* doc/tools.texinfo: Add file from trunk.NATIVE-LAYER

        * native/jni/Makefile.am (DIST_SUBDIRS): Add native-lib.
        * native/jni/java-io/java_io_VMFile.c: Include lstat and readlink
        headers.
        * native/jni/java-lang/java_lang_VMProcess.c
        (Java_java_lang_VMProcess_nativeSpawn): Remove redirect argument.
        * native/jni/java-net/java_net_VMInetAddress.c
        (Java_java_net_VMInetAddress_getHostByName): Remove unused variable.
        * native/jni/native-lib/Makefile.am: Remove empty and nonexisting
        files.
        * native/jni/native-lib/cpio.c (cpio_setFileReadonly): Use correct
        mask.
        * native/jni/native-lib/cpnet.c (cpnet_connect): Removed unused
        theaddr.
        * native/jni/native-lib/cpnet.h (cpnet_freeAddresses): Moved from
        cpnet.h.
        * native/jni/native-lib/cpnet.h (cpnet_freeAddresses): Declare,
        don't implement.
        * vm/reference/java/lang/VMProcess.java: Removed unused redirect
        argument.
        * include/java_lang_VMProcess.h: Regenerated.

12 files changed, 1257 insertions, 29 deletions

diff --git a/ChangeLog.native b/ChangeLog.native
index 818ca64fd..e2084c5da 100644
--- a/ChangeLog.native
+++ b/ChangeLog.native
@@ -1,3 +1,27 @@
+2006-08-20  Mark Wielaard  <mark@klomp.org>
+
+	* doc/tools.texinfo: Add file from trunk.
+	* native/jni/Makefile.am (DIST_SUBDIRS): Add native-lib.
+	* native/jni/java-io/java_io_VMFile.c: Include lstat and readlink
+	headers.
+	* native/jni/java-lang/java_lang_VMProcess.c
+	(Java_java_lang_VMProcess_nativeSpawn): Remove redirect argument.
+	* native/jni/java-net/java_net_VMInetAddress.c
+	(Java_java_net_VMInetAddress_getHostByName): Remove unused variable.
+	* native/jni/native-lib/Makefile.am: Remove empty and nonexisting
+	files.
+	* native/jni/native-lib/cpio.c (cpio_setFileReadonly): Use correct
+	mask.
+	* native/jni/native-lib/cpnet.c (cpnet_connect): Removed unused
+	theaddr.
+	* native/jni/native-lib/cpnet.h (cpnet_freeAddresses): Moved from
+	cpnet.h.
+	* native/jni/native-lib/cpnet.h (cpnet_freeAddresses): Declare,
+	don't implement.
+	* vm/reference/java/lang/VMProcess.java: Removed unused redirect
+	argument.
+	* include/java_lang_VMProcess.h: Regenerated.
+	
 2006-08-14  Guilhem Lavaux  <guilhem@kaffe.org>
 	
