Index: tests/creddy_tests/Makefile
===================================================================
--- tests/creddy_tests/Makefile	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/Makefile	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,15 @@
+
+.PHONY : runcheck clean 
+runcheck: $(DIRECTORY)
+
+clean:
+	rm -rf *.xml *.pem *.out
+	rm -rf result
+
+runcheck: 
+	@echo 'running libabac CREDDY testing...' 
+	@./run_test > result 2>/dev/null; \
+	if test -f result && test `diff -q result.save result |wc -l ` -eq 0 ; \
+	then echo "   PASSED"; \
+	else echo "   ERROR:got changes!!!"; \
+	fi
Index: tests/creddy_tests/PGissuer.pem_save
===================================================================
--- tests/creddy_tests/PGissuer.pem_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/PGissuer.pem_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID/jCCA2egAwIBAgICA/gwDQYJKoZIhvcNAQEEBQAwgeMxCzAJBgNVBAYTAlVT
+MQ0wCwYDVQQIEwRVdGFoMRswGQYDVQQHExJTYWx0IExha2UgU2ltIENpdHkxITAf
+BgNVBAoTGFV0YWggTmV0d29yayBTZWNvbmQgTGlmZTEeMBwGA1UECxMVQ2VydGlm
+aWNhdGUgQXV0aG9yaXR5MSkwJwYDVQQDEyBteWJvc3Muam9ubGFiLnRlc3RiZWQu
+ZW11bGFiLm5ldDE6MDgGCSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9u
+bGFiLnRlc3RiZWQuZW11bGFiLm5ldDAeFw0xMzA0MjIxNTE1NDNaFw0xODEwMTMx
+NjE1NDNaMIG+MQswCQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDEhMB8GA1UEChMY
+VXRhaCBOZXR3b3JrIFNlY29uZCBMaWZlMRIwEAYDVQQLEwlqb25sYWIuc2ExLTAr
+BgNVBAMTJGUxYTIxMzNkLWFiNjctMTFlMi1iMDAxLTAwMjRlODc5MjdlYjE6MDgG
+CSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9ubGFiLnRlc3RiZWQuZW11
+bGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzYZo6Dq9Yo+LZ/Ah
+M2f6r/jkO/tJow5h6A4F4kqZfHIS1lyN/zICra47qjHpgrBC3npR5+ibr4AosC4m
+wDo09yFHbS0CUSIGuemt7Nnt/siD8ULqXwYMwHHDhr+wQnqgjiPoo0FT69lbfiQ3
+P1IH6TVn8j5vK/5i1PtolKqUg5MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUbXWxdwVR
+Ouopn6qnsRp9jaY9nBYwQgYDVR0RBDswOYY3dXJuOnB1YmxpY2lkOklETitqb25s
+YWIudGVzdGJlZC5lbXVsYWIubmV0K2F1dGhvcml0eStzYTAPBgNVHRMBAf8EBTAD
+AQH/MGoGCCsGAQUFBwEBBF4wXDBaBhRpg8yTgKiYzKjHvbGngICqrteKG4ZCaHR0
+cHM6Ly9teWJvc3Muam9ubGFiLnRlc3RiZWQuZW11bGFiLm5ldDoxMjM2OS9wcm90
+b2dlbmkveG1scnBjL3NhMA0GCSqGSIb3DQEBBAUAA4GBAHUtR537wn94Em+BJUS4
+lb6qQ/mDG49l1K12XJghyKU40pQCxRKlp4EWScghgtwcpBTaCcA3+ZOgkdwnHXLx
+pCabA69clBKdncqaaUzSCx4AGjGe9yMX6WliBvvh2dODQZeFlK7C9B7mTvkTFv4Z
+iMdQbxu/Fh8LdtU+ymuXekid
+-----END CERTIFICATE-----
Index: tests/creddy_tests/ProtoGENI.xml_save
===================================================================
--- tests/creddy_tests/ProtoGENI.xml_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/ProtoGENI.xml_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,125 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<signed-credential xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.protogeni.net/resources/credential/credential.xsd" xsi:schemaLocation="http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd">
+  <credential xml:id="refCB16DEE0B6F8507C">
+ <type>privilege</type>
+ <serial>15102</serial>
+ <owner_gid>MIIEQTCCA6qgAwIBAgICBAcwDQYJKoZIhvcNAQEEBQAwgeMxCzAJBgNVBAYTAlVT
+MQ0wCwYDVQQIEwRVdGFoMRswGQYDVQQHExJTYWx0IExha2UgU2ltIENpdHkxITAf
+BgNVBAoTGFV0YWggTmV0d29yayBTZWNvbmQgTGlmZTEeMBwGA1UECxMVQ2VydGlm
+aWNhdGUgQXV0aG9yaXR5MSkwJwYDVQQDEyBteWJvc3Muam9ubGFiLnRlc3RiZWQu
+ZW11bGFiLm5ldDE6MDgGCSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9u
+bGFiLnRlc3RiZWQuZW11bGFiLm5ldDAeFw0xMzA1MjkxMzU5MDFaFw0xNDA1Mjkx
+MzU5MDFaMIGzMQswCQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDEhMB8GA1UEChMY
+VXRhaCBOZXR3b3JrIFNlY29uZCBMaWZlMRQwEgYDVQQLEwtqb25sYWIudXNlcjEt
+MCsGA1UEAxMkNzcxZGUzY2EtYzg2Ny0xMWUyLWIwMDEtMDAyNGU4NzkyN2ViMS0w
+KwYJKoZIhvcNAQkBFh51c2VyQGpvbmxhYi50ZXN0YmVkLmVtdWxhYi5uZXQwgZ8w
+DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJwMbC6tGGlqcL5Jsm65uMQyyr9epUEJ
+MidAV5pMi5I2jlwy+xfI01OT+bmq/ZqB6yLgTERAXMx/xcjA3M9zRcO2h3gK6W2R
+5Jg1sZbocHaS6Qp8nrceXUdnWJxHPxwHlkGcNZisTNrB/jzUIZvzqpHKsHj8SKAF
+ByRXo7FgeEubAgMBAAGjggEwMIIBLDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQG
+0yIBzv5opmk6a6YDjdQb+jq09jCBkAYDVR0RBIGIMIGFhjR1cm46cHVibGljaWQ6
+SUROK2pvbmxhYi50ZXN0YmVkLmVtdWxhYi5uZXQrdXNlcit1c2VygR51c2VyQGpv
+bmxhYi50ZXN0YmVkLmVtdWxhYi5uZXSGLXVybjp1dWlkOjc3MWRlM2NhLWM4Njct
+MTFlMi1iMDAxLTAwMjRlODc5MjdlYjBqBggrBgEFBQcBAQReMFwwWgYUaYPMk4Co
+mMyox72xp4CAqq7XihuGQmh0dHBzOi8vbXlib3NzLmpvbmxhYi50ZXN0YmVkLmVt
+dWxhYi5uZXQ6MTIzNjkvcHJvdG9nZW5pL3htbHJwYy9zYTANBgkqhkiG9w0BAQQF
+AAOBgQBcdrf70YPbnIoQvlUdX/rBRh4Xxo55uqJ8kZEdnIKcN/OaiwYkVuPHWl/k
+qxmTnB707+e9uhhszNhQLuWnXuD+w08gcBUNQiUxF9MjW1nw1LrLQjvShetJKVs6
+Uut/UnbDbeS05LkhQw0I1Q75alZcY6r5qRZkmcbDisR8IRHjJg==
+</owner_gid>
+ <owner_urn>urn:publicid:IDN+jonlab.testbed.emulab.net+user+user</owner_urn>
+ <target_gid>MIID/jCCA2egAwIBAgICA/gwDQYJKoZIhvcNAQEEBQAwgeMxCzAJBgNVBAYTAlVT
+MQ0wCwYDVQQIEwRVdGFoMRswGQYDVQQHExJTYWx0IExha2UgU2ltIENpdHkxITAf
+BgNVBAoTGFV0YWggTmV0d29yayBTZWNvbmQgTGlmZTEeMBwGA1UECxMVQ2VydGlm
+aWNhdGUgQXV0aG9yaXR5MSkwJwYDVQQDEyBteWJvc3Muam9ubGFiLnRlc3RiZWQu
+ZW11bGFiLm5ldDE6MDgGCSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9u
