Adding upstream version 2.1.6.upstream/2.1.6

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 3414 insertions, 0 deletions

diff --git a/cts/cts-cli.in b/cts/cts-cli.in
new file mode 100755
index 0000000..fdad002
--- /dev/null
+++ b/cts/cts-cli.in
@@ -0,0 +1,3414 @@
+#!@BASH_PATH@
+#
+# Copyright 2008-2022 the Pacemaker project contributors
+#
+# The version control history for this file may have further details.
+#
+# This source code is licensed under the GNU General Public License version 2
+# or later (GPLv2+) WITHOUT ANY WARRANTY.
+#
+
+# Set the exit status of a command to the exit code of the last program to
+# exit non-zero.  This is bash-specific.
+set -o pipefail
+
+#
+# Note on portable usage of sed: GNU/POSIX/*BSD sed have a limited subset of
+# compatible functionality. Do not use the -i option, alternation (\|),
+# \0, or character sequences such as \n or \s.
+#
+
+USAGE_TEXT="Usage: cts-cli [<options>]
+Options:
+ --help          Display this text, then exit
+ -V, --verbose   Display any differences from expected output
+ -t 'TEST [...]' Run only specified tests
+                 (default: 'daemons dates error_codes tools crm_mon acls
+                            validity upgrade rules feature_set').
+                 Other tests: agents (must be run in an installed environment).
+ -p DIR          Look for executables in DIR (may be specified multiple times)
+ -v, --valgrind  Run all commands under valgrind
+ -s              Save actual output as expected output"
+
+# If readlink supports -e (i.e. GNU), use it
+readlink -e / >/dev/null 2>/dev/null
+if [ $? -eq 0 ]; then
+    test_home="$(dirname "$(readlink -e "$0")")"
+else
+    test_home="$(dirname "$0")"
+fi
+
+: ${shadow=cts-cli}
+shadow_dir=$(mktemp -d ${TMPDIR:-/tmp}/cts-cli.shadow.XXXXXXXXXX)
+num_errors=0
+num_passed=0
+verbose=0
+tests="daemons dates error_codes tools crm_mon acls validity upgrade rules "
+tests="$tests feature_set"
+do_save=0
+XMLLINT_CMD=
+VALGRIND_CMD=
+VALGRIND_OPTS="
+    -q
+    --gen-suppressions=all
+    --show-reachable=no
+    --leak-check=full
+    --trace-children=no
+    --time-stamp=yes
+    --num-callers=20
+    --suppressions=$test_home/valgrind-pcmk.suppressions
+"
+
+# Temp files for saving a command's stdout/stderr in _test_assert()
+test_assert_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_outfile.XXXXXXXXXX)
+test_assert_errfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.ta_errfile.XXXXXXXXXX)
+xmllint_outfile=$(mktemp ${TMPDIR:-/tmp}/cts-cli.xmllint_outfile.XXXXXXXXXX)
+
+# Log test errors to stderr
+export PCMK_stderr=1
+
+# Output when PCMK_trace_functions is undefined is different from when it's
+# empty. Later we save the value of PCMK_trace_functions, do work, and restore
+# the original value. Getting back to the initial state is simplest if we assume
+# the variable is defined.
+: ${PCMK_trace_functions=""}
+export PCMK_trace_functions
+
+# These constants must track crm_exit_t values
+CRM_EX_OK=0
+CRM_EX_ERROR=1
+CRM_EX_INVALID_PARAM=2
+CRM_EX_UNIMPLEMENT_FEATURE=3
+CRM_EX_INSUFFICIENT_PRIV=4
+CRM_EX_NOT_CONFIGURED=6
+CRM_EX_USAGE=64
+CRM_EX_DATAERR=65
+CRM_EX_CANTCREAT=73
+CRM_EX_CONFIG=78
+CRM_EX_OLD=103
+CRM_EX_DIGEST=104
+CRM_EX_NOSUCH=105
+CRM_EX_UNSAFE=107
+CRM_EX_EXISTS=108
+CRM_EX_MULTIPLE=109
+CRM_EX_EXPIRED=110
+CRM_EX_NOT_YET_IN_EFFECT=111
+
+reset_shadow_cib_version() {
+    local SHADOWPATH
+
+    SHADOWPATH="$(crm_shadow --file)"
+    # sed -i isn't portable :-(
+    cp -p "$SHADOWPATH" "${SHADOWPATH}.$$" # preserve permissions
+    sed -e 's/epoch="[0-9]*"/epoch="1"/g' \
+        -e 's/num_updates="[0-9]*"/num_updates="0"/g' \
+        -e 's/admin_epoch="[0-9]*"/admin_epoch="0"/g' \
+        "$SHADOWPATH" > "${SHADOWPATH}.$$"
+    mv -- "${SHADOWPATH}.$$" "$SHADOWPATH"
+}
+
+# A newly created empty CIB might or might not have a rsc_defaults section
+# depending on whether the --with-resource-stickiness-default configure
+# option was used. To ensure regression tests behave the same either way,
+# delete any rsc_defaults after creating or erasing a CIB.
+delete_shadow_resource_defaults() {
+    cibadmin --delete --xml-text '<rsc_defaults/>'
+
+    # The above command might or might not bump the CIB version, so reset it
+    # to ensure future changes result in the same version for comparison.
+    reset_shadow_cib_version
+}
+
+create_shadow_cib() {
+    local VALIDATE_WITH
+    local SHADOW_CMD
+
+    CREATE_ARG="$1"
+    VALIDATE_WITH="$2"
+
+    export CIB_shadow_dir="${shadow_dir}"
+
+    SHADOW_CMD="$VALGRIND_CMD crm_shadow --batch --force $CREATE_ARG"
+    if [ -z "$VALIDATE_WITH" ]; then
+        $SHADOW_CMD "$shadow" 2>&1
+    else
+        $SHADOW_CMD "$shadow" --validate-with="${VALIDATE_WITH}" 2>&1
+    fi
+
+    export CIB_shadow="$shadow"
+    delete_shadow_resource_defaults
+}
+
+function _test_assert() {
+    target=$1; shift
+    validate=$1; shift
+    cib=$1; shift
+    app=`echo "$cmd" | sed 's/\ .*//'`
+    printf "* Running: $app - $desc\n" 1>&2
+
+    printf "=#=#=#= Begin test: $desc =#=#=#=\n"
+
+    # Capture stderr and stdout separately, then print them consecutively
+    eval $VALGRIND_CMD $cmd > "$test_assert_outfile" 2> "$test_assert_errfile"
+    rc=$?
+    cat "$test_assert_errfile"
+    cat "$test_assert_outfile"
+
+    if [ x$cib != x0 ]; then
+        printf "=#=#=#= Current cib after: $desc =#=#=#=\n"
+        CIB_user=root cibadmin -Q
+    fi
+
+    # Do not validate if running under valgrind, even if told to do so.  Valgrind
+    # will output a lot more stuff that is not XML, so it wouldn't validate anyway.
+    if [ "$validate" = "1" ] && [ "$VALGRIND_CMD" = "" ] && [ $rc = 0 ] && [ "$XMLLINT_CMD" != "" ]; then
+        # The sed command filters out the "- validates" line that xmllint will output
+        # on success.  grep cannot be used here because "grep -v 'validates$'" will
+        # return an exit code of 1 if its input consists entirely of "- validates".
+        $XMLLINT_CMD --noout --relaxng \
+            "$PCMK_schema_directory/api/api-result.rng" "$test_assert_outfile" \
+            > "$xmllint_outfile" 2>&1
+        rc=$?
+
+        sed -n '/validates$/ !p' "$xmllint_outfile"
+
+        if [ $rc = 0 ]; then
+            printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
+        else
+            printf "=#=#=#= End test: %s - Failed to validate (%d) =#=#=#=\n" "$desc" $rc
+        fi
+    else
+        printf "=#=#=#= End test: %s - $(crm_error --exit $rc) (%d) =#=#=#=\n" "$desc" $rc
+    fi
+
+    if [ $rc -ne $target ]; then
+        num_errors=$(( $num_errors + 1 ))
+        printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc"
+        printf "* Failed (rc=%.3d): %-14s - %s\n" $rc $app "$desc (`which $app`)" 1>&2
+        return
+        exit $CRM_EX_ERROR
+    else
+        printf "* Passed: %-14s - %s\n" $app "$desc"
+        num_passed=$(( $num_passed + 1 ))
+    fi
+}
+
+function test_assert() {
+    _test_assert $1 0 $2
+}
+
+function test_assert_validate() {
+    _test_assert $1 1 $2
+}
+
+# Tests that depend on resource agents and must be run in an installed
+# environment
+function test_agents() {
+    desc="Validate a valid resource configuration"
+    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
+    test_assert $CRM_EX_OK 0
+
+    desc="Validate a valid resource configuration (XML)"
+    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
+    cmd="$cmd --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Make the Dummy configuration invalid (op_sleep can't be a generic string)
+    export OCF_RESKEY_op_sleep=asdf
+
+    desc="Validate an invalid resource configuration"
+    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
+    test_assert $CRM_EX_NOT_CONFIGURED 0
+
+    desc="Validate an invalid resource configuration (XML)"
+    cmd="crm_resource --validate --class ocf --provider pacemaker --agent Dummy"
+    cmd="$cmd --output-as=xml"
+    test_assert_validate $CRM_EX_NOT_CONFIGURED 0
+
+    unset OCF_RESKEY_op_sleep
+    export OCF_RESKEY_op_sleep
+}
+
+function test_daemons() {
+    desc="Get CIB manager metadata"
+    cmd="pacemaker-based metadata"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get controller metadata"
+    cmd="pacemaker-controld metadata"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get fencer metadata"
+    cmd="pacemaker-fenced metadata"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get scheduler metadata"
+    cmd="pacemaker-schedulerd metadata"
+    test_assert $CRM_EX_OK 0
+}
+
+function test_crm_mon() {
+    local TMPXML
+    export CIB_file="$test_home/cli/crm_mon.xml"
+
+    desc="Basic text output"
+    cmd="crm_mon -1"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output"
+    cmd="crm_mon --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output without node section"
+    cmd="crm_mon -1 --exclude=nodes"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output without the node section"
+    cmd="crm_mon --output-as=xml --exclude=nodes"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Text output with only the node section"
+    cmd="crm_mon -1 --exclude=all --include=nodes"
+    test_assert $CRM_EX_OK 0
+
+    # The above test doesn't need to be performed for other output formats.  It's
+    # really just a test to make sure that blank lines are correct.