 	* Merged HEAD as of 2006-08-14 0:00.
diff --git a/doc/tools.texinfo b/doc/tools.texinfo
new file mode 100644
index 000000000..28252cdc8
--- /dev/null
+++ b/doc/tools.texinfo
@@ -0,0 +1,1206 @@
+\input texinfo @c -*-texinfo-*-
+
+@c %**start of header
+@setfilename tools.info
+@settitle GNU Classpath Tools Guide
+@c %**end of header
+
+@setchapternewpage on
+
+@ifinfo
+This file documents the Tools included in a standard distribution of the GNU
+Classpath project deliverables.
+
+Copyright (C) 2006 Free Software Foundation, Inc.
+
+@ifnotplaintext
+@dircategory GNU Libraries
+@direntry
+* Classpath Tools: (tools).       GNU Classpath Tools Guide
+@end direntry
+@end ifnotplaintext
+@end ifinfo
+
+@titlepage
+@title GNU Classpath Tools Guide
+@author The GNU Classpath Team
+
+@page
+@vskip 0pt plus 1filll
+Copyright @copyright{} 2006 Free Software Foundation, Inc.
+@sp 2
+Permission is granted to make and distribute verbatim copies of this document provided the copyright notice and this permission notice are preserved on all copies.
+
+Permission is granted to copy and distribute modified versions of this document under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.
+
+Permission is granted to copy and distribute translations of this manual into another language, under the above conditions for modified versions, except that this permission notice may be stated in a translation approved by the Free Software Foundation.
+
+@end titlepage
+
+@contents
+
+@ifinfo
+@node Top, Applet Tools, (dir), (dir)
+@top GNU Classpath Tools Guide
+
+This document contains important information you need to know in order to use
+the tools included in the GNU Classpath project deliverables.
+
+The Tools aim at providing a free replacement, similar in their behavior, to
+their counter-parts found in the Reference Implementation (RI) of the Java
+Software Development Kit (SDK).
+
+@end ifinfo
+
+@menu
+* Applet Tools::               Work with applets
+* Security Tools::             Work securely with Java applications
+* I18N Issues::                How to add support for non-English languages
+
+@detailmenu
+ --- The Detailed Node Listing ---
+
+Applet Tools
+
+* appletviewer Tool::          Load applets
+* gcjwebplugin::               Load applets in a web browser
+
+Security Tools
+
+* jarsigner Tool::             Sign and verify .JAR files
+* keytool Tool::               Manage private keys and public certificates
+
+jarsigner Tool
+
+* Common jarsigner Options::   Options used when signing or verifying a file
+* Signing Options::            Options only used when signing a .JAR file
+* Verification Options::       Options only used when verifying a .JAR file
+
+keytool Tool
+
+* Getting Help::               How to get help with keytool commands
+* Common keytool Options::     Options used in more than one command
+* Distinguished Names::        X.500 Distinguished Names used in certificates
+* Add/Update Commands::        Commands for adding data to a Key Store
+* Export Commands::            Commands for exporting data from a Key Store
+* Display Commands::           Commands for displaying data in a Key Store
+* Management Commands::        Commands for managing a Key Store
+
+Add/Update Commands
+
+* Command -genkey::            Generate private key and self-signed certificate
+* Command -import::            Import certificates and certificate replies
+* Command -selfcert::          Generate self-signed certificate
+* Command -cacert::            Import a CA Trusted Certificate
+* Command -identitydb::        Import JDK-1 style identities
+
+Export Commands
+
+* Command -certreq::           Generate Certificate Signing Requests (CSR)
+* Command -export::            Export a certificate in a Key Store
+
+Display Commands
+
+* Command -list::              Display information about one or all Aliases
+* Command -printcert::         Print a certificate or a certificate fingerprint
+
+Management Commands
+
+* Command -keyclone::          Clone a Key Entry in a Key Store
+* Command -storepasswd::       Change the password protecting a Key Store
+* Command -keypasswd::         Change the password protecting a Key Entry
+* Command -delete::            Remove an entry in a Key Store
+
+I18N Issues
+
+* Language Resources::         Where resources are located
+* Message Formats::            How messages are internationalized
+
+@end detailmenu
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Applet Tools, Security Tools, Top, Top
+@comment node-name, next, previous, up
+@chapter Applet Tools
+
+Two Applet Tools are available with GNU Classpath: @b{appletviewer}
+and @b{gcjwebplugin}.
+
+To avoid conflicts with other implementations, the appletviewer
+executable is called ``gappletviewer''.
+
+@menu
+* appletviewer Tool::          Load applets
+* gcjwebplugin::               Load applets in a web browser
+@end menu
+
+If while using these tools you think you found a bug, then please report it at @uref{http://www.gnu.org/software/classpath/bugs.html,classpath-bugs}.
+
+@comment ----------------------------------------------------------------------
+
+@node appletviewer Tool, gcjwebplugin, Applet Tools, Applet Tools
+@comment node-name, next, previous, up
+@section The @code{appletviewer} Tool
+
+@table @b
+
+@item SYNOPSIS
+@code{appletviewer [OPTION]... URL...}@*
+@code{appletviewer [OPTION]... -code CODE}@*
+@code{appletviewer [OPTION]... -plugin INPUT,OUTPUT}
+
+@item DESCRIPTION
+The @code{appletviewer} tool loads and runs an applet.
+
+Use the first form to test applets specified by tag.  The URL should
+resolve to an HTML document from which the @code{appletviewer} will
+extract applet tags.  The APPLET, EMBED and OBJECT tags are supported.
+If a given document contains multiple applet tags, all the applets
+will be loaded, with each applet appearing in its own window.
+Likewise, when multiple URLs are specified, each applet tag instance
+is given its own window.  If a given document contains no recognized
+tags the @code{appletviewer} does nothing.
+
+@example
+@code{appletviewer http://www.gnu.org/software/classpath/}
+@end example
+
+Use the second form to test an applet in development.  This form
+allows applet tag attributes to be supplied on the command line.  Only
+one applet may be specified using the @code{-code} option.  The
+@code{-code} option overrides the URL form -- any URLs specified will
+be ignored.
+
+@example
+@code{appletviewer -code Test.class -param datafile,data.txt}
+@end example
+
+@code{gcjwebplugin} uses the third form to communicate with the
+@code{appletviewer} through named pipes.
+
+@item URL OPTIONS
+@table @b
+@item -debug
+This option is not yet implemented but is provided for compatibility.
+
+@item -encoding CHARSET
+Use this option to specify an alternate character encoding for the
+specified HTML page.
+
+@end table
+
+@item APPLET TAG OPTIONS
+@table @b
+@item -code CODE
+Use the @code{-code} option to specify the value of the applet tag
+CODE attribute.
+
+@item -codebase CODEBASE
+Use the @code{-codebase} option to specify the value of the applet tag
+CODEBASE attribute.
+
+@item -archive ARCHIVE
+Use the @code{-archive} option to specify the value of the applet tag
+ARCHIVE attribute.
+
+@item -width WIDTH
+Use the @code{-width} option to specify the value of the applet tag
+WIDTH attribute.
+
+@item -height HEIGHT
+Use the @code{-height} option to specify the value of the applet tag
+HEIGHT attribute.
+
+@item -param NAME,VALUE
+Use the @code{-param} option to specify values for the NAME and VALUE
+attributes of an applet PARAM tag.
+
+@end table
+
+@item PLUGIN OPTION
+@table @b
+@item -plugin INPUT,OUTPUT
+@code{gcjwebplugin} uses the @code{-plugin} option to specify the
+named pipe the @code{appletviewer} should use for receiving commands
+(INPUT) and the one it should use for sending commands to
+@code{gcjwebplugin} (OUTPUT).
+
+@end table
+
+@item DEBUGGING OPTION
+@table @b
+@item -verbose
+Use the @code{-verbose} option to have the @code{appletviewer} print
+debugging messages.
+
+@end table
+
+@item STANDARD OPTIONS
+@table @b
+@item -help
+Use the @code{-help} option to have the @code{appletviewer} print a
+usage message, then exit.
+
+@item -version
+Use the @code{-version} option to have the @code{appletviewer} print
+its version, then exit.
+
+@item -JOPTION
+Use the @code{-J} option to pass OPTION to the virtual machine that
+will run the @code{appletviewer}.  Unlike other options, there must
+not be a space between the -J and OPTION.
+
+@end table
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node gcjwebplugin, , appletviewer Tool, Applet Tools
+@comment node-name, next, previous, up
+@section The @code{gcjwebplugin} Tool
+
+@code{gcjwebplugin} is a plugin that adds applet support to web
+browsers.  Currently @code{gcjwebplugin} only supports Mozilla-based
+browsers (e.g., Firefox, Galeon, Mozilla).
+
+@comment ----------------------------------------------------------------------
+
+@node Security Tools, I18N Issues, Applet Tools, Top
+@comment node-name, next, previous, up
+@chapter Security Tools
+
+Two Security Tools are available with GNU Classpath: @b{jarsigner} and @b{keytool}.
+
+To avoid conflicts with other implementations, the jarsigner
+executable is called ``gjarsigner'' and the keytool executable is
+called ``gkeytool''.
+
+@menu
+* jarsigner Tool::             Sign and verify .JAR files
+* keytool Tool::               Manage private keys and public certificates
+@end menu
+
+If while using these tools you think you found a bug, then please report it at @uref{http://www.gnu.org/software/classpath/bugs.html,classpath-bugs}.
+
+@comment ----------------------------------------------------------------------
+
+@node jarsigner Tool, keytool Tool, Security Tools, Security Tools
+@comment node-name, next, previous, up
+@section The @code{jarsigner} Tool
+
+The @b{jarsigner} tool is invoked from the command line, in one of two forms, as follows:
+
+@example
+@code{jarsigner [OPTION]... FILE ALIAS}
+@code{jarsigner -verify [OPTION]... FILE}
+@end example
+
+When the first form is used, the tool signs the designated JAR file. The second form, on the other hand, is used to verify a previously signed JAR file.
+
+@code{FILE} is the .JAR file to process; i.e. to sign if the first syntax form is used, or to verify if the second syntax form is used instead.
+
+@code{ALIAS} must be a known @i{Alias} of a @i{Key Entry} in the designated @i{Key Store}. The private key material associated with this @i{Alias} is then used for signing the designated .JAR file.
+
+@menu
+* Common jarsigner Options::   Options used when signing or verifying a file
+* Signing Options::            Options only used when signing a .JAR file
+* Verification Options::       Options only used when verifying a .JAR file
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Common jarsigner Options, Signing Options, jarsigner Tool, jarsigner Tool
+@comment node-name, next, previous, up
+@subsection Common options
+
+The following options may be used when the tool is used for either signing, or verifying, a .JAR file.
+
+@table @b
+@item -verbose
+Use this option to force the tool to generate more verbose messages, during its processing.
+
+@item -internalsf
+When present, the tool will include --which otherwise it does not-- the @code{.SF} file in the @code{.DSA} generated file.
+
+@item -sectionsonly
+When present, the tool will include in the @code{.SF} generated file --which otherwise it does not-- a header containing a hash of the whole manifest file.  When that header is included, the tool can quickly check, during verification, if the hash (in the header) matches or not the manifest file.
+
+@item -provider PROVIDER_CLASS_NAME
