CVE-2026-52754

@@ -401,8 +401,7 @@ private <T> T asyncRequest(HttpRequest request, BodyHandler<T> bodyHandler, Task
 			// if possible, unwrap the exception that happened inside the future
 			Throwable cause = e.getCause();
 			Msg.error(this, "Error during HTTP request [%s]".formatted(request.uri()), cause);
-			throw (cause instanceof IOException)
-					? (IOException) cause
+			throw (cause instanceof IOException) ? (IOException) cause
 					: new IOException("Error during HTTP request", cause);
 		}
 		finally {

@@ -19,6 +19,7 @@
 import java.io.InputStream;
 import java.util.*;
 
+import generic.hash.HashUtilities;
 import ghidra.app.plugin.processors.generic.MemoryBlockDefinition;
 import ghidra.app.util.Option;
 import ghidra.app.util.OptionUtils;
@@ -36,7 +37,6 @@
 import ghidra.program.model.symbol.*;
 import ghidra.program.util.DefaultLanguageService;
 import ghidra.program.util.GhidraProgramUtilities;
-import ghidra.util.HashUtilities;
 import ghidra.util.MD5Utilities;
 import ghidra.util.exception.*;
 import ghidra.util.task.TaskMonitor;

@@ -23,6 +23,7 @@
 
 import org.apache.commons.collections4.map.ReferenceMap;
 
+import generic.hash.HashUtilities;
 import ghidra.app.util.bin.*;
 import ghidra.util.*;
 import ghidra.util.exception.CancelledException;

@@ -31,6 +31,7 @@
 import org.apache.commons.io.FilenameUtils;
 
 import docking.widgets.OptionDialog;
+import generic.hash.HashUtilities;
 import ghidra.app.util.bin.ByteProvider;
 import ghidra.formats.gfilesystem.annotations.FileSystemInfo;
 import ghidra.formats.gfilesystem.fileinfo.FileType;

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -21,7 +21,7 @@
 import generic.jar.ResourceFile;
 import ghidra.GhidraClassLoader;
 import ghidra.framework.preferences.Preferences;
-import ghidra.net.ApplicationTrustManagerFactory;
+import ghidra.net.DefaultTrustManagerFactory;
 import ghidra.util.Msg;
 import ghidra.util.classfinder.ClassSearcher;
 import ghidra.util.exception.CancelledException;
@@ -88,7 +88,7 @@ private void locateCACertsFile() {
 		for (ResourceFile appRoot : Application.getApplicationRootDirectories()) {
 			File cacertsFile = new File(appRoot.getAbsolutePath(), "cacerts");
 			if (cacertsFile.isFile()) {
-				System.setProperty(ApplicationTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY,
+				System.setProperty(DefaultTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY,
 					cacertsFile.getAbsolutePath());
 				break;
 			}

@@ -38,7 +38,7 @@
 import ghidra.features.bsim.query.ingest.BSimLaunchable;
 import ghidra.framework.*;
 import ghidra.framework.client.ClientUtil;
-import ghidra.net.ApplicationKeyManagerUtils;
+import ghidra.net.PKIUtils;
 import ghidra.util.Msg;
 import ghidra.util.exception.AssertException;
 import ghidra.util.exception.CancelledException;
@@ -390,7 +390,7 @@ private static boolean verifyPEMFormat(File testFile) throws IOException {
 				if (line == null) {
 					break;
 				}
-				if (line.startsWith(ApplicationKeyManagerUtils.BEGIN_CERT)) {
+				if (line.startsWith(PKIUtils.BEGIN_CERT)) {
 					return true;
 				}
 			}
@@ -557,11 +557,10 @@ private void generateSelfSignedCertificate(File certFile, File passFile)
 		PasswordProtection pp = new PasswordProtection(password);
 		try {
 			// TODO: should subjectAlternativeNames be supported?
-			KeyStore keyStore = ApplicationKeyManagerUtils.createKeyStore(alias, "CN=BSimServer",
-				365 * 2, null, null, "JKS", null, password);
+			KeyStore keyStore = PKIUtils.createKeyStore(alias, "CN=BSimServer", 365 * 2, null,
+				null, "JKS", null, password);
 
-			ApplicationKeyManagerUtils.exportX509Certificates(keyStore.getCertificateChain(alias),
-				certFile);
+			PKIUtils.exportX509Certificates(keyStore.getCertificateChain(alias), certFile);
 			Key key = keyStore.getKey(alias, password);
 
 			try (FileOutputStream fout = new FileOutputStream(passFile);

@@ -34,7 +34,7 @@
 import ghidra.framework.client.ClientUtil;
 import ghidra.framework.client.HeadlessClientAuthenticator;
 import ghidra.framework.protocol.ghidra.GhidraURL;
-import ghidra.net.SSLContextInitializer;
+import ghidra.net.DefaultSSLContextInitializer;
 import ghidra.util.Msg;
 import ghidra.util.SystemUtilities;
 import ghidra.util.exception.CancelledException;
@@ -1111,7 +1111,7 @@ public static void initializeApplication(ApplicationLayout layout, int type,
 
 		Application.initializeApplication(layout, config);
 
-		SSLContextInitializer.initialize();
+		DefaultSSLContextInitializer.initialize();
 		ghidra.framework.protocol.ghidra.Handler.registerHandler();
 		ghidra.features.bsim.query.postgresql.Handler.registerHandler();
 

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -20,7 +20,7 @@
 
 import generic.jar.ResourceFile;
 import ghidra.framework.*;
-import ghidra.net.ApplicationTrustManagerFactory;
+import ghidra.net.DefaultTrustManagerFactory;
 import ghidra.util.classfinder.ClassSearcher;
 
 public class HeadlessBSimApplicationConfiguration extends ApplicationConfiguration {
@@ -46,7 +46,7 @@ private void locateCACertsFile() {
 		for (ResourceFile appRoot : Application.getApplicationRootDirectories()) {
 			File cacertsFile = new File(appRoot.getAbsolutePath(), "cacerts");
 			if (cacertsFile.isFile()) {
-				System.setProperty(ApplicationTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY,
+				System.setProperty(DefaultTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY,
 					cacertsFile.getAbsolutePath());
 				break;
 			}

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -19,10 +19,10 @@
 import java.util.Date;
 import java.util.List;
 
+import generic.hash.HashUtilities;
 import generic.lsh.vector.*;
 import ghidra.features.bsim.query.description.*;
 import ghidra.features.bsim.query.protocol.SimilarityVectorResult;
-import ghidra.util.HashUtilities;
 import ghidra.xml.XmlPullParser;
 
 public class TestNearestVectorResult extends SimilarityVectorResult {

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -19,10 +19,10 @@
 import java.io.InputStream;
 import java.util.Date;
 
+import generic.hash.HashUtilities;
 import ghidra.features.bsim.query.description.ExecutableRecord;
 import ghidra.features.bsim.query.description.FunctionDescription;
 import ghidra.features.bsim.query.protocol.SimilarityResult;
-import ghidra.util.HashUtilities;
 
 public class TestSimilarityResult extends SimilarityResult {
 //	protected static Random random = new Random();

@@ -23,14 +23,14 @@
 
 import com.google.gson.*;
 
+import generic.hash.HashUtilities;
 import ghidra.app.util.bin.ByteProvider;
 import ghidra.app.util.bin.ByteProviderWrapper;
 import ghidra.formats.gfilesystem.*;
 import ghidra.formats.gfilesystem.annotations.FileSystemInfo;
 import ghidra.formats.gfilesystem.crypto.CryptoSession;
 import ghidra.formats.gfilesystem.fileinfo.*;
 import ghidra.framework.generic.auth.Password;
-import ghidra.util.HashUtilities;
 import ghidra.util.exception.CancelledException;
 import ghidra.util.task.TaskMonitor;
 

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -22,7 +22,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 
-import ghidra.util.HashUtilities;
+import generic.hash.HashUtilities;
 
 /**
  * Helper class from providing all the constants required for parsing a CaRT

