diff --git a/cts/cts-cli.in b/cts/cts-cli.in
index fdad002c6a..72e24355bd 100755
--- a/cts/cts-cli.in
+++ b/cts/cts-cli.in
@@ -1,3414 +1,3419 @@
 #!@BASH_PATH@
 #
 # Copyright 2008-2022 the Pacemaker project contributors
 #
 # The version control history for this file may have further details.
 #
 # This source code is licensed under the GNU General Public License version 2
 # or later (GPLv2+) WITHOUT ANY WARRANTY.
 #
 
 # Set the exit status of a command to the exit code of the last program to
 # exit non-zero.  This is bash-specific.
 set -o pipefail
 
 #
 # Note on portable usage of sed: GNU/POSIX/*BSD sed have a limited subset of
 # compatible functionality. Do not use the -i option, alternation (\|),
 # \0, or character sequences such as \n or \s.
 #
 
 USAGE_TEXT="Usage: cts-cli [<options>]
 Options:
  --help          Display this text, then exit
  -V, --verbose   Display any differences from expected output
  -t 'TEST [...]' Run only specified tests
                  (default: 'daemons dates error_codes tools crm_mon acls
                             validity upgrade rules feature_set').
                  Other tests: agents (must be run in an installed environment).
  -p DIR          Look for executables in DIR (may be specified multiple times)
  -v, --valgrind  Run all commands under valgrind
  -s              Save actual output as expected output"
 
 # If readlink supports -e (i.e. GNU), use it
 readlink -e / >/dev/null 2>/dev/null
 if [ $? -eq 0 ]; then
     test_home="$(dirname "$(readlink -e "$0")")"
 else
     test_home="$(dirname "$0")"
 fi
 
 : ${shadow=cts-cli}
 shadow_dir=$(mktemp -d ${TMPDIR:-/tmp}/cts-cli.shadow.XXXXXXXXXX)
 num_errors=0
 num_passed=0
 verbose=0
 tests="daemons dates error_codes tools crm_mon acls validity upgrade rules "
 tests="$tests feature_set"
 do_save=0
 XMLLINT_CMD=
 VALGRIND_CMD=
 VALGRIND_OPTS="
     -q
     --gen-suppressions=all
     --show-reachable=no
     --leak-check=full
     --trace-children=no
     --time-stamp=yes
     --num-callers=20
     --suppressions=$test_home/valgrind-pcmk.suppressions
 "
 
 # Temp files for saving a command's stdout/stderr in _test_assert()
 test_assert_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_outfile.XXXXXXXXXX)
 test_assert_errfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_errfile.XXXXXXXXXX)
 xmllint_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.xmllint_outfile.XXXXXXXXXX)
 
 # Log test errors to stderr
 export PCMK_stderr=1
 
 # Output when PCMK_trace_functions is undefined is different from when it's
 # empty. Later we save the value of PCMK_trace_functions, do work, and restore
 # the original value. Getting back to the initial state is simplest if we assume
 # the variable is defined.
 : ${PCMK_trace_functions=""}
 export PCMK_trace_functions
 
 # These constants must track crm_exit_t values
 CRM_EX_OK=0
 CRM_EX_ERROR=1
 CRM_EX_INVALID_PARAM=2
 CRM_EX_UNIMPLEMENT_FEATURE=3
 CRM_EX_INSUFFICIENT_PRIV=4
 CRM_EX_NOT_CONFIGURED=6
 CRM_EX_USAGE=64
 CRM_EX_DATAERR=65
 CRM_EX_CANTCREAT=73
 CRM_EX_CONFIG=78
 CRM_EX_OLD=103
 CRM_EX_DIGEST=104
 CRM_EX_NOSUCH=105
 CRM_EX_UNSAFE=107
 CRM_EX_EXISTS=108
 CRM_EX_MULTIPLE=109
 CRM_EX_EXPIRED=110
 CRM_EX_NOT_YET_IN_EFFECT=111
 
 reset_shadow_cib_version() {
     local SHADOWPATH
 
     SHADOWPATH="$(crm_shadow --file)"
     # sed -i isn't portable :-(
     cp -p "$SHADOWPATH" "${SHADOWPATH}.$$" # preserve permissions
     sed -e 's/epoch="[0-9]*"/epoch="1"/g' \
         -e 's/num_updates="[0-9]*"/num_updates="0"/g' \
         -e 's/admin_epoch="[0-9]*"/admin_epoch="0"/g' \
         "$SHADOWPATH" > "${SHADOWPATH}.$$"
     mv -- "${SHADOWPATH}.$$" "$SHADOWPATH"
 }
 
 # A newly created empty CIB might or might not have a rsc_defaults section
 # depending on whether the --with-resource-stickiness-default configure
 # option was used. To ensure regression tests behave the same either way,
 # delete any rsc_defaults after creating or erasing a CIB.
 delete_shadow_resource_defaults() {
     cibadmin --delete --xml-text '<rsc_defaults/>'
 
     # The above command might or might not bump the CIB version, so reset it
     # to ensure future changes result in the same version for comparison.
     reset_shadow_cib_version
 }
 
 create_shadow_cib() {
     local VALIDATE_WITH
     local SHADOW_CMD
 
     CREATE_ARG="$1"
     VALIDATE_WITH="$2"
 
     export CIB_shadow_dir="${shadow_dir}"
 
     SHADOW_CMD="$VALGRIND_CMD crm_shadow --batch --force $CREATE_ARG"
     if [ -z "$VALIDATE_WITH" ]; then
         $SHADOW_CMD "$shadow" 2>&1
     else
         $SHADOW_CMD "$shadow" --validate-with="${VALIDATE_WITH}" 2>&1
     fi
 
     export CIB_shadow="$shadow"
     delete_shadow_resource_defaults
 }
 
 function _test_assert() {
     target=$1; shift
     validate=$1; shift
     cib=$1; shift
     app=`echo "$cmd" | sed 's/\ .*//'`
     printf "* Running: $app - $desc\n" 1>&2
 
     printf "=#=#=#= Begin test: $desc =#=#=#=\n"
 
     # Capture stderr and stdout separately, then print them consecutively
     eval $VALGRIND_CMD $cmd > "$test_assert_outfile" 2> "$test_assert_errfile"
     rc=$?
     cat "$test_assert_errfile"
     cat "$test_assert_outfile"
 
     if [ x$cib != x0 ]; then
         printf "=#=#=#= Current cib after: $desc =#=#=#=\n"
         CIB_user=root cibadmin -Q
     fi
 
     # Do not validate if running under valgrind, even if told to do so.  Valgrind
     # will output a lot more stuff that is not XML, so it wouldn't validate anyway.
     if [ "$validate" = "1" ] && [ "$VALGRIND_CMD" = "" ] && [ $rc = 0 ] && [ "$XMLLINT_CMD" != "" ]; then
         # The sed command filters out the "- validates" line that xmllint will output
         # on success.  grep cannot be used here because "grep -v 'validates$'" will
         # return an exit code of 1 if its input consists entirely of "- validates".
         $XMLLINT_CMD --noout --relaxng \
             "$PCMK_schema_directory/api/api-result.rng" "$test_assert_outfile" \
             > "$xmllint_outfile" 2>&1
         rc=$?
 
         sed -n '/validates$/ !p' "$xmllint_outfile"
 
         if [ $rc = 0 ]; then
             printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
         else
             printf "=#=#=#= End test: %s - Failed to validate (%d) =#=#=#=\n" "$desc" $rc
         fi
     else
         printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
     fi
 
     if [ $rc -ne $target ]; then
         num_errors=$(( $num_errors + 1 ))
         printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc"
         printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc (`which $app`)" 1>&2
         return
         exit $CRM_EX_ERROR
     else
         printf "* Passed: %-14s - %s\n" $app "$desc"
         num_passed=$(( $num_passed + 1 ))
     fi
 }
 
 function test_assert() {
     _test_assert $1 0 $2
 }
 
 function test_assert_validate() {
     _test_assert $1 1 $2
 }
 
 # Tests that depend on resource agents and must be run in an installed
 # environment
 function test_agents() {
     desc="Validate a valid resource configuration"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     test_assert $CRM_EX_OK 0
 
     desc="Validate a valid resource configuration (XML)"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     cmd="$cmd --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Make the Dummy configuration invalid (op_sleep can't be a generic string)
     export OCF_RESKEY_op_sleep=asdf
 
     desc="Validate an invalid resource configuration"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     test_assert $CRM_EX_NOT_CONFIGURED 0
 
     desc="Validate an invalid resource configuration (XML)"
     cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
     cmd="$cmd --output-as=xml"
     test_assert_validate $CRM_EX_NOT_CONFIGURED 0
 
     unset OCF_RESKEY_op_sleep
     export OCF_RESKEY_op_sleep
 }
 
 function test_daemons() {
     desc="Get CIB manager metadata"
     cmd="pacemaker-based metadata"
     test_assert $CRM_EX_OK 0
 
     desc="Get controller metadata"
     cmd="pacemaker-controld metadata"
     test_assert $CRM_EX_OK 0
 
     desc="Get fencer metadata"
     cmd="pacemaker-fenced metadata"
     test_assert $CRM_EX_OK 0
 
     desc="Get scheduler metadata"
     cmd="pacemaker-schedulerd metadata"
     test_assert $CRM_EX_OK 0
 }
 
 function test_crm_mon() {
     local TMPXML
     export CIB_file="$test_home/cli/crm_mon.xml"
 
     desc="Basic text output"
     cmd="crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output"
     cmd="crm_mon --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output without node section"
     cmd="crm_mon -1 --exclude=nodes"
     test_assert $CRM_EX_OK 0
 
     desc="XML output without the node section"
     cmd="crm_mon --output-as=xml --exclude=nodes"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Text output with only the node section"
     cmd="crm_mon -1 --exclude=all --include=nodes"
     test_assert $CRM_EX_OK 0
 
     # The above test doesn't need to be performed for other output formats.  It's
     # really just a test to make sure that blank lines are correct.
 
     desc="Complete text output"
     cmd="crm_mon -1 --include=all"
     test_assert $CRM_EX_OK 0
 
     # XML includes everything already so there's no need for a complete test
 
     desc="Complete text output with detail"
     cmd="crm_mon -1R --include=all"
     test_assert $CRM_EX_OK 0
 
     # XML includes detailed output already
 
     desc="Complete brief text output"
     cmd="crm_mon -1 --include=all --brief"
     test_assert $CRM_EX_OK 0
 
     desc="Complete text output grouped by node"
     cmd="crm_mon -1 --include=all --group-by-node"
     test_assert $CRM_EX_OK 0
 
     # XML does not have a brief output option
 
     desc="Complete brief text output grouped by node"
     cmd="crm_mon -1 --include=all --group-by-node --brief"
     test_assert $CRM_EX_OK 0
 
     desc="XML output grouped by node"
     cmd="crm_mon -1 --output-as=xml --group-by-node"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by node"
     cmd="crm_mon -1 --include=all --node=cluster01"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by node"
     cmd="crm_mon --output-as xml --include=all --node=cluster01"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by tag"
     cmd="crm_mon -1 --include=all --node=even-nodes"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by tag"
     cmd="crm_mon --output-as=xml --include=all --node=even-nodes"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by resource tag"
     cmd="crm_mon -1 --include=all --resource=fencing-rscs"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by resource tag"
     cmd="crm_mon --output-as=xml --include=all --resource=fencing-rscs"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output filtered by node that doesn't exist"
     cmd="crm_mon -1 --node=blah"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by node that doesn't exist"
     cmd="crm_mon --output-as=xml --node=blah"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources"
     cmd="crm_mon -1 -r"
     test_assert $CRM_EX_OK 0
 
     # XML already includes inactive resources
 
     desc="Basic text output with inactive resources, filtered by node"
     cmd="crm_mon -1 -r --node=cluster02"
     test_assert $CRM_EX_OK 0
 