+
+    desc="Complete text output"
+    cmd="crm_mon -1 --include=all"
+    test_assert $CRM_EX_OK 0
+
+    # XML includes everything already so there's no need for a complete test
+
+    desc="Complete text output with detail"
+    cmd="crm_mon -1R --include=all"
+    test_assert $CRM_EX_OK 0
+
+    # XML includes detailed output already
+
+    desc="Complete brief text output"
+    cmd="crm_mon -1 --include=all --brief"
+    test_assert $CRM_EX_OK 0
+
+    desc="Complete text output grouped by node"
+    cmd="crm_mon -1 --include=all --group-by-node"
+    test_assert $CRM_EX_OK 0
+
+    # XML does not have a brief output option
+
+    desc="Complete brief text output grouped by node"
+    cmd="crm_mon -1 --include=all --group-by-node --brief"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output grouped by node"
+    cmd="crm_mon -1 --output-as=xml --group-by-node"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by node"
+    cmd="crm_mon -1 --include=all --node=cluster01"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by node"
+    cmd="crm_mon --output-as xml --include=all --node=cluster01"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by tag"
+    cmd="crm_mon -1 --include=all --node=even-nodes"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by tag"
+    cmd="crm_mon --output-as=xml --include=all --node=even-nodes"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by resource tag"
+    cmd="crm_mon -1 --include=all --resource=fencing-rscs"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by resource tag"
+    cmd="crm_mon --output-as=xml --include=all --resource=fencing-rscs"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output filtered by node that doesn't exist"
+    cmd="crm_mon -1 --node=blah"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by node that doesn't exist"
+    cmd="crm_mon --output-as=xml --node=blah"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources"
+    cmd="crm_mon -1 -r"
+    test_assert $CRM_EX_OK 0
+
+    # XML already includes inactive resources
+
+    desc="Basic text output with inactive resources, filtered by node"
+    cmd="crm_mon -1 -r --node=cluster02"
+    test_assert $CRM_EX_OK 0
+
+    # XML already includes inactive resources
+
+    desc="Complete text output filtered by primitive resource"
+    cmd="crm_mon -1 --include=all --resource=Fencing"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by primitive resource"
+    cmd="crm_mon --output-as=xml --resource=Fencing"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by group resource"
+    cmd="crm_mon -1 --include=all --resource=exim-group"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by group resource"
+    cmd="crm_mon --output-as=xml --resource=exim-group"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by group resource member"
+    cmd="crm_mon -1 --include=all --resource=Public-IP"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by group resource member"
+    cmd="crm_mon --output-as=xml --resource=Email"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by clone resource"
+    cmd="crm_mon -1 --include=all --resource=ping-clone"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by clone resource"
+    cmd="crm_mon --output-as=xml --resource=ping-clone"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by clone resource instance"
+    cmd="crm_mon -1 --include=all --resource=ping"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by clone resource instance"
+    cmd="crm_mon --output-as=xml --resource=ping"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output filtered by exact clone resource instance"
+    cmd="crm_mon -1 --include=all --show-detail --resource=ping:0"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by exact clone resource instance"
+    cmd="crm_mon --output-as=xml --resource=ping:1"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output filtered by resource that doesn't exist"
+    cmd="crm_mon -1 --resource=blah"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by resource that doesn't exist"
+    cmd="crm_mon --output-as=xml --resource=blah"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources, filtered by tag"
+    cmd="crm_mon -1 -r --resource=inactive-rscs"
+    test_assert $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources, filtered by bundle resource"
+    cmd="crm_mon -1 -r --resource=httpd-bundle"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by inactive bundle resource"
+    cmd="crm_mon --output-as=xml --resource=httpd-bundle"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources, filtered by bundled IP address resource"
+    cmd="crm_mon -1 -r --resource=httpd-bundle-ip-192.168.122.131"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by bundled IP address resource"
+    cmd="crm_mon --output-as=xml --resource=httpd-bundle-ip-192.168.122.132"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources, filtered by bundled container"
+    cmd="crm_mon -1 -r --resource=httpd-bundle-docker-1"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by bundled container"
+    cmd="crm_mon --output-as=xml --resource=httpd-bundle-docker-2"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources, filtered by bundle connection"
+    cmd="crm_mon -1 -r --resource=httpd-bundle-0"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by bundle connection"
+    cmd="crm_mon --output-as=xml --resource=httpd-bundle-0"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Basic text output with inactive resources, filtered by bundled primitive resource"
+    cmd="crm_mon -1 -r --resource=httpd"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output filtered by bundled primitive resource"
+    cmd="crm_mon --output-as=xml --resource=httpd"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output, filtered by clone name in cloned group"
+    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-clone-group"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, filtered by clone name in cloned group"
+    cmd="crm_mon --output-as=xml --resource=mysql-clone-group"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output, filtered by group name in cloned group"
+    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, filtered by group name in cloned group"
+    cmd="crm_mon --output-as=xml --resource=mysql-group"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output, filtered by exact group instance name in cloned group"
+    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-group:1"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, filtered by exact group instance name in cloned group"
+    cmd="crm_mon --output-as=xml --resource=mysql-group:1"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output, filtered by primitive name in cloned group"
+    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, filtered by primitive name in cloned group"
+    cmd="crm_mon --output-as=xml --resource=mysql-proxy"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Complete text output, filtered by exact primitive instance name in cloned group"
+    cmd="crm_mon -1 --include=all --show-detail --resource=mysql-proxy:1"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, filtered by exact primitive instance name in cloned group"
+    cmd="crm_mon --output-as=xml --resource=mysql-proxy:1"
+    test_assert_validate $CRM_EX_OK 0
+
+    unset CIB_file
+
+    export CIB_file="$test_home/cli/crm_mon-partial.xml"
+
+    desc="Text output of partially active resources"
+    cmd="crm_mon -1 --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output of partially active resources"
+    cmd="crm_mon -1 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Text output of partially active resources, with inactive resources"
+    cmd="crm_mon -1 -r --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    # XML already includes inactive resources
+
+    desc="Complete brief text output, with inactive resources"
+    cmd="crm_mon -1 -r --include=all --brief --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    # XML does not have a brief output option
+
+    desc="Text output of partially active group"
+    cmd="crm_mon -1 --resource=partially-active-group"
+    test_assert $CRM_EX_OK 0
+
+    desc="Text output of partially active group, with inactive resources"
+    cmd="crm_mon -1 --resource=partially-active-group -r"
+    test_assert $CRM_EX_OK 0
+
+    desc="Text output of active member of partially active group"
+    cmd="crm_mon -1 --resource=dummy-1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Text output of inactive member of partially active group"
+    cmd="crm_mon -1 --resource=dummy-2 --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    desc="Complete brief text output grouped by node, with inactive resources"
+    cmd="crm_mon -1 -r --include=all --group-by-node --brief --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    desc="Text output of partially active resources, with inactive resources, filtered by node"
+    cmd="crm_mon -1 -r --node=cluster01"
+    test_assert $CRM_EX_OK 0
+
+    desc="Text output of partially active resources, filtered by node"
+    cmd="crm_mon -1 --output-as=xml --node=cluster01"
+    test_assert_validate $CRM_EX_OK 0
+
+    unset CIB_file
+
+    export CIB_file="$test_home/cli/crm_mon-unmanaged.xml"
+
+    desc="Text output of active unmanaged resource on offline node"
+    cmd="crm_mon -1"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output of active unmanaged resource on offline node"
+    cmd="crm_mon -1 --output-as=xml"
+    test_assert $CRM_EX_OK 0
+
+    desc="Brief text output of active unmanaged resource on offline node"
+    cmd="crm_mon -1 --brief"
+    test_assert $CRM_EX_OK 0
+
+    desc="Brief text output of active unmanaged resource on offline node, grouped by node"
+    cmd="crm_mon -1 --brief --group-by-node"
+    test_assert $CRM_EX_OK 0
+
+    # Maintenance mode tests
+
+    export CIB_file=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_mon.xml.XXXXXXXXXX)
+    cp "$test_home/cli/crm_mon.xml" "$CIB_file"
+
+    crm_attribute -n maintenance-mode -v true
+
+    desc="Text output of all resources with maintenance-mode enabled"
+    cmd="crm_mon -1 -r"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output of all resources with maintenance-mode enabled"
+    cmd="crm_mon -1 -r --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    crm_attribute -n maintenance-mode -v false
+
+    crm_attribute -n maintenance -N cluster02 -v true
+
+    desc="Text output of all resources with maintenance enabled for a node"
+    cmd="crm_mon -1 -r"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output of all resources with maintenance enabled for a node"
+    cmd="crm_mon -1 -r --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    rm -f "$CIB_file"
+    unset CIB_file
+
+    export CIB_file="$test_home/cli/crm_mon-rsc-maint.xml"
+
+    # The fence resource is excluded, for comparison
+    desc="Text output of all resources with maintenance meta attribute true"
+    cmd="crm_mon -1 -r"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output of all resources with maintenance meta attribute true"
+    cmd="crm_mon -1 -r --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    unset CIB_file
+
+    export CIB_file="$test_home/cli/crm_mon-T180.xml"
+
+    desc="Text output of guest node's container on different node from its"
+    desc="$desc remote resource"
+    cmd="crm_mon -1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Complete text output of guest node's container on different node from"
+    desc="$desc its remote resource"
+    cmd="crm_mon -1 --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_file
+}
+
+function test_error_codes() {
+    # Note: At the time of this writing, crm_error returns success even for
+    # unknown error codes. We don't want to cause a regression by changing that.
+
+    # Due to the way _test_assert() formats output, we need "crm_error" to be
+    # the first token of cmd. We can't start with a parenthesis or variable
+    # assignment. However, in the "list result codes" tests, we also need to
+    # save some output for later processing. We'll use a temp file for this.
+    local TMPFILE
+    TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.crm_error_out.XXXXXXXXXX)
+
+    # Legacy return codes
+    #
+    # Don't test unknown legacy code. FreeBSD includes a colon in strerror(),
+    # while other distros do not.
+    desc="Get legacy return code"
+    cmd="crm_error -- 201"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get legacy return code (XML)"
+    cmd="crm_error --output-as=xml -- 201"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get legacy return code (with name)"
+    cmd="crm_error -n -- 201"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get legacy return code (with name) (XML)"
+    cmd="crm_error -n --output-as=xml -- 201"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get multiple legacy return codes"
+    cmd="crm_error -- 201 202"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get multiple legacy return codes (XML)"
+    cmd="crm_error --output-as=xml -- 201 202"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get multiple legacy return codes (with names)"
+    cmd="crm_error -n -- 201 202"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get multiple legacy return codes (with names) (XML)"
+    cmd="crm_error -n --output-as=xml -- 201 202"
+    test_assert_validate $CRM_EX_OK 0
+
+    # We can only rely on our custom codes, so we'll spot-check codes 201-209
+    desc="List legacy return codes (spot check)"
+    cmd="crm_error -l | grep 20[1-9]"
+    test_assert $CRM_EX_OK 0
+
+    desc="List legacy return codes (spot check) (XML)"
+    cmd="crm_error -l --output-as=xml > $TMPFILE; rc=$?"
+    cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
+    cmd="$cmd; (exit $rc)"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="List legacy return codes (spot check) (with names)"
+    cmd="crm_error -n -l | grep 20[1-9]"
+    test_assert $CRM_EX_OK 0
+
+    desc="List legacy return codes (spot check) (with names) (XML)"
+    cmd="crm_error -n -l --output-as=xml > $TMPFILE; rc=$?"
+    cmd="$cmd; grep -Ev '<result-code.*code=\"([^2]|2[^0]|20[^1-9])' $TMPFILE"
+    cmd="$cmd; (exit $rc)"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Standard Pacemaker return codes
+    #
+    # Don't test positive (system) error codes, which may vary by OS
+
+    desc="Get unknown Pacemaker return code"
+    cmd="crm_error -r -- -10000"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get unknown Pacemaker return code (XML)"
+    cmd="crm_error -r --output-as=xml -- -10000"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get unknown Pacemaker return code (with name)"
+    cmd="crm_error -n -r -- -10000"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get unknown Pacemaker return code (with name) (XML)"
+    cmd="crm_error -n -r --output-as=xml -- -10000"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Negative return codes require parsing out the "--" explicitly, so we need
+    # to test them as a separate case
+    desc="Get negative Pacemaker return code"
+    cmd="crm_error -r -- -1005"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get negative Pacemaker return code (XML)"
+    cmd="crm_error -r --output-as=xml -- -1005"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Testing name lookups for negative return codes only is sufficient
+    desc="Get negative Pacemaker return code (with name)"
+    cmd="crm_error -n -r -- -1005"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get negative Pacemaker return code (with name) (XML)"
+    cmd="crm_error -n -r --output-as=xml -- -1005"
+    test_assert_validate $CRM_EX_OK 0
+
+    # We can only rely on our custom codes (negative and zero)
+    desc="List Pacemaker return codes (non-positive)"
+    cmd="crm_error -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
+    test_assert $CRM_EX_OK 0
+
+    desc="List Pacemaker return codes (non-positive) (XML)"
+    cmd="crm_error -l -r --output-as=xml > $TMPFILE; rc=$?"
+    cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
+    cmd="$cmd; (exit $rc)"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="List Pacemaker return codes (non-positive) (with names)"
+    cmd="crm_error -n -l -r | grep -E '^[[:blank:]]*(-[[:digit:]]+|0):'"
+    test_assert $CRM_EX_OK 0
+
+    desc="List Pacemaker return codes (non-positive) (with names) (XML)"
+    cmd="crm_error -n -l -r --output-as=xml > $TMPFILE; rc=$?"
+    cmd="$cmd; grep -E -v '<result-code.*code=\"[[:digit:]]' $TMPFILE"
+    cmd="$cmd; (exit $rc)"
+    test_assert_validate $CRM_EX_OK 0
+
+    # crm_exit_t exit codes
+
+    desc="Get unknown crm_exit_t exit code"
+    cmd="crm_error -X -- -10000"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get unknown crm_exit_t exit code (XML)"
+    cmd="crm_error -X --output-as=xml -- -10000"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get unknown crm_exit_t exit code (with name)"
+    cmd="crm_error -n -X -- -10000"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get unknown crm_exit_t exit code (with name) (XML)"
+    cmd="crm_error -n -X --output-as=xml -- -10000"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get crm_exit_t exit code"
+    cmd="crm_error -X -- 1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get crm_exit_t exit code (XML)"
+    cmd="crm_error -X --output-as=xml -- 1"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get crm_exit_t exit code (with name)"
+    cmd="crm_error -n -X -- 1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get crm_exit_t exit code (with name) (XML)"
+    cmd="crm_error -n -X --output-as=xml -- 1"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get all crm_exit_t exit codes"
+    cmd="crm_error -l -X"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get all crm_exit_t exit codes (XML)"
+    cmd="crm_error -l -X --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get all crm_exit_t exit codes (with name)"
+    cmd="crm_error -l -n -X"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get all crm_exit_t exit codes (with name) (XML)"
+    cmd="crm_error -l -n -X --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    rm -f "$TMPFILE"
+}
+
+function test_tools() {
+    local TMPXML
+    local TMPORIG
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    TMPORIG=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.existing.xml.XXXXXXXXXX)
+
+    create_shadow_cib --create-empty
+
+    desc="Validate CIB"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_OK
+
+    desc="Query the value of an attribute that does not exist"
+    cmd="crm_attribute -n ABCD --query --quiet"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Configure something before erasing"
+    cmd="crm_attribute -n cluster-delay -v 60s"
+    test_assert $CRM_EX_OK
+
+    desc="Require --force for CIB erasure"
+    cmd="cibadmin -E"
+    test_assert $CRM_EX_UNSAFE
+
+    desc="Allow CIB erasure with --force"
+    cmd="cibadmin -E --force"
+    test_assert $CRM_EX_OK 0
+
+    # Skip outputting the resulting CIB in the previous command, and delete
+    # rsc_defaults now, so tests behave the same regardless of build options.
