstack.h
index 370c8129..370c8129 100644
--- a/rcynic/defstack.h
+++ b/rp/rcynic/defstack.h
diff --git a/rcynic/make-tal.sh b/rp/rcynic/make-tal.sh
index 854a76b9..854a76b9 100755
--- a/rcynic/make-tal.sh
+++ b/rp/rcynic/make-tal.sh
diff --git a/rcynic/rc-scripts/darwin/RCynic b/rp/rcynic/rc-scripts/darwin/RCynic
index d486a3c3..d486a3c3 100755
--- a/rcynic/rc-scripts/darwin/RCynic
+++ b/rp/rcynic/rc-scripts/darwin/RCynic
diff --git a/rcynic/rc-scripts/darwin/StartupParameters.plist b/rp/rcynic/rc-scripts/darwin/StartupParameters.plist
index ca46b676..ca46b676 100644
--- a/rcynic/rc-scripts/darwin/StartupParameters.plist
+++ b/rp/rcynic/rc-scripts/darwin/StartupParameters.plist
diff --git a/rcynic/rc-scripts/freebsd/rc.d.rcynic b/rp/rcynic/rc-scripts/freebsd/rc.d.rcynic
index 9b7aa545..9b7aa545 100755
--- a/rcynic/rc-scripts/freebsd/rc.d.rcynic
+++ b/rp/rcynic/rc-scripts/freebsd/rc.d.rcynic
diff --git a/rcynic/rcynic-cron.py b/rp/rcynic/rcynic-cron
index fbe1ebeb..dc26e9a0 100644..100755
--- a/rcynic/rcynic-cron.py
+++ b/rp/rcynic/rcynic-cron
@@ -1,3 +1,5 @@
+#!/usr/bin/env python
+#
 # $Id$
 # 
 # Copyright (C) 2014  Dragon Research Labs ("DRL")
@@ -30,6 +32,7 @@ import pwd
 import fcntl
 import errno
 import argparse
+import rpki.autoconf
 
 def run(*cmd, **kwargs):
   chroot_this = kwargs.pop("chroot_this", False)
@@ -37,13 +40,13 @@ def run(*cmd, **kwargs):
   pid = os.fork()
   if pid == 0:
     if chroot_this:
-      os.chdir(ac_rcynic_dir)
+      os.chdir(rpki.autoconf.RCYNIC_DIR)
     elif cwd is not None:
       os.chdir(cwd)
     if we_are_root:
       os.initgroups(pw.pw_name, pw.pw_gid)
     if chroot_this:
-      os.chroot(ac_rcynic_dir)
+      os.chroot(rpki.autoconf.RCYNIC_DIR)
     if we_are_root:
       os.setgid(pw.pw_gid)
       os.setuid(pw.pw_uid)
@@ -71,12 +74,13 @@ if args.chroot and not we_are_root:
   sys.exit("Only root can --chroot")
 
 try:
-  pw = pwd.getpwnam(ac_rcynic_user)
+  pw = pwd.getpwnam(rpki.autoconf.RCYNIC_USER)
 except KeyError:
-  sys.exit("Could not find passwd entry for user %s" % ac_rcynic_user)
+  sys.exit("Could not find passwd entry for user %s" % rpki.autoconf.RCYNIC_USER)
 
 try:
-  lock = os.open(os.path.join(ac_rcynic_dir, "data/lock"), os.O_RDONLY | os.O_CREAT | os.O_NONBLOCK, 0666)
+  lock = os.open(os.path.join(rpki.autoconf.RCYNIC_DIR, "data/lock"),
+                 os.O_RDONLY | os.O_CREAT | os.O_NONBLOCK, 0666)
   fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
   if we_are_root:
     os.fchown(lock, pw.pw_uid, pw.pw_gid)
@@ -84,23 +88,23 @@ except (IOError, OSError), e:
   if e.errno == errno.EAGAIN:
     sys.exit(0)                         # Another instance of this script is already running, exit silently
   else:
-    sys.exit("Error %r opening lock %r" % (e.strerror, os.path.join(ac_rcynic_dir, "data/lock")))
+    sys.exit("Error %r opening lock %r" % (e.strerror, os.path.join(rpki.autoconf.RCYNIC_DIR, "data/lock")))
 
 if args.chroot:
   run("/bin/rcynic", "-c", "/etc/rcynic.conf", chroot_this = True)
 else:
-  run(os.path.join(ac_bindir, "rcynic"), "-c", os.path.join(ac_sysconfdir, "rcynic.conf"))
+  run(os.path.join(rpki.autoconf.bindir, "rcynic"), "-c", os.path.join(rpki.autoconf.sysconfdir, "rcynic.conf"))
 
-run(os.path.join(ac_bindir, "rtr-origin"),
+run(os.path.join(rpki.autoconf.bindir, "rtr-origin"),
     "--cronjob", 
-    os.path.join(ac_rcynic_dir, "data/authenticated"),
-    cwd = os.path.join(ac_rcynic_dir, "rpki-rtr"))
+    os.path.join(rpki.autoconf.RCYNIC_DIR, "data/authenticated"),
+    cwd = os.path.join(rpki.autoconf.RCYNIC_DIR, "rpki-rtr"))
 
-prog = os.path.join(ac_libexecdir, "rpkigui-rcynic")
+prog = os.path.join(rpki.autoconf.libexecdir, "rpkigui-rcynic")
 if os.path.exists(prog):
   run(prog)
 
-if ac_rcynic_html_dir and os.path.exists(os.path.dirname(ac_rcynic_html_dir)):
-  run(os.path.join(ac_bindir, "rcynic-html"),
-      os.path.join(ac_rcynic_dir, "data/rcynic.xml"),
-      ac_rcynic_html_dir)
+if rpki.autoconf.RCYNIC_HTML_DIR and os.path.exists(os.path.dirname(rpki.autoconf.RCYNIC_HTML_DIR)):
+  run(os.path.join(rpki.autoconf.bindir, "rcynic-html"),
+      os.path.join(rpki.autoconf.RCYNIC_DIR, "data/rcynic.xml"),
+      rpki.autoconf.RCYNIC_HTML_DIR)
diff --git a/rcynic/rcynic-html.py b/rp/rcynic/rcynic-html
index 58e65dde..cf5f5368 100644..100755
--- a/rcynic/rcynic-html.py
+++ b/rp/rcynic/rcynic-html
@@ -1,3 +1,5 @@
+#!/usr/bin/env python
+#
 # $Id$
 # 
 # Copyright (C) 2013--2014  Dragon Research Labs ("DRL")
@@ -27,6 +29,7 @@ import argparse
 import time
 import subprocess
 import copy
+import rpki.autoconf
 
 try:
   from lxml.etree            import (ElementTree, Element, SubElement, Comment)
@@ -41,7 +44,7 @@ def parse_options():
   global args
 
   try:
-    default_rrdtool_binary = ac_rrdtool_binary
+    default_rrdtool_binary = rpki.autoconf.RRDTOOL
   except NameError:
     default_rrdtool_binary = "rrdtool"
 
diff --git a/rcynic/rcynic-svn.py b/rp/rcynic/rcynic-svn
index fd0df500..c667ec4a 100644..100755
--- a/rcynic/rcynic-svn.py
+++ b/rp/rcynic/rcynic-svn
@@ -1,3 +1,5 @@
+#!/usr/bin/env python
+#
 # $Id$
 #
 # Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC")
diff --git a/rcynic/rcynic-text.py b/rp/rcynic/rcynic-text
index a8e56dac..c837e88b 100644..100755
--- a/rcynic/rcynic-text.py
+++ b/rp/rcynic/rcynic-text
@@ -1,3 +1,5 @@
+#!/usr/bin/env python
+#
 # $Id$
 # 
 # Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC")
diff --git a/rcynic/rcynic.c b/rp/rcynic/rcynic.c
index dea9c48f..dea9c48f 100644
--- a/rcynic/rcynic.c
+++ b/rp/rcynic/rcynic.c
diff --git a/rcynic/rcynic.xsl b/rp/rcynic/rcynic.xsl
index 487cd2f6..487cd2f6 100644
--- a/rcynic/rcynic.xsl
+++ b/rp/rcynic/rcynic.xsl
diff --git a/rp/rcynic/rpki b/rp/rcynic/rpki
new file mode 120000
index 00000000..d39d05b6
--- /dev/null
+++ b/rp/rcynic/rpki
@@ -0,0 +1 @@
+../../rpki
\ No newline at end of file
diff --git a/rcynic/rpki-torrent.py b/rp/rcynic/rpki-torrent.py
index 9b97f298..cc0798e7 100644
--- a/rcynic/rpki-torrent.py
+++ b/rp/rcynic/rpki-torrent.py
@@ -1,5 +1,5 @@
-#!/usr/local/bin/python
-
+#!/usr/bin/env python
+#
 # $Id$
 #
 # Copyright (C) 2013--2014  Dragon Research Labs ("DRL")
diff --git a/rcynic/rules.darwin.mk b/rp/rcynic/rules.darwin.mk
index d37b0e75..d37b0e75 100644
--- a/rcynic/rules.darwin.mk
+++ b/rp/rcynic/rules.darwin.mk
diff --git a/rcynic/rules.freebsd.mk b/rp/rcynic/rules.freebsd.mk
index 5233386e..5233386e 100644
--- a/rcynic/rules.freebsd.mk
+++ b/rp/rcynic/rules.freebsd.mk
diff --git a/rcynic/rules.linux.mk b/rp/rcynic/rules.linux.mk
index 6a962cef..6a962cef 100644
--- a/rcynic/rules.linux.mk
+++ b/rp/rcynic/rules.linux.mk
diff --git a/rcynic/rules.unknown.mk b/rp/rcynic/rules.unknown.mk
index 6ce3ea18..6ce3ea18 100644
--- a/rcynic/rules.unknown.mk
+++ b/rp/rcynic/rules.unknown.mk
diff --git a/rcynic/sample-rcynic.conf b/rp/rcynic/sample-rcynic.conf
index 6fa49b9c..6fa49b9c 100644
--- a/rcynic/sample-rcynic.conf
+++ b/rp/rcynic/sample-rcynic.conf
diff --git a/rcynic/sample-trust-anchors/README b/rp/rcynic/sample-trust-anchors/README
index 485d0485..485d0485 100644
--- a/rcynic/sample-trust-anchors/README
+++ b/rp/rcynic/sample-trust-anchors/README
diff --git a/rcynic/sample-trust-anchors/afrinic.tal b/rp/rcynic/sample-trust-anchors/afrinic.tal
index 0f202c73..0f202c73 100644
--- a/rcynic/sample-trust-anchors/afrinic.tal
+++ b/rp/rcynic/sample-trust-anchors/afrinic.tal
diff --git a/rcynic/sample-trust-anchors/altca.tal b/rp/rcynic/sample-trust-anchors/altca.tal
index 2dbc7413..2dbc7413 100644
--- a/rcynic/sample-trust-anchors/altca.tal
+++ b/rp/rcynic/sample-trust-anchors/altca.tal
diff --git a/rcynic/sample-trust-anchors/apnic-rpki-root-afrinic-origin.tal b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-afrinic-origin.tal
index d254ec44..d254ec44 100644
--- a/rcynic/sample-trust-anchors/apnic-rpki-root-afrinic-origin.tal
+++ b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-afrinic-origin.tal
diff --git a/rcynic/sample-trust-anchors/apnic-rpki-root-arin-origin.tal b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-arin-origin.tal
index b82a136f..b82a136f 100644
--- a/rcynic/sample-trust-anchors/apnic-rpki-root-arin-origin.tal
+++ b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-arin-origin.tal
diff --git a/rcynic/sample-trust-anchors/apnic-rpki-root-iana-origin.tal b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-iana-origin.tal
index a4e714c0..a4e714c0 100644
--- a/rcynic/sample-trust-anchors/apnic-rpki-root-iana-origin.tal
+++ b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-iana-origin.tal
diff --git a/rcynic/sample-trust-anchors/apnic-rpki-root-lacnic-origin.tal b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-lacnic-origin.tal
index a4d56802..a4d56802 100644
--- a/rcynic/sample-trust-anchors/apnic-rpki-root-lacnic-origin.tal
+++ b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-lacnic-origin.tal
diff --git a/rcynic/sample-trust-anchors/apnic-rpki-root-ripe-origin.tal b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-ripe-origin.tal
index d64df3ae..d64df3ae 100644
--- a/rcynic/sample-trust-anchors/apnic-rpki-root-ripe-origin.tal
+++ b/rp/rcynic/sample-trust-anchors/apnic-rpki-root-ripe-origin.tal
diff --git a/rcynic/sample-trust-anchors/apnic-testbed.tal b/rp/rcynic/sample-trust-anchors/apnic-testbed.tal
index f87a3bf3..f87a3bf3 100644
--- a/rcynic/sample-trust-anchors/apnic-testbed.tal
+++ b/rp/rcynic/sample-trust-anchors/apnic-testbed.tal
diff --git a/rcynic/sample-trust-anchors/bbn-testbed.tal.disabled b/rp/rcynic/sample-trust-anchors/bbn-testbed.tal.disabled
index 21302ea5..21302ea5 100644
--- a/rcynic/sample-trust-anchors/bbn-testbed.tal.disabled
+++ b/rp/rcynic/sample-trust-anchors/bbn-testbed.tal.disabled
diff --git a/rcynic/sample-trust-anchors/lacnic.tal b/rp/rcynic/sample-trust-anchors/lacnic.tal
index 29220d37..29220d37 100644
--- a/rcynic/sample-trust-anchors/lacnic.tal
+++ b/rp/rcynic/sample-trust-anchors/lacnic.tal
diff --git a/rcynic/sample-trust-anchors/ripe-ncc-root.tal b/rp/rcynic/sample-trust-anchors/ripe-ncc-root.tal
index ebdb9f45..ebdb9f45 100644
--- a/rcynic/sample-trust-anchors/ripe-ncc-root.tal
+++ b/rp/rcynic/sample-trust-anchors/ripe-ncc-root.tal
diff --git a/rcynic/sample-trust-anchors/ripe-pilot.tal b/rp/rcynic/sample-trust-anchors/ripe-pilot.tal
index 971128e0..971128e0 100644
--- a/rcynic/sample-trust-anchors/ripe-pilot.tal
+++ b/rp/rcynic/sample-trust-anchors/ripe-pilot.tal
diff --git a/rcynic/sample-trust-anchors/rpki.net-testbed.tal b/rp/rcynic/sample-trust-anchors/rpki.net-testbed.tal
index 1e466300..1e466300 100644
--- a/rcynic/sample-trust-anchors/rpki.net-testbed.tal
+++ b/rp/rcynic/sample-trust-anchors/rpki.net-testbed.tal
diff --git a/rcynic/sample-trust-anchors/testbed-apnicrpki.tal.disabled b/rp/rcynic/sample-trust-anchors/testbed-apnicrpki.tal.disabled
index ae16a302..ae16a302 100644
--- a/rcynic/sample-trust-anchors/testbed-apnicrpki.tal.disabled
+++ b/rp/rcynic/sample-trust-anchors/testbed-apnicrpki.tal.disabled
diff --git a/rcynic/static-rsync/Makefile.in b/rp/rcynic/static-rsync/Makefile.in
index 8a433c7b..8a433c7b 100644
--- a/rcynic/static-rsync/Makefile.in
+++ b/rp/rcynic/static-rsync/Makefile.in
diff --git a/rcynic/static-rsync/README b/rp/rcynic/static-rsync/README
index 9ff5afa8..9ff5afa8 100644
--- a/rcynic/static-rsync/README
+++ b/rp/rcynic/static-rsync/README
diff --git a/rcynic/static-rsync/patches/patch-CVE-2007-4091 b/rp/rcynic/static-rsync/patches/patch-CVE-2007-4091
index 201af96a..201af96a 100644
--- a/rcynic/static-rsync/patches/patch-CVE-2007-4091
+++ b/rp/rcynic/static-rsync/patches/patch-CVE-2007-4091
diff --git a/rcynic/static-rsync/rsync-2.6.9.tar.gz b/rp/rcynic/static-rsync/rsync-2.6.9.tar.gz
index 6377f639..6377f639 100644
--- a/rcynic/static-rsync/rsync-2.6.9.tar.gz
+++ b/rp/rcynic/static-rsync/rsync-2.6.9.tar.gz
diff --git a/rcynic/validation_status.py b/rp/rcynic/validation_status
index 1f7a704d..1ff17e75 100644..100755
--- a/rcynic/validation_status.py
+++ b/rp/rcynic/validation_status
@@ -1,3 +1,5 @@
+#!/usr/bin/env python
+#
 # $Id$
 # 
 # Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC")
diff --git a/rtr-origin/Makefile.in b/rp/rpki-rtr/Makefile.in
index daa18009..e587305b 100644
--- a/rtr-origin/Makefile.in
+++ b/rp/rpki-rtr/Makefile.in
@@ -1,8 +1,6 @@
 # $Id$
 