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -22,9 +22,9 @@
 import org.junit.Before;
 import org.junit.Test;
 
+import generic.hash.HashUtilities;
 import ghidra.app.util.bin.BinaryReader;
 import ghidra.app.util.bin.ByteArrayProvider;
-import ghidra.util.HashUtilities;
 
 public class CartV1FileTest {
 	CartV1File cartFile;

@@ -45,8 +45,8 @@
 import ghidra.framework.Application;
 import ghidra.framework.ApplicationConfiguration;
 import ghidra.framework.remote.*;
-import ghidra.net.ApplicationKeyManagerFactory;
-import ghidra.net.SSLContextInitializer;
+import ghidra.net.DefaultKeyManagerFactory;
+import ghidra.net.DefaultSSLContextInitializer;
 import ghidra.server.RepositoryManager;
 import ghidra.server.UserManager;
 import ghidra.server.security.*;
@@ -731,7 +731,7 @@ else if (s.equals("-autoProvision")) {
 		Application.initializeLogging(serverLogFile, serverLogFile);
 
 		// In the absence of module initialization - we must invoke directly
-		SSLContextInitializer.initialize();
+		DefaultSSLContextInitializer.initialize();
 
 		log = LogManager.getLogger(GhidraServer.class); // init log *after* initializing log system
 
@@ -752,13 +752,12 @@ else if (s.equals("-autoProvision")) {
 			// Ensure that remote access hostname is properly set for RMI registration
 			String hostname = initRemoteAccessHostname();
 
-			if (ApplicationKeyManagerFactory.getPreferredKeyStore() == null) {
+			if (DefaultKeyManagerFactory.getPreferredKeyStore() == null) {
 				// keystore has not been identified - use self-signed certificate
-				ApplicationKeyManagerFactory
-						.setDefaultIdentity(new X500Principal("CN=GhidraServer"));
-				ApplicationKeyManagerFactory.addSubjectAlternativeName(hostname);
+				DefaultKeyManagerFactory.setDefaultIdentity(new X500Principal("CN=GhidraServer"));
+				DefaultKeyManagerFactory.addSubjectAlternativeName(hostname);
 			}
-			if (!ApplicationKeyManagerFactory.initialize()) {
+			if (!DefaultKeyManagerFactory.initialize()) {
 				log.fatal("Failed to initialize PKI/SSL keystore");
 				System.exit(0);
 				return;

@@ -50,7 +50,7 @@ public class PKIAuthenticationModule implements AuthenticationModule {
 	public PKIAuthenticationModule(boolean anonymousAllowed)
 			throws IOException, CertificateException {
 		this.anonymousAllowed = anonymousAllowed;
-		authorities = ApplicationKeyManagerUtils.getTrustedIssuers();
+		authorities = DefaultTrustManagerFactory.getTrustedIssuers();
 		if (authorities == null || authorities.length == 0) {
 			throw new IOException("trusted PKI Certificate Authorities have not been configured");
 		}
@@ -72,8 +72,8 @@ public Callback[] getAuthenticationCallbacks() {
 		try {
 			byte[] token = TokenGenerator.getNewToken(TOKEN_SIZE);
 			boolean usingSelfSignedCert =
-				ApplicationKeyManagerFactory.usingGeneratedSelfSignedCertificate();
-			SignedToken signedToken = ApplicationKeyManagerUtils
+				DefaultKeyManagerFactory.usingGeneratedSelfSignedCertificate();
+			SignedToken signedToken = DefaultKeyManagerFactory
 					.getSignedToken(usingSelfSignedCert ? null : authorities, token);
 			sigCb = new SignatureCallback(authorities, token, signedToken.signature);
 		}
@@ -127,8 +127,8 @@ public String authenticate(UserManager userMgr, Subject subject, Callback[] call
 			}
 
 			boolean usingSelfSignedCert =
-				ApplicationKeyManagerFactory.usingGeneratedSelfSignedCertificate();
-			if (!ApplicationKeyManagerUtils.isMySignature(usingSelfSignedCert ? null : authorities,
+				DefaultKeyManagerFactory.usingGeneratedSelfSignedCertificate();
+			if (!DefaultKeyManagerFactory.isMySignature(usingSelfSignedCert ? null : authorities,
 				token, sigCb.getServerSignature())) {
 				throw new FailedLoginException("Invalid Signature callback");
 			}
@@ -138,8 +138,7 @@ public String authenticate(UserManager userMgr, Subject subject, Callback[] call
 				throw new FailedLoginException("user certificate not provided");
 			}
 
-			ApplicationKeyManagerUtils.validateClient(certChain,
-				ApplicationKeyManagerUtils.RSA_TYPE);
+			DefaultTrustManagerFactory.validateClient(certChain, PKIUtils.RSA_TYPE);
 
 			byte[] sigBytes = sigCb.getSignature();
 			if (sigBytes != null) {

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -75,9 +75,9 @@ public Callback[] addAuthenticationCallbacks(Callback[] primaryAuthCallbacks) {
 		byte[] token = TokenGenerator.getNewToken(TOKEN_SIZE);
 		try {
 			boolean usingSelfSignedCert =
-				ApplicationKeyManagerFactory.usingGeneratedSelfSignedCertificate();
-			SignedToken signedToken = ApplicationKeyManagerUtils.getSignedToken(
-				usingSelfSignedCert ? null : ApplicationKeyManagerUtils.getTrustedIssuers(), token);
+				DefaultKeyManagerFactory.usingGeneratedSelfSignedCertificate();
+			SignedToken signedToken = DefaultKeyManagerFactory.getSignedToken(
+				usingSelfSignedCert ? null : DefaultTrustManagerFactory.getTrustedIssuers(), token);
 			list.add(new SSHSignatureCallback(token, signedToken.signature));
 		}
 		catch (Exception e) {
@@ -88,9 +88,9 @@ public Callback[] addAuthenticationCallbacks(Callback[] primaryAuthCallbacks) {
 
 	public boolean hasSignedSSHCallback(Callback[] callbacks) {
 		if (callbacks != null) {
-			for (int i = 0; i < callbacks.length; i++) {
-				if (callbacks[i] instanceof SSHSignatureCallback) {
-					SSHSignatureCallback sshCb = (SSHSignatureCallback) callbacks[i];
+			for (Callback callback : callbacks) {
+				if (callback instanceof SSHSignatureCallback) {
+					SSHSignatureCallback sshCb = (SSHSignatureCallback) callback;
 					return sshCb.isSigned();
 				}
 			}
@@ -154,12 +154,12 @@ public String authenticate(UserManager userMgr, Subject subject, Callback[] call
 		NameCallback nameCb = null;
 		SSHSignatureCallback sshCb = null;
 		if (callbacks != null) {
-			for (int i = 0; i < callbacks.length; i++) {
-				if (callbacks[i] instanceof NameCallback) {
-					nameCb = (NameCallback) callbacks[i];
+			for (Callback callback : callbacks) {
+				if (callback instanceof NameCallback) {
+					nameCb = (NameCallback) callback;
 				}
-				if (callbacks[i] instanceof SSHSignatureCallback) {
-					sshCb = (SSHSignatureCallback) callbacks[i];
+				if (callback instanceof SSHSignatureCallback) {
+					sshCb = (SSHSignatureCallback) callback;
 				}
 			}
 		}
@@ -197,9 +197,9 @@ public String authenticate(UserManager userMgr, Subject subject, Callback[] call
 		boolean isValid = false;
 		try {
 			boolean usingSelfSignedCert =
-				ApplicationKeyManagerFactory.usingGeneratedSelfSignedCertificate();
-			isValid = ApplicationKeyManagerUtils.isMySignature(
-				usingSelfSignedCert ? null : ApplicationKeyManagerUtils.getTrustedIssuers(), token,
+				DefaultKeyManagerFactory.usingGeneratedSelfSignedCertificate();
+			isValid = DefaultKeyManagerFactory.isMySignature(
+				usingSelfSignedCert ? null : DefaultTrustManagerFactory.getTrustedIssuers(), token,
 				sshCb.getServerSignature());
 		}
 		catch (Exception e) {