+    delete_shadow_resource_defaults
+
+    # Verify the output after erasure
+    desc="Query CIB"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_OK
+
+    # Save a copy of the CIB for a later test
+    cibadmin -Q > "$TMPORIG"
+
+    desc="Set cluster option"
+    cmd="crm_attribute -n cluster-delay -v 60s"
+    test_assert $CRM_EX_OK
+
+    desc="Query new cluster option"
+    cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
+    test_assert $CRM_EX_OK
+
+    desc="Query cluster options"
+    cmd="cibadmin -Q -o crm_config > $TMPXML"
+    test_assert $CRM_EX_OK
+
+    desc="Set no-quorum policy"
+    cmd="crm_attribute -n no-quorum-policy -v ignore"
+    test_assert $CRM_EX_OK
+
+    desc="Delete nvpair"
+    cmd="cibadmin -D -o crm_config --xml-text '<nvpair id=\"cib-bootstrap-options-cluster-delay\"/>'"
+    test_assert $CRM_EX_OK
+
+    desc="Create operation should fail"
+    cmd="cibadmin -C -o crm_config --xml-file $TMPXML"
+    test_assert $CRM_EX_EXISTS
+
+    desc="Modify cluster options section"
+    cmd="cibadmin -M -o crm_config --xml-file $TMPXML"
+    test_assert $CRM_EX_OK
+
+    desc="Query updated cluster option"
+    cmd="cibadmin -Q -o crm_config | grep cib-bootstrap-options-cluster-delay"
+    test_assert $CRM_EX_OK
+
+    desc="Set duplicate cluster option"
+    cmd="crm_attribute -n cluster-delay -v 40s -s duplicate"
+    test_assert $CRM_EX_OK
+
+    desc="Setting multiply defined cluster option should fail"
+    cmd="crm_attribute -n cluster-delay -v 30s"
+    test_assert $CRM_EX_MULTIPLE
+
+    desc="Set cluster option with -s"
+    cmd="crm_attribute -n cluster-delay -v 30s -s duplicate"
+    test_assert $CRM_EX_OK
+
+    desc="Delete cluster option with -i"
+    cmd="crm_attribute -n cluster-delay -D -i cib-bootstrap-options-cluster-delay"
+    test_assert $CRM_EX_OK
+
+    desc="Create node1 and bring it online"
+    cmd="crm_simulate --live-check --in-place --node-up=node1"
+    test_assert $CRM_EX_OK
+
+    desc="Create node attribute"
+    cmd="crm_attribute -n ram -v 1024M -N node1 -t nodes"
+    test_assert $CRM_EX_OK
+
+    desc="Query new node attribute"
+    cmd="cibadmin -Q -o nodes | grep node1-ram"
+    test_assert $CRM_EX_OK
+
+    desc="Create second node attribute"
+    cmd="crm_attribute -n rattr -v XYZ -N node1 -t nodes"
+    test_assert $CRM_EX_OK
+
+    desc="Query node attributes by pattern"
+    cmd="crm_attribute -t nodes -P 'ra.*' -N node1 --query"
+    test_assert $CRM_EX_OK 0
+
+    desc="Update node attributes by pattern"
+    cmd="crm_attribute -t nodes -P 'rat.*' -N node1 -v 10"
+    test_assert $CRM_EX_OK
+
+    desc="Delete node attributes by pattern"
+    cmd="crm_attribute -t nodes -P 'rat.*' -N node1 -D"
+    test_assert $CRM_EX_OK
+
+    desc="Set a transient (fail-count) node attribute"
+    cmd="crm_attribute -n fail-count-foo -v 3 -N node1 -t status"
+    test_assert $CRM_EX_OK
+
+    desc="Query a fail count"
+    cmd="crm_failcount --query -r foo -N node1"
+    test_assert $CRM_EX_OK
+
+    desc="Show node attributes with crm_simulate"
+    cmd="crm_simulate --live-check --show-attrs"
+    test_assert $CRM_EX_OK 0
+
+    desc="Set a second transient node attribute"
+    cmd="crm_attribute -n fail-count-bar -v 5 -N node1 -t status"
+    test_assert $CRM_EX_OK
+
+    desc="Query transient node attributes by pattern"
+    cmd="crm_attribute -t status -P fail-count -N node1 --query"
+    test_assert $CRM_EX_OK 0
+
+    desc="Update transient node attributes by pattern"
+    cmd="crm_attribute -t status -P fail-count -N node1 -v 10"
+    test_assert $CRM_EX_OK
+
+    desc="Delete transient node attributes by pattern"
+    cmd="crm_attribute -t status -P fail-count -N node1 -D"
+    test_assert $CRM_EX_OK
+
+    desc="crm_attribute given invalid delete usage"
+    cmd="crm_attribute -t nodes -N node1 -D"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Set a utilization node attribute"
+    cmd="crm_attribute -n cpu -v 1 -N node1 -z"
+    test_assert $CRM_EX_OK
+
+    desc="Query utilization node attribute"
+    cmd="crm_attribute --query -n cpu -N node1 -z"
+    test_assert $CRM_EX_OK 0
+
+    desc="Digest calculation"
+    cmd="cibadmin -Q | cibadmin -5 -p 2>&1 > /dev/null"
+    test_assert $CRM_EX_OK
+
+    # This update will fail because it has version numbers
+    desc="Replace operation should fail"
+    cmd="cibadmin -R --xml-file $TMPORIG"
+    test_assert $CRM_EX_OLD
+
+    desc="Default standby value"
+    cmd="crm_standby -N node1 -G"
+    test_assert $CRM_EX_OK
+
+    desc="Set standby status"
+    cmd="crm_standby -N node1 -v true"
+    test_assert $CRM_EX_OK
+
+    desc="Query standby value"
+    cmd="crm_standby -N node1 -G"
+    test_assert $CRM_EX_OK
+
+    desc="Delete standby value"
+    cmd="crm_standby -N node1 -D"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource"
+    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
+    test_assert $CRM_EX_OK
+
+    desc="crm_resource run with extra arguments"
+    cmd="crm_resource foo bar"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="crm_resource given both -r and resource config"
+    cmd="crm_resource -r xyz --class ocf --provider pacemaker --agent Dummy"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="crm_resource given resource config with invalid action"
+    cmd="crm_resource --class ocf --provider pacemaker --agent Dummy -D"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Create a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -p is-managed -v false"
+    test_assert $CRM_EX_OK
+
+    desc="Query a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -g is-managed"
+    test_assert $CRM_EX_OK
+
+    desc="Remove a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -d is-managed"
+    test_assert $CRM_EX_OK
+
+    desc="Create another resource meta attribute"
+    cmd="crm_resource -r dummy --meta -p target-role -v Stopped --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Show why a resource is not running"
+    cmd="crm_resource -Y -r dummy --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Remove another resource meta attribute"
+    cmd="crm_resource -r dummy --meta -d target-role --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get a non-existent attribute from a resource element with output-as=xml"
+    cmd="crm_resource -r dummy --get-parameter nonexistent --element --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get a non-existent attribute from a resource element without output-as=xml"
+    cmd="crm_resource -r dummy --get-parameter nonexistent --element"
+    test_assert $CRM_EX_OK
+
+    desc="Get an existent attribute from a resource element with output-as=xml"
+    cmd="crm_resource -r dummy --get-parameter class --element --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get an existent attribute from a resource element without output-as=xml"
+    cmd="crm_resource -r dummy --get-parameter class --element"
+    test_assert $CRM_EX_OK
+
+    desc="Set a non-existent attribute for a resource element with output-as=xml"
+    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml"
+    test_assert $CRM_EX_OK
+
+    desc="Set an existent attribute for a resource element with output-as=xml"
+    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element --output-as=xml"
+    test_assert $CRM_EX_OK
+
+    desc="Delete an existent attribute for a resource element with output-as=xml"
+    cmd="crm_resource -r dummy -d description --element --output-as=xml"
+    test_assert $CRM_EX_OK
+
+    desc="Delete a non-existent attribute for a resource element with output-as=xml"
+    cmd="crm_resource -r dummy -d description --element --output-as=xml"
+    test_assert $CRM_EX_OK
+
+    desc="Set a non-existent attribute for a resource element without output-as=xml"
+    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element"
+    test_assert $CRM_EX_OK
+
+    desc="Set an existent attribute for a resource element without output-as=xml"
+    cmd="crm_resource -r dummy --set-parameter=description -v test_description --element"
+    test_assert $CRM_EX_OK
+
+    desc="Delete an existent attribute for a resource element without output-as=xml"
+    cmd="crm_resource -r dummy -d description --element"
+    test_assert $CRM_EX_OK
+
+    desc="Delete a non-existent attribute for a resource element without output-as=xml"
+    cmd="crm_resource -r dummy -d description --element"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource attribute"
+    cmd="crm_resource -r dummy -p delay -v 10s"
+    test_assert $CRM_EX_OK
+
+    desc="List the configured resources"
+    cmd="crm_resource -L"
+    test_assert $CRM_EX_OK
+
+    desc="List the configured resources in XML"
+    cmd="crm_resource -L --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Implicitly list the configured resources"
+    cmd="crm_resource"
+    test_assert $CRM_EX_OK 0
+
+    desc="List IDs of instantiated resources"
+    cmd="crm_resource -l"
+    test_assert $CRM_EX_OK 0
+
+    desc="Show XML configuration of resource"
+    cmd="crm_resource -q -r dummy"
+    test_assert $CRM_EX_OK 0
+
+    desc="Show XML configuration of resource, output as XML"
+    cmd="crm_resource -q -r dummy --output-as=xml"
+    test_assert $CRM_EX_OK 0
+
+    desc="Require a destination when migrating a resource that is stopped"
+    cmd="crm_resource -r dummy -M"
+    test_assert $CRM_EX_USAGE
+
+    desc="Don't support migration to non-existent locations"
+    cmd="crm_resource -r dummy -M -N i.do.not.exist"
+    test_assert $CRM_EX_NOSUCH
+
+    desc="Create a fencing resource"
+    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"Fence\" class=\"stonith\" type=\"fence_true\"/>'"
+    test_assert $CRM_EX_OK
+
+    desc="Bring resources online"
+    cmd="crm_simulate --live-check --in-place -S"
+    test_assert $CRM_EX_OK
+
+    desc="Try to move a resource to its existing location"
+    cmd="crm_resource -r dummy --move --node node1"
+    test_assert $CRM_EX_EXISTS
+
+    desc="Try to move a resource that doesn't exist"
+    cmd="crm_resource -r xyz --move --node node1"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Move a resource from its existing location"
+    cmd="crm_resource -r dummy --move"
+    test_assert $CRM_EX_OK
+
+    desc="Clear out constraints generated by --move"
+    cmd="crm_resource -r dummy --clear"
+    test_assert $CRM_EX_OK
+
+    desc="Default ticket granted state"
+    cmd="crm_ticket -t ticketA -G granted -d false"
+    test_assert $CRM_EX_OK
+
+    desc="Set ticket granted state"
+    cmd="crm_ticket -t ticketA -r --force"
+    test_assert $CRM_EX_OK
+
+    desc="Query ticket granted state"
+    cmd="crm_ticket -t ticketA -G granted"
+    test_assert $CRM_EX_OK
+
+    desc="Delete ticket granted state"
+    cmd="crm_ticket -t ticketA -D granted --force"
+    test_assert $CRM_EX_OK
+
+    desc="Make a ticket standby"
+    cmd="crm_ticket -t ticketA -s"
+    test_assert $CRM_EX_OK
+
+    desc="Query ticket standby state"
+    cmd="crm_ticket -t ticketA -G standby"
+    test_assert $CRM_EX_OK
+
+    desc="Activate a ticket"
+    cmd="crm_ticket -t ticketA -a"
+    test_assert $CRM_EX_OK
+
+    desc="Delete ticket standby state"
+    cmd="crm_ticket -t ticketA -D standby"
+    test_assert $CRM_EX_OK
+
+    desc="Ban a resource on unknown node"
+    cmd="crm_resource -r dummy -B -N host1"
+    test_assert $CRM_EX_NOSUCH
+
+    desc="Create two more nodes and bring them online"
+    cmd="crm_simulate --live-check --in-place --node-up=node2 --node-up=node3"
+    test_assert $CRM_EX_OK
+
+    desc="Ban dummy from node1"
+    cmd="crm_resource -r dummy -B -N node1"
+    test_assert $CRM_EX_OK
+
+    desc="Show where a resource is running"
+    cmd="crm_resource -r dummy -W"
+    test_assert $CRM_EX_OK 0
+
+    desc="Show constraints on a resource"
+    cmd="crm_resource -a -r dummy"
+    test_assert $CRM_EX_OK 0
+
+    desc="Ban dummy from node2"
+    cmd="crm_resource -r dummy -B -N node2 --output-as=xml"
+    test_assert_validate $CRM_EX_OK
+
+    desc="Relocate resources due to ban"
+    cmd="crm_simulate --live-check --in-place -S"
+    test_assert $CRM_EX_OK
+
+    desc="Move dummy to node1"
+    cmd="crm_resource -r dummy -M -N node1 --output-as=xml"
+    test_assert_validate $CRM_EX_OK
+
+    desc="Clear implicit constraints for dummy on node2"
+    cmd="crm_resource -r dummy -U -N node2"
+    test_assert $CRM_EX_OK
+
+    desc="Drop the status section"
+    cmd="cibadmin -R -o status --xml-text '<status/>'"
+    test_assert $CRM_EX_OK 0
+
+    desc="Create a clone"
+    cmd="cibadmin -C -o resources --xml-text '<clone id=\"test-clone\"><primitive id=\"test-primitive\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/></clone>'"
+    test_assert $CRM_EX_OK 0
+
+    desc="Create a resource meta attribute"
+    cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource meta attribute in the primitive"
+    cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
+    test_assert $CRM_EX_OK
+
+    desc="Update resource meta attribute with duplicates"
+    cmd="crm_resource -r test-clone --meta -p is-managed -v true"
+    test_assert $CRM_EX_OK
+
+    desc="Update resource meta attribute with duplicates (force clone)"
+    cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
+    test_assert $CRM_EX_OK
+
+    desc="Update child resource meta attribute with duplicates"
+    cmd="crm_resource -r test-primitive --meta -p is-managed -v false"
+    test_assert $CRM_EX_OK
+
+    desc="Delete resource meta attribute with duplicates"
+    cmd="crm_resource -r test-clone --meta -d is-managed"
+    test_assert $CRM_EX_OK
+
+    desc="Delete resource meta attribute in parent"
+    cmd="crm_resource -r test-primitive --meta -d is-managed"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource meta attribute in the primitive"
+    cmd="crm_resource -r test-primitive --meta -p is-managed -v false --force"
+    test_assert $CRM_EX_OK
+
+    desc="Update existing resource meta attribute"
+    cmd="crm_resource -r test-clone --meta -p is-managed -v true"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource meta attribute in the parent"
+    cmd="crm_resource -r test-clone --meta -p is-managed -v true --force"
+    test_assert $CRM_EX_OK
+
+    desc="Copy resources"
+    cmd="cibadmin -Q -o resources > $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    desc="Delete resource parent meta attribute (force)"
+    cmd="crm_resource -r test-clone --meta -d is-managed --force"
+    test_assert $CRM_EX_OK
+
+    desc="Restore duplicates"
+    cmd="cibadmin -R -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK
+
+    desc="Delete resource child meta attribute"
+    cmd="crm_resource -r test-primitive --meta -d is-managed"
+    test_assert $CRM_EX_OK
+
+    desc="Create the dummy-group resource group"
+    cmd="cibadmin -C -o resources --xml-text '<group id=\"dummy-group\">"
+    cmd="$cmd <primitive id=\"dummy1\" class=\"ocf\" provider=\"pacemaker\""
+    cmd="$cmd     type=\"Dummy\"/>"
+    cmd="$cmd <primitive id=\"dummy2\" class=\"ocf\" provider=\"pacemaker\""
+    cmd="$cmd     type=\"Dummy\"/>"
+    cmd="$cmd </group>'"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource meta attribute in dummy1"
+    cmd="crm_resource -r dummy1 --meta -p is-managed -v true"
+    test_assert $CRM_EX_OK
+
+    desc="Create a resource meta attribute in dummy-group"
+    cmd="crm_resource -r dummy-group --meta -p is-managed -v false"
+    test_assert $CRM_EX_OK
+
+    desc="Delete the dummy-group resource group"
+    cmd="cibadmin -D -o resources --xml-text '<group id=\"dummy-group\">'"
+    test_assert $CRM_EX_OK
+
+    desc="Specify a lifetime when moving a resource"
+    cmd="crm_resource -r dummy --move --node node2 --lifetime=PT1H"
+    test_assert $CRM_EX_OK
+
+    desc="Try to move a resource previously moved with a lifetime"
+    cmd="crm_resource -r dummy --move --node node1"
+    test_assert $CRM_EX_OK
+
+    desc="Ban dummy from node1 for a short time"
+    cmd="crm_resource -r dummy -B -N node1 --lifetime=PT1S"
+    test_assert $CRM_EX_OK
+
+    desc="Remove expired constraints"
+    sleep 2
+    cmd="crm_resource --clear --expired"
+    test_assert $CRM_EX_OK
+
+    # Clear has already been tested elsewhere, but we need to get rid of the
+    # constraints so testing delete works.  It won't delete if there's still
+    # a reference to the resource somewhere.