+bGFiLnRlc3RiZWQuZW11bGFiLm5ldDAeFw0xMzA0MjIxNTE1NDNaFw0xODEwMTMx
+NjE1NDNaMIG+MQswCQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDEhMB8GA1UEChMY
+VXRhaCBOZXR3b3JrIFNlY29uZCBMaWZlMRIwEAYDVQQLEwlqb25sYWIuc2ExLTAr
+BgNVBAMTJGUxYTIxMzNkLWFiNjctMTFlMi1iMDAxLTAwMjRlODc5MjdlYjE6MDgG
+CSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9ubGFiLnRlc3RiZWQuZW11
+bGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzYZo6Dq9Yo+LZ/Ah
+M2f6r/jkO/tJow5h6A4F4kqZfHIS1lyN/zICra47qjHpgrBC3npR5+ibr4AosC4m
+wDo09yFHbS0CUSIGuemt7Nnt/siD8ULqXwYMwHHDhr+wQnqgjiPoo0FT69lbfiQ3
+P1IH6TVn8j5vK/5i1PtolKqUg5MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUbXWxdwVR
+Ouopn6qnsRp9jaY9nBYwQgYDVR0RBDswOYY3dXJuOnB1YmxpY2lkOklETitqb25s
+YWIudGVzdGJlZC5lbXVsYWIubmV0K2F1dGhvcml0eStzYTAPBgNVHRMBAf8EBTAD
+AQH/MGoGCCsGAQUFBwEBBF4wXDBaBhRpg8yTgKiYzKjHvbGngICqrteKG4ZCaHR0
+cHM6Ly9teWJvc3Muam9ubGFiLnRlc3RiZWQuZW11bGFiLm5ldDoxMjM2OS9wcm90
+b2dlbmkveG1scnBjL3NhMA0GCSqGSIb3DQEBBAUAA4GBAHUtR537wn94Em+BJUS4
+lb6qQ/mDG49l1K12XJghyKU40pQCxRKlp4EWScghgtwcpBTaCcA3+ZOgkdwnHXLx
+pCabA69clBKdncqaaUzSCx4AGjGe9yMX6WliBvvh2dODQZeFlK7C9B7mTvkTFv4Z
+iMdQbxu/Fh8LdtU+ymuXekid
+</target_gid>
+ <target_urn>urn:publicid:IDN+jonlab.testbed.emulab.net+authority+sa</target_urn>
+ <uuid>9bc8ec4e-c869-11e2-b001-0024e87927eb</uuid>
+ <expires>2013-05-30T14:11:08Z</expires>
+  <privileges>
+<privilege><name>*</name><can_delegate>1</can_delegate></privilege>
+</privileges></credential>
+  <signatures>
+    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#" xml:id="Sig_refCB16DEE0B6F8507C">
+ <SignedInfo>
+  <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
+  <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+  <Reference URI="#refCB16DEE0B6F8507C">
+    <Transforms>
+      <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+    </Transforms>
+    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+    <DigestValue>9/uW8NR0sHZpLAPzxZ32SOLAZhY=</DigestValue>
+    </Reference>
+ </SignedInfo>
+ <SignatureValue>UfAUZ5RyncNw+YWJOAbmfnOYbpWxeyVLDZ9Kg7yw4idRUE0/CnL0bNkUAT5g2IYF
+W/kKxooWz/1P15/EOtDE+OYJCdnWwR1iEoWoxyQayP94bygAZ7WiLvrwhoTMQ01+
+lvnjClLyTAibpeWp2Uql1KRSX8TFrEKXsKqPt/vhOls=</SignatureValue>
+ <KeyInfo>
+  <X509Data>
+   
+   
+   
+  <X509Certificate>MIID/jCCA2egAwIBAgICA/gwDQYJKoZIhvcNAQEEBQAwgeMxCzAJBgNVBAYTAlVT
+MQ0wCwYDVQQIEwRVdGFoMRswGQYDVQQHExJTYWx0IExha2UgU2ltIENpdHkxITAf
+BgNVBAoTGFV0YWggTmV0d29yayBTZWNvbmQgTGlmZTEeMBwGA1UECxMVQ2VydGlm
+aWNhdGUgQXV0aG9yaXR5MSkwJwYDVQQDEyBteWJvc3Muam9ubGFiLnRlc3RiZWQu
+ZW11bGFiLm5ldDE6MDgGCSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9u
+bGFiLnRlc3RiZWQuZW11bGFiLm5ldDAeFw0xMzA0MjIxNTE1NDNaFw0xODEwMTMx
+NjE1NDNaMIG+MQswCQYDVQQGEwJVUzENMAsGA1UECBMEVXRhaDEhMB8GA1UEChMY
+VXRhaCBOZXR3b3JrIFNlY29uZCBMaWZlMRIwEAYDVQQLEwlqb25sYWIuc2ExLTAr
+BgNVBAMTJGUxYTIxMzNkLWFiNjctMTFlMi1iMDAxLTAwMjRlODc5MjdlYjE6MDgG
+CSqGSIb3DQEJARYrdGVzdGJlZC1vcHNAbXlvcHMuam9ubGFiLnRlc3RiZWQuZW11
+bGFiLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzYZo6Dq9Yo+LZ/Ah
+M2f6r/jkO/tJow5h6A4F4kqZfHIS1lyN/zICra47qjHpgrBC3npR5+ibr4AosC4m
+wDo09yFHbS0CUSIGuemt7Nnt/siD8ULqXwYMwHHDhr+wQnqgjiPoo0FT69lbfiQ3
+P1IH6TVn8j5vK/5i1PtolKqUg5MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUbXWxdwVR
+Ouopn6qnsRp9jaY9nBYwQgYDVR0RBDswOYY3dXJuOnB1YmxpY2lkOklETitqb25s
+YWIudGVzdGJlZC5lbXVsYWIubmV0K2F1dGhvcml0eStzYTAPBgNVHRMBAf8EBTAD
+AQH/MGoGCCsGAQUFBwEBBF4wXDBaBhRpg8yTgKiYzKjHvbGngICqrteKG4ZCaHR0
+cHM6Ly9teWJvc3Muam9ubGFiLnRlc3RiZWQuZW11bGFiLm5ldDoxMjM2OS9wcm90
+b2dlbmkveG1scnBjL3NhMA0GCSqGSIb3DQEBBAUAA4GBAHUtR537wn94Em+BJUS4
+lb6qQ/mDG49l1K12XJghyKU40pQCxRKlp4EWScghgtwcpBTaCcA3+ZOgkdwnHXLx
+pCabA69clBKdncqaaUzSCx4AGjGe9yMX6WliBvvh2dODQZeFlK7C9B7mTvkTFv4Z
+iMdQbxu/Fh8LdtU+ymuXekid</X509Certificate>
+<X509SubjectName>emailAddress=testbed-ops@myops.jonlab.testbed.emulab.net,CN=e1a2133d-ab67-11e2-b001-0024e87927eb,OU=jonlab.sa,O=Utah Network Second Life,ST=Utah,C=US</X509SubjectName>
+<X509IssuerSerial>
+<X509IssuerName>emailAddress=testbed-ops@myops.jonlab.testbed.emulab.net,CN=myboss.jonlab.testbed.emulab.net,OU=Certificate Authority,O=Utah Network Second Life,L=Salt Lake Sim City,ST=Utah,C=US</X509IssuerName>
+<X509SerialNumber>1016</X509SerialNumber>
+</X509IssuerSerial>
+</X509Data>
+  <KeyValue>
+<RSAKeyValue>
+<Modulus>
+zYZo6Dq9Yo+LZ/AhM2f6r/jkO/tJow5h6A4F4kqZfHIS1lyN/zICra47qjHpgrBC
+3npR5+ibr4AosC4mwDo09yFHbS0CUSIGuemt7Nnt/siD8ULqXwYMwHHDhr+wQnqg
+jiPoo0FT69lbfiQ3P1IH6TVn8j5vK/5i1PtolKqUg5M=
+</Modulus>
+<Exponent>
+AQAB
+</Exponent>
+</RSAKeyValue>
+</KeyValue>
+ </KeyInfo>
+</Signature>
+  </signatures>
+</signed-credential>
+
Index: tests/creddy_tests/README
===================================================================
--- tests/creddy_tests/README	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/README	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,4 @@
+
+In this testing suite, various features of creddy is exercised
+
+
Index: tests/creddy_tests/attribute.ck
===================================================================