     # XML already includes inactive resources
 
     desc="Complete text output filtered by primitive resource"
     cmd="crm_mon -1 --include=all --resource=Fencing"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by primitive resource"
     cmd="crm_mon --output-as=xml --resource=Fencing"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by group resource"
     cmd="crm_mon -1 --include=all --resource=exim-group"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by group resource"
     cmd="crm_mon --output-as=xml --resource=exim-group"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by group resource member"
     cmd="crm_mon -1 --include=all --resource=Public-IP"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by group resource member"
     cmd="crm_mon --output-as=xml --resource=Email"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by clone resource"
     cmd="crm_mon -1 --include=all --resource=ping-clone"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by clone resource"
     cmd="crm_mon --output-as=xml --resource=ping-clone"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by clone resource instance"
     cmd="crm_mon -1 --include=all --resource=ping"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by clone resource instance"
     cmd="crm_mon --output-as=xml --resource=ping"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output filtered by exact clone resource instance"
     cmd="crm_mon -1 --include=all --show-detail --resource=ping:0"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by exact clone resource instance"
     cmd="crm_mon --output-as=xml --resource=ping:1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output filtered by resource that doesn't exist"
     cmd="crm_mon -1 --resource=blah"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by resource that doesn't exist"
     cmd="crm_mon --output-as=xml --resource=blah"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by tag"
     cmd="crm_mon -1 -r --resource=inactive-rscs"
     test_assert $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundle resource"
     cmd="crm_mon -1 -r --resource=httpd-bundle"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by inactive bundle resource"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundled IP address resource"
     cmd="crm_mon -1 -r --resource=httpd-bundle-ip-192.168.122.131"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundled IP address resource"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle-ip-192.168.122.132"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundled container"
     cmd="crm_mon -1 -r --resource=httpd-bundle-docker-1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundled container"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle-docker-2"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundle connection"
     cmd="crm_mon -1 -r --resource=httpd-bundle-0"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundle connection"
     cmd="crm_mon --output-as=xml --resource=httpd-bundle-0"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Basic text output with inactive resources, filtered by bundled primitive resource"
     cmd="crm_mon -1 -r --resource=httpd"
     test_assert $CRM_EX_OK 0
 
     desc="XML output filtered by bundled primitive resource"
     cmd="crm_mon --output-as=xml --resource=httpd"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by clone name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-clone-group"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by clone name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-clone-group"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by group name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by group name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-group"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by exact group instance name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group:1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by exact group instance name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-group:1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by primitive name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by primitive name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-proxy"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Complete text output, filtered by exact primitive instance name in cloned group"
     cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy:1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, filtered by exact primitive instance name in cloned group"
     cmd="crm_mon --output-as=xml --resource=mysql-proxy:1"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-partial.xml"
 
     desc="Text output of partially active resources"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of partially active resources"
     cmd="crm_mon -1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Text output of partially active resources, with inactive resources"
     cmd="crm_mon -1 -r --show-detail"
     test_assert $CRM_EX_OK 0
 
     # XML already includes inactive resources
 
     desc="Complete brief text output, with inactive resources"
     cmd="crm_mon -1 -r --include=all --brief --show-detail"
     test_assert $CRM_EX_OK 0
 
     # XML does not have a brief output option
 
     desc="Text output of partially active group"
     cmd="crm_mon -1 --resource=partially-active-group"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of partially active group, with inactive resources"
     cmd="crm_mon -1 --resource=partially-active-group -r"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of active member of partially active group"
     cmd="crm_mon -1 --resource=dummy-1"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of inactive member of partially active group"
     cmd="crm_mon -1 --resource=dummy-2 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="Complete brief text output grouped by node, with inactive resources"
     cmd="crm_mon -1 -r --include=all --group-by-node --brief --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of partially active resources, with inactive resources, filtered by node"
     cmd="crm_mon -1 -r --node=cluster01"
     test_assert $CRM_EX_OK 0
 
     desc="Text output of partially active resources, filtered by node"
     cmd="crm_mon -1 --output-as=xml --node=cluster01"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-unmanaged.xml"
 
     desc="Text output of active unmanaged resource on offline node"
     cmd="crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of active unmanaged resource on offline node"
     cmd="crm_mon -1 --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     desc="Brief text output of active unmanaged resource on offline node"
     cmd="crm_mon -1 --brief"
     test_assert $CRM_EX_OK 0
 
     desc="Brief text output of active unmanaged resource on offline node, grouped by node"
     cmd="crm_mon -1 --brief --group-by-node"
     test_assert $CRM_EX_OK 0
 
     # Maintenance mode tests
 
     export CIB_file=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_mon.xml.XXXXXXXXXX)
     cp "$test_home/cli/crm_mon.xml" "$CIB_file"
 
     crm_attribute -n maintenance-mode -v true
 
     desc="Text output of all resources with maintenance-mode enabled"
     cmd="crm_mon -1 -r"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of all resources with maintenance-mode enabled"
     cmd="crm_mon -1 -r --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     crm_attribute -n maintenance-mode -v false
 
     crm_attribute -n maintenance -N cluster02 -v true
 
     desc="Text output of all resources with maintenance enabled for a node"
     cmd="crm_mon -1 -r"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of all resources with maintenance enabled for a node"
     cmd="crm_mon -1 -r --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     rm -f "$CIB_file"
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-rsc-maint.xml"
 
     # The fence resource is excluded, for comparison
     desc="Text output of all resources with maintenance meta attribute true"
     cmd="crm_mon -1 -r"
     test_assert $CRM_EX_OK 0
 
     desc="XML output of all resources with maintenance meta attribute true"
     cmd="crm_mon -1 -r --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon-T180.xml"
 
     desc="Text output of guest node's container on different node from its"
     desc="$desc remote resource"
     cmd="crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="Complete text output of guest node's container on different node from"
     desc="$desc its remote resource"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
 }
 
 function test_error_codes() {
     # Note: At the time of this writing, crm_error returns success even for
     # unknown error codes. We don't want to cause a regression by changing that.
 
     # Due to the way _test_assert() formats output, we need "crm_error" to be
     # the first token of cmd. We can't start with a parenthesis or variable
     # assignment. However, in the "list result codes" tests, we also need to
     # save some output for later processing. We'll use a temp file for this.
     local TMPFILE
     TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_error_out.XXXXXXXXXX)
 
     # Legacy return codes
     #
     # Don't test unknown legacy code. FreeBSD includes a colon in strerror(),
     # while other distros do not.
     desc="Get legacy return code"
     cmd="crm_error -- 201"
     test_assert $CRM_EX_OK 0
 
     desc="Get legacy return code (XML)"
     cmd="crm_error --output-as=xml -- 201"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get legacy return code (with name)"
     cmd="crm_error -n -- 201"
     test_assert $CRM_EX_OK 0
 
     desc="Get legacy return code (with name) (XML)"
     cmd="crm_error -n --output-as=xml -- 201"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes"
     cmd="crm_error -- 201 202"
     test_assert $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes (XML)"
     cmd="crm_error --output-as=xml -- 201 202"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes (with names)"
     cmd="crm_error -n -- 201 202"
     test_assert $CRM_EX_OK 0
 
     desc="Get multiple legacy return codes (with names) (XML)"
     cmd="crm_error -n --output-as=xml -- 201 202"
     test_assert_validate $CRM_EX_OK 0
 
     # We can only rely on our custom codes, so we'll spot-check codes 201-209
     desc="List legacy return codes (spot check)"
     cmd="crm_error -l | grep 20[1-9]"
     test_assert $CRM_EX_OK 0
 
     desc="List legacy return codes (spot check) (XML)"
     cmd="crm_error -l --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List legacy return codes (spot check) (with names)"
     cmd="crm_error -n -l | grep 20[1-9]"
     test_assert $CRM_EX_OK 0
 
     desc="List legacy return codes (spot check) (with names) (XML)"
     cmd="crm_error -n -l --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     # Standard Pacemaker return codes
     #
     # Don't test positive (system) error codes, which may vary by OS
 
     desc="Get unknown Pacemaker return code"
     cmd="crm_error -r -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown Pacemaker return code (XML)"
     cmd="crm_error -r --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get unknown Pacemaker return code (with name)"
     cmd="crm_error -n -r -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown Pacemaker return code (with name) (XML)"
     cmd="crm_error -n -r --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     # Negative return codes require parsing out the "--" explicitly, so we need
     # to test them as a separate case
     desc="Get negative Pacemaker return code"
     cmd="crm_error -r -- -1005"
     test_assert $CRM_EX_OK 0
 
     desc="Get negative Pacemaker return code (XML)"
     cmd="crm_error -r --output-as=xml -- -1005"
     test_assert_validate $CRM_EX_OK 0
 
     # Testing name lookups for negative return codes only is sufficient
     desc="Get negative Pacemaker return code (with name)"
     cmd="crm_error -n -r -- -1005"
     test_assert $CRM_EX_OK 0
 
     desc="Get negative Pacemaker return code (with name) (XML)"
     cmd="crm_error -n -r --output-as=xml -- -1005"
     test_assert_validate $CRM_EX_OK 0
 
     # We can only rely on our custom codes (negative and zero)
     desc="List Pacemaker return codes (non-positive)"
     cmd="crm_error -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
     test_assert $CRM_EX_OK 0
 
     desc="List Pacemaker return codes (non-positive) (XML)"
     cmd="crm_error -l -r --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List Pacemaker return codes (non-positive) (with names)"
     cmd="crm_error -n -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
     test_assert $CRM_EX_OK 0
 
     desc="List Pacemaker return codes (non-positive) (with names) (XML)"
     cmd="crm_error -n -l -r --output-as=xml > $TMPFILE; rc=$?"
     cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
     cmd="$cmd; (exit $rc)"
     test_assert_validate $CRM_EX_OK 0
 
     # crm_exit_t exit codes
 
     desc="Get unknown crm_exit_t exit code"
     cmd="crm_error -X -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown crm_exit_t exit code (XML)"
     cmd="crm_error -X --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get unknown crm_exit_t exit code (with name)"
     cmd="crm_error -n -X -- -10000"
     test_assert $CRM_EX_OK 0
 
     desc="Get unknown crm_exit_t exit code (with name) (XML)"
     cmd="crm_error -n -X --output-as=xml -- -10000"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code"
     cmd="crm_error -X -- 1"
     test_assert $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code (XML)"
     cmd="crm_error -X --output-as=xml -- 1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code (with name)"
     cmd="crm_error -n -X -- 1"
     test_assert $CRM_EX_OK 0
 
     desc="Get crm_exit_t exit code (with name) (XML)"
     cmd="crm_error -n -X --output-as=xml -- 1"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes"
     cmd="crm_error -l -X"
     test_assert $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes (XML)"
     cmd="crm_error -l -X --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes (with name)"
     cmd="crm_error -l -n -X"
     test_assert $CRM_EX_OK 0
 
     desc="Get all crm_exit_t exit codes (with name) (XML)"
     cmd="crm_error -l -n -X --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     rm -f "$TMPFILE"
 }
 
 function test_tools() {
     local TMPXML
     local TMPORIG
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     TMPORIG=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.existing.xml.XXXXXXXXXX)
 
     create_shadow_cib --create-empty
 
     desc="Validate CIB"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK
 
     desc="Query the value of an attribute that does not exist"
     cmd="crm_attribute -n ABCD --query --quiet"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Configure something before erasing"
     cmd="crm_attribute -n cluster-delay -v 60s"
     test_assert $CRM_EX_OK
 
     desc="Require --force for CIB erasure"
     cmd="cibadmin -E"
     test_assert $CRM_EX_UNSAFE
 
     desc="Allow CIB erasure with --force"
     cmd="cibadmin -E --force"
     test_assert $CRM_EX_OK 0
 
     # Skip outputting the resulting CIB in the previous command, and delete
     # rsc_defaults now, so tests behave the same regardless of build options.
     delete_shadow_resource_defaults
 
