tests

#!/bin/bash
# vim:et:ts=2:sts=2:sw=2
set -u

done_testing=0
rc=0
platform=
arch=amd64
old_home="$HOME"
vault_pid=
root_token=
unseal_key=

case $OSTYPE in
(darwin*)
  platform=darwin
  declare -a versions=(
    "0.9.6"
    "1.1.5"
    "1.2.4"
    "1.3.2"
  )
  ;;
(linux*)
  platform=linux
  declare -a versions=(
    "0.9.6"
    "1.1.5"
    "1.2.4"
    "1.3.2"
  )
  ;;
(*)
  echo >&2 "UNRECOGNIZED OSTYPE '$OSTYPE'"
  exit 1
  ;;
esac


bail() {
  echo >&2 $*
  exit 2
}
ok() {
  if [[ -t 1 ]]; then
    echo -e "\033[1;32mok\033[0m"
  else
    echo "ok"
  fi
}
failed() {
  if [[ -t 1 ]]; then
    echo -e "\033[1;31mfail\033[0m"
  else
    echo "fail"
  fi
}
tests_passed() {
  if [[ -t 1 ]]; then
    echo -e "\033[1;32mALL TESTS PASSED\033[0m"
  else
    echo "ALL TESTS PASSED"
  fi
}
tests_failed() {
  if [[ -t 1 ]]; then
    echo -e "\033[1;31mTESTS FAILED\033[0m"
  else
    echo "TESTS FAILED"
  fi
}
test=""
testing() {
  if [[ $rc -ne 0 && -n "${FAIL_FAST:-}" ]] ; then
    dump_log 1
    echo "Failure encountered, stopping tests!"
    exit 4
  fi
  rm -f t/home/got t/home/want t/home/diff t/home/errors
  echo
  if [[ -t 1 ]]; then
    echo -e "[\033[1;36m$version\033[0m|\033[1;35mkv$kvversion\033[0m] \033[1;34m$*\033[0m"
  else
    echo "[$v] $*"
  fi
  test="$*"
}
clearvault() {
  (./safe rm -rdaf secret) &>/dev/null
}
now() {
  if [[ -n "${1:-}" ]]; then
    test="$*"
  fi
}
run() {
  rm -f t/tmp/errors
  exec &>t/tmp/errors
}
step() {
  echo -n "  $*... "
}
diffok() {
  step "$test"
  if [[ -f t/home/errors && -s t/home/errors ]]; then
    failed
    rc=1
    cat t/home/errors
    echo ; echo

  elif ! diff -Bu t/home/got t/home/want >t/home/diff 2>&1; then
    failed
    rc=1
    cat t/home/diff
    echo ; echo
  else

    ok
  fi
}

jsonok() {
  cat t/home/got | jq -MS '.' > t/home/got.x   ; mv t/home/got.x t/home/got
  cat t/home/want | jq -MS '.' > t/home/want.x ; mv t/home/want.x t/home/want
  diffok
}

yamlok() {
  [ -s t/home/got ] || echo "--- {}" > t/home/got
  spruce merge t/home/got  > t/home/got.x   ; mv t/home/got.x  t/home/got
  spruce merge t/home/want > t/home/want.x  ; mv t/home/want.x t/home/want
  diffok
}

exitok() {
  step "$test"
  if [[ $1 -eq ${2:-0} ]]; then
    ok
  else
    failed
    rc=1
    echo " expected process to exit $2"
    echo "   but it actually exited $1"
    if [[ -f t/tmp/errors ]]; then
      echo
      echo "---[ command output ]------------------"
      cat t/tmp/errors
      echo "---------------------------------------"
      rm t/tmp/errors
    else
      echo "   (no output from command)"
    fi
  fi
}

eq() {
  got=$1
  want=$2
  step $test
  if [[ $got != $want ]]; then
    failed
    rc=1
    echo "       got $got"
    echo "  expected $want"
  else
    ok
  fi
}

eq_or_diff() {
  got=$1
  want=$2
  step $test
  if [[ $got != $want ]]; then
    failed
    rc=1
    echo "   values were different:"
    diff -y <(echo "$got") \
            <(echo "$want")
  else
    ok
  fi
}

ne() {
  got=$1
  want=$2
  step $test
  if [[ $got == $want ]]; then
    failed
    rc=1
    echo "       got $got"
    echo "  expected literally anything else..."
  else
    ok
  fi
}

eq_key() {
  key1=$1
  key2=$2
  now retrieving "$key1" from vault
  (run; ./safe get "$key1" >t/home/got) ; exitok $? 0
  cp t/home/got t/home/want

  now retrieving "$key2" from vault
  (run; ./safe get "$key2" >t/home/got) ; exitok $? 0

  now checking that "$key1" == "$key2"
  diffok
}
is_key() {
  key=$1
  val=$2
  alt=${3:-}
  if [[ -z "${alt}" ]]; then
    alt="'$2'"
  fi
  now retrieving "$key" from vault
  (run; ./safe get "$key" >t/home/got) ; exitok $? 0

  now checking that "$key" == "$alt"
  cat >t/home/want <<EOF ; diffok
$val
EOF
}
ok_key() {
  for key in "$@"; do
    now checking that "$key" exists in vault
    (run; ./safe exists "$key"); exitok $? 0
  done
}
no_key() {
  for key in "$@"; do
    now checking that "$key" does not exist in vault
    (run; ./safe exists "$key"); exitok $? 1
  done
}
generate() {
  now generating secret "'$1'" to test with
  (run; ./safe set $*); exitok $? 0
}

dump_log() {
  if [[ -f t/home/log ]] ; then
    if grep -q 'goroutine' t/home/log; then
      exit 77 # ./try will pick up on this error code
    fi
    if [[ ${rc} -ne 0 || -n ${1:-} ]]; then
      echo
      echo >&2 "---[ VAULT LOG ]------------------------------------------"
      cat  >&2 t/home/log
      echo >&2 "----------------------------------------------------------"
      echo
    fi
  fi
}

kill_running_vault() {
  if [[ -n $vault_pid ]] ; then
    kill $vault_pid
    wait $vault_pid
    vault_pid=
  fi
}

cleanup() {
  export HOME=${old_home}
  rm -rf t/
  kill_running_vault

  if [[ ${done_testing} -eq 1 && ${rc} -eq 0 ]]; then
    tests_passed
  else
    tests_failed
  fi
  exit ${rc}
}

restart_vault_server() {
  kill_running_vault
  rm -f t/home/log
  mkdir -p ./vaults/bin
  cp ./vaults/vault-${platform}-${version} ./vaults/bin/vault
  ./vaults/bin/vault server -dev -dev-listen-address 127.0.0.1:8198 >t/home/log 2>&1 &
  vault_pid=$!
  waitfor=600
  while ! grep -iq '^root token: ' t/home/log; do
    if [[ $waitfor -gt 0 ]]; then
      waitfor=$((waitfor - 1))
      sleep 0.1
    else
      failed "timed out waiting for vault server (-dev) to start"
      dump_log 1
      exit 3 # FIXME: this is the wrong thing to do
    fi
  done

  root_token=$(awk '/^Root Token:/ { print $3 }' < t/home/log | head -n1)
  unseal_key=$(awk '/^Unseal Key:/ { print $3 }' < t/home/log | head -n1)

  now targeting test vault server
  (run; ./safe target unit-tests http://127.0.0.1:8198) ; exitok $? 0
  now authenticating with ${root_token} root token
  (run; echo "$root_token" | ./safe auth token)         ; exitok $? 0
  
  local engine="kv"
  local versionflag="-version $kvversion"
  local mountcmd="secrets enable"
  local unmountcmd="secrets disable"
  if [[ $version =~ ^0\.[6-9].* ]]; then versionflag=""; fi
  now unmounting the existing secret/ mount
  (run; PATH="${PWD}/vaults/bin:${PATH}" ./safe vault $unmountcmd "secret/"); exitok $? 0
  now mounting a kv v$kvversion engine
  (run; PATH="${PWD}/vaults/bin:${PATH}" ./safe vault $mountcmd -path="secret/" $versionflag "$engine"); exitok $? 0
}

create_test_policy() {
  ./safe curl POST /sys/policy/test-policy '{"policy": "path \"secret/*\" { capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]}"}' >/dev/null
}

setup_approle() {
  create_test_policy
  role_name="test-role"
  ./safe vault auth enable approle >/dev/null #Mount the approle backend
  ./safe curl POST "auth/approle/role/${role_name}" '{"policies": "test-policy"}' >/dev/null #Create a role
  role_id="$(./safe curl --data-only GET "auth/approle/role/${role_name}/role-id" | jq -Mr '.data.role_id')"
  secret_id="$(./safe curl --data-only POST "auth/approle/role/${role_name}/secret-id" | jq -Mr '.data.secret_id')"
  echo "$role_id" "$secret_id"
}

mkdir -p vaults t/tmp
trap 'cleanup' INT QUIT TERM EXIT

for version in "${versions[@]}"; do
  killall vault-${platform}-${version} >/dev/null 2>&1 || true
done
for version in "${versions[@]}"; do
for kvversion in 1 2; do
  # KV v2 was introduced in 0.10
  if [[ kvversion -eq 2 && $version =~ ^0\.[6-9].* ]]; then
    continue
  fi

  echo "VAULT ${version}" -- KV v${kvversion}
  killall vault-${platform}-${version} >/dev/null 2>&1 || true
  echo "----------------------------------------------"
  if [[ ! -f vaults/vault-${platform}-${version} ]]; then
    echo "Downloading Vault ${version} CLI..."
    curl --fail -L > t/tmp/archive.zip \
      https://releases.hashicorp.com/vault/${version}/vault_${version}_${platform}_${arch}.zip \
      || bail "download of vault ${version} failed"

    unzip -d t/tmp t/tmp/archive.zip
    mv t/tmp/vault vaults/vault-${platform}-${version}
    echo "DONE"
    echo
  fi

  old_home=$HOME
  export HOME=${PWD}/t/home

  rm -rf t/home ; mkdir -p t/home
  #trap "rm -rf t/home" INT TERM QUIT EXIT


   ######  ######## ######## ##     ## ########
  ##    ## ##          ##    ##     ## ##     ##
  ##       ##          ##    ##     ## ##     ##
   ######  ######      ##    ##     ## ########
        ## ##          ##    ##     ## ##
  ##    ## ##          ##    ##     ## ##
   ######  ########    ##     #######  ##

  #######
  testing setup
  restart_vault_server
  clearvault

  ########    ###    ########   ######   ######## ########
     ##      ## ##   ##     ## ##    ##  ##          ##
     ##     ##   ##  ##     ## ##        ##          ##
     ##    ##     ## ########  ##   #### ######      ##
     ##    ######### ##   ##   ##    ##  ##          ##
     ##    ##     ## ##    ##  ##    ##  ##          ##
     ##    ##     ## ##     ##  ######   ########    ##

  #######
  testing targeting by ip
  (run; ./safe target http://127.0.0.1:8198) ; exitok $? 0
  (run; ./safe -T http://127.0.0.1:8198 env) ; exitok $? 0

  testing targeting by alias
  (run; ./safe target unit-tests)            ; exitok $? 0
  (run; ./safe -T unit-tests env)            ; exitok $? 0

  testing targeting a bad ip
  (run; ./safe target http://127.0.0.1:8200) ; exitok $? 1
  (run; ./safe -T http://127.0.0.1:8200 env) ; exitok $? 1

  testing ambiguous targets
  (run; ./safe target alternate \
                      http://127.0.0.1:8198) ; exitok $? 0
  (run; ./safe target http://127.0.0.1:8198) ; exitok $? 1
  (run; ./safe -T http://127.0.0.1:8198 env) ; exitok $? 1
  restart_vault_server


   ######  ##     ## ########  ##
  ##    ## ##     ## ##     ## ##
  ##       ##     ## ##     ## ##
  ##       ##     ## ########  ##
  ##       ##     ## ##   ##   ##
  ##    ## ##     ## ##    ##  ##
   ######   #######  ##     ## ########

  #######
  clearvault
  testing safe curl plumbing
  now trying to curl without a leading slash
  (run; ./safe curl sys/seal-status)    ; exitok $? 0
  now trying to curl with a leading slash
  (run; ./safe curl /sys/seal-status)   ; exitok $? 0
  now trying to curl with embedded duplicate slashes
  (run; ./safe curl /sys///seal-status) ; exitok $? 0


     ##     ##     ## ######## ##    ##
    ####    ##     ##    ##    ##    ##
   ##  ##   ##     ##    ##    ##    ##
  ########  ##     ##    ##    ########
  ##    ##  ##     ##    ##    ##    ##
  ##    ##  ##     ##    ##    ##    ##
  ##    ##   #######     ##    ##    ##