-BASE		= rtr-origin
-SRC		= ${BASE}.py
-BIN		= ${BASE}
+BIN		= rtr-origin
 
 INSTALL		= @INSTALL@
 PYTHON		= @PYTHON@
@@ -30,10 +28,8 @@ RPKI_RTR_PORT	= 43779
 SCAN_ROAS	= ${bindir}/scan_roas
 
 
-all: ${BIN}
-
-clean:
-	rm -f ${BIN}
+all clean test::
+	@true
 
 install: all ${RTR_ORIGIN_INSTALL_TARGETS}
 
@@ -48,14 +44,6 @@ distclean: clean
 	rm -rf current sockets *.ax *.ix.*
 	rm -f Makefile
 
-${BIN} : ${SRC}
-	AC_PYTHON_INTERPRETER='${PYTHON}' AC_SCAN_ROAS='${SCAN_ROAS}' \
-	${PYTHON} ${abs_top_srcdir}/buildtools/make-rcynic-script.py <${SRC} >$@
-	chmod a+x $@
-
-test:
-	@true
-
 .FORCE:
 
 # Platform-specific rules below here.
diff --git a/rtr-origin/README b/rp/rpki-rtr/README
index dae53010..dae53010 100644
--- a/rtr-origin/README
+++ b/rp/rpki-rtr/README
diff --git a/rp/rpki-rtr/rpki b/rp/rpki-rtr/rpki
new file mode 120000
index 00000000..d39d05b6
--- /dev/null
+++ b/rp/rpki-rtr/rpki
@@ -0,0 +1 @@
+../../rpki
\ No newline at end of file
diff --git a/rtr-origin/rtr-origin.py b/rp/rpki-rtr/rtr-origin
index f37d2ce0..24400f77 100755
--- a/rtr-origin/rtr-origin.py
+++ b/rp/rpki-rtr/rtr-origin
@@ -41,7 +41,7 @@ import getopt
 import bisect
 import random
 import base64
-
+import rpki.autoconf
 
 # Debugging only, should be False in production
 disable_incrementals = False
@@ -898,7 +898,7 @@ class axfr_set(pdu_set):
         asn = line[1]
         self.extend(prefix.from_text(asn, addr) for addr in line[2:])
     except OSError, e:
-      sys.exit("Could not run %s, check your $PATH variable? (%s)" % (scan_roas, e))
+      sys.exit("Could not run %s: %s" % (scan_roas, e))
 
     try:
       p = subprocess.Popen((scan_routercerts, rcynic_dir), stdout = subprocess.PIPE)
@@ -908,7 +908,7 @@ class axfr_set(pdu_set):
         key  = line[-1]
         self.extend(router_key.from_text(asn, gski, key) for asn in line[1:-1])
     except OSError, e:
-      sys.exit("Could not run %s, check your $PATH variable? (%s)" % (scan_routercerts, e))
+      sys.exit("Could not run %s: %s" % (scan_routercerts, e))
 
     self.sort()
     for i in xrange(len(self) - 2, -1, -1):
@@ -2160,28 +2160,8 @@ def bgpdump_server_main(argv):
   except KeyboardInterrupt:
     sys.exit(0)
 
-# Figure out where the scan_roas utility program is today
-try:
-  # Set from autoconf
-  scan_roas = ac_scan_roas
-except NameError:
-  # Source directory
-  scan_roas = os.path.normpath(os.path.join(sys.path[0], "..", "utils",
-                                            "scan_roas", "scan_roas"))
-# If that didn't work, use $PATH and hope for the best
-if not os.path.exists(scan_roas):
-  scan_roas = "scan_roas"
-
-# Same thing for scan_routercerts
-try:
-  # Set from autoconf
-  scan_routercerts = ac_scan_routercerts
-except NameError:
-  # Source directory
-  scan_routercerts = os.path.normpath(os.path.join(sys.path[0], "..", "utils",
-                                                   "scan_routercerts", "scan_routercerts"))
-if not os.path.exists(scan_routercerts):
-  scan_routercerts = "scan_routercerts"
+scan_roas        = os.path.join(rpki.autoconf.bindir, "scan_roas")
+scan_routercerts = os.path.join(rpki.autoconf.bindir, "scan_routercerts")
 
 force_zero_nonce = False
 
@@ -2204,6 +2184,10 @@ def usage(msg = None):
   f.write("\n")
   f.write("where options are zero or more of:\n")
   f.write("\n")
+  f.write("--scan-roas        /path/to/scan_roas\n")
+  f.write("\n")
+  f.write("--scan-routercerts /path/to/scan_routercerts\n")
+  f.write("\n")
   f.write("--syslog facility.warning_priority[.info_priority]\n")
   f.write("\n")
   f.write("--zero-nonce\n")
@@ -2225,7 +2209,8 @@ if __name__ == "__main__":
 
   syslog_facility, syslog_warning, syslog_info = syslog.LOG_DAEMON, syslog.LOG_WARNING, syslog.LOG_INFO
 