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -20,6 +20,7 @@
 
 import javax.security.auth.x500.X500Principal;
 
+import generic.hash.HashUtilities;
 import generic.jar.ResourceFile;
 import ghidra.GhidraApplicationLayout;
 import ghidra.GhidraLaunchable;

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -25,6 +25,7 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
+import generic.hash.HashUtilities;
 import ghidra.framework.remote.User;
 import ghidra.framework.store.local.LocalFileSystem;
 import ghidra.util.*;

@@ -155,10 +155,10 @@ private HttpRequest.Builder request(String str) throws IOException {
 	@Override
 	public boolean exists(String filename, TaskMonitor monitor) {
 		try {
-			HttpRequest request = request(filename)
-					.timeout(Duration.ofMillis(HTTP_REQUEST_TIMEOUT_MS))
-					.method("HEAD", BodyPublishers.noBody())
-					.build();
+			HttpRequest request =
+				request(filename).timeout(Duration.ofMillis(HTTP_REQUEST_TIMEOUT_MS))
+						.method("HEAD", BodyPublishers.noBody())
+						.build();
 
 			Msg.debug(this,
 				logPrefix() + ": Checking exist for [" + filename + "]: " + request.toString());
@@ -182,8 +182,7 @@ public SymbolServerInputStream getFileStream(String filename, TaskMonitor monito
 		monitor.setMessage("Connecting to " + serverURI);
 
 		HttpRequest request = request(filename).GET().build();
-		Msg.debug(this,
-			logPrefix() + ": Getting file [" + filename + "]: " + request.toString());
+		Msg.debug(this, logPrefix() + ": Getting file [" + filename + "]: " + request.toString());
 		CompletableFuture<HttpResponse<InputStream>> futureResponse =
 			HttpClients.getHttpClient().sendAsync(request, BodyHandlers.ofInputStream());
 		CancelledListener l = () -> futureResponse.cancel(true);
@@ -215,8 +214,7 @@ public SymbolServerInputStream getFileStream(String filename, TaskMonitor monito
 			// if possible, unwrap the exception that happened inside the future
 			Throwable cause = e.getCause();
 			Msg.error(this, "Error during HTTP get", cause);
-			throw (cause instanceof IOException)
-					? (IOException) cause
+			throw (cause instanceof IOException) ? (IOException) cause
 					: new IOException("Error during HTTP get", cause);
 		}
 		finally {

@@ -26,6 +26,7 @@
 import javax.security.auth.callback.*;
 import javax.security.auth.login.LoginException;
 
+import generic.hash.HashUtilities;
 import ghidra.framework.model.ServerInfo;
 import ghidra.framework.remote.*;
 import ghidra.framework.remote.security.SSHKeyManager;
@@ -444,7 +445,7 @@ else if (callback instanceof AnonymousCallback) {
 	static void processSignatureCallback(String serverName, SignatureCallback sigCb)
 			throws IOException {
 		try {
-			SignedToken signedToken = ApplicationKeyManagerUtils
+			SignedToken signedToken = DefaultKeyManagerFactory
 					.getSignedToken(sigCb.getRecognizedAuthorities(), sigCb.getToken());
 			sigCb.sign(signedToken.certChain, signedToken.signature);
 			Msg.info(ClientUtil.class, "PKI Authenticating to " + serverName + " as user '" +

@@ -27,7 +27,7 @@
 import ghidra.framework.remote.AnonymousCallback;
 import ghidra.framework.remote.SSHSignatureCallback;
 import ghidra.framework.remote.security.SSHKeyManager;
-import ghidra.net.ApplicationKeyManagerFactory;
+import ghidra.net.DefaultKeyManagerFactory;
 import ghidra.util.Msg;
 
 /**
@@ -169,7 +169,7 @@ public static void installHeadlessClientAuthenticator(String username, String ke
 			}
 			catch (InvalidKeyException e) { // keyfile is not a valid SSH private key format
 				// does not appear to be an SSH private key - try PKI keystore parse
-				if (ApplicationKeyManagerFactory.setKeyStore(keystorePath, false)) {
+				if (DefaultKeyManagerFactory.setDefaultKeyStore(keystorePath, false)) {
 					success = true;
 					Msg.info(HeadlessClientAuthenticator.class,
 						"Loaded PKI keystore: " + keystorePath);

@@ -23,7 +23,7 @@
 
 import ghidra.framework.remote.AnonymousCallback;
 import ghidra.framework.remote.SSHSignatureCallback;
-import ghidra.net.ApplicationKeyManagerFactory;
+import ghidra.net.DefaultKeyManagerFactory;
 
 /**
  * <code>PasswordClientAuthenticator</code> provides a fixed username/password 
@@ -38,7 +38,7 @@
  * for accessing SSH keys or server password authentication.  In such headless situations,
  * the PKI certificate path/password should be specified via a property since it is unlikely
  * that the same password will apply.
- * @see ApplicationKeyManagerFactory 
+ * @see DefaultKeyManagerFactory 
  */
 public class PasswordClientAuthenticator implements ClientAuthenticator {
 

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -486,7 +486,7 @@ public synchronized String[] getAllUsers() throws IOException, NotConnectedExcep
 	 * @throws IOException if user data can't be written to file
 	 * @throws NotConnectedException if server connection is down (user already informed)
 	 * @see ghidra.framework.remote.RemoteRepositoryServerHandle#setPassword(char[])
-	 * @see ghidra.util.HashUtilities#getSaltedHash(String, char[])  HashUtilities.getSaltedHash("SHA-256", char[])
+	 * @see generic.hash.HashUtilities#getSaltedHash(String, char[])  HashUtilities.getSaltedHash("SHA-256", char[])
 	 */
 	public synchronized boolean setPassword(char[] saltedSHA256PasswordHash)
 			throws IOException, NotConnectedException {

@@ -38,7 +38,7 @@
 import ghidra.framework.Application;
 import ghidra.framework.model.ServerInfo;
 import ghidra.framework.remote.*;
-import ghidra.net.ApplicationKeyManagerFactory;
+import ghidra.net.DefaultKeyManagerFactory;
 import ghidra.util.Msg;
 import ghidra.util.exception.CancelledException;
 import ghidra.util.task.*;
@@ -130,7 +130,7 @@ private static Subject getLocalUserSubject() {
 
 	private static boolean isSSLHandshakeCancelled(SSLHandshakeException e) throws IOException {
 		if (e.getMessage().indexOf("bad_certificate") > 0) {
-			if (ApplicationKeyManagerFactory.getPreferredKeyStore() == null) {
+			if (DefaultKeyManagerFactory.getPreferredKeyStore() == null) {
 				throw new IOException("User PKI Certificate not installed", e);
 			}
 			// assume user cancelled connect attempt when prompted for cert password
@@ -291,13 +291,12 @@ else if (pkiSignatureCb != null) {
 							// if anonymous access allowed, let server validate certificate
 							// first and assume anonymous access if user unknown but cert is valid
 
-							if (!ApplicationKeyManagerFactory.initialize()) {
+							if (!DefaultKeyManagerFactory.initialize()) {
 								throw new IOException(
 									"Client PKI certificate has not been installed");
 							}
 
-							if (ApplicationKeyManagerFactory
-									.usingGeneratedSelfSignedCertificate()) {
+							if (DefaultKeyManagerFactory.usingGeneratedSelfSignedCertificate()) {
 								Msg.warn(this,
 									"Server connect - client is using self-signed PKI certificate");
 							}

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -104,7 +104,7 @@ public interface RepositoryServerHandle {
 	 * @param saltedSHA256PasswordHash SHA256 salted password hash
 	 * @return true if password changed
 	 * @throws IOException if an IO error occurs
-	 * @see ghidra.util.HashUtilities#getSaltedHash(String, char[])  HashUtilities.getSaltedHash("SHA-256", char[])
+	 * @see generic.hash.HashUtilities#getSaltedHash(String, char[])  HashUtilities.getSaltedHash("SHA-256", char[])
 	 */
 	boolean setPassword(char[] saltedSHA256PasswordHash) throws IOException;
 