     # Verify the output after erasure
     desc="Query CIB"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK
 
     # Save a copy of the CIB for a later test
     cibadmin -Q > "$TMPORIG"
 
     desc="Set cluster option"
     cmd="crm_attribute -n cluster-delay -v 60s"
     test_assert $CRM_EX_OK
 
     desc="Query new cluster option"
     cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
     test_assert $CRM_EX_OK
 
     desc="Query cluster options"
     cmd="cibadmin -Q -o crm_config > $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Set no-quorum policy"
     cmd="crm_attribute -n no-quorum-policy -v ignore"
     test_assert $CRM_EX_OK
 
     desc="Delete nvpair"
     cmd="cibadmin -D -o crm_config --xml-text '<nvpair id=\"cib-bootstrap-options-cluster-delay\"/>'"
     test_assert $CRM_EX_OK
 
     desc="Create operation should fail"
     cmd="cibadmin -C -o crm_config --xml-file $TMPXML"
     test_assert $CRM_EX_EXISTS
 
     desc="Modify cluster options section"
     cmd="cibadmin -M -o crm_config --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Query updated cluster option"
     cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
     test_assert $CRM_EX_OK
 
     desc="Set duplicate cluster option"
     cmd="crm_attribute -n cluster-delay -v 40s -s duplicate"
     test_assert $CRM_EX_OK
 
     desc="Setting multiply defined cluster option should fail"
     cmd="crm_attribute -n cluster-delay -v 30s"
     test_assert $CRM_EX_MULTIPLE
 
     desc="Set cluster option with -s"
     cmd="crm_attribute -n cluster-delay -v 30s -s duplicate"
     test_assert $CRM_EX_OK
 
     desc="Delete cluster option with -i"
     cmd="crm_attribute -n cluster-delay -D -i cib-bootstrap-options-cluster-delay"
     test_assert $CRM_EX_OK
 
     desc="Create node1 and bring it online"
     cmd="crm_simulate --live-check --in-place --node-up=node1"
     test_assert $CRM_EX_OK
 
     desc="Create node attribute"
     cmd="crm_attribute -n ram -v 1024M -N node1 -t nodes"
     test_assert $CRM_EX_OK
 
     desc="Query new node attribute"
     cmd="cibadmin -Q -o nodes | grep node1-ram"
     test_assert $CRM_EX_OK
 
     desc="Create second node attribute"
     cmd="crm_attribute -n rattr -v XYZ -N node1 -t nodes"
     test_assert $CRM_EX_OK
 
     desc="Query node attributes by pattern"
     cmd="crm_attribute -t nodes -P 'ra.*' -N node1 --query"
     test_assert $CRM_EX_OK 0
 
     desc="Update node attributes by pattern"
     cmd="crm_attribute -t nodes -P 'rat.*' -N node1 -v 10"
     test_assert $CRM_EX_OK
 
     desc="Delete node attributes by pattern"
     cmd="crm_attribute -t nodes -P 'rat.*' -N node1 -D"
     test_assert $CRM_EX_OK
 
     desc="Set a transient (fail-count) node attribute"
     cmd="crm_attribute -n fail-count-foo -v 3 -N node1 -t status"
     test_assert $CRM_EX_OK
 
     desc="Query a fail count"
     cmd="crm_failcount --query -r foo -N node1"
     test_assert $CRM_EX_OK
 
     desc="Show node attributes with crm_simulate"
     cmd="crm_simulate --live-check --show-attrs"
     test_assert $CRM_EX_OK 0
 
     desc="Set a second transient node attribute"
     cmd="crm_attribute -n fail-count-bar -v 5 -N node1 -t status"
     test_assert $CRM_EX_OK
 
     desc="Query transient node attributes by pattern"
     cmd="crm_attribute -t status -P fail-count -N node1 --query"
     test_assert $CRM_EX_OK 0
 
     desc="Update transient node attributes by pattern"
     cmd="crm_attribute -t status -P fail-count -N node1 -v 10"
     test_assert $CRM_EX_OK
 
     desc="Delete transient node attributes by pattern"
     cmd="crm_attribute -t status -P fail-count -N node1 -D"
     test_assert $CRM_EX_OK
 
     desc="crm_attribute given invalid delete usage"
     cmd="crm_attribute -t nodes -N node1 -D"
     test_assert $CRM_EX_USAGE 0
 
     desc="Set a utilization node attribute"
     cmd="crm_attribute -n cpu -v 1 -N node1 -z"
     test_assert $CRM_EX_OK
 
     desc="Query utilization node attribute"
     cmd="crm_attribute --query -n cpu -N node1 -z"
     test_assert $CRM_EX_OK 0
 
     desc="Digest calculation"
     cmd="cibadmin -Q | cibadmin -5 -p 2>&1 > /dev/null"
     test_assert $CRM_EX_OK
 
     # This update will fail because it has version numbers
     desc="Replace operation should fail"
     cmd="cibadmin -R --xml-file $TMPORIG"
     test_assert $CRM_EX_OLD
 
     desc="Default standby value"
     cmd="crm_standby -N node1 -G"
     test_assert $CRM_EX_OK
 
     desc="Set standby status"
     cmd="crm_standby -N node1 -v true"
     test_assert $CRM_EX_OK
 
     desc="Query standby value"
     cmd="crm_standby -N node1 -G"
     test_assert $CRM_EX_OK
 
     desc="Delete standby value"
     cmd="crm_standby -N node1 -D"
     test_assert $CRM_EX_OK
 
     desc="Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_OK
 
     desc="crm_resource run with extra arguments"
     cmd="crm_resource foo bar"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_resource given both -r and resource config"
     cmd="crm_resource -r xyz --class ocf --provider pacemaker --agent Dummy"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_resource given resource config with invalid action"
     cmd="crm_resource --class ocf --provider pacemaker --agent Dummy -D"
     test_assert $CRM_EX_USAGE 0
 
     desc="Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Query a resource meta attribute"
     cmd="crm_resource -r dummy --meta -g is-managed"
     test_assert $CRM_EX_OK
 
     desc="Remove a resource meta attribute"
     cmd="crm_resource -r dummy --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Create another resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Stopped --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Show why a resource is not running"
     cmd="crm_resource -Y -r dummy --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Remove another resource meta attribute"
     cmd="crm_resource -r dummy --meta -d target-role --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get a non-existent attribute from a resource element with output-as=xml"
     cmd="crm_resource -r dummy --get-parameter nonexistent --element --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get a non-existent attribute from a resource element without output-as=xml"
     cmd="crm_resource -r dummy --get-parameter nonexistent --element"
     test_assert $CRM_EX_OK
 
     desc="Get an existent attribute from a resource element with output-as=xml"
     cmd="crm_resource -r dummy --get-parameter class --element --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get an existent attribute from a resource element without output-as=xml"
     cmd="crm_resource -r dummy --get-parameter class --element"
     test_assert $CRM_EX_OK
 
     desc="Set a non-existent attribute for a resource element with output-as=xml"
     cmd="crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml"
     test_assert $CRM_EX_OK
 
     desc="Set an existent attribute for a resource element with output-as=xml"
     cmd="crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml"
     test_assert $CRM_EX_OK
 
     desc="Delete an existent attribute for a resource element with output-as=xml"
     cmd="crm_resource -r dummy -d description --element --output-as=xml"
     test_assert $CRM_EX_OK
 
     desc="Delete a non-existent attribute for a resource element with output-as=xml"
     cmd="crm_resource -r dummy -d description --element --output-as=xml"
     test_assert $CRM_EX_OK
 
     desc="Set a non-existent attribute for a resource element without output-as=xml"
     cmd="crm_resource -r dummy --set-parameter=description -v test_description --element"
     test_assert $CRM_EX_OK
 
     desc="Set an existent attribute for a resource element without output-as=xml"
     cmd="crm_resource -r dummy --set-parameter=description -v test_description --element"
     test_assert $CRM_EX_OK
 
     desc="Delete an existent attribute for a resource element without output-as=xml"
     cmd="crm_resource -r dummy -d description --element"
     test_assert $CRM_EX_OK
 
     desc="Delete a non-existent attribute for a resource element without output-as=xml"
     cmd="crm_resource -r dummy -d description --element"
     test_assert $CRM_EX_OK
 
     desc="Create a resource attribute"
     cmd="crm_resource -r dummy -p delay -v 10s"
     test_assert $CRM_EX_OK
 
     desc="List the configured resources"
     cmd="crm_resource -L"
     test_assert $CRM_EX_OK
 
     desc="List the configured resources in XML"
     cmd="crm_resource -L --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Implicitly list the configured resources"
     cmd="crm_resource"
     test_assert $CRM_EX_OK 0
 
     desc="List IDs of instantiated resources"
     cmd="crm_resource -l"
     test_assert $CRM_EX_OK 0
 
     desc="Show XML configuration of resource"
     cmd="crm_resource -q -r dummy"
     test_assert $CRM_EX_OK 0
 
     desc="Show XML configuration of resource, output as XML"
     cmd="crm_resource -q -r dummy --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     desc="Require a destination when migrating a resource that is stopped"
     cmd="crm_resource -r dummy -M"
     test_assert $CRM_EX_USAGE
 
     desc="Don't support migration to non-existent locations"
     cmd="crm_resource -r dummy -M -N i.do.not.exist"
     test_assert $CRM_EX_NOSUCH
 
     desc="Create a fencing resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"Fence\" class=\"stonith\" type=\"fence_true\"/>'"
     test_assert $CRM_EX_OK
 
     desc="Bring resources online"
     cmd="crm_simulate --live-check --in-place -S"
     test_assert $CRM_EX_OK
 
     desc="Try to move a resource to its existing location"
     cmd="crm_resource -r dummy --move --node node1"
     test_assert $CRM_EX_EXISTS
 
     desc="Try to move a resource that doesn't exist"
     cmd="crm_resource -r xyz --move --node node1"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Move a resource from its existing location"
     cmd="crm_resource -r dummy --move"
     test_assert $CRM_EX_OK
 
     desc="Clear out constraints generated by --move"
     cmd="crm_resource -r dummy --clear"
     test_assert $CRM_EX_OK
 
     desc="Default ticket granted state"
     cmd="crm_ticket -t ticketA -G granted -d false"
     test_assert $CRM_EX_OK
 
     desc="Set ticket granted state"
     cmd="crm_ticket -t ticketA -r --force"
     test_assert $CRM_EX_OK
 
     desc="Query ticket granted state"
     cmd="crm_ticket -t ticketA -G granted"
     test_assert $CRM_EX_OK
 
     desc="Delete ticket granted state"
     cmd="crm_ticket -t ticketA -D granted --force"
     test_assert $CRM_EX_OK
 
     desc="Make a ticket standby"
     cmd="crm_ticket -t ticketA -s"
     test_assert $CRM_EX_OK
 
     desc="Query ticket standby state"
     cmd="crm_ticket -t ticketA -G standby"
     test_assert $CRM_EX_OK
 
     desc="Activate a ticket"
     cmd="crm_ticket -t ticketA -a"
     test_assert $CRM_EX_OK
 
     desc="Delete ticket standby state"
     cmd="crm_ticket -t ticketA -D standby"
     test_assert $CRM_EX_OK
 
     desc="Ban a resource on unknown node"
     cmd="crm_resource -r dummy -B -N host1"
     test_assert $CRM_EX_NOSUCH
 
     desc="Create two more nodes and bring them online"
     cmd="crm_simulate --live-check --in-place --node-up=node2 --node-up=node3"
     test_assert $CRM_EX_OK
 
     desc="Ban dummy from node1"
     cmd="crm_resource -r dummy -B -N node1"
     test_assert $CRM_EX_OK
 
     desc="Show where a resource is running"
     cmd="crm_resource -r dummy -W"
     test_assert $CRM_EX_OK 0
 
     desc="Show constraints on a resource"
     cmd="crm_resource -a -r dummy"
     test_assert $CRM_EX_OK 0
 
     desc="Ban dummy from node2"
     cmd="crm_resource -r dummy -B -N node2 --output-as=xml"
     test_assert_validate $CRM_EX_OK
 
     desc="Relocate resources due to ban"
     cmd="crm_simulate --live-check --in-place -S"
     test_assert $CRM_EX_OK
 
     desc="Move dummy to node1"
     cmd="crm_resource -r dummy -M -N node1 --output-as=xml"
     test_assert_validate $CRM_EX_OK
 
     desc="Clear implicit constraints for dummy on node2"
     cmd="crm_resource -r dummy -U -N node2"
     test_assert $CRM_EX_OK
 
     desc="Drop the status section"
     cmd="cibadmin -R -o status --xml-text '<status/>'"
     test_assert $CRM_EX_OK 0
 
     desc="Create a clone"
     cmd="cibadmin -C -o resources --xml-text '<clone id=\"test-clone\"><primitive id=\"test-primitive\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/></clone>'"
     test_assert $CRM_EX_OK 0
 
     desc="Create a resource meta attribute"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in the primitive"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
     test_assert $CRM_EX_OK
 