-  opts, argv = getopt.getopt(sys.argv[1:], "hs:z?", ["help", "syslog=", "zero-nonce"] + main_dispatch.keys())
+  opts, argv = getopt.getopt(sys.argv[1:], "hs:z?", ["help", "scan-roas=", "scan-routercerts=",
+                                                     "syslog=", "zero-nonce"] + main_dispatch.keys())
   for o, a in opts:
     if o in ("-h", "--help", "-?"):
       usage()
@@ -2241,6 +2226,10 @@ if __name__ == "__main__":
           raise ValueError
       except:
         usage("Bad value specified for --syslog option")
+    elif o == "--scan-roas":
+      scan_roas = a
+    elif o == "--scan-routercerts":
+      scan_routercerts = a
     elif len(o) > 2 and o[2:] in main_dispatch:
       if mode is not None:
         sys.exit("Conflicting modes specified")
diff --git a/rtr-origin/rules.darwin.mk b/rp/rpki-rtr/rules.darwin.mk
index 1230db92..1230db92 100644
--- a/rtr-origin/rules.darwin.mk
+++ b/rp/rpki-rtr/rules.darwin.mk
diff --git a/rtr-origin/rules.freebsd.mk b/rp/rpki-rtr/rules.freebsd.mk
index df99da47..df99da47 100644
--- a/rtr-origin/rules.freebsd.mk
+++ b/rp/rpki-rtr/rules.freebsd.mk
diff --git a/rtr-origin/rules.linux.mk b/rp/rpki-rtr/rules.linux.mk
index 23f90f69..23f90f69 100644
--- a/rtr-origin/rules.linux.mk
+++ b/rp/rpki-rtr/rules.linux.mk
diff --git a/rtr-origin/rules.unknown.mk b/rp/rpki-rtr/rules.unknown.mk
index fb16e93a..fb16e93a 100644
--- a/rtr-origin/rules.unknown.mk
+++ b/rp/rpki-rtr/rules.unknown.mk
diff --git a/rtr-origin/server.sh b/rp/rpki-rtr/server.sh
index 7ccf2f38..7ccf2f38 100755
--- a/rtr-origin/server.sh
+++ b/rp/rpki-rtr/server.sh
diff --git a/rp/rpki-rtr/sshd.conf b/rp/rpki-rtr/sshd.conf
new file mode 100644
index 00000000..df32ca67
--- /dev/null
+++ b/rp/rpki-rtr/sshd.conf
@@ -0,0 +1,23 @@
+# $Id$
+#
+# sshd config file for testing.  Invoke thusly:
+#
+# /usr/sbin/sshd -f $top/rpki-rtr/sshd.conf -d
+
+Port					2222
+Protocol				2
+ListenAddress				127.0.0.1
+ListenAddress				::1
+HostKey					/u/sra/rpki/subvert-rpki.hactrn.net/rpki-rtr/ssh_host_rsa_key
+PermitRootLogin				no
+PubkeyAuthentication			yes
+AuthorizedKeysFile			/u/sra/rpki/subvert-rpki.hactrn.net/rpki-rtr/authorized_keys
+PasswordAuthentication			no
+PermitEmptyPasswords			no
+ChallengeResponseAuthentication		no
+UsePAM					no
+AllowTcpForwarding			no
+X11Forwarding				no
+UseDNS					no
+PidFile					/u/sra/rpki/subvert-rpki.hactrn.net/rpki-rtr/sshd.pid
+Subsystem		rpki-rtr	/u/sra/rpki/subvert-rpki.hactrn.net/rpki-rtr/server.sh
diff --git a/rp/utils/Makefile.in b/rp/utils/Makefile.in
new file mode 100644
index 00000000..b4a178ff
--- /dev/null
+++ b/rp/utils/Makefile.in
@@ -0,0 +1,82 @@
+# $Id$
+
+CFLAGS		= @CFLAGS@
+LDFLAGS		= @LDFLAGS@
+LIBS		= @LIBS@
+
+INSTALL		= @INSTALL@ -m 555 
+
+prefix		= @prefix@
+exec_prefix	= @exec_prefix@
+datarootdir	= @datarootdir@
+datadir		= @datadir@
+localstatedir	= @localstatedir@
+sharedstatedir	= @sharedstatedir@
+sysconfdir	= @sysconfdir@
+bindir		= @bindir@
+sbindir		= @sbindir@
+libexecdir	= @libexecdir@
+libdir		= @libdir@
+
+abs_top_srcdir	 = @abs_top_srcdir@
+abs_top_builddir = @abs_top_builddir@
+
+BINS		= find_roa hashdir print_rpki_manifest print_roa scan_roas uri
+
+SCRIPTS		= scan_routercerts find-roa-expiration
+
+all:: ${BINS}
+
+clean::
+	rm -rf ${BINS} *.o *.dSYM
+
+install:: all
+	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
+	${INSTALL} ${BINS} ${SCRIPTS} ${DESTDIR}${bindir}
+
+deinstall uninstall::
+	for i in ${BINS} ${SCRIPTS}; do rm -f ${DESTDIR}${bindir}/$$i; done
+
+distclean:: clean
+	rm -f Makefile
+
+find_roa: find_roa.c
+	${CC} ${CFLAGS} -o $@ find_roa.c ${LDFLAGS} ${LIBS}
+
+hashdir: hashdir.c
+	${CC} ${CFLAGS} -o $@ hashdir.c ${LDFLAGS} ${LIBS}
+
+print_roa: print_roa.c
+	${CC} ${CFLAGS} -o $@ print_roa.c ${LDFLAGS} ${LIBS}
+
+print_rpki_manifest: print_rpki_manifest.c
+	${CC} ${CFLAGS} -o $@ print_rpki_manifest.c ${LDFLAGS} ${LIBS}
+
+scan_roas: scan_roas.c
+	${CC} ${CFLAGS} -o $@ scan_roas.c ${LDFLAGS} ${LIBS}
+
+uri: uri.c
+	${CC} ${CFLAGS} -o $@ uri.c ${LDFLAGS} ${LIBS}
+
+# Tests
+
+RSYNC_AUTH_DIR	= ${abs_top_builddir}/rp/rcynic/rcynic-data/authenticated
+HASHDIR_OUTPUT	= hashed-pem-dir
+TARGET_PREFIXES	= 10.3.0.44 10.2.0.6 10.0.0.0/24
+
+test:: ${BINS} ${SCRIPTS}
+	if test -d ${RSYNC_AUTH_DIR}; \
+	then \
+	    rm -rf ${HASHDIR_OUTPUT} ; \
+	    mkdir  ${HASHDIR_OUTPUT} ; \
+	    ./hashdir  ${RSYNC_AUTH_DIR} ${HASHDIR_OUTPUT}; \
+	    ./find_roa ${RSYNC_AUTH_DIR} ${TARGET_PREFIXES} ; \
+	    date -u +'now:            %Y%m%d%H%M%SZ' || : ; \
+	    find ${RSYNC_AUTH_DIR} -type f -name '*.roa' -print -exec ./print_roa           {} \; ; \
+	    find ${RSYNC_AUTH_DIR} -type f -name '*.mft' -print -exec ./print_rpki_manifest {} \; ; \
+	    ./scan_roas        ${RSYNC_AUTH_DIR} ; \
+	    ./scan_routercerts ${RSYNC_AUTH_DIR} ; \
+	fi
+
+clean::
+	rm -rf ${HASHDIR_OUTPUT}
diff --git a/utils/README b/rp/utils/README
index edbd793b..edbd793b 100644
--- a/utils/README
+++ b/rp/utils/README
diff --git a/utils/uri/dot.awk b/rp/utils/dot.awk
index ca1b490b..ca1b490b 100644
--- a/utils/uri/dot.awk
+++ b/rp/utils/dot.awk
diff --git a/scripts/find-roa-expiration.py b/rp/utils/find-roa-expiration
index 1401dc42..1401dc42 100644..100755
--- a/scripts/find-roa-expiration.py
+++ b/rp/utils/find-roa-expiration
diff --git a/utils/find_roa/find_roa.c b/rp/utils/find_roa.c
index a14242c8..a14242c8 100644
--- a/utils/find_roa/find_roa.c
+++ b/rp/utils/find_roa.c
diff --git a/utils/hashdir/hashdir.c b/rp/utils/hashdir.c
index 1b5b0f46..1b5b0f46 100644
--- a/utils/hashdir/hashdir.c
+++ b/rp/utils/hashdir.c
diff --git a/utils/print_roa/print_roa.c b/rp/utils/print_roa.c
index c88fc092..c88fc092 100644
--- a/utils/print_roa/print_roa.c
+++ b/rp/utils/print_roa.c
diff --git a/utils/print_rpki_manifest/print_rpki_manifest.c b/rp/utils/print_rpki_manifest.c
index f55f9916..f55f9916 100644
--- a/utils/print_rpki_manifest/print_rpki_manifest.c
+++ b/rp/utils/print_rpki_manifest.c
diff --git a/rp/utils/rpki b/rp/utils/rpki
new file mode 120000
index 00000000..d39d05b6
--- /dev/null
+++ b/rp/utils/rpki
@@ -0,0 +1 @@
+../../rpki
\ No newline at end of file
diff --git a/utils/scan_roas/scan_roas.c b/rp/utils/scan_roas.c
index f32e3827..f32e3827 100644
--- a/utils/scan_roas/scan_roas.c
+++ b/rp/utils/scan_roas.c
diff --git a/utils/scan_routercerts/scan_routercerts b/rp/utils/scan_routercerts
index 342fa272..342fa272 100755
--- a/utils/scan_routercerts/scan_routercerts
+++ b/rp/utils/scan_routercerts
diff --git a/utils/print_roa/strip_roa.sh b/rp/utils/strip_roa.sh
index e2dacf86..e2dacf86 100755
--- a/utils/print_roa/strip_roa.sh
+++ b/rp/utils/strip_roa.sh
diff --git a/utils/uri/table.awk b/rp/utils/table.awk
index d8627f67..d8627f67 100644
--- a/utils/uri/table.awk
+++ b/rp/utils/table.awk
diff --git a/utils/find_roa/test_roa.sh b/rp/utils/test_roa.sh
index 43d20898..43d20898 100644
--- a/utils/find_roa/test_roa.sh
+++ b/rp/utils/test_roa.sh
diff --git a/utils/uri/uri.c b/rp/utils/uri.c
index 6353e8e5..6353e8e5 100644
--- a/utils/uri/uri.c
+++ b/rp/utils/uri.c
diff --git a/rpkid/rpki/POW/__init__.py b/rpki/POW/__init__.py
index d3796245..d3796245 100644
--- a/rpkid/rpki/POW/__init__.py
+++ b/rpki/POW/__init__.py
diff --git a/rpkid/rpki/__init__.py b/rpki/__init__.py
index 9e090f63..9e090f63 100644
--- a/rpkid/rpki/__init__.py
+++ b/rpki/__init__.py
diff --git a/rpkid/rpki/adns.py b/rpki/adns.py
index a6a900ed..a6a900ed 100644
--- a/rpkid/rpki/adns.py
+++ b/rpki/adns.py
diff --git a/rpkid/rpki/async.py b/rpki/async.py
index 49f98841..49f98841 100644
--- a/rpkid/rpki/async.py
+++ b/rpki/async.py
diff --git a/rpkid/rpki/cli.py b/rpki/cli.py
index 1930f2b7..1930f2b7 100644
--- a/rpkid/rpki/cli.py
+++ b/rpki/cli.py
diff --git a/rpkid/rpki/config.py b/rpki/config.py
index 9f26664e..9f26664e 100644
--- a/rpkid/rpki/config.py
+++ b/rpki/config.py
diff --git a/rpkid/rpki/csv_utils.py b/rpki/csv_utils.py
index 47caabdb..47caabdb 100644
--- a/rpkid/rpki/csv_utils.py
+++ b/rpki/csv_utils.py
diff --git a/rpkid/rpki/daemonize.py b/rpki/daemonize.py
index 62b4ee4e..62b4ee4e 100644
--- a/rpkid/rpki/daemonize.py
+++ b/rpki/daemonize.py
diff --git a/rpkid/rpki/exceptions.py b/rpki/exceptions.py
index d8d3774e..d8d3774e 100644
--- a/rpkid/rpki/exceptions.py
+++ b/rpki/exceptions.py
diff --git a/rpkid/rpki/gui/__init__.py b/rpki/gui/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/__init__.py
+++ b/rpki/gui/__init__.py
diff --git a/rpkid/rpki/gui/api/__init__.py b/rpki/gui/api/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/api/__init__.py
+++ b/rpki/gui/api/__init__.py
diff --git a/rpkid/rpki/gui/api/urls.py b/rpki/gui/api/urls.py
index 8c9d824c..8c9d824c 100644
--- a/rpkid/rpki/gui/api/urls.py
+++ b/rpki/gui/api/urls.py
diff --git a/rpkid/rpki/gui/app/TODO b/rpki/gui/app/TODO
index b7136397..b7136397 100644
--- a/rpkid/rpki/gui/app/TODO
+++ b/rpki/gui/app/TODO
diff --git a/rpkid/rpki/gui/app/__init__.py b/rpki/gui/app/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/app/__init__.py
+++ b/rpki/gui/app/__init__.py
diff --git a/rpkid/rpki/gui/app/admin.py b/rpki/gui/app/admin.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/app/admin.py
+++ b/rpki/gui/app/admin.py
diff --git a/rpkid/rpki/gui/app/check_expired.py b/rpki/gui/app/check_expired.py
index fcf5ecae..fcf5ecae 100644
--- a/rpkid/rpki/gui/app/check_expired.py
+++ b/rpki/gui/app/check_expired.py
diff --git a/rpkid/rpki/gui/app/forms.py b/rpki/gui/app/forms.py
index 20ce4a07..20ce4a07 100644
--- a/rpkid/rpki/gui/app/forms.py
+++ b/rpki/gui/app/forms.py
diff --git a/rpkid/rpki/gui/app/glue.py b/rpki/gui/app/glue.py
index a9f6441e..a9f6441e 100644
--- a/rpkid/rpki/gui/app/glue.py
+++ b/rpki/gui/app/glue.py
diff --git a/rpkid/rpki/gui/app/migrations/0001_initial.py b/rpki/gui/app/migrations/0001_initial.py
index 80877901..80877901 100644
--- a/rpkid/rpki/gui/app/migrations/0001_initial.py
+++ b/rpki/gui/app/migrations/0001_initial.py
diff --git a/rpkid/rpki/gui/app/migrations/0002_auto__add_field_resourcecert_conf.py b/rpki/gui/app/migrations/0002_auto__add_field_resourcecert_conf.py
index d3326f90..d3326f90 100644
--- a/rpkid/rpki/gui/app/migrations/0002_auto__add_field_resourcecert_conf.py
+++ b/rpki/gui/app/migrations/0002_auto__add_field_resourcecert_conf.py
diff --git a/rpkid/rpki/gui/app/migrations/0003_set_conf_from_parent.py b/rpki/gui/app/migrations/0003_set_conf_from_parent.py
index a90a11cc..a90a11cc 100644
--- a/rpkid/rpki/gui/app/migrations/0003_set_conf_from_parent.py
+++ b/rpki/gui/app/migrations/0003_set_conf_from_parent.py
diff --git a/rpkid/rpki/gui/app/migrations/0004_auto__chg_field_resourcecert_conf.py b/rpki/gui/app/migrations/0004_auto__chg_field_resourcecert_conf.py
index a236ad4a..a236ad4a 100644
--- a/rpkid/rpki/gui/app/migrations/0004_auto__chg_field_resourcecert_conf.py
+++ b/rpki/gui/app/migrations/0004_auto__chg_field_resourcecert_conf.py
diff --git a/rpkid/rpki/gui/app/migrations/0005_auto__chg_field_resourcecert_parent.py b/rpki/gui/app/migrations/0005_auto__chg_field_resourcecert_parent.py
index 11e9c814..11e9c814 100644
--- a/rpkid/rpki/gui/app/migrations/0005_auto__chg_field_resourcecert_parent.py
+++ b/rpki/gui/app/migrations/0005_auto__chg_field_resourcecert_parent.py
diff --git a/rpkid/rpki/gui/app/migrations/0006_add_conf_acl.py b/rpki/gui/app/migrations/0006_add_conf_acl.py
index 88fe8171..88fe8171 100644
--- a/rpkid/rpki/gui/app/migrations/0006_add_conf_acl.py
+++ b/rpki/gui/app/migrations/0006_add_conf_acl.py
diff --git a/rpkid/rpki/gui/app/migrations/0007_default_acls.py b/rpki/gui/app/migrations/0007_default_acls.py
index 40656d0f..40656d0f 100644
--- a/rpkid/rpki/gui/app/migrations/0007_default_acls.py
+++ b/rpki/gui/app/migrations/0007_default_acls.py
diff --git a/rpkid/rpki/gui/app/migrations/0008_add_alerts.py b/rpki/gui/app/migrations/0008_add_alerts.py
index 77af68d2..77af68d2 100644
--- a/rpkid/rpki/gui/app/migrations/0008_add_alerts.py
+++ b/rpki/gui/app/migrations/0008_add_alerts.py
diff --git a/rpkid/rpki/gui/app/migrations/__init__.py b/rpki/gui/app/migrations/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/app/migrations/__init__.py
+++ b/rpki/gui/app/migrations/__init__.py
diff --git a/rpkid/rpki/gui/app/models.py b/rpki/gui/app/models.py
index 7d643fdc..7d643fdc 100644
--- a/rpkid/rpki/gui/app/models.py
+++ b/rpki/gui/app/models.py
diff --git a/rpkid/rpki/gui/app/range_list.py b/rpki/gui/app/range_list.py
index 21fd1f29..21fd1f29 100755
--- a/rpkid/rpki/gui/app/range_list.py
+++ b/rpki/gui/app/range_list.py
diff --git a/rpkid/rpki/gui/app/static/css/bootstrap.min.css b/rpki/gui/app/static/css/bootstrap.min.css
index c10c7f41..c10c7f41 100644
--- a/rpkid/rpki/gui/app/static/css/bootstrap.min.css
+++ b/rpki/gui/app/static/css/bootstrap.min.css
diff --git a/rpkid/rpki/gui/app/static/img/glyphicons-halflings-white.png b/rpki/gui/app/static/img/glyphicons-halflings-white.png
index 3bf6484a..3bf6484a 100644
--- a/rpkid/rpki/gui/app/static/img/glyphicons-halflings-white.png
+++ b/rpki/gui/app/static/img/glyphicons-halflings-white.png
diff --git a/rpkid/rpki/gui/app/static/img/glyphicons-halflings.png b/rpki/gui/app/static/img/glyphicons-halflings.png
index a9969993..a9969993 100644
--- a/rpkid/rpki/gui/app/static/img/glyphicons-halflings.png
+++ b/rpki/gui/app/static/img/glyphicons-halflings.png
diff --git a/rpkid/rpki/gui/app/static/img/sui-riu.ico b/rpki/gui/app/static/img/sui-riu.ico
index 61223e27..61223e27 100644
--- a/rpkid/rpki/gui/app/static/img/sui-riu.ico
+++ b/rpki/gui/app/static/img/sui-riu.ico
diff --git a/rpkid/rpki/gui/app/static/js/bootstrap.min.js b/rpki/gui/app/static/js/bootstrap.min.js
index 95c5ac5e..95c5ac5e 100644
--- a/rpkid/rpki/gui/app/static/js/bootstrap.min.js
+++ b/rpki/gui/app/static/js/bootstrap.min.js
diff --git a/rpkid/rpki/gui/app/static/js/jquery-1.8.3.min.js b/rpki/gui/app/static/js/jquery-1.8.3.min.js
index 83589daa..83589daa 100644
--- a/rpkid/rpki/gui/app/static/js/jquery-1.8.3.min.js
+++ b/rpki/gui/app/static/js/jquery-1.8.3.min.js
diff --git a/rpkid/rpki/gui/app/templates/404.html b/rpki/gui/app/templates/404.html
index 76ef3aee..76ef3aee 100644
--- a/rpkid/rpki/gui/app/templates/404.html
+++ b/rpki/gui/app/templates/404.html
diff --git a/rpkid/rpki/gui/app/templates/500.html b/rpki/gui/app/templates/500.html
index 216fe8ae..216fe8ae 100644
--- a/rpkid/rpki/gui/app/templates/500.html
+++ b/rpki/gui/app/templates/500.html
diff --git a/rpkid/rpki/gui/app/templates/app/alert_confirm_clear.html b/rpki/gui/app/templates/app/alert_confirm_clear.html
index 5d7fcf04..5d7fcf04 100644
--- a/rpkid/rpki/gui/app/templates/app/alert_confirm_clear.html
+++ b/rpki/gui/app/templates/app/alert_confirm_clear.html
diff --git a/rpkid/rpki/gui/app/templates/app/alert_confirm_delete.html b/rpki/gui/app/templates/app/alert_confirm_delete.html
index 78c84917..78c84917 100644
--- a/rpkid/rpki/gui/app/templates/app/alert_confirm_delete.html
+++ b/rpki/gui/app/templates/app/alert_confirm_delete.html
diff --git a/rpkid/rpki/gui/app/templates/app/alert_detail.html b/rpki/gui/app/templates/app/alert_detail.html
index b3a73b7e..b3a73b7e 100644
--- a/rpkid/rpki/gui/app/templates/app/alert_detail.html
+++ b/rpki/gui/app/templates/app/alert_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/alert_list.html b/rpki/gui/app/templates/app/alert_list.html
index dd0530e4..dd0530e4 100644
--- a/rpkid/rpki/gui/app/templates/app/alert_list.html
+++ b/rpki/gui/app/templates/app/alert_list.html
diff --git a/rpkid/rpki/gui/app/templates/app/app_base.html b/rpki/gui/app/templates/app/app_base.html
index 4fb5f731..4fb5f731 100644
--- a/rpkid/rpki/gui/app/templates/app/app_base.html
+++ b/rpki/gui/app/templates/app/app_base.html
diff --git a/rpkid/rpki/gui/app/templates/app/app_confirm_delete.html b/rpki/gui/app/templates/app/app_confirm_delete.html
index 7c35a733..7c35a733 100644
--- a/rpkid/rpki/gui/app/templates/app/app_confirm_delete.html
+++ b/rpki/gui/app/templates/app/app_confirm_delete.html
diff --git a/rpkid/rpki/gui/app/templates/app/app_form.html b/rpki/gui/app/templates/app/app_form.html
index b6ab60a2..b6ab60a2 100644
--- a/rpkid/rpki/gui/app/templates/app/app_form.html
+++ b/rpki/gui/app/templates/app/app_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/bootstrap_form.html b/rpki/gui/app/templates/app/bootstrap_form.html
index c6fd5424..c6fd5424 100644
--- a/rpkid/rpki/gui/app/templates/app/bootstrap_form.html
+++ b/rpki/gui/app/templates/app/bootstrap_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/child_detail.html b/rpki/gui/app/templates/app/child_detail.html
index 8178e179..8178e179 100644
--- a/rpkid/rpki/gui/app/templates/app/child_detail.html
+++ b/rpki/gui/app/templates/app/child_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/client_detail.html b/rpki/gui/app/templates/app/client_detail.html
index 3117e859..3117e859 100644
--- a/rpkid/rpki/gui/app/templates/app/client_detail.html
+++ b/rpki/gui/app/templates/app/client_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/client_list.html b/rpki/gui/app/templates/app/client_list.html
index 12987c53..12987c53 100644
--- a/rpkid/rpki/gui/app/templates/app/client_list.html
+++ b/rpki/gui/app/templates/app/client_list.html
diff --git a/rpkid/rpki/gui/app/templates/app/conf_empty.html b/rpki/gui/app/templates/app/conf_empty.html