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -18,6 +18,8 @@
 import java.io.*;
 import java.util.List;
 
+import generic.hash.HashUtilities;
+
 public class MD5Utilities {
 
 	public static final int SALT_LENGTH = HashUtilities.SALT_LENGTH;
@@ -54,11 +56,7 @@ public static char[] getSaltedMD5Hash(char[] salt, char[] msg) {
 	 * returned as a prefix to the hash
 	 */
 	public static char[] getSaltedMD5Hash(char[] msg) {
-		char[] salt = new char[HashUtilities.SALT_LENGTH];
-		for (int i = 0; i < salt.length; i++) {
-			salt[i] = HashUtilities.getRandomLetterOrDigit();
-		}
-		return getSaltedMD5Hash(salt, msg);
+		return HashUtilities.getSaltedHash(HashUtilities.MD5_ALGORITHM, msg);
 	}
 
 	/**

@@ -4,16 +4,16 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package ghidra.util;
+package generic.hash;
 
 import java.io.*;
 import java.security.MessageDigest;
@@ -22,6 +22,7 @@
 import java.util.List;
 
 import generic.random.SecureRandomFactory;
+import ghidra.util.NumericUtilities;
 
 public class HashUtilities {
 

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -15,74 +15,32 @@
  */
 package ghidra.net;
 
-import java.io.FileNotFoundException;
-import java.io.IOException;
-import java.net.Socket;
+import java.io.*;
 import java.security.*;
+import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.*;
 
 import javax.net.ssl.*;
-import javax.security.auth.x500.X500Principal;
-
-import org.apache.commons.lang3.StringUtils;
 
-import ghidra.framework.preferences.Preferences;
+import generic.hash.HashUtilities;
 import ghidra.security.KeyStorePasswordProvider;
 import ghidra.util.Msg;
-import ghidra.util.SystemUtilities;
 import ghidra.util.exception.CancelledException;
 
 /**
- * <code>ApplicationKeyManagerFactory</code> provides application keystore management
- * functionality and the ability to generate X509KeyManager's for use with an SSLContext
- * or other PKI related operations.  Access to keystore data (other than keystore path)
- * is restricted to package access.  Certain public operations are exposed via the
- * {@link ApplicationKeyManagerUtils} class.
+ * {@link ApplicationKeyManagerFactory} provides a factory for using and caching X509 keystores.
  */
 public class ApplicationKeyManagerFactory {
 
-	/**
-	 * Keystore path system property or user preference.  Setting the system
-	 * property will take precedence over the user preference.
-	 */
-	public static final String KEYSTORE_PATH_PROPERTY = "ghidra.keystore";
-
-	/**
-	 * Password system property may be set.  If set, this password will be used
-	 * when accessing the keystore before attempting to use <code>customPasswordProvider</code>
-	 * if it has been set.
-	 */
-	public static final String KEYSTORE_PASSWORD_PROPERTY = "ghidra.password";
-
-	public static final String DEFAULT_PASSWORD = "changeme";
-
-	private static final int SELF_SIGNED_DURATION_DAYS = 2 * 365; // 2-years
-
 	private static KeyStorePasswordProvider customPasswordProvider;
-	private static X500Principal defaultIdentity;
-	private static List<String> subjectAlternativeNames;
 
-	private static ApplicationKeyManagerFactory instance;
+	// X509KeyManager cached keyed by file hash concatenated with its canonical path
+	private static HashMap<String, X509KeyManager> keyStoreCache = new HashMap<>();
 
-	/**
-	 * Get ApplicationKeyManager singleton
-	 * @return application X509KeyManager
-	 */
-	static synchronized ApplicationKeyManagerFactory getInstance() {
-		if (instance == null) {
-			instance = new ApplicationKeyManagerFactory();
-		}
-		return instance;
-	}
-
-	/**
-	 * get the single key manager instance associated with the factory.
-	 * @return key manager instance
-	 */
-	private static ApplicationKeyManager getKeyManagerWrapper() {
-		return getInstance().keyManagerWrapper;
+	private ApplicationKeyManagerFactory() {
+		// no construct
 	}
 
 	/**
@@ -94,220 +52,49 @@ public static synchronized void setKeyStorePasswordProvider(KeyStorePasswordProv
 	}
 
 	/**
-	 * Prune path to trim leading and trailing white space. A null will be
-	 * returned if the pruned path is null or the empty string.
-	 *
-	 * @param path
-	 * @return pruned path or null if path was null or pruned path was the empty
-	 *         string
+	 * Clear all cached key managers.
+	 * NOTE: This is primarily intended for test use only.
 	 */
-	private static String prunePath(String path) {
-		if (path != null) {
-			path = path.trim();
-			if (path.length() == 0) {
-				path = null;
-			}
-		}
-		return path;
+	public static synchronized void clearKeyManagerCache() {
+		keyStoreCache.clear();
 	}
 
 	/**
-	 * Set user keystore file path (e.g., certificate file with private key).
-	 * This method will have no effect if the keystore had been set via the system
-	 * property and an error will be displayed.  Otherwise, the keystore will
-	 * be updated and the key manager re-initialized.  The user preference will be
-	 * updated unless a failure occurred while attempting to open the keystore.
-	 * This change will take immediate effect for the current executing application,
-	 * however, it may still be superseded by a system property setting when running
-	 * the application in the future. See {@link #getKeyStore()}.
-	 * @param path keystore file path or null to clear current key store and preference.
-	 * @param savePreference if true will be saved as user preference
-	 * @return true if successful else false if error occured (see log).
+	 * Get key manager for specified JKS or PKCS12 keystore file path.  The user may be prompted
+	 * for a password if required which will block the invocation of this synchronized method.  
+	 * If successfully opened, the resulting key manager instance will be cached for subsequent 
+	 * re-use of the same keystore.
+	 * 
+	 * @param keystorePath protected keystore path
+	 * @param defaultPasswd default password (e.g., supplied by property) or null
+	 * @return key manager
+	 * @throws CancelledException password entry was cancelled by user
+	 * @throws KeyStoreException error occurred opening/processing keystore
 	 */
-	public static synchronized boolean setKeyStore(String path, boolean savePreference) {
-
-		if (System.getProperty(KEYSTORE_PATH_PROPERTY) != null) {
-			Msg.showError(ApplicationKeyManagerFactory.class, null, "Set KeyStore Failed",
-				"PKI KeyStore was set via system property and can not be changed");
-			return false;
-		}
+	public synchronized static X509KeyManager getKeyManager(String keystorePath,
+			String defaultPasswd) throws CancelledException, KeyStoreException {
 
-		path = prunePath(path);
+		String hashKey;
 
 		try {
-			boolean keyInitialized = getKeyManagerWrapper().init(path);
-
-			if (savePreference && (path == null || keyInitialized)) {
-				Preferences.setProperty(KEYSTORE_PATH_PROPERTY, path);
-				Preferences.store();
+			if (PKIUtils.detectKeyStoreType(keystorePath) == null) {
+				throw new KeyStoreException("Unsupported PKI key store file type: " + keystorePath);
 			}
-			return keyInitialized;
-		}
-		catch (CancelledException e) {
-			// ignore - keystore left unchanged
-			return false;
-		}
-	}
-
-	/**
-	 * Get the keystore path associated with the active key manager or the
-	 * preferred keystore path if not yet initialized.
-	 */
-	public static synchronized String getKeyStore() {
-		return getKeyManagerWrapper().getKeyStore();
-	}
+			// Obtain canonical path for cache use
+			File keystoreFile = new File(keystorePath);
+			keystorePath = (keystoreFile).getCanonicalPath();
 