  ########
  clearvault
  testing approle login
  now making an approle
  approle_output="$(setup_approle)"
  echo "$approle_output" >&2
  role_id="$(awk '{print $1}' <<<"$approle_output")"
  secret_id="$(awk '{print $2}' <<<"$approle_output")"

  now trying to login with approle
  (run; ./safe auth approle <<<"$role_id
$secret_id
") ; exitok $? 0;
  now checking that we can do stuff with the Vault
  (run; ./safe set secret/beep/boop foo=bar) ; exitok $? 0
  (run; ./safe get secret/beep/boop) ; exitok $? 0
  restart_vault_server

   ######   ######## ########       ##  ######  ######## ########
  ##    ##  ##          ##         ##  ##    ## ##          ##
  ##        ##          ##        ##   ##       ##          ##
  ##   #### ######      ##       ##     ######  ######      ##
  ##    ##  ##          ##      ##           ## ##          ##
  ##    ##  ##          ##     ##      ##    ## ##          ##
   ######   ########    ##    ##        ######  ########    ##

  #######
  clearvault
  testing basic set/get operation
  now setting a key=value on a new path
  (run; ./safe set secret/handshake knock=knock) ; exitok $? 0

  now asking for a key, but providing the value anyway
  (run; ./safe ask secret/handshake whos=there)  ; exitok $? 0

  now retrieving the test path
  (run; ./safe get secret/handshake >t/home/got) ; exitok $? 0

  now checking that we got the expected secrets in the output
  cat >t/home/want <<EOF ; yamlok
--- # secret/handshake
knock: knock
whos: there
EOF

  for p in /secret/handshake    \
            secret///handshake  \
       /////secret//////handshake; do
    now retrieving non-canonical $p path
    (run; ./safe get $p >t/home/got) ; exitok $? 0

    now checking that we got the expected secrets in the output
    cat >t/home/want <<EOF ; yamlok
--- # secret/handshake
knock: knock
whos: there
EOF
  done

  now checking that we cannot set sub-keys on keyed path
  (run; ./safe set secret/inner:secret key=value) ; exitok $? 1

  now checking that we can set non-canonical paths
  (run; ./safe set /secret///non/canonical key=value)  ; exitok $? 0

  now retrieving the secret from its canonical path
  (run; ./safe get secret/non/canonical >t/home/got) ; exitok $? 0

  now checking that the response is what we wrote
  cat >t/home/want <<EOF ; yamlok
--- # secret/non/canonical
key: value
EOF


  #######
  #clearvault
  testing get operation with --yaml on single path
  now retrieving secret/handshake as --yaml
  (run; ./safe get --yaml secret/handshake >t/home/got) ; exitok $? 0

  now checking that the response is properly formatted
  cat >t/home/want <<EOF ; yamlok
---
secret/handshake:
  knock: knock
  whos: there
EOF


  #######
  #clearvault
  testing get operation: multiple requests, some missing
  now setting secret/other/thing to a valid value
  (run; ./safe set secret/other/thing get=this); exitok $? 0

  now checking that a get where some of the paths are missing fails
  (run; ./safe get secret/handshake \
                   secret/other/thing \
                   secret/non-existent \
                   secret/handshake:passcode >t/home/got 2>&1) ; exitok $? 1

  now checking that we get errors about missing paths and keys
  cat >t/home/want <<'EOF' ; diffok
!! Multiple errors found:
   - no secret exists at path `secret/non-existent`
   - no key `passcode` exists in secret `secret/handshake`
EOF


  #######
  #clearvault
  testing get operation: multiple requests
  now checking that a get of multiple existing paths succeeds
  (run; ./safe get secret/handshake secret/other/thing >t/home/got) ; exitok $? 0

  now checking that we get back the paths we want
  cat >t/home/want <<'EOF' ; yamlok
---
secret/handshake:
  knock: knock
  whos: there
secret/other/thing:
  get: this
EOF


  #######
  #clearvault
  testing get --keys operation: multiple requests, some missing
  now checking that a get where some of the keys are missing still works
  (run; ./safe get --keys secret/handshake secret/other/thing secret/code:pssst >t/home/got 2>t/home/warn); exitok $? 0

  now checking that we get back the paths we want
  cat >t/home/want <<'EOF' ; yamlok
---
secret/handshake:
- knock
- whos
secret/other/thing:
- get
secret/code: []
EOF

  mv t/home/warn t/home/got
  now checking that we got a warning about the missing secrets
  cat >t/home/want <<'EOF'; diffok
WARNING: no secret exists at path `secret/code`
EOF


  #######
  #clearvault
  testing get --keys operation: single key
  now retrieving a single path and all of its --keys
  (run;./safe get --keys secret/handshake >t/home/got) ; exitok $? 0

  now checking that we got the values of the keys
  cat >t/home/want <<'EOF' ; diffok
knock
whos
EOF

  #######
  #clearvault
  testing get --keys operation: single key with --yaml
  now retrieving a single path and all of its --keys in --yaml format
  (run; ./safe get --keys --yaml secret/handshake >t/home/got) ; exitok $? 0

  now checking that we got the yaml output we wanted
  cat >t/home/want <<'EOF' ; yamlok
---
secret/handshake:
- knock
- whos
EOF


  #######
  clearvault
  testing multiple-attribute set operation
  now setting multiple keys on the same path
  (run; ./safe set secret/account username=admin password=sekrit) ; exitok $? 0

  now retrieving secret/account to check for our keys
  (run; ./safe get secret/account >t/home/got)                    ; exitok $? 0

  now checking that our keys are found in the output
  cat >t/home/want <<EOF ; yamlok
--- # secret/account
username: admin
password: sekrit
EOF


  clearvault
  testing versions - simple
  now checking versions errs when the secret does not exist

  (run; ./safe versions secret/notasecret); exitok $? 1

  now putting a single version into the vault
  (run; ./safe set secret/versions beep=boop); exitok $? 0
  
  now checking that one versions does not err on an existing secret
  (run; ./safe versions secret/versions >t/home/got); exitok $? 0

  now checking that the output of versions was version 1
  eq "$(awk '{print $1}' < t/home/got)" 1
  now checking that the output of versions was labeled as alive
  eq "$(awk '{print $2}' < t/home/got)" alive


   ######  ##     ## ########  ######  ##    ##
  ##    ## ##     ## ##       ##    ## ##   ##
  ##       ##     ## ##       ##       ##  ##
  ##       ######### ######   ##       #####
  ##       ##     ## ##       ##       ##  ##
  ##    ## ##     ## ##       ##    ## ##   ##
   ######  ##     ## ########  ######  ##    ##

  #######
  clearvault
  testing basic check/exists operation
  now setting secret/handshake
  (run; ./safe set secret/handshake knock=knock) ; exitok $? 0

  now checking that secret/handshake:knock exists
  (run; ./safe exists secret/handshake:knock)    ; exitok $? 0

  now checking that secret/handshake:enoent does not exist
  (run; ./safe exists secret/handshake:enoent)   ; exitok $? 1

  now checking that secret/enoent does not exist
  (run; ./safe exists secret/enoent)             ; exitok $? 1

  now checking that secret/enoent:sub does not exist
  (run; ./safe exists secret/enoent:sub)         ; exitok $? 1



   ######   ######## ##    ##
  ##    ##  ##       ###   ##
  ##        ##       ####  ##
  ##   #### ######   ## ## ##
  ##    ##  ##       ##  ####
  ##    ##  ##       ##   ###
   ######   ######## ##    ##

  #######
  clearvault
  testing password randomization
  now generating some random secrets
  (run; ./safe gen secret/random one    ) ; exitok $? 0
  (run; ./safe gen secret/random another) ; exitok $? 0

  now retrieving generated credentials
  (run; ./safe get secret/random | spruce json >t/home/got) ; exitok $? 0
  one=$(jq -r .one < t/home/got)
  another=$(jq -r .another < t/home/got)
  step "checking that the two generated passwords are different"
  if [[ ${one} == ${another} ]]; then
    failed
    rc=1
    echo "  ... expected generated password '${one}'"
    echo "            to not be the same as '${another}'"
  else
    ok
  fi



   ######  ##     ##    ###    #### ##    ##
  ##    ## ##     ##   ## ##    ##  ###   ##
  ##       ##     ##  ##   ##   ##  ####  ##
  ##       ######### ##     ##  ##  ## ## ##
  ##       ##     ## #########  ##  ##  ####
  ##    ## ##     ## ##     ##  ##  ##   ###
   ######  ##     ## ##     ## #### ##    ##

  #######
  clearvault
  testing command chaining
  now generating three credentials via a command chain
  (run; ./safe gen secret/chained a -- \
               gen secret/chained b -- \
               gen secret/chained c)                          ; exitok $? 0

  now retrieving our generated credentials
  (run; ./safe get secret/chained | spruce json > t/home/got) ; exitok $? 0

  for k in a b c; do
    step "checking that each credential exists"
    v=$(jq -r .$k < t/home/got)
    if [[ -z "$v" ]]; then
      failed
      rc=1
      echo "  ... expected secret/chained/$k to exist"
    else
      ok
    fi
  done


  #######
  clearvault
  testing custom password runes randomization
  now generating credentials consisting of only the digits 1 - 9
  (run; ./safe gen --policy "1-9" 64 secret/random one)       ; exitok $? 0

  now retrieving our generated credentials
  (run; ./safe get secret/random | spruce json >t/home/runed) ; exitok $? 0

  step "checking that the generated credential only consists of the digits 1-9"
  one=$(jq -r .one < t/home/runed)
  if [[ "$one" =~ ^[1-9]+$ ]]; then
    ok
  else
    failed
    rc=1
    echo "  expected generated password: '$one'"
    echo "              to only contain: [1-9]"
  fi


  #######
  clearvault
  testing password with secret:key syntax
  now generating a random secret at secret/random:two
  (run; ./safe gen 64 secret/random:two) ; exitok $? 0

  now retrieving our generated credentials
  (run; ./safe get secret/random:two)    ; exitok $? 0


  #######
  clearvault
  testing gen with multiple passwords to make
  now generating passwords
  (run; ./safe gen 64 secret/random:three secret/random four secret/random:five) ; exitok $? 0
  ok_key secret/random:{three,four,five}


  #######
  clearvault
  testing gen with length flag
  now generating a 10-character password
  (run; ./safe gen secret/random:six -l 10) ; exitok $? 0

  now retrieving our 10-character password
  (run; ./safe get secret/random:six | tr -d '\n' >t/home/got) ; exitok $? 0

  step "testing that the password is only 10 characters long"
  if [[ $(cat t/home/got | wc -m) -eq 10 ]]; then
    ok
  else
    failed
    rc=1
    echo "Expected generated password to have 10 characters"
    echo "Got $(cat t/home/got | wc -m) instead"
  fi

  #######
  clearvault
  testing gen with incorrectly mixed path:key should fail
  (run; ./safe gen secret/random secret/random:seven) ; exitok $? 1
  no_key secret/random


  #######
  clearvault
  testing gen with missing key should fail
  (run; ./safe gen secret/random) ; exitok $? 1
  no_key secret/random


  #######
  clearvault
  testing single-value retrieval
  (run; ./safe set secret/single/value foo=bar baz=quux) ; exitok $? 0
  foo=$(./safe get secret/single/value:foo)
  step "retrieving our single value"
  if [[ ${foo} = "bar" ]]; then
    ok
  else
    failed
    rc=1
    echo "  ... expected foo='bar'"
    echo "               got '${foo}'"
  fi


  #######
  clearvault
  testing set key from file
  echo -n "this is a value" >t/home/value-file
  echo -n "" >t/home/empty-file
  cat >t/home/long-file <<EOF
this
is
a
multiline
value
EOF
  now setting values from files
  (run; ./safe set secret/from-files/content \
                     value@t/home/value-file \
                     blank@t/home/empty-file \
                     long@t/home/long-file) ; exitok $? 0

  now retrieving set values
  (run; ./safe get secret/from-files/content --yaml >t/home/got) ; exitok $? 0

  now checking that we got back the correct multiline and single-line values
  cat >t/home/want <<EOF ; yamlok
---
secret/from-files/content:
  value: this is a value
  blank: ""
  long: |
    this
    is
    a
    multiline
    value
EOF


  #######
  clearvault
  testing set key to empty value
  now setting values
  (run; ./safe set secret/setec/astronomy too= many="") ; exitok $? 0
  is_key secret/setec/astronomy:too  ""
  is_key secret/setec/astronomy:many ""