--- tests/creddy_tests/attribute.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/attribute.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# attribute.ck
+
+result=`diff attribute.out attribute.save 2>/dev/null`
+
+if [ "$result" = "" ]; then
+    return 0
+else
+    return 1
+fi
+
+
+# ignore
+#
+
Index: tests/creddy_tests/attribute.save
===================================================================
--- tests/creddy_tests/attribute.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/attribute.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,14 @@
+---running attribute 
+Usage: creddy --attribute \
+                --issuer <cert> --key <key> --role <role> \
+                [ --subject-cert <cert> | --subject-id <sha1> \
+                    [ --subject-role <role> ]  ... ] \
+                [ --validity <time> ] --out <file>
+    default validity: 365 days
+    provide exactly one of --subject-cert / --subject-id
+    give multiple --subject-{cert,id} / --subject-role pairs for intersection
+
+    time is specified with optional suffix: s m h d y
+    defaults to days if unspecified
+wrong private key for the cert!!
+creddy: Can't load private key from Coyote_private.pem
Index: tests/creddy_tests/attribute.sh
===================================================================
--- tests/creddy_tests/attribute.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/attribute.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role roleOne \
+       --subject-cert Acme_ID.pem --subject-role simple_subject_role \
+       --out Acme_roleOne__Acme_simple_subject_role_attr.xml
+
+$eloc/creddy --attribute \
+       --issuer Acme_ID.pem --role roleTwo \
+       --subject-cert Acme_ID.pem --subject-role simple_subject_role \
+       --out Acme_roleTwo__Acme_simple_subject_role_attr.xml
+
+$eloc/creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role roleThree \
+       --subject-cert Coyote_ID.pem --subject-role simple_subject_role \
+       --out Acme_roleThree__Coyote_simple_subject_role_attr.xml
+
+$eloc/creddy --attribute \
+       --issuer Acme_ID.pem --key Coyote_private.pem --role roleFour \
+       --subject-cert Coyote_ID.pem --subject-role simple_subject_role \
+       --out Acme_roleFour__Coyote_simple_subject_role_attr.xml
+
+
Index: tests/creddy_tests/attribute_rule.ck
===================================================================
--- tests/creddy_tests/attribute_rule.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/attribute_rule.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# attribute_rule.ck
+
+result=`diff -I "sneaky_friend" attribute_rule.out attribute_rule.save 2>/dev/null`
+
+if [ "$result" = "" ]; then
+    return 0
+else
+    return 1
+fi
+
+
+# ignore
+
+#
+#2c2
+#< 42d367c6c599ac9d505cafa9abe92fd00d587db5.sneaky_friend<-a1dca2221c256393553edb5369980b4c04768dc0
+#---
+#> 0331e8fb4e0b4a58fcda5b938eaeab6a0663d7d3.sneaky_friend<-7ab52740e981d1c98589bed128e94fbefffa181a
+#
Index: tests/creddy_tests/attribute_rule.save
===================================================================
--- tests/creddy_tests/attribute_rule.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/attribute_rule.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,2 @@
+---running attribute_rule 
+0331e8fb4e0b4a58fcda5b938eaeab6a0663d7d3.sneaky_friend<-7ab52740e981d1c98589bed128e94fbefffa181a
Index: tests/creddy_tests/attribute_rule.sh
===================================================================
--- tests/creddy_tests/attribute_rule.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/attribute_rule.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+#attribute_rule.sh
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --generate --cn Bigbird 1>/dev/null 2>& 1
+$eloc/creddy --generate --cn Coyote 1>/dev/null 2>& 1
+
+bigbird=`creddy --keyid --cert Bigbird_ID.pem`
+coyote=`creddy --keyid --cert Coyote_ID.pem`
+
+rule="$coyote.sneaky_friend<-$bigbird"
+
+$eloc/creddy --attribute \
+       --issuer Coyote_ID.pem --key Coyote_private.pem \
+       --attrrule "$rule" \
+       --out Coyote_sneakyFriend__Bigbird_attr.xml
+
+$eloc/creddy --roles --cert Coyote_sneakyFriend__Bigbird_attr.xml
+
Index: tests/creddy_tests/display.ck
===================================================================
--- tests/creddy_tests/display.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/display.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# display.ck
+
+result=`diff display.out display.save 2>/dev/null |wc -l`
+
+if [ $result -eq 50 ]; then
+    return 0
+else
+    return 1
+fi
+
Index: tests/creddy_tests/display.save
===================================================================
--- tests/creddy_tests/display.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/display.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,73 @@
+---running display 
+Issuer: /CN=Acme
+Subject: /CN=Acme
+Validity:
+    Not before: 2013-05-31 06:33:52 PST [1370010832]
+    Not after:  2016-05-15 06:33:52 PST [1463322832]