-	/**
-	 * If the system property <i>ghidra.keystore</i> takes precedence in establishing 
-	 * the keystore.  If using a GUI and the system property has not been set, the 
-	 * user preference with the same name will be used.
-	 * @return active keystore path or null if currently not running with a keystore or
-	 * one has not been set.
-	 */
-	public static synchronized String getPreferredKeyStore() {
-		String path = prunePath(System.getProperty(KEYSTORE_PATH_PROPERTY));
-		if (path == null && !SystemUtilities.isInHeadlessMode()) {
-			path = prunePath(Preferences.getProperty(KEYSTORE_PATH_PROPERTY));
-		}
-		return path;
-	}
-
-	/**
-	 * Determine if active key manager is utilizing a generated self-signed certificate.
-	 * @return true if using self-signed certificate.
-	 */
-	public static synchronized boolean usingGeneratedSelfSignedCertificate() {
-		return getKeyManagerWrapper().usingGeneratedSelfSignedCertificate();
-	}
-
-	/**
-	 * Set the default self-signed principal identity to be used during initialization
-	 * if no keystore defined.  Current application key manager will be invalidated.
-	 * (NOTE: this is intended for server use only when client will not be performing
-	 * CA validation).
-	 * @param identity if not null and a KeyStore path has not be set, this
-	 * identity will be used to generate a self-signed certificate and private key
-	 */
-	public synchronized static void setDefaultIdentity(X500Principal identity) {
-		defaultIdentity = identity;
-		getKeyManagerWrapper().invalidateKey();
-	}
+			hashKey = HashUtilities.getHash(HashUtilities.MD5_ALGORITHM, keystoreFile) + "_" +
+				keystorePath;
 
-	/**
-	 * Add the optional self-signed subject alternative name to be used during initialization
-	 * if no keystore defined.  Current application key manager will be invalidated.
-	 * (NOTE: this is intended for server use only when client will not be performing
-	 * CA validation).
-	 * @param subjectAltName name to be added to the current list of alternative subject names.
-	 * A null value will clear all names currently set.  
-	 * name will be used to generate a self-signed certificate and private key
-	 */
-	public synchronized static void addSubjectAlternativeName(String subjectAltName) {
-		if (subjectAltName == null) {
-			subjectAlternativeNames = null;
-		}
-		else {
-			if (subjectAlternativeNames == null) {
-				subjectAlternativeNames = new ArrayList<>();
+			X509KeyManager keyManager = keyStoreCache.get(hashKey);
+			if (keyManager != null) {
+				return keyManager;
 			}
-			subjectAlternativeNames.add(subjectAltName);
 		}
-		getKeyManagerWrapper().invalidateKey();
-	}
-
-	/**
-	 * Get the current list of subject alternative names to be used for a self-signed certificate
-	 * if no keystore defined.
-	 * @return list of subject alternative names to be used for a self-signed certificate
-	 * if no keystore defined.
-	 */
-	public synchronized static List<String> getSubjectAlternativeName() {
-		return Collections.unmodifiableList(subjectAlternativeNames);
-	}
-
-	/**
-	 * Initialize key manager if needed.  Doing this explicitly independent of an SSL connection
-	 * allows application to bail before initiating connection.  This will get handshake failure
-	 * if user forgets keystore password or other keystore problem.
-	 * @return true if key manager initialized, otherwise false
-	 */
-	public synchronized static boolean initialize() {
-		try {
-			return getKeyManagerWrapper().init();
+		catch (IOException e) {
+			throw new KeyStoreException("Failed to examine keystore: " + keystorePath, e);
 		}
-		catch (CancelledException e) {
-			return false;
-		}
-	}
-
-	/**
-	 * Invalidate the key managers associated with this factory
-	 */
-	public synchronized static void invalidateKeyManagers() {
-		getKeyManagerWrapper().invalidateKey();
-	}
-
-	// Factory maintains a single X509 key manager
-	private ApplicationKeyManager keyManagerWrapper = new ApplicationKeyManager();
-
-	/**
-	 * <code>ApplicationKeyManagerFactory</code> constructor
-	 */
-	private ApplicationKeyManagerFactory() {
-	}
-
-	/**
-	 * Get key managers
-	 * @return key managers
-	 */
-	KeyManager[] getKeyManagers() {
-		return new KeyManager[] { keyManagerWrapper };
-	}
-
-	/**
-	 * <code>ProtectedKeyStoreData</code> provides a container for a keystore
-	 * which has been successfully accessed using the specified password.
-	 */
-	private static class ProtectedKeyStoreData {
-		KeyStore keyStore;
-		char[] password;
-
-		ProtectedKeyStoreData(KeyStore keyStore, char[] password) {
-			this.keyStore = keyStore;
-			this.password = password != null ? password.clone() : null;
-		}
-
-		/**
-		 * Dispose this keystore data wrapper and the retained password
-		 */
-		void dispose() {
-			if (password != null) {
-				Arrays.fill(password, ' ');
-			}
-			keyStore = null;
-		}
-
-		@Override
-		protected void finalize() throws Throwable {
-			dispose();
-			super.finalize();
-		}
-	}
-
-	/**
-	 * Get protected keystore data for specified keystorePath.  Caller is responsible for
-	 * properly disposing returned object.
-	 * @param keystorePath protected keystore path
-	 * @return protected keystore data
-	 * @throws CancelledException password entry was cancelled by user
-	 * @throws KeyStoreException error occurred opening/processing keystore
-	 */
-	private static ProtectedKeyStoreData getProtectedKeyStoreData(String keystorePath)
-			throws CancelledException, KeyStoreException {
-
-		Msg.info(ApplicationKeyManagerFactory.class, "Using certificate keystore: " + keystorePath);
-
-		String keystorePwd = System.getProperty(KEYSTORE_PASSWORD_PROPERTY);
 
 		int tryCount = 0;
 
@@ -319,20 +106,12 @@ private static ProtectedKeyStoreData getProtectedKeyStoreData(String keystorePat
 					// try no password first
 				}
 				else if (tryCount == 1) {
-					// try default password
-					Msg.debug(ApplicationKeyManagerFactory.class,
-						"Attempting to load keystore without password...");
-					password = DEFAULT_PASSWORD.toCharArray();
-				}
-				else if (tryCount == 2) {
 					// try specified password
-					if (keystorePwd != null) {
-						Msg.debug(ApplicationKeyManagerFactory.class,
-							"Attempting to load keystore with property-based password...");
-						password = keystorePwd.toCharArray();
+					if (defaultPasswd != null) {
+						password = defaultPasswd.toCharArray();
 					}
 					else {
-						// no system property password provided
+						// no default password was provided
 						++tryCount;
 						continue;
 					}
@@ -341,7 +120,7 @@ else if (customPasswordProvider != null) {
 					disposePassword(oldPassword);
 					oldPassword = password;
 					password =
-						customPasswordProvider.getKeyStorePassword(keystorePath, tryCount != 3);
+						customPasswordProvider.getKeyStorePassword(keystorePath, tryCount != 2);
 					if (password == null) {
 						throw new CancelledException();
 					}
@@ -358,24 +137,24 @@ else if (customPasswordProvider != null) {
 				}
 				++tryCount;
 