+A fully qualified class name of a @i{Security Provider} to add to the current list of @i{Security Providers} already installed in the JVM in-use. If a provider class is specified with this option, and was successfully added to the runtime --i.e. it was not already installed-- then the tool will attempt to remove this @i{Security Provider} before exiting.
+
+@item -help
+Prints a help text similar to this one.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Signing Options, Verification Options, Common jarsigner Options, jarsigner Tool
+@comment node-name, next, previous, up
+@subsection Signing options
+
+The following options may be specified when using the tool for signing purposes.
+
+@table @b
+@item -keystore URL
+Use this option to specify the location of the key store to use. The default value is a file URL referencing the file named @file{.keystore} located in the path returned by the call to @code{java.lang.System#getProperty(String)} using @code{user.home} as argument.
+
+If a URL was specified, but was found to be malformed --e.g. missing protocol element-- the tool will attempt to use the URL value as a file-name (with absolute or relative path-name) of a key store --as if the protocol was @code{file:}.
+
+@item -storetype STORE_TYPE
+Use this option to specify the type of the key store to use. The default value, if this option is omitted, is that of the property @code{keystore.type} in the security properties file, which is obtained by invoking the static method call @code{getDefaultType()} in @code{java.security.KeyStore}.
+
+@item -storepass PASSWORD
+Use this option to specify the password which will be used to unlock the key store. If this option is missing, the User will be prompted to provide a password.
+
+@item -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the @i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key Entry} using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
+
+@item -sigfile NAME
+Use this option to designate a literal that will be used to construct file names for both the @code{.SF} and @code{.DSA} signature files. These files  will be generated, by the tool, and placed in the @file{META-INF} directory of the signed JAR.  Permissible characters for @code{NAME} must be in the range "a-zA-Z0-9_-".  All characters will be converted to upper-case ones.
+
+If this option is missing, the first eight characters of the @code{ALIAS} argument will be used. When this is the case, any character in @code{ALIAS} that is outside the permissible range of characters will be replaced by an underscore.
+
+@item -signedjar FILE
+Use this option to specify the file name of the signed JAR. If this option is omitted, then the signed JAR will be named the same as @code{FILE}; i.e. the input JAR file will be replaced with the signed copy.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Verification Options, , Signing Options, jarsigner Tool
+@comment node-name, next, previous, up
+@subsection Verification options
+
+The following options may be specified when using the tool for verification purposes.
+
+@table @b
+@item -verify
+Use this option to indicate that the tool is to be used for verification purposes.
+
+@item -certs
+This option is used in conjunction with the @code{-verbose} option. When present, along with the @code{-verbose} option, the tool will print more detailed information about the certificates of the signer(s) being processed.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node keytool Tool, , jarsigner Tool, Security Tools
+@comment node-name, next, previous, up
+@section The @code{keytool} Tool
+
+Cryptographic credentials, in a Java environment, are usually stored in a @i{Key Store}. The Java SDK specifies a @i{Key Store} as a persistent container of two types of objects: @i{Key Entries} and @i{Trusted Certificates}. The security tool @b{keytool} is a Java-based application for managing those types of objects.
+
+A @i{Key Entry} represents the private key part of a key-pair used in Public-Key Cryptography, and a signed X.509 certificate which authenticates the public key part for a known entity; i.e. the owner of the key-pair. The X.509 certificate itself contains the public key part of the key-pair.
+
+A @i{Trusted Certificate} is a signed X.509 certificate issued by a trusted entity. The @i{Trust} in this context is relative to the User of the @b{keytool}. In other words, the existence of a @i{Trusted Certificate} in the @i{Key Store} processed by a @b{keytool} command implies that the User trusts the @i{Issuer} of that @i{Trusted Certificate} to also sign, and hence authenticates, other @i{Subjects} the tool may process.
+
+@i{Trusted Certificates} are important because they allow the tool to mechanically construct @i{Chains of Trust} starting from one of the @i{Trusted Certificates} in a @i{Key Store} and ending with a certificate whose @i{Issuer} is potentially unknown. A valid chain is an ordered list, starting with a @i{Trusted Certificate} (also called the @i{anchor}), ending with the target certificate, and satisfying the condition that the @i{Subject} of certificate @code{#i} is the @i{Issuer} of certificate @code{#i + 1}.
+
+The @b{keytool} is invoked from the command line as follows:
+
+@example
+@code{keytool [COMMAND]...}
+@end example
+
+Multiple @code{COMMAND}s may be specified at once, each complete with its own options. @b{keytool} will parse all the arguments, before processing, and executing, each @code{COMMAND}. If an exception occurs while executing one @code{COMMAND} @b{keytool} will abort. Note however that because the implementation of the tool uses code to parse command line options that also supports GNU-style options, you have to separate each command group with a double-hyphen; e.g
+
+@example
+@code{keytool -list -- -printcert -alias mykey}
+@end example
+
+Here is a summary of the commands supported by the tool:
+
+@enumerate
+@item Add/Update commands
+@itemize @bullet
+@item -genkey [OPTION]@dots{}
+Generate a new @i{Key Entry}, eventually creating a new key store.
+
+@item -import [OPTION]@dots{}
+Add, to a key store, @i{Key Entries} (private keys and certificate chains authenticating the public keys) and @i{Trusted Certificates} (3rd party certificates which can be used as @i{Trust Anchors} when building chains-of-trust).
+
+@item -selfcert [OPTION]@dots{}
+Generate a new self-signed @i{Trusted Certificate}.
+
+@item -cacert [OPTION]@dots{}
+Import a CA @i{Trusted Certificate}.
+
+@item -identitydb [OPTION]@dots{}
+@b{NOT IMPLEMENTED YET}.@*
+Import a JDK 1.1 style Identity Database.
+@end itemize
+
+@item Export commands
+@itemize @bullet
+@item -certreq [OPTION]@dots{}
+Issue a @i{Certificate Signing Request} (CSR) which can be then sent to a @i{Certification Authority} (CA) to issue a certificate signed (by the CA) and authenticating the @i{Subject} of the request.
+
+@item -export [OPTION]@dots{}
+Export a certificate from a key store.
+@end itemize
+
+@item Display commands
+@itemize @bullet
+@item -list [OPTION]@dots{}
+Print one or all certificates in a key store to @code{STDOUT}.
+
+@item -printcert [OPTION]@dots{}
+Print a human-readable form of a certificate, in a designated file, to @code{STDOUT}.
+@end itemize
+
+@item Management commands
+@itemize @bullet
+@item -keyclone [OPTION]@dots{}
+Clone a @i{Key Entry} in a key store.
+
+@item -storepasswd [OPTION]@dots{}
+Change the password protecting a key store.
+
+@item -keypasswd [OPTION]@dots{}
+Change the password protecting a @i{Key Entry} in a key store.
+
+@item -delete [OPTION]@dots{}
+Delete a @i{Key Entry} or a @i{Trusted Certificate} from a key store.
+@end itemize
+
+@end enumerate
+
+@menu
+* Getting Help::               How to get help with keytool commands
+* Common keytool Options::     Options used in more than one command
+* Distinguished Names::        X.500 Distinguished Names used in certificates
+* Add/Update Commands::        Commands for adding data to a Key Store
+* Export Commands::            Commands for exporting data from a Key Store
+* Display Commands::           Commands for displaying data in a Key Store
+* Management Commands::        Commands for managing a Key Store
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Getting Help, Common keytool Options, keytool Tool, keytool Tool
+@comment node-name, next, previous, up
+@subsection Getting help
+
+To get a general help text about the tool, use the @code{-help} option; e.g.
+
+@example
+@code{keytool -help}
+@end example
+
+To get more specific help text about one of the tool's command use the @code{-help} option for that command; e.g.
+
+@example
+@code{keytool -genkey -help}
+@end example
+
+In both instances, the tool will print a help text and then will exit the running JVM.
+
+It is worth noting here that the help messages printed by the tool are I18N-ready. This means that if/when the contents of the tool's @i{Message Bundle} properties file are available in languages other than English, you may see those messages in that language.
+
+@comment ----------------------------------------------------------------------
+
+@node Common keytool Options, Distinguished Names, Getting Help, keytool Tool
+@comment node-name, next, previous, up
+@subsection Common options
+
+The following @code{OPTION}s are used in more than one @code{COMMAND}. They are described here to reduce redundancy.
+
+@table @b
+@anchor{alias}
+@item -alias ALIAS
+Every entry, be it a @i{Key Entry} or a @i{Trusted Certificate}, in a key store is uniquely identified by a user-defined @i{Alias} string. Use this option to specify the @i{Alias} to use when referring to an entry in the key store. Unless specified otherwise, a default value of @code{mykey} shall be used when this option is omitted from the command line.
+
+@anchor{keyalg}
+@item -keyalg ALGORITHM
+Use this option to specify the canonical name of the key-pair generation algorithm. The default value for this option is @code{DSS} (a synonym for the Digital Signature Algorithm also known as DSA).
+
+@anchor{keysize}
+@item -keysize SIZE
+Use this option to specify the number of bits of the shared modulus (for both the public and private keys) to use when generating new keys. A default value of @code{1024} will be used if this option is omitted from the command line.
+
+@anchor{validity}
+@item -validity DAY_COUNT
+Use this option to specify the number of days a newly generated certificate will be valid for. The default value is @code{90} (days) if this option is omitted from the command line.
+
+@anchor{storetype}
+@item -storetype STORE_TYPE
+Use this option to specify the type of the key store to use. The default value, if this option is omitted, is that of the property @code{keystore.type} in the security properties file, which is obtained by invoking the static method call @code{getDefaultType()} in @code{java.security.KeyStore}.
+
+@anchor{storepass}
+@item -storepass PASSWORD
+Use this option to specify the password protecting the key store. If this option is omitted from the command line, you will be prompted to provide a password.
+
+@anchor{keystore}
+@item -keystore URL
+Use this option to specify the location of the key store to use. The default value is a file URL referencing the file named @file{.keystore} located in the path returned by the call to @code{java.lang.System#getProperty(String)} using @code{user.home} as argument.
+
+If a URL was specified, but was found to be malformed --e.g. missing protocol element-- the tool will attempt to use the URL value as a file-name (with absolute or relative path-name) of a key store --as if the protocol was @code{file:}.
+
+@anchor{provider}
+@item -provider PROVIDER_CLASS_NAME
+A fully qualified class name of a @i{Security Provider} to add to the current list of @i{Security Providers} already installed in the JVM in-use. If a provider class is specified with this option, and was successfully added to the runtime --i.e. it was not already installed-- then the tool will attempt to removed this @i{Security Provider} before exiting.
+
+@anchor{file}