+creddy: Couldn't load Acme_private.pem as an ID or attribute, 
+Issuer: /CN=Acme
+Subject: /CN=Acme
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2014-05-31 06:33:55 GMT [1401546835]
+Roles: 1bf6cb92f7a4e770a6a78c5dcc7f063b0e8db629.buy_rockets<-1bf6cb92f7a4e770a6a78c5dcc7f063b0e8db629.preferred_customer
+Issuer: /CN=Acme
+Subject: /CN=Acme
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2014-05-31 06:33:55 GMT [1401546835]
+Roles: 1bf6cb92f7a4e770a6a78c5dcc7f063b0e8db629.preferred_customer<-b0c2a825907e33c334561c138d2b9412ea358994
+creddy: Couldn't load bad_attr.xml as an ID or attribute, 
+Issuer: /C=US/ST=California/L=Marina del Rey/O=DETER Network Security Testbed/OU=Certificate Authority/CN=boss.isi.deterlab.net/emailAddress=testbed-ops@isi.deterlab.net
+Subject: /C=US/ST=California/O=DETER Network Security Testbed/OU=sslxmlrpc/CN=70f4db5c-c7f5-11dc-a204-000423c28e76/emailAddress=faber@isi.deterlab.net
+Validity:
+    Not before: 2010-11-05 22:35:12 PST [1289025312]
+    Not after:  2013-08-01 22:35:12 PST [1375425312]
+Issuer: /C=US/ST=California/L=Marina del Rey/O=DETER Network Security Testbed/OU=Certificate Authority/CN=boss.isi.deterlab.net/emailAddress=testbed-ops@isi.deterlab.net
+Subject: /C=US/ST=California/O=DETER Network Security Testbed/OU=sslxmlrpc/CN=70f4db5c-c7f5-11dc-a204-000423c28e76/emailAddress=faber@isi.deterlab.net
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2014-05-20 17:39:55 GMT [1400636395]
+Roles: 0a778934b93d546406d195d18e4f208af11ea84a.test_attr<-633aadf1753647ba60f28b7310f5a56cd32ab7e2
+creddy: Couldn't load ProtoGENI.xml as an ID or attribute, 
+Issuer: /C=US/ST=Utah/L=Salt Lake Sim City/O=Utah Network Second Life/OU=Certificate Authority/CN=myboss.jonlab.testbed.emulab.net/emailAddress=testbed-ops@myops.jonlab.testbed.emulab.net
+Subject: /C=US/ST=Utah/O=Utah Network Second Life/OU=jonlab.sa/CN=e1a2133d-ab67-11e2-b001-0024e87927eb/emailAddress=testbed-ops@myops.jonlab.testbed.emulab.net
+Validity:
+    Not before: 2013-04-22 15:15:43 PST [1366672543]
+    Not after:  2018-10-13 16:15:43 PST [1539476143]
+Issuer: /CN=issuer
+Subject: /CN=issuer
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2015-07-14 19:52:08 GMT [1436932328]
+Roles: 378a1922494c157372be987d9b8657633119d9e0.speaks_for_f75358f7f87f3fe641121ad37fd5c3163b0896ff <- f75358f7f87f3fe641121ad37fd5c3163b0896ff.speaks_for_f75358f7f87f3fe641121ad37fd5c3163b0896ff
+Issuer: /CN=issuer
+Subject: /CN=issuer
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2015-07-14 19:52:08 GMT [1436932328]
+Roles: 378a1922494c157372be987d9b8657633119d9e0.speaks_for_f75358f7f87f3fe641121ad37fd5c3163b0896ff <- f75358f7f87f3fe641121ad37fd5c3163b0896ff
+Issuer: /CN=issuer
+Subject: /CN=issuer
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2015-07-14 19:52:08 GMT [1436932328]
+Roles: 378a1922494c157372be987d9b8657633119d9e0.refresh_633aadf1753647ba60f28b7310f5a56cd32ab7e2 <- 378a1922494c157372be987d9b8657633119d9e0.speaks_for_f75358f7f87f3fe641121ad37fd5c3163b0896ff
+Issuer: /CN=issuer
+Subject: /CN=issuer
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2015-07-14 19:52:08 GMT [1436932328]
+Roles: 378a1922494c157372be987d9b8657633119d9e0.test2_633aadf1753647ba60f28b7310f5a56cd32ab7e2 <- 378a1922494c157372be987d9b8657633119d9e0.speaks_for_f75358f7f87f3fe641121ad37fd5c3163b0896ff
+Issuer: /CN=issuer
+Subject: /CN=issuer
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2015-07-14 19:52:08 GMT [1436932328]
+Roles: 378a1922494c157372be987d9b8657633119d9e0.test2_633aadf1753647ba60f28b7310f5a56cd32ab7e2 <- 378a1922494c157372be987d9b8657633119d9e0.can_delegate_test2_633aadf1753647ba60f28b7310f5a56cd32ab7e2.test2_633aadf1753647ba60f28b7310f5a56cd32ab7e2
+Issuer: /CN=issuer
+Subject: /CN=issuer
+Validity:
+    Not before: 2013-05-31 06:33:55 GMT [1370010835]
+    Not after:  2015-07-14 19:52:08 GMT [1436932328]
+Roles: 378a1922494c157372be987d9b8657633119d9e0.can_delegate_test2_633aadf1753647ba60f28b7310f5a56cd32ab7e2 <- f75358f7f87f3fe641121ad37fd5c3163b0896ff
Index: tests/creddy_tests/display.sh
===================================================================
--- tests/creddy_tests/display.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/display.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --display --show=all --cert Acme_ID.pem
+$eloc/creddy --display --show=all --cert Acme_private.pem
+$eloc/creddy --display --show=all --cert Acme_buy_rockets__Acme_preferred_customer_attr.xml
+$eloc/creddy --display --show=all --cert Acme_preferred_customer__Coyote_attr.xml
+$eloc/creddy --display --show=all --cert bad_attr.xml
+
+$eloc/creddy --display --show=all --cert not_ss.pem
+$eloc/creddy --display --show=all --cert not_ss.xml
+
+$eloc/creddy --display --show=all --cert ProtoGENI.xml
+$eloc/creddy --display --show=all --cert PGissuer.pem
+$eloc/creddy --display --show=all --cert priv.xml
Index: tests/creddy_tests/generate.ck
===================================================================