-				// we only support a single password for both keystore and private key
-				KeyStore keyStore = ApplicationKeyStore.getKeyStoreInstance(keystorePath, password);
-				return new ProtectedKeyStoreData(keyStore, password);
+				// NOTE: we only support a single password for both keystore and private key
+				KeyStore keyStore = PKIUtils.getKeyStoreInstance(keystorePath, password);
+				X509KeyManager keyManager = getKeyManagerFromKeyStore(keyStore, password);
+				keyStoreCache.put(hashKey, keyManager);
+				return keyManager;
 			}
-			catch (NoSuchAlgorithmException | CertificateException | FileNotFoundException e) {
+			catch (UnrecoverableKeyException | NoSuchAlgorithmException | CertificateException
+					| FileNotFoundException e) {
 				throw new KeyStoreException("Failed to process keystore: " + keystorePath, e);
 			}
 			catch (KeyStoreException | IOException e) {
 				// Java Bug: JDK-6974037 : PKCS12 Keystore load with invalid passwords generates different exceptions
 				Exception ioException = getIOException(e);
-				if (ioException != null) {
-					// Assume all IOExceptions are the result of improperly decrypted keystore
-					// since arbitrary and inconsistent errors are produced when attempting to 
-					// load an encrypted keystore without a password or with the wrong password.
-					continue;
+				if (ioException != null &&
+					ioException.getCause() instanceof UnrecoverableKeyException) {
+					continue; // Assume incorrect password was specified
 				}
-				throw new KeyStoreException(
-					"Failed to process keystore (" + tryCount + "): " + keystorePath, e);
+				throw new KeyStoreException("Failed to open keystore: " + keystorePath, e);
 			}
 			finally {
 				disposePassword(oldPassword);
@@ -385,6 +164,47 @@ else if (customPasswordProvider != null) {
 		throw new KeyStoreException("Failed to unlock key storage: " + keystorePath);
 	}
 
+	/**
+	 * Get key manager for specified JKS or PKCS12 keystore. The keystore must only contain a 
+	 * single X509 certificate and corresponding private key which has a usage of digital signing.
+	 * @param keyStore JKS or PKCS12 keystore file
+	 * @param password password for accessing keystore and private key.
+	 * @return X509 key manager instance
+	 * @throws NoSuchAlgorithmException if the specified algorithm is not available from the 
+	 * 			specified provider.
+	 * @throws UnrecoverableKeyException if the key cannot be recovered
+	 *          (e.g. the given password is wrong).
+	 * @throws KeyStoreException if a general failure occurs while accessing keystore
+	 */
+	static X509KeyManager getKeyManagerFromKeyStore(KeyStore keyStore, char[] password)
+			throws UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException {
+
+		// Assume cert of interest is the first one
+		Enumeration<String> aliases = keyStore.aliases();
+		if (!aliases.hasMoreElements()) {
+			throw new KeyStoreException("PKI key store is empty");
+		}
+		Certificate certificate = keyStore.getCertificate(aliases.nextElement());
+		if (!(certificate instanceof X509Certificate x509Cert)) {
+			throw new KeyStoreException("PKI X509 Certificate not found");
+		}
+		boolean[] keyUsage = x509Cert.getKeyUsage();
+		if (!keyUsage[0]) {
+			throw new KeyStoreException("PKI key store must contain Digital Signing certificate");
+		}
+
+		KeyManagerFactory kmf =
+			KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+		kmf.init(keyStore, password);
+
+		// Assume that one keystore will produce at most one KeyManager
+		KeyManager[] keyManagers = kmf.getKeyManagers();
+		if (keyManagers.length == 1 && (keyManagers[0] instanceof X509KeyManager)) {
+			return (X509KeyManager) keyManagers[0];
+		}
+		throw new KeyStoreException("Unsupported keystore");
+	}
+
 	private static void disposePassword(char[] password) {
 		if (password != null) {
 			Arrays.fill(password, (char) 0);
@@ -403,237 +223,4 @@ private static IOException getIOException(Exception e) {
 		return null;
 	}
 
-	/**
-	 * <code>ApplicationKeyManager</code> provides a wrapper for the X509 wrappedKeyManager whose
-	 * instantiation is delayed until needed.  When a wrapper method is first invoked, the
-	 * {@link ApplicationKeyManagerFactory#init()} method is called to open the keystore
-	 * (which may require a password prompt) and establish the underlying X509KeyManager.
-	 */
-	private class ApplicationKeyManager extends X509ExtendedKeyManager {
-
-		private X509KeyManager wrappedKeyManager;
-		private String keystorePath;
-		private boolean isSelfSigned = false;
-
-		@Override
-		public String chooseEngineServerAlias(String keyType, Principal[] issuers,
-				SSLEngine engine) {
-			return super.chooseEngineServerAlias(keyType, issuers, engine);
-		}
-
-		@Override
-		public String chooseEngineClientAlias(String[] keyType, Principal[] issuers,
-				SSLEngine engine) {
-			return super.chooseEngineClientAlias(keyType, issuers, engine);
-		}
-
-		@Override
-		public synchronized String chooseClientAlias(String[] keyType, Principal[] issuers,
-				Socket socket) {
-			try {
-				init();
-			}
-			catch (CancelledException e) {
-				// ignore
-			}
-			if (wrappedKeyManager == null) {
-				return null;
-			}
-			return wrappedKeyManager.chooseClientAlias(keyType, issuers, socket);
-		}
-
-		@Override
-		public synchronized String chooseServerAlias(String keyType, Principal[] issuers,
-				Socket socket) {
-			try {
-				init();
-			}
-			catch (CancelledException e) {
-				// ignore
-			}
-			if (wrappedKeyManager == null) {
-				return null;
-			}
-			return wrappedKeyManager.chooseServerAlias(keyType, issuers, socket);
-		}
-
-		@Override
-		public String[] getClientAliases(String keyType, Principal[] issuers) {
-			try {
-				init();
-			}
-			catch (CancelledException e) {
-				// ignore
-			}
-			if (wrappedKeyManager == null) {
-				return null;
-			}
-			return wrappedKeyManager.getClientAliases(keyType, issuers);
-		}
-
-		@Override
-		public String[] getServerAliases(String keyType, Principal[] issuers) {
-			try {
-				init();
-			}
-			catch (CancelledException e) {
-				// ignore
-			}
-			if (wrappedKeyManager == null) {
-				return null;
-			}
-			return wrappedKeyManager.getServerAliases(keyType, issuers);
-		}
-
-		@Override
-		public X509Certificate[] getCertificateChain(String alias) {
-			if (wrappedKeyManager == null) {
-				return null;
-			}
-			return wrappedKeyManager.getCertificateChain(alias);
-		}
-
-		@Override
-		public PrivateKey getPrivateKey(String alias) {
-			if (wrappedKeyManager == null) {
-				return null;
-			}
-			return wrappedKeyManager.getPrivateKey(alias);
-		}
-
-		/**
-		 * Invalidate the active keystore and key manager
-		 */
-		private synchronized void invalidateKey() {
-			wrappedKeyManager = null;
-			keystorePath = null;
-			isSelfSigned = false;
-		}
-
-		/**
-		 * Return active keystore path or preferred keystore path if not yet initialized.
-		 * @return active keystore path or preferred keystore path if not yet initialized.
-		 */
-		private synchronized String getKeyStore() {
-			return wrappedKeyManager != null ? keystorePath : getPreferredKeyStore();
-		}
-
-		/**
-		 * Determine if active key manager is utilizing a generated self-signed certificate.
-		 * @return true if using self-signed certificate.
-		 */
-		private synchronized boolean usingGeneratedSelfSignedCertificate() {
-			return wrappedKeyManager != null && isSelfSigned;
-		}
-
-		/**
-		 * Initialize the x509KeyManager associated with the active keystore setting.
-		 * If the <code>x509KeyManager</code> already exists, this method has no affect.  If the
-		 * <code>keystorePath</code> has not already been set, the <code>getPreferredKeyStore()</code>
-		 * method will be invoked to obtain the keystore which should be used in establishing the
-		 * <code>wrappedKeyManager</code>.  If no keystore has been identified and the Default Identity
-		 * has been set, a self-signed certificate will be generated.  If nothing has been set, the
-		 * wrappedKeyManager will remain null and false will be returned.  If an error occurs it
-		 * will be logged and key managers will remain uninitialized.
-		 * @return true if key manager initialized successfully or was previously initialized, else
-		 * false if keystore path has not been set and default identity for self-signed certificate
-		 * has not be established (see {@link ApplicationKeyManagerFactory#setDefaultIdentity(X500Principal)}).
-		 * @throws CancelledException user cancelled keystore password entry request
-		 */
-		private synchronized boolean init() throws CancelledException {
-			if (wrappedKeyManager != null) {
-				return true;
-			}
-			return init(getPreferredKeyStore());
-		}
-
-		/**
-		 * Initialize the x509KeyManager.
-		 * If the <code>x509KeyManager</code> already exists for the specified keystore path,
-		 * this method has no affect.  If no keystore has been identified and the Default Identity
-		 * has been set, a self-signed certificate will be generated.  If nothing has been set, the
-		 * wrappedKeyManager will remain null and false will be returned.  If an error occurs it
-		 * will be logged and key managers will remain uninitialized.
-		 * @param newKeystorePath specifies the keystore to be opened or null for no keystore
-		 * @return true if key manager initialized successfully or was previously initialized, else
-		 * false if new keystore path was not specified and default identity for self-signed certificate
-		 * has not be established (see {@link ApplicationKeyManagerFactory#setDefaultIdentity(X500Principal)}).
-		 * @throws CancelledException user cancelled keystore password entry request
-		 */
-		private synchronized boolean init(String newKeystorePath) throws CancelledException {
-
-			if (wrappedKeyManager != null) {
-				if (StringUtils.equals(keystorePath, newKeystorePath)) {
-					return true;
-				}
-				invalidateKey();
-			}
-
-			ProtectedKeyStoreData keystoreData = null;
-			try {
-				if (newKeystorePath != null && newKeystorePath.length() != 0) {
-					keystoreData = getProtectedKeyStoreData(newKeystorePath);
-				}
-				else if (defaultIdentity != null) {
-					// use self-signed keystore as fallback (intended for server use only)
-					Msg.info(this, "Using self-signed certificate: " + defaultIdentity.getName());
-					char[] pwd = DEFAULT_PASSWORD.toCharArray();
-					KeyStore selfSignedKeyStore =
-						ApplicationKeyManagerUtils.createKeyStore("defaultSigKey",
-							defaultIdentity.getName(), SELF_SIGNED_DURATION_DAYS, null, null, "JKS",
-							subjectAlternativeNames, pwd);
-					keystoreData = new ProtectedKeyStoreData(selfSignedKeyStore, pwd);
-					isSelfSigned = true;
-				}
-				else {
-					return false;
-				}
-
-				ApplicationKeyStore.logCerts(keystoreData.keyStore);
-
-				KeyManagerFactory kmf =
-					KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
-				kmf.init(keystoreData.keyStore, keystoreData.password);
-
-				// Assume that one keystore will produce at most one KeyManager
-				KeyManager[] keyManagers = kmf.getKeyManagers();
-				if (keyManagers.length == 1 && (keyManagers[0] instanceof X509KeyManager)) {
-					wrappedKeyManager = (X509KeyManager) keyManagers[0];
-					keystorePath = newKeystorePath; // update current keystore path
-					return true;
-				}
-
-				isSelfSigned = false;
-
-				if (keyManagers.length == 0) {
-					Msg.showError(this, null, "PKI Keystore Failure",
-						"Failed to create PKI key manager: failed to process keystore (no keys processed)");
-				}
-				else if (keyManagers.length == 1) {
-					Msg.showError(this, null, "PKI Keystore Failure",
-						"Failed to create PKI key manager: failed to process keystore (expected X.509)");
-				}
-				else {
-					// Unexpected condition
-					Msg.showError(this, null, "PKI Keystore Failure",
-						"Failed to create PKI key manager: unsupported keystore produced multiple KeyManagers");
-				}
-			}
-			catch (CancelledException e) {
-				throw e;
-			}
-			catch (Exception e) {
-				Msg.showError(this, null, "PKI Keystore Failure",
-					"Failed to create PKI key manager: " + e.getMessage(), e);
-			}
-			finally {
-				if (keystoreData != null) {
-					keystoreData.dispose();
-					keystoreData = null;
-				}
-			}
-			return false;
-		}
-	}
-
 }