+    desc="Clear all implicit constraints for dummy"
+    cmd="crm_resource -r dummy -U"
+    test_assert $CRM_EX_OK
+
+    desc="Set a node health strategy"
+    cmd="crm_attribute -n node-health-strategy -v migrate-on-red"
+    test_assert $CRM_EX_OK
+
+    desc="Set a node health attribute"
+    cmd="crm_attribute -N node3 -n '#health-cts-cli' -v red"
+    test_assert $CRM_EX_OK
+
+    desc="Show why a resource is not running on an unhealthy node"
+    cmd="crm_resource -N node3 -Y -r dummy --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Delete a resource"
+    cmd="crm_resource -D -r dummy -t primitive"
+    test_assert $CRM_EX_OK
+
+    unset CIB_shadow
+    unset CIB_shadow_dir
+
+    desc="Create an XML patchset"
+    cmd="crm_diff -o $test_home/cli/crm_diff_old.xml -n $test_home/cli/crm_diff_new.xml"
+    test_assert $CRM_EX_ERROR 0
+
+    export CIB_file="$test_home/cli/constraints.xml"
+
+    for rsc in prim1 prim2 prim3 prim4 prim5 prim6 prim7 prim8 prim9 \
+               prim10 prim11 prim12 prim13 group clone; do
+        desc="Check locations and constraints for $rsc"
+        cmd="crm_resource -a -r $rsc"
+        test_assert $CRM_EX_OK 0
+
+        desc="Recursively check locations and constraints for $rsc"
+        cmd="crm_resource -A -r $rsc"
+        test_assert $CRM_EX_OK 0
+
+        desc="Check locations and constraints for $rsc in XML"
+        cmd="crm_resource -a -r $rsc --output-as=xml"
+        test_assert_validate $CRM_EX_OK 0
+
+        desc="Recursively check locations and constraints for $rsc in XML"
+        cmd="crm_resource -A -r $rsc --output-as=xml"
+        test_assert_validate $CRM_EX_OK 0
+    done
+
+    desc="Check locations and constraints for group member (referring to group)"
+    cmd="crm_resource -a -r gr2"
+    test_assert $CRM_EX_OK 0
+
+    desc="Check locations and constraints for group member (without referring to group)"
+    cmd="crm_resource -a -r gr2 --force"
+    test_assert $CRM_EX_OK 0
+
+    # Create a shadow CIB based on constraints.xml
+    create_shadow_cib --create
+    unset CIB_file
+
+    desc="Set a meta-attribute for primitive and resources colocated with it"
+    cmd="crm_resource -r prim5 --meta --set-parameter=target-role -v Stopped --recursive"
+    test_assert $CRM_EX_OK 0
+
+    desc="Set a meta-attribute for group and resource colocated with it"
+    cmd="crm_resource -r group --meta --set-parameter=target-role -v Stopped --recursive"
+    test_assert $CRM_EX_OK 0
+
+    desc="Set a meta-attribute for clone and resource colocated with it"
+    cmd="crm_resource -r clone --meta --set-parameter=target-role -v Stopped --recursive"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_shadow
+    unset CIB_shadow_dir
+
+    export CIB_file="$test_home/cli/crm_resource_digests.xml"
+
+    desc="Show resource digests"
+    cmd="crm_resource --digests -r rsc1 -N node1 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Show resource digests with overrides"
+    cmd="$cmd CRM_meta_interval=10000 CRM_meta_timeout=20000"
+    test_assert $CRM_EX_OK 0
+
+    desc="Show resource operations"
+    cmd="crm_resource --list-operations"
+    test_assert $CRM_EX_OK 0
+
+    desc="Show resource operations (XML)"
+    cmd="crm_resource --list-operations --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    unset CIB_file
+
+    export CIB_file="$test_home/cli/crmadmin-cluster-remote-guest-nodes.xml"
+
+    desc="List all nodes"
+    cmd="crmadmin -N"
+    test_assert $CRM_EX_OK 0
+
+    desc="Minimally list all nodes"
+    cmd="crmadmin -N -q"
+    test_assert $CRM_EX_OK 0
+
+    desc="List all nodes as bash exports"
+    cmd="crmadmin -N -B"
+    test_assert $CRM_EX_OK 0
+
+    desc="List cluster nodes"
+    cmd="crmadmin -N cluster | wc -l | grep 6"
+    test_assert $CRM_EX_OK 0
+
+    desc="List guest nodes"
+    cmd="crmadmin -N guest | wc -l | grep 2"
+    test_assert $CRM_EX_OK 0
+
+    desc="List remote nodes"
+    cmd="crmadmin -N remote | wc -l | grep 3"
+    test_assert $CRM_EX_OK 0
+
+    desc="List cluster,remote nodes"
+    cmd="crmadmin -N cluster,remote | wc -l | grep 9"
+    test_assert $CRM_EX_OK 0
+
+    desc="List guest,remote nodes"
+    cmd="crmadmin -N guest,remote | wc -l | grep 5"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_file
+
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    export CIB_shadow_dir="${shadow_dir}"
+
+    desc="Show allocation scores with crm_simulate"
+    cmd="crm_simulate -x $CIB_file --show-scores --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Show utilization with crm_simulate"
+    cmd="crm_simulate -x $CIB_file --show-utilization"
+    test_assert $CRM_EX_OK 0
+
+    desc="Simulate injecting a failure"
+    cmd="crm_simulate -x $CIB_file -S -i ping_monitor_10000@cluster02=1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Simulate bringing a node down"
+    cmd="crm_simulate -x $CIB_file -S --node-down=cluster01"
+    test_assert $CRM_EX_OK 0
+
+    desc="Simulate a node failing"
+    cmd="crm_simulate -x $CIB_file -S --node-fail=cluster02"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_shadow_dir
+
+    desc="List a promotable clone resource"
+    cmd="crm_resource --locate -r promotable-clone"
+    test_assert $CRM_EX_OK 0
+
+    desc="List the primitive of a promotable clone resource"
+    cmd="crm_resource --locate -r promotable-rsc"
+    test_assert $CRM_EX_OK 0
+
+    desc="List a single instance of a promotable clone resource"
+    cmd="crm_resource --locate -r promotable-rsc:0"
+    test_assert $CRM_EX_OK 0
+
+    desc="List another instance of a promotable clone resource"
+    cmd="crm_resource --locate -r promotable-rsc:1"
+    test_assert $CRM_EX_OK 0
+
+    desc="List a promotable clone resource in XML"
+    cmd="crm_resource --locate -r promotable-clone --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="List the primitive of a promotable clone resource in XML"
+    cmd="crm_resource --locate -r promotable-rsc --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="List a single instance of a promotable clone resource in XML"
+    cmd="crm_resource --locate -r promotable-rsc:0 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="List another instance of a promotable clone resource in XML"
+    cmd="crm_resource --locate -r promotable-rsc:1 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Try to move an instance of a cloned resource"
+    cmd="crm_resource -r promotable-rsc:0 --move --node node1"
+    test_assert $CRM_EX_INVALID_PARAM 0
+
+    # Create a sandbox copy of crm_mon.xml
+    cibadmin -Q > "$TMPXML"
+    export CIB_file="$TMPXML"
+
+    desc="Query a nonexistent promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Query a nonexistent promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Delete a nonexistent promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
+    test_assert $CRM_EX_OK 0
+
+    desc="Delete a nonexistent promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Query after deleting a nonexistent promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Query after deleting a nonexistent promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Update a nonexistent promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Update a nonexistent promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 1 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Query after updating a nonexistent promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
+    test_assert $CRM_EX_OK 0
+
+    desc="Query after updating a nonexistent promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Update an existing promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5"
+    test_assert $CRM_EX_OK 0
+
+    desc="Update an existing promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -v 5 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Query after updating an existing promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
+    test_assert $CRM_EX_OK 0
+
+    desc="Query after updating an existing promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Delete an existing promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -D"
+    test_assert $CRM_EX_OK 0
+
+    desc="Delete an existing promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -D --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Query after deleting an existing promotable score attribute"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Query after deleting an existing promotable score attribute (XML)"
+    cmd="crm_attribute -N cluster01 -p promotable-rsc -G --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    # Test for an issue with legacy command line parsing when the resource is
+    # specified in the environment (CLBZ#5509)
+    export OCF_RESOURCE_INSTANCE=promotable-rsc
+
+    desc="Update a promotable score attribute to -INFINITY"
+    cmd="crm_attribute -N cluster01 -p -v -INFINITY"
+    test_assert $CRM_EX_OK 0
+
+    desc="Update a promotable score attribute to -INFINITY (XML)"
+    cmd="crm_attribute -N cluster01 -p -v -INFINITY --output-as=xml"
+    test_assert $CRM_EX_OK 0
+
+    desc="Query after updating a promotable score attribute to -INFINITY"
+    cmd="crm_attribute -N cluster01 -p -G"
+    test_assert $CRM_EX_OK 0
+
+    desc="Query after updating a promotable score attribute to -INFINITY (XML)"
+    cmd="crm_attribute -N cluster01 -p -G --output-as=xml"
+    test_assert $CRM_EX_OK 0
+
+    desc="Try OCF_RESOURCE_INSTANCE if -p is specified with an empty string"
+    cmd="crm_attribute -N cluster01 -p '' -G"
+    test_assert $CRM_EX_OK 0
+
+    export OCF_RESOURCE_INSTANCE=""
+
+    desc="Return usage error if both -p and OCF_RESOURCE_INSTANCE are empty strings"
+    cmd="crm_attribute -N cluster01 -p '' -G"
+    test_assert $CRM_EX_USAGE 0
+
+    unset CIB_file
+    unset OCF_RESOURCE_INSTANCE
+
+    export CIB_file="-"
+
+    desc="Check that CIB_file=\"-\" works - crm_mon"
+    cmd="cat $test_home/cli/crm_mon.xml | crm_mon -1"
+    test_assert $CRM_EX_OK 0
+
+    desc="Check that CIB_file=\"-\" works - crm_resource"
+    cmd="cat $test_home/cli/crm_resource_digests.xml | crm_resource --digests -r rsc1 -N node1 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Check that CIB_file=\"-\" works - crmadmin"
+    cmd="cat $test_home/cli/crmadmin-cluster-remote-guest-nodes.xml | crmadmin -N | wc -l | grep 11"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_file
+    rm -f "$TMPXML" "$TMPORIG"
+
+
+    # crm_shadow tests
+
+    unset CIB_shadow
+    unset CIB_shadow_dir
+
+    # Query with no active shadow instance
+    desc="Get active shadow instance (no active instance)"
+    cmd="crm_shadow --which"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance (no active instance) (XML)"
+    cmd="crm_shadow --which --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's file name (no active instance)"
+    cmd="crm_shadow --file"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's file name (no active instance) (XML)"
+    cmd="crm_shadow --file --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's contents (no active instance)"
+    cmd="crm_shadow --display"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's contents (no active instance) (XML)"
+    cmd="crm_shadow --display --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's diff (no active instance)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's diff (no active instance) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    # Create new shadow instance based on active CIB
+    # Don't use create_shadow_cib() here; test explicitly
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    export CIB_shadow="$shadow"
+    export CIB_shadow_dir="$shadow_dir"
+
+    # Delete the shadow file if it already exists
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create copied shadow instance"
+    cmd="crm_shadow --create $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create copied shadow instance (XML)"
+    cmd="crm_shadow --create $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Query shadow instance based on active CIB
+    desc="Get active shadow instance (copied)"
+    cmd="crm_shadow --which"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance (copied) (XML)"
+    cmd="crm_shadow --which --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's file name (copied)"
+    cmd="crm_shadow --file"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's file name (copied) (XML)"
+    cmd="crm_shadow --file --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's contents (copied)"
+    cmd="crm_shadow --display"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's contents (copied) (XML)"
+    cmd="crm_shadow --display --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (copied)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (copied) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Make some changes to the shadow file
+    export CIB_file="$(crm_shadow --file)"
+
+    cibadmin --modify --xml-text '<primitive id="dummy" description="desc"/>'