  #######
  clearvault
  testing set key from file - error conditions
  now setting values from a non-existent file - should fail
  (run; ./safe set secret/from-file/content nothing@non-existent-file 2>t/home/got) ; exitok $? 1
  now checking the output error
  cat > t/home/want<<EOF ; diffok
!! Failed to read contents of non-existent-file: open non-existent-file: no such file or directory
EOF

  now checking that we did not set a secret in vault
  (run; ./safe get secret/from-file/content:nothing)               ; exitok $? 1

  now setting values using file syntax, but missing the file argument
  (run; ./safe set secret/from-file/content no-file@ 2>t/home/got) ; exitok $? 1

  now checking the output error
  cat > t/home/want<<EOF ; diffok
!! No file specified: expecting no-file@<filename>
EOF

  now checking that we did not set a secret in vault
  (run; ./safe get secret/from-file/content:no-file)               ; exitok $? 1



  ######## ##     ## ########
  ##       ###   ###    ##
  ##       #### ####    ##
  ######   ## ### ##    ##
  ##       ##     ##    ##
  ##       ##     ##    ##
  ##       ##     ##    ##

  #######
  clearvault
  testing fmt - all formats
  now generating a test secret to format
  (run; ./safe gen secret/fmt/formats original) ; exitok $? 0

  now verifying that our secret got created
  (run; ./safe get secret/fmt/formats:original) ; exitok $? 0

  for f in base64 bcrypt crypt-{md5,sha256,sha512}; do
    now formatting $f
    (run; ./safe fmt $f secret/fmt/formats original $f) ; exitok $? 0

    now verifying that we generated a secret for $f
    (run; ./safe get secret/fmt/formats:$f)             ; exitok $? 0

  done

  # note that the tests do not support the optional parameters in crypt format
  # (i.e. `$<id>[$<param>=<value>(,<param>=<value>)*][$<salt>[$<hash>]]`)
  now checking bcrypt format
  (run; ./safe get secret/fmt/formats:bcrypt \
        | grep -qE '^\$2[axy]?\$[a-zA-Z0-9+/=]+\$.+') ; exitok $? 0

  now checking crypt-md5 format
  (run; ./safe get secret/fmt/formats:crypt-md5 \
        | grep -qE '^\$1\$[a-zA-Z0-9+/=]+\$.+')       ; exitok $? 0

  now checking crypt-sha256 format
  (run; ./safe get secret/fmt/formats:crypt-sha256 \
        | grep -qE '^\$5\$[a-zA-Z0-9+/=]+\$.+')       ; exitok $? 0

  now checking crypt-sha512 format
  (run; ./safe get secret/fmt/formats:crypt-sha512 \
        | grep -qE '^\$6\$[a-zA-Z0-9+/=]+\$.+')       ; exitok $? 0



  ########  ######## ##       ######## ######## ########
  ##     ## ##       ##       ##          ##    ##
  ##     ## ##       ##       ##          ##    ##
  ##     ## ######   ##       ######      ##    ######
  ##     ## ##       ##       ##          ##    ##
  ##     ## ##       ##       ##          ##    ##
  ########  ######## ######## ########    ##    ########

  #######
  clearvault
  testing secret deletion
  no_key secret/delete
  generate secret/delete hello=world
  is_key secret/delete:hello world

  now removing the secret
  (run; ./safe delete secret/delete) ; exitok $? 0
  no_key secret/delete

  #######
  clearvault
  testing recursive secret deletion
  no_key secret/a/b/c/d/e/f/delete
  generate secret/a/b/c/d/e/f/delete hello=world
  generate secret/a/b/c/1/2/3/delete goodbye=cruel-world
  generate secret/a/a/a/a/a/a/a/h real=monsters
  is_key secret/a/b/c/d/e/f/delete:hello world
  is_key secret/a/b/c/1/2/3/delete:goodbye cruel-world
  is_key secret/a/a/a/a/a/a/a/h:real monsters

  now removing the secret
  (run; ./safe delete -Rf secret/a/b) ; exitok $? 0
  no_key secret/a/b/c/d/e/f/delete
  no_key secret/a/b/c/1/2/3/delete
  is_key secret/a/a/a/a/a/a/a/h:real monsters # still got it!


  #######
  clearvault
  testing multiple secret deletion
  no_key secret/delete/{two,three}
  generate secret/delete/two foo=bar
  generate secret/delete/three wom=bat

  now deleting both secrets
  (run; ./safe delete secret/delete/two secret/delete/three) ; exitok $? 0
  no_key secret/delete/two
  no_key secret/delete/three


  #######
  clearvault
  testing key deletion with key remaining within secret afterwards
  generate secret/delete foo=bar wom=bat

  now deleting a single key in the multi-key path
  (run; ./safe delete secret/delete:wom) ; exitok $? 0
  no_key secret/delete:wom
  is_key secret/delete:foo "bar"


  #######
  clearvault
  testing key deletion with no keys remaining should delete secret
  generate secret/delete foo=bar

  now deleting the last key in a single path
  (run; ./safe delete secret/delete:foo)  ; exitok $? 0
  no_key secret/delete


  #######
  clearvault
  testing multiple key deletion
  generate secret/delete foo=bar wom=bat beep=boop

  now deleting the a subset of the keys
  (run; ./safe delete secret/delete:foo secret/delete:wom) ; exitok $? 0
  no_key secret/delete:{foo,wom}
  is_key secret/delete:beep "boop"


  #######
  clearvault
  testing attempt to delete non-existent key should fail
  no_key secret/delete
  (run; ./safe delete secret/delete) ; exitok $? 1
  no_key secret/delete


  #######
  clearvault
  testing attempt to delete non-existing key within existing secret should error
  no_key secret/delete
  generate secret/delete foo=bar

  now deleting the a non-existent key under an existing path
  (run; ./safe delete secret/delete:gobbledegook) ; exitok $? 1
  is_key secret/delete:foo "bar"


  #######
  clearvault
  testing delete non-existent key should not fail if -f is given
  no_key secret/delete
  (run; ./safe delete secret/delete -f) ; exitok $? 0
  no_key secret/delete


  #######
  clearvault
  testing deleting non-existent key with -f specified should fail silently
  no_key secret/delete
  generate secret/delete foo=bar

  now deleting a non-existent key with -f
  (run; ./safe delete secret/delete:gobbledegook -f) ; exitok $? 0
  no_key secret/delete:gobbledegook
  is_key secret/delete:foo "bar"


  #######
  clearvault
  testing recursively delete a subtree
  no_key secret/delete/subtree/{one,two}
  generate secret/delete/subtree/one foo=bar
  generate secret/delete/subtree/two beep=boop

  (run; ./safe delete -Rf secret/delete/subtree) ; exitok $? 0
  no_key secret/delete/subtree/{one,two}


  #######
  clearvault
  testing attempting to delete a subtree without -R should fail
  no_key secret/delete/subtree/{one,two}
  generate secret/delete/subtree/one foo=bar
  generate secret/delete/subtree/two foo=bar

  now attempting to delete the subtree without -R
  (run; ./safe delete -f secret/delete/subtree) ; exitok $? 1

  is_key secret/delete/subtree/one:foo "bar"
  is_key secret/delete/subtree/two:foo "bar"


  #######
  clearvault
  testing recursively delete a leaf node secret
  no_key secret/delete
  generate secret/delete foo=bar

  now deleting the single secret
  (run; ./safe delete -Rf secret/delete)  ; exitok $? 0
  no_key secret/delete


  #######
  clearvault
  testing recursively delete a key
  generate secret/delete foo=bar beep=boop

  now deleting a key recursively
  (run; ./safe delete -Rf secret/delete:foo) ; exitok $? 0
  no_key secret/delete:foo
  is_key secret/delete:beep "boop"


  #######
  clearvault
  testing recursively delete a secret that does not exist with -f should not fail
  no_key secret/delete

  now deleting a non-existent secret
  (run; ./safe delete -Rf secret/delete) ; exitok $? 0
  no_key secret/delete


  #######
  clearvault
  testing recursively delete a key that does not exist with -f should not fail
  generate secret/delete beep=boop

  now deleting a non-existent key with -Rf
  (run; ./safe delete -Rf secret/delete:foo) ; exitok $? 0
  is_key secret/delete:beep "boop"



   ######   #######  ########  ##    ##
  ##    ## ##     ## ##     ##  ##  ##
  ##       ##     ## ##     ##   ####
  ##       ##     ## ########     ##
  ##       ##     ## ##           ##
  ##    ## ##     ## ##           ##
   ######   #######  ##           ##

  #######
  clearvault
  testing copy a secret to another location
  no_key secret/copy/{from,to}
  generate secret/copy/from beep=boop

  now copying a single secret
  (run; ./safe copy secret/copy/from secret/copy/to) ; exitok $? 0
  eq_key secret/copy/{from,to}:beep


  #######
  clearvault
  testing copy a key to another secret without a key specified
  no_key secret/copy/{from,to}
  generate secret/copy/from beep=boop foo=bar

  now copying secrets
  (run; ./safe copy secret/copy/from:beep secret/copy/to) ; exitok $? 0
  eq_key secret/copy/{from,to}:beep
  no_key secret/copy/to:foo


  #######
  clearvault
  testing copy a key to another specified key where the dest secret exists
  no_key secret/copy/{from,to}
  generate secret/copy/from beep=boop foo=bar
  generate secret/copy/to wom=bat

  now copying
  (run; ./safe copy secret/copy/from:beep secret/copy/to:another) ; exitok $? 0

  is_key secret/copy/from:foo "bar"
  is_key secret/copy/to:wom   "bat"
  eq_key secret/copy/{from:beep,to:another}


  #######
  clearvault
  testing copy a key to another specified key where the dest secret does not exist
  no_key secret/copy/{from,to}
  generate secret/copy/from beep=boop foo=bar

  now copying
  (run; ./safe copy secret/copy/from:beep secret/copy/to:another) ; exitok $? 0
  eq_key secret/copy/{from:beep,to:another}


  #######
  clearvault
  testing copying a full secret to a specified key should fail
  (run; ./safe set secret/copy/from beep=boop)             ; exitok $? 0
  (run; ./safe copy secret/copy/from secret/copy/to:hell) ; exitok $? 1
  is_key secret/copy/from:beep "boop"
  no_key secret/copy/to


  #######
  clearvault
  testing copying from a secret that does not exist should fail
  (run; ./safe copy secret/copy/from6 secret/copy/to) ; exitok $? 1
  no_key secret/copy/from6
  no_key secret/copy/to


  #######
  clearvault
  testing copying from a key where the underlying secret does not exist should fail
  no_key secret/copy/from7:beep
  (run; ./safe copy secret/copy/from7:beep secret/copy/to) ; exitok $? 1
  no_key secret/copy/to


  #######
  clearvault
  testing copying from a missing key where the underlying secret exists should fail
  (run; ./safe set secret/copy/from8 foo=bar)              ; exitok $? 0
  (run; ./safe copy secret/copy/from8:beep secret/copy/to) ; exitok $? 1
  no_key secret/copy/to


  #######
  clearvault
  testing copying recursively from a leaf node secret
  now generating some secrets to test with
  (run; ./safe set secret/copy/from foo=bar)             ; exitok $? 0

  now copying a leaf node secret
  (run; ./safe copy -Rf secret/copy/from secret/copy/to) ; exitok $? 0
  eq_key secret/copy/{from,to}:foo


  #######
  clearvault
  testing copying recursively from a key
  now generating some secrets to test with
  (run; ./safe set secret/copy/from foo=bar)                   ; exitok $? 0

  now recursively copying from:foo to to
  (run; ./safe copy -Rf secret/copy/from:foo secret/copy/to) ; exitok $? 0
  eq_key secret/copy/{from,to}:foo


  #######
  clearvault
  testing copying recursively from a subtree
  now generating some secrets to test with
  (run; ./safe set secret/copy/fromtree/one foo=bar)              ; exitok $? 0

  now recursively copying secret/copy/fromtree/* to secret/copy/totree/*
  (run; ./safe copy -Rf secret/copy/fromtree secret/copy/totree) ; exitok $? 0
  eq_key secret/copy/{from,to}tree/one:foo


  #######
  clearvault
  testing attempting to copy a subtree without -R should fail
  now generating some secrets to test with
  (run; ./safe set secret/copy/fromtree/one foo=bar); exitok $? 0

  now copying secret/copy/fromtree/* to secret/copy/totree/* without -R
  (run; ./safe copy -f secret/copy/fromtree secret/copy/totree) ; exitok $? 1
  is_key secret/copy/fromtree/one:foo "bar"
  no_key secret/copy/totree/one