--- tests/creddy_tests/generate.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/generate.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# generate.ck
+
+result=`diff -I "buy_rockets" generate.out generate.save 2>/dev/null`
+list=`ls -l *ID.pem |wc -l`
+
+if [ "$result" = "" -a $list -eq 6 ]; then
+    return 0
+else
+    return 1
+fi
+
+
+# ignore
+#
+
Index: tests/creddy_tests/generate.sh
===================================================================
--- tests/creddy_tests/generate.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/generate.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --generate --cn Bigbird
+$eloc/creddy --generate --cn 12_3
+## looks like optarg just picked up the 'Bad' part
+$eloc/creddy --generate --cn Bad$name
+$eloc/creddy --generate --cn abc --cert bad_attr.xml
Index: tests/creddy_tests/keyid.ck
===================================================================
--- tests/creddy_tests/keyid.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/keyid.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# keyid.ck
+
+q=`diff -q keyid.out keyid.save 2>/dev/null |grep -c differ`
+result=`diff keyid.out keyid.save 2>/dev/null |wc -l`
+
+if [ $q -eq 1 -a $result -eq 4 ]; then
+    return 0
+else
+    return 1
+fi
+
Index: tests/creddy_tests/keyid.save
===================================================================
--- tests/creddy_tests/keyid.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/keyid.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,10 @@
+---running keyid 
+cfa52808c42825751443522edd790b05e4937049
+creddy: Couldn't load ID cert from Acme_private.pem
+creddy: Couldn't load ID cert from Acme_buy_rockets__Acme_preferred_customer_attr.xml
+creddy: Couldn't load ID cert from bad_attr.xml
+0a778934b93d546406d195d18e4f208af11ea84a
+creddy: Couldn't load ID cert from not_ss.xml
+creddy: Couldn't load ID cert from priv.xml
+6d75b17705513aea299faaa7b11a7d8da63d9c16
+creddy: Couldn't load ID cert from ProtoGENI.xml
Index: tests/creddy_tests/keyid.sh
===================================================================
--- tests/creddy_tests/keyid.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/keyid.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --keyid --cert Acme_ID.pem
+$eloc/creddy --keyid --cert Acme_private.pem
+$eloc/creddy --keyid --cert Acme_buy_rockets__Acme_preferred_customer_attr.xml
+$eloc/creddy --keyid --cert bad_attr.xml
+
+$eloc/creddy --keyid --cert not_ss.pem
+$eloc/creddy --keyid --cert not_ss.xml
+$eloc/creddy --keyid --cert priv.xml
+$eloc/creddy --keyid --cert PGissuer.pem
+$eloc/creddy --keyid --cert ProtoGENI.xml
+
Index: tests/creddy_tests/not_ss.pem_save
===================================================================
--- tests/creddy_tests/not_ss.pem_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/not_ss.pem_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC+DCCAmECAg2pMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJVUzETMBEG
+A1UECBMKQ2FsaWZvcm5pYTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxJzAlBgNV
+BAoTHkRFVEVSIE5ldHdvcmsgU2VjdXJpdHkgVGVzdGJlZDEeMBwGA1UECxMVQ2Vy
+dGlmaWNhdGUgQXV0aG9yaXR5MR4wHAYDVQQDExVib3NzLmlzaS5kZXRlcmxhYi5u
+ZXQxKzApBgkqhkiG9w0BCQEWHHRlc3RiZWQtb3BzQGlzaS5kZXRlcmxhYi5uZXQw
+HhcNMTAxMTA1MjIzNTEyWhcNMTMwODAxMjIzNTEyWjCBtTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExJzAlBgNVBAoTHkRFVEVSIE5ldHdvcmsgU2Vj
+dXJpdHkgVGVzdGJlZDESMBAGA1UECxMJc3NseG1scnBjMS0wKwYDVQQDEyQ3MGY0
+ZGI1Yy1jN2Y1LTExZGMtYTIwNC0wMDA0MjNjMjhlNzYxJTAjBgkqhkiG9w0BCQEW
+FmZhYmVyQGlzaS5kZXRlcmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAPfkJKdY9YBblX5WbiEjdNOQuLgLmAMif57VQ+LVk505dihLgkZc25qQTJOQ
+16sWFqLrl04334kMHzDmLn74/af5rxDxipSc+fxXd3WNX20NnIP0XJFl+IpAt+me
+G5ksmisLOwD7Iw7upbgB9oIBV16ByFHo9I5uyqQ00SN5FvjVAgMBAAEwDQYJKoZI
+hvcNAQEEBQADgYEAjGn3aZtem7Me+uGpPw6xEs8pwd3EtJ9yLofr2EMOkUKYNTHL
+fVV8cqybBCYF+RH8UYZPk3oIYH0XCfa1dzEeOcEBmYqlhcDgM8Y0Wpfh5t590ScI
+h7nN7kzGIN0wpUG6sASNqQdXA8YxwpPE/XjLrE0QKT69bU2rZnBGqSYcpzY=
+-----END CERTIFICATE-----
Index: tests/creddy_tests/not_ss.xml_save
===================================================================
--- tests/creddy_tests/not_ss.xml_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/not_ss.xml_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<signed-credential>
+    <credential xml:id="ref0">
+	<type>abac</type>
+	<version>1.0</version>
+	<expires>2014-05-20T17:39:55Z</expires>
+	<rt0>0a778934b93d546406d195d18e4f208af11ea84a.test_attr&lt;-633aadf1753647ba60f28b7310f5a56cd32ab7e2</rt0>
+    </credential>
+    <signatures>
+	<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+	    <SignedInfo>
+		<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+		<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+		<Reference URI="#ref0">
+		    <Transforms>
+			<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+		    </Transforms>
+		    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+		    <DigestValue>PZhnlEVuQz0AEHrBFzEcuefhWB8=</DigestValue>
+		</Reference>
+	    </SignedInfo>
+	    <SignatureValue>wYIkXgDSnzeTVu/Cc2C2W5bib6w0SVzZcKSabls47Qr6rJMdNUKrO3YOV8fcHrbT