     desc="Update resource meta attribute with duplicates"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true"
     test_assert $CRM_EX_OK
 
     desc="Update resource meta attribute with duplicates (force clone)"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
     test_assert $CRM_EX_OK
 
     desc="Update child resource meta attribute with duplicates"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Delete resource meta attribute with duplicates"
     cmd="crm_resource -r test-clone --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Delete resource meta attribute in parent"
     cmd="crm_resource -r test-primitive --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in the primitive"
     cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
     test_assert $CRM_EX_OK
 
     desc="Update existing resource meta attribute"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in the parent"
     cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
     test_assert $CRM_EX_OK
 
     desc="Copy resources"
     cmd="cibadmin -Q -o resources > $TMPXML"
     test_assert $CRM_EX_OK 0
 
     desc="Delete resource parent meta attribute (force)"
     cmd="crm_resource -r test-clone --meta -d is-managed --force"
     test_assert $CRM_EX_OK
 
     desc="Restore duplicates"
     cmd="cibadmin -R -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Delete resource child meta attribute"
     cmd="crm_resource -r test-primitive --meta -d is-managed"
     test_assert $CRM_EX_OK
 
     desc="Create the dummy-group resource group"
     cmd="cibadmin -C -o resources --xml-text '<group id=\"dummy-group\">"
     cmd="$cmd <primitive id=\"dummy1\" class=\"ocf\" provider=\"pacemaker\""
     cmd="$cmd     type=\"Dummy\"/>"
     cmd="$cmd <primitive id=\"dummy2\" class=\"ocf\" provider=\"pacemaker\""
     cmd="$cmd     type=\"Dummy\"/>"
     cmd="$cmd </group>'"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in dummy1"
     cmd="crm_resource -r dummy1 --meta -p is-managed -v true"
     test_assert $CRM_EX_OK
 
     desc="Create a resource meta attribute in dummy-group"
     cmd="crm_resource -r dummy-group --meta -p is-managed -v false"
     test_assert $CRM_EX_OK
 
     desc="Delete the dummy-group resource group"
     cmd="cibadmin -D -o resources --xml-text '<group id=\"dummy-group\">'"
     test_assert $CRM_EX_OK
 
     desc="Specify a lifetime when moving a resource"
     cmd="crm_resource -r dummy --move --node node2 --lifetime=PT1H"
     test_assert $CRM_EX_OK
 
     desc="Try to move a resource previously moved with a lifetime"
     cmd="crm_resource -r dummy --move --node node1"
     test_assert $CRM_EX_OK
 
     desc="Ban dummy from node1 for a short time"
     cmd="crm_resource -r dummy -B -N node1 --lifetime=PT1S"
     test_assert $CRM_EX_OK
 
     desc="Remove expired constraints"
     sleep 2
     cmd="crm_resource --clear --expired"
     test_assert $CRM_EX_OK
 
     # Clear has already been tested elsewhere, but we need to get rid of the
     # constraints so testing delete works.  It won't delete if there's still
     # a reference to the resource somewhere.
     desc="Clear all implicit constraints for dummy"
     cmd="crm_resource -r dummy -U"
     test_assert $CRM_EX_OK
 
     desc="Set a node health strategy"
     cmd="crm_attribute -n node-health-strategy -v migrate-on-red"
     test_assert $CRM_EX_OK
 
     desc="Set a node health attribute"
     cmd="crm_attribute -N node3 -n '#health-cts-cli' -v red"
     test_assert $CRM_EX_OK
 
     desc="Show why a resource is not running on an unhealthy node"
     cmd="crm_resource -N node3 -Y -r dummy --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Delete a resource"
     cmd="crm_resource -D -r dummy -t primitive"
     test_assert $CRM_EX_OK
 
     unset CIB_shadow
     unset CIB_shadow_dir
 
     desc="Create an XML patchset"
     cmd="crm_diff -o $test_home/cli/crm_diff_old.xml -n $test_home/cli/crm_diff_new.xml"
     test_assert $CRM_EX_ERROR 0
 
     export CIB_file="$test_home/cli/constraints.xml"
 
     for rsc in prim1 prim2 prim3 prim4 prim5 prim6 prim7 prim8 prim9 \
                prim10 prim11 prim12 prim13 group clone; do
         desc="Check locations and constraints for $rsc"
         cmd="crm_resource -a -r $rsc"
         test_assert $CRM_EX_OK 0
 
         desc="Recursively check locations and constraints for $rsc"
         cmd="crm_resource -A -r $rsc"
         test_assert $CRM_EX_OK 0
 
         desc="Check locations and constraints for $rsc in XML"
         cmd="crm_resource -a -r $rsc --output-as=xml"
         test_assert_validate $CRM_EX_OK 0
 
         desc="Recursively check locations and constraints for $rsc in XML"
         cmd="crm_resource -A -r $rsc --output-as=xml"
         test_assert_validate $CRM_EX_OK 0
     done
 
     desc="Check locations and constraints for group member (referring to group)"
     cmd="crm_resource -a -r gr2"
     test_assert $CRM_EX_OK 0
 
     desc="Check locations and constraints for group member (without referring to group)"
     cmd="crm_resource -a -r gr2 --force"
     test_assert $CRM_EX_OK 0
 
     # Create a shadow CIB based on constraints.xml
     create_shadow_cib --create
     unset CIB_file
 
     desc="Set a meta-attribute for primitive and resources colocated with it"
     cmd="crm_resource -r prim5 --meta --set-parameter=target-role -v Stopped --recursive"
     test_assert $CRM_EX_OK 0
 
     desc="Set a meta-attribute for group and resource colocated with it"
     cmd="crm_resource -r group --meta --set-parameter=target-role -v Stopped --recursive"
     test_assert $CRM_EX_OK 0
 
     desc="Set a meta-attribute for clone and resource colocated with it"
     cmd="crm_resource -r clone --meta --set-parameter=target-role -v Stopped --recursive"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow
     unset CIB_shadow_dir
 
     export CIB_file="$test_home/cli/crm_resource_digests.xml"
 
     desc="Show resource digests"
     cmd="crm_resource --digests -r rsc1 -N node1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Show resource digests with overrides"
     cmd="$cmd CRM_meta_interval=10000 CRM_meta_timeout=20000"
     test_assert $CRM_EX_OK 0
 
     desc="Show resource operations"
     cmd="crm_resource --list-operations"
     test_assert $CRM_EX_OK 0
 
     desc="Show resource operations (XML)"
     cmd="crm_resource --list-operations --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crmadmin-cluster-remote-guest-nodes.xml"
 
     desc="List all nodes"
     cmd="crmadmin -N"
     test_assert $CRM_EX_OK 0
 
     desc="Minimally list all nodes"
     cmd="crmadmin -N -q"
     test_assert $CRM_EX_OK 0
 
     desc="List all nodes as bash exports"
     cmd="crmadmin -N -B"
     test_assert $CRM_EX_OK 0
 
     desc="List cluster nodes"
     cmd="crmadmin -N cluster | wc -l | grep 6"
     test_assert $CRM_EX_OK 0
 
     desc="List guest nodes"
     cmd="crmadmin -N guest | wc -l | grep 2"
     test_assert $CRM_EX_OK 0
 
     desc="List remote nodes"
     cmd="crmadmin -N remote | wc -l | grep 3"
     test_assert $CRM_EX_OK 0
 
     desc="List cluster,remote nodes"
     cmd="crmadmin -N cluster,remote | wc -l | grep 9"
     test_assert $CRM_EX_OK 0
 
     desc="List guest,remote nodes"
     cmd="crmadmin -N guest,remote | wc -l | grep 5"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
 
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow_dir="${shadow_dir}"
 
     desc="Show allocation scores with crm_simulate"
     cmd="crm_simulate -x $CIB_file --show-scores --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Show utilization with crm_simulate"
     cmd="crm_simulate -x $CIB_file --show-utilization"
     test_assert $CRM_EX_OK 0
 
     desc="Simulate injecting a failure"
     cmd="crm_simulate -x $CIB_file -S -i ping_monitor_10000@cluster02=1"
     test_assert $CRM_EX_OK 0
 
     desc="Simulate bringing a node down"
     cmd="crm_simulate -x $CIB_file -S --node-down=cluster01"
     test_assert $CRM_EX_OK 0
 
     desc="Simulate a node failing"
     cmd="crm_simulate -x $CIB_file -S --node-fail=cluster02"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
 
     desc="List a promotable clone resource"
     cmd="crm_resource --locate -r promotable-clone"
     test_assert $CRM_EX_OK 0
 
     desc="List the primitive of a promotable clone resource"
     cmd="crm_resource --locate -r promotable-rsc"
     test_assert $CRM_EX_OK 0
 
     desc="List a single instance of a promotable clone resource"
     cmd="crm_resource --locate -r promotable-rsc:0"
     test_assert $CRM_EX_OK 0
 
     desc="List another instance of a promotable clone resource"
     cmd="crm_resource --locate -r promotable-rsc:1"
     test_assert $CRM_EX_OK 0
 
     desc="List a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-clone --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List the primitive of a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-rsc --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List a single instance of a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-rsc:0 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="List another instance of a promotable clone resource in XML"
     cmd="crm_resource --locate -r promotable-rsc:1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Try to move an instance of a cloned resource"
     cmd="crm_resource -r promotable-rsc:0 --move --node node1"
     test_assert $CRM_EX_INVALID_PARAM 0
 
     # Create a sandbox copy of crm_mon.xml
     cibadmin -Q > "$TMPXML"
     export CIB_file="$TMPXML"
 
     desc="Query a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Query a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Delete a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
     test_assert $CRM_EX_OK 0
 
     desc="Delete a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after deleting a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Query after deleting a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Update a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1"
     test_assert $CRM_EX_OK 0
 
     desc="Update a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after updating a nonexistent promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_OK 0
 
     desc="Query after updating a nonexistent promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Update an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5"
     test_assert $CRM_EX_OK 0
 
     desc="Update an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after updating an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_OK 0
 
     desc="Query after updating an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Delete an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
     test_assert $CRM_EX_OK 0
 
     desc="Delete an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Query after deleting an existing promotable score attribute"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Query after deleting an existing promotable score attribute (XML)"
     cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     # Test for an issue with legacy command line parsing when the resource is
     # specified in the environment (CLBZ#5509)
     export OCF_RESOURCE_INSTANCE=promotable-rsc
 
     desc="Update a promotable score attribute to -INFINITY"
     cmd="crm_attribute -N cluster01 -p -v -INFINITY"
     test_assert $CRM_EX_OK 0
 
     desc="Update a promotable score attribute to -INFINITY (XML)"
     cmd="crm_attribute -N cluster01 -p -v -INFINITY --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     desc="Query after updating a promotable score attribute to -INFINITY"
     cmd="crm_attribute -N cluster01 -p -G"
     test_assert $CRM_EX_OK 0
 
     desc="Query after updating a promotable score attribute to -INFINITY (XML)"
     cmd="crm_attribute -N cluster01 -p -G --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     desc="Try OCF_RESOURCE_INSTANCE if -p is specified with an empty string"
     cmd="crm_attribute -N cluster01 -p '' -G"
     test_assert $CRM_EX_OK 0
 
     export OCF_RESOURCE_INSTANCE=""
 
     desc="Return usage error if both -p and OCF_RESOURCE_INSTANCE are empty strings"
     cmd="crm_attribute -N cluster01 -p '' -G"
     test_assert $CRM_EX_USAGE 0
 
     unset CIB_file
     unset OCF_RESOURCE_INSTANCE
 
     export CIB_file="-"
 
     desc="Check that CIB_file=\"-\" works - crm_mon"
     cmd="cat $test_home/cli/crm_mon.xml | crm_mon -1"
     test_assert $CRM_EX_OK 0
 
     desc="Check that CIB_file=\"-\" works - crm_resource"
     cmd="cat $test_home/cli/crm_resource_digests.xml | crm_resource --digests -r rsc1 -N node1 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Check that CIB_file=\"-\" works - crmadmin"
     cmd="cat $test_home/cli/crmadmin-cluster-remote-guest-nodes.xml | crmadmin -N | wc -l | grep 11"
     test_assert $CRM_EX_OK 0
 
     unset CIB_file
     rm -f "$TMPXML" "$TMPORIG"
 
