(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'key revocation lists'>)}
          spids: [7]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:ECDSA)
          op: assign_op.Equal
          rhs: {<ecdsa>}
          spids: [16]
        )
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: 
            (condition.Shell
              commands: [
                (command.Sentence
                  child: 
                    (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$TEST_SSH_ECC'))} 
                      {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <xyes>)}
                    )
                  terminator: <Id.Op_Semi _>
                )
              ]
            )
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:ECDSA)
                  op: assign_op.Equal
                  rhs: {<rsa>}
                  spids: [39]
                )
              ]
            )
          ]
          spids: [19 36]
        )
      ]
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/revoked-'> <Id.Lit_Star '*'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/krl-'> <Id.Lit_Star '*'>}
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [
            {($ Id.VSub_DollarName '$SSHKEYGEN')}
            {<-t>}
            {($ Id.VSub_DollarName '$ECDSA')}
            {<-f>}
            {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca'>}
            {<-C>}
            {(DQ )}
            {<-N>}
            {(DQ )}
          ]
          redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<'/dev/null'>})]
          do_fork: T
        )
        (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' CA failed'>)})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [
            {($ Id.VSub_DollarName '$SSHKEYGEN')}
            {<-t>}
            {<ed25519>}
            {<-f>}
            {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca2'>}
            {<-C>}
            {(DQ )}
            {<-N>}
            {(DQ )}
          ]
          redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<'/dev/null'>})]
          do_fork: T
        )
        (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' CA2 failed'>)})
      ]
    )
    (command.Simple
      words: [{<cat>}]
      redirects: [
        (redir
          op: <Id.Redir_DLess '<<'>
          loc: (redir_loc.Fd fd:0)
          arg: 
            (redir_param.HereDoc
              here_begin: {<EOF>}
              here_end_span_id: 178
              stdin_parts: [
                <'serial: 1-4\n'>
                <'serial: 10\n'>
                <'serial: 15\n'>
                <'serial: 30\n'>
                <'serial: 50\n'>
                <'serial: 999\n'>
                <'# The following sum to 500-799\n'>
                <'serial: 500\n'>
                <'serial: 501\n'>
                <'serial: 502\n'>
                <'serial: 503-600\n'>
                <'serial: 700-797\n'>
                <'serial: 798\n'>
                <'serial: 799\n'>
                <'serial: 599-701\n'>
                <'# Some multiple consecutive serial number ranges\n'>
                <'serial: 10000-20000\n'>
                <'serial: 30000-40000\n'>
              ]
            )
        )
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/revoked-serials'>}
        )
      ]
      do_fork: T
    )
    (C {<touch>} {($ Id.VSub_DollarName '$OBJ') <'/revoked-keyid'>})
    (command.ForEach
      iter_name: n
      iter_words: [
        {<1>}
        {<2>}
        {<3>}
        {<4>}
        {<10>}
        {<15>}
        {<30>}
        {<50>}
        {(command_sub left_token:<Id.Left_Backtick '`'> child:(C {<jot>} {<500>} {<300>}))}
        {<999>}
        {<1000>}
        {<1001>}
        {<1002>}
      ]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$n'))} {<Id.Lit_Equals '='>} {(DQ <x499>)})
                (command.ControlFlow token:<Id.ControlFlow_Continue continue>)
              ]
            )
            (command.Simple
              words: [{<echo>} {(DQ <'id: revoked '> ($ Id.VSub_DollarName '$n'))}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/revoked-keyid'>}
                )
              ]
              do_fork: T
            )
          ]
        )
    )
    (command.ShFunction
      name: keygen
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:N)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [276]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:f)
                  op: assign_op.Equal
                  rhs: 
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-'> 
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        child: (C {<printf>} {(DQ <'%04d'>)} {($ Id.VSub_DollarName '$N')})
                      )
                    }
                  spids: [280]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:keytype)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_DollarName '$ECDSA')}
                  spids: [300]
                )
              ]
            )
            (command.Case
              to_match: {($ Id.VSub_DollarName '$N')}
              arms: [
                (case_arm
                  pat_list: [{<2>} {<10>} {<510>} {<1001>}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:keytype)
                          op: assign_op.Equal
                          rhs: {<rsa>}
                          spids: [326]
                        )
                      ]
                    )
                  ]
                  spids: [311 324 328 -1]
                )
                (case_arm
                  pat_list: [{<4>} {<30>} {<520>} {<1002>}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:keytype)
                          op: assign_op.Equal
                          rhs: {<ed25519>}
                          spids: [346]
                        )
                      ]
                    )
                  ]
                  spids: [331 344 348 -1]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {<-t>}
                    {($ Id.VSub_DollarName '$keytype')}
                    {<-f>}
                    {($ Id.VSub_DollarName '$f')}
                    {<-C>}
                    {(DQ )}
                    {<-N>}
                    {(DQ )}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca'>}
                    {<-z>}