+    cibadmin --delete --xml-text '<op_defaults/>'
+    cibadmin --create -o resources --xml-text \
+        '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
+
+    state="<node_state id=\"3\" uname=\"cluster03\" in_ccm=\"true\""
+    state="$state crmd=\"online\" crm-debug-origin=\"do_update_resource\""
+    state="$state join=\"member\" expected=\"member\">"
+
+    cibadmin --create -o status --xml-text "$state"
+    unset state
+
+    export CIB_file="$test_home/cli/crm_mon.xml"
+
+    desc="Get active shadow instance's diff (after changes)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_ERROR 0
+
+    desc="Get active shadow instance's diff (after changes) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_ERROR 0
+
+    # Commit the modified shadow CIB to a temp active CIB file
+    cp "$test_home/cli/crm_mon.xml" "$TMPXML"
+    export CIB_file="$TMPXML"
+
+    desc="Commit shadow instance"
+    cmd="crm_shadow --commit $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (force)"
+    cmd="crm_shadow --commit $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (after commit)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_ERROR 0
+
+    desc="Commit shadow instance (force) (all)"
+    cmd="crm_shadow --commit $shadow --force --all"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (after commit all)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_ERROR 0
+
+    # Repeat sequence with XML output
+    cp "$test_home/cli/crm_mon.xml" "$TMPXML"
+    export CIB_file="$TMPXML"
+
+    desc="Commit shadow instance (XML)"
+    cmd="crm_shadow --commit $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (force) (XML)"
+    cmd="crm_shadow --commit $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (after commit) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_ERROR 0
+
+    desc="Commit shadow instance (force) (all) (XML)"
+    cmd="crm_shadow --commit $shadow --force --all --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (after commit all) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_ERROR 0
+
+    # Commit an inactive shadow instance with no active instance
+    unset CIB_shadow
+
+    desc="Commit shadow instance (no active instance)"
+    cmd="crm_shadow --commit $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (no active instance) (force)"
+    cmd="crm_shadow --commit $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    desc="Commit shadow instance (no active instance) (XML)"
+    cmd="crm_shadow --commit $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (no active instance) (force) (XML)"
+    cmd="crm_shadow --commit $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Commit an inactive shadow instance with an active instance
+    export CIB_shadow="nonexistent_shadow"
+
+    desc="Commit shadow instance (mismatch)"
+    cmd="crm_shadow --commit $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (mismatch) (force)"
+    cmd="crm_shadow --commit $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    desc="Commit shadow instance (mismatch) (XML)"
+    cmd="crm_shadow --commit $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (mismatch) (force) (XML)"
+    cmd="crm_shadow --commit $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Commit an active shadow instance whose shadow file is missing
+    desc="Commit shadow instance (nonexistent shadow file)"
+    cmd="crm_shadow --commit $CIB_shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (nonexistent shadow file) (force)"
+    cmd="crm_shadow --commit $CIB_shadow --force"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's diff (nonexistent shadow file)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Commit shadow instance (nonexistent shadow file) (XML)"
+    cmd="crm_shadow --commit $CIB_shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (nonexistent shadow file) (force) (XML)"
+    cmd="crm_shadow --commit $CIB_shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's diff (nonexistent shadow file) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    # Commit an active shadow instance when the CIB file is missing
+    export CIB_file="$test_home/cli/nonexistent_cib.xml"
+    export CIB_shadow="$shadow"
+
+    desc="Commit shadow instance (nonexistent CIB file)"
+    cmd="crm_shadow --commit $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (nonexistent CIB file) (force)"
+    cmd="crm_shadow --commit $shadow --force"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's diff (nonexistent CIB file)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Commit shadow instance (nonexistent CIB file) (XML)"
+    cmd="crm_shadow --commit $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Commit shadow instance (nonexistent CIB file) (force) (XML)"
+    cmd="crm_shadow --commit $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Get active shadow instance's diff (nonexistent CIB file) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    rm -f "$TMPXML"
+
+    # Delete an active shadow instance
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    export CIB_shadow="$shadow"
+
+    desc="Delete shadow instance"
+    cmd="crm_shadow --delete $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (force)"
+    cmd="crm_shadow --delete $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    create_shadow_cib --create
+
+    desc="Delete shadow instance (XML)"
+    cmd="crm_shadow --delete $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (force) (XML)"
+    cmd="crm_shadow --delete $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Delete an inactive shadow instance with no active instance
+    create_shadow_cib --create
+    unset CIB_shadow
+
+    desc="Delete shadow instance (no active instance)"
+    cmd="crm_shadow --delete $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (no active instance) (force)"
+    cmd="crm_shadow --delete $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    create_shadow_cib --create
+    unset CIB_shadow
+
+    desc="Delete shadow instance (no active instance) (XML)"
+    cmd="crm_shadow --delete $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (no active instance) (force) (XML)"
+    cmd="crm_shadow --delete $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Delete an inactive shadow instance with an active instance
+    create_shadow_cib --create
+    export CIB_shadow="nonexistent_shadow"
+
+    desc="Delete shadow instance (mismatch)"
+    cmd="crm_shadow --delete $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (mismatch) (force)"
+    cmd="crm_shadow --delete $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    create_shadow_cib --create
+    export CIB_shadow="nonexistent_shadow"
+
+    desc="Delete shadow instance (mismatch) (XML)"
+    cmd="crm_shadow --delete $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (mismatch) (force) (XML)"
+    cmd="crm_shadow --delete $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Delete an active shadow instance whose shadow file is missing
+    desc="Delete shadow instance (nonexistent shadow file)"
+    cmd="crm_shadow --delete $CIB_shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (nonexistent shadow file) (force)"
+    cmd="crm_shadow --delete $CIB_shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    desc="Delete shadow instance (nonexistent shadow file) (XML)"
+    cmd="crm_shadow --delete $CIB_shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (nonexistent shadow file) (force) (XML)"
+    cmd="crm_shadow --delete $CIB_shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Delete an active shadow instance when the CIB file is missing
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    create_shadow_cib --create
+    export CIB_file="$test_home/cli/nonexistent_cib.xml"
+
+    desc="Delete shadow instance (nonexistent CIB file)"
+    cmd="crm_shadow --delete $shadow"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (nonexistent CIB file) (force)"
+    cmd="crm_shadow --delete $shadow --force"
+    test_assert $CRM_EX_OK 0
+
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    create_shadow_cib --create
+    export CIB_file="$test_home/cli/nonexistent_cib.xml"
+
+    desc="Delete shadow instance (nonexistent CIB file) (XML)"
+    cmd="crm_shadow --delete $shadow --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Delete shadow instance (nonexistent CIB file) (force) (XML)"
+    cmd="crm_shadow --delete $shadow --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create new shadow instance based on active CIB with no instance active
+    export CIB_file="$test_home/cli/crm_mon.xml"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+    unset CIB_shadow
+
+    desc="Create copied shadow instance (no active instance)"
+    cmd="crm_shadow --create $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+    unset CIB_shadow
+
+    desc="Create copied shadow instance (no active instance) (XML)"
+    cmd="crm_shadow --create $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create new shadow instance based on active CIB with other instance active
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    export CIB_shadow="nonexistent_shadow"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create copied shadow instance (mismatch)"
+    cmd="crm_shadow --create $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create copied shadow instance (mismatch) (XML)"
+    cmd="crm_shadow --create $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create new shadow instance based on CIB (shadow file already exists)
+    export CIB_file="$test_home/cli/crm_mon.xml"
+
+    desc="Create copied shadow instance (file already exists)"
+    cmd="crm_shadow --create $shadow --batch"
+    test_assert $CRM_EX_CANTCREAT 0
+
+    desc="Create copied shadow instance (file already exists) (force)"
+    cmd="crm_shadow --create $shadow --batch --force"
+    test_assert $CRM_EX_OK 0
+
+    desc="Create copied shadow instance (file already exists) (XML)"
+    cmd="crm_shadow --create $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_CANTCREAT 0
+
+    desc="Create copied shadow instance (file already exists) (force) (XML)"
+    cmd="crm_shadow --create $shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create new shadow instance based on active CIB when the CIB file is missing
+    export CIB_file="$test_home/cli/nonexistent_cib.xml"
+    export CIB_shadow="$shadow"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create copied shadow instance (nonexistent CIB file) (force)"
+    cmd="crm_shadow --create $shadow --batch --force"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Create copied shadow instance (nonexistent CIB file) (force) (XML)"
+    cmd="crm_shadow --create $shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    # Create new empty shadow instance
+    export CIB_shadow="$shadow"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance"
+    cmd="crm_shadow --create-empty $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (XML)"
+    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create empty shadow instance with no active instance
+    unset CIB_shadow
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (no active instance)"
+    cmd="crm_shadow --create-empty $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (no active instance) (XML)"
+    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create empty shadow instance with other instance active
+    export CIB_shadow="nonexistent_shadow"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (mismatch)"
+    cmd="crm_shadow --create-empty $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (mismatch) (XML)"
+    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create empty shadow instance when the CIB file is missing
+    export CIB_file="$test_home/cli/nonexistent_cib.xml"
+    export CIB_shadow="$shadow"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (nonexistent CIB file)"
+    cmd="crm_shadow --create-empty $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Create empty shadow instance (nonexistent CIB file) (XML)"
+    cmd="crm_shadow --create-empty $shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Create empty shadow instance (shadow file already exists)
+    export CIB_file="$test_home/cli/crm_mon.xml"
+
+    desc="Create empty shadow instance (file already exists)"
+    cmd="crm_shadow --create-empty $shadow --batch"
+    test_assert $CRM_EX_CANTCREAT 0
+
+    desc="Create empty shadow instance (file already exists) (force)"
+    cmd="crm_shadow --create-empty $shadow --batch --force"
+    test_assert $CRM_EX_OK 0
+
+    desc="Create empty shadow instance (file already exists) (XML)"
+    cmd="crm_shadow --create-empty $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_CANTCREAT 0
+
+    desc="Create empty shadow instance (file already exists) (force) (XML)"
+    cmd="crm_shadow --create-empty $shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Query shadow instance with an empty CIB.
+    # --which and --file queries were done earlier.