  #######
  clearvault
  testing copying a non-existent secret with -f should fail silently
  now copying
  (run; ./safe copy -f secret/copy/gobbledegook secret/copy/fakedes) ; exitok $? 0
  no_key secret/copy/fakedes


  #######
  clearvault
  testing copying a non-existent key with -f should fail silently
  now generating some secrets to test with
  (run; ./safe set secret/copy/from foo=bar)                   ; exitok $? 0

  now copying non-existent key with -f
  (run; ./safe copy -f secret/copy/from:beep secret/copy/to) ; exitok $? 0
  no_key secret/copy/to



  ##     ##  #######  ##     ## ########
  ###   ### ##     ## ##     ## ##
  #### #### ##     ## ##     ## ##
  ## ### ## ##     ## ##     ## ######
  ##     ## ##     ##  ##   ##  ##
  ##     ## ##     ##   ## ##   ##
  ##     ##  #######     ###    ########

  #######
  clearvault
  testing move a secret to another location
  no_key secret/move/from
  no_key secret/move/to

  now generating some secrets to test with
  (run; ./safe set secret/move/from beep=boop)       ; exitok $? 0

  now moving a single secret
  (run; ./safe move secret/move/from secret/move/to) ; exitok $? 0
  no_key secret/move/from:beep
  is_key secret/move/to:beep "boop"


  #######
  clearvault
  testing move a key to another secret without a key specified
  no_key secret/move/{from,to}
  generate secret/move/from beep=boop foo=bar

  now moving a secret without a key
  (run; ./safe move secret/move/from:beep secret/move/to) ; exitok $? 0
  no_key secret/move/from:beep
  is_key secret/move/from:foo  "bar"

  is_key secret/move/to:beep   "boop"
  no_key secret/move/to:foo


  #######
  clearvault
  testing move a key to another specified key where the dest secret exists
  no_key secret/move/{from,to}
  generate secret/move/from beep=boop foo=bar
  generate secret/move/to   wom=bat

  now moving a secret key to an existing secret
  (run; ./safe move secret/move/from:beep secret/move/to:another) ; exitok $? 0

  no_key secret/move/from:beep
  is_key secret/move/from:foo   "bar"

  is_key secret/move/to:another "boop"
  is_key secret/move/to:wom     "bat"


  #######
  clearvault
  testing move a key to another specified key where the dest secret does not exist
  no_key secret/move/from
  no_key secre/move/to

  now generating some secrets to test with
  (run; ./safe set secret/move/from beep=boop foo=bar)            ; exitok $? 0

  now moving one secret key to a new secret key
  (run; ./safe move secret/move/from:beep secret/move/to:another) ; exitok $? 0

  no_key secret/move/from:beep
  is_key secret/move/from:foo   "bar"

  is_key secret/move/to:another "boop"
  no_key secret/move/to:foo


  #######
  clearvault
  testing moving a full secret to a specified key should fail
  no_key secret/move/from
  no_key secret/move/to
  generate secret/move/from beep=boop

  now moving one secret subkey to another existing secret
  (run; ./safe move secret/move/from secret/move/to:beep) ; exitok $? 1
  is_key secret/move/from:beep "boop"
  no_key secret/move/to:beep


  #######
  clearvault
  testing moving from a secret that does not exist should fail
  no_key secret/move/from
  no_key secret/move/to

  (run; ./safe move secret/copy/from secret/move/to) ; exitok $? 1
  no_key secret/move/from
  no_key secret/move/to


  #######
  clearvault
  testing moving from a key where the underlying secret does not exist should fail
  no_key secret/move/from
  no_key secret/move/to

  (run; ./safe move secret/move/from:beep secret/move/to) ; exitok $? 1
  no_key secret/move/from
  no_key secret/move/to


  #######
  clearvault
  testing moving from a missing key where the underlying secret exists should fail
  no_key secret/move/from
  no_key secret/move/to
  generate secret/move/from foo=bar

  now moving a non-existent key to a new secret
  (run; ./safe move secret/move/from:beep secret/move/to) ; exitok $? 1
  is_key secret/move/from:foo "bar"
  no_key secret/move/to


  #######
  clearvault
  testing moving recursively from a leaf node secret
  no_key secret/move/from
  no_key secret/move/to
  generate secret/move/from foo=bar

  now moving a single secret resursively
  (run; ./safe move -Rf secret/move/from secret/move/to) ; exitok $? 0
  no_key secret/move/from:foo
  is_key secret/move/to:foo "bar"


  #######
  clearvault
  testing moving recursively from a key
  no_key secret/move/{from,to}
  generate secret/move/from foo=bar

  now moving a key recursively
  (run; ./safe move -Rf secret/move/from:foo secret/move/to) ; exitok $? 0
  no_key secret/move/from
  is_key secret/move/to:foo "bar"


  #######
  clearvault
  testing moving recursively from a subtree
  no_key secret/{from,to}tree{,/one}
  generate secret/move/fromtree/one foo=bar

  now moving a subtree recursively
  (run; ./safe move -Rf secret/move/fromtree secret/move/totree) ; exitok $? 0
  no_key secret/move/fromtree/one
  is_key secret/move/totree/one:foo "bar"


  #######
  clearvault
  testing attempting to copy a subtree without -R should fail
  no_key secret/{from,to}tree{,/one}
  generate secret/move/fromtree/one foo=bar

  now moving a subtree without the -R option
  (run; ./safe move -f secret/move/fromtree secret/move/totree) ; exitok $? 1
  no_key secret/move/totree/on


  #######
  clearvault
  testing moving a non-existent secret with -f should fail silently
  no_key secret/move/gobbledegook
  (run; ./safe move -f secret/move/gobbledegook secret/move/fakedes) ; exitok $? 0
  no_key secret/move/fakedes


  #######
  clearvault
  testing moving a non-existent key with -f should fail silently
  no_key secret/copy/{from,to}
  generate secret/move/from foo=bar

  now moving non-existent key
  (run; ./safe copy -f secret/move/from:beep secret/move/to) ; exitok $? 0
  no_key secret/move/to



   ######  ##        #######  ########  ########  ######## ########
  ##    ## ##       ##     ## ##     ## ##     ## ##       ##     ##
  ##       ##       ##     ## ##     ## ##     ## ##       ##     ##
  ##       ##       ##     ## ########  ########  ######   ########
  ##       ##       ##     ## ##     ## ##     ## ##       ##   ##
  ##    ## ##       ##     ## ##     ## ##     ## ##       ##    ##
   ######  ########  #######  ########  ########  ######## ##     ##

  #######
  clearvault
  testing safe gen --no-clobber
  no_key secret/existing
  now running safe gen --no-clobber with no pre-existing secrets
  (run; ./safe gen --no-clobber secret/existing val) ; exitok $? 0
  expected=$(./safe get secret/existing:val)

  now running safe gen --no-clobber with pre-existing secrets
  (run; ./safe gen --no-clobber secret/existing val >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
Cowardly refusing to update secret/existing:val as it is already present in Vault
EOF
  is_key secret/existing:val "$expected"

  now running safe gen --no-clobber with pre-existing secrets in --quiet mode
  (run; ./safe gen --no-clobber --quiet secret/existing val >t/home/got 2>&1) ; exitok $? 0

  now checking that we got no error output under --quiet
  cat >t/home/want <<EOF ; diffok
EOF
  is_key secret/existing:val "$expected"


  for op in set paste ask; do
    #######
    clearvault
    testing safe $op --no-clobber
    no_key secret/existing

    now running safe $op --no-clobber with no pre-existing secrets
    (run; ./safe $op --no-clobber secret/existing val=original >t/home/got 2>&1) ; exitok $? 0
    is_key secret/existing:val "original"

    now running safe $op --no-clobber with pre-existing secrets
    (run; ./safe $op --no-clobber secret/existing val=override 2>t/home/got)     ; exitok $? 0
    now checking the error output
    cat >t/home/want <<EOF ; diffok
val: override
Cowardly refusing to update secret/existing, as the following keys would be clobbered: val
EOF
    is_key secret/existing:val "original"

    now running safe $op --no-clobber with pre-existing secrets in --quiet mode
    (run; ./safe $op --no-clobber --quiet secret/existing val=OVER 2>t/home/got) ; exitok $? 0
    now checking the error output
    cat >t/home/want <<EOF ; diffok
EOF
    is_key secret/existing:val "original"


    #######
    clearvault
    testing safe $op --no-clobber, with different key in same path
    no_key secret/existing

    now running safe $op --no-clobber with no pre-existing secrets
    (run; ./safe $op --no-clobber secret/existing val=test)   ; exitok $? 0
    is_key secret/existing:val  "test"

    now running safe $op --no-clobber with pre-existing secrets but a new key
    (run; ./safe $op --no-clobber secret/existing val2=test2) ; exitok $? 0
    is_key secret/existing:val2 "test2"
  done


  #######
  clearvault
  testing safe import --no-clobber
  no_key safe/existing/import

  now running safe import --no-clobber
  (run; ./safe import --no-clobber secret/existing/import <<EOF >t/home/got 2>&1) ; exitok $? 1
{"secret/existing/import":{"should": "not import"}}
EOF
  now checking the error output
  cat >t/home/want <<EOF ; diffok
!! --no-clobber is incompatible with safe import
safe import - Import name/value pairs into the current Vault
USAGE: safe import <backup/file.json
EOF


  for op in move copy; do
    #######
    clearvault
    testing safe $op --no-clobber
    no_key secret/existing/{from,to}
    generate secret/existing/from key=val

    now running safe $op --no-clobber with no pre-existing destination secrets
    (run; ./safe $op --no-clobber secret/existing/{from,to} >t/home/got 2>&1) ; exitok $? 0
    is_key secret/existing/to:key "val"
    if [[ $op == "move" ]]; then
      no_key secret/existing/from
    else
      is_key secret/existing/from:key "val"
    fi

    #######
    clearvault
    testing safe $op --no-clobber with pre-existing destination secrets
    no_key secret/existing/{from,to}
    generate secret/existing/from key=FROM
    generate secret/existing/to   key=TO

    now running safe $op --no-clobber with pre-existing destination secrets
    (run; ./safe $op --no-clobber secret/existing/{from,to} >t/home/got 2>&1) ; exitok $? 0
    now checking the error output
    cat >t/home/want <<EOF ; diffok
Cowardly refusing to copy/move data into secret/existing/to, as that would clobber existing data
EOF
    #is_key secret/existing/from:key "FROM" # FIXME
    is_key secret/existing/to:key   "TO"

    #######
    clearvault
    testing safe $op --no-clobber with pre-existing destination secrets in --quiet mode
    no_key secret/existing/{from,to}
    generate secret/existing/from key=FROM
    generate secret/existing/to   key=TO

    now running safe $op --no-clobber with pre-existing destination secrets in --quiet mode
    (run; ./safe $op --no-clobber --quiet secret/existing/{from,to} >t/home/got 2>&1) ; exitok $? 0
    now checking the error output
    cat >t/home/want <<EOF ; diffok
EOF
    #is_key secret/existing/from:key "FROM" # FIXME
    is_key secret/existing/to:key   "TO"

    #######
    clearvault
    testing safe $op --no-clobber recursive
    no_key secret/existing/from/{first,second} \
           secret/existing/to/{first,second}
    generate secret/existing/from/first  key=val
    generate secret/existing/from/second key=val
    now running safe $op --no-clobber -Rf with no pre-existing secrets
    (run; ./safe $op --no-clobber -Rf secret/existing/{from,to} >t/home/got 2>&1) ; exitok $? 0
    now checking the error output
    cat >t/home/want <<EOF ; diffok
EOF
    is_key secret/existing/to/first:key  "val"
    is_key secret/existing/to/second:key "val"

