(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'key revocation lists'>)}
          spids: [7]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:ECDSA)
          op: assign_op.Equal
          rhs: {<ecdsa>}
          spids: [16]
        )
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$TEST_SSH_ECC'))} 
                  {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <xyes>)}
                )
              terminator: <Id.Op_Semi _>
            )
          ]
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:ECDSA)
                  op: assign_op.Equal
                  rhs: {<rsa>}
                  spids: [39]
                )
              ]
            )
          ]
          spids: [19 36]
        )
      ]
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') </revoked-> <Id.Lit_Star '*'>} 
      {($ Id.VSub_DollarName '$OBJ') </krl-> <Id.Lit_Star '*'>}
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [
            {($ Id.VSub_DollarName '$SSHKEYGEN')}
            {<-t>}
            {($ Id.VSub_DollarName '$ECDSA')}
            {<-f>}
            {($ Id.VSub_DollarName '$OBJ') </revoked-ca>}
            {<-C>}
            {(DQ )}
            {<-N>}
            {(DQ )}
          ]
          redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
        )
        (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' CA failed'>)})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [
            {($ Id.VSub_DollarName '$SSHKEYGEN')}
            {<-t>}
            {<ed25519>}
            {<-f>}
            {($ Id.VSub_DollarName '$OBJ') </revoked-ca2>}
            {<-C>}
            {(DQ )}
            {<-N>}
            {(DQ )}
          ]
          redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
        )
        (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' CA2 failed'>)})
      ]
    )
    (command.Simple
      words: [{<cat>}]
      redirects: [
        (redir.HereDoc
          op: <Id.Redir_DLess '<<'>
          fd: -1
          here_begin: {<EOF>}
          here_end_span_id: 178
          stdin_parts: [
            <'serial: 1-4\n'>
            <'serial: 10\n'>
            <'serial: 15\n'>
            <'serial: 30\n'>
            <'serial: 50\n'>
            <'serial: 999\n'>
            <'# The following sum to 500-799\n'>
            <'serial: 500\n'>
            <'serial: 501\n'>
            <'serial: 502\n'>
            <'serial: 503-600\n'>
            <'serial: 700-797\n'>
            <'serial: 798\n'>
            <'serial: 799\n'>
            <'serial: 599-701\n'>
            <'# Some multiple consecutive serial number ranges\n'>
            <'serial: 10000-20000\n'>
            <'serial: 30000-40000\n'>
          ]
        )
        (redir.Redir
          op: <Id.Redir_DGreat '>>'>
          fd: -1
          arg_word: {($ Id.VSub_DollarName '$OBJ') </revoked-serials>}
        )
      ]
    )
    (C {<touch>} {($ Id.VSub_DollarName '$OBJ') </revoked-keyid>})
    (command.ForEach
      iter_name: n
      iter_words: [
        {<1>}
        {<2>}
        {<3>}
        {<4>}
        {<10>}
        {<15>}
        {<30>}
        {<50>}
        {
          (command_sub
            left_token: <Id.Left_Backtick '`'>
            command_list: (command.CommandList children:[(C {<jot>} {<500>} {<300>})])
          )
        }
        {<999>}
        {<1000>}
        {<1001>}
        {<1002>}
      ]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$n'))} {<Id.Lit_Equals '='>} {(DQ <x499>)})
                (command.ControlFlow token:<Id.ControlFlow_Continue continue>)
              ]
            )
            (command.Simple
              words: [{<echo>} {(DQ <'id: revoked '> ($ Id.VSub_DollarName '$n'))}]
              redirects: [
                (redir.Redir
                  op: <Id.Redir_DGreat '>>'>
                  fd: -1
                  arg_word: {($ Id.VSub_DollarName '$OBJ') </revoked-keyid>}
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: keygen
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:N)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [276]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:f)
                  op: assign_op.Equal
                  rhs: 
                    {($ Id.VSub_DollarName '$OBJ') </revoked-> 
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        command_list: 
                          (command.CommandList
                            children: [(C {<printf>} {(DQ <'%04d'>)} {($ Id.VSub_DollarName '$N')})]
                          )
                      )
                    }
                  spids: [280]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:keytype)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_DollarName '$ECDSA')}
                  spids: [300]
                )
              ]
            )
            (command.Case
              to_match: {($ Id.VSub_DollarName '$N')}
              arms: [
                (case_arm
                  pat_list: [{<2>} {<10>} {<510>} {<1001>}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:keytype)
                          op: assign_op.Equal
                          rhs: {<rsa>}
                          spids: [326]
                        )
                      ]
                    )
                  ]
                  spids: [311 324 328 -1]
                )
                (case_arm
                  pat_list: [{<4>} {<30>} {<520>} {<1002>}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:keytype)
                          op: assign_op.Equal
                          rhs: {<ed25519>}
                          spids: [346]
                        )
                      ]
                    )
                  ]
                  spids: [331 344 348 -1]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {<-t>}
                    {($ Id.VSub_DollarName '$keytype')}
                    {<-f>}
                    {($ Id.VSub_DollarName '$f')}
                    {<-C>}
                    {(DQ )}
                    {<-N>}
                    {(DQ )}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-ca>}
                    {<-z>}
                    {($ Id.VSub_DollarName '$n')}
                    {<-I>}
                    {(DQ <'revoked '> ($ Id.VSub_DollarName '$N'))}
                    {($ Id.VSub_DollarName '$f')}
                  ]
                  redirects: [
                    (redir.Redir