index efe06f14..efe06f14 100644
--- a/rpkid/rpki/gui/app/templates/app/conf_empty.html
+++ b/rpki/gui/app/templates/app/conf_empty.html
diff --git a/rpkid/rpki/gui/app/templates/app/conf_list.html b/rpki/gui/app/templates/app/conf_list.html
index dce6d59e..dce6d59e 100644
--- a/rpkid/rpki/gui/app/templates/app/conf_list.html
+++ b/rpki/gui/app/templates/app/conf_list.html
diff --git a/rpkid/rpki/gui/app/templates/app/dashboard.html b/rpki/gui/app/templates/app/dashboard.html
index 65dbb90f..65dbb90f 100644
--- a/rpkid/rpki/gui/app/templates/app/dashboard.html
+++ b/rpki/gui/app/templates/app/dashboard.html
diff --git a/rpkid/rpki/gui/app/templates/app/ghostbuster_confirm_delete.html b/rpki/gui/app/templates/app/ghostbuster_confirm_delete.html
index 76b1d25a..76b1d25a 100644
--- a/rpkid/rpki/gui/app/templates/app/ghostbuster_confirm_delete.html
+++ b/rpki/gui/app/templates/app/ghostbuster_confirm_delete.html
diff --git a/rpkid/rpki/gui/app/templates/app/ghostbusterrequest_detail.html b/rpki/gui/app/templates/app/ghostbusterrequest_detail.html
index 296f0f16..296f0f16 100644
--- a/rpkid/rpki/gui/app/templates/app/ghostbusterrequest_detail.html
+++ b/rpki/gui/app/templates/app/ghostbusterrequest_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/import_resource_form.html b/rpki/gui/app/templates/app/import_resource_form.html
index e446d344..e446d344 100644
--- a/rpkid/rpki/gui/app/templates/app/import_resource_form.html
+++ b/rpki/gui/app/templates/app/import_resource_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/object_confirm_delete.html b/rpki/gui/app/templates/app/object_confirm_delete.html
index c4af9b26..c4af9b26 100644
--- a/rpkid/rpki/gui/app/templates/app/object_confirm_delete.html
+++ b/rpki/gui/app/templates/app/object_confirm_delete.html
diff --git a/rpkid/rpki/gui/app/templates/app/parent_detail.html b/rpki/gui/app/templates/app/parent_detail.html
index 4dd1842f..4dd1842f 100644
--- a/rpkid/rpki/gui/app/templates/app/parent_detail.html
+++ b/rpki/gui/app/templates/app/parent_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/pubclient_list.html b/rpki/gui/app/templates/app/pubclient_list.html
index 1872e005..1872e005 100644
--- a/rpkid/rpki/gui/app/templates/app/pubclient_list.html
+++ b/rpki/gui/app/templates/app/pubclient_list.html
diff --git a/rpkid/rpki/gui/app/templates/app/repository_detail.html b/rpki/gui/app/templates/app/repository_detail.html
index 92a43e54..92a43e54 100644
--- a/rpkid/rpki/gui/app/templates/app/repository_detail.html
+++ b/rpki/gui/app/templates/app/repository_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/resource_holder_list.html b/rpki/gui/app/templates/app/resource_holder_list.html
index 6525e74d..6525e74d 100644
--- a/rpkid/rpki/gui/app/templates/app/resource_holder_list.html
+++ b/rpki/gui/app/templates/app/resource_holder_list.html
diff --git a/rpkid/rpki/gui/app/templates/app/roa_detail.html b/rpki/gui/app/templates/app/roa_detail.html
index ec76579d..ec76579d 100644
--- a/rpkid/rpki/gui/app/templates/app/roa_detail.html
+++ b/rpki/gui/app/templates/app/roa_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/roarequest_confirm_delete.html b/rpki/gui/app/templates/app/roarequest_confirm_delete.html
index 7dc3ec2b..7dc3ec2b 100644
--- a/rpkid/rpki/gui/app/templates/app/roarequest_confirm_delete.html
+++ b/rpki/gui/app/templates/app/roarequest_confirm_delete.html
diff --git a/rpkid/rpki/gui/app/templates/app/roarequest_confirm_form.html b/rpki/gui/app/templates/app/roarequest_confirm_form.html
index 446bb6a4..446bb6a4 100644
--- a/rpkid/rpki/gui/app/templates/app/roarequest_confirm_form.html
+++ b/rpki/gui/app/templates/app/roarequest_confirm_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/roarequest_confirm_multi_form.html b/rpki/gui/app/templates/app/roarequest_confirm_multi_form.html
index 4a06a4aa..4a06a4aa 100644
--- a/rpkid/rpki/gui/app/templates/app/roarequest_confirm_multi_form.html
+++ b/rpki/gui/app/templates/app/roarequest_confirm_multi_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/roarequest_form.html b/rpki/gui/app/templates/app/roarequest_form.html
index 3a29131d..3a29131d 100644
--- a/rpkid/rpki/gui/app/templates/app/roarequest_form.html
+++ b/rpki/gui/app/templates/app/roarequest_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/roarequest_multi_form.html b/rpki/gui/app/templates/app/roarequest_multi_form.html
index 06d07943..06d07943 100644
--- a/rpkid/rpki/gui/app/templates/app/roarequest_multi_form.html
+++ b/rpki/gui/app/templates/app/roarequest_multi_form.html
diff --git a/rpkid/rpki/gui/app/templates/app/route_detail.html b/rpki/gui/app/templates/app/route_detail.html
index 84add4a8..84add4a8 100644
--- a/rpkid/rpki/gui/app/templates/app/route_detail.html
+++ b/rpki/gui/app/templates/app/route_detail.html
diff --git a/rpkid/rpki/gui/app/templates/app/routes_view.html b/rpki/gui/app/templates/app/routes_view.html
index 885f3fa9..885f3fa9 100644
--- a/rpkid/rpki/gui/app/templates/app/routes_view.html
+++ b/rpki/gui/app/templates/app/routes_view.html
diff --git a/rpkid/rpki/gui/app/templates/app/user_list.html b/rpki/gui/app/templates/app/user_list.html
index 1b419ded..1b419ded 100644
--- a/rpkid/rpki/gui/app/templates/app/user_list.html
+++ b/rpki/gui/app/templates/app/user_list.html
diff --git a/rpkid/rpki/gui/app/templates/base.html b/rpki/gui/app/templates/base.html
index 08d0c112..08d0c112 100644
--- a/rpkid/rpki/gui/app/templates/base.html
+++ b/rpki/gui/app/templates/base.html
diff --git a/rpkid/rpki/gui/app/templates/registration/login.html b/rpki/gui/app/templates/registration/login.html
index 18b66b55..18b66b55 100644
--- a/rpkid/rpki/gui/app/templates/registration/login.html
+++ b/rpki/gui/app/templates/registration/login.html
diff --git a/rpkid/rpki/gui/app/templates/registration/password_reset_complete.html b/rpki/gui/app/templates/registration/password_reset_complete.html
index d60c6b09..d60c6b09 100644
--- a/rpkid/rpki/gui/app/templates/registration/password_reset_complete.html
+++ b/rpki/gui/app/templates/registration/password_reset_complete.html
diff --git a/rpkid/rpki/gui/app/templates/registration/password_reset_confirm.html b/rpki/gui/app/templates/registration/password_reset_confirm.html
index a577f12d..a577f12d 100644
--- a/rpkid/rpki/gui/app/templates/registration/password_reset_confirm.html
+++ b/rpki/gui/app/templates/registration/password_reset_confirm.html
diff --git a/rpkid/rpki/gui/app/templates/registration/password_reset_done.html b/rpki/gui/app/templates/registration/password_reset_done.html
index c0584f86..c0584f86 100644
--- a/rpkid/rpki/gui/app/templates/registration/password_reset_done.html
+++ b/rpki/gui/app/templates/registration/password_reset_done.html
diff --git a/rpkid/rpki/gui/app/templates/registration/password_reset_email.html b/rpki/gui/app/templates/registration/password_reset_email.html
index 0c4a5672..0c4a5672 100644
--- a/rpkid/rpki/gui/app/templates/registration/password_reset_email.html
+++ b/rpki/gui/app/templates/registration/password_reset_email.html
diff --git a/rpkid/rpki/gui/app/templates/registration/password_reset_form.html b/rpki/gui/app/templates/registration/password_reset_form.html
index 12f1d624..12f1d624 100644
--- a/rpkid/rpki/gui/app/templates/registration/password_reset_form.html
+++ b/rpki/gui/app/templates/registration/password_reset_form.html
diff --git a/rpkid/rpki/gui/app/templatetags/__init__.py b/rpki/gui/app/templatetags/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/app/templatetags/__init__.py
+++ b/rpki/gui/app/templatetags/__init__.py
diff --git a/rpkid/rpki/gui/app/templatetags/app_extras.py b/rpki/gui/app/templatetags/app_extras.py
index 2bde9bc2..2bde9bc2 100644
--- a/rpkid/rpki/gui/app/templatetags/app_extras.py
+++ b/rpki/gui/app/templatetags/app_extras.py
diff --git a/rpkid/rpki/gui/app/templatetags/bootstrap_pager.py b/rpki/gui/app/templatetags/bootstrap_pager.py
index bae8445a..bae8445a 100644
--- a/rpkid/rpki/gui/app/templatetags/bootstrap_pager.py
+++ b/rpki/gui/app/templatetags/bootstrap_pager.py
diff --git a/rpkid/rpki/gui/app/timestamp.py b/rpki/gui/app/timestamp.py
index 959f2025..959f2025 100644
--- a/rpkid/rpki/gui/app/timestamp.py
+++ b/rpki/gui/app/timestamp.py
diff --git a/rpkid/rpki/gui/app/urls.py b/rpki/gui/app/urls.py
index a86611a7..a86611a7 100644
--- a/rpkid/rpki/gui/app/urls.py
+++ b/rpki/gui/app/urls.py
diff --git a/rpkid/rpki/gui/app/views.py b/rpki/gui/app/views.py
index db4cf0c1..db4cf0c1 100644
--- a/rpkid/rpki/gui/app/views.py
+++ b/rpki/gui/app/views.py
diff --git a/rpkid/rpki/gui/cacheview/__init__.py b/rpki/gui/cacheview/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/cacheview/__init__.py
+++ b/rpki/gui/cacheview/__init__.py
diff --git a/rpkid/rpki/gui/cacheview/forms.py b/rpki/gui/cacheview/forms.py
index 28b8ff24..28b8ff24 100644
--- a/rpkid/rpki/gui/cacheview/forms.py
+++ b/rpki/gui/cacheview/forms.py
diff --git a/rpkid/rpki/gui/cacheview/misc.py b/rpki/gui/cacheview/misc.py
index 9a69645c..9a69645c 100644
--- a/rpkid/rpki/gui/cacheview/misc.py
+++ b/rpki/gui/cacheview/misc.py
diff --git a/rpkid/rpki/gui/cacheview/models.py b/rpki/gui/cacheview/models.py
index c3ee8421..c3ee8421 100644
--- a/rpkid/rpki/gui/cacheview/models.py
+++ b/rpki/gui/cacheview/models.py
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/addressrange_detail.html b/rpki/gui/cacheview/templates/cacheview/addressrange_detail.html
index 76edc1ba..76edc1ba 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/addressrange_detail.html
+++ b/rpki/gui/cacheview/templates/cacheview/addressrange_detail.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/cacheview_base.html b/rpki/gui/cacheview/templates/cacheview/cacheview_base.html
index ec71d740..ec71d740 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/cacheview_base.html
+++ b/rpki/gui/cacheview/templates/cacheview/cacheview_base.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/cert_detail.html b/rpki/gui/cacheview/templates/cacheview/cert_detail.html
index 256e7780..256e7780 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/cert_detail.html
+++ b/rpki/gui/cacheview/templates/cacheview/cert_detail.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/ghostbuster_detail.html b/rpki/gui/cacheview/templates/cacheview/ghostbuster_detail.html
index 4215f757..4215f757 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/ghostbuster_detail.html
+++ b/rpki/gui/cacheview/templates/cacheview/ghostbuster_detail.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/global_summary.html b/rpki/gui/cacheview/templates/cacheview/global_summary.html
index 0dbd0ffc..0dbd0ffc 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/global_summary.html
+++ b/rpki/gui/cacheview/templates/cacheview/global_summary.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/query_result.html b/rpki/gui/cacheview/templates/cacheview/query_result.html
index 0694c531..0694c531 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/query_result.html
+++ b/rpki/gui/cacheview/templates/cacheview/query_result.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/roa_detail.html b/rpki/gui/cacheview/templates/cacheview/roa_detail.html
index 39cc547b..39cc547b 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/roa_detail.html
+++ b/rpki/gui/cacheview/templates/cacheview/roa_detail.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/search_form.html b/rpki/gui/cacheview/templates/cacheview/search_form.html
index 1141615d..1141615d 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/search_form.html
+++ b/rpki/gui/cacheview/templates/cacheview/search_form.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/search_result.html b/rpki/gui/cacheview/templates/cacheview/search_result.html
index 7cbf852e..7cbf852e 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/search_result.html
+++ b/rpki/gui/cacheview/templates/cacheview/search_result.html
diff --git a/rpkid/rpki/gui/cacheview/templates/cacheview/signedobject_detail.html b/rpki/gui/cacheview/templates/cacheview/signedobject_detail.html
index 22ae3d27..22ae3d27 100644
--- a/rpkid/rpki/gui/cacheview/templates/cacheview/signedobject_detail.html
+++ b/rpki/gui/cacheview/templates/cacheview/signedobject_detail.html
diff --git a/rpkid/rpki/gui/cacheview/tests.py b/rpki/gui/cacheview/tests.py
index 2247054b..2247054b 100644
--- a/rpkid/rpki/gui/cacheview/tests.py
+++ b/rpki/gui/cacheview/tests.py
diff --git a/rpkid/rpki/gui/cacheview/urls.py b/rpki/gui/cacheview/urls.py
index cc03a587..cc03a587 100644
--- a/rpkid/rpki/gui/cacheview/urls.py
+++ b/rpki/gui/cacheview/urls.py
diff --git a/rpkid/rpki/gui/cacheview/util.py b/rpki/gui/cacheview/util.py
index 0d3d7ae3..0d3d7ae3 100644
--- a/rpkid/rpki/gui/cacheview/util.py
+++ b/rpki/gui/cacheview/util.py
diff --git a/rpkid/rpki/gui/cacheview/views.py b/rpki/gui/cacheview/views.py
index 94870eb2..94870eb2 100644
--- a/rpkid/rpki/gui/cacheview/views.py
+++ b/rpki/gui/cacheview/views.py
diff --git a/rpkid/rpki/gui/decorators.py b/rpki/gui/decorators.py
index 69d20c46..69d20c46 100644
--- a/rpkid/rpki/gui/decorators.py
+++ b/rpki/gui/decorators.py
diff --git a/rpkid/rpki/gui/default_settings.py b/rpki/gui/default_settings.py
index 3859247c..3859247c 100644
--- a/rpkid/rpki/gui/default_settings.py
+++ b/rpki/gui/default_settings.py
diff --git a/rpkid/rpki/gui/models.py b/rpki/gui/models.py
index 7a684f32..7a684f32 100644
--- a/rpkid/rpki/gui/models.py
+++ b/rpki/gui/models.py
diff --git a/rpkid/rpki/gui/routeview/__init__.py b/rpki/gui/routeview/__init__.py
index e69de29b..e69de29b 100644
--- a/rpkid/rpki/gui/routeview/__init__.py
+++ b/rpki/gui/routeview/__init__.py
diff --git a/rpkid/rpki/gui/routeview/api.py b/rpki/gui/routeview/api.py
index cf699c9a..cf699c9a 100644
--- a/rpkid/rpki/gui/routeview/api.py
+++ b/rpki/gui/routeview/api.py
diff --git a/rpkid/rpki/gui/routeview/models.py b/rpki/gui/routeview/models.py
index 052860c4..052860c4 100644
--- a/rpkid/rpki/gui/routeview/models.py
+++ b/rpki/gui/routeview/models.py
diff --git a/rpkid/rpki/gui/routeview/util.py b/rpki/gui/routeview/util.py
index 7884224c..7884224c 100644
--- a/rpkid/rpki/gui/routeview/util.py
+++ b/rpki/gui/routeview/util.py
diff --git a/rpkid/rpki/gui/script_util.py b/rpki/gui/script_util.py
index c3a864fd..c3a864fd 100644
--- a/rpkid/rpki/gui/script_util.py
+++ b/rpki/gui/script_util.py
diff --git a/rpkid/rpki/gui/urls.py b/rpki/gui/urls.py
index 955092f5..955092f5 100644
--- a/rpkid/rpki/gui/urls.py
+++ b/rpki/gui/urls.py
diff --git a/rpkid/rpki/gui/views.py b/rpki/gui/views.py
index 404d6c7e..404d6c7e 100644
--- a/rpkid/rpki/gui/views.py
+++ b/rpki/gui/views.py
diff --git a/rpkid/rpki/http.py b/rpki/http.py
index 3c541f26..3c541f26 100644
--- a/rpkid/rpki/http.py
+++ b/rpki/http.py
diff --git a/rpkid/rpki/ipaddrs.py b/rpki/ipaddrs.py
index c1855302..c1855302 100644
--- a/rpkid/rpki/ipaddrs.py
+++ b/rpki/ipaddrs.py
diff --git a/rpkid/rpki/irdb/__init__.py b/rpki/irdb/__init__.py
index cc83387e..cc83387e 100644
--- a/rpkid/rpki/irdb/__init__.py
+++ b/rpki/irdb/__init__.py
diff --git a/rpkid/rpki/irdb/models.py b/rpki/irdb/models.py
index 1ad9b4e3..1ad9b4e3 100644
--- a/rpkid/rpki/irdb/models.py
+++ b/rpki/irdb/models.py
diff --git a/rpkid/rpki/irdb/router.py b/rpki/irdb/router.py
index 1f27d0c9..1f27d0c9 100644
--- a/rpkid/rpki/irdb/router.py
+++ b/rpki/irdb/router.py
diff --git a/rpkid/rpki/irdb/zookeeper.py b/rpki/irdb/zookeeper.py
index f99dc9f0..f99dc9f0 100644
--- a/rpkid/rpki/irdb/zookeeper.py
+++ b/rpki/irdb/zookeeper.py
diff --git a/rpkid/rpki/irdbd.py b/rpki/irdbd.py
index 41739dc4..41739dc4 100644
--- a/rpkid/rpki/irdbd.py
+++ b/rpki/irdbd.py
diff --git a/rpkid/rpki/left_right.py b/rpki/left_right.py
index 2d46cdfa..2d46cdfa 100644
--- a/rpkid/rpki/left_right.py
+++ b/rpki/left_right.py
diff --git a/rpkid/rpki/log.py b/rpki/log.py
index c605331a..c605331a 100644
--- a/rpkid/rpki/log.py
+++ b/rpki/log.py
diff --git a/rpkid/rpki/myrpki.py b/rpki/myrpki.py
index c5c7990f..c5c7990f 100644
--- a/rpkid/rpki/myrpki.py
+++ b/rpki/myrpki.py
diff --git a/rpkid/rpki/mysql_import.py b/rpki/mysql_import.py
index 88d30357..88d30357 100644
--- a/rpkid/rpki/mysql_import.py
+++ b/rpki/mysql_import.py
diff --git a/rpkid/rpki/oids.py b/rpki/oids.py
index a97df6a7..a97df6a7 100644
--- a/rpkid/rpki/oids.py
+++ b/rpki/oids.py
diff --git a/rpkid/rpki/old_irdbd.py b/rpki/old_irdbd.py
index 41060344..41060344 100644
--- a/rpkid/rpki/old_irdbd.py
+++ b/rpki/old_irdbd.py
diff --git a/rpkid/rpki/pubd.py b/rpki/pubd.py
index 31f22ed4..31f22ed4 100644
--- a/rpkid/rpki/pubd.py
+++ b/rpki/pubd.py
diff --git a/rpkid/rpki/publication.py b/rpki/publication.py
index 2462ae39..2462ae39 100644
--- a/rpkid/rpki/publication.py
+++ b/rpki/publication.py
diff --git a/rpkid/rpki/rcynic.py b/rpki/rcynic.py
index 73394fb8..73394fb8 100644
--- a/rpkid/rpki/rcynic.py
+++ b/rpki/rcynic.py
diff --git a/rpkid/rpki/relaxng.py b/rpki/relaxng.py
index 0d8c0d64..3dcf3d4f 100644
--- a/rpkid/rpki/relaxng.py
+++ b/rpki/relaxng.py
@@ -6,7 +6,7 @@ import lxml.etree
 ## Parsed RelaxNG left_right schema
 left_right = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: left-right-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: left-right-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for RPKI left-right protocol.
   