@@ -1,244 +0,0 @@
-/* ###
- * IP: GHIDRA
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ghidra.net;
-
-import java.io.*;
-import java.security.*;
-import java.security.cert.*;
-import java.security.cert.Certificate;
-import java.util.Date;
-import java.util.Enumeration;
-
-import javax.security.auth.x500.X500Principal;
-
-import ghidra.util.Msg;
-
-/**
- * <code>ApplicationKeyStore</code> provides the ability to read X.509 certificates and 
- * keystores in various formats. Certificate files (e.g., cacerts) may be in a standard
- * X.509 form (*.pem, *.crt, *.cer, *.der) or Java JKS (*.jks) form, while keystores 
- * for client/server may be in a PKCS12 form (*.p12, *.pks, *.pfx) or Java JKS (*.jks) form.
- */
-public class ApplicationKeyStore {
-
-	private ApplicationKeyStore() {
-		// no instantiation - static methods only
-	}
-
-	/**
-	 * Load the specified X.509 certificate authority store in a standard
-	 * X.509 form (*.pem, *.crt, *.cer, *.der) or Java JKS (*.jks) form.
-	 * @param cacertsPath certificate store file path
-	 * @return KeyStore containing ingested certificates
-	 * @throws IOException
-	 * @throws KeyStoreException
-	 * @throws NoSuchAlgorithmException
-	 * @throws CertificateException
-	 */
-	public static KeyStore getCertificateStoreInstance(String cacertsPath)
-			throws IOException, KeyStoreException, NoSuchAlgorithmException, CertificateException {
-
-		int certCount = 0;
-
-		KeyStore store = KeyStore.getInstance(KeyStore.getDefaultType());
-		store.load(null);
-
-		InputStream fis = new FileInputStream(cacertsPath);
-		BufferedInputStream bis = new BufferedInputStream(fis);
-
-		try {
-			CertificateFactory cf = CertificateFactory.getInstance("X.509");
-			while (bis.available() > 0) {
-				try {
-					Certificate cert = cf.generateCertificate(bis);
-					if (cert instanceof X509Certificate) {
-						X509Certificate x509Cert = (X509Certificate) cert;
-						String name = getCommonName(x509Cert.getSubjectDN());
-						store.setCertificateEntry(name, cert);
-						++certCount;
-					}
-				}
-				catch (CertificateException e) {
-					// Must handle blank lines at bottom of file
-					Throwable cause = e.getCause();
-					if (cause != null && "Empty input".equals(cause.getMessage())) {
-						break; // end of file
-					}
-					throw e;
-				}
-			}
-		}
-		finally {
-			bis.close();
-		}
-		if (certCount == 0) {
-			// Processing JKS files above produce "Empty input", if no certs read
-			// try reading as keystore without password 
-			return getKeyStoreInstance(cacertsPath, null);
-		}
-		return store;
-	}
-
-	/**
-	 * Attempt to load a client/server keystore in a PKCS12 form (*.p12, *.pks, *.pfx) or 
-	 * Java JKS (*.jks) form.
-	 * @param pwd keystore password
-	 * @return keystore instance
-	 * @throws IOException
-	 * @throws KeyStoreException
-	 * @throws NoSuchAlgorithmException
-	 * @throws CertificateException
-	 */
-	public static KeyStore getKeyStoreInstance(String keystorePath, char[] pwd)
-			throws IOException, KeyStoreException, NoSuchAlgorithmException, CertificateException {
-
-		File keystoreFile = new File(keystorePath);
-		boolean isPKCS12 = ApplicationKeyManagerUtils.PKCS_FILENAME_FILTER.accept(keystoreFile);
-		String type = isPKCS12 ? "PKCS12" : "JKS"; // JKS assumed if not PKCS
-		KeyStore ks = KeyStore.getInstance(type);
-
-		InputStream fis = new FileInputStream(keystorePath);
-		BufferedInputStream bis = new BufferedInputStream(fis);
-		try {
-			ks.load(bis, pwd);
-		}
-		finally {
-			bis.close();
-		}
-		return ks;
-	}
-
-	/**
-	 * Attempt to detect PKI KeyStore type ("JKS" or "PKCS12") for the specified file.
-	 * @param keystorePath key store file path
-	 * @return "JKS", "PKCS12" or null
-	 * @throws IOException if file read error occurs
-	 */
-	public static String detectKeyStoreType(String keystorePath) throws IOException {
-		try (FileInputStream fis = new FileInputStream(keystorePath)) {
-			byte[] header = new byte[4];
-			int read = fis.read(header);
-			if (read < 4) {
-				return null;
-			}
-
-			// Check for JKS magic number: FEEDFEED
-			if ((header[0] & 0xFF) == 0xFE && (header[1] & 0xFF) == 0xED &&
-				(header[2] & 0xFF) == 0xFE && (header[3] & 0xFF) == 0xED) {
-				return "JKS";
-			}
-
-			// Check for PKCS12: starts with 0x30 0x82
-			if ((header[0] & 0xFF) == 0x30 && (header[1] & 0xFF) == 0x82) {
-				return "PKCS12";
-			}
-
-			return null;
-		}
-	}
-
-	/**
-	 * Extract Common Name (CN) from specified principal subject Distinguished Name (DN)
-	 * @param subject X.509 certificate subject
-	 * @return Common Name or full subject name if unable to extract CN from DN
-	 */
-	private static String getCommonName(Principal subject) {
-
-		// Subject name should be distinguished-name (DN) which starts with common-name (CN)
-		String name = subject.getName();
-		int commaIndex = name.indexOf(',');
-		String firstElement = commaIndex < 0 ? name : name.substring(0, commaIndex);
-
-		int equalsIndex = firstElement.indexOf('=');
-		if (equalsIndex <= 0) {
-			return name; // bad common name
-		}
-
-		String fieldName = firstElement.substring(0, equalsIndex).trim();
-		String fieldValue = firstElement.substring(equalsIndex + 1).trim();
-
-		if (!fieldName.equalsIgnoreCase("CN")) {
-			return name; // bad common name
-		}
-
-		return fieldValue;
-	}
-
-	/**
-	 * Log all X509 certificates contained within keystore
-	 * @param keyStore certificate keystore
-	 */
-	static void logCerts(KeyStore keyStore) {
-		try {
-			Enumeration<String> aliases = keyStore.aliases();
-			while (aliases.hasMoreElements()) {
-				String alias = aliases.nextElement();
-				Certificate certificate = keyStore.getCertificate(alias);
-				if (certificate == null) {
-					continue;
-				}
-				else if (certificate instanceof X509Certificate) {
-					logCert(alias, (X509Certificate) certificate);
-				}
-				else {
-					Msg.warn(ApplicationKeyStore.class, "Ignore unrecognized certificate: alias=" +
-						alias + ", type=" + certificate.getType());
-				}
-			}
-		}
-		catch (KeyStoreException e) {
-			Msg.error(ApplicationKeyStore.class, "KeyStore failure", e);
-		}
-	}
-
-	/**
-	 * Log all X509 certificates contained within array
-	 * @param x509Certs array of certificates
-	 */
-	public static void logCerts(X509Certificate[] x509Certs) {
-		for (X509Certificate x509Cert : x509Certs) {
-			logCert(null, x509Cert);
-		}
-	}
-
-	/**
-	 * Log specified X509 certificate details
-	 * @param alias certificate alias or null if not applicable
-	 * @param x509Cert X509 certificate
-	 */
-	static void logCert(String alias, X509Certificate x509Cert) {
-
-		X500Principal subj = x509Cert.getSubjectX500Principal();
-		X500Principal issuer = x509Cert.getIssuerX500Principal();
-
-		Date now = new Date();
-
-		String label = alias != null ? (alias + ": ") : "";
-		if (now.compareTo(x509Cert.getNotAfter()) > 0) {
-			Msg.warn(ApplicationKeyStore.class,
-				"   " + label + getCommonName(subj) + ", issued by " + getCommonName(issuer) +
-					", S/N " + x509Cert.getSerialNumber().toString(16) + ", expired " +
-					x509Cert.getNotAfter() + " **EXPIRED**");
-		}
-		else {
-			Msg.info(ApplicationKeyStore.class,
-				"   " + label + getCommonName(subj) + ", issued by " + getCommonName(issuer) +
-					", S/N " + x509Cert.getSerialNumber().toString(16) + ", expires " +
-					x509Cert.getNotAfter());
-		}
-	}
-
-}