+@item -file FILE
+Use this option to designate a file to use with a command. When specified with this option, the value is expected to be the fully qualified path of a file accessible by the File System. Depending on the command, the file may be used as input or as output. When this option is omitted from the command line, @code{STDIN} will be used instead, as the source of input, and @code{STDOUT} will be used instead as the output destination.
+
+@anchor{verbose}
+@item -v
+Unless specified otherwise, use this option to enable more verbose output.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Distinguished Names, Add/Update Commands, Common keytool Options, keytool Tool
+@comment node-name, next, previous, up
+@subsection X.500 Distinguished Names
+
+@anchor{dn}
+A @i{Distinguished Name} (or DN) MUST be supplied with some of the @code{COMMAND}s using a @code{-dname} option. The syntax of a valid value for this option MUST follow RFC-2253 specifications. Namely the following components (with their accepted meaning) will be recognized. Note that the component name is case-insensitive:
+
+@ftable @var
+@item CN
+The Common Name; e.g. @kbd{host.domain.com}
+@item OU
+The Organizational Unit; e.g. @kbd{IT Department}
+@item O
+The Organization Name; e.g. @kbd{The Sample Company}
+@item L
+The Locality Name; e.g. @kbd{Sydney}
+@item ST
+The State Name; e.g. @kbd{New South Wales}
+@item C
+The 2-letter Country identifier; e.g. @kbd{AU}
+@end ftable
+
+When specified with a @code{-dname} option, each pair of component/value will be separated from the other with a comma. Each component and value pair MUST be separated by an equal sign. For example, the following is a valid DN value:@*
+
+@format
+CN=host.domain.com, O=The Sample Company, L=Sydney, ST=NSW, C=AU
+@end format
+@*
+If the @i{Distinguished Name} is required, and no valid default value can be used, the tool will prompt you to enter the information through the console.
+
+@comment ----------------------------------------------------------------------
+
+@node Add/Update Commands, Export Commands, Distinguished Names, keytool Tool
+@comment node-name, next, previous, up
+@subsection Add/Update commands
+
+@menu
+* Command -genkey::            Generate private key and self-signed certificate
+* Command -import::            Import certificates and certificate replies
+* Command -selfcert::          Generate self-signed certificate
+* Command -cacert::            Import a CA Trusted Certificate
+* Command -identitydb::        Import JDK-1 style identities
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Command -genkey, Command -import, Add/Update Commands, Add/Update Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-genkey} command
+
+Use this command to generate a new key-pair (both private and public keys), and save these credentials in the key store as a @i{Key Entry}, associated with the designated (if was specified with the @code{-alias} option) or default (if the @code{-alias} option is omitted) @i{Alias}.
+
+The private key material will be protected with a user-defined password (see @code{-keypass} option). The public key on the other hand will be part of a self-signed X.509 certificate, which will form a 1-element chain and will be saved in the key store.
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -keyalg ALGORITHM
+For more details @pxref{keyalg,, ALGORITHM}.
+
+@item -keysize KEY_SIZE
+For more details @pxref{keysize,, KEY_SIZE}.
+
+@item -sigalg ALGORITHM
+The canonical name of the digital signature algorithm to use for signing certificates. If this option is omitted, a default value will be chosen based on the type of the key-pair; i.e. the algorithm that ends up being used by the -keyalg option. If the key-pair generation algorithm is @code{DSA}, the value for the signature algorithm will be @code{SHA1withDSA}. If on the other hand the key-pair generation algorithm is @code{RSA}, then the tool will use @code{MD5withRSA} as the signature algorithm.
+
+@item -dname NAME
+This a mandatory value for the command. If no value is specified --i.e. the @code{-dname} option is omitted-- the tool will prompt you to enter a @i{Distinguished Name} to use as both the @i{Owner} and @i{Issuer} of the generated self-signed certificate.
+
+For more details @pxref{dn,, X.500 DISTINGUISHED NAME}.
+
+@item -keypass PASSWORD
+Use this option to specify the password which the tool will use to protect the newly created @i{Key Entry}.
+
+If this option is omitted, you will be prompted to provide a password.
+
+@item -validity DAY_COUNT
+For more details @pxref{validity,, DAY_COUNT}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -import, Command -selfcert, Command -genkey, Add/Update Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-import} command
+
+Use this command to read an X.509 certificate, or a PKCS#7 @i{Certificate Reply} from a designated input source and incorporate the certificates into the key store.
+
+If the @i{Alias} does not already exist in the key store, the tool treats the certificate read from the input source as a new @i{Trusted Certificate}. It then attempts to discover a chain-of-trust, starting from that certificate and ending at another @i{Trusted Certificate}, already stored in the key store. If the @code{-trustcacerts} option is present, an additional key store, of type @code{JKS} named @file{cacerts}, and assumed to be present in @file{$@{JAVA_HOME@}/lib/security} will also be consulted if found --@code{$@{JAVA_HOME@}} refers to the location of an installed @i{Java Runtime Environment} (JRE). If no chain-of-trust can be established, and unless the @code{-noprompt} option has been specified, the certificate is printed to @code{STDOUT} and the user is prompted for a confirmation.
+
+If @i{Alias} exists in the key store, the tool will treat the certificate(s) read from the input source as a @i{Certificate Reply}, which can be a chain of certificates, that eventually would replace the chain of certificates associated with the @i{Key Entry} of that @i{Alias}. The substitution of the certificates only occurs if a chain-of-trust can be established between the bottom certificate of the chain read from the input file and the @i{Trusted Certificates} already present in the key store. Again, if the @code{-trustcacerts} option is specified, additional @i{Trusted Certificates} in the same @file{cacerts} key store will be considered. If no chain-of-trust can be established, the operation will abort.
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -file FILE
+For more details @pxref{file,, FILE}.
+
+@item -keypass PASSWORD
+Use this option to specify the password which the tool will use to protect the @i{Key Entry} associated with the designated @i{Alias}, when replacing this @i{Alias}' chain of certificates with that found in the certificate reply.
+
+If this option is omitted, and the chain-of-trust for the certificate reply has been established, the tool will first attempt to unlock the @i{Key Entry} using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
+
+@item -noprompt
+Use this option to prevent the tool from prompting the user.
+
+@item -trustcacerts
+Use this option to indicate to the tool that a key store, of type @code{JKS}, named @file{cacerts}, and usually located in @file{lib/security} in an installed @i{Java Runtime Environment} should be considered when trying to establish chain-of-trusts.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -selfcert, Command -cacert, Command -import, Add/Update Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-selfcert} command
+
+Use this command to generate a self-signed X.509 version 1 certificate. The newly generated certificate will form a chain of one element which will replace the previous chain associated with the designated @i{Alias} (if @code{-alias} option was specified), or the default @i{Alias} (if @code{-alias} option was omitted).
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -sigalg ALGORITHM
+The canonical name of the digital signature algorithm to use for signing the certificate. If this option is omitted, a default value will be chosen based on the type of the private key associated with the designated @i{Alias}. If the private key is a @code{DSA} one, the value for the signature algorithm will be @code{SHA1withDSA}. If on the other hand the private key is an @code{RSA} one, then the tool will use @code{MD5withRSA} as the signature algorithm.
+
+@item -dname NAME
+Use this option to specify the @i{Distinguished Name} of the newly generated self-signed certificate. If this option is omitted, the existing @i{Distinguished Name} of the base certificate in the chain associated with the designated @i{Alias} will be used instead.
+
+For more details @pxref{dn,, X.500 DISTINGUISHED NAME}.
+
+@item -validity DAY_COUNT
+For more details @pxref{validity,, DAY_COUNT}.
+
+@item -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the @i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key Entry} using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -cacert, Command -identitydb, Command -selfcert, Add/Update Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-cacert} command
+
+Use this command to import, a CA certificate and add it to the key store as a @i{Trusted Certificate}. The @i{Alias} for this new entry will be constructed from the FILE's base-name after replacing hyphens and dots with underscores.
+
+This command is useful when used in a script that recursively visits a directory of CA certificates to populate a @code{cacerts.gkr} @i{Key Store} of trusted certificates which can then be used commands that specify the @code{-trustcacerts} option.
+
+@table @b
+@item -file FILE
+For more details @pxref{file,, FILE}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -identitydb, , Command -cacert, Add/Update Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-identitydb} command
+
+@b{NOT IMPLEMENTED YET}.
+
+Use this command to import a JDK 1.1 style Identity Database.
+
+@table @b
+@item -file FILE
+For more details @pxref{file,, FILE}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Export Commands, Display Commands, Add/Update Commands, keytool Tool
+@comment node-name, next, previous, up
+@subsection Export commands
+
+@menu
+* Command -certreq::           Generate Certificate Signing Requests (CSR)
+* Command -export::            Export a certificate in a Key Store
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Command -certreq, Command -export, Export Commands, Export Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-certreq} command
+
+Use this command to generate a PKCS#10 @i{Certificate Signing Request} (CSR) and write it to a designated output destination. The contents of the destination should look something like the following:
+
+@example
+-----BEGIN NEW CERTIFICATE REQUEST-----
+MI...QAwXzEUMBIGA1UEAwwLcnNuQGdudS5vcmcxGzAZBgNVBAoMElUg
+Q2...A0GA1UEBwwGU3lkbmV5MQwwCgYDVQQIDANOU1cxCzAJBgNVBACC
+...
+FC...IVwNVOfQLRX+O5kAhQ/a4RTZme2L8PnpvgRwrf7Eg8D6w==
+-----END NEW CERTIFICATE REQUEST-----
+@end example
+
+@b{IMPORTANT}: Some documentation (e.g. RSA examples) claims that the @code{Attributes} field, in the CSR is @code{OPTIONAL} while RFC-2986 implies the opposite. This implementation considers this field, by default, as @code{OPTIONAL}, unless the option @code{-attributes} is specified on the command line.
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -sigalg ALGORITHM
+The canonical name of the digital signature algorithm to use for signing the certificate. If this option is omitted, a default value will be chosen based on the type of the private key associated with the designated @i{Alias}. If the private key is a @code{DSA} one, the value for the signature algorithm will be @code{SHA1withDSA}. If on the other hand the private key is an @code{RSA} one, then the tool will use @code{MD5withRSA} as the signature algorithm.