    #######
    clearvault
    testing $op --no-clobber recursive, with existing data
    no_key secret/existing/from/{first,second} \
           secret/existing/to/{first,second}
    generate secret/existing/from/first  key=FROM-1
    generate secret/existing/from/second key=FROM-2
    generate secret/existing/to/first    key=TO-1

    now running safe $op --no-clobber -Rf with pre-existing destination secrets
    (run; ./safe $op --no-clobber -Rf secret/existing/{from,to} >t/home/got 2>&1) ; exitok $? 0

    now checking the error output
    cat >t/home/want <<EOF ; diffok
Cowardly refusing to copy/move data into secret/existing/to, as the following paths would be clobbered:
- secret/existing/to/first
EOF
    #is_key secret/existing/from/first:key  "FROM-1" # FIXME
    #is_key secret/existing/from/second:key "FROM-2" # FIXME
    is_key secret/existing/to/first:key    "TO-1"
    no_key secret/existing/to/second

    now running safe $op --no-clobber -Rf with pre-existing destination secrets in --quiet mode
    (run; ./safe $op --no-clobber --quiet -Rf secret/existing/{from,to} >t/home/got 2>&1) ; exitok $? 0

    now checking the error output
    cat >t/home/want <<EOF ; diffok
EOF
    #is_key secret/existing/from/first:key  "FROM-1" # FIXME
    #is_key secret/existing/from/second:key "FROM-2" # FIXME
    is_key secret/existing/to/first:key    "TO-1"
    no_key secret/existing/to/second
  done

  clearvault
  testing safe fmt --no-clobber
  no_key secret/existing
  generate secret/existing val=original

  now running safe fmt --no-clobber with no pre-existing formatted key
  (run; ./safe fmt --no-clobber crypt-sha512 \
                   secret/existing val crypted >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
EOF
  expected=$(./safe get secret/existing:crypted)

  now running safe fmt --no-clobber with a pre-existing formatted key
  (run; ./safe fmt --no-clobber crypt-sha512 \
               secret/existing val crypted >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
Cowardly refusing to reformat secret/existing:val to crypted as it is already present in Vault
EOF
  is_key secret/existing:val     "original"
  is_key secret/existing:crypted "$expected"

  now running safe fmt --no-clobber with a pre-existing formatted key in --query mode
  (run; ./safe fmt --no-clobber --quiet crypt-sha512 \
               secret/existing val crypted >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
EOF
  is_key secret/existing:val     "original"
  is_key secret/existing:crypted "$expected"



  #######
  clearvault
  testing safe delete --no-clobber
  no_key secret/existing
  generate secret/existing key=val

  now running safe delete --no-clobber
  (run; ./safe delete --no-clobber -f secret/existing >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
EOF
  no_key secret/existing


  #######
  clearvault
  testing safe delete --no-clobber recursively
  no_key secret/existing{,/subkey}
  generate secret/existing key=val
  generate secret/existing/subkey key=val

  now running safe delete --no-clobber recursively
  (run; ./safe delete --no-clobber -Rf secret/existing >t/home/got 2>&1) ; exitok $? 0
  cat >t/home/want <<EOF ; diffok
EOF
  no_key secret/existing{,/subkey}



  ######## ########  ######## ########
     ##    ##     ## ##       ##
     ##    ##     ## ##       ##
     ##    ########  ######   ######
     ##    ##   ##   ##       ##
     ##    ##    ##  ##       ##
     ##    ##     ## ######## ########

  #######
  clearvault
  testing tree display
  now generating secrets to test with
  (run; ./safe gen secret/tree/alpha     x)  ; exitok $? 0
  (run; ./safe gen secret/tree/g         x)  ; exitok $? 0
  (run; ./safe gen secret/tree/g/a       x)  ; exitok $? 0
  (run; ./safe gen secret/tree/beta/name x)  ; exitok $? 0
  (run; ./safe gen secret/tree/beta/env  x)  ; exitok $? 0
  (run; ./safe gen secret/tree/g/a/m     x)  ; exitok $? 0
  (run; ./safe gen secret/tree/g/a/m/m   x)  ; exitok $? 0
  (run; ./safe gen secret/tree/g/a/m/m/a x)  ; exitok $? 0

  now running safe tree
  (run; ./safe tree secret/tree >t/home/got) ; exitok $? 0

  now checking the output
  cat >t/home/want <<EOF ; diffok
.
└── secret/tree/
    ├── alpha
    ├── beta/
    │   ├── env
    │   └── name
    ├── g
    └── g/
        ├── a
        └── a/
            ├── m
            └── m/
                ├── m
                └── m/
                    └── a

EOF

  now running safe tree with -d to limit display to parent paths
  (run; ./safe tree -d secret/tree >t/home/got) ; exitok $? 0

  now checking the output
  cat >t/home/want <<EOF ; diffok
.
└── secret/tree/
    ├── beta/
    └── g/
        └── a/
            └── m/
                └── m/

EOF

  #######
  clearvault
  testing tree --keys
  generate secret/tree/a/b/c   subkey=foo
  generate secret/tree/a/b/c/d subsubkey=bar
  generate secret/tree/robot   mark=val password=sekrit username=robo

  now retrieving a single subtree
  (run; ./safe tree --keys secret/tree/a/b/c >t/home/got) ; exitok $? 0

  now checking that tree output contains :keys
  cat <<'EOF' >t/home/want ; diffok
.
└── secret/tree/a/b/c
    ├── :subkey
    └── d
        └── :subsubkey

EOF
  now retrieving multiple disjoint subtrees
  (run; ./safe tree --keys secret/tree/a secret/tree/robot >t/home/got) ; exitok $? 0

  now checking that tree output contains :keys
  cat <<'EOF' >t/home/want ; diffok
.
├── secret/tree/a/
│   └── b/
│       ├── c
│       │   └── :subkey
│       └── c/
│           └── d
│               └── :subsubkey
└── secret/tree/robot
    ├── :mark
    ├── :password
    └── :username

EOF



  ########     ###    ######## ##     ##  ######
  ##     ##   ## ##      ##    ##     ## ##    ##
  ##     ##  ##   ##     ##    ##     ## ##
  ########  ##     ##    ##    #########  ######
  ##        #########    ##    ##     ##       ##
  ##        ##     ##    ##    ##     ## ##    ##
  ##        ##     ##    ##    ##     ##  ######

  #######
  clearvault
  testing paths 
  no_key secret/{a/b/c,robot}
  generate secret/a/b/c   subkey=value
  generate secret/a/b/c/d subsubkey=value
  generate secret/robot   username=bot password=sekrit

  now retrieving a single path
  (run; ./safe paths secret/a/b/c >t/home/got) ; exitok $? 0
  now paths should report on path per line
  cat <<'EOF' >t/home/want ; diffok
secret/a/b/c
secret/a/b/c/d
EOF

  now retrieving multiple paths
  (run; ./safe paths secret/a secret/robot >t/home/got) ; exitok $? 0
  now should get all paths
  cat <<'EOF' >t/home/want ; diffok
secret/a/b/c
secret/a/b/c/d
secret/robot
EOF

  testing paths --keys
  now retrieving a single path with keys
  (run; ./safe paths --keys secret/a/b/c >t/home/got) ; exitok $? 0

  now paths should report on path:key per line
  cat <<'EOF' >t/home/want ; diffok
secret/a/b/c:subkey
secret/a/b/c/d:subsubkey
EOF


  now retrieving multiple paths with keys
  (run; ./safe paths --keys secret/a secret/robot >t/home/got) ; exitok $? 0
  now should get all paths, and all the keys
  cat <<'EOF' >t/home/want ; diffok
secret/a/b/c:subkey
secret/a/b/c/d:subsubkey
secret/robot:password
secret/robot:username
EOF



  ######## ##     ## ########   #######  ########  ########
  ##        ##   ##  ##     ## ##     ## ##     ##    ##
  ##         ## ##   ##     ## ##     ## ##     ##    ##
  ######      ###    ########  ##     ## ########     ##
  ##         ## ##   ##        ##     ## ##   ##      ##
  ##        ##   ##  ##        ##     ## ##    ##     ##
  ######## ##     ## ##         #######  ##     ##    ##

  #######
  clearvault
  testing tree export
  no_key secret/export{,/admin,/robot,/a/b/c}
  generate secret/export/admin username=admin password=sekrit
  generate secret/export/robot username=bot password=beep-boop mark=2
  generate secret/export/a/b/c subkey='the-value-given'

  now exporting the vault data
  (run; ./safe export secret/export >t/home/got) ; exitok $? 0

  now checking that the export contained our data
cat >t/home/want <<EOF ; yamlok
---
secret/export/admin:
  username: admin
  password: sekrit
secret/export/robot:
  username: bot
  password: beep-boop
  mark: "2"
secret/export/a/b/c:
  subkey: the-value-given
EOF
EOF



  #### ##     ## ########   #######  ########  ########
   ##  ###   ### ##     ## ##     ## ##     ##    ##
   ##  #### #### ##     ## ##     ## ##     ##    ##
   ##  ## ### ## ########  ##     ## ########     ##
   ##  ##     ## ##        ##     ## ##   ##      ##
   ##  ##     ## ##        ##     ## ##    ##     ##
  #### ##     ## ##         #######  ##     ##    ##

  #######
  clearvault
  testing tree import
  cat <<EOF >t/home/want
[
  {
    "data": {
      "secret/import/a/b/c": {
        "versions": [
          {
            "value": {
              "subkey": "the-value-given"
            }
          }
        ]
      },
      "secret/import/a/b/c/d": {
        "versions": [
          {
            "value": {
              "subsubkey": "really deep"
            }
          }
        ]
      },
      "secret/import/admin": {
        "versions": [
          {
            "value": {
              "password": "sekrit",
              "username": "admin"
            }
          }
        ]
      },
      "secret/import/robot": {
        "versions": [
          {
            "value": {
              "mark": "2",
              "password": "beep-boop",
              "username": "bot"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {}
  }
]
EOF
  now importing our data
  (run; ./safe import secret/import <t/home/want) ; exitok $? 0

  now exporting our data
  (run; ./safe export secret/import >t/home/got)  ; exitok $? 0

  cat <<EOF >t/home/want
secret/import/a/b/c:
  subkey: the-value-given
secret/import/a/b/c/d:
  subsubkey: really deep
secret/import/admin:
  password: sekrit
  username: admin
secret/import/robot:
  mark: "2"
  password: beep-boop
  username: bot
EOF
  now checking that the export matches the import
  yamlok

  testing import with a v1 format export
  clearvault
  cat <<EOF | spruce json >t/home/want
---
secret/import/admin:
  username: admin
  password: sekrit
secret/import/robot:
  username: bot
  password: beep-boop
  mark: "2"
secret/import/a/b/c:
  subkey: the-value-given
secret/import/a/b/c/d:
  subsubkey: really deep
EOF
  now importing our data
  (run; ./safe import secret/import <t/home/want) ; exitok $? 0

  now exporting our data
  (run; ./safe export secret/import >t/home/got)  ; exitok $? 0

  cat <<EOF >t/home/want
---
secret/import/admin:
  username: admin
  password: sekrit
secret/import/robot:
  username: bot
  password: beep-boop
  mark: "2"
secret/import/a/b/c:
  subkey: the-value-given
secret/import/a/b/c/d:
  subsubkey: really deep
EOF
  now checking that the export corresponds to the import
  yamlok




  ########  ######## ##    ## ######## ##    ##
  ##     ## ##       ##   ##  ##        ##  ##
  ##     ## ##       ##  ##   ##         ####
  ########  ######   #####    ######      ##
  ##   ##   ##       ##  ##   ##          ##
  ##    ##  ##       ##   ##  ##          ##
  ##     ## ######## ##    ## ########    ##

  testing safe rekey
  now trying to rekey to require 5/3 keys should error
  (run; ./safe rekey --keys 3 --threshold 5 >t/home/got 2>&1); exitok $? 1
  cat <<'EOF' > t/home/want ; diffok
!! You specified only 3 unseal keys, but are requiring 5 keys to unseal vault. This is bad.
EOF
  now trying to rekey to require 1/1+n keys should error
  (run; ./safe rekey --threshold 1 --keys 2 >t/home/got 2>&1); exitok $? 1
  cat <<'EOF' > t/home/want ; diffok
!! When specifying more than 1 unseal key, you must also have more than one key required to unseal.
EOF
  now trying to rekey with a bad unseal key should error
  (run; ./safe rekey </dev/null >t/home/got 2>&1); exitok $? 1
  # the below sed is used, as earlier versions of vault had a bad error message, that later versions
  # corrected, so we need to account for both error messages coming through
  sed -i -e 's/must specified/must be specified/' t/home/got
  cat <<'EOF' > t/home/want ; diffok
Vault rekey canceled successfully
!! Key submission failed: no key provided
EOF

  now after failures to rekey, the cancel command was sent to reset the rekey
  (./safe curl GET sys/rekey/init | grep '"started":false'); exitok $? 0


  now restarting vault server to start over
  restart_vault_server
  now validating that the restarted vault is unsealed
  (./safe set secret/handshake knock=knock); exitok $? 0
  now trying to rekey without using gpg
  (run; echo "$unseal_key" | ./safe rekey --keys 1 > t/home/original); exitok $? 0
  cat t/home/original | sed -E 's/Unseal key 1: .*/Unseal key 1: REPLACED/' > t/home/got
  cat <<'EOF' >t/home/want ; diffok
Your Vault has been re-keyed. Please take note of your new unseal keys and store them safely!
Unseal key 1: REPLACED
EOF
  now "unsealing with the new unseal key succeeds (making sure data still exists + the new keys work)"
  (./safe vault operator seal); exitok $? 0
  unseal_key=$(awk '/^Unseal key 1:/ { print $4 }' < t/home/original | head -n1)
  (./safe vault operator unseal "$unseal_key" </dev/null); exitok $? 0
  (./safe read secret/handshake > t/home/got); exitok $? 0
  cat <<'EOF' >t/home/want; diffok
--- # secret/handshake
knock: knock