@@ -1,92 +0,0 @@
-/* ###
- * IP: GHIDRA
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *      http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ghidra.net;
-
-import java.io.IOException;
-import java.net.*;
-import java.security.NoSuchAlgorithmException;
-
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSocketFactory;
-
-import ghidra.util.Msg;
-
-/**
- * <code>ApplicationSSLSocketFactory</code> provides a replacement for the default
- * <code>SSLSocketFactory</code> which utilizes the default SSLContext established
- * by {@link SSLContextInitializer}.
- */
-public class ApplicationSSLSocketFactory extends SSLSocketFactory {
-
-	private final SSLSocketFactory socketFactory;
-
-	/**
-	 * ApplicationSSLSocketFactory constructor.  
-	 * SSLContext initialization will be performed using {@link SSLContextInitializer}.
-	 */
-	public ApplicationSSLSocketFactory() {
-		SSLSocketFactory factory = null;
-		try {
-			if (SSLContextInitializer.initialize()) {
-				factory = SSLContext.getDefault().getSocketFactory();
-			}
-		}
-		catch (NoSuchAlgorithmException e) {
-			Msg.error(this, "Failed to employ default SSLContext: " + e.toString(), e);
-		}
-		this.socketFactory =
-			factory != null ? factory : (SSLSocketFactory) SSLSocketFactory.getDefault();
-	}
-
-	@Override
-	public Socket createSocket(Socket s, String host, int port, boolean autoClose)
-			throws IOException {
-		return socketFactory.createSocket(s, host, port, autoClose);
-	}
-
-	@Override
-	public String[] getDefaultCipherSuites() {
-		return socketFactory.getDefaultCipherSuites();
-	}
-
-	@Override
-	public String[] getSupportedCipherSuites() {
-		return socketFactory.getSupportedCipherSuites();
-	}
-
-	@Override
-	public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
-		return socketFactory.createSocket(host, port);
-	}
-
-	@Override
-	public Socket createSocket(InetAddress host, int port) throws IOException {
-		return socketFactory.createSocket(host, port);
-	}
-
-	@Override
-	public Socket createSocket(String host, int port, InetAddress localHost, int localPort)
-			throws IOException, UnknownHostException {
-		return socketFactory.createSocket(host, port, localHost, localPort);
-	}
-
-	@Override
-	public Socket createSocket(InetAddress address, int port, InetAddress localAddress,
-			int localPort)
-			throws IOException {
-		return socketFactory.createSocket(address, port, localAddress, localPort);
-	}
-}

@@ -0,0 +1,512 @@
+/* ###
+ * IP: GHIDRA
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package ghidra.net;
+
+import java.net.Socket;
+import java.security.*;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.*;
+
+import javax.net.ssl.*;
+import javax.rmi.ssl.SslRMIClientSocketFactory;
+import javax.security.auth.DestroyFailedException;
+import javax.security.auth.x500.X500Principal;
+
+import org.apache.commons.lang3.StringUtils;
+
+import ghidra.framework.preferences.Preferences;
+import ghidra.util.Msg;
+import ghidra.util.SystemUtilities;
+import ghidra.util.exception.CancelledException;
+
+/**
+ * {@link DefaultKeyManagerFactory} provides access to the default application key manager
+ * associated with the preferred keystore file specified by the {@link #KEYSTORE_PATH_PROPERTY}
+ * system property or set with {@link #setDefaultKeyStore(String, boolean)}.  
+ * <p>
+ * <p>
+ * NOTE: Since {@link SslRMIClientSocketFactory} and {@link SSLServerSocketFactory} employ a
+ * static cache of a default {@link SSLSocketFactory}, with its default {@link SSLContext}, we
+ * must utilize a wrapped implementation of the associated {@link X509ExtendedKeyManager} so that 
+