+
+@item -file FILE
+For more details @pxref{file,, FILE}.
+
+@item -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the @i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key Entry} using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@item -attributes
+Use this option to force the tool to encode a @code{NULL} DER value in the CSR as the value of the @code{Attributes} field.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -export, , Command -certreq, Export Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-export} command
+
+Use this command to export a certificate stored in a key store to a designated output destination, either in binary format (if the @code{-v} option is specified), or in RFC-1421 compliant encoding (if the @code{-rfc} option is specified instead).
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -file FILE
+For more details @pxref{file,, FILE}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -rfc
+Use RFC-1421 specifications when encoding the output.
+
+@item -v
+Output the certificate in binary DER encoding. This is the default output format of the command if neither @code{-rfc} nor @code{-v} options were detected on the command line. If both this option and the @code{-rfc} option are detected on the command line, the tool will opt for the RFC-1421 style encoding.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Display Commands, Management Commands, Export Commands, keytool Tool
+@comment node-name, next, previous, up
+@subsection Display commands
+
+@menu
+* Command -list::              Display information about one or all Aliases
+* Command -printcert::         Print a certificate or a certificate fingerprint
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Command -list, Command -printcert, Display Commands, Display Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-list} command
+
+Use this command to print one or all of a key store entries to @code{STDOUT}. Usually this command will only print a @i{fingerprint} of the certificate, unless either the @code{-rfc} or the @code{-v} option is specified.
+
+@table @b
+@item -alias ALIAS
+If this option is omitted, the tool will print ALL the entries found in the key store.
+
+For more details @pxref{alias,, ALIAS}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -rfc
+Use RFC-1421 specifications when encoding the output.
+
+@item -v
+Output the certificate in human-readable format. If both this option and the @code{-rfc} option are detected on the command line, the tool will opt for the human-readable form and will not abort the command.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -printcert, , Command -list, Display Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-printcert} command
+
+Use this command to read a certificate from a designated input source and print it to @code{STDOUT} in a human-readable form.
+
+@table @b
+@item -file FILE
+For more details @pxref{file,, FILE}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Management Commands, , Display Commands, keytool Tool
+@comment node-name, next, previous, up
+@subsection Management commands
+
+@menu
+* Command -keyclone::          Clone a Key Entry in a Key Store
+* Command -storepasswd::       Change the password protecting a Key Store
+* Command -keypasswd::         Change the password protecting a Key Entry
+* Command -delete::            Remove an entry in a Key Store
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Command -keyclone, Command -storepasswd, Management Commands, Management Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-keyclone} command
+
+Use this command to clone an existing @i{Key Entry} and store it under a new (different) @i{Alias} protecting, its private key material with possibly a new password.
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -dest ALIAS
+Use this option to specify the new @i{Alias} which will be used to identify the cloned copy of the @i{Key Entry}.
+
+@item -keypass PASSWORD
+Use this option to specify the password which the tool will use to unlock the @i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key Entry} using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
+
+@item -new PASSWORD
+Use this option to specify the password protecting the private key material of the newly cloned copy of the @i{Key Entry}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -storepasswd, Command -keypasswd, Command -keyclone, Management Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-storepasswd} command
+
+Use this command to change the password protecting a key store.
+
+@table @b
+@item -new PASSWORD
+The new, and different, password which will be used to protect the designated key store.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -keypasswd, Command -delete, Command -storepasswd, Management Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-keypasswd} command
+
+Use this command to change the password protecting the private key material of a designated @i{Key Entry}.
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+Use this option to specify the password which the tool will use to unlock the @i{Key Entry} associated with the designated @i{Alias}.
+
+If this option is omitted, the tool will first attempt to unlock the @i{Key Entry} using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
+
+@item -new PASSWORD
+The new, and different, password which will be used to protect the private key material of the designated @i{Key Entry}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node Command -delete, , Command -keypasswd, Management Commands
+@comment node-name, next, previous, up
+@subsubsection @code{-delete} command
+
+Use this command to delete a designated key store entry.
+
+@table @b
+@item -alias ALIAS
+For more details @pxref{alias,, ALIAS}.
+
+@item -storetype STORE_TYPE
+For more details @pxref{storetype,, STORE_TYPE}.
+
+@item -keystore URL
+For more details @pxref{keystore,, URL}.
+
+@item -storepass PASSWORD
+For more details @pxref{storepass,, PASSWORD}.
+
+@item -provider PROVIDER_CLASS_NAME
+For more details @pxref{provider,, PROVIDER_CLASS_NAME}.
+
+@item -v
+For more details @pxref{verbose}.
+
+@end table
+
+@comment ----------------------------------------------------------------------
+
+@node I18N Issues, , Security Tools, Top
+@comment node-name, next, previous, up
+@chapter I18N Issues
+
+Some tools --@pxref{Security Tools}-- allow using other than the English language when prompting the User for input, and outputing messages. This chapter describes the elements used to offer this support and how they can be adapted for use with specific languages.
+
+@menu
+* Language Resources::         Where resources are located
+* Message Formats::            How messages are internationalized
+@end menu
+
+@comment ----------------------------------------------------------------------
+
+@node Language Resources, Message Formats, I18N Issues, I18N Issues
+@comment node-name, next, previous, up
+@section Language-specific resources
+
+The Tools use Java @code{ResourceBundle}s to store messages, and message templates they use at runtime to generate the message text itself, depending on the locale in use at the time.
+
+The @i{Resource Bundles} these tools use are essentially Java @i{Properties} files consisting of a set of @i{Name/Value} pairs. The @i{Name} is the @i{Propery Name} and the @i{Value} is a substitution string that is used when the code references the associated @i{Name}. For example the following is a line in a @i{Resource Bundle} used by the @code{keytool} Tool:
+
+@example
+Command.23=A correct key password MUST be provided
+@end example
+
+When the tool needs to signal a mandatory but missing key password, it would reference the property named @code{Command.23} and the message "@kbd{A correct key password MUST be provided}" will be used instead. This indirect referencing of "resources" permits replacing, as late as possible, the English strings with strings in other languages, provided of course @i{Resource Bundles} in those languages are provided.
+
+For the GNU Classpath Tools described in this Guide, the @i{Resource Bundles} are files named @file{messages[_ll[_CC[_VV]]].properties} where:
+
+@ftable @var
+@item ll
+Is the 2-letter code for the Language,
+@item CC
+Is the 2-letter code for the Region, and
+@item VV
+Is the 2-letter code for the Variant of the language.
+@end ftable
+
+The complete list of language codes can be found at @uref{http://ftp.ics.uci.edu/pub/ietf/http/related/iso639.txt, Code for the representation of names of languages}. A similar list for the region codes can be found at @uref{http://userpage.chemie.fu-berlin.de/diverse/doc/ISO_3166.html, ISO 3166 Codes (Countries)}.
+
+The location of the @i{Resource Bundles} for the GNU Classpath Tools is specific to each tool. The next table shows where these files are found in a standard GNU Classpath distribution:
+
+@ftable @code
+@item jarsigner
+@file{gnu/classpath/tools/jarsigner}
+@item keytool
+@file{gnu/classpath/tools/keytool}
+@end ftable
+
+The collection of @i{Resource Bundles} in a location act as an inverted tree with a parent-child relationship. For example suppose in the @file{gnu/classpath/tools/keytool} there are 3 message bundles named:
+
+@enumerate
+@item @code{messages.properties}
+@item @code{messages_fr.properties}
+@item @code{messages_fr_FR.properties}
+@end enumerate
+
+In the above example, bundle #1 will act as the parent of bundle #2, which in turn will act as the parent for bundle #3. This ordering is used by the Java runtime to choose which file to load based on the set Locale. For example if the Locale is @code{fr_CH}, @code{messages_fr.properties} will be used because (a) @code{messages_fr_CH.properties} does not exist, but (b) @code{messages_fr.properties} is the parent for the required bundle, and it exists. As another example, suppose the Locale was set to @code{en_AU}; then the tool will end up using @code{messages.properties} because (a) @code{messages_en_AU.properties} does not exist, (b) @code{messages_en.properties} which is the parent for the required bundle does not exist, but (c) @code{messages.properties} exists and is the root of the hierarchy.
+
+You can see from the examples above that @file{messages.properties} is the safety net that the Java runtime falls back to when failing to find a specific bunlde and its parent(s). This file is always provided with the Tool. In time, more localized versions will be included to cater for other languages.
+
+In the meantime, if you are willing to contribute localized versions of these resources, grab the @file{messages.properties} for a specific tool; translate it; save it with the appropriate language and region suffix and mail it to @code{classpath@@gnu.org}.
+
+@comment ----------------------------------------------------------------------
+
+@node Message Formats, , Language Resources, I18N Issues
+@comment node-name, next, previous, up
+@section Message formats
+
+If you open any of the @file{messages.properties} described in the previous section, you may see properties that look like so:
+
+@example
+Command.67=Issuer: @{0@}
+Command.68=Serial number: @{0,number@}
+Command.69=Valid from: @{0,date,full@} - @{0,time,full@}
+Command.70=\ \ \ \ \ until: @{0,date,full@} - @{0,time,full@}
+@end example
+
+These are @i{Message Formats} used by the tools to customize a text string that will then be used either as a prompt for User input or as output.
+
+If you are translating a @file{messages.properties} be careful not to alter text between curly braces.
+
+@comment ----------------------------------------------------------------------
+
+@bye
diff --git a/include/java_lang_VMProcess.h b/include/java_lang_VMProcess.h
index 22617816d..3029f0d9c 100644
--- a/include/java_lang_VMProcess.h
+++ b/include/java_lang_VMProcess.h
@@ -10,7 +10,7 @@ extern "C"
 {
 #endif
 