@@ -1095,277 +1095,379 @@ left_right = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" en
 -->
 '''))
 
-## @var up_down
-## Parsed RelaxNG up_down schema
-up_down = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
+## @var myrpki
+## Parsed RelaxNG myrpki schema
+myrpki = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: up-down-schema.rnc 5753 2014-04-05 19:24:26Z sra $
-  
-  RelaxNG schema for the up-down protocol, extracted from RFC 6492.
+  $Id: myrpki.rnc 5757 2014-04-05 22:42:12Z sra $
   
-  Copyright (c) 2012 IETF Trust and the persons identified as authors
-  of the code.  All rights reserved.
+  RelaxNG schema for MyRPKI XML messages.
   
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions
-  are met:
+  This message protocol is on its way out, as we're in the process of
+  moving on from the user interface model that produced it, but even
+  after we finish replacing it we'll still need the schema for a while
+  to validate old messages when upgrading.
   
-  * Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer.
+  libxml2 (including xmllint) only groks the XML syntax of RelaxNG, so
+  run the compact syntax through trang to get XML syntax.
   
-  * Redistributions in binary form must reproduce the above copyright
-    notice, this list of conditions and the following disclaimer in
-    the documentation and/or other materials provided with the
-    distribution.
+  Copyright (C) 2009-2011  Internet Systems Consortium ("ISC")
   
-  * Neither the name of Internet Society, IETF or IETF Trust, nor the
-    names of specific contributors, may be used to endorse or promote
-    products derived from this software without specific prior written
-    permission.
+  Permission to use, copy, modify, and distribute this software for any
+  purpose with or without fee is hereby granted, provided that the above
+  copyright notice and this permission notice appear in all copies.
   
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
-  FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-  COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
-  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
-  ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-  POSSIBILITY OF SUCH DAMAGE.
+  THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+  REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+  INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  PERFORMANCE OF THIS SOFTWARE.
 -->
-<grammar ns="http://www.apnic.net/specs/rescerts/up-down/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
-  <define name="resource_set_as">
-    <data type="string">
+<grammar ns="http://www.hactrn.net/uris/rpki/myrpki/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
+  <define name="version">
+    <value>2</value>
+  </define>
+  <define name="base64">
+    <data type="base64Binary">
       <param name="maxLength">512000</param>
-      <param name="pattern">[\-,0-9]*</param>
     </data>
   </define>
-  <define name="resource_set_ip4">
+  <define name="object_handle">
     <data type="string">
-      <param name="maxLength">512000</param>
-      <param name="pattern">[\-,/.0-9]*</param>
+      <param name="maxLength">255</param>
+      <param name="pattern">[\-_A-Za-z0-9]+</param>
     </data>
   </define>
-  <define name="resource_set_ip6">
+  <define name="pubd_handle">
     <data type="string">
-      <param name="maxLength">512000</param>
-      <param name="pattern">[\-,/:0-9a-fA-F]*</param>
+      <param name="maxLength">255</param>
+      <param name="pattern">[\-_A-Za-z0-9/]+</param>
     </data>
   </define>
-  <define name="class_name">
-    <data type="token">
-      <param name="minLength">1</param>
-      <param name="maxLength">1024</param>
+  <define name="uri">
+    <data type="anyURI">
+      <param name="maxLength">4096</param>
     </data>
   </define>
-  <define name="ski">
-    <data type="token">
-      <param name="minLength">27</param>
-      <param name="maxLength">1024</param>
-    </data>
+  <define name="asn">
+    <data type="positiveInteger"/>
   </define>
-  <define name="label">
-    <data type="token">
-      <param name="minLength">1</param>
-      <param name="maxLength">1024</param>
+  <define name="asn_list">
+    <data type="string">
+      <param name="maxLength">512000</param>
+      <param name="pattern">[\-,0-9]+</param>
     </data>
   </define>
-  <define name="cert_url">
+  <define name="ipv4_list">
     <data type="string">
-      <param name="minLength">10</param>
-      <param name="maxLength">4096</param>
+      <param name="maxLength">512000</param>
+      <param name="pattern">[\-,0-9/.]+</param>
     </data>
   </define>
-  <define name="base64_binary">
-    <data type="base64Binary">
-      <param name="minLength">4</param>
+  <define name="ipv6_list">
+    <data type="string">
       <param name="maxLength">512000</param>
+      <param name="pattern">[\-,0-9/:a-fA-F]+</param>
     </data>
   </define>
-  <start>
-    <element name="message">
-      <attribute name="version">
-        <data type="positiveInteger">
-          <param name="maxInclusive">1</param>
-        </data>
-      </attribute>
-      <attribute name="sender">
-        <ref name="label"/>
-      </attribute>
-      <attribute name="recipient">
-        <ref name="label"/>
-      </attribute>
-      <ref name="payload"/>
-    </element>
-  </start>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>list</value>
-    </attribute>
-    <ref name="list_request"/>
-  </define>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>list_response</value>
-    </attribute>
-    <ref name="list_response"/>
-  </define>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>issue</value>
-    </attribute>
-    <ref name="issue_request"/>
-  </define>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>issue_response</value>
-    </attribute>
-    <ref name="issue_response"/>
-  </define>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>revoke</value>
-    </attribute>
-    <ref name="revoke_request"/>
-  </define>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>revoke_response</value>
-    </attribute>
-    <ref name="revoke_response"/>
-  </define>
-  <define name="payload" combine="choice">
-    <attribute name="type">
-      <value>error_response</value>
-    </attribute>
-    <ref name="error_response"/>
-  </define>
-  <define name="list_request">
-    <empty/>
-  </define>
-  <define name="list_response">
-    <zeroOrMore>
-      <ref name="class"/>
-    </zeroOrMore>
+  <define name="timestamp">
+    <data type="dateTime">
+      <param name="pattern">.*Z</param>
+    </data>
   </define>
-  <define name="class">
-    <element name="class">
-      <attribute name="class_name">
-        <ref name="class_name"/>
-      </attribute>
-      <attribute name="cert_url">
-        <ref name="cert_url"/>
-      </attribute>
-      <attribute name="resource_set_as">
-        <ref name="resource_set_as"/>
-      </attribute>
-      <attribute name="resource_set_ipv4">
-        <ref name="resource_set_ip4"/>
-      </attribute>
-      <attribute name="resource_set_ipv6">
-        <ref name="resource_set_ip6"/>
+  <!--
+    Message formate used between configure_resources and
+    configure_daemons.
+  -->
+  <start combine="choice">
+    <element name="myrpki">
+      <attribute name="version">
+        <ref name="version"/>
       </attribute>
-      <attribute name="resource_set_notafter">
-        <data type="dateTime"/>
+      <attribute name="handle">
+        <ref name="object_handle"/>
       </attribute>
       <optional>
-        <attribute name="suggested_sia_head">
-          <data type="anyURI">
-            <param name="maxLength">1024</param>
-            <param name="pattern">rsync://.+</param>
-          </data>
+        <attribute name="service_uri">
+          <ref name="uri"/>
         </attribute>
       </optional>
       <zeroOrMore>
-        <element name="certificate">
-          <attribute name="cert_url">
-            <ref name="cert_url"/>
+        <element name="roa_request">
+          <attribute name="asn">
+            <ref name="asn"/>
+          </attribute>
+          <attribute name="v4">
+            <ref name="ipv4_list"/>
+          </attribute>
+          <attribute name="v6">
+            <ref name="ipv6_list"/>
+          </attribute>
+        </element>
+      </zeroOrMore>
+      <zeroOrMore>
+        <element name="child">
+          <attribute name="handle">
+            <ref name="object_handle"/>
+          </attribute>
+          <attribute name="valid_until">
+            <ref name="timestamp"/>
           </attribute>
           <optional>
-            <attribute name="req_resource_set_as">
-              <ref name="resource_set_as"/>
+            <attribute name="asns">
+              <ref name="asn_list"/>
             </attribute>
           </optional>
           <optional>
-            <attribute name="req_resource_set_ipv4">
-              <ref name="resource_set_ip4"/>
+            <attribute name="v4">
+              <ref name="ipv4_list"/>
             </attribute>
           </optional>
           <optional>
-            <attribute name="req_resource_set_ipv6">
-              <ref name="resource_set_ip6"/>
+            <attribute name="v6">
+              <ref name="ipv6_list"/>
             </attribute>
           </optional>
-          <ref name="base64_binary"/>
+          <optional>
+            <element name="bpki_certificate">
+              <ref name="base64"/>
+            </element>
+          </optional>
         </element>
       </zeroOrMore>
-      <element name="issuer">
-        <ref name="base64_binary"/>
+      <zeroOrMore>
+        <element name="parent">
+          <attribute name="handle">
+            <ref name="object_handle"/>
+          </attribute>
+          <optional>
+            <attribute name="service_uri">
+              <ref name="uri"/>
+            </attribute>
+          </optional>
+          <optional>
+            <attribute name="myhandle">
+              <ref name="object_handle"/>
+            </attribute>
+          </optional>
+          <optional>
+            <attribute name="sia_base">
+              <ref name="uri"/>
+            </attribute>
+          </optional>
+          <optional>
+            <element name="bpki_cms_certificate">
+              <ref name="base64"/>
+            </element>
+          </optional>
+        </element>
+      </zeroOrMore>
+      <zeroOrMore>
+        <element name="repository">
+          <attribute name="handle">
+            <ref name="object_handle"/>
+          </attribute>
+          <optional>
+            <attribute name="service_uri">
+              <ref name="uri"/>
+            </attribute>
+          </optional>
+          <optional>
+            <element name="bpki_certificate">
+              <ref name="base64"/>
+            </element>
+          </optional>
+        </element>
+      </zeroOrMore>
+      <optional>
+        <element name="bpki_ca_certificate">
+          <ref name="base64"/>
+        </element>
+      </optional>
+      <optional>
+        <element name="bpki_crl">
+          <ref name="base64"/>
+        </element>
+      </optional>
+      <optional>
+        <element name="bpki_bsc_certificate">
+          <ref name="base64"/>
+        </element>
+      </optional>
+      <optional>
+        <element name="bpki_bsc_pkcs10">
+          <ref name="base64"/>
+        </element>
+      </optional>
+    </element>
+  </start>
+  <!-- Format of an identity.xml file. -->
+  <start combine="choice">
+    <element name="identity">
+      <attribute name="version">
+        <ref name="version"/>
+      </attribute>
+      <attribute name="handle">
+        <ref name="object_handle"/>
+      </attribute>
+      <element name="bpki_ta">
+        <ref name="base64"/>
       </element>
     </element>
-  </define>
-  <define name="issue_request">
-    <element name="request">
-      <attribute name="class_name">
-        <ref name="class_name"/>
+  </start>
+  <!--
+    Format of <authorization/> element used in referrals.  The Base64
+    text is a <referral/> (q. v.) element signed with CMS.
+  -->
+  <define name="authorization">
+    <element name="authorization">
+      <attribute name="referrer">
+        <ref name="pubd_handle"/>
       </attribute>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <!-- Format of <contact_info/> element used in referrals. -->
+  <define name="contact_info">
+    <element name="contact_info">
       <optional>
-        <attribute name="req_resource_set_as">
-          <ref name="resource_set_as"/>
+        <attribute name="uri">
+          <ref name="uri"/>
         </attribute>
       </optional>
+      <data type="string"/>
+    </element>
+  </define>
+  <!-- Variant payload portion of a <repository/> element. -->
+  <define name="repository_payload">
+    <choice>
+      <attribute name="type">
+        <value>none</value>
+      </attribute>
+      <attribute name="type">
+        <value>offer</value>
+      </attribute>
+      <group>
+        <attribute name="type">
+          <value>referral</value>
+        </attribute>
+        <ref name="authorization"/>
+        <ref name="contact_info"/>
+      </group>
+    </choice>
+  </define>
+  <!-- <parent/> element (response from configure_child). -->
+  <start combine="choice">
+    <element name="parent">
+      <attribute name="version">
+        <ref name="version"/>
+      </attribute>
       <optional>
-        <attribute name="req_resource_set_ipv4">
-          <ref name="resource_set_ip4"/>
+        <attribute name="valid_until">
+          <ref name="timestamp"/>
         </attribute>
       </optional>
       <optional>
-        <attribute name="req_resource_set_ipv6">
-          <ref name="resource_set_ip6"/>
+        <attribute name="service_uri">
+          <ref name="uri"/>
         </attribute>
       </optional>
-      <ref name="base64_binary"/>
-    </element>
-  </define>
-  <define name="issue_response">
-    <ref name="class"/>
-  </define>
-  <define name="revoke_request">
-    <ref name="revocation"/>
-  </define>
-  <define name="revoke_response">
-    <ref name="revocation"/>
-  </define>
-  <define name="revocation">
-    <element name="key">
-      <attribute name="class_name">
-        <ref name="class_name"/>
+      <attribute name="child_handle">
+        <ref name="object_handle"/>
       </attribute>
-      <attribute name="ski">
-        <ref name="ski"/>
+      <attribute name="parent_handle">
+        <ref name="object_handle"/>
       </attribute>
+      <element name="bpki_resource_ta">
+        <ref name="base64"/>
+      </element>
+      <element name="bpki_child_ta">
+        <ref name="base64"/>
+      </element>
+      <optional>
+        <element name="repository">
+          <ref name="repository_payload"/>
+        </element>
+      </optional>
     </element>
-  </define>
-  <define name="error_response">
-    <element name="status">
-      <data type="positiveInteger">
-        <param name="maxInclusive">9999</param>
-      </data>
+  </start>
+  <!--
+    <repository/> element, types offer and referral
+    (input to configure_publication_client).
+  -->
+  <start combine="choice">
+    <element name="repository">
+      <attribute name="version">
+        <ref name="version"/>
+      </attribute>
+      <attribute name="handle">
+        <ref name="object_handle"/>
+      </attribute>
+      <attribute name="parent_handle">
+        <ref name="object_handle"/>
+      </attribute>
+      <ref name="repository_payload"/>
+      <element name="bpki_client_ta">
+        <ref name="base64"/>
+      </element>
     </element>
-    <zeroOrMore>
-      <element name="description">
-        <attribute name="xml:lang">
-          <data type="language"/>
-        </attribute>
-        <data type="string">
-          <param name="maxLength">1024</param>
-        </data>
+  </start>
+  <!--
+    <repository/> element, confirmation type (output of
+    configure_publication_client).
+  -->
+  <start combine="choice">
+    <element name="repository">
+      <attribute name="version">
+        <ref name="version"/>
+      </attribute>
+      <attribute name="type">
+        <value>confirmed</value>
+      </attribute>
+      <attribute name="parent_handle">
+        <ref name="object_handle"/>
+      </attribute>
+      <attribute name="client_handle">
+        <ref name="pubd_handle"/>
+      </attribute>
+      <attribute name="service_uri">
+        <ref name="uri"/>
+      </attribute>
+      <attribute name="sia_base">
+        <ref name="uri"/>
+      </attribute>
+      <element name="bpki_server_ta">
+        <ref name="base64"/>
       </element>
-    </zeroOrMore>
-  </define>
+      <element name="bpki_client_ta">
+        <ref name="base64"/>
+      </element>
+      <optional>
+        <ref name="authorization"/>
+      </optional>
+      <optional>
+        <ref name="contact_info"/>
+      </optional>
+    </element>
+  </start>
+  <!--
+    <referral/> element.  This is the entirety of a separate message
+    which is signed with CMS then included ase the Base64 content of an
+    <authorization/> element in the main message.
+  -->
+  <start combine="choice">
+    <element name="referral">
+      <attribute name="version">
+        <ref name="version"/>
+      </attribute>
+      <attribute name="authorized_sia_base">
+        <ref name="uri"/>
+      </attribute>
+      <ref name="base64"/>
+    </element>
+  </start>
 </grammar>
 <!--
   Local Variables:
@@ -1380,7 +1482,7 @@ up_down = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encod
 ## Parsed RelaxNG publication schema
 publication = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: publication-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: publication-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for RPKI publication protocol.
   