EOF
  rm t/home/original

  if [[ -z "${SAFE_DISABLE_GPG_TESTS:-}" ]]; then
    testing safe rekey --gpg
    now trying to rekey with the threshold other than the number of gpg keys should error
    gpg --import assets/gpg.pubkey
    (run; ./safe rekey --keys 3 --gpg safe-testing@safe.com >t/home/got 2>&1); exitok $? 1
    cat <<'EOF' > t/home/want ; diffok
!! Both --gpg and --keys were specified, and their counts did not match.
EOF

    now trying to rekey with a gpg key that is not in the keyring fails
    (run; ./safe rekey --gpg not-there@missing.com > t/home/got 2>&1); exitok $? 1
    cat <<'EOF' >t/home/want ; diffok
!! No GPG key found for not-there@missing.com in the local keyring
EOF

    restart_vault_server
    now trying to rekey with gpg keys matching the threshold
    (./safe set secret/handshake knock=knock); exitok $? 0
    gpg --import assets/gpg.pubkey
    gpg --allow-secret-key-import --import assets/gpg.key
    (run; echo "$unseal_key" |./safe rekey --gpg safe-testing@safe.com > t/home/original); exitok $? 0
    cat t/home/original | sed -E 's/^[a-z0-9]+$/REPLACED/' > t/home/got
    cat <<'EOF' > t/home/want ; diffok
Your Vault has been re-keyed. Please take note of your new unseal keys and store them safely!
Unseal key for safe-testing@safe.com:
REPLACED
EOF
    now "unsealing with the new unseal key succeeds (making sure data still exists + the new keys work)"
    (./safe vault operator seal); exitok $? 0
    #FIXME retrieve the new unseal key, decrypt, and unseal vault, then read data
    encrypted_key=$(tail -n 1 t/home/original)
    unseal_key=$(echo $encrypted_key | xxd -r -p  | gpg -d)
    echo "Using new unseal key of '$unseal_key'"
    (./safe vault operator unseal "$unseal_key" < /dev/null); exitok $? 0
    rm t/home/original
  (./safe read secret/handshake > t/home/got); exitok $? 0
  cat <<'EOF' >t/home/want; diffok
--- # secret/handshake
knock: knock

EOF
  fi

  if [[ $kvversion -ne 2 ]]; then continue; fi


  # KV Version 2 specific tests
  testing setting multiple versions
  clearvault
  # the default version limit in vault is 10. If we write eleven, we can
  # test that the count not starting at version 1 works - we would expect 
  # the first remaining version to be version 2
  values=(eins zwei drei vier fuenf sechs sieben acht neun zehn elf)
  for val in "${values[@]}"; do
    now setting version $val of the same key
    (./safe set secret/versioned key=${val} 2>/dev/null); exitok $? 0
  done

  now checking that not specifying a version gets the latest version
  (./safe get secret/versioned >t/home/got); exitok $? 0
  cat <<'EOF' >t/home/want; diffok
--- # secret/versioned
key: elf

EOF

  for vnum in $(seq 2 11); do
    now checking that version ${vnum} can be retrieved
    (./safe get secret/versioned^${vnum} >t/home/got); exitok $? 0
    cat <<EOF >t/home/want; diffok
--- # secret/versioned^${vnum}
key: ${values[${vnum}-1]}

EOF
  done

  # If the default number of versions stops being 10, this would fail
  now checking that retrieving a missing version returns an error
  (./safe get secret/versioned^1 2>t/home/got); exitok $? 1
  cat <<'EOF' >t/home/want; diffok
!! no secret exists at path `secret/versioned`
EOF

  testing versions 
  now testing the output of versions
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  # The whitespace below between version num and status is a tab
  cat <<'EOF' >t/home/want; diffok
2	alive
3	alive
4	alive
5	alive
6	alive
7	alive
8	alive
9	alive
10	alive
11	alive
EOF

  testing deleting specific versions
  clearvault
  now putting secret versions into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now deleting version two
  (./safe delete secret/versioned^2 >/dev/null); exitok $? 0
  now checking the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  cat << 'EOF' >t/home/want; diffok
1	alive
2	deleted
3	alive
EOF
    
  testing deleting the latest version
  clearvault
  now putting secret versions into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now deleting the latest version
  (./safe delete secret/versioned >/dev/null); exitok $? 0
  now checking the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  cat << 'EOF' >t/home/want; diffok
1	alive
2	alive
3	deleted
EOF
    
  
  testing destroying specific versions
  clearvault
  now putting secret versions into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now destroying version two
  (./safe delete -D secret/versioned^2 >/dev/null); exitok $? 0
  now checking the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  cat << 'EOF' >t/home/want; diffok
1	alive
2	destroyed
3	alive
EOF

  testing destroying the latest version
  clearvault
  now putting secret versions into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now destroying the latest version
  (./safe delete -D secret/versioned >/dev/null); exitok $? 0
  now checking the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  cat << 'EOF' >t/home/want; diffok
1	alive
2	alive
3	destroyed
EOF

  testing deleting already deleted versions
  clearvault
  now putting a secret into the vault
  (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  now deleting the secret
  (./safe delete secret/versioned >/dev/null); exitok $? 0
  now deleting the same secret again
  (./safe delete secret/versioned >/dev/null 2>t/home/got); exitok $? 1
  now checking that the error message conveys that the secret is already deleted
  cat << 'EOF' >t/home/want; diffok
!! `secret/versioned' is deleted
EOF

  testing deleting already deleted versions with force
  clearvault
  now putting a secret into the vault
  (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  now deleting the secret
  (./safe delete -f secret/versioned >/dev/null); exitok $? 0
  now deleting the same secret again
  (./safe delete -f secret/versioned >/dev/null 2>t/home/got); exitok $? 0
    
  testing destroying specific versions that are already marked as deleted
  clearvault
  now putting secret versions into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now deleting version two
  (./safe delete secret/versioned^2 >/dev/null); exitok $? 0
  now destroying version two
  (./safe delete -D secret/versioned^2 >/dev/null); exitok $? 0
  now checking the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  cat << 'EOF' >t/home/want; diffok
1	alive
2	destroyed
3	alive
EOF

  testing destroying already destroyed versions
  clearvault
  now putting a secret into the vault
  (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  now putting a second version of the secret into the vault
  (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  now destroying the secret
  (./safe delete secret/versioned^1 -D >/dev/null); exitok $? 0
  now destroying the same secret again
  (./safe delete secret/versioned^1 -D 2>t/home/got); exitok $? 1
  now checking that the error message conveys that the secret is already destroyed
  cat << 'EOF' >t/home/want; diffok
!! `secret/versioned^1' is destroyed
EOF

  testing destroying already destroyed versions with force
  clearvault
  now putting a secret into the vault
  (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  now destroying the secret
  (./safe delete secret/versioned -Df); exitok $? 0
  now destroying the same secret again
  (./safe delete secret/versioned -Df); exitok $? 0

  testing destroying versions of secrets that dont exist
  clearvault
  now destroying a non-existent secret
  (./safe delete secret/poof -D 2>t/home/got); exitok $? 1
  now testing that the error message conveys that nothing is there
  cat << 'EOF' >t/home/want; diffok
!! no secret exists at path `secret/poof`
EOF

  testing destroying versions of secrets that dont exist with force
  clearvault
  now destroying a non-existent secret
  (./safe delete secret/poof -Df); exitok $? 0

  testing deleting all versions
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now deleting all versions
  (./safe delete secret/versioned -a); exitok $? 0
  now getting versions metadata
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that all versions are deleted
  cat << 'EOF' >t/home/want; diffok
1	deleted
2	deleted
3	deleted
EOF


  testing deleting all versions with the latest version deleted already
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now deleting the latest version
  (./safe delete secret/versioned); exitok $? 0
  now deleting all versions
  (./safe delete secret/versioned -a); exitok $? 0
  now getting versions metadata
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that all versions are deleted
  cat << 'EOF' >t/home/want; diffok
1	deleted
2	deleted
3	deleted
EOF

  testing destroying all versions
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now destroying all versions
  (./safe delete secret/versioned -Da 2>/dev/null); exitok $? 0
  now checking that versions metadata is gone
  (./safe versions secret/versioned >t/home/got 2>/dev/null); exitok $? 1

  testing destroying all versions when the latest version is already destroyed
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now destroying the latest version
  (./safe delete secret/versioned -D 2>/dev/null); exitok $? 0
  now destroying all versions
  (./safe delete secret/versioned -Da 2>/dev/null); exitok $? 0
  now checking that versions metadata is gone
  (./safe versions secret/versioned >t/home/got 2>/dev/null); exitok $? 1

  testing that destroying all versions one by one cleans up the metadata
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=val 2>/dev/null); exitok $? 0
  done
  now destroying version 1
  (./safe delete secret/versioned^1 -D); exitok $? 0
  now destroying version 3
  (./safe delete secret/versioned^3 -D); exitok $? 0
  now destroying version 2
  (./safe delete secret/versioned^2 -D); exitok $? 0
  now checking that the metadata no longer exists
  (./safe versions secret/versioned 2>/dev/null); exitok $? 1

  testing that reverting to a previous version works
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=$vnum 2>/dev/null); exitok $? 0
  done
  now reverting back to version 2
  (./safe revert secret/versioned 2); exitok $? 0
  now retrieving the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that there are four living versions
  cat << 'EOF' >t/home/want; diffok
1	alive
2	alive
3	alive
4	alive
EOF
  now getting the latest version of the secret
  (./safe get secret/versioned:key >t/home/got); exitok $? 0
  now checking that the latest version contains the value 2
  cat << 'EOF' >t/home/want; diffok
2
EOF
  
  testing that reverting to the current version is a no-op
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=$vnum 2>/dev/null); exitok $? 0
  done
  now reverting back to version 3
  (./safe revert secret/versioned 3); exitok $? 0
  now retrieving the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that there are three living versions
  cat << 'EOF' >t/home/want; diffok
1	alive
2	alive
3	alive
EOF
  now getting the latest version of the secret
  (./safe get secret/versioned:key >t/home/got); exitok $? 0
  now checking that the latest version contains the value 3
  cat << 'EOF' >t/home/want; diffok
3
EOF

  testing that reverting to a version that does not yet exist errs
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=$vnum 2>/dev/null); exitok $? 0
  done
  now reverting back to version 4
  (./safe revert secret/versioned 4 2>/dev/null); exitok $? 1
  now retrieving the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that there are three living versions
  cat << 'EOF' >t/home/want; diffok
1	alive
2	alive
3	alive
EOF
  now getting the latest version of the secret
  (./safe get secret/versioned:key >t/home/got); exitok $? 0
  now checking that the latest version contains the value 3
  cat << 'EOF' >t/home/want; diffok
3
EOF

  now reverting to a deleted version
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=$vnum 2>/dev/null); exitok $? 0
  done
  now deleting version 2
  (./safe delete secret/versioned^2); exitok $? 0
  now reverting back to version 2
  (./safe revert secret/versioned 2 2>/dev/null); exitok $? 1
  now retrieving the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that there are three versions with the correct states
  cat << 'EOF' >t/home/want; diffok
1	alive
2	deleted
3	alive
EOF
  now getting the latest version of the secret
  (./safe get secret/versioned:key >t/home/got); exitok $? 0
  now checking that the latest version contains the value 3
  cat << 'EOF' >t/home/want; diffok
3
EOF

  now reverting to a deleted version with the -d flag set
  clearvault
  now putting three versions of a secret into the vault
  for vnum in $(seq 1 3); do
    (./safe set secret/versioned key=$vnum 2>/dev/null); exitok $? 0
  done
  now deleting version 2
  (./safe delete secret/versioned^2); exitok $? 0
  now reverting back to version 2
  (./safe revert secret/versioned 2 -d); exitok $? 0
  now retrieving the version list
  (./safe versions secret/versioned >t/home/got); exitok $? 0
  now checking that there are four versions with the correct states
  cat << 'EOF' >t/home/want; diffok
1	alive
2	deleted
3	alive
4	alive
EOF
  now getting the latest version of the secret
  (./safe get secret/versioned:key >t/home/got); exitok $? 0
  now checking that the latest version contains the value 3
  cat << 'EOF' >t/home/want; diffok
2
EOF