-JNIEXPORT void JNICALL Java_java_lang_VMProcess_nativeSpawn (JNIEnv *env, jobject, jobjectArray, jobjectArray, jobject, jboolean);
+JNIEXPORT void JNICALL Java_java_lang_VMProcess_nativeSpawn (JNIEnv *env, jobject, jobjectArray, jobjectArray, jobject);
 JNIEXPORT jboolean JNICALL Java_java_lang_VMProcess_nativeReap (JNIEnv *env, jclass);
 JNIEXPORT void JNICALL Java_java_lang_VMProcess_nativeKill (JNIEnv *env, jclass, jlong);
 #undef java_lang_VMProcess_INITIAL
diff --git a/native/jni/Makefile.am b/native/jni/Makefile.am
index dfe81b172..110540799 100644
--- a/native/jni/Makefile.am
+++ b/native/jni/Makefile.am
@@ -32,7 +32,8 @@ SUBDIRS = classpath $(JNIDIRS) \
   $(ALSADIR) $(DSSIDIR) $(GTKDIR) $(CLASSPATH_QT_PEER_DIR) $(XMLJDIR) \
   $(CLASSPATH_GCONF_PEER_DIR)
 DIST_SUBDIRS = classpath java-io java-lang java-net java-nio java-util \
-               gtk-peer gconf-peer qt-peer xmlj midi-alsa midi-dssi
+               gtk-peer gconf-peer qt-peer xmlj midi-alsa midi-dssi \
+               native-lib
 