                    {($ Id.VSub_DollarName '$n')}
                    {<-I>}
                    {(DQ <'revoked '> ($ Id.VSub_DollarName '$N'))}
                    {($ Id.VSub_DollarName '$f')}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' sign failed'>)})
              ]
            )
            (C {<echo>} {($ Id.VSub_DollarName '$f')})
          ]
        )
    )
    (C {<verbose>} {(DQ ($ Id.VSub_DollarName '$tid') <': generating test keys'>)})
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:REVOKED_SERIALS)
          op: assign_op.Equal
          rhs: {(DQ <'1 4 10 50 500 510 520 799 999'>)}
          spids: [449]
        )
      ]
    )
    (command.ForEach
      iter_name: n
      iter_words: [{($ Id.VSub_DollarName '$REVOKED_SERIALS')}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:f)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        child: (C {<keygen>} {($ Id.VSub_DollarName '$n')})
                      )
                    }
                  spids: [467]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:RKEYS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$RKEYS') <' '> (${ Id.VSub_Name f) <.pub>)}
                  spids: [477]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:RCERTS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$RCERTS') <' '> (${ Id.VSub_Name f) <-cert.pub>)}
                  spids: [488]
                )
              ]
            )
          ]
        )
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:UNREVOKED_SERIALS)
          op: assign_op.Equal
          rhs: {(DQ <'5 9 14 16 29 49 51 499 800 1010 1011'>)}
          spids: [500]
        )
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:UNREVOKED)
          op: assign_op.Equal
          rhs: {(DQ )}
          spids: [505]
        )
      ]
    )
    (command.ForEach
      iter_name: n
      iter_words: [{($ Id.VSub_DollarName '$UNREVOKED_SERIALS')}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:f)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: <Id.Left_Backtick '`'>
                        child: (C {<keygen>} {($ Id.VSub_DollarName '$n')})
                      )
                    }
                  spids: [522]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:UKEYS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$UKEYS') <' '> (${ Id.VSub_Name f) <.pub>)}
                  spids: [532]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:UCERTS)
                  op: assign_op.Equal
                  rhs: {(DQ ($ Id.VSub_DollarName '$UCERTS') <' '> (${ Id.VSub_Name f) <-cert.pub>)}
                  spids: [543]
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: genkrls
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:OPTS)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [563]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-empty'>}
                    {<->}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Less '<'>
                      loc: (redir_loc.Fd fd:0)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-keys'>}
                    {($ Id.VSub_DollarName '$RKEYS')}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-cert'>}
                    {($ Id.VSub_DollarName '$RCERTS')}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-all'>}
                    {($ Id.VSub_DollarName '$RKEYS')}
                    {($ Id.VSub_DollarName '$RCERTS')}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-ca'>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca.pub'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-serial'>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-serials'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL succeeded unexpectedly'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid'>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-keyid'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                    (redir
                      op: <Id.Redir_GreatAnd '2>&'>
                      loc: (redir_loc.Fd fd:2)
                      arg: {<1>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL succeeded unexpectedly'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-serial'>}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca'>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-serials'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid'>}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca.pub'>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-keyid'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-serial-wild'>}
                    {<-s>}
                    {<NONE>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-serials'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid-wild'>}
                    {<-s>}
                    {<NONE>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-keyid'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {($ Id.VSub_DollarName '$SSHKEYGEN')}
                    {($ Id.VSub_DollarName '$OPTS')}
                    {<-kf>}
                    {($ Id.VSub_DollarName '$OBJ') <'/krl-serial'>}
                    {<-u>}
                    {<-s>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-ca2'>}
                    {($ Id.VSub_DollarName '$OBJ') <'/revoked-serials'>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {<'/dev/null'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ ($ Id.VSub_DollarName '$SSHKEYGEN') <' KRL failed'>)})
              ]
            )
          ]
        )
    )
    (C {<verbose>} {(DQ ($ Id.VSub_DollarName '$tid') <': generating KRLs'>)})
    (C {<genkrls>})
    (command.ShFunction
      name: check_krl
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEY)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [952]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KRL)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [956]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:EXPECT_REVOKED)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [960]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:TAG)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [964]
                )
              ]
            )
            (command.Simple
              words: [
                {($ Id.VSub_DollarName '$SSHKEYGEN')}
                {<-Qf>}