@@ -1954,394 +2056,11 @@ publication = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" e
 -->
 '''))
 
-## @var myrpki
-## Parsed RelaxNG myrpki schema
-myrpki = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  $Id: myrpki.rnc 5753 2014-04-05 19:24:26Z sra $
-  
-  RelaxNG schema for MyRPKI XML messages.
-  
-  This message protocol is on its way out, as we're in the process of
-  moving on from the user interface model that produced it, but even
-  after we finish replacing it we'll still need the schema for a while
-  to validate old messages when upgrading.
-  
-  libxml2 (including xmllint) only groks the XML syntax of RelaxNG, so
-  run the compact syntax through trang to get XML syntax.
-  
-  Copyright (C) 2009-2011  Internet Systems Consortium ("ISC")
-  
-  Permission to use, copy, modify, and distribute this software for any
-  purpose with or without fee is hereby granted, provided that the above
-  copyright notice and this permission notice appear in all copies.
-  
-  THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-  REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-  AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-  INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-  LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-  OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-  PERFORMANCE OF THIS SOFTWARE.
--->
-<grammar ns="http://www.hactrn.net/uris/rpki/myrpki/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
-  <define name="version">
-    <value>2</value>
-  </define>
-  <define name="base64">
-    <data type="base64Binary">
-      <param name="maxLength">512000</param>
-    </data>
-  </define>
-  <define name="object_handle">
-    <data type="string">
-      <param name="maxLength">255</param>
-      <param name="pattern">[\-_A-Za-z0-9]+</param>
-    </data>
-  </define>
-  <define name="pubd_handle">
-    <data type="string">
-      <param name="maxLength">255</param>
-      <param name="pattern">[\-_A-Za-z0-9/]+</param>
-    </data>
-  </define>
-  <define name="uri">
-    <data type="anyURI">
-      <param name="maxLength">4096</param>
-    </data>
-  </define>
-  <define name="asn">
-    <data type="positiveInteger"/>
-  </define>
-  <define name="asn_list">
-    <data type="string">
-      <param name="maxLength">512000</param>
-      <param name="pattern">[\-,0-9]+</param>
-    </data>
-  </define>
-  <define name="ipv4_list">
-    <data type="string">
-      <param name="maxLength">512000</param>
-      <param name="pattern">[\-,0-9/.]+</param>
-    </data>
-  </define>
-  <define name="ipv6_list">
-    <data type="string">
-      <param name="maxLength">512000</param>
-      <param name="pattern">[\-,0-9/:a-fA-F]+</param>
-    </data>
-  </define>
-  <define name="timestamp">
-    <data type="dateTime">
-      <param name="pattern">.*Z</param>
-    </data>
-  </define>
-  <!--
-    Message formate used between configure_resources and
-    configure_daemons.
-  -->
-  <start combine="choice">
-    <element name="myrpki">
-      <attribute name="version">
-        <ref name="version"/>
-      </attribute>
-      <attribute name="handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <optional>
-        <attribute name="service_uri">
-          <ref name="uri"/>
-        </attribute>
-      </optional>
-      <zeroOrMore>
-        <element name="roa_request">
-          <attribute name="asn">
-            <ref name="asn"/>
-          </attribute>
-          <attribute name="v4">
-            <ref name="ipv4_list"/>
-          </attribute>
-          <attribute name="v6">
-            <ref name="ipv6_list"/>
-          </attribute>
-        </element>
-      </zeroOrMore>
-      <zeroOrMore>
-        <element name="child">
-          <attribute name="handle">
-            <ref name="object_handle"/>
-          </attribute>
-          <attribute name="valid_until">
-            <ref name="timestamp"/>
-          </attribute>
-          <optional>
-            <attribute name="asns">
-              <ref name="asn_list"/>
-            </attribute>
-          </optional>
-          <optional>
-            <attribute name="v4">
-              <ref name="ipv4_list"/>
-            </attribute>
-          </optional>
-          <optional>
-            <attribute name="v6">
-              <ref name="ipv6_list"/>
-            </attribute>
-          </optional>
-          <optional>
-            <element name="bpki_certificate">
-              <ref name="base64"/>
-            </element>
-          </optional>
-        </element>
-      </zeroOrMore>
-      <zeroOrMore>
-        <element name="parent">
-          <attribute name="handle">
-            <ref name="object_handle"/>
-          </attribute>
-          <optional>
-            <attribute name="service_uri">
-              <ref name="uri"/>
-            </attribute>
-          </optional>
-          <optional>
-            <attribute name="myhandle">
-              <ref name="object_handle"/>
-            </attribute>
-          </optional>
-          <optional>
-            <attribute name="sia_base">
-              <ref name="uri"/>
-            </attribute>
-          </optional>
-          <optional>
-            <element name="bpki_cms_certificate">
-              <ref name="base64"/>
-            </element>
-          </optional>
-        </element>
-      </zeroOrMore>
-      <zeroOrMore>
-        <element name="repository">
-          <attribute name="handle">
-            <ref name="object_handle"/>
-          </attribute>
-          <optional>
-            <attribute name="service_uri">
-              <ref name="uri"/>
-            </attribute>
-          </optional>
-          <optional>
-            <element name="bpki_certificate">
-              <ref name="base64"/>
-            </element>
-          </optional>
-        </element>
-      </zeroOrMore>
-      <optional>
-        <element name="bpki_ca_certificate">
-          <ref name="base64"/>
-        </element>
-      </optional>
-      <optional>
-        <element name="bpki_crl">
-          <ref name="base64"/>
-        </element>
-      </optional>
-      <optional>
-        <element name="bpki_bsc_certificate">
-          <ref name="base64"/>
-        </element>
-      </optional>
-      <optional>
-        <element name="bpki_bsc_pkcs10">
-          <ref name="base64"/>
-        </element>
-      </optional>
-    </element>
-  </start>
-  <!-- Format of an identity.xml file. -->
-  <start combine="choice">
-    <element name="identity">
-      <attribute name="version">
-        <ref name="version"/>
-      </attribute>
-      <attribute name="handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <element name="bpki_ta">
-        <ref name="base64"/>
-      </element>
-    </element>
-  </start>
-  <!--
-    Format of <authorization/> element used in referrals.  The Base64
-    text is a <referral/> (q. v.) element signed with CMS.
-  -->
-  <define name="authorization">
-    <element name="authorization">
-      <attribute name="referrer">
-        <ref name="pubd_handle"/>
-      </attribute>
-      <ref name="base64"/>
-    </element>
-  </define>
-  <!-- Format of <contact_info/> element used in referrals. -->
-  <define name="contact_info">
-    <element name="contact_info">
-      <optional>
-        <attribute name="uri">
-          <ref name="uri"/>
-        </attribute>
-      </optional>
-      <data type="string"/>
-    </element>
-  </define>
-  <!-- Variant payload portion of a <repository/> element. -->
-  <define name="repository_payload">
-    <choice>
-      <attribute name="type">
-        <value>none</value>
-      </attribute>
-      <attribute name="type">
-        <value>offer</value>
-      </attribute>
-      <group>
-        <attribute name="type">
-          <value>referral</value>
-        </attribute>
-        <ref name="authorization"/>
-        <ref name="contact_info"/>
-      </group>
-    </choice>
-  </define>
-  <!-- <parent/> element (response from configure_child). -->
-  <start combine="choice">
-    <element name="parent">
-      <attribute name="version">
-        <ref name="version"/>
-      </attribute>
-      <optional>
-        <attribute name="valid_until">
-          <ref name="timestamp"/>
-        </attribute>
-      </optional>
-      <optional>
-        <attribute name="service_uri">
-          <ref name="uri"/>
-        </attribute>
-      </optional>
-      <attribute name="child_handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <attribute name="parent_handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <element name="bpki_resource_ta">
-        <ref name="base64"/>
-      </element>
-      <element name="bpki_child_ta">
-        <ref name="base64"/>
-      </element>
-      <optional>
-        <element name="repository">
-          <ref name="repository_payload"/>
-        </element>
-      </optional>
-    </element>
-  </start>
-  <!--
-    <repository/> element, types offer and referral
-    (input to configure_publication_client).
-  -->
-  <start combine="choice">
-    <element name="repository">
-      <attribute name="version">
-        <ref name="version"/>
-      </attribute>
-      <attribute name="handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <attribute name="parent_handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <ref name="repository_payload"/>
-      <element name="bpki_client_ta">
-        <ref name="base64"/>
-      </element>
-    </element>
-  </start>
-  <!--
-    <repository/> element, confirmation type (output of
-    configure_publication_client).
-  -->
-  <start combine="choice">
-    <element name="repository">
-      <attribute name="version">
-        <ref name="version"/>
-      </attribute>
-      <attribute name="type">
-        <value>confirmed</value>
-      </attribute>
-      <attribute name="parent_handle">
-        <ref name="object_handle"/>
-      </attribute>
-      <attribute name="client_handle">
-        <ref name="pubd_handle"/>
-      </attribute>
-      <attribute name="service_uri">
-        <ref name="uri"/>
-      </attribute>
-      <attribute name="sia_base">
-        <ref name="uri"/>
-      </attribute>
-      <element name="bpki_server_ta">
-        <ref name="base64"/>
-      </element>
-      <element name="bpki_client_ta">
-        <ref name="base64"/>
-      </element>
-      <optional>
-        <ref name="authorization"/>
-      </optional>
-      <optional>
-        <ref name="contact_info"/>
-      </optional>
-    </element>
-  </start>
-  <!--
-    <referral/> element.  This is the entirety of a separate message
-    which is signed with CMS then included ase the Base64 content of an
-    <authorization/> element in the main message.
-  -->
-  <start combine="choice">
-    <element name="referral">
-      <attribute name="version">
-        <ref name="version"/>
-      </attribute>
-      <attribute name="authorized_sia_base">
-        <ref name="uri"/>
-      </attribute>
-      <ref name="base64"/>
-    </element>
-  </start>
-</grammar>
-<!--
-  Local Variables:
-  indent-tabs-mode: nil
-  comment-start: "# "
-  comment-start-skip: "#[ \t]*"
-  End:
--->
-'''))
-
 ## @var router_certificate
 ## Parsed RelaxNG router_certificate schema
 router_certificate = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: router-certificate-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: router-certificate-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for BGPSEC router certificate interchange format.
   
@@ -2439,3 +2158,284 @@ router_certificate = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version=
 -->
 '''))
 
+## @var up_down
+## Parsed RelaxNG up_down schema
+up_down = lxml.etree.RelaxNG(lxml.etree.fromstring(r'''<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  $Id: up-down-schema.rnc 5757 2014-04-05 22:42:12Z sra $
+  
+  RelaxNG schema for the up-down protocol, extracted from RFC 6492.
+  
+  Copyright (c) 2012 IETF Trust and the persons identified as authors
+  of the code.  All rights reserved.
+  
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+  
+  * Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+  
+  * Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in
+    the documentation and/or other materials provided with the
+    distribution.
+  
+  * Neither the name of Internet Society, IETF or IETF Trust, nor the
+    names of specific contributors, may be used to endorse or promote
+    products derived from this software without specific prior written
+    permission.
+  
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+  FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+  COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+  BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+  ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  POSSIBILITY OF SUCH DAMAGE.
+-->
+<grammar ns="http://www.apnic.net/specs/rescerts/up-down/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
+  <define name="resource_set_as">
+    <data type="string">
+      <param name="maxLength">512000</param>
+      <param name="pattern">[\-,0-9]*</param>
+    </data>
+  </define>
+  <define name="resource_set_ip4">
+    <data type="string">
+      <param name="maxLength">512000</param>
+      <param name="pattern">[\-,/.0-9]*</param>
+    </data>
+  </define>
+  <define name="resource_set_ip6">
+    <data type="string">
+      <param name="maxLength">512000</param>
+      <param name="pattern">[\-,/:0-9a-fA-F]*</param>
+    </data>
+  </define>
+  <define name="class_name">
+    <data type="token">
+      <param name="minLength">1</param>
+      <param name="maxLength">1024</param>
+    </data>
+  </define>
+  <define name="ski">
+    <data type="token">
+      <param name="minLength">27</param>
+      <param name="maxLength">1024</param>
+    </data>
+  </define>
+  <define name="label">
+    <data type="token">
+      <param name="minLength">1</param>
+      <param name="maxLength">1024</param>
+    </data>
+  </define>
+  <define name="cert_url">
+    <data type="string">
+      <param name="minLength">10</param>
+      <param name="maxLength">4096</param>
+    </data>
+  </define>
+  <define name="base64_binary">
+    <data type="base64Binary">
+      <param name="minLength">4</param>
+      <param name="maxLength">512000</param>
+    </data>
+  </define>
+  <start>
+    <element name="message">
+      <attribute name="version">
+        <data type="positiveInteger">
+          <param name="maxInclusive">1</param>
+        </data>
+      </attribute>
+      <attribute name="sender">
+        <ref name="label"/>
+      </attribute>
+      <attribute name="recipient">
+        <ref name="label"/>
+      </attribute>
+      <ref name="payload"/>
+    </element>
+  </start>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>list</value>
+    </attribute>
+    <ref name="list_request"/>
+  </define>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>list_response</value>
+    </attribute>
+    <ref name="list_response"/>
+  </define>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>issue</value>
+    </attribute>
+    <ref name="issue_request"/>
+  </define>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>issue_response</value>
+    </attribute>
+    <ref name="issue_response"/>
+  </define>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>revoke</value>
+    </attribute>
+    <ref name="revoke_request"/>
+  </define>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>revoke_response</value>
+    </attribute>
+    <ref name="revoke_response"/>
+  </define>
+  <define name="payload" combine="choice">
+    <attribute name="type">
+      <value>error_response</value>
+    </attribute>
+    <ref name="error_response"/>
+  </define>
+  <define name="list_request">
+    <empty/>
+  </define>
+  <define name="list_response">
+    <zeroOrMore>
+      <ref name="class"/>
+    </zeroOrMore>
+  </define>
+  <define name="class">
+    <element name="class">
+      <attribute name="class_name">
+        <ref name="class_name"/>
+      </attribute>
+      <attribute name="cert_url">
+        <ref name="cert_url"/>
+      </attribute>
+      <attribute name="resource_set_as">
+        <ref name="resource_set_as"/>
+      </attribute>
+      <attribute name="resource_set_ipv4">
+        <ref name="resource_set_ip4"/>
+      </attribute>
+      <attribute name="resource_set_ipv6">
+        <ref name="resource_set_ip6"/>
+      </attribute>
+      <attribute name="resource_set_notafter">
+        <data type="dateTime"/>
+      </attribute>
+      <optional>
+        <attribute name="suggested_sia_head">
+          <data type="anyURI">
+            <param name="maxLength">1024</param>
+            <param name="pattern">rsync://.+</param>
+          </data>
+        </attribute>
+      </optional>
+      <zeroOrMore>
+        <element name="certificate">
+          <attribute name="cert_url">
+            <ref name="cert_url"/>
+          </attribute>
+          <optional>
+            <attribute name="req_resource_set_as">
+              <ref name="resource_set_as"/>
+            </attribute>
+          </optional>
+          <optional>
+            <attribute name="req_resource_set_ipv4">
+              <ref name="resource_set_ip4"/>
+            </attribute>
+          </optional>
+          <optional>
+            <attribute name="req_resource_set_ipv6">
+              <ref name="resource_set_ip6"/>
+            </attribute>
+          </optional>
+          <ref name="base64_binary"/>
+        </element>
+      </zeroOrMore>
+      <element name="issuer">
+        <ref name="base64_binary"/>
+      </element>
+    </element>
+  </define>
+  <define name="issue_request">
+    <element name="request">
+      <attribute name="class_name">
+        <ref name="class_name"/>
+      </attribute>
+      <optional>
+        <attribute name="req_resource_set_as">
+          <ref name="resource_set_as"/>
+        </attribute>
+      </optional>
+      <optional>
+        <attribute name="req_resource_set_ipv4">
+          <ref name="resource_set_ip4"/>
+        </attribute>
+      </optional>
+      <optional>
+        <attribute name="req_resource_set_ipv6">
+          <ref name="resource_set_ip6"/>
+        </attribute>
+      </optional>
+      <ref name="base64_binary"/>
+    </element>
+  </define>
+  <define name="issue_response">
+    <ref name="class"/>
+  </define>
+  <define name="revoke_request">
+    <ref name="revocation"/>
+  </define>
+  <define name="revoke_response">
+    <ref name="revocation"/>
+  </define>
+  <define name="revocation">
+    <element name="key">
+      <attribute name="class_name">
+        <ref name="class_name"/>
+      </attribute>
+      <attribute name="ski">
+        <ref name="ski"/>
+      </attribute>
+    </element>
+  </define>
+  <define name="error_response">
+    <element name="status">
+      <data type="positiveInteger">
+        <param name="maxInclusive">9999</param>
+      </data>
+    </element>
+    <zeroOrMore>
+      <element name="description">
+        <attribute name="xml:lang">
+          <data type="language"/>
+        </attribute>
+        <data type="string">
+          <param name="maxLength">1024</param>
+        </data>
+      </element>
+    </zeroOrMore>
+  </define>
+</grammar>
+<!--
+  Local Variables:
+  indent-tabs-mode: nil
+  comment-start: "# "
+  comment-start-skip: "#[ \t]*"
+  End:
+-->
+'''))
+
diff --git a/rpkid/rpki/resource_set.py b/rpki/resource_set.py
index 2ec19cab..2ec19cab 100644
--- a/rpkid/rpki/resource_set.py
+++ b/rpki/resource_set.py
diff --git a/rpkid/rpki/rootd.py b/rpki/rootd.py
index 43e84873..43e84873 100644
--- a/rpkid/rpki/rootd.py
+++ b/rpki/rootd.py
diff --git a/rpkid/rpki/rpkic.py b/rpki/rpkic.py
index d5339f5b..d5339f5b 100644
--- a/rpkid/rpki/rpkic.py
+++ b/rpki/rpkic.py
diff --git a/rpkid/rpki/rpkid.py b/rpki/rpkid.py
index d6163bee..d6163bee 100644
--- a/rpkid/rpki/rpkid.py
+++ b/rpki/rpkid.py
diff --git a/rpkid/rpki/rpkid_tasks.py b/rpki/rpkid_tasks.py
index 04e1c0df..04e1c0df 100644
--- a/rpkid/rpki/rpkid_tasks.py
+++ b/rpki/rpkid_tasks.py
diff --git a/rpkid/rpki/sql.py b/rpki/sql.py
index c753278c..c753278c 100644
--- a/rpkid/rpki/sql.py
+++ b/rpki/sql.py
diff --git a/rpkid/rpki/sql_schemas.py b/rpki/sql_schemas.py
index e57c7a7f..0ac6016e 100644
--- a/rpkid/rpki/sql_schemas.py
+++ b/rpki/sql_schemas.py
@@ -2,7 +2,7 @@
 