 all-local:
 	cd $(top_srcdir) && $(SHELL) ./scripts/check_jni_methods.sh
diff --git a/native/jni/java-io/java_io_VMFile.c b/native/jni/java-io/java_io_VMFile.c
index ce890e603..3f9282049 100644
--- a/native/jni/java-io/java_io_VMFile.c
+++ b/native/jni/java-io/java_io_VMFile.c
@@ -42,6 +42,12 @@ exception statement from your version. */
 #include <stdio.h>
 #include <stdlib.h>
 
+#if defined (HAVE_LSTAT) && defined (HAVE_READLINK)
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#endif
+
 #include <jni.h>
 #include <jcl.h>
 #include "cpio.h"
diff --git a/native/jni/java-lang/java_lang_VMProcess.c b/native/jni/java-lang/java_lang_VMProcess.c
index 16793287a..915af96f1 100644
--- a/native/jni/java-lang/java_lang_VMProcess.c
+++ b/native/jni/java-lang/java_lang_VMProcess.c
@@ -123,8 +123,7 @@ copy_elem (JNIEnv * env, jobject stringArray, jint i)
 JNIEXPORT void JNICALL
 Java_java_lang_VMProcess_nativeSpawn (JNIEnv * env, jobject this,
 				      jobjectArray cmdArray,
-				      jobjectArray envArray, jobject dirFile,
-				      jboolean redirect)
+				      jobjectArray envArray, jobject dirFile)
 {
   int fds[CPIO_EXEC_NUM_PIPES];
   jobject streams[CPIO_EXEC_NUM_PIPES] = { NULL, NULL, NULL };
diff --git a/native/jni/java-net/java_net_VMInetAddress.c b/native/jni/java-net/java_net_VMInetAddress.c
index 3273f02fe..2ca0545fe 100644
--- a/native/jni/java-net/java_net_VMInetAddress.c
+++ b/native/jni/java-net/java_net_VMInetAddress.c
@@ -208,7 +208,7 @@ Java_java_net_VMInetAddress_getHostByName (JNIEnv * env,
   int result;
   jclass arr_class;
   jobjectArray addrs;
-  jint i, j;
+  jint i;
   jbyte *octets;
   jarray ret_octets;
 
