Index: examples/passphrase_tests/python/acme_rockets_rt0/README
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/README	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/README	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,30 @@
+#
+# The example makes use of 2 principals, Acme and Coyote.
+#
+# This example shows a very simple delegation of roles by Acme.  Acme's
+# buy_rockets role includes all of Acme's preferred customers. 
+# The setup.py creates the principals where Acme is using a pre-existing
+# encrypted key file and the attr.py creates 2 policy credentials.  
+# Credential 1 encodes the policy that all of Acme's preferred customers 
+# can buy rockets from Acme 
+# Credential 2 defines the Coyote as an Acme preferred customer.
+# In both cases, the private key is decrypted a file that contains the passphrase
+# while the attribute is being baked
+
+# The ./run_query script issues queries to show that the Coyote is both a preferred
+# customer and can buy rockets.  Two invalid queries are also made, checking if
+# Acme is the Coyote's friend, which it isn't and whether a query about
+# something other than a principal works (it doesn't).
+
+# acme_rockets_rt0
+
+rm -rf *.der *.pem
+cp ../../PFILE pfile
+cp ../../ENC_PRIVATE.PEM Acme_private.pem
+
+# Credential 1
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+
Index: examples/passphrase_tests/python/acme_rockets_rt0/attr.py
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/attr.py	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/attr.py	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.id_load_encrypted_privkey_file("Acme_private.pem","pfile");
+ctxt.load_id(acmeID)
+acme=acmeID.id_keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.id_load_privkey_file("Coyote_private.pem");
+ctxt.load_id(coyoteID)
+coyote=coyoteID.id_keyid()
+
+################################################
+# Credential 1, only preferred_customer of Acme can buy_rockets
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer
+head = ABAC.Role(acme,"buy_rockets")
+tail = ABAC.Role(acme,"preferred_customer")
+
+# compose the attribute of a basic rt0 role rule
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+
+# finalize the policy
+attr.attribute_bake()
+
+# create a policy file at the file system
+attr.attribute_write_cert("Acme_buy_rockets__Acme_preferred_customer_attr.der")
+
+# load the policy into current context by with the newly created policy file
+ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+head = ABAC.Role(acme,"preferred_customer")
+tail = ABAC.Role(coyote)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Acme_preferred_customer__Coyote_attr.der")
+ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
Index: examples/passphrase_tests/python/acme_rockets_rt0/query.py
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/query.py	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/query.py	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,92 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.id_load_privkey_file("Acme_private.pem");
+acme=acmeID.id_keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.id_load_privkey_file("Coyote_private.pem");
+coyote=coyoteID.id_keyid()
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# is coyote a preferred_customer of Acme ?
+# role=[keyid:Acme].role:preferred_customer
+# p =[keyid:coyote]
+role = ABAC.Role(acme,"preferred_customer")
+p = ABAC.Role(coyote)
+print "\n===good============ Acme.preferred_customer <- Coyote"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# can coyote buy rockets from Acme ?
+# role=[keyid:Acme].role:buy_rockets
+# p =[keyid:coyote]
+role = ABAC.Role(acme,"buy_rockets")
+p = ABAC.Role(coyote)
+print "\n===good============ Acme.buy_rockets <- Coyote"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# is Acme a friend of coyote ?
+# role=[keyid:Coyote].role:friend
+# p=[keyid:Acme] 
+role = ABAC.Role(coyote,"friend")
+p = ABAC.Role(acme)
+print "\n===bad=============== Coyote.friend <- Acme"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# using complex role to ask a question.. expecting to fail 
+# role=[keyid:Acme].role:buy_rockets 
+# p=[keyid:Acme].role:preferred_customer
+role = ABAC.Role(acme,"buy_rockets")
+p = ABAC.Role(acme,"preferred_customer")
+print "\n===bad=============== Acme.buy_rockets <- Acme.preferred_customer"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+
Index: examples/passphrase_tests/python/acme_rockets_rt0/rocket.save
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/rocket.save	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/rocket.save	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,24 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+...final principal set...
+(pAcme,keyid,y) 
+(pCoyote,keyid,y) 
+
+...final policy attribute set...
+pAcme.buy_rockets <- pAcme.preferred_customer
+pAcme.preferred_customer <- pCoyote
+
+===good============ Acme.preferred_customer <- Coyote
+YAP query succeed
+pAcme.preferred_customer <- pCoyote
+
+===good============ Acme.buy_rockets <- Coyote
+YAP query succeed
+pAcme.buy_rockets <- pAcme.preferred_customer
+pAcme.preferred_customer <- pCoyote
+
+===bad=============== Coyote.friend <- Acme
+YAP query failed
+
+===bad=============== Acme.buy_rockets <- Acme.preferred_customer
+fail, a.o <- b.o and a.r <- a.r query is not implemented yet !!!
Index: examples/passphrase_tests/python/acme_rockets_rt0/run_test
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/run_test	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/run_test	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,32 @@
+#!/bin/sh 
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>rocket.log 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > rocket.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>rocket.cn 2>&1
+
+result=`diff rocket.cn rocket.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:acme_rockets_rt0 python test result differs!!!"
+    fi
+else
+    echo "   ERROR:acme_rockets_rt0  pythontest result differs!!!"
+fi
+
+
Index: examples/passphrase_tests/python/acme_rockets_rt0/setup
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/setup	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/setup	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+rm -rf *.pem *.der
+
+cp ../../PFILE pfile
+cp ../../ENC_PRIVATE.PEM Acme_private.pem
+
+
Index: examples/passphrase_tests/python/acme_rockets_rt0/setup.py
===================================================================
--- examples/passphrase_tests/python/acme_rockets_rt0/setup.py	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
+++ examples/passphrase_tests/python/acme_rockets_rt0/setup.py	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics. 
+sets up 2 (Acme, Coyote) principal ID credentials
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+acme=ABAC.ID("Acme", 0, "Acme_private.pem", "pfile")
+acme.id_write_cert("Acme_ID.pem")
+
+coyote=ABAC.ID("Coyote", 0)
+coyote.id_write_cert("Coyote_ID.pem")
+coyote.id_write_privkey("Coyote_private.pem")
+