+    delete_shadow_resource_defaults
+
+    desc="Get active shadow instance's contents (empty CIB)"
+    cmd="crm_shadow --display"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's contents (empty CIB) (XML)"
+    cmd="crm_shadow --display --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (empty CIB)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_ERROR 0
+
+    desc="Get active shadow instance's diff (empty CIB) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_ERROR 0
+
+    # Reset shadow instance (overwrite existing shadow file based on active CIB)
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    export CIB_shadow="$shadow"
+
+    desc="Reset shadow instance"
+    cmd="crm_shadow --reset $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (after reset)"
+    cmd="crm_shadow --diff"
+    test_assert $CRM_EX_OK 0
+
+    create_shadow_cib --create-empty
+
+    desc="Reset shadow instance (XML)"
+    cmd="crm_shadow --reset $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Get active shadow instance's diff (after reset) (XML)"
+    cmd="crm_shadow --diff --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Reset an inactive shadow instance with no active instance
+    unset CIB_shadow
+
+    desc="Reset shadow instance (no active instance)"
+    cmd="crm_shadow --reset $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    create_shadow_cib --create-empty
+    unset CIB_shadow
+
+    desc="Reset shadow instance (no active instance) (XML)"
+    cmd="crm_shadow --reset $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Reset an inactive shadow instance with an active instance
+    export CIB_shadow="nonexistent_shadow"
+
+    desc="Reset shadow instance (mismatch)"
+    cmd="crm_shadow --reset $shadow --batch"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="Reset shadow instance (mismatch) (force)"
+    cmd="crm_shadow --reset $shadow --batch --force"
+    test_assert $CRM_EX_OK 0
+
+    create_shadow_cib --create-empty
+    export CIB_shadow="nonexistent_shadow"
+
+    desc="Reset shadow instance (mismatch) (XML)"
+    cmd="crm_shadow --reset $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="Reset shadow instance (mismatch) (force) (XML)"
+    cmd="crm_shadow --reset $shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Reset an active shadow instance when the CIB file is missing
+    create_shadow_cib --create-empty
+    export CIB_file="$test_home/cli/nonexistent_cib.xml"
+
+    desc="Reset shadow instance (nonexistent CIB file)"
+    cmd="crm_shadow --reset $CIB_shadow --batch"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Reset shadow instance (nonexistent CIB file) (XML)"
+    cmd="crm_shadow --reset $CIB_shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Reset shadow instance (nonexistent CIB file) (force)"
+    cmd="crm_shadow --reset $CIB_shadow --batch --force"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Reset shadow instance (nonexistent CIB file) (force) (XML)"
+    cmd="crm_shadow --reset $CIB_shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    # Reset an active shadow instance whose shadow file is missing
+    export CIB_file="$test_home/cli/crm_mon.xml"
+    export CIB_shadow="$shadow"
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Reset shadow instance (nonexistent shadow file)"
+    cmd="crm_shadow --reset $CIB_shadow --batch"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Reset shadow instance (nonexistent shadow file) (force)"
+    cmd="crm_shadow --reset $CIB_shadow --batch --force"
+    test_assert $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Reset shadow instance (nonexistent shadow file) (XML)"
+    cmd="crm_shadow --reset $CIB_shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Reset shadow instance (nonexistent shadow file) (force) (XML)"
+    cmd="crm_shadow --reset $CIB_shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    # Switch shadow instances
+    # In batch mode, this only displays a message
+    create_shadow_cib --create-empty
+
+    # Makes no difference now, just future-proofing
+    CIB_shadow="nonexistent_shadow"
+
+    desc="Switch to new shadow instance"
+    cmd="crm_shadow --switch $shadow --batch"
+    test_assert $CRM_EX_OK 0
+
+    CIB_shadow="nonexistent_shadow"
+
+    desc="Switch to new shadow instance (XML)"
+    cmd="crm_shadow --switch $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    crm_shadow --delete "$shadow" --force >/dev/null 2>&1
+
+    desc="Switch to nonexistent shadow instance"
+    cmd="crm_shadow --switch $shadow --batch"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Switch to nonexistent shadow instance (force)"
+    cmd="crm_shadow --switch $shadow --batch --force"
+    test_assert $CRM_EX_NOSUCH 0
+
+    desc="Switch to nonexistent shadow instance (XML)"
+    cmd="crm_shadow --switch $shadow --batch --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Switch to nonexistent shadow instance (force) (XML)"
+    cmd="crm_shadow --switch $shadow --batch --force --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    unset CIB_file
+    unset CIB_shadow
+    unset CIB_shadow_dir
+}
+
+INVALID_PERIODS=(
+    "2019-01-01 00:00:00Z"              # Start with no end
+    "2019-01-01 00:00:00Z/"             # Start with only a trailing slash
+    "PT2S/P1M"                          # Two durations
+    "2019-13-01 00:00:00Z/P1M"          # Out-of-range month
+    "20191077T15/P1M"                   # Out-of-range day
+    "2019-10-01T25:00:00Z/P1M"          # Out-of-range hour
+    "2019-10-01T24:00:01Z/P1M"          # Hour 24 with anything but :00:00
+    "PT5H/20191001T007000Z"             # Out-of-range minute
+    "2019-10-01 00:00:80Z/P1M"          # Out-of-range second
+    "2019-10-01 00:00:10 +25:00/P1M"    # Out-of-range offset hour
+    "20191001T000010 -00:61/P1M"        # Out-of-range offset minute
+    "P1Y/2019-02-29 00:00:00Z"          # Feb. 29 in non-leap-year
+    "2019-01-01 00:00:00Z/P"            # Duration with no values
+    "P1Z/2019-02-20 00:00:00Z"          # Invalid duration unit
+    "P1YM/2019-02-20 00:00:00Z"         # No number for duration unit
+)
+
+function test_dates() {
+    # Ensure invalid period specifications are rejected
+    for spec in '' "${INVALID_PERIODS[@]}"; do
+        desc="Invalid period - [$spec]"
+        cmd="iso8601 -p \"$spec\""
+        test_assert $CRM_EX_INVALID_PARAM 0
+    done
+
+    desc="2014-01-01 00:30:00 - 1 Hour"
+    cmd="iso8601 -d '2014-01-01 00:30:00Z' -D P-1H -E '2013-12-31 23:30:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="Valid date - Feb 29 in leap year"
+    cmd="iso8601 -d '2020-02-29 00:00:00Z' -E '2020-02-29 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="Valid date - using 'T' and offset"
+    cmd="iso8601 -d '20191201T131211 -05:00' -E '2019-12-01 18:12:11Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="24:00:00 equivalent to 00:00:00 of next day"
+    cmd="iso8601 -d '2019-12-31 24:00:00Z' -E '2020-01-01 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    for y in 06 07 08 09 10 11 12 13 14 15 16 17 18 40; do
+        desc="20$y-W01-7"
+        cmd="iso8601 -d '20$y-W01-7 00Z'"
+        test_assert $CRM_EX_OK 0
+
+        desc="20$y-W01-7 - round-trip"
+        cmd="iso8601 -d '20$y-W01-7 00Z' -W -E '20$y-W01-7 00:00:00Z'"
+        test_assert $CRM_EX_OK 0
+
+        desc="20$y-W01-1"
+        cmd="iso8601 -d '20$y-W01-1 00Z'"
+        test_assert $CRM_EX_OK 0
+
+        desc="20$y-W01-1 - round-trip"
+        cmd="iso8601 -d '20$y-W01-1 00Z' -W -E '20$y-W01-1 00:00:00Z'"
+        test_assert $CRM_EX_OK 0
+    done
+
+    desc="2009-W53-07"
+    cmd="iso8601 -d '2009-W53-7 00:00:00Z' -W -E '2009-W53-7 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="epoch + 2 Years 5 Months 6 Minutes"
+    cmd="iso8601 -d 'epoch' -D P2Y5MT6M -E '1972-06-01 00:06:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="2009-01-31 + 1 Month"
+    cmd="iso8601 -d '20090131T000000Z' -D P1M -E '2009-02-28 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="2009-01-31 + 2 Months"
+    cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P2M -E '2009-03-31 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="2009-01-31 + 3 Months"
+    cmd="iso8601 -d '2009-01-31 00:00:00Z' -D P3M -E '2009-04-30 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="2009-03-31 - 1 Month"
+    cmd="iso8601 -d '2009-03-31 01:00:00 +01:00' -D P-1M -E '2009-02-28 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+
+    desc="2038-01-01 + 3 Months"
+    cmd="iso8601 -d '2038-01-01 00:00:00Z' -D P3M -E '2038-04-01 00:00:00Z'"
+    test_assert $CRM_EX_OK 0
+}
+
+function test_acl_loop() {
+    local TMPXML
+
+    TMPXML="$1"
+
+    # Make sure we're rejecting things for the right reasons
+    orig_trace_fns="$PCMK_trace_functions"
+    export PCMK_trace_functions=pcmk__check_acl,pcmk__apply_creation_acl
+
+    CIB_user=root cibadmin --replace --xml-text '<resources/>'
+
+    ### no ACL ###
+    export CIB_user=unknownguy
+    desc="$CIB_user: Query configuration"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Set enable-acl"
+    cmd="crm_attribute -n enable-acl -v false"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Set stonith-enabled"
+    cmd="crm_attribute -n stonith-enabled -v false"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Create a resource"
+    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    ### deny /cib permission ###
+    export CIB_user=l33t-haxor
+    desc="$CIB_user: Query configuration"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Set enable-acl"
+    cmd="crm_attribute -n enable-acl -v false"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Set stonith-enabled"
+    cmd="crm_attribute -n stonith-enabled -v false"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Create a resource"
+    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    ### observer role ###
+    export CIB_user=niceguy
+    desc="$CIB_user: Query configuration"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_OK 0
+
+    desc="$CIB_user: Set enable-acl"
+    cmd="crm_attribute -n enable-acl -v false"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Set stonith-enabled"
+    cmd="crm_attribute -n stonith-enabled -v false"
+    test_assert $CRM_EX_OK
+
+    desc="$CIB_user: Create a resource"
+    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    export CIB_user=root
+    desc="$CIB_user: Query configuration"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_OK 0
+
+    desc="$CIB_user: Set stonith-enabled"
+    cmd="crm_attribute -n stonith-enabled -v true"
+    test_assert $CRM_EX_OK
+
+    desc="$CIB_user: Create a resource"
+    cmd="cibadmin -C -o resources --xml-text '<primitive id=\"dummy\" class=\"ocf\" provider=\"pacemaker\" type=\"Dummy\"/>'"
+    test_assert $CRM_EX_OK
+
+    ### deny /cib permission ###
+    export CIB_user=l33t-haxor
+
+    desc="$CIB_user: Create a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Query a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -g target-role"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    desc="$CIB_user: Remove a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -d target-role"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    ### observer role ###
+    export CIB_user=niceguy
+
+    desc="$CIB_user: Create a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -p target-role -v Stopped"
+    test_assert $CRM_EX_OK
+
+    desc="$CIB_user: Query a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -g target-role"
+    test_assert $CRM_EX_OK
+
+    desc="$CIB_user: Remove a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -d target-role"
+    test_assert $CRM_EX_OK
+
+    desc="$CIB_user: Create a resource meta attribute"
+    cmd="crm_resource -r dummy --meta -p target-role -v Started"
+    test_assert $CRM_EX_OK
+
+    ### read //meta_attributes ###
+    export CIB_user=badidea
+    desc="$CIB_user: Query configuration - implied deny"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_OK 0
+
+    ### deny /cib, read //meta_attributes ###
+    export CIB_user=betteridea
+    desc="$CIB_user: Query configuration - explicit deny"
+    cmd="cibadmin -Q"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --delete --xml-text '<acls/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    ### observer role ###
+    export CIB_user=niceguy
+    desc="$CIB_user: Replace - remove acls"
+    cmd="cibadmin --replace --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - create resource"
+    cmd="cibadmin --replace --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" crm_attribute -n enable-acl -v false
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - modify attribute (deny)"
+    cmd="cibadmin --replace --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace --xml-text '<nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - delete attribute (deny)"
+    cmd="cibadmin --replace --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - create attribute (deny)"
+    cmd="cibadmin --replace --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    ### admin role ###
+    CIB_user=bob
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - create attribute (direct allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - modify attribute (direct allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - delete attribute (direct allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    ### super_user role ###
+    export CIB_user=joe