+9wsCrEq2v2d8kuueuzSjzXvZrgBBfXrMe83Z427F0todl5/IhQTgXtKyhYsKZEvU
+5C50FVKSs/spKCqcO95TYtzEZEAu6yCJV/Oa59TYt/4=</SignatureValue>
+	    <KeyInfo>
+	      <KeyValue>
+<RSAKeyValue>
+<Modulus>
+9+Qkp1j1gFuVflZuISN005C4uAuYAyJ/ntVD4tWTnTl2KEuCRlzbmpBMk5DXqxYW
+ouuXTjffiQwfMOYufvj9p/mvEPGKlJz5/Fd3dY1fbQ2cg/RckWX4ikC36Z4bmSya
+Kws7APsjDu6luAH2ggFXXoHIUej0jm7KpDTRI3kW+NU=
+</Modulus>
+<Exponent>
+AQAB
+</Exponent>
+</RSAKeyValue>
+</KeyValue>
+		<X509Data>
+		    
+		    
+		    
+		<X509Certificate>MIIC+DCCAmECAg2pMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJVUzETMBEG
+A1UECBMKQ2FsaWZvcm5pYTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxJzAlBgNV
+BAoTHkRFVEVSIE5ldHdvcmsgU2VjdXJpdHkgVGVzdGJlZDEeMBwGA1UECxMVQ2Vy
+dGlmaWNhdGUgQXV0aG9yaXR5MR4wHAYDVQQDExVib3NzLmlzaS5kZXRlcmxhYi5u
+ZXQxKzApBgkqhkiG9w0BCQEWHHRlc3RiZWQtb3BzQGlzaS5kZXRlcmxhYi5uZXQw
+HhcNMTAxMTA1MjIzNTEyWhcNMTMwODAxMjIzNTEyWjCBtTELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExJzAlBgNVBAoTHkRFVEVSIE5ldHdvcmsgU2Vj
+dXJpdHkgVGVzdGJlZDESMBAGA1UECxMJc3NseG1scnBjMS0wKwYDVQQDEyQ3MGY0
+ZGI1Yy1jN2Y1LTExZGMtYTIwNC0wMDA0MjNjMjhlNzYxJTAjBgkqhkiG9w0BCQEW
+FmZhYmVyQGlzaS5kZXRlcmxhYi5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAPfkJKdY9YBblX5WbiEjdNOQuLgLmAMif57VQ+LVk505dihLgkZc25qQTJOQ
+16sWFqLrl04334kMHzDmLn74/af5rxDxipSc+fxXd3WNX20NnIP0XJFl+IpAt+me
+G5ksmisLOwD7Iw7upbgB9oIBV16ByFHo9I5uyqQ00SN5FvjVAgMBAAEwDQYJKoZI
+hvcNAQEEBQADgYEAjGn3aZtem7Me+uGpPw6xEs8pwd3EtJ9yLofr2EMOkUKYNTHL
+fVV8cqybBCYF+RH8UYZPk3oIYH0XCfa1dzEeOcEBmYqlhcDgM8Y0Wpfh5t590ScI
+h7nN7kzGIN0wpUG6sASNqQdXA8YxwpPE/XjLrE0QKT69bU2rZnBGqSYcpzY=</X509Certificate>
+<X509SubjectName>emailAddress=faber@isi.deterlab.net,CN=70f4db5c-c7f5-11dc-a204-000423c28e76,OU=sslxmlrpc,O=DETER Network Security Testbed,ST=California,C=US</X509SubjectName>
+<X509IssuerSerial>
+<X509IssuerName>emailAddress=testbed-ops@isi.deterlab.net,CN=boss.isi.deterlab.net,OU=Certificate Authority,O=DETER Network Security Testbed,L=Marina del Rey,ST=California,C=US</X509IssuerName>
+<X509SerialNumber>3497</X509SerialNumber>
+</X509IssuerSerial>
+</X509Data>
+	    </KeyInfo>
+	</Signature>
+    </signatures>
+</signed-credential>
Index: tests/creddy_tests/priv.xml_save
===================================================================
--- tests/creddy_tests/priv.xml_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/priv.xml_save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<signed-credential><credential xml:id="ref0"><type>privilege</type><serial>8</serial>
+    <owner_gid>
+MIIDBjCCAe6gAwIBAgIJAPE7s3B5kTdLMA0GCSqGSIb3DQEBBQUAMBAxDjAMBgNV
+BAMTBW93bmVyMB4XDTEzMDUwOTAwNTEwN1oXDTE2MDQyMzAwNTEwN1owEDEOMAwG
+A1UEAxMFb3duZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkKGUk
+ruciVF3pt6EoZIPE658WP/r3y+VYJ8qz7vaOaq7zhtWAxJU+3D/bLwDVgIa/pJhy
+80HfU1w1sT5BF7u04jz8kXk3a2yG6blYIMSESyTmGG1Kh3qQIvAQCzG6u9JE9/Dl
+jv/FaI7xppRQfSWNCJjEAg6Yp+Zh1pIdmQ0L4XgCJpZ3J0sjDBF3klZOlSNdXHP+
+VFPZM2zFVGN8Psf9talcDsPPxiyjIFOP3ZNaAHbSTFqs0Fet6mBCcyUq5ihxBmMy
+1DzrYGokcT+BhUOOloIOM2a6FUyS2dnVQdYUJUC49MJzS7eRoq7HFtF2SkkJGoPI
+QhwXBYQATOgCHri9AgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMB0GA1UdDgQWBBT3U1j3+H8/5kESGtN/1cMWOwiW/zAfBgNVHSMEGDAW
+gBT3U1j3+H8/5kESGtN/1cMWOwiW/zANBgkqhkiG9w0BAQUFAAOCAQEAnanyKDiV
+hupOgOFbF0yPyRNVcSQ0aMzfTMalrD/n5hwcm6kkeMpE/UhoyFHGze8vTjdV7B6A
+As3aSe9ylpW3LvMvxAHsbMM8cRTsFJAr+XOiDG4wf3Bvz3nMa/eZCOgc5Eei+I1j
+6b+h7ITv+qNmF/fYvo++iKn81bQfbVlUhNKnUVQOMQsEa96UFVYb7e1xAkBIrQjS
+z+y7cs+pC+nV/IZM9W5mGomMJ2UIGPkylkuJ1xyKkOVi/upd2IfpLxOX+5yOG/rc
+/YY2wLDy2uh/hKTQD3KqDs2Dreh+8N9UPhyphPT60GbXtZjznssPH77lrZWcEKmh
+AXI5VDa7QK9Bow==
+    </owner_gid>
+    <owner_urn>urn:publicid:IDN+plc:gpo:site2+user+jkarlin</owner_urn>
+    <target_gid>
+MIIDCDCCAfCgAwIBAgIJANWtb5ZPUhtJMA0GCSqGSIb3DQEBBQUAMBExDzANBgNV
+BAMTBnRhcmdldDAeFw0xMzA1MDkwMDUxMTFaFw0xNjA0MjMwMDUxMTFaMBExDzAN
+BgNVBAMTBnRhcmdldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOW8
+ajwAW7Ir1dG6qE2r1QY1Kl6yhRj1eiC3oc9rnmpXasgc0mGQX3XW4xe4Schegd9h
+816iZKWJsFdmq7iz0Kd4BQCa6A/3vXdTfDbB6xMpAtItwWYjCiOrBwaMrmKeMfYs
+o1z0mbJNgluuQoELrsMThaRk5opbTEm3bLTOkiyEYJt0jrn+Afr2Ne5DHrQ/bb4n
+UIrXqyksE4CsWyORKZmpzlP2cyhgjTXD4DaATGWe1j2gLmqrYcQxtoG4/f3OMgUb
+ALf1S6wyAeDxnAiaVxQvSyzauV5X5sR4mlCJ8pKMXPt/IRNRnNEomZ6R5MkZa6kX
+QYPLzEscabWlEKrEiPMCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B
+Af8EBAMCAQYwHQYDVR0OBBYEFGM6rfF1Nke6YPKLcxD1pWzTKrfiMB8GA1UdIwQY
+MBaAFGM6rfF1Nke6YPKLcxD1pWzTKrfiMA0GCSqGSIb3DQEBBQUAA4IBAQAlm3pV
+IjFjshe1SWsOeBOO4gMrLa2BsZLFKdkcm2pBrRn/L+fzfBl5qOnXoojq7oM/8PGB
+pPGuptXE2H3ybVkS0s5vl4kqrgGAFfUAXzOrc6b5QVntj8oOGEwTf+eQ+mpOB3Zy
+I5CxDJ1EYa6Ad0QCteGuygGzcXa4X1Lu0ueiTAltQ9FpvTclFSqKROM9OMkMSDRm
+PcDbrRZVObXSgqlIKnHB6wLyPSWLkIylWx8TYEWqfRtTHQMJqUFNDiPUvIjzk6J8
+rTke0E30WVS7F08Pipa5TC+5pnrYrXv7zp5cwE2CbAmKxZDK9rFVaSlESDoXOWfj
+kUZGc3/3pSEX0WMC