                      op: <Id.Redir_Great '>'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                    (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>})
                  ]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' sign failed'>)})
              ]
            )
            (C {<echo>} {($ Id.VSub_DollarName '$f')})
          ]
        )
    )
    (C {<verbose>} {(DQ ($ Id.VSub_DollarName '$tid') <': generating test keys'>)})
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:REVOKED_SERIALS)
          op: assign_op.Equal
          rhs: {(DQ <'1 4 10 50 500 510 520 799 999'>)}
          spids: [449]
        )
      ]
    )
    (command.ForEach
      iter_name: n
      iter_words: [{($ Id.VSub_DollarName '$REVOKED_SERIALS')}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:f)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        command_list: 
                          (command.CommandList
                            children: [(C {<keygen>} {($ Id.VSub_DollarName '$n')})]
                          )
                      )
                    }
                  spids: [467]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:RKEYS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$RKEYS') <' '> (${ Id.VSub_Name f) <.pub>)}
                  spids: [477]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:RCERTS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$RCERTS') <' '> (${ Id.VSub_Name f) <-cert.pub>)}
                  spids: [488]
                )
              ]
            )
          ]
        )
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:UNREVOKED_SERIALS)
          op: assign_op.Equal
          rhs: {(DQ <'5 9 14 16 29 49 51 499 800 1010 1011'>)}
          spids: [500]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:UNREVOKED)
          op: assign_op.Equal
          rhs: {(DQ )}
          spids: [505]
        )
      ]
    )
    (command.ForEach
      iter_name: n
      iter_words: [{($ Id.VSub_DollarName '$UNREVOKED_SERIALS')}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:f)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        command_list: 
                          (command.CommandList
                            children: [(C {<keygen>} {($ Id.VSub_DollarName '$n')})]
                          )
                      )
                    }
                  spids: [522]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:UKEYS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$UKEYS') <' '> (${ Id.VSub_Name f) <.pub>)}
                  spids: [532]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:UCERTS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$UCERTS') <' '> (${ Id.VSub_Name f) <-cert.pub>)}
                  spids: [543]
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: genkrls
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:OPTS)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [563]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-empty>}
                    {<->}
                  ]
                  redirects: [
                    (redir.Redir
                      op: <Id.Redir_Less '<'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                    (redir.Redir
                      op: <Id.Redir_Great '>'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                  ]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-keys>}
                    {($ Id.VSub_DollarName '$RKEYS')}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-cert>}
                    {($ Id.VSub_DollarName '$RCERTS')}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-all>}
                    {($ Id.VSub_DollarName '$RKEYS')}
                    {($ Id.VSub_DollarName '$RCERTS')}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-ca>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-ca.pub>}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-serial>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-serials>}
                  ]
                  redirects: [
                    (redir.Redir
                      op: <Id.Redir_Great '>'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                    (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>})
                  ]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL succeeded unexpectedly'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-keyid>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-keyid>}
                  ]
                  redirects: [
                    (redir.Redir
                      op: <Id.Redir_Great '>'>
                      fd: -1
                      arg_word: {</dev/null>}
                    )
                    (redir.Redir op:<Id.Redir_GreatAnd '2>&'> fd:2 arg_word:{<1>})
                  ]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL succeeded unexpectedly'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-serial>}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-ca>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-serials>}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-keyid>}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-ca.pub>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-keyid>}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-serial-wild>}
                    {<-s>}
                    {<NONE>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-serials>}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-keyid-wild>}
                    {<-s>}
                    {<NONE>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-keyid>}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') </krl-serial>}
                    {<-u>}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-ca2>}
                    {($ Id.VSub_DollarName '$OBJ') </revoked-serials>}
                  ]
                  redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
          ]
        )
    )
    (C {<verbose>} {(DQ ($ Id.VSub_DollarName '$tid') <': generating KRLs'>)})
    (C {<genkrls>})
    (command.ShFunction
      name: check_krl
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEY)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [952]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KRL)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [956]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:EXPECT_REVOKED)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [960]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:TAG)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [964]