 
     # crm_shadow tests
 
     unset CIB_shadow
     unset CIB_shadow_dir
 
     # Query with no active shadow instance
     desc="Get active shadow instance (no active instance)"
     cmd="crm_shadow --which"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance (no active instance) (XML)"
     cmd="crm_shadow --which --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's file name (no active instance)"
     cmd="crm_shadow --file"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's file name (no active instance) (XML)"
     cmd="crm_shadow --file --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's contents (no active instance)"
     cmd="crm_shadow --display"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's contents (no active instance) (XML)"
     cmd="crm_shadow --display --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's diff (no active instance)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's diff (no active instance) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     # Create new shadow instance based on active CIB
     # Don't use create_shadow_cib() here; test explicitly
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow="$shadow"
     export CIB_shadow_dir="$shadow_dir"
 
     # Delete the shadow file if it already exists
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create copied shadow instance"
     cmd="crm_shadow --create $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create copied shadow instance (XML)"
     cmd="crm_shadow --create $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Query shadow instance based on active CIB
     desc="Get active shadow instance (copied)"
     cmd="crm_shadow --which"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance (copied) (XML)"
     cmd="crm_shadow --which --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's file name (copied)"
     cmd="crm_shadow --file"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's file name (copied) (XML)"
     cmd="crm_shadow --file --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's contents (copied)"
     cmd="crm_shadow --display"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's contents (copied) (XML)"
     cmd="crm_shadow --display --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (copied)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (copied) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Make some changes to the shadow file
     export CIB_file="$(crm_shadow --file)"
 
     cibadmin --modify --xml-text '<primitive id="dummy" description="desc"/>'
     cibadmin --delete --xml-text '<op_defaults/>'
     cibadmin --create -o resources --xml-text \
         '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
 
     state="<node_state id=\"3\" uname=\"cluster03\" in_ccm=\"true\""
     state="$state crmd=\"online\" crm-debug-origin=\"do_update_resource\""
     state="$state join=\"member\" expected=\"member\">"
 
     cibadmin --create -o status --xml-text "$state"
     unset state
 
     export CIB_file="$test_home/cli/crm_mon.xml"
 
     desc="Get active shadow instance's diff (after changes)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_ERROR 0
 
     desc="Get active shadow instance's diff (after changes) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_ERROR 0
 
     # Commit the modified shadow CIB to a temp active CIB file
     cp "$test_home/cli/crm_mon.xml" "$TMPXML"
     export CIB_file="$TMPXML"
 
     desc="Commit shadow instance"
     cmd="crm_shadow --commit $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (force)"
     cmd="crm_shadow --commit $shadow --force"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (after commit)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_ERROR 0
 
     desc="Commit shadow instance (force) (all)"
     cmd="crm_shadow --commit $shadow --force --all"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (after commit all)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_ERROR 0
 
     # Repeat sequence with XML output
     cp "$test_home/cli/crm_mon.xml" "$TMPXML"
     export CIB_file="$TMPXML"
 
     desc="Commit shadow instance (XML)"
     cmd="crm_shadow --commit $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (force) (XML)"
     cmd="crm_shadow --commit $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (after commit) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_ERROR 0
 
     desc="Commit shadow instance (force) (all) (XML)"
     cmd="crm_shadow --commit $shadow --force --all --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (after commit all) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_ERROR 0
 
     # Commit an inactive shadow instance with no active instance
     unset CIB_shadow
 
     desc="Commit shadow instance (no active instance)"
     cmd="crm_shadow --commit $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (no active instance) (force)"
     cmd="crm_shadow --commit $shadow --force"
     test_assert $CRM_EX_OK 0
 
     desc="Commit shadow instance (no active instance) (XML)"
     cmd="crm_shadow --commit $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (no active instance) (force) (XML)"
     cmd="crm_shadow --commit $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Commit an inactive shadow instance with an active instance
     export CIB_shadow="nonexistent_shadow"
 
     desc="Commit shadow instance (mismatch)"
     cmd="crm_shadow --commit $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (mismatch) (force)"
     cmd="crm_shadow --commit $shadow --force"
     test_assert $CRM_EX_OK 0
 
     desc="Commit shadow instance (mismatch) (XML)"
     cmd="crm_shadow --commit $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (mismatch) (force) (XML)"
     cmd="crm_shadow --commit $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Commit an active shadow instance whose shadow file is missing
     desc="Commit shadow instance (nonexistent shadow file)"
     cmd="crm_shadow --commit $CIB_shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (nonexistent shadow file) (force)"
     cmd="crm_shadow --commit $CIB_shadow --force"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's diff (nonexistent shadow file)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Commit shadow instance (nonexistent shadow file) (XML)"
     cmd="crm_shadow --commit $CIB_shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (nonexistent shadow file) (force) (XML)"
     cmd="crm_shadow --commit $CIB_shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's diff (nonexistent shadow file) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     # Commit an active shadow instance when the CIB file is missing
     export CIB_file="$test_home/cli/nonexistent_cib.xml"
     export CIB_shadow="$shadow"
 
     desc="Commit shadow instance (nonexistent CIB file)"
     cmd="crm_shadow --commit $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (nonexistent CIB file) (force)"
     cmd="crm_shadow --commit $shadow --force"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's diff (nonexistent CIB file)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Commit shadow instance (nonexistent CIB file) (XML)"
     cmd="crm_shadow --commit $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Commit shadow instance (nonexistent CIB file) (force) (XML)"
     cmd="crm_shadow --commit $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Get active shadow instance's diff (nonexistent CIB file) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     rm -f "$TMPXML"
 
     # Delete an active shadow instance
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow="$shadow"
 
     desc="Delete shadow instance"
     cmd="crm_shadow --delete $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (force)"
     cmd="crm_shadow --delete $shadow --force"
     test_assert $CRM_EX_OK 0
 
     create_shadow_cib --create
 
     desc="Delete shadow instance (XML)"
     cmd="crm_shadow --delete $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (force) (XML)"
     cmd="crm_shadow --delete $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Delete an inactive shadow instance with no active instance
     create_shadow_cib --create
     unset CIB_shadow
 
     desc="Delete shadow instance (no active instance)"
     cmd="crm_shadow --delete $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (no active instance) (force)"
     cmd="crm_shadow --delete $shadow --force"
     test_assert $CRM_EX_OK 0
 
     create_shadow_cib --create
     unset CIB_shadow
 
     desc="Delete shadow instance (no active instance) (XML)"
     cmd="crm_shadow --delete $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (no active instance) (force) (XML)"
     cmd="crm_shadow --delete $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Delete an inactive shadow instance with an active instance
     create_shadow_cib --create
     export CIB_shadow="nonexistent_shadow"
 
     desc="Delete shadow instance (mismatch)"
     cmd="crm_shadow --delete $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (mismatch) (force)"
     cmd="crm_shadow --delete $shadow --force"
     test_assert $CRM_EX_OK 0
 
     create_shadow_cib --create
     export CIB_shadow="nonexistent_shadow"
 
     desc="Delete shadow instance (mismatch) (XML)"
     cmd="crm_shadow --delete $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (mismatch) (force) (XML)"
     cmd="crm_shadow --delete $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Delete an active shadow instance whose shadow file is missing
     desc="Delete shadow instance (nonexistent shadow file)"
     cmd="crm_shadow --delete $CIB_shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (nonexistent shadow file) (force)"
     cmd="crm_shadow --delete $CIB_shadow --force"
     test_assert $CRM_EX_OK 0
 
     desc="Delete shadow instance (nonexistent shadow file) (XML)"
     cmd="crm_shadow --delete $CIB_shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (nonexistent shadow file) (force) (XML)"
     cmd="crm_shadow --delete $CIB_shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Delete an active shadow instance when the CIB file is missing
     export CIB_file="$test_home/cli/crm_mon.xml"
     create_shadow_cib --create
     export CIB_file="$test_home/cli/nonexistent_cib.xml"
 
     desc="Delete shadow instance (nonexistent CIB file)"
     cmd="crm_shadow --delete $shadow"
     test_assert $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (nonexistent CIB file) (force)"
     cmd="crm_shadow --delete $shadow --force"
     test_assert $CRM_EX_OK 0
 
     export CIB_file="$test_home/cli/crm_mon.xml"
     create_shadow_cib --create
     export CIB_file="$test_home/cli/nonexistent_cib.xml"
 
     desc="Delete shadow instance (nonexistent CIB file) (XML)"
     cmd="crm_shadow --delete $shadow --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Delete shadow instance (nonexistent CIB file) (force) (XML)"
     cmd="crm_shadow --delete $shadow --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create new shadow instance based on active CIB with no instance active
     export CIB_file="$test_home/cli/crm_mon.xml"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
     unset CIB_shadow
 
     desc="Create copied shadow instance (no active instance)"
     cmd="crm_shadow --create $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
     unset CIB_shadow
 
     desc="Create copied shadow instance (no active instance) (XML)"
     cmd="crm_shadow --create $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create new shadow instance based on active CIB with other instance active
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow="nonexistent_shadow"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create copied shadow instance (mismatch)"
     cmd="crm_shadow --create $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create copied shadow instance (mismatch) (XML)"
     cmd="crm_shadow --create $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create new shadow instance based on CIB (shadow file already exists)
     export CIB_file="$test_home/cli/crm_mon.xml"
 
     desc="Create copied shadow instance (file already exists)"
     cmd="crm_shadow --create $shadow --batch"
     test_assert $CRM_EX_CANTCREAT 0
 
     desc="Create copied shadow instance (file already exists) (force)"
     cmd="crm_shadow --create $shadow --batch --force"
     test_assert $CRM_EX_OK 0
 
     desc="Create copied shadow instance (file already exists) (XML)"
     cmd="crm_shadow --create $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_CANTCREAT 0
 
     desc="Create copied shadow instance (file already exists) (force) (XML)"
     cmd="crm_shadow --create $shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create new shadow instance based on active CIB when the CIB file is missing
     export CIB_file="$test_home/cli/nonexistent_cib.xml"
     export CIB_shadow="$shadow"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create copied shadow instance (nonexistent CIB file) (force)"
     cmd="crm_shadow --create $shadow --batch --force"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Create copied shadow instance (nonexistent CIB file) (force) (XML)"
     cmd="crm_shadow --create $shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     # Create new empty shadow instance
     export CIB_shadow="$shadow"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance"
     cmd="crm_shadow --create-empty $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (XML)"
     cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create empty shadow instance with no active instance
     unset CIB_shadow
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (no active instance)"
     cmd="crm_shadow --create-empty $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (no active instance) (XML)"
     cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create empty shadow instance with other instance active
     export CIB_shadow="nonexistent_shadow"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (mismatch)"
     cmd="crm_shadow --create-empty $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (mismatch) (XML)"
     cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create empty shadow instance when the CIB file is missing
     export CIB_file="$test_home/cli/nonexistent_cib.xml"
     export CIB_shadow="$shadow"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (nonexistent CIB file)"
     cmd="crm_shadow --create-empty $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Create empty shadow instance (nonexistent CIB file) (XML)"
     cmd="crm_shadow --create-empty $shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Create empty shadow instance (shadow file already exists)
     export CIB_file="$test_home/cli/crm_mon.xml"
 
     desc="Create empty shadow instance (file already exists)"
     cmd="crm_shadow --create-empty $shadow --batch"
     test_assert $CRM_EX_CANTCREAT 0
 
     desc="Create empty shadow instance (file already exists) (force)"
     cmd="crm_shadow --create-empty $shadow --batch --force"
     test_assert $CRM_EX_OK 0
 
     desc="Create empty shadow instance (file already exists) (XML)"
     cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_CANTCREAT 0
 
     desc="Create empty shadow instance (file already exists) (force) (XML)"
     cmd="crm_shadow --create-empty $shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Query shadow instance with an empty CIB.
     # --which and --file queries were done earlier.
     delete_shadow_resource_defaults
 
     desc="Get active shadow instance's contents (empty CIB)"
     cmd="crm_shadow --display"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's contents (empty CIB) (XML)"
     cmd="crm_shadow --display --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (empty CIB)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_ERROR 0
 
     desc="Get active shadow instance's diff (empty CIB) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_ERROR 0
 