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - create attribute (inherited allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - modify attribute (inherited allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - delete attribute (inherited allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    ### rsc_writer role ###
+    export CIB_user=mike
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - create attribute (allow overrides deny)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - modify attribute (allow overrides deny)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - delete attribute (allow overrides deny)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK 0
+
+    ### rsc_denied role ###
+    export CIB_user=chris
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - create attribute (deny overrides allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    # Set as root since setting as chris failed
+    CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="nothing interesting"/>'
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - modify attribute (deny overrides allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    # Set as root since setting as chris failed
+    CIB_user=root cibadmin --modify --xml-text '<primitive id="dummy" description="something interesting"/>'
+
+    CIB_user=root cibadmin -Q > "$TMPXML"
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin --replace -o resources --xml-text '<primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>'
+    CIB_user=root CIB_file="$TMPXML" CIB_shadow="" cibadmin -Ql
+
+    desc="$CIB_user: Replace - delete attribute (deny overrides allow)"
+    cmd="cibadmin --replace -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_INSUFFICIENT_PRIV 0
+
+    export PCMK_trace_functions="$orig_trace_fns"
+}
+
+function test_acls() {
+    local SHADOWPATH
+    local TMPXML
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.acls.xml.XXXXXXXXXX)
+
+    create_shadow_cib --create-empty pacemaker-1.3
+
+    cat <<EOF > "$TMPXML"
+    <acls>
+      <acl_user id="l33t-haxor">
+        <deny id="crook-nothing" xpath="/cib"/>
+      </acl_user>
+      <acl_user id="niceguy">
+        <role_ref id="observer"/>
+      </acl_user>
+      <acl_user id="bob">
+        <role_ref id="admin"/>
+      </acl_user>
+      <acl_user id="joe">
+        <role_ref id="super_user"/>
+      </acl_user>
+      <acl_user id="mike">
+        <role_ref id="rsc_writer"/>
+      </acl_user>
+      <acl_user id="chris">
+        <role_ref id="rsc_denied"/>
+      </acl_user>
+      <acl_role id="observer">
+        <read id="observer-read-1" xpath="/cib"/>
+        <write id="observer-write-1" xpath="//nvpair[@name=&apos;stonith-enabled&apos;]"/>
+        <write id="observer-write-2" xpath="//nvpair[@name=&apos;target-role&apos;]"/>
+      </acl_role>
+      <acl_role id="admin">
+        <read id="admin-read-1" xpath="/cib"/>
+        <write id="admin-write-1" xpath="//resources"/>
+      </acl_role>
+      <acl_role id="super_user">
+        <write id="super_user-write-1" xpath="/cib"/>
+      </acl_role>
+      <acl_role id="rsc_writer">
+        <deny id="rsc-writer-deny-1" xpath="/cib"/>
+        <write id="rsc-writer-write-1" xpath="//resources"/>
+      </acl_role>
+      <acl_role id="rsc_denied">
+        <write id="rsc-denied-write-1" xpath="/cib"/>
+        <deny id="rsc-denied-deny-1" xpath="//resources"/>
+      </acl_role>
+    </acls>
+EOF
+
+    desc="Configure some ACLs"
+    cmd="cibadmin -M -o acls --xml-file $TMPXML"
+    test_assert $CRM_EX_OK
+
+    desc="Enable ACLs"
+    cmd="crm_attribute -n enable-acl -v true"
+    test_assert $CRM_EX_OK
+
+    desc="Set cluster option"
+    cmd="crm_attribute -n no-quorum-policy -v ignore"
+    test_assert $CRM_EX_OK
+
+    desc="New ACL"
+    cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"badidea\"><read id=\"badidea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
+    test_assert $CRM_EX_OK
+
+    desc="Another ACL"
+    cmd="cibadmin --create -o acls --xml-text '<acl_user id=\"betteridea\"><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
+    test_assert $CRM_EX_OK
+
+    desc="Updated ACL"
+    cmd="cibadmin --replace -o acls --xml-text '<acl_user id=\"betteridea\"><deny id=\"betteridea-nothing\" xpath=\"/cib\"/><read id=\"betteridea-resources\" xpath=\"//meta_attributes\"/></acl_user>'"
+    test_assert $CRM_EX_OK
+
+    test_acl_loop "$TMPXML"
+
+    printf "\n\n    !#!#!#!#! Upgrading to latest CIB schema and re-testing !#!#!#!#!\n"
+    printf "\nUpgrading to latest CIB schema and re-testing\n" 1>&2
+
+    export CIB_user=root
+    desc="$CIB_user: Upgrade to latest CIB schema"
+    cmd="cibadmin --upgrade --force -V"
+    test_assert $CRM_EX_OK
+
+    reset_shadow_cib_version
+
+    test_acl_loop "$TMPXML"
+
+    unset CIB_shadow_dir
+    rm -f "$TMPXML"
+}
+
+function test_validity() {
+    local TMPGOOD
+    local TMPBAD
+
+    TMPGOOD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.good.xml.XXXXXXXXXX)
+    TMPBAD=$(mktemp ${TMPDIR:-/tmp}/cts-cli.validity.bad.xml.XXXXXXXXXX)
+
+    create_shadow_cib --create-empty pacemaker-1.2
+    orig_trace_fns="$PCMK_trace_functions"
+    export PCMK_trace_functions=apply_upgrade,update_validation
+
+    cibadmin -C -o resources --xml-text '<primitive id="dummy1" class="ocf" provider="pacemaker" type="Dummy"/>'
+    cibadmin -C -o resources --xml-text '<primitive id="dummy2" class="ocf" provider="pacemaker" type="Dummy"/>'
+    cibadmin -C -o constraints --xml-text '<rsc_order id="ord_1-2" first="dummy1" first-action="start" then="dummy2"/>'
+    cibadmin -Q > "$TMPGOOD"
+
+
+    desc="Try to make resulting CIB invalid (enum violation)"
+    cmd="cibadmin -M -o constraints --xml-text '<rsc_order id=\"ord_1-2\" first=\"dummy1\" first-action=\"break\" then=\"dummy2\"/>'"
+    test_assert $CRM_EX_CONFIG
+
+    sed 's|"start"|"break"|' "$TMPGOOD" > "$TMPBAD"
+    desc="Run crm_simulate with invalid CIB (enum violation)"
+    cmd="crm_simulate -x $TMPBAD -S"
+    test_assert $CRM_EX_CONFIG 0
+
+
+    desc="Try to make resulting CIB invalid (unrecognized validate-with)"
+    cmd="cibadmin -M --xml-text '<cib validate-with=\"pacemaker-9999.0\"/>'"
+    test_assert $CRM_EX_CONFIG
+
+    sed 's|"pacemaker-1.2"|"pacemaker-9999.0"|' "$TMPGOOD" > "$TMPBAD"
+    desc="Run crm_simulate with invalid CIB (unrecognized validate-with)"
+    cmd="crm_simulate -x $TMPBAD -S"
+    test_assert $CRM_EX_CONFIG 0
+
+
+    desc="Try to make resulting CIB invalid, but possibly recoverable (valid with X.Y+1)"
+    cmd="cibadmin -C -o configuration --xml-text '<tags/>'"
+    test_assert $CRM_EX_CONFIG
+
+    sed 's|</configuration>|<tags/></configuration>|' "$TMPGOOD" > "$TMPBAD"
+    desc="Run crm_simulate with invalid, but possibly recoverable CIB (valid with X.Y+1)"
+    cmd="crm_simulate -x $TMPBAD -S"
+    test_assert $CRM_EX_OK 0
+
+
+    sed 's|[ 	][ 	]*validate-with="[^"]*"||' "$TMPGOOD" > "$TMPBAD"
+    desc="Make resulting CIB valid, although without validate-with attribute"
+    cmd="cibadmin -R --xml-file $TMPBAD"
+    test_assert $CRM_EX_OK
+
+    desc="Run crm_simulate with valid CIB, but without validate-with attribute"
+    cmd="crm_simulate -x $TMPBAD -S"
+    test_assert $CRM_EX_OK 0
+
+
+    # this will just disable validation and accept the config, outputting
+    # validation errors
+    sed -e 's|[ 	][ 	]*validate-with="[^"]*"||' \
+        -e 's|\([ 	][ 	]*epoch="[^"]*\)"|\10"|' -e 's|"start"|"break"|' \
+        "$TMPGOOD" > "$TMPBAD"
+    desc="Make resulting CIB invalid, and without validate-with attribute"
+    cmd="cibadmin -R --xml-file $TMPBAD"
+    test_assert $CRM_EX_OK
+
+    desc="Run crm_simulate with invalid CIB, also without validate-with attribute"
+    cmd="crm_simulate -x $TMPBAD -S"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_shadow_dir
+    rm -f "$TMPGOOD" "$TMPBAD"
+    export PCMK_trace_functions="$orig_trace_fns"
+}
+
+test_upgrade() {
+    local TMPXML
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+
+    create_shadow_cib --create-empty pacemaker-2.10
+    orig_trace_fns="$PCMK_trace_functions"
+    export PCMK_trace_functions=apply_upgrade,update_validation
+
+    desc="Set stonith-enabled=false"
+    cmd="crm_attribute -n stonith-enabled -v false"
+    test_assert $CRM_EX_OK
+
+    cat <<EOF > "$TMPXML"
+    <resources>
+      <primitive id="mySmartFuse" class="ocf" provider="experiment" type="SmartFuse">
+        <operations>
+          <op id="mySmartFuse-start" name="start" interval="0" timeout="40s"/>
+          <op id="mySmartFuse-monitor-inputpower" name="monitor" interval="30s">
+            <instance_attributes id="mySmartFuse-inputpower-instanceparams">
+              <nvpair id="mySmartFuse-inputpower-requires" name="requires" value="inputpower"/>
+            </instance_attributes>
+          </op>
+          <op id="mySmartFuse-monitor-outputpower" name="monitor" interval="2s">
+            <instance_attributes id="mySmartFuse-outputpower-instanceparams">
+              <nvpair id="mySmartFuse-outputpower-requires" name="requires" value="outputpower"/>
+            </instance_attributes>
+          </op>
+        </operations>
+        <instance_attributes id="mySmartFuse-params">
+          <nvpair id="mySmartFuse-params-ip" name="ip" value="192.0.2.10"/>
+        </instance_attributes>
+	<!-- a bit hairy but valid -->
+        <instance_attributes id-ref="mySmartFuse-outputpower-instanceparams"/>
+      </primitive>
+    </resources>
+EOF
+
+    desc="Configure the initial resource"
+    cmd="cibadmin -M -o resources --xml-file $TMPXML"
+    test_assert $CRM_EX_OK
+
+    desc="Upgrade to latest CIB schema (trigger 2.10.xsl + the wrapping)"
+    cmd="cibadmin --upgrade --force -V -V"
+    test_assert $CRM_EX_OK
+
+    desc="Query a resource instance attribute (shall survive)"
+    cmd="crm_resource -r mySmartFuse -g requires"
+    test_assert $CRM_EX_OK
+
+    unset CIB_shadow_dir
+    rm -f "$TMPXML"
+    export PCMK_trace_functions="$orig_trace_fns"
+}
+
+test_rules() {
+    local TMPXML
+
+    create_shadow_cib --create-empty
+
+    cibadmin -C -o crm_config --xml-text '<cluster_property_set id="cib-bootstrap-options"><nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="false"/></cluster_property_set>'
+    cibadmin -C -o resources --xml-text '<primitive class="ocf" id="dummy" provider="heartbeat" type="Dummy" />'
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-too-many-date-expressions" rsc="dummy">
+  <rule id="cli-rule-too-many-date-expressions" score="INFINITY" boolean-op="or">
+    <date_expression id="cli-date-expression-1" operation="gt" start="2020-01-01 01:00:00 -0500"/>
+    <date_expression id="cli-date-expression-2" operation="lt" end="2019-01-01 01:00:00 -0500"/>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-prefer-dummy-expired" rsc="dummy">
+  <rule id="cli-prefer-rule-dummy-expired" score="INFINITY">
+    <date_expression id="cli-prefer-lifetime-end-dummy-expired" operation="lt" end="2019-01-01 12:00:00 -05:00"/>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    if [ "$(uname)" == "FreeBSD" ]; then
+        tomorrow=$(date -v+1d +"%F %T %z")
+    else
+        tomorrow=$(date --date=tomorrow +"%F %T %z")
+    fi
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-prefer-dummy-not-yet" rsc="dummy">
+  <rule id="cli-prefer-rule-dummy-not-yet" score="INFINITY">
+    <date_expression id="cli-prefer-lifetime-end-dummy-not-yet" operation="gt" start="${tomorrow}"/>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-prefer-dummy-date_spec-only-years" rsc="dummy">
+  <rule id="cli-prefer-rule-dummy-date_spec-only-years" score="INFINITY">
+    <date_expression id="cli-prefer-dummy-date_spec-only-years-expr" operation="date_spec">
+      <date_spec id="cli-prefer-dummy-date_spec-only-years-spec" years="2019"/>
+    </date_expression>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-prefer-dummy-date_spec-without-years" rsc="dummy">
+  <rule id="cli-prefer-rule-dummy-date_spec-without-years" score="INFINITY">
+    <date_expression id="cli-prefer-dummy-date_spec-without-years-expr" operation="date_spec">
+      <date_spec id="cli-prefer-dummy-date_spec-without-years-spec" hours="20" months="1,3,5,7"/>
+    </date_expression>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-prefer-dummy-date_spec-years-moon" rsc="dummy">
+  <rule id="cli-prefer-rule-dummy-date_spec-years-moon" score="INFINITY">
+    <date_expression id="cli-prefer-dummy-date_spec-years-moon-expr" operation="date_spec">
+      <date_spec id="cli-prefer-dummy-date_spec-years-moon-spec" years="2019" moon="1"/>
+    </date_expression>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.tools.xml.XXXXXXXXXX)
+    cat <<EOF > "$TMPXML"
+<rsc_location id="cli-no-date_expression" rsc="dummy">
+  <rule id="cli-no-date_expression-rule" score="INFINITY">
+    <expression id="ban-apache-expr" attribute="#uname" operation="eq" value="node3"/>
+  </rule>
+</rsc_location>
+EOF
+
+    cibadmin -C -o constraints -x "$TMPXML"
+    rm -f "$TMPXML"
+
+    desc="crm_rule given no arguments"
+    cmd="crm_rule"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="crm_rule given no arguments (XML)"
+    cmd="crm_rule --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="crm_rule given no rule to check"
+    cmd="crm_rule -c"
+    test_assert $CRM_EX_USAGE 0
+
+    desc="crm_rule given no rule to check (XML)"
+    cmd="crm_rule -c --output-as=xml"
+    test_assert_validate $CRM_EX_USAGE 0
+
+    desc="crm_rule given invalid input XML"
+    cmd="crm_rule -c -r blahblah -X 'invalidxml'"
+    test_assert $CRM_EX_DATAERR 0
+