+    </target_gid><target_urn>urn:publicid:IDN+plc:gpo:site2+user+jkarlin</target_urn><uuid/><expires>2015-07-14T19:52:08Z</expires><privileges><privilege><name>refresh</name><can_delegate>false</can_delegate></privilege><privilege><name>test2</name><can_delegate>true</can_delegate></privilege></privileges></credential><signatures><Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+<SignedInfo>
+<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+<Reference URI="#ref0">
+<Transforms>
+<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+</Transforms>
+<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+<DigestValue>oVidj/V4RM0KRcoC08rhAFkfpL4=</DigestValue>
+</Reference>
+</SignedInfo>
+<SignatureValue>l3/o8Zr0v+hPzO2BrgT3066h5MI5H8DWID3C0g+MYcV4d1bYh53LQSzMSWamXjQz
+4fYXLfKF1nOYAb0Aji5gED4wTQnGouPTjP6e3RfiQEePAQUfs+k712DiRZ2MIkQ7
+TruOU0Z/qOYRcJkvpSG1b9Rj0nRrIlZoO0vZhjAQMMwZe1jM4cVOCJ1Z5Gi15YX1
+a6H7lSLoEArMMsW/QuNtee8C5qws1/JMraVOE0VRVRzhKXeHp8rtioAmWLfAvljg
+tTJwPSX3qTaR1/B7LMNJ73P6mJiDbrYWlmEyiZ9TkaFtW9vzxYxH2+g7nITLbJW6
+xAYG2tk1jCNlZRD8PnrQxg==</SignatureValue>
+<KeyInfo>
+  <KeyValue>
+<RSAKeyValue>
+<Modulus>
+xOYb9ILBZK7AdluCTQD2GYAF/sYyoMUQLnV0f8UxZjFWgstZHo4Kxs8WKX/ooVX5
+GsO+U3QEwdyYSOct1UxTt4eAfLaIyanp76AWbhPbJIPn0Ryz2LCDZDmTitmmr9xv
+u8SaOQfpjSCrVrSxy/CYx9D8ViYMka/Fl3lZ08oUdoe36xkb9YN2fZprE+prPFRA
+dxtMCVhvrxo9mU9DLOsXSS2gfO3iIk6zH21L5QHlo3nLS/rI8TwbA8xQ073W4P8I
+LhQRXj9JPC3tmHAbkEqQG5G7ZN+/5adL22jOXHZPmwJpPypMD72sl/br0OcJevre
+16q52qkvKZeS960ut4AnFw==
+</Modulus>
+<Exponent>
+AQAB
+</Exponent>
+</RSAKeyValue>
+</KeyValue>
+  <X509Data>
+    
+    
+  
+<X509Certificate>MIIDBzCCAe+gAwIBAgIILODblEaiZl8wDQYJKoZIhvcNAQEFBQAwETEPMA0GA1UE
+AxMGaXNzdWVyMB4XDTEzMDUwOTAwNTEwMloXDTE2MDQyMzAwNTEwMlowETEPMA0G
+A1UEAxMGaXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxOYb
+9ILBZK7AdluCTQD2GYAF/sYyoMUQLnV0f8UxZjFWgstZHo4Kxs8WKX/ooVX5GsO+
+U3QEwdyYSOct1UxTt4eAfLaIyanp76AWbhPbJIPn0Ryz2LCDZDmTitmmr9xvu8Sa
+OQfpjSCrVrSxy/CYx9D8ViYMka/Fl3lZ08oUdoe36xkb9YN2fZprE+prPFRAdxtM
+CVhvrxo9mU9DLOsXSS2gfO3iIk6zH21L5QHlo3nLS/rI8TwbA8xQ073W4P8ILhQR
+Xj9JPC3tmHAbkEqQG5G7ZN+/5adL22jOXHZPmwJpPypMD72sl/br0OcJevre16q5
+2qkvKZeS960ut4AnFwIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBBjAdBgNVHQ4EFgQUN4oZIklMFXNyvph9m4ZXYzEZ2eAwHwYDVR0jBBgw
+FoAUN4oZIklMFXNyvph9m4ZXYzEZ2eAwDQYJKoZIhvcNAQEFBQADggEBAA+6vPDp
+M77Zx1beqO1glS2J9b6FqrIanzSI7BiR8cg6dHcCjIZUD6exrvx6SR/rM9vqmgiY
+76H3Y8ezN2C7RnNBj0I22e17sqFzOsyyriBLCk8f52K/M7RnTFawvGaJKAazzOD6
+Dl3FSbnyqZFrTvEmEhRlqqisoHB+93XP3FD5nUCqRY+NQs0y32oBvUR2l2czqgNW
+HOKQtOABuTOQVy0EdEfkRjIgo+XiN9f8rMbv1It71X3We5PNqjTBifC/v4dxkvQq
+/C52P3tMDlK9Nxq9M9/VAxOyrW1wqLVE0/UfULnri52VI9S4JBwq00YaZPtNmK/W
+Y8ftygeJzodeRXI=</X509Certificate>
+<X509SubjectName>CN=issuer</X509SubjectName>
+<X509IssuerSerial>
+<X509IssuerName>CN=issuer</X509IssuerName>
+<X509SerialNumber>3233825962338707039</X509SerialNumber>
+</X509IssuerSerial>
+</X509Data>
+</KeyInfo>
+</Signature></signatures></signed-credential>
Index: tests/creddy_tests/result.save
===================================================================
--- tests/creddy_tests/result.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/result.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,7 @@
+   creddy_tests, verify PASSED
+   creddy_tests, roles PASSED
+   creddy_tests, attribute PASSED
+   creddy_tests, keyid PASSED
+   creddy_tests, generate PASSED
+   creddy_tests, display PASSED
+   creddy_tests, attribute_rule PASSED
Index: tests/creddy_tests/roles.ck
===================================================================
--- tests/creddy_tests/roles.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/roles.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# roles.ck
+
+result=`diff -I "I/O warning" -I "buy_rockets" -I "PRIVATE KEY" roles.out roles.save 2>/dev/null`
+
+if [ "$result" = "" ]; then
+    return 0
+else
+    return 1
+fi
+
+
+# ignore
+#< 200baedcb4bfc243cdefe11efb27e293b85a7232.buy_rockets<-200baedcb4bfc243cdefe11efb27e293b85a7232.preferred_customer
+#---
+#> da8282ce28befbb08b432822f282dce02e28eaec.buy_rockets<-da8282ce28befbb08b432822f282dce02e28eaec.preferred_customer
+#
+
Index: tests/creddy_tests/roles.save
===================================================================
--- tests/creddy_tests/roles.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/roles.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,5 @@
+---running roles 
+creddy: Couldn't get cert from Acme_ID.pem
+creddy: Couldn't get cert from Acme_private.pem
+6a84d8b51dd08c6248a44d52b8709239c663cc90.buy_rockets<-6a84d8b51dd08c6248a44d52b8709239c663cc90.preferred_customer
+creddy: Couldn't get cert from bad_attr.xml
Index: tests/creddy_tests/roles.sh
===================================================================
--- tests/creddy_tests/roles.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/roles.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --roles --cert Acme_ID.pem
+$eloc/creddy --roles --cert Acme_private.pem
+$eloc/creddy --roles --cert Acme_buy_rockets__Acme_preferred_customer_attr.xml
+$eloc/creddy --roles --cert bad_attr.xml
Index: tests/creddy_tests/run_test
===================================================================