                {($ Id.VSub_DollarName '$KRL')}
                {($ Id.VSub_DollarName '$KEY')}
              ]
              redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<'/dev/null'>})]
              do_fork: T
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:result)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_QMark '$?')}
                  spids: [980]
                )
              ]
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$EXPECT_REVOKED'))} 
                              {<Id.Lit_Equals '='>} {(DQ <xyes>)} {<-a>} {($ Id.VSub_DollarName '$result')} {<-eq>} {<0>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'key '> ($ Id.VSub_DollarName '$KEY') <' not revoked by KRL '> 
                          ($ Id.VSub_DollarName '$KRL') <': '> ($ Id.VSub_DollarName '$TAG')
                        )
                      }
                    )
                  ]
                  spids: [984 1009]
                )
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$EXPECT_REVOKED'))} 
                              {<Id.Lit_Equals '='>} {(DQ <xno>)} {<-a>} {($ Id.VSub_DollarName '$result')} {<-ne>} {<0>}
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [
                    (C {<fatal>} 
                      {
                        (DQ <'key '> ($ Id.VSub_DollarName '$KEY') <' unexpectedly revoked by KRL '> 
                          ($ Id.VSub_DollarName '$KRL') <': '> ($ Id.VSub_DollarName '$TAG')
                        )
                      }
                    )
                  ]
                  spids: [1024 1049]
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: test_rev
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:FILES)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [1075]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:TAG)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [1079]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEYS_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [1083]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:ALL_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [1087]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:SERIAL_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$5')}
                  spids: [1091]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEYID_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$6')}
                  spids: [1095]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:CERTS_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$7')}
                  spids: [1099]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:CA_RESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$8')}
                  spids: [1103]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:SERIAL_WRESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$9')}
                  spids: [1107]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:KEYID_WRESULT)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1') <0>}
                  spids: [1111]
                )
              ]
            )
            (C {<verbose>} 
              {
                (DQ ($ Id.VSub_DollarName '$tid') <': checking revocations for '> 
                  ($ Id.VSub_DollarName '$TAG')
                )
              }
            )
            (command.ForEach
              iter_name: f
              iter_words: [{($ Id.VSub_DollarName '$FILES')}]
              do_arg_iter: F
              body: 
                (command.DoGroup
                  children: [
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-empty'>} {<no>} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-keys'>} {($ Id.VSub_DollarName '$KEYS_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-all'>} {($ Id.VSub_DollarName '$ALL_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-serial'>} {($ Id.VSub_DollarName '$SERIAL_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid'>} {($ Id.VSub_DollarName '$KEYID_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-cert'>} {($ Id.VSub_DollarName '$CERTS_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-ca'>} {($ Id.VSub_DollarName '$CA_RESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-serial-wild'>} {($ Id.VSub_DollarName '$SERIAL_WRESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                    (C {<check_krl>} {($ Id.VSub_DollarName '$f')} 
                      {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid-wild'>} {($ Id.VSub_DollarName '$KEYID_WRESULT')} {(DQ ($ Id.VSub_DollarName '$TAG'))}
                    )
                  ]
                )
            )
          ]
        )
    )
    (command.ShFunction
      name: test_all
      body: 
        (BraceGroup
          children: [
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$RKEYS'))} {(DQ <'revoked keys'>)} {<yes>} {<yes>} 
              {<no>} {<no>} {<no>} {<no>} {<no>} {<no>}
            )
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$UKEYS'))} {(DQ <'unrevoked keys'>)} {<no>} {<no>} 
              {<no>} {<no>} {<no>} {<no>} {<no>} {<no>}
            )
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$RCERTS'))} {(DQ <'revoked certs'>)} {<yes>} 
              {<yes>} {<yes>} {<yes>} {<yes>} {<yes>} {<yes>} {<yes>}
            )
            (C {<test_rev>} {(DQ ($ Id.VSub_DollarName '$UCERTS'))} {(DQ <'unrevoked certs'>)} {<no>} 
              {<no>} {<no>} {<no>} {<no>} {<yes>} {<no>} {<no>}
            )
          ]
        )
    )
    (C {<test_all>})
    (C {<verbose>} {(DQ ($ Id.VSub_DollarName '$tid') <': testing KRL update'>)})
    (command.ForEach
      iter_name: f
      iter_words: [
        {($ Id.VSub_DollarName '$OBJ') <'/krl-keys'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-cert'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-all'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-ca'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-serial'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-serial-wild'>}
        {($ Id.VSub_DollarName '$OBJ') <'/krl-keyid-wild'>}
      ]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<cp>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/krl-empty'>} {($ Id.VSub_DollarName '$f')})
            (C {<genkrls>} {<-u>})
          ]
        )
    )
    (C {<test_all>})
  ]
)