 ## @var rpkid
 ## SQL schema rpkid
-rpkid = '''-- $Id: rpkid.sql 5753 2014-04-05 19:24:26Z sra $
+rpkid = '''-- $Id: rpkid.sql 5757 2014-04-05 22:42:12Z sra $
 
 -- Copyright (C) 2009--2011  Internet Systems Consortium ("ISC")
 --
@@ -256,7 +256,7 @@ CREATE TABLE ee_cert (
 
 ## @var pubd
 ## SQL schema pubd
-pubd = '''-- $Id: pubd.sql 3465 2010-10-07 00:59:39Z sra $
+pubd = '''-- $Id: pubd.sql 5757 2014-04-05 22:42:12Z sra $
 
 -- Copyright (C) 2009--2010  Internet Systems Consortium ("ISC")
 --
diff --git a/rpkid/rpki/sundial.py b/rpki/sundial.py
index 0825d61b..0825d61b 100644
--- a/rpkid/rpki/sundial.py
+++ b/rpki/sundial.py
diff --git a/rpkid/rpki/up_down.py b/rpki/up_down.py
index d2ad85d3..d2ad85d3 100644
--- a/rpkid/rpki/up_down.py
+++ b/rpki/up_down.py
diff --git a/rpkid/rpki/x509.py b/rpki/x509.py
index fb1a5a2b..fb1a5a2b 100644
--- a/rpkid/rpki/x509.py
+++ b/rpki/x509.py
diff --git a/rpkid/rpki/xml_utils.py b/rpki/xml_utils.py
index f254fd11..f254fd11 100644
--- a/rpkid/rpki/xml_utils.py
+++ b/rpki/xml_utils.py
diff --git a/rpkid/doc/README b/rpkid/doc/README
deleted file mode 100644
index 33902d7e..00000000
--- a/rpkid/doc/README
+++ /dev/null
@@ -1,16 +0,0 @@
-$Id$
-
-Internals documentation for the RPKI CA tools.
-
-Once upon a time this included the hand-written documentation for the
-CA tools, but that is now part of the overall package documentation.
-What's left here is just what Doxygen generates from the source code
-and a few Graphviz diagrams.
-
-At the moment the control for the stuff generated here is still
-../Makefile, that may change at some point.
-
-We no longer generate the documentation here automatically, as it's
-kind of large and we're not sure anybody else cares about it, so if
-you want this manual you'll have to install Doxygen and build it
-yourself.
diff --git a/rpkid/doc/mainpage.py b/rpkid/doc/mainpage.py
deleted file mode 100644
index 4570547b..00000000
--- a/rpkid/doc/mainpage.py
+++ /dev/null
@@ -1,71 +0,0 @@
-## @file
-# @details
-# Doxygen documentation source, expressed as Python comments to make Doxygen happy.
-#
-# $Id$
-#
-# Copyright (C) 2009--2012  Internet Systems Consortium ("ISC")
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-#
-# Portions copyright (C) 2007--2008  American Registry for Internet Numbers ("ARIN")
-#
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-## @mainpage RPKI Engine Reference Manual
-#
-# This collection of Python modules implements an RPKI CA engine.
-#
-# See http://trac.rpki.net/ for the RPKI tools package documentation.
-#
-# The documentation you're reading is generated automatically by
-# Doxygen from comments and documentation in
-# <a href="http://trac.rpki.net/browser/trunk">the code</a>.
-#
-# At one point this manual also included documentation for the CA
-# tools, but that has been integrated into the overall package
-# documentation.  This manual is now just the CA tools internals.
-
-## @page sql-schemas SQL database schemas
-#
-# @li @subpage rpkid-sql "rpkid database schema"
-# @li @subpage pubd-sql  "pubd database schema"
-
-## @page rpkid-sql rpkid SQL schema
-#
-# @image html  rpkid.png "Diagram of rpkid.sql"
-# @image latex rpkid.eps "Diagram of rpkid.sql" height=\textheight
-#
-# @verbinclude rpkid.sql
-
-## @page pubd-sql pubd SQL Schema
-#
-# @image html  pubd.png "Diagram of pubd.sql"
-# @image latex pubd.eps "Diagram of pubd.sql" width=\textwidth
-#
-# @verbinclude pubd.sql
-
-# Local Variables:
-# mode:python
-# compile-command: "cd ../.. && ./config.status && cd rpkid && make docs"
-# End:
diff --git a/rpkid/setup.py b/rpkid/setup.py
deleted file mode 100644
index 653d2d31..00000000
--- a/rpkid/setup.py
+++ /dev/null
@@ -1,93 +0,0 @@
-# $Id$
-#
-# Copyright (C) 2011-2013  Internet Systems Consortium ("ISC")
-# 
-# Permission to use, copy, modify, and distribute this software for any
-# purpose with or without fee is hereby granted, provided that the above
-# copyright notice and this permission notice appear in all copies.
-#
-# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-# PERFORMANCE OF THIS SOFTWARE.
-
-from distutils.core import setup, Extension
-from glob import glob
-import setup_extensions
-
-try:
-  import setup_autoconf as autoconf
-
-except ImportError:
-  class autoconf:
-    "Fake autoconf object to let --help work without autoconf."
-    sbindir = libexecdir = datarootdir = sysconfdir = CFLAGS = LDFLAGS = LIBS = ""
-
-try:
-  from rpki.version import VERSION
-
-except ImportError:
-  VERSION = "0.0"
-
-# pylint: disable=W0622
-
-setup(name              = "rpkitoolkit",
-      version           = VERSION,
-      description       = "RPKI Toolkit",
-      license           = "BSD",
-      url               = "http://rpki.net/",
-      cmdclass          = {"build_scripts"   : setup_extensions.build_scripts,
-                           "install_scripts" : setup_extensions.install_scripts},
-      packages          = ["rpki",
-                           "rpki.POW",
-                           "rpki.irdb",
-                           "rpki.gui",
-                           "rpki.gui.app",
-                           "rpki.gui.cacheview",
-                           "rpki.gui.api",
-                           "rpki.gui.routeview"],
-      ext_modules       = [Extension("rpki.POW._POW", ["ext/POW.c"], 
-                                     extra_compile_args =  autoconf.CFLAGS.split(),
-                                     extra_link_args    = (autoconf.LDFLAGS + " " +
-                                                           autoconf.LIBS).split())],
-      package_data      = {"rpki.gui.app" :
-                             ["migrations/*.py",
-                              "static/*/*",
-                              "templates/*.html",
-                              "templates/*/*.html",
-                              "templatetags/*.py"],
-                           "rpki.gui.cacheview" :
-                             ["templates/*/*.html"]},
-      scripts           = [(autoconf.sbindir,
-                            ["rpkic",
-                             "rpki-confgen",
-                             "rpki-start-servers",
-                             "rpki-sql-backup",
-                             "rpki-sql-setup",
-                             "portal-gui/scripts/rpki-manage",
-                             "portal-gui/scripts/rpkigui-query-routes",
-                             "irbe_cli"]),
-                           (autoconf.libexecdir,
-                            ["irdbd",
-                             "pubd",
-                             "rootd",
-                             "rpkid",
-                             "portal-gui/scripts/rpkigui-import-routes",
-                             "portal-gui/scripts/rpkigui-check-expired",
-                             "portal-gui/scripts/rpkigui-rcynic",
-                             "portal-gui/scripts/rpkigui-apache-conf-gen"])],
-      data_files        = [(autoconf.sysconfdir  + "/rpki",
-                            ["rpki-confgen.xml"]),
-                           (autoconf.datarootdir + "/rpki/wsgi",
-                            ["portal-gui/rpki.wsgi"]),
-                           (autoconf.datarootdir + "/rpki/media/css",
-                            glob("rpki/gui/app/static/css/*")),
-                           (autoconf.datarootdir + "/rpki/media/js",
-                            glob("rpki/gui/app/static/js/*")),
-                           (autoconf.datarootdir + "/rpki/media/img",
-                            glob("rpki/gui/app/static/img/*")),
-                           (autoconf.datarootdir + "/rpki/upgrade-scripts",
-                            glob("upgrade-scripts/*"))])
diff --git a/rtr-origin/sshd.conf b/rtr-origin/sshd.conf
deleted file mode 100644
index 0124fc4c..00000000
--- a/rtr-origin/sshd.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-# $Id$
-#
-# sshd config file for testing.  Invoke thusly:
-#
-# /usr/sbin/sshd -f /u/sra/rpki/subvert-rpki.hactrn.net/rtr-origin/sshd.conf -d
-
-Port					2222
-Protocol				2
-ListenAddress				127.0.0.1
-ListenAddress				::1
-HostKey					/u/sra/rpki/subvert-rpki.hactrn.net/rtr-origin/ssh_host_rsa_key
-PermitRootLogin				no
-PubkeyAuthentication			yes
-AuthorizedKeysFile			/u/sra/rpki/subvert-rpki.hactrn.net/rtr-origin/authorized_keys
-PasswordAuthentication			no
-PermitEmptyPasswords			no
-ChallengeResponseAuthentication		no
-UsePAM					no
-AllowTcpForwarding			no
-X11Forwarding				no
-UseDNS					no
-PidFile					/u/sra/rpki/subvert-rpki.hactrn.net/rtr-origin/sshd.pid
-Subsystem		rpki-rtr	/u/sra/rpki/subvert-rpki.hactrn.net/rtr-origin/server.sh
diff --git a/rpkid/left-right-schema.rnc b/schemas/relaxng/left-right-schema.rnc
index b46adeb5..b46adeb5 100644
--- a/rpkid/left-right-schema.rnc
+++ b/schemas/relaxng/left-right-schema.rnc
diff --git a/rpkid/left-right-schema.rng b/schemas/relaxng/left-right-schema.rng
index 6c3d2f1a..f153f0b6 100644
--- a/rpkid/left-right-schema.rng
+++ b/schemas/relaxng/left-right-schema.rng
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: left-right-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: left-right-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for RPKI left-right protocol.
   
diff --git a/rpkid/myrpki.rnc b/schemas/relaxng/myrpki.rnc
index 156ab0d5..156ab0d5 100644
--- a/rpkid/myrpki.rnc
+++ b/schemas/relaxng/myrpki.rnc
diff --git a/rpkid/myrpki.rng b/schemas/relaxng/myrpki.rng
index 07b8beb3..8c7473eb 100644
--- a/rpkid/myrpki.rng
+++ b/schemas/relaxng/myrpki.rng
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: myrpki.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: myrpki.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for MyRPKI XML messages.
   
diff --git a/rpkid/publication-schema.rnc b/schemas/relaxng/publication-schema.rnc
index 4353ae80..4353ae80 100644
--- a/rpkid/publication-schema.rnc
+++ b/schemas/relaxng/publication-schema.rnc
diff --git a/rpkid/publication-schema.rng b/schemas/relaxng/publication-schema.rng
index 63fb6ea5..7c74698f 100644
--- a/rpkid/publication-schema.rng
+++ b/schemas/relaxng/publication-schema.rng
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: publication-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: publication-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for RPKI publication protocol.
   
diff --git a/rpkid/router-certificate-schema.rnc b/schemas/relaxng/router-certificate-schema.rnc
index 8cc325ce..8cc325ce 100644
--- a/rpkid/router-certificate-schema.rnc
+++ b/schemas/relaxng/router-certificate-schema.rnc
diff --git a/rpkid/router-certificate-schema.rng b/schemas/relaxng/router-certificate-schema.rng
index d8be9eda..90b50107 100644
--- a/rpkid/router-certificate-schema.rng
+++ b/schemas/relaxng/router-certificate-schema.rng
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: router-certificate-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: router-certificate-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for BGPSEC router certificate interchange format.
   
diff --git a/rpkid/up-down-schema.rnc b/schemas/relaxng/up-down-schema.rnc
index a603b8fe..a603b8fe 100644
--- a/rpkid/up-down-schema.rnc
+++ b/schemas/relaxng/up-down-schema.rnc
diff --git a/rpkid/up-down-schema.rng b/schemas/relaxng/up-down-schema.rng
index 5368fa65..89235b7e 100644
--- a/rpkid/up-down-schema.rng
+++ b/schemas/relaxng/up-down-schema.rng
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  $Id: up-down-schema.rnc 5753 2014-04-05 19:24:26Z sra $
+  $Id: up-down-schema.rnc 5757 2014-04-05 22:42:12Z sra $
   
   RelaxNG schema for the up-down protocol, extracted from RFC 6492.
   