     # Reset shadow instance (overwrite existing shadow file based on active CIB)
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow="$shadow"
 
     desc="Reset shadow instance"
     cmd="crm_shadow --reset $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (after reset)"
     cmd="crm_shadow --diff"
     test_assert $CRM_EX_OK 0
 
     create_shadow_cib --create-empty
 
     desc="Reset shadow instance (XML)"
     cmd="crm_shadow --reset $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Get active shadow instance's diff (after reset) (XML)"
     cmd="crm_shadow --diff --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Reset an inactive shadow instance with no active instance
     unset CIB_shadow
 
     desc="Reset shadow instance (no active instance)"
     cmd="crm_shadow --reset $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     create_shadow_cib --create-empty
     unset CIB_shadow
 
     desc="Reset shadow instance (no active instance) (XML)"
     cmd="crm_shadow --reset $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Reset an inactive shadow instance with an active instance
     export CIB_shadow="nonexistent_shadow"
 
     desc="Reset shadow instance (mismatch)"
     cmd="crm_shadow --reset $shadow --batch"
     test_assert $CRM_EX_USAGE 0
 
     desc="Reset shadow instance (mismatch) (force)"
     cmd="crm_shadow --reset $shadow --batch --force"
     test_assert $CRM_EX_OK 0
 
     create_shadow_cib --create-empty
     export CIB_shadow="nonexistent_shadow"
 
     desc="Reset shadow instance (mismatch) (XML)"
     cmd="crm_shadow --reset $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="Reset shadow instance (mismatch) (force) (XML)"
     cmd="crm_shadow --reset $shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Reset an active shadow instance when the CIB file is missing
     create_shadow_cib --create-empty
     export CIB_file="$test_home/cli/nonexistent_cib.xml"
 
     desc="Reset shadow instance (nonexistent CIB file)"
     cmd="crm_shadow --reset $CIB_shadow --batch"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Reset shadow instance (nonexistent CIB file) (XML)"
     cmd="crm_shadow --reset $CIB_shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Reset shadow instance (nonexistent CIB file) (force)"
     cmd="crm_shadow --reset $CIB_shadow --batch --force"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Reset shadow instance (nonexistent CIB file) (force) (XML)"
     cmd="crm_shadow --reset $CIB_shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     # Reset an active shadow instance whose shadow file is missing
     export CIB_file="$test_home/cli/crm_mon.xml"
     export CIB_shadow="$shadow"
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Reset shadow instance (nonexistent shadow file)"
     cmd="crm_shadow --reset $CIB_shadow --batch"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Reset shadow instance (nonexistent shadow file) (force)"
     cmd="crm_shadow --reset $CIB_shadow --batch --force"
     test_assert $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Reset shadow instance (nonexistent shadow file) (XML)"
     cmd="crm_shadow --reset $CIB_shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Reset shadow instance (nonexistent shadow file) (force) (XML)"
     cmd="crm_shadow --reset $CIB_shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     # Switch shadow instances
     # In batch mode, this only displays a message
     create_shadow_cib --create-empty
 
     # Makes no difference now, just future-proofing
     CIB_shadow="nonexistent_shadow"
 
     desc="Switch to new shadow instance"
     cmd="crm_shadow --switch $shadow --batch"
     test_assert $CRM_EX_OK 0
 
     CIB_shadow="nonexistent_shadow"
 
     desc="Switch to new shadow instance (XML)"
     cmd="crm_shadow --switch $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     crm_shadow --delete "$shadow" --force >/dev/null 2>&1
 
     desc="Switch to nonexistent shadow instance"
     cmd="crm_shadow --switch $shadow --batch"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Switch to nonexistent shadow instance (force)"
     cmd="crm_shadow --switch $shadow --batch --force"
     test_assert $CRM_EX_NOSUCH 0
 
     desc="Switch to nonexistent shadow instance (XML)"
     cmd="crm_shadow --switch $shadow --batch --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Switch to nonexistent shadow instance (force) (XML)"
     cmd="crm_shadow --switch $shadow --batch --force --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     unset CIB_file
     unset CIB_shadow
     unset CIB_shadow_dir
 }
 
 INVALID_PERIODS=(
     "2019-01-01 00:00:00Z"              # Start with no end
     "2019-01-01 00:00:00Z/"             # Start with only a trailing slash
     "PT2S/P1M"                          # Two durations
     "2019-13-01 00:00:00Z/P1M"          # Out-of-range month
     "20191077T15/P1M"                   # Out-of-range day
     "2019-10-01T25:00:00Z/P1M"          # Out-of-range hour
     "2019-10-01T24:00:01Z/P1M"          # Hour 24 with anything but :00:00
     "PT5H/20191001T007000Z"             # Out-of-range minute
     "2019-10-01 00:00:80Z/P1M"          # Out-of-range second
     "2019-10-01 00:00:10 +25:00/P1M"    # Out-of-range offset hour
     "20191001T000010 -00:61/P1M"        # Out-of-range offset minute
     "P1Y/2019-02-29 00:00:00Z"          # Feb. 29 in non-leap-year
     "2019-01-01 00:00:00Z/P"            # Duration with no values
     "P1Z/2019-02-20 00:00:00Z"          # Invalid duration unit
     "P1YM/2019-02-20 00:00:00Z"         # No number for duration unit
 )
 
 function test_dates() {
     # Ensure invalid period specifications are rejected
     for spec in '' "${INVALID_PERIODS[@]}"; do
         desc="Invalid period - [$spec]"
         cmd="iso8601 -p \"$spec\""
         test_assert $CRM_EX_INVALID_PARAM 0
     done
 
     desc="2014-01-01 00:30:00 - 1 Hour"
     cmd="iso8601 -d '2014-01-01 00:30:00Z' -D P-1H -E '2013-12-31 23:30:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="Valid date - Feb 29 in leap year"
     cmd="iso8601 -d '2020-02-29 00:00:00Z' -E '2020-02-29 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="Valid date - using 'T' and offset"
     cmd="iso8601 -d '20191201T131211 -05:00' -E '2019-12-01 18:12:11Z'"
     test_assert $CRM_EX_OK 0
 
     desc="24:00:00 equivalent to 00:00:00 of next day"
     cmd="iso8601 -d '2019-12-31 24:00:00Z' -E '2020-01-01 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     for y in 06 07 08 09 10 11 12 13 14 15 16 17 18 40; do
         desc="20$y-W01-7"
         cmd="iso8601 -d '20$y-W01-7 00Z'"
         test_assert $CRM_EX_OK 0
 
         desc="20$y-W01-7 - round-trip"
         cmd="iso8601 -d '20$y-W01-7 00Z' -W -E '20$y-W01-7 00:00:00Z'"
         test_assert $CRM_EX_OK 0
 
         desc="20$y-W01-1"
         cmd="iso8601 -d '20$y-W01-1 00Z'"
         test_assert $CRM_EX_OK 0
 
         desc="20$y-W01-1 - round-trip"
         cmd="iso8601 -d '20$y-W01-1 00Z' -W -E '20$y-W01-1 00:00:00Z'"
         test_assert $CRM_EX_OK 0
     done
 
     desc="2009-W53-07"
     cmd="iso8601 -d '2009-W53-7 00:00:00Z' -W -E '2009-W53-7 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="epoch + 2 Years 5 Months 6 Minutes"
     cmd="iso8601 -d 'epoch' -D P2Y5MT6M -E '1972-06-01 00:06:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-01-31 + 1 Month"
     cmd="iso8601 -d '20090131T000000Z' -D P1M -E '2009-02-28 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-01-31 + 2 Months"
     cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P2M -E '2009-03-31 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-01-31 + 3 Months"
     cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P3M -E '2009-04-30 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2009-03-31 - 1 Month"
     cmd="iso8601 -d '2009-03-31 01:00:00 +01:00' -D P-1M -E '2009-02-28 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 
     desc="2038-01-01 + 3 Months"
     cmd="iso8601 -d '2038-01-01 00:00:00Z' -D P3M -E '2038-04-01 00:00:00Z'"
     test_assert $CRM_EX_OK 0
 }
 
 function test_acl_loop() {
     local TMPXML
 
     TMPXML="$1"
 
     # Make sure we're rejecting things for the right reasons
     orig_trace_fns="$PCMK_trace_functions"
     export PCMK_trace_functions=pcmk__check_acl,pcmk__apply_creation_acl
 
     CIB_user=root cibadmin --replace --xml-text '<resources/>'
 
     ### no ACL ###
     export CIB_user=unknownguy
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set enable-acl"
     cmd="crm_attribute -n enable-acl -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### deny /cib permission ###
     export CIB_user=l33t-haxor
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set enable-acl"
     cmd="crm_attribute -n enable-acl -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### observer role ###
     export CIB_user=niceguy
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     desc="$CIB_user: Set enable-acl"
     cmd="crm_attribute -n enable-acl -v false"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     export CIB_user=root
     desc="$CIB_user: Query configuration"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     desc="$CIB_user: Set stonith-enabled"
     cmd="crm_attribute -n stonith-enabled -v true"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Create a resource"
     cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
     test_assert $CRM_EX_OK
 
     ### deny /cib permission ###
     export CIB_user=l33t-haxor
 
     desc="$CIB_user: Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Query a resource meta attribute"
     cmd="crm_resource -r dummy --meta -g target-role"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     desc="$CIB_user: Remove a resource meta attribute"
     cmd="crm_resource -r dummy --meta -d target-role"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### observer role ###
     export CIB_user=niceguy
 
     desc="$CIB_user: Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Query a resource meta attribute"
     cmd="crm_resource -r dummy --meta -g target-role"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Remove a resource meta attribute"
     cmd="crm_resource -r dummy --meta -d target-role"
     test_assert $CRM_EX_OK
 
     desc="$CIB_user: Create a resource meta attribute"
     cmd="crm_resource -r dummy --meta -p target-role -v Started"
     test_assert $CRM_EX_OK
 
     ### read //meta_attributes ###
     export CIB_user=badidea
     desc="$CIB_user: Query configuration - implied deny"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     ### deny /cib, read //meta_attributes ###
     export CIB_user=betteridea
     desc="$CIB_user: Query configuration - explicit deny"
     cmd="cibadmin -Q"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --delete --xml-text '<acls/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     ### observer role ###
     export CIB_user=niceguy
     desc="$CIB_user: Replace - remove acls"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create resource"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" crm_attribute -n enable-acl -v false
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (deny)"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace --xml-text '<nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (deny)"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (deny)"
     cmd="cibadmin --replace --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     ### admin role ###
     CIB_user=bob
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (direct allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (direct allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (direct allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     ### super_user role ###
     export CIB_user=joe
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (inherited allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (inherited allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (inherited allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     ### rsc_writer role ###
     export CIB_user=mike
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (allow overrides deny)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (allow overrides deny)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (allow overrides deny)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK 0
 
     ### rsc_denied role ###
     export CIB_user=chris
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - create attribute (deny overrides allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     # Set as root since setting as chris failed
     CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - modify attribute (deny overrides allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     # Set as root since setting as chris failed
     CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
 