  testing tree export when redundant paths are specified
  clearvault
  no_key secret/export{,/admin,/robot,/a/b/c}
  generate secret/export/admin username=admin password=sekrit
  generate secret/export/robot username=bot password=beep-boop mark=2
  generate secret/export/a/b/c subkey='the-value-given'

  now exporting the vault data
  (run; ./safe export secret/export secret/export secret/export/a secret/export/a/b secret/export/robot >t/home/got) ; exitok $? 0

  now checking that the export contained our non-duplicated data
  cat >t/home/want <<EOF ; yamlok
---
secret/export/a/b/c:
  subkey: the-value-given
secret/export/admin:
  password: sekrit
  username: admin
secret/export/robot:
  mark: "2"
  password: beep-boop
  username: bot
EOF

  testing export with multiple versions per secret
  clearvault
  no_key secret/export{,/admin,/robot,/a/b/c}
  generate secret/export/admin username=admin password=sekrit
  generate secret/export/admin username=admin password=anuthersekrit
  generate secret/export/admin username=admin password=sekrit anuthurkey=beepboop
  generate secret/export/robot username=bot password=beep-boop mark=2
  generate secret/export/robot username=bot password=BEEPBOOP mark=2
  generate secret/export/a/b/c subkey='the-value-given'
  now deleting version 2 of secret/export/admin
  (./safe delete secret/export/admin^2 -f); exitok $? 0
  now destroying version 1 of secret/export/robot
  (./safe delete secret/export/robot^1 -Df); exitok $? 0
  now exporting the vault data
  (run; ./safe export secret/export --all --deleted >t/home/got) ; exitok $? 0
  now checking that the export contained our data
  cat >t/home/want <<EOF ; jsonok
[
  {
    "data": {
      "secret/export/a/b/c": {
        "versions": [
          {
            "value": {
              "subkey": "the-value-given"
            }
          }
        ]
      },
      "secret/export/admin": {
        "versions": [
          {
            "value": {
              "password": "sekrit",
              "username": "admin"
            }
          },
          {
            "deleted": true,
            "value": {
              "password": "anuthersekrit",
              "username": "admin"
            }
          },
          {
            "value": {
              "password": "sekrit",
              "username": "admin",
              "anuthurkey": "beepboop"
            }
          }
        ]
      },
      "secret/export/robot": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "value": {
              "mark": "2",
              "password": "BEEPBOOP",
              "username": "bot"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF
  
  testing exports when the first remaining version is not one
  clearvault
  values=(eins zwei drei vier fuenf sechs sieben acht neun zehn elf)
  for val in "${values[@]}"; do
    now setting version $val of the same key
    (./safe set secret/versioned key=${val} 2>/dev/null); exitok $? 0
  done
  now exporting the tree
  (./safe export secret --all --deleted >t/home/got) ; exitok $? 0
  cat >t/home/want <<EOF ; jsonok
[
  {
    "data": {
      "secret/versioned": {
        "first": 2,
        "versions": [
          {
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          },
          {
            "value": {
              "key": "vier"
            }
          },
          {
            "value": {
              "key": "fuenf"
            }
          },
          {
            "value": {
              "key": "sechs"
            }
          },
          {
            "value": {
              "key": "sieben"
            }
          },
          {
            "value": {
              "key": "acht"
            }
          },
          {
            "value": {
              "key": "neun"
            }
          },
          {
            "value": {
              "key": "zehn"
            }
          },
          {
            "value": {
              "key": "elf"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
] 
EOF

  testing importing a tree where the first version is not 1
  clearvault
  cat >t/home/want <<EOF
[
  {
    "data": {
      "secret/versioned": {
        "first": 2,
        "versions": [
          {
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          },
          {
            "value": {
              "key": "vier"
            }
          },
          {
            "value": {
              "key": "fuenf"
            }
          },
          {
            "value": {
              "key": "sechs"
            }
          },
          {
            "value": {
              "key": "sieben"
            }
          },
          {
            "value": {
              "key": "acht"
            }
          },
          {
            "value": {
              "key": "neun"
            }
          },
          {
            "value": {
              "key": "zehn"
            }
          },
          {
            "value": {
              "key": "elf"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
] 
EOF
  now importing the secrets
  (run; ./safe import secret/import <t/home/want) ; exitok $? 0
  now exporting the secrets
  (./safe export secret --all --deleted >t/home/got); exitok $? 0
  now checking that the export matches the import
  jsonok

  testing exports without --deleted set
  clearvault
  values=(eins zwei drei)
  for val in "${values[@]}"; do
    now setting version $val of the same key
    (./safe set secret/versioned key=${val} 2>/dev/null); exitok $? 0
  done
  now deleting version 2
  (./safe delete secret/versioned^2 -f); exitok $? 0
  now destroying version 1
  (./safe delete secret/versioned^1 -Df); exitok $? 0
  now exporting the tree 
  (./safe export secret --all >t/home/got) ; exitok $? 0
  cat >t/home/want <<EOF ; jsonok
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "destroyed": true
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
] 
EOF

  testing exports without --all set
  clearvault
  values=(eins zwei drei)
  for val in "${values[@]}"; do
    now setting version $val of the same key
    (./safe set secret/versioned key=${val} 2>/dev/null); exitok $? 0
  done
  now exporting 
  (./safe export secret >t/home/got) ; exitok $? 0
  now checking that the output matches what is expected
  cat >t/home/want <<EOF ; yamlok
secret/versioned:
  key: drei
EOF

  testing imports with --ignore-destroyed set
  clearvault
  cat >t/home/want <<EOF
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "deleted": true,
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF
  (run; ./safe import secret/import -I <t/home/want) ; exitok $? 0
  now exporting the secrets
  (./safe export secret --all --deleted >t/home/got); exitok $? 0
  now checking that the export matches the import
  cat >t/home/want <<EOF ; jsonok
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "deleted": true,
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF
  
  testing imports with --ignore-deleted set
  clearvault
  cat >t/home/want <<EOF
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "deleted": true,
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF
  (run; ./safe import secret/import -i <t/home/want) ; exitok $? 0
  now exporting the secrets
  (./safe export secret --all --deleted >t/home/got); exitok $? 0
  now checking that the export matches the import
  cat >t/home/want <<EOF ; jsonok
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF

  testing imports with --ignore-destroyed and --ignore-deleted set
  clearvault
  cat >t/home/want <<EOF
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "deleted": true,
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF
  (run; ./safe import secret/import -iI <t/home/want) ; exitok $? 0
  now exporting the secrets
  (./safe export secret --all --deleted >t/home/got); exitok $? 0
  now checking that the export matches the import
  cat >t/home/want <<EOF ; yamlok
secret/versioned:
  key: drei
EOF

  testing imports with --shallow set
  clearvault
  cat >t/home/want <<EOF
[
  {
    "data": {
      "secret/versioned": {
        "versions": [
          {
            "destroyed": true
          },
          {
            "deleted": true,
            "value": {
              "key": "zwei"
            }
          },
          {
            "value": {
              "key": "drei"
            }
          }
        ]
      }
    },
    "export_version": 2,
    "requires_versioning": {"secret": true}
  }
]
EOF
  (run; ./safe import secret/import -s <t/home/want) ; exitok $? 0
  now exporting the secrets
  (./safe export secret --all --deleted >t/home/got); exitok $? 0
  now checking that the export matches the import
  cat >t/home/want <<EOF ; yamlok
secret/versioned:
  key: drei
EOF
  dump_log
done
done

if [[ -z "${TEST_QUICK:-}" ]]; then
  #######
  clearvault
  no_key secret/existing

  testing safe x509 --no-clobber
  now running safe x509 issue --no-clobber with no pre-existing certificates
  (run; ./safe x509 issue --no-clobber \
                --ca --name test \
                secret/existing >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
EOF
  expected=$(./safe get secret/existing)

  now running safe x509 issue --no-clobber with pre-existing certificates
  (run; ./safe x509 issue \
                --no-clobber --ca --name test \
                secret/existing >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
Cowardly refusing to create a new certificate in secret/existing as it is already present in Vault
EOF
  is_key secret/existing "$expected" "<existing>"

  now running safe x509 issue --no-clobber with pre-existing certificates in --quiet mode
  (run; ./safe x509 issue --quiet --no-clobber \
                --ca --name test \
                secret/existing >t/home/got 2>&1) ; exitok $? 0

  now checking the error output
  cat >t/home/want <<EOF ; diffok
EOF
  is_key secret/existing "$expected" "<existing>"

  now running safe x509 revoke --no-clobber with no pre-existing revocation list
  (run; ./safe x509 revoke --no-clobber \
                --signed-by secret/existing \
                secret/existing >t/home/got 3>&1) ; exitok $? 0
  cat >t/home/want <<EOF ; diffok
EOF

  testing safe x509 reissue
  now issuing a CA and a certificate for reissue testing
  (run; ./safe x509 issue --ca        secret/reissue/ca --name test.ca   && \
        ./safe x509 issue --signed-by secret/reissue/ca --name test.cert \
                          --bits 2048 secret/reissue/cert); exitok $? 0
  serial1=$(./safe read secret/reissue/ca:serial)

  now reissuing the certificate
  ./safe cp secret/reissue/cert/ secret/reissue/orig
  (run; ./safe x509 reissue secret/reissue/cert); exitok $? 0

  now checking that reissue changed the private key
  ne "$(./safe read secret/reissue/orig:key)" \
      "$(./safe read secret/reissue/cert:key)"

  now checking that reissue bumps the CA serial number
  serial2=$(./safe read secret/reissue/ca:serial)
  eq $(( $serial1 + 1 )) $serial2

  now checking that reissue does not change certificate attributes
  eq_or_diff "$(./safe x509 show secret/reissue/orig | grep -Ev 'secret/re|valid from|expires in|serial')" \
              "$(./safe x509 show secret/reissue/cert | grep -Ev 'secret/re|valid from|expires in|serial')"

  now reissuing the certificate with a shorter ttl and a smaller key
  (run; ./safe x509 reissue --ttl 5d --bits 1024 secret/reissue/cert); exitok $? 0

  now checking that the certificates have different dates
  ne "$(./safe x509 show secret/reissue/orig | grep 'valid from')" \
      "$(./safe x509 show secret/reissue/cert | grep 'valid from')"

  now checking that reissue does not change certificate attributes, other than ttl
  eq_or_diff "$(./safe x509 show secret/reissue/orig | grep -Ev 'secret/re|valid from|expires in|serial')" \
              "$(./safe x509 show secret/reissue/cert | grep -Ev 'secret/re|valid from|expires in|serial')"



  testing safe x509 renew
  now issuing a CA and a certificate for renew testing
  (run; ./safe x509 issue --ca        secret/renew/ca --name test.ca   && \
        ./safe x509 issue --signed-by secret/renew/ca --name test.cert \
                          --bits 2048 secret/renew/cert); exitok $? 0
  serial1=$(./safe read secret/renew/ca:serial)

  now renewing the certificate
  ./safe cp secret/renew/cert/ secret/renew/orig
  (run; ./safe x509 renew secret/renew/cert); exitok $? 0

  now checking that renew did not change the private key
  eq "$(./safe read secret/renew/orig:key)" \
      "$(./safe read secret/renew/cert:key)"

  now checking that renew bumps the CA serial number
  serial2=$(./safe read secret/renew/ca:serial)
  eq $(( $serial1 + 1 )) $serial2

  now checking that renew does not change certificate attributes
  eq_or_diff "$(./safe x509 show secret/renew/orig | grep -Ev 'secret/re|valid from|expires in|serial')" \
              "$(./safe x509 show secret/renew/cert | grep -Ev 'secret/re|valid from|expires in|serial')"

  now renewing the certificate with a shorter ttl
  (run; ./safe x509 renew --ttl 5d secret/renew/cert); exitok $? 0

  now checking that the certificates have different dates
  ne "$(./safe x509 show secret/renew/orig | grep 'valid from')" \
      "$(./safe x509 show secret/renew/cert | grep 'valid from')"

  now checking that renew does not change certificate attributes, other than ttl
  eq_or_diff "$(./safe x509 show secret/renew/orig | grep -Ev 'secret/re|valid from|expires in|serial')" \
              "$(./safe x509 show secret/renew/cert | grep -Ev 'secret/re|valid from|expires in|serial')"


  now removing the CRL from a CA certificate
  (run; ./safe rm secret/renew/ca:crl); exitok $? 0
  no_key secret/renew/ca:crl

  now checking that a CA without a CRL is invalid
  (run; ./safe x509 validate secret/renew/ca); exitok $? 1

  now checking that renew can re-constitute a missing CRL
  (run; ./safe x509 renew secret/renew/ca); exitok $? 0
  ok_key secret/renew/ca:crl

  now checking that a CA is valid again
  (run; ./safe x509 validate secret/renew/ca); exitok $? 0


  now removing the serial from a CA certificate
  (run; ./safe rm secret/renew/ca:serial); exitok $? 0
  no_key secret/renew/ca:serial

  now checking that a CA without a serial is invalid
  (run; ./safe x509 validate secret/renew/ca); exitok $? 1

  now checking that renew can re-constitute a missing CA serial
  (run; ./safe x509 renew secret/renew/ca); exitok $? 0
  ok_key secret/renew/ca:serial

  now checking that a CA is valid again
  (run; ./safe x509 validate secret/renew/ca); exitok $? 0

  for op in ssh rsa dhparam; do
    case $op in
    ssh)     what="an SSH key" ;;
    rsa)     what="an RSA key" ;;
    dhparam) what="a Diffie-Hellman key exchange parameter set" ;;
    *)       what="(i don't know what)" ;;
    esac