diff --git a/native/jni/native-lib/Makefile.am b/native/jni/native-lib/Makefile.am
index c8eb0367d..beab77e57 100644
--- a/native/jni/native-lib/Makefile.am
+++ b/native/jni/native-lib/Makefile.am
@@ -3,9 +3,7 @@ libclasspathnative_la_SOURCES = cpnet.c \
 				cpnet.h \
 				cpio.c \
 				cpio.h \
-				cpnative.c \
 				cpnative.h \
-				cpmath.h \
 				cpproc.h \
 				cpproc.c
 
diff --git a/native/jni/native-lib/cpio.c b/native/jni/native-lib/cpio.c
index 2e41afd67..955fdccc8 100644
--- a/native/jni/native-lib/cpio.c
+++ b/native/jni/native-lib/cpio.c
@@ -334,7 +334,7 @@ int cpio_setFileReadonly (const char *filename)
   if (stat(filename, &statbuf) < 0)
     return errno;
  
-  if (chmod(filename, statbuf.st_mode & ~(S_IRUSR | S_IRGRP | S_IROTH)) < 0)
+  if (chmod(filename, statbuf.st_mode & ~(S_IWRITE | S_IWGRP | S_IWOTH)) < 0)
     return errno;
 
   return 0;
diff --git a/native/jni/native-lib/cpnet.c b/native/jni/native-lib/cpnet.c
index 53472e21b..32bd1265e 100644
--- a/native/jni/native-lib/cpnet.c
+++ b/native/jni/native-lib/cpnet.c
@@ -180,8 +180,6 @@ jint cpnet_connect(JNIEnv *env UNUSED, jint fd, cpnet_address *addr)
   int ret;
 
   /* TODO: implement socket time out */
-  struct sockaddr_in *theaddr = (struct sockaddr_in *)addr->data;
-
   ret = connect(fd, (struct sockaddr *)addr->data, addr->len);
   if (ret != 0)
     return errno;
@@ -697,3 +695,11 @@ jint cpnet_getHostByAddr (JNIEnv *env UNUSED, cpnet_address *addr, char *hostnam
 
   return 0;
 }
+
+void cpnet_freeAddresses(JNIEnv * env, cpnet_address **addr, jint addresses_count)
+{
+  jint i;
+
+  for (i = 0; i < addresses_count; i++)
+    cpnet_freeAddress(env, addr[i]);
+}
diff --git a/native/jni/native-lib/cpnet.h b/native/jni/native-lib/cpnet.h
index 1b7583a5a..0c7c215f8 100644
--- a/native/jni/native-lib/cpnet.h
+++ b/native/jni/native-lib/cpnet.h
@@ -94,6 +94,7 @@ JNIEXPORT jint cpnet_getAvailableBytes (JNIEnv *env, jint fd, jint *availableByt
 JNIEXPORT jint cpnet_getHostname (JNIEnv *env, char *hostname, jint hostname_len);
 JNIEXPORT jint cpnet_getHostByName (JNIEnv *env, const char *hostname, cpnet_address ***adresses, jint *addresses_count);
 JNIEXPORT jint cpnet_getHostByAddr (JNIEnv *env, cpnet_address *addr, char *hostname, jint hostname_len);
+JNIEXPORT void cpnet_freeAddresses(JNIEnv * env, cpnet_address **addr, jint addresses_count);
 
 static inline cpnet_address *cpnet_newIPV4Address(JNIEnv * env)
 {
@@ -130,14 +131,6 @@ static inline void cpnet_freeAddress(JNIEnv * env, cpnet_address *addr)
   JCL_free(env, addr);
 }
 
-static void cpnet_freeAddresses(JNIEnv * env, cpnet_address **addr, jint addresses_count)
-{
-  jint i;
-
-  for (i = 0; i < addresses_count; i++)
-    cpnet_freeAddress(env, addr[i]);
-}
-
 static inline void cpnet_addressSetPort(cpnet_address *addr, jint port)
 {
   struct sockaddr_in *ipaddr = (struct sockaddr_in *)&(addr->data[0]);
diff --git a/vm/reference/java/lang/VMProcess.java b/vm/reference/java/lang/VMProcess.java
index 076e5999d..86e4a7b9a 100644
--- a/vm/reference/java/lang/VMProcess.java
+++ b/vm/reference/java/lang/VMProcess.java
@@ -95,7 +95,6 @@ final class VMProcess extends Process
   InputStream stdout;			       // process output stream
   InputStream stderr;			       // process error stream
   int exitValue;			       // process exit value
-  boolean redirect;			       // redirect stderr -> stdout
 
   //
   // Dedicated thread that does all the fork()'ing and wait()'ing
@@ -200,8 +199,7 @@ final class VMProcess extends Process
 	{
 	  try
 	    {
-	      process.nativeSpawn(process.cmd, process.env, process.dir,
-				  process.redirect);
+	      process.nativeSpawn(process.cmd, process.env, process.dir);
 	      process.state = RUNNING;
 	      activeMap.put(new Long(process.pid), process);
 	    }
@@ -220,7 +218,7 @@ final class VMProcess extends Process
   }
 
   // Constructor
-  private VMProcess(String[] cmd, String[] env, File dir, boolean redirect)
+  private VMProcess(String[] cmd, String[] env, File dir)
     throws IOException
   {
     
@@ -229,7 +227,6 @@ final class VMProcess extends Process
     this.cmd = cmd;
     this.env = env;
     this.dir = dir;
-    this.redirect = redirect;
   
     // Add process to the new process work list and wakeup processThread
     synchronized (workList)
@@ -304,11 +301,10 @@ final class VMProcess extends Process
    */
   static Process exec(String[] cmd, String[] env, File dir) throws IOException
   {
-    return new VMProcess(cmd, env, dir, false);
+    return new VMProcess(cmd, env, dir);
   }
 
-  static Process exec(List cmd, Map env,
-		      File dir, boolean redirect) throws IOException
+  static Process exec(List cmd, Map env, File dir) throws IOException
   {
     String[] acmd = (String[]) cmd.toArray(new String[cmd.size()]);
     String[] aenv = new String[env.size()];
@@ -321,7 +317,7 @@ final class VMProcess extends Process
 	aenv[i++] = entry.getKey() + "=" + entry.getValue();
       }
 
-    return new VMProcess(acmd, aenv, dir, redirect);
+    return new VMProcess(acmd, aenv, dir);
   }
 
   public OutputStream getOutputStream()
@@ -380,8 +376,7 @@ final class VMProcess extends Process
    *
    * @throws IOException if the O/S process could not be created.
    */
-  native void nativeSpawn(String[] cmd, String[] env, File dir,
-			  boolean redirect)
+  native void nativeSpawn(String[] cmd, String[] env, File dir)
     throws IOException;
 
   /**