     CIB_user=root cibadmin -Q > "$TMPXML"
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
     CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
 
     desc="$CIB_user: Replace - delete attribute (deny overrides allow)"
     cmd="cibadmin --replace -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_INSUFFICIENT_PRIV 0
 
     export PCMK_trace_functions="$orig_trace_fns"
 }
 
 function test_acls() {
     local SHADOWPATH
     local TMPXML
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.acls.xml.XXXXXXXXXX)
 
     create_shadow_cib --create-empty pacemaker-1.3
 
     cat <<EOF > "$TMPXML"
     <acls>
       <acl_user id="l33t-haxor">
         <deny id="crook-nothing" xpath="/cib"/>
       </acl_user>
       <acl_user id="niceguy">
         <role_ref id="observer"/>
       </acl_user>
       <acl_user id="bob">
         <role_ref id="admin"/>
       </acl_user>
       <acl_user id="joe">
         <role_ref id="super_user"/>
       </acl_user>
       <acl_user id="mike">
         <role_ref id="rsc_writer"/>
       </acl_user>
       <acl_user id="chris">
         <role_ref id="rsc_denied"/>
       </acl_user>
       <acl_role id="observer">
         <read id="observer-read-1" xpath="/cib"/>
         <write id="observer-write-1" xpath="//nvpair[@name=&apos;stonith-enabled&apos;]"/>
         <write id="observer-write-2" xpath="//nvpair[@name=&apos;target-role&apos;]"/>
       </acl_role>
       <acl_role id="admin">
         <read id="admin-read-1" xpath="/cib"/>
         <write id="admin-write-1" xpath="//resources"/>
       </acl_role>
       <acl_role id="super_user">
         <write id="super_user-write-1" xpath="/cib"/>
       </acl_role>
       <acl_role id="rsc_writer">
         <deny id="rsc-writer-deny-1" xpath="/cib"/>
         <write id="rsc-writer-write-1" xpath="//resources"/>
       </acl_role>
       <acl_role id="rsc_denied">
         <write id="rsc-denied-write-1" xpath="/cib"/>
         <deny id="rsc-denied-deny-1" xpath="//resources"/>
       </acl_role>
     </acls>
 EOF
 
     desc="Configure some ACLs"
     cmd="cibadmin -M -o acls --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Enable ACLs"
     cmd="crm_attribute -n enable-acl -v true"
     test_assert $CRM_EX_OK
 
     desc="Set cluster option"
     cmd="crm_attribute -n no-quorum-policy -v ignore"
     test_assert $CRM_EX_OK
 
     desc="New ACL"
     cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"badidea\"><read id=\"badidea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
     test_assert $CRM_EX_OK
 
     desc="Another ACL"
     cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"betteridea\"><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
     test_assert $CRM_EX_OK
 
     desc="Updated ACL"
     cmd="cibadmin --replace -o acls --xml-text '<acl_user id=\"betteridea\"><deny id=\"betteridea-nothing\" xpath=\"/cib\"/><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
     test_assert $CRM_EX_OK
 
     test_acl_loop "$TMPXML"
 
     printf "\n\n    !#!#!#!#! Upgrading to latest CIB schema and re-testing !#!#!#!#!\n"
     printf "\nUpgrading to latest CIB schema and re-testing\n" 1>&2
 
     export CIB_user=root
     desc="$CIB_user: Upgrade to latest CIB schema"
     cmd="cibadmin --upgrade --force -V"
     test_assert $CRM_EX_OK
 
     reset_shadow_cib_version
 
     test_acl_loop "$TMPXML"
 
     unset CIB_shadow_dir
     rm -f "$TMPXML"
 }
 
 function test_validity() {
     local TMPGOOD
     local TMPBAD
 
     TMPGOOD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.good.xml.XXXXXXXXXX)
     TMPBAD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.bad.xml.XXXXXXXXXX)
 
     create_shadow_cib --create-empty pacemaker-1.2
     orig_trace_fns="$PCMK_trace_functions"
     export PCMK_trace_functions=apply_upgrade,update_validation
 
     cibadmin -C -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
     cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
     cibadmin -C -o constraints --xml-text '<rsc_order id="ord_1-2" first="dummy1" first-action="start" then="dummy2"/>'
     cibadmin -Q > "$TMPGOOD"
 
 
     desc="Try to make resulting CIB invalid (enum violation)"
     cmd="cibadmin -M -o constraints --xml-text '<rsc_order id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" then=\"dummy2\"/>'"
     test_assert $CRM_EX_CONFIG
 
     sed 's|"start"|"break"|' "$TMPGOOD" > "$TMPBAD"
     desc="Run crm_simulate with invalid CIB (enum violation)"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_CONFIG 0
 
 
     desc="Try to make resulting CIB invalid (unrecognized validate-with)"
     cmd="cibadmin -M --xml-text '<cib validate-with=\"pacemaker-9999.0\"/>'"
     test_assert $CRM_EX_CONFIG
 
     sed 's|"pacemaker-1.2"|"pacemaker-9999.0"|' "$TMPGOOD" > "$TMPBAD"
     desc="Run crm_simulate with invalid CIB (unrecognized validate-with)"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_CONFIG 0
 
 
     desc="Try to make resulting CIB invalid, but possibly recoverable (valid with X.Y+1)"
     cmd="cibadmin -C -o configuration --xml-text '<tags/>'"
     test_assert $CRM_EX_CONFIG
 
     sed 's|</configuration>|<tags/></configuration>|' "$TMPGOOD" > "$TMPBAD"
     desc="Run crm_simulate with invalid, but possibly recoverable CIB (valid with X.Y+1)"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_OK 0
 
 
     sed 's|[ 	][ 	]*validate-with="[^"]*"||' "$TMPGOOD" > "$TMPBAD"
     desc="Make resulting CIB valid, although without validate-with attribute"
     cmd="cibadmin -R --xml-file $TMPBAD"
     test_assert $CRM_EX_OK
 
     desc="Run crm_simulate with valid CIB, but without validate-with attribute"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_OK 0
 
 
     # this will just disable validation and accept the config, outputting
     # validation errors
     sed -e 's|[ 	][ 	]*validate-with="[^"]*"||' \
         -e 's|\([ 	][ 	]*epoch="[^"]*\)"|\10"|' -e 's|"start"|"break"|' \
         "$TMPGOOD" > "$TMPBAD"
     desc="Make resulting CIB invalid, and without validate-with attribute"
     cmd="cibadmin -R --xml-file $TMPBAD"
     test_assert $CRM_EX_OK
 
     desc="Run crm_simulate with invalid CIB, also without validate-with attribute"
     cmd="crm_simulate -x $TMPBAD -S"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
     rm -f "$TMPGOOD" "$TMPBAD"
     export PCMK_trace_functions="$orig_trace_fns"
 }
 
 test_upgrade() {
     local TMPXML
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
 
     create_shadow_cib --create-empty pacemaker-2.10
     orig_trace_fns="$PCMK_trace_functions"
     export PCMK_trace_functions=apply_upgrade,update_validation
 
     desc="Set stonith-enabled=false"
     cmd="crm_attribute -n stonith-enabled -v false"
     test_assert $CRM_EX_OK
 
     cat <<EOF > "$TMPXML"
     <resources>
       <primitive id="mySmartFuse" class="ocf" provider="experiment" type="SmartFuse">
         <operations>
           <op id="mySmartFuse-start" name="start" interval="0" timeout="40s"/>
           <op id="mySmartFuse-monitor-inputpower" name="monitor" interval="30s">
             <instance_attributes id="mySmartFuse-inputpower-instanceparams">
               <nvpair id="mySmartFuse-inputpower-requires" name="requires" value="inputpower"/>
             </instance_attributes>
           </op>
           <op id="mySmartFuse-monitor-outputpower" name="monitor" interval="2s">
             <instance_attributes id="mySmartFuse-outputpower-instanceparams">
               <nvpair id="mySmartFuse-outputpower-requires" name="requires" value="outputpower"/>
             </instance_attributes>
           </op>
         </operations>
         <instance_attributes id="mySmartFuse-params">
           <nvpair id="mySmartFuse-params-ip" name="ip" value="192.0.2.10"/>
         </instance_attributes>
 	<!-- a bit hairy but valid -->
         <instance_attributes id-ref="mySmartFuse-outputpower-instanceparams"/>
       </primitive>
     </resources>
 EOF
 
     desc="Configure the initial resource"
     cmd="cibadmin -M -o resources --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Upgrade to latest CIB schema (trigger 2.10.xsl + the wrapping)"
     cmd="cibadmin --upgrade --force -V -V"
     test_assert $CRM_EX_OK
 
     desc="Query a resource instance attribute (shall survive)"
     cmd="crm_resource -r mySmartFuse -g requires"
     test_assert $CRM_EX_OK
 
     unset CIB_shadow_dir
     rm -f "$TMPXML"
     export PCMK_trace_functions="$orig_trace_fns"
 }
 
 test_rules() {
     local TMPXML
 
     create_shadow_cib --create-empty
 
     cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'
     cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-too-many-date-expressions" rsc="dummy">
   <rule id="cli-rule-too-many-date-expressions" score="INFINITY" boolean-op="or">
     <date_expression id="cli-date-expression-1" operation="gt" start="2020-01-01 01:00:00 -0500"/>
     <date_expression id="cli-date-expression-2" operation="lt" end="2019-01-01 01:00:00 -0500"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-expired" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-expired" score="INFINITY">
     <date_expression id="cli-prefer-lifetime-end-dummy-expired" operation="lt" end="2019-01-01 12:00:00 -05:00"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     if [ "$(uname)" == "FreeBSD" ]; then
         tomorrow=$(date -v+1d +"%F %T %z")
     else
         tomorrow=$(date --date=tomorrow +"%F %T %z")
     fi
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-not-yet" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-not-yet" score="INFINITY">
     <date_expression id="cli-prefer-lifetime-end-dummy-not-yet" operation="gt" start="${tomorrow}"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-date_spec-only-years" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-date_spec-only-years" score="INFINITY">
     <date_expression id="cli-prefer-dummy-date_spec-only-years-expr" operation="date_spec">
       <date_spec id="cli-prefer-dummy-date_spec-only-years-spec" years="2019"/>
     </date_expression>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-date_spec-without-years" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-date_spec-without-years" score="INFINITY">
     <date_expression id="cli-prefer-dummy-date_spec-without-years-expr" operation="date_spec">
       <date_spec id="cli-prefer-dummy-date_spec-without-years-spec" hours="20" months="1,3,5,7"/>
     </date_expression>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-prefer-dummy-date_spec-years-moon" rsc="dummy">
   <rule id="cli-prefer-rule-dummy-date_spec-years-moon" score="INFINITY">
     <date_expression id="cli-prefer-dummy-date_spec-years-moon-expr" operation="date_spec">
       <date_spec id="cli-prefer-dummy-date_spec-years-moon-spec" years="2019" moon="1"/>
     </date_expression>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
     cat <<EOF > "$TMPXML"
 <rsc_location id="cli-no-date_expression" rsc="dummy">
   <rule id="cli-no-date_expression-rule" score="INFINITY">
     <expression id="ban-apache-expr" attribute="#uname" operation="eq" value="node3"/>
   </rule>
 </rsc_location>
 EOF
 
     cibadmin -C -o constraints -x "$TMPXML"
     rm -f "$TMPXML"
 
     desc="crm_rule given no arguments"
     cmd="crm_rule"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_rule given no arguments (XML)"
     cmd="crm_rule --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="crm_rule given no rule to check"
     cmd="crm_rule -c"
     test_assert $CRM_EX_USAGE 0
 
     desc="crm_rule given no rule to check (XML)"
     cmd="crm_rule -c --output-as=xml"
     test_assert_validate $CRM_EX_USAGE 0
 
     desc="crm_rule given invalid input XML"
     cmd="crm_rule -c -r blahblah -X 'invalidxml'"
     test_assert $CRM_EX_DATAERR 0
 
     desc="crm_rule given invalid input XML (XML)"
     cmd="crm_rule -c -r blahblah -X 'invalidxml' --output-as=xml"
     test_assert_validate $CRM_EX_DATAERR 0
 
     desc="crm_rule given invalid input XML on stdin"
     cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X -"
     test_assert $CRM_EX_DATAERR 0
 
     desc="crm_rule given invalid input XML on stdin (XML)"
     cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X - --output-as=xml"
     test_assert_validate $CRM_EX_DATAERR 0
 
     desc="Try to check a rule that doesn't exist"
     cmd="crm_rule -c -r blahblah"
     test_assert $CRM_EX_NOSUCH
 
     desc="Try to check a rule that doesn't exist, with XML output"
     cmd="crm_rule -c -r blahblah --output-as=xml"
     test_assert_validate $CRM_EX_NOSUCH 0
 
     desc="Try to check a rule that has too many date_expressions"
     cmd="crm_rule -c -r cli-rule-too-many-date-expressions"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule that has too many date_expressions (XML)"
     cmd="crm_rule -c -r cli-rule-too-many-date-expressions --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Verify basic rule is expired"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired"
     test_assert $CRM_EX_EXPIRED 0
 
     desc="Verify basic rule is expired, with XML output"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired --output-as=xml"
     test_assert_validate $CRM_EX_EXPIRED 0
 
     desc="Verify basic rule worked in the past"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101"
     test_assert $CRM_EX_OK 0
 
     desc="Verify basic rule worked in the past (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Verify basic rule is not yet in effect"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet"
     test_assert $CRM_EX_NOT_YET_IN_EFFECT 0
 
     desc="Verify basic rule is not yet in effect (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet --output-as=xml"
     test_assert_validate $CRM_EX_NOT_YET_IN_EFFECT 0
 
     desc="Verify date_spec rule with years has expired"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years"
     test_assert $CRM_EX_EXPIRED 0
 
     desc="Verify date_spec rule with years has expired (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
     test_assert_validate $CRM_EX_EXPIRED 0
 
     desc="Verify multiple rules at once"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years"
     test_assert $CRM_EX_EXPIRED 0
 
     desc="Verify multiple rules at once, with XML output"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
     test_assert_validate $CRM_EX_EXPIRED 0
 
     desc="Verify date_spec rule with years is in effect"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201"
     test_assert $CRM_EX_OK 0
 
     desc="Verify date_spec rule with years is in effect (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 --output-as=xml"
     test_assert_validate $CRM_EX_OK 0
 
     desc="Try to check a rule whose date_spec does not contain years="
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule whose date_spec does not contain years= (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule whose date_spec contains years= and moon="
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule whose date_spec contains years= and moon= (XML)"
     cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule with no date_expression"
     cmd="crm_rule -c -r cli-no-date_expression-rule"
     test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     desc="Try to check a rule with no date_expression (XML)"
     cmd="crm_rule -c -r cli-no-date_expression-rule --output-as=xml"
     test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
 
     unset CIB_shadow_dir
 }
 
 # Ensure all command output is in portable locale for comparison
 export LC_ALL="C"
 test_access_render() {
     local TMPXML
 
     TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.access_render.xml.XXXXXXXXXX)
     export CIB_shadow_dir="${shadow_dir}"
 
     $VALGRIND_CMD crm_shadow --batch --force --create-empty $shadow 2>&1
     export CIB_shadow=$shadow
 
     # Create a test CIB that has ACL roles
     cat <<EOF > "$TMPXML"
     <acls>
       <acl_role id="role-deny-acls">
         <acl_permission id="deny-acls" kind="deny" xpath="/cib/configuration/acls"/>
         <acl_permission id="read-rest" kind="read" xpath="/cib"/>
       </acl_role>
       <acl_target id="tony">
         <role id="role-deny-acls"/>
       </acl_target>
     </acls>
 EOF
 
     desc="Configure some ACLs"
     cmd="cibadmin -M -o acls --xml-file $TMPXML"
     test_assert $CRM_EX_OK
 
     desc="Enable ACLs"
     cmd="crm_attribute -n enable-acl -v true"
     test_assert $CRM_EX_OK
 
     unset CIB_user
 
     # Run cibadmin --show-access on the test CIB with different users (tony here)
 
     desc="An instance of ACLs render (into color)"
     cmd="cibadmin --force --show-access=color -Q --user tony"
     test_assert $CRM_EX_OK 0
 
     desc="An instance of ACLs render (into namespacing)"
     cmd="cibadmin --force --show-access=namespace -Q --user tony"
     test_assert $CRM_EX_OK 0
 
     desc="An instance of ACLs render (into text)"
     cmd="cibadmin --force --show-access=text -Q --user tony"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
     rm -f "$TMPXML"
 }
 
 function test_feature_set() {
     create_shadow_cib --create-empty
 
     # Import the initial test CIB with non-mixed versions
     desc="Import the test CIB"
     cmd="cibadmin --replace --xml-file $test_home/cli/crm_mon-feature_set.xml"
     test_assert $CRM_EX_OK
 
     desc="Complete text output, no mixed status"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, no mixed status"
     cmd="crm_mon --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     # Modify the CIB to fake that the cluster has mixed versions
     desc="Fake inconsistent feature set"
     cmd="crm_attribute --node=cluster02 --name=#feature-set --update=3.15.0 --lifetime=reboot"
     test_assert $CRM_EX_OK
 
     desc="Complete text output, mixed status"
     cmd="crm_mon -1 --show-detail"
     test_assert $CRM_EX_OK 0
 
     desc="XML output, mixed status"
     cmd="crm_mon --output-as=xml"
     test_assert $CRM_EX_OK 0
 
     unset CIB_shadow_dir
 }
 
 # Process command-line arguments
 while [ $# -gt 0 ]; do
     case "$1" in
         -t)
             tests="$2"
             shift 2
             ;;
         -V|--verbose)
             verbose=1
             shift
             ;;
         -v|--valgrind)
             export G_SLICE=always-malloc
             VALGRIND_CMD="valgrind $VALGRIND_OPTS"
             shift
             ;;
         -s)
             do_save=1
             shift
             ;;
         -p)
             export PATH="$2:$PATH"
             shift
             ;;
         --help)
             echo "$USAGE_TEXT"
             exit $CRM_EX_OK
             ;;
         *)
             echo "error: unknown option $1"
             echo
             echo "$USAGE_TEXT"
             exit $CRM_EX_USAGE
             ;;
     esac
 done
 
 for t in $tests; do
     case "$t" in
         agents) ;;
         daemons) ;;
         dates) ;;
         error_codes) ;;
         tools) ;;
         acls) ;;
         validity) ;;
         upgrade) ;;
         rules) ;;
         crm_mon) ;;
         feature_set) ;;
         *)
             echo "error: unknown test $t"
             echo
             echo "$USAGE_TEXT"
             exit $CRM_EX_USAGE
             ;;
     esac
 done
 
 XMLLINT_CMD=$(which xmllint 2>/dev/null)
 if [ $? -ne 0 ]; then
     XMLLINT_CMD=""
     echo "xmllint is missing - install it to validate command output"
 fi
 
 # Check whether we're running from source directory
 SRCDIR=$(dirname $test_home)
 if [ -x "$SRCDIR/tools/crm_simulate" ]; then
     path_dirs="$SRCDIR/tools"
     for daemon in based controld fenced schedulerd; do
         if [ -x "$SRCDIR/daemons/$daemon/pacemaker-${daemon}" ]; then
             path_dirs="$path_dirs:$SRCDIR/daemons/$daemon"
         fi
     done
     export PATH="$path_dirs:$PATH"
 
     echo "Using local binaries from: ${path_dirs//:/ }"
 
     if [ -x "$SRCDIR/xml" ]; then
         export PCMK_schema_directory="$SRCDIR/xml"
         echo "Using local schemas from: $PCMK_schema_directory"
     fi
 else
     export PATH="@CRM_DAEMON_DIR@:$PATH"
     export PCMK_schema_directory=@CRM_SCHEMA_DIRECTORY@
 fi
 
 for t in $tests; do
     echo "Testing $t"
     TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.$t.XXXXXXXXXX)
     eval TMPFILE_$t="$TMPFILE"
     test_$t > "$TMPFILE"
 
     # last-rc-change= is always numeric in the CIB. However, for the crm_mon
     # test we also need to compare against the XML output of the crm_mon
     # program. There, these are shown as human readable strings (like the
     # output of the `date` command).
     sed -e 's|\(<cib.*\) cib-last-written[^/]*/>|\1/>|' \
         -e 's|\(<cib.*\) cib-last-written[^/]*>|\1>|' \
         -e 's/Last updated: .*/Last updated:/' \
         -e 's/Last change: .*/Last change:/' \
         -e 's/(version .*)/(version)/' \
         -e 's/last_update time=\".*\"/last_update time=\"\"/' \
         -e 's/last_change time=\".*\"/last_change time=\"\"/' \
         -e 's/ api-version="[^"]*"/ api-version="X"/' \
         -e 's/ default="[^"]*"/ default=""/' \
         -e 's/ version="[^"]*"/ version=""/' \
         -e 's/request=\".*\(crm_[a-zA-Z0-9]*\)/request=\"\1/' \
         -e 's/crm_feature_set="[^"]*" //'\
         -e 's/validate-with="[^"]*" //'\
         -e 's/Created new pacemaker-.* configuration/Created new pacemaker configuration/'\
         -e 's/.*\(crm_time_parse_duration\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(crm_time_parse_period\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(crm_time_parse_sec\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(log_xmllib_err\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(parse_date\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(pcmk__.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(unpack_.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(update_validation\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e 's/.*\(apply_upgrade\)@.*\.c:[0-9][0-9]*)/\1/g' \
         -e "s/ last-rc-change=['\"][-+A-Za-z0-9: ]*['\"],\{0,1\}//" \
         -e 's|^/tmp/cts-cli\.shadow\.[^/]*/|/tmp/cts-cli.shadow/|' \
         -e 's|"/tmp/cts-cli\.shadow\.[^/]*/|"/tmp/cts-cli.shadow/|' \
         -e 's|^/tmp/cts-cli\.validity\.bad.xml\.[^:]*:|validity.bad.xml:|'\
         -e 's/^Entity: line [0-9][0-9]*: //'\
         -e 's/\(validation ([0-9][0-9]* of \)[0-9][0-9]*\().*\)/\1X\2/' \
         -e 's/^Migration will take effect until: .*/Migration will take effect until:/' \
         -e 's/ end=\"[0-9][-+: 0-9]*Z*\"/ end=\"\"/' \
         -e 's/ start=\"[0-9][-+: 0-9]*Z*\"/ start=\"\"/' \
         -e 's/Device not configured/No such device or address/' \
         -e 's/\(Injecting attribute last-failure-ping#monitor_10000=\)[0-9]*/\1/' \
         -e 's/^lt-//' \
         -e 's/ocf::/ocf:/' \
         -e 's/Masters:/Promoted:/' \
         -e 's/Slaves:/Unpromoted:/' \
         -e 's/Master/Promoted/' \
         -e 's/Slave/Unpromoted/' \
         -e 's/\x1b/\\x1b/' \
         "$TMPFILE" > "${TMPFILE}.$$"
     mv -- "${TMPFILE}.$$" "$TMPFILE"
 
     if [ $do_save -eq 1 ]; then
         cp "$TMPFILE" $test_home/cli/regression.$t.exp
     fi
 done
 
 rm -rf "${shadow_dir}"
 rm -f "${test_assert_outfile}"
 rm -f "${test_assert_errfile}"
 rm -f "${xmllint_outfile}"
 
 failed=0
 
 if [ $verbose -eq 1 ]; then
     echo -e "\n\nResults"
 fi
 for t in $tests; do
     eval TMPFILE="\$TMPFILE_$t"
     if [ $verbose -eq 1 ]; then
         diff -wu $test_home/cli/regression.$t.exp "$TMPFILE"
     else
         diff -w $test_home/cli/regression.$t.exp "$TMPFILE" >/dev/null 2>&1
     fi
     if [ $? -ne 0 ]; then
         failed=1
     fi
 done
 
 echo -e "\n\nSummary"
 for t in $tests; do
     eval TMPFILE="\$TMPFILE_$t"
     grep -e '^\* \(Passed\|Failed\)' "$TMPFILE"
 done
 
 function print_or_remove_file() {
 
   eval TMPFILE="\$TMPFILE_$1"
   if [[ ! $(diff -wq $test_home/cli/regression.$1.exp "$TMPFILE") ]]; then
     rm -f "$TMPFILE"
   else
     echo "    $TMPFILE"
+    if [ $verbose -ne 0 ]; then
+      echo "======================================================"
+      cat "$TMPFILE"
+      echo "======================================================"
+    fi
   fi
 }
 
 if [ $num_errors -ne 0 ] && [ $failed -ne 0 ]; then
     echo "$num_errors tests failed; see output in:"
     for t in $tests; do
       print_or_remove_file "$t"
     done
     exit $CRM_EX_ERROR
 elif [ $num_errors -ne 0 ]; then
     echo "$num_errors tests failed"
     for t in $tests; do
       print_or_remove_file "$t"
     done
     exit $CRM_EX_ERROR
 elif [ $failed -eq 1 ]; then
     echo "$num_passed tests passed but output was unexpected; see output in:"
     for t in $tests; do
       print_or_remove_file "$t"
     done
     exit $CRM_EX_DIGEST
 else
     echo $num_passed tests passed
     for t in $tests; do
         eval TMPFILE="\$TMPFILE_$t"
         rm -f "$TMPFILE"
     done
     crm_shadow --force --delete $shadow >/dev/null 2>&1
     exit $CRM_EX_OK
 fi