    #######
    clearvault
    testing safe $op --no-clobber
    no_key secret/existing

    now running safe $op --no-clobber with no pre-existing secrets
    (run; ./safe $op --no-clobber secret/existing >t/home/got 2>/dev/null) ; exitok $? 0
    cat >t/home/want <<EOF ; diffok
EOF
    expected=$(./safe get secret/existing)

    now running safe $op --no-clobber with pre-existing secrets
    (run; ./safe $op --no-clobber secret/existing >t/home/got 2>&1) ; exitok $? 0

    now checking the error output
    cat >t/home/want <<EOF ; diffok
Cowardly refusing to generate $what at secret/existing as it is already present in Vault
EOF
    is_key secret/existing "$expected" '<existing>'

    now running safe $op --no-clobber with pre-existing secrets in --quiet mode
    (run; ./safe $op --no-clobber --quiet secret/existing >t/home/got 2>&1) ; exitok $? 0

    now checking the error output
    cat >t/home/want <<EOF ; diffok
EOF
    is_key secret/existing "$expected" '<existing>'
  done

  #######

  ##     ##     ########   #####    #######
   ##   ##      ##        ##   ##  ##     ##
    ## ##       ##       ##     ## ##     ##
     ###        #######  ##     ##  ########
    ## ##             ## ##     ##        ##
   ##   ##  ### ##    ##  ##   ##  ##     ##
  ##     ## ###  ######    #####    #######

  #######
  clearvault
  testing x509 commands

  now running safe x509 issue without a path
  (run; ./safe x509 issue)                                                ; exitok $? 1
  now running safe x509 issue without a name
  (run; ./safe x509 issue --signed-by secret/enoent)                      ; exitok $? 1
  now running safe x509 issue with a non-existent ca
  (run; ./safe x509 issue --signed-by secret/enoent secret/cert)          ; exitok $? 1

  now generating a new self-signed certificate
  (run; ./safe x509 issue secret/x509/self-signed --name www.example.com) ; exitok $? 0
  now validating our self-signed certificate
  (run; ./safe x509 validate secret/x509/self-signed)                     ; exitok $? 0

  ok_key secret/x509/self-signed:{certificate,key,combined}
  no_key secret/x509/self-signed:{serial,crl}

  now validating the certificate applicability
  (run; ./safe x509 check secret/x509/self-signed)                        ; exitok $? 0
  (run; ./safe x509 check secret/x509/self-signed --for www.example.com)  ; exitok $? 0
  (run; ./safe x509 check secret/x509/self-signed --for mail.example.com) ; exitok $? 1
  (run; ./safe x509 check secret/x509/self-signed --for test@example.com) ; exitok $? 1
  (run; ./safe x509 check secret/x509/self-signed --for 10.40.5.6)        ; exitok $? 1

  now running safe x509 issue without a name
  (run; ./safe x509 issue secret/fail-without-name)                       ; exitok $? 1
  no_key secret/fail-without-name:{certificate,key,combined,serial,crl}

  now generate a CA certificate
  (run; ./safe x509 issue secret/x509/ca --name ca.example.com --ca)      ; exitok $? 0
  ok_key secret/x509/ca:{certificate,key,combined,serial,crl}

  now validating our new CA certificate
  (run; ./safe x509 validate secret/x509/ca --ca)                         ; exitok $? 0
  (run; ./safe x509 validate secret/x509/ca --not-expired)                ; exitok $? 0
  (run; ./safe x509 validate secret/x509/ca --for ca.example.com)         ; exitok $? 0
  (run; ./safe x509 validate secret/x509/ca --for www.example.com)        ; exitok $? 1
  (run; ./safe x509 validate secret/x509/ca --signed-by secret/x509/ca \
                                            --not-revoked)                ; exitok $? 0

  now running safe x509 check without a path
  (run; ./safe x509 check)                                                ; exitok $? 1
  now running safe x509 check with --signed-by but no path
  (run; ./safe x509 check --signed-by secret/enoent)                      ; exitok $? 1
  now running safe x509 check with no CA
  (run; ./safe x509 check --signed-by secret/enoent secret/cert)          ; exitok $? 1
  now running safe x509 check with a bad certificate path
  (run; ./safe x509 check --signed-by secret/x509/ca secret/enoent)       ; exitok $? 1

  now issuing a CA-signed certificate
  (run; ./safe x509 issue secret/x509/signed --signed-by secret/x509/ca \
                                              --name mail.example.com)     ; exitok $? 0
  now validating our CA-signed certificate
  (run; ./safe x509 validate secret/x509/signed --signed-by secret/x509/ca \
                                                --not-expired \
                                                --not-revoked \
                                                --for mail.example.com)   ; exitok $? 0

  now running safe x509 revoke without a path
  (run; ./safe x509 revoke)                                               ; exitok $? 1
  (run; ./safe x509 revoke --signed-by secret/x509/ca)                    ; exitok $? 1
  now running safe x509 revoke with a bad path
  (run; ./safe x509 revoke --signed-by secret/x509/ca secret/enoent)      ; exitok $? 1
  now running safe x509 revoke with a bad CA
  (run; ./safe x509 revoke --signed-by secret/enoent secret/x509/signed)  ; exitok $? 1

  now running safe x509 crl --renew without a path
  (run; ./safe x509 crl --renew)                                          ; exitok $? 1
  now running safe x509 crl with a CA path but no --renew
  (run; ./safe x509 crl secret/x509/ca)                                   ; exitok $? 1
  now running safe x509 crl --renew against a bad path
  (run; ./safe x509 crl --renew secret/enoent)                            ; exitok $? 1
  now running safe x509 crl --renew without a CA
  (run; ./safe x509 crl --renew secret/x509/signed)                       ; exitok $? 1
  now running safe x509 crl --renew
  (run; ./safe x509 crl --renew secret/x509/ca)                           ; exitok $? 0

  now revoke our signed certificate
  (run; ./safe x509 revoke secret/x509/signed --signed-by secret/x509/ca) ; exitok $? 0
  now validating that our signed certificate is only revoked
  (run; ./safe x509 validate secret/x509/signed --signed-by secret/x509/ca \
                                                --not-expired \
                                                --revoked \
                                                --for mail.example.com)   ; exitok $? 0

  now issuing a certificate with lots of subjectAltNames
  (run; ./safe x509 issue secret/x509/multi --signed-by secret/x509/ca \
                                            --name dns.example.com \
                                            --name *.dns.example.com \
                                            --name 10.255.6.7 \
                                            --name 10.255.6.8 \
                                            --name admin@example.com \
                                            --name safe.vault@example.com) ; exitok $? 0
  now validating our SAN certificate
  (run; ./safe x509 check secret/x509/multi --signed-by secret/x509/ca \
                                            --not-expired \
                                            --not-revoked \
                                            --for dns.example.com \
                                            --for 10.255.6.7 \
                                            --for 10.255.6.8 \
                                            --for admin@example.com \
                                            --for safe.vault@example.com) ; exitok $? 0
  now checking our SAN certificate applicability
  (run; ./safe x509 check secret/x509/multi --for whatever.dns.example.com \
                                            --for anything.dns.example.com \
                                            --for x.dns.example.com)     ; exitok $? 0
  (run; ./safe x509 check secret/x509/multi --for x.y.dns.example.com)   ; exitok $? 1
  (run; ./safe x509 check secret/x509/multi --for x.com)                 ; exitok $? 1

  now issuing a wildcard SAN certificate
  (run; ./safe x509 issue secret/x509/wild --signed-by secret/x509/ca \
                                            --name cn.tld \
                                            --name '*.tld' \
                                            --name '*.*.tld' \
                                            --name '*.*.*.tld')           ; exitok $? 0
  now validating our wildcard SAN certificate applicability
  (run; ./safe x509 check secret/x509/wild --signed-by secret/x509/ca \
                                            --for cn.tld \
                                            --for x.tld \
                                            --for x.y.tld \
                                            --for x.y.z.tld)              ; exitok $? 0
  (run; ./safe x509 check secret/x509/wild --signed-by secret/x509/ca \
                                            --for tld)                    ; exitok $? 1
  (run; ./safe x509 check secret/x509/wild --signed-by secret/x509/ca \
                                            --for w.x.y.z.tld)            ; exitok $? 1

  now issuing a weak 1024-bit certificate
  (run; ./safe x509 issue secret/x509/weak --bits 1024 -n weak.tld)      ; exitok $? 0
  now checking that our 1024-bit certificate is actually 1024-bits
  (run; ./safe x509 check secret/x509/weak --bits 1024)                  ; exitok $? 0
  (run; ./safe x509 check secret/x509/weak --bits 2048)                  ; exitok $? 1
  (run; ./safe x509 check secret/x509/weak --bits 4096)                  ; exitok $? 1
  (run; ./safe x509 check secret/x509/weak --bits 1024 \
                                            --bits 2048 \
                                            --bits 4096)                  ; exitok $? 0

  now issuing a moderately strong 2048-bit certificate
  (run; ./safe x509 issue secret/x509/meh --bits 2048 -n meh.tld)        ; exitok $? 0
  now checking that our 2048-bit certificate is actually 2048-bits
  (run; ./safe x509 check secret/x509/meh --bits 1024)                   ; exitok $? 1
  (run; ./safe x509 check secret/x509/meh --bits 2048)                   ; exitok $? 0
  (run; ./safe x509 check secret/x509/meh --bits 4096)                   ; exitok $? 1
  (run; ./safe x509 check secret/x509/meh --bits 1024 \
                                          --bits 2048 \
                                          --bits 4096)                   ; exitok $? 0

  now issuing a strong 4096-bit certificate
  (run; ./safe x509 issue secret/x509/strong --bits 4096 -n strong.tld)  ; exitok $? 0
  now checking that our 4096-bit certificate is actually 4096-bits
  (run; ./safe x509 check secret/x509/strong --bits 1024)                ; exitok $? 1
  (run; ./safe x509 check secret/x509/strong --bits 2048)                ; exitok $? 1
  (run; ./safe x509 check secret/x509/strong --bits 4096)                ; exitok $? 0
  (run; ./safe x509 check secret/x509/strong --bits 1024 \
                                              --bits 2048 \
                                              --bits 4096)                ; exitok $? 0

  now issuing a certificate with an invalid strength
  (run; ./safe x509 issue secret/x509/bad --bits 1000000000 -n one.mil)  ; exitok $? 1

  now checking the validity of multiple certificates
  (run; ./safe x509 check secret/x509/{weak,meh,strong})                 ; exitok $? 0
  (run; ./safe x509 check secret/x509/{weak,ENOENT,strong})              ; exitok $? 1

  now issuing a CA certificate
  (run; ./safe x509 issue secret/x509/imposter --name x.y.z --ca)        ; exitok $? 0
  now checking that we got a CA certificate
  (run; ./safe x509 check secret/x509/imposter --ca)                     ; exitok $? 0
  now overwrite our CA certificate with a non-CA certificate
  (run; ./safe x509 issue secret/x509/imposter --name a.b.c)             ; exitok $? 0
  now checking that we no longer have a CA certificate
  (run; ./safe x509 check secret/x509/imposter --ca)                     ; exitok $? 1
fi

done_testing=1