--- tests/creddy_tests/run_test	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/run_test	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,27 @@
+#!/bin/sh
+#########
+# run_test
+#
+
+./setup.sh 1>/dev/null 2>&1
+
+# a_run type
+a_run()
+{
+    echo "---running $1 " > $1.out
+    ./$1.sh 1 >> $1.out 2>& 1
+    `./$1.ck`
+    if [ $? -eq 0 ]; then
+       echo "   creddy_tests, $1 PASSED"
+    else
+       echo "   creddy-tests, $1 FAILED"
+    fi
+}
+
+a_run verify
+a_run roles
+a_run attribute
+a_run keyid
+a_run generate
+a_run display
+a_run attribute_rule
Index: tests/creddy_tests/setup.sh
===================================================================
--- tests/creddy_tests/setup.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/setup.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+#Acme.buy_rockets <- Acme.preferred_customer
+#Acme.preferred_customer <- Coyote
+
+rm -rf *.pem *.xml *.out
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --generate --cn Acme
+$eloc/creddy --generate --cn Coyote
+
+$eloc/creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role buy_rockets \
+       --subject-cert Acme_ID.pem --subject-role preferred_customer \
+       --out Acme_buy_rockets__Acme_preferred_customer_attr.xml
+
+$eloc/creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Coyote_ID.pem \
+       --out Acme_preferred_customer__Coyote_attr.xml
+
+cp not_ss.pem_save not_ss.pem
+cp not_ss.xml_save not_ss.xml
+cp priv.xml_save priv.xml
+cp PGissuer.pem_save PGissuer.pem
+cp ProtoGENI.xml_save ProtoGENI.xml
+
Index: tests/creddy_tests/verify.ck
===================================================================
--- tests/creddy_tests/verify.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/verify.ck	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# verify.ck
+
+result=`diff -I "I/O warning" -I "no start line" verify.out verify.save 2>/dev/null`
+
+if [ "$result" = "" ]; then
+    return 0
+else
+    return 1
+fi
+
+
+# ignore
+#< 10455:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: CERTIFICATE
+#---
+#> 10410:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:650:Expecting: CERTIFICATE
+#
+
Index: tests/creddy_tests/verify.save
===================================================================
--- tests/creddy_tests/verify.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/verify.save	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,33 @@
+---running verify 
+creddy verify, issuer: Coyote_ID.pem
+               attribute cert: Acme_buy_rockets__Acme_preferred_customer_attr.xml
+  issuer and attribute cert have mismatched principals
+  issuer cert still valid
+  attribute cert still valid
+creddy verify, issuer: Acme_ID.pem
+               attribute cert: Acme_buy_rockets__Acme_preferred_customer_attr.xml
+  issuer and attribute cert have matching principals
+  issuer cert still valid
+  attribute cert still valid
+creddy: Can't load issuer cert from Acme_private.pem
+creddy verify, issuer: Acme_private.pem
+creddy verify, issuer: Acme_ID.pem
+               attribute cert: bad_attr.xml
+  fail to extract attribute cert but...
+  issuer cert still valid
+creddy: Can't load issuer cert from Acme_buy_rockets__Acme_preferred_customer_attr.xml
+creddy verify, issuer: Acme_buy_rockets__Acme_preferred_customer_attr.xml
+creddy: Can't load issuer cert from bad_attr.xml
+creddy verify, issuer: bad_attr.xml
+creddy verify, issuer: Coyote_ID.pem
+  issuer cert still valid
+creddy verify, issuer: not_ss.pem
+  issuer cert still valid
+creddy: Can't load issuer cert from not_ss.xml
+creddy verify, issuer: not_ss.xml
+creddy: Can't load issuer cert from priv.xml
+creddy verify, issuer: priv.xml
+creddy verify, issuer: PGissuer.pem
+  issuer cert still valid
+creddy: Can't load issuer cert from ProtoGENI.xml
+creddy verify, issuer: ProtoGENI.xml
Index: tests/creddy_tests/verify.sh
===================================================================
--- tests/creddy_tests/verify.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
+++ tests/creddy_tests/verify.sh	(revision ec550f769c681cfa831dc724f82ddacd21fc75cd)
@@ -0,0 +1,24 @@
+#!/bin/sh
+#creddy --verify --cert <cert> [ --attrcert <cert> ]
+
+pwd=`pwd`
+eloc=`which creddy | sed 's/\/creddy//'`
+if [ "$eloc" = "" ]; then
+  echo "ERROR: creddy is not in the search path!!!"
+  exit 1
+fi
+
+$eloc/creddy --verify --cert Coyote_ID.pem --attrcert Acme_buy_rockets__Acme_preferred_customer_attr.xml
+$eloc/creddy --verify --cert Acme_ID.pem --attrcert Acme_buy_rockets__Acme_preferred_customer_attr.xml
+
+$eloc/creddy --verify --cert Acme_private.pem
+$eloc/creddy --verify --cert Acme_ID.pem --attrcert bad_attr.xml
+$eloc/creddy --verify --cert Acme_buy_rockets__Acme_preferred_customer_attr.xml
+$eloc/creddy --verify --cert bad_attr.xml
+$eloc/creddy --verify --cert Coyote_ID.pem
+
+$eloc/creddy --verify --cert not_ss.pem
+$eloc/creddy --verify --cert not_ss.xml
+$eloc/creddy --verify --cert priv.xml
+$eloc/creddy --verify --cert PGissuer.pem
+$eloc/creddy --verify --cert ProtoGENI.xml