+    desc="crm_rule given invalid input XML (XML)"
+    cmd="crm_rule -c -r blahblah -X 'invalidxml' --output-as=xml"
+    test_assert_validate $CRM_EX_DATAERR 0
+
+    desc="crm_rule given invalid input XML on stdin"
+    cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X -"
+    test_assert $CRM_EX_DATAERR 0
+
+    desc="crm_rule given invalid input XML on stdin (XML)"
+    cmd="echo 'invalidxml' | crm_rule -c -r blahblah -X - --output-as=xml"
+    test_assert_validate $CRM_EX_DATAERR 0
+
+    desc="Try to check a rule that doesn't exist"
+    cmd="crm_rule -c -r blahblah"
+    test_assert $CRM_EX_NOSUCH
+
+    desc="Try to check a rule that doesn't exist, with XML output"
+    cmd="crm_rule -c -r blahblah --output-as=xml"
+    test_assert_validate $CRM_EX_NOSUCH 0
+
+    desc="Try to check a rule that has too many date_expressions"
+    cmd="crm_rule -c -r cli-rule-too-many-date-expressions"
+    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Try to check a rule that has too many date_expressions (XML)"
+    cmd="crm_rule -c -r cli-rule-too-many-date-expressions --output-as=xml"
+    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Verify basic rule is expired"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired"
+    test_assert $CRM_EX_EXPIRED 0
+
+    desc="Verify basic rule is expired, with XML output"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired --output-as=xml"
+    test_assert_validate $CRM_EX_EXPIRED 0
+
+    desc="Verify basic rule worked in the past"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101"
+    test_assert $CRM_EX_OK 0
+
+    desc="Verify basic rule worked in the past (XML)"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-expired -d 20180101 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Verify basic rule is not yet in effect"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet"
+    test_assert $CRM_EX_NOT_YET_IN_EFFECT 0
+
+    desc="Verify basic rule is not yet in effect (XML)"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet --output-as=xml"
+    test_assert_validate $CRM_EX_NOT_YET_IN_EFFECT 0
+
+    desc="Verify date_spec rule with years has expired"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years"
+    test_assert $CRM_EX_EXPIRED 0
+
+    desc="Verify date_spec rule with years has expired (XML)"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
+    test_assert_validate $CRM_EX_EXPIRED 0
+
+    desc="Verify multiple rules at once"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years"
+    test_assert $CRM_EX_EXPIRED 0
+
+    desc="Verify multiple rules at once, with XML output"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-not-yet -r cli-prefer-rule-dummy-date_spec-only-years --output-as=xml"
+    test_assert_validate $CRM_EX_EXPIRED 0
+
+    desc="Verify date_spec rule with years is in effect"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201"
+    test_assert $CRM_EX_OK 0
+
+    desc="Verify date_spec rule with years is in effect (XML)"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-only-years -d 20190201 --output-as=xml"
+    test_assert_validate $CRM_EX_OK 0
+
+    desc="Try to check a rule whose date_spec does not contain years="
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years"
+    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Try to check a rule whose date_spec does not contain years= (XML)"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-without-years --output-as=xml"
+    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Try to check a rule whose date_spec contains years= and moon="
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon"
+    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Try to check a rule whose date_spec contains years= and moon= (XML)"
+    cmd="crm_rule -c -r cli-prefer-rule-dummy-date_spec-years-moon --output-as=xml"
+    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Try to check a rule with no date_expression"
+    cmd="crm_rule -c -r cli-no-date_expression-rule"
+    test_assert $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    desc="Try to check a rule with no date_expression (XML)"
+    cmd="crm_rule -c -r cli-no-date_expression-rule --output-as=xml"
+    test_assert_validate $CRM_EX_UNIMPLEMENT_FEATURE 0
+
+    unset CIB_shadow_dir
+}
+
+# Ensure all command output is in portable locale for comparison
+export LC_ALL="C"
+test_access_render() {
+    local TMPXML
+
+    TMPXML=$(mktemp ${TMPDIR:-/tmp}/cts-cli.access_render.xml.XXXXXXXXXX)
+    export CIB_shadow_dir="${shadow_dir}"
+
+    $VALGRIND_CMD crm_shadow --batch --force --create-empty $shadow 2>&1
+    export CIB_shadow=$shadow
+
+    # Create a test CIB that has ACL roles
+    cat <<EOF > "$TMPXML"
+    <acls>
+      <acl_role id="role-deny-acls">
+        <acl_permission id="deny-acls" kind="deny" xpath="/cib/configuration/acls"/>
+        <acl_permission id="read-rest" kind="read" xpath="/cib"/>
+      </acl_role>
+      <acl_target id="tony">
+        <role id="role-deny-acls"/>
+      </acl_target>
+    </acls>
+EOF
+
+    desc="Configure some ACLs"
+    cmd="cibadmin -M -o acls --xml-file $TMPXML"
+    test_assert $CRM_EX_OK
+
+    desc="Enable ACLs"
+    cmd="crm_attribute -n enable-acl -v true"
+    test_assert $CRM_EX_OK
+
+    unset CIB_user
+
+    # Run cibadmin --show-access on the test CIB with different users (tony here)
+
+    desc="An instance of ACLs render (into color)"
+    cmd="cibadmin --force --show-access=color -Q --user tony"
+    test_assert $CRM_EX_OK 0
+
+    desc="An instance of ACLs render (into namespacing)"
+    cmd="cibadmin --force --show-access=namespace -Q --user tony"
+    test_assert $CRM_EX_OK 0
+
+    desc="An instance of ACLs render (into text)"
+    cmd="cibadmin --force --show-access=text -Q --user tony"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_shadow_dir
+    rm -f "$TMPXML"
+}
+
+function test_feature_set() {
+    create_shadow_cib --create-empty
+
+    # Import the initial test CIB with non-mixed versions
+    desc="Import the test CIB"
+    cmd="cibadmin --replace --xml-file $test_home/cli/crm_mon-feature_set.xml"
+    test_assert $CRM_EX_OK
+
+    desc="Complete text output, no mixed status"
+    cmd="crm_mon -1 --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, no mixed status"
+    cmd="crm_mon --output-as=xml"
+    test_assert $CRM_EX_OK 0
+
+    # Modify the CIB to fake that the cluster has mixed versions
+    desc="Fake inconsistent feature set"
+    cmd="crm_attribute --node=cluster02 --name=#feature-set --update=3.15.0 --lifetime=reboot"
+    test_assert $CRM_EX_OK
+
+    desc="Complete text output, mixed status"
+    cmd="crm_mon -1 --show-detail"
+    test_assert $CRM_EX_OK 0
+
+    desc="XML output, mixed status"
+    cmd="crm_mon --output-as=xml"
+    test_assert $CRM_EX_OK 0
+
+    unset CIB_shadow_dir
+}
+
+# Process command-line arguments
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -t)
+            tests="$2"
+            shift 2
+            ;;
+        -V|--verbose)
+            verbose=1
+            shift
+            ;;
+        -v|--valgrind)
+            export G_SLICE=always-malloc
+            VALGRIND_CMD="valgrind $VALGRIND_OPTS"
+            shift
+            ;;
+        -s)
+            do_save=1
+            shift
+            ;;
+        -p)
+            export PATH="$2:$PATH"
+            shift
+            ;;
+        --help)
+            echo "$USAGE_TEXT"
+            exit $CRM_EX_OK
+            ;;
+        *)
+            echo "error: unknown option $1"
+            echo
+            echo "$USAGE_TEXT"
+            exit $CRM_EX_USAGE
+            ;;
+    esac
+done
+
+for t in $tests; do
+    case "$t" in
+        agents) ;;
+        daemons) ;;
+        dates) ;;
+        error_codes) ;;
+        tools) ;;
+        acls) ;;
+        validity) ;;
+        upgrade) ;;
+        rules) ;;
+        crm_mon) ;;
+        feature_set) ;;
+        *)
+            echo "error: unknown test $t"
+            echo
+            echo "$USAGE_TEXT"
+            exit $CRM_EX_USAGE
+            ;;
+    esac
+done
+
+XMLLINT_CMD=$(which xmllint 2>/dev/null)
+if [ $? -ne 0 ]; then
+    XMLLINT_CMD=""
+    echo "xmllint is missing - install it to validate command output"
+fi
+
+# Check whether we're running from source directory
+SRCDIR=$(dirname $test_home)
+if [ -x "$SRCDIR/tools/crm_simulate" ]; then
+    path_dirs="$SRCDIR/tools"
+    for daemon in based controld fenced schedulerd; do
+        if [ -x "$SRCDIR/daemons/$daemon/pacemaker-${daemon}" ]; then
+            path_dirs="$path_dirs:$SRCDIR/daemons/$daemon"
+        fi
+    done
+    export PATH="$path_dirs:$PATH"
+
+    echo "Using local binaries from: ${path_dirs//:/ }"
+
+    if [ -x "$SRCDIR/xml" ]; then
+        export PCMK_schema_directory="$SRCDIR/xml"
+        echo "Using local schemas from: $PCMK_schema_directory"
+    fi
+else
+    export PATH="@CRM_DAEMON_DIR@:$PATH"
+    export PCMK_schema_directory=@CRM_SCHEMA_DIRECTORY@
+fi
+
+for t in $tests; do
+    echo "Testing $t"
+    TMPFILE=$(mktemp ${TMPDIR:-/tmp}/cts-cli.$t.XXXXXXXXXX)
+    eval TMPFILE_$t="$TMPFILE"
+    test_$t > "$TMPFILE"
+
+    # last-rc-change= is always numeric in the CIB. However, for the crm_mon
+    # test we also need to compare against the XML output of the crm_mon
+    # program. There, these are shown as human readable strings (like the
+    # output of the `date` command).
+    sed -e 's|\(<cib.*\) cib-last-written[^/]*/>|\1/>|' \
+        -e 's|\(<cib.*\) cib-last-written[^/]*>|\1>|' \
+        -e 's/Last updated: .*/Last updated:/' \
+        -e 's/Last change: .*/Last change:/' \
+        -e 's/(version .*)/(version)/' \
+        -e 's/last_update time=\".*\"/last_update time=\"\"/' \
+        -e 's/last_change time=\".*\"/last_change time=\"\"/' \
+        -e 's/ api-version="[^"]*"/ api-version="X"/' \
+        -e 's/ default="[^"]*"/ default=""/' \
+        -e 's/ version="[^"]*"/ version=""/' \
+        -e 's/request=\".*\(crm_[a-zA-Z0-9]*\)/request=\"\1/' \
+        -e 's/crm_feature_set="[^"]*" //'\
+        -e 's/validate-with="[^"]*" //'\
+        -e 's/Created new pacemaker-.* configuration/Created new pacemaker configuration/'\
+        -e 's/.*\(crm_time_parse_duration\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(crm_time_parse_period\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(crm_time_parse_sec\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(log_xmllib_err\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(parse_date\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(pcmk__.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(unpack_.*\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(update_validation\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e 's/.*\(apply_upgrade\)@.*\.c:[0-9][0-9]*)/\1/g' \
+        -e "s/ last-rc-change=['\"][-+A-Za-z0-9: ]*['\"],\{0,1\}//" \
+        -e 's|^/tmp/cts-cli\.shadow\.[^/]*/|/tmp/cts-cli.shadow/|' \
+        -e 's|"/tmp/cts-cli\.shadow\.[^/]*/|"/tmp/cts-cli.shadow/|' \
+        -e 's|^/tmp/cts-cli\.validity\.bad.xml\.[^:]*:|validity.bad.xml:|'\
+        -e 's/^Entity: line [0-9][0-9]*: //'\
+        -e 's/\(validation ([0-9][0-9]* of \)[0-9][0-9]*\().*\)/\1X\2/' \
+        -e 's/^Migration will take effect until: .*/Migration will take effect until:/' \
+        -e 's/ end=\"[0-9][-+: 0-9]*Z*\"/ end=\"\"/' \
+        -e 's/ start=\"[0-9][-+: 0-9]*Z*\"/ start=\"\"/' \
+        -e 's/Device not configured/No such device or address/' \
+        -e 's/\(Injecting attribute last-failure-ping#monitor_10000=\)[0-9]*/\1/' \
+        -e 's/^lt-//' \
+        -e 's/ocf::/ocf:/' \
+        -e 's/Masters:/Promoted:/' \
+        -e 's/Slaves:/Unpromoted:/' \
+        -e 's/Master/Promoted/' \
+        -e 's/Slave/Unpromoted/' \
+        -e 's/\x1b/\\x1b/' \
+        "$TMPFILE" > "${TMPFILE}.$$"
+    mv -- "${TMPFILE}.$$" "$TMPFILE"
+
+    if [ $do_save -eq 1 ]; then
+        cp "$TMPFILE" $test_home/cli/regression.$t.exp
+    fi
+done
+
+rm -rf "${shadow_dir}"
+rm -f "${test_assert_outfile}"
+rm -f "${test_assert_errfile}"
+rm -f "${xmllint_outfile}"
+
+failed=0
+
+if [ $verbose -eq 1 ]; then
+    echo -e "\n\nResults"
+fi
+for t in $tests; do
+    eval TMPFILE="\$TMPFILE_$t"
+    if [ $verbose -eq 1 ]; then
+        diff -wu $test_home/cli/regression.$t.exp "$TMPFILE"
+    else
+        diff -w $test_home/cli/regression.$t.exp "$TMPFILE" >/dev/null 2>&1
+    fi
+    if [ $? -ne 0 ]; then
+        failed=1
+    fi
+done
+
+echo -e "\n\nSummary"
+for t in $tests; do
+    eval TMPFILE="\$TMPFILE_$t"
+    grep -e '^\* \(Passed\|Failed\)' "$TMPFILE"
+done
+
+function print_or_remove_file() {
+
+  eval TMPFILE="\$TMPFILE_$1"
+  if [[ ! $(diff -wq $test_home/cli/regression.$1.exp "$TMPFILE") ]]; then
+    rm -f "$TMPFILE"
+  else
+    echo "    $TMPFILE"
+  fi
+}
+
+if [ $num_errors -ne 0 ] && [ $failed -ne 0 ]; then
+    echo "$num_errors tests failed; see output in:"
+    for t in $tests; do
+      print_or_remove_file "$t"
+    done
+    exit $CRM_EX_ERROR
+elif [ $num_errors -ne 0 ]; then
+    echo "$num_errors tests failed"
+    for t in $tests; do
+      print_or_remove_file "$t"
+    done
+    exit $CRM_EX_ERROR
+elif [ $failed -eq 1 ]; then
+    echo "$num_passed tests passed but output was unexpected; see output in:"
+    for t in $tests; do
+      print_or_remove_file "$t"
+    done
+    exit $CRM_EX_DIGEST
+else
+    echo $num_passed tests passed
+    for t in $tests; do
+        eval TMPFILE="\$TMPFILE_$t"
+        rm -f "$TMPFILE"
+    done
+    crm_shadow --force --delete $shadow >/dev/null 2>&1
+    exit $CRM_EX_OK
+fi