diff --git a/rpkid/pubd.sql b/schemas/sql/pubd.sql
index 3a58ec00..3a58ec00 100644
--- a/rpkid/pubd.sql
+++ b/schemas/sql/pubd.sql
diff --git a/rpkid/rpkid.sql b/schemas/sql/rpkid.sql
index a7e3dc0a..a7e3dc0a 100644
--- a/rpkid/rpkid.sql
+++ b/schemas/sql/rpkid.sql
diff --git a/scripts/rpki b/scripts/rpki
deleted file mode 120000
index 168548eb..00000000
--- a/scripts/rpki
+++ /dev/null
@@ -1 +0,0 @@
-../rpkid/rpki
\ No newline at end of file
diff --git a/setup.py b/setup.py
new file mode 100644
index 00000000..86f40983
--- /dev/null
+++ b/setup.py
@@ -0,0 +1,110 @@
+# $Id$
+# 
+# Copyright (C) 2014  Dragon Research Labs ("DRL")
+# Portions copyright (C) 2011--2013  Internet Systems Consortium ("ISC")
+# 
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notices and this permission notice appear in all copies.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS" AND DRL AND ISC DISCLAIM ALL
+# WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL DRL OR
+# ISC BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+# DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA
+# OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+# TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+from distutils.core import setup, Extension
+from glob import glob
+import setup_extensions
+
+try:
+  import setup_autoconf as autoconf
+
+except ImportError:
+  class autoconf:
+    "Fake autoconf object to let --help work without autoconf."
+    sbindir = libexecdir = datarootdir = sysconfdir = ""
+    CFLAGS = LDFLAGS = LIBS = CA_TARGET = RP_TARGET = ""
+
+try:
+  from rpki.version import VERSION
+
+except ImportError:
+  VERSION = "0.0"
+
+# pylint: disable=W0622
+
+setup_args = dict(
+  name          = "rpkitoolkit",
+  version       = VERSION,
+  description   = "RPKI Toolkit",
+  license       = "BSD",
+  url           = "http://rpki.net/",
+  cmdclass      = {"build_scripts"   : setup_extensions.build_scripts,
+                   "install_scripts" : setup_extensions.install_scripts})
+
+# If and when we start using setup.py to install RP scripts or start
+# trying to separate RP and CA modules in the rpki package tree, we'll
+# need to do something about sharing "packages", "scripts", etc.
+# Write that code when we need it.
+
+if autoconf.RP_TARGET == "rp":
+  setup_args.update(
+    packages    = ["rpki",
+                   "rpki.POW",
+                   "rpki.irdb",
+                   "rpki.gui",
+                   "rpki.gui.app",
+                   "rpki.gui.cacheview",
+                   "rpki.gui.api",
+                   "rpki.gui.routeview"],
+    ext_modules = [Extension("rpki.POW._POW", ["ext/POW.c"], 
+                             extra_compile_args =  autoconf.CFLAGS.split(),
+                             extra_link_args    = (autoconf.LDFLAGS + " " +
+                                                   autoconf.LIBS).split())],
+    package_data = {"rpki.gui.app" :
+                    ["migrations/*.py",
+                     "static/*/*",
+                     "templates/*.html",
+                     "templates/*/*.html",
+                     "templatetags/*.py"],
+                    "rpki.gui.cacheview" :
+                    ["templates/*/*.html"]})
+
+if autoconf.CA_TARGET == "ca":
+  setup_args.update(
+    scripts     = [(autoconf.sbindir,
+                    ["ca/rpkic",
+                     "ca/rpki-confgen",
+                     "ca/rpki-start-servers",
+                     "ca/rpki-sql-backup",
+                     "ca/rpki-sql-setup",
+                     "ca/rpki-manage",
+                     "ca/rpkigui-query-routes",
+                     "ca/irbe_cli"]),
+                   (autoconf.libexecdir,
+                    ["ca/irdbd",
+                     "ca/pubd",
+                     "ca/rootd",
+                     "ca/rpkid",
+                     "ca/rpkigui-import-routes",
+                     "ca/rpkigui-check-expired",
+                     "ca/rpkigui-rcynic",
+                     "ca/rpkigui-apache-conf-gen"])],
+    data_files  = [(autoconf.sysconfdir  + "/rpki",
+                    ["ca/rpki-confgen.xml"]),
+                   (autoconf.datarootdir + "/rpki/wsgi",
+                    ["ca/rpki.wsgi"]),
+                   (autoconf.datarootdir + "/rpki/media/css",
+                    glob("rpki/gui/app/static/css/*")),
+                   (autoconf.datarootdir + "/rpki/media/js",
+                    glob("rpki/gui/app/static/js/*")),
+                   (autoconf.datarootdir + "/rpki/media/img",
+                    glob("rpki/gui/app/static/img/*")),
+                   (autoconf.datarootdir + "/rpki/upgrade-scripts",
+                    glob("ca/upgrade-scripts/*"))])
+
+setup(**setup_args)
diff --git a/rpkid/setup_extensions.py b/setup_extensions.py
index 12b123aa..12b123aa 100644
--- a/rpkid/setup_extensions.py
+++ b/setup_extensions.py
diff --git a/utils/find_roa/Makefile.in b/utils/find_roa/Makefile.in
deleted file mode 100644
index 36c68e01..00000000
--- a/utils/find_roa/Makefile.in
+++ /dev/null
@@ -1,56 +0,0 @@
-# $Id$
-
-NAME = find_roa
-
-BIN = ${NAME}
-SRC = ${NAME}.c
-OBJ = ${NAME}.o
-
-CFLAGS = @CFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-
-INSTALL		= @INSTALL@ -m 555 
-
-prefix		= @prefix@
-exec_prefix	= @exec_prefix@
-datarootdir	= @datarootdir@
-datadir		= @datadir@
-localstatedir	= @localstatedir@
-sharedstatedir	= @sharedstatedir@
-sysconfdir	= @sysconfdir@
-bindir		= @bindir@
-sbindir		= @sbindir@
-libexecdir	= @libexecdir@
-libdir		= @libdir@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all: ${BIN}
-
-clean:
-	rm -rf ${BIN} ${OBJ} ${BIN}.dSYM
-
-${BIN}: ${SRC}
-	${CC} ${CFLAGS} -o $@ ${SRC} ${LDFLAGS} ${LIBS}
-
-
-ROA_DIR = ${abs_top_builddir}/rcynic/rcynic-data/authenticated
-
-TEST_ARGS = ${ROA_DIR} 10.3.0.44 10.2.0.6 10.0.0.0/24
-
-test: ${BIN}
-#	if test -d ${ROA_DIR}; then ./${BIN} ${TEST_ARGS} ; else :; fi
-	if test -d ${ROA_DIR}; then sh ./test_roa.sh ${TEST_ARGS} ; else :; fi
-
-install: all
-	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
-	${INSTALL} ${BIN} ${DESTDIR}${bindir}
-
-deinstall uninstall:
-	rm -f ${DESTDIR}${bindir}/${BIN}
-
-distclean: clean
-	rm -rf hashed-pem-dir
-	rm -f Makefile
diff --git a/utils/hashdir/Makefile.in b/utils/hashdir/Makefile.in
deleted file mode 100644
index c0cf448a..00000000
--- a/utils/hashdir/Makefile.in
+++ /dev/null
@@ -1,55 +0,0 @@
-# $Id$
-
-NAME = hashdir
-
-BIN = ${NAME}
-SRC = ${NAME}.c
-OBJ = ${NAME}.o
-
-CFLAGS = @CFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-
-INSTALL		= @INSTALL@ -m 555 
-
-prefix		= @prefix@
-exec_prefix	= @exec_prefix@
-datarootdir	= @datarootdir@
-datadir		= @datadir@
-localstatedir	= @localstatedir@
-sharedstatedir	= @sharedstatedir@
-sysconfdir	= @sysconfdir@
-bindir		= @bindir@
-sbindir		= @sbindir@
-libexecdir	= @libexecdir@
-libdir		= @libdir@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all: ${BIN}
-
-clean::
-	rm -rf ${BIN} ${OBJ} ${BIN}.dSYM
-
-${BIN}: ${SRC}
-	${CC} ${CFLAGS} -o $@ ${SRC} ${LDFLAGS} ${LIBS}
-
-INPUT  = ${abs_top_builddir}/rcynic/rcynic-data/authenticated
-OUTPUT = hashed-pem-dir
-
-test: ${BIN}
-	if test -d ${INPUT}; then rm -rf ${OUTPUT} && mkdir ${OUTPUT} && ./hashdir ${INPUT} ${OUTPUT}; else :; fi
-
-clean::
-	rm -rf ${OUTPUT}
-
-install: all
-	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
-	${INSTALL} ${BIN} ${DESTDIR}${bindir}
-
-deinstall uninstall:
-	rm -f ${DESTDIR}${bindir}/${BIN}
-
-distclean: clean
-	rm -f Makefile
diff --git a/utils/print_roa/Makefile.in b/utils/print_roa/Makefile.in
deleted file mode 100644
index 5999b351..00000000
--- a/utils/print_roa/Makefile.in
+++ /dev/null
@@ -1,52 +0,0 @@
-# $Id$
-
-NAME = print_roa
-
-BIN = ${NAME}
-SRC = ${NAME}.c
-OBJ = ${NAME}.o
-
-CFLAGS = @CFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-
-INSTALL		= @INSTALL@ -m 555 
-
-prefix		= @prefix@
-exec_prefix	= @exec_prefix@
-datarootdir	= @datarootdir@
-datadir		= @datadir@
-localstatedir	= @localstatedir@
-sharedstatedir	= @sharedstatedir@
-sysconfdir	= @sysconfdir@
-bindir		= @bindir@
-sbindir		= @sbindir@
-libexecdir	= @libexecdir@
-libdir		= @libdir@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all: ${BIN}
-
-clean:
-	rm -rf ${BIN} ${OBJ} ${BIN}.dSYM
-
-${BIN}: ${SRC}
-	${CC} ${CFLAGS} -o $@ ${SRC} ${LDFLAGS} ${LIBS}
-
-ROA_DIR = ${abs_top_builddir}/rpkid/tests/smoketest.dir/publication
-
-test: all
-	-date -u +'now:            %Y%m%d%H%M%SZ'
-	if test -d ${ROA_DIR}; then find ${ROA_DIR} -type f -name '*.roa' -print -exec ./${BIN} {} \; ; else :; fi
-
-install: all
-	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
-	${INSTALL} ${BIN} ${DESTDIR}${bindir}
-
-deinstall uninstall:
-	rm -f ${DESTDIR}${bindir}/${BIN}
-
-distclean: clean
-	rm -f Makefile
diff --git a/utils/print_rpki_manifest/Makefile.in b/utils/print_rpki_manifest/Makefile.in
deleted file mode 100644
index 22f1b16b..00000000
--- a/utils/print_rpki_manifest/Makefile.in
+++ /dev/null
@@ -1,52 +0,0 @@
-# $Id$
-
-NAME = print_rpki_manifest
-
-BIN = ${NAME}
-SRC = ${NAME}.c
-OBJ = ${NAME}.o
-
-CFLAGS = @CFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-
-INSTALL		= @INSTALL@ -m 555 
-
-prefix		= @prefix@
-exec_prefix	= @exec_prefix@
-datarootdir	= @datarootdir@
-datadir		= @datadir@
-localstatedir	= @localstatedir@
-sharedstatedir	= @sharedstatedir@
-sysconfdir	= @sysconfdir@
-bindir		= @bindir@
-sbindir		= @sbindir@
-libexecdir	= @libexecdir@
-libdir		= @libdir@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all: ${BIN}
-
-clean:
-	rm -rf ${BIN} ${OBJ} ${BIN}.dSYM
-
-${BIN}: ${SRC}
-	${CC} ${CFLAGS} -o $@ ${SRC} ${LDFLAGS} ${LIBS}
-
-MANIFEST_DIR = ${abs_top_builddir}/rpkid/tests/smoketest.dir/publication
-
-test: all
-	-date -u +'now:            %Y%m%d%H%M%SZ'
-	if test -d ${MANIFEST_DIR}; then find ${MANIFEST_DIR} -type f -name '*.mnf' -print -exec ./${BIN} {} \; ; else :; fi
-
-install: all
-	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
-	${INSTALL} ${BIN} ${DESTDIR}${bindir}
-
-deinstall uninstall:
-	rm -f ${DESTDIR}${bindir}/${BIN}
-
-distclean: clean
-	rm -f Makefile
diff --git a/utils/scan_roas/Makefile.in b/utils/scan_roas/Makefile.in
deleted file mode 100644
index 7707969c..00000000
--- a/utils/scan_roas/Makefile.in
+++ /dev/null
@@ -1,52 +0,0 @@
-# $Id$
-
-NAME = scan_roas
-
-BIN = ${NAME}
-SRC = ${NAME}.c
-OBJ = ${NAME}.o
-
-CFLAGS = @CFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-
-INSTALL		= @INSTALL@ -m 555 
-
-prefix		= @prefix@
-exec_prefix	= @exec_prefix@
-datarootdir	= @datarootdir@
-datadir		= @datadir@
-localstatedir	= @localstatedir@
-sharedstatedir	= @sharedstatedir@
-sysconfdir	= @sysconfdir@
-bindir		= @bindir@
-sbindir		= @sbindir@
-libexecdir	= @libexecdir@
-libdir		= @libdir@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all: ${BIN}
-
-clean:
-	rm -rf ${BIN} ${OBJ} ${BIN}.dSYM
-
-${BIN}: ${SRC}
-	${CC} ${CFLAGS} -o $@ ${SRC} ${LDFLAGS} ${LIBS}
-
-ROA_DIR = ${abs_top_builddir}/rpkid/tests/smoketest.dir/publication
-
-test: all
-	-date -u +'now:            %Y%m%d%H%M%SZ'
-	if test -d ${ROA_DIR}; then  ./${BIN} ${ROA_DIR} ; else :; fi
-
-install: all
-	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
-	${INSTALL} ${BIN} ${DESTDIR}${bindir}
-
-deinstall uninstall:
-	rm -f ${DESTDIR}${bindir}/${BIN}
-
-distclean: clean
-	rm -f Makefile
diff --git a/utils/scan_routercerts/Makefile.in b/utils/scan_routercerts/Makefile.in
deleted file mode 100644
index 715d1325..00000000
--- a/utils/scan_routercerts/Makefile.in
+++ /dev/null
@@ -1,41 +0,0 @@
-# $Id$
-
-NAME = scan_routercerts
-
-BIN = ${NAME}
-
-INSTALL		= @INSTALL@ -m 555 
-
-prefix		= @prefix@
-exec_prefix	= @exec_prefix@
-datarootdir	= @datarootdir@
-datadir		= @datadir@
-localstatedir	= @localstatedir@
-sharedstatedir	= @sharedstatedir@
-sysconfdir	= @sysconfdir@
-bindir		= @bindir@
-sbindir		= @sbindir@
-libexecdir	= @libexecdir@
-libdir		= @libdir@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all clean:
-	@true
-
-ROUTERCERT_DIR = ${abs_top_builddir}/rpkid/tests/smoketest.dir/publication
-
-test: all
-	-date -u +'now:            %Y%m%d%H%M%SZ'
-	if test -d ${ROUTERCERT_DIR}; then ./${BIN} ; else :; fi
-
-install: all
-	if test -d ${DESTDIR}${bindir} ; then :; else ${INSTALL} -d ${DESTDIR}${bindir}; fi
-	${INSTALL} ${BIN} ${DESTDIR}${bindir}
-
-deinstall uninstall:
-	rm -f ${DESTDIR}${bindir}/${BIN}
-
-distclean: clean
-	rm -f Makefile
diff --git a/utils/uri/Makefile.in b/utils/uri/Makefile.in
deleted file mode 100644
index fc545060..00000000
--- a/utils/uri/Makefile.in
+++ /dev/null
@@ -1,31 +0,0 @@
-# $Id$
-
-NAME = uri
-
-BIN = ${NAME}
-SRC = ${NAME}.c
-OBJ = ${NAME}.o
-
-CFLAGS = @CFLAGS@
-LDFLAGS = @LDFLAGS@
-LIBS = @LIBS@
-
-abs_top_srcdir	 = @abs_top_srcdir@
-abs_top_builddir = @abs_top_builddir@
-
-all: ${BIN}
-
-clean:
-	rm -rf ${BIN} ${OBJ} ${BIN}.dSYM
-
-${BIN}: ${SRC}
-	${CC} ${CFLAGS} -o $@ ${SRC} ${LDFLAGS} ${LIBS}
-
-test:
-	@true
-
-install deinstall uninstall:
-	@true
-
-distclean: clean
-	rm -f Makefile