                )
              ]
            )
            (command.Simple
              words: [
                {($ Id.VSub_DollarName '$SSHKEYGEN')}
                {<-Qf>}
                {($ Id.VSub_DollarName '$KRL')}
                {($ Id.VSub_DollarName '$KEY')}
              ]
              redirects: [(redir.Redir op:<Id.Redir_Great '>'> fd:-1 arg_word:{</dev/null>})]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:result)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_QMark '$?')}
                  spids: [980]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$EXPECT_REVOKED'))} 
                          {<Id.Lit_Equals '='>} {(DQ <xyes>)} {<-a>} {($ Id.VSub_DollarName '$result')} {<-eq>} {<0>}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'key '> ($ Id.VSub_DollarName '$KEY') <' not revoked by KRL '> 
                          ($ Id.VSub_DollarName '$KRL') <': '> ($ Id.VSub_DollarName '$TAG')
                        )
                      }
                    )
                  ]
                  spids: [984 1009]
                )
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$EXPECT_REVOKED'))} 
                          {<Id.Lit_Equals '='>} {(DQ <xno>)} {<-a>} {($ Id.VSub_DollarName '$result')} {<-ne>} {<0>}
                        )
                      terminator: <Id.Op_Semi _>
                    )
                  ]
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'key '> ($ Id.VSub_DollarName '$KEY') <' unexpectedly revoked by KRL '> 
                          ($ Id.VSub_DollarName '$KRL') <': '> ($ Id.VSub_DollarName '$TAG')
                        )
                      }
                    )
                  ]
                  spids: [1024 1049]
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: test_rev
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:FILES)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [1075]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:TAG)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [1079]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEYS_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [1083]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:ALL_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [1087]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:SERIAL_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$5')}
                  spids: [1091]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEYID_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$6')}
                  spids: [1095]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:CERTS_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$7')}
                  spids: [1099]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:CA_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$8')}
                  spids: [1103]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:SERIAL_WRESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$9')}
                  spids: [1107]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEYID_WRESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1') <0>}
                  spids: [1111]
                )
              ]
            )
            (C {<verbose>} 
              {
                (DQ ($ Id.VSub_DollarName '$tid') <': checking revocations for '> 
                  ($ Id.VSub_DollarName '$TAG')
                )
              }
            )
            (command.ForEach
              iter_name: f
              iter_words: [{($ Id.VSub_DollarName '$FILES')}]
              do_arg_iter: F
              body: 
                (command.DoGroup
                  children: [
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-empty>} {<no>} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-keys>} {($ Id.VSub_DollarName '$KEYS_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-all>} {($ Id.VSub_DollarName '$ALL_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-serial>} {($ Id.VSub_DollarName '$SERIAL_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-keyid>} {($ Id.VSub_DollarName '$KEYID_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-cert>} {($ Id.VSub_DollarName '$CERTS_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-ca>} {($ Id.VSub_DollarName '$CA_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-serial-wild>} {($ Id.VSub_DollarName '$SERIAL_WRESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') </krl-keyid-wild>} {($ Id.VSub_DollarName '$KEYID_WRESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                  ]
                )
            )
          ]
        )
    )
    (command.ShFunction
      name: test_all
      body: 
        (command.BraceGroup
          children: [
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$RKEYS'))} {(DQ <'revoked keys'>)} {<yes>} {<yes>} 
              {<no>} {<no>} {<no>} {<no>} {<no>} {<no>}
            )
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$UKEYS'))} {(DQ <'unrevoked keys'>)} {<no>} {<no>} 
              {<no>} {<no>} {<no>} {<no>} {<no>} {<no>}
            )
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$RCERTS'))} {(DQ <'revoked certs'>)} {<yes>} 
              {<yes>} {<yes>} {<yes>} {<yes>} {<yes>} {<yes>} {<yes>}
            )
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$UCERTS'))} {(DQ <'unrevoked certs'>)} {<no>} 
              {<no>} {<no>} {<no>} {<no>} {<yes>} {<no>} {<no>}
            )
          ]
        )
    )
    (C {<test_all>})
    (C {<verbose>} {(DQ ($ Id.VSub_DollarName '$tid') <': testing KRL update'>)})
    (command.ForEach
      iter_name: f
      iter_words: [
        {($ Id.VSub_DollarName '$OBJ') </krl-keys>}
        {($ Id.VSub_DollarName '$OBJ') </krl-cert>}
        {($ Id.VSub_DollarName '$OBJ') </krl-all>}
        {($ Id.VSub_DollarName '$OBJ') </krl-ca>}
        {($ Id.VSub_DollarName '$OBJ') </krl-serial>}
        {($ Id.VSub_DollarName '$OBJ') </krl-keyid>}
        {($ Id.VSub_DollarName '$OBJ') </krl-serial-wild>}
        {($ Id.VSub_DollarName '$OBJ') </krl-keyid-wild>}
      ]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<cp>} {<-f>} {($ Id.VSub_DollarName '$OBJ') </krl-empty>} {($ Id.VSub_DollarName '$f')})
            (C {<genkrls>} {<-u>})
          ]
        )
    )
    (C {<test_all>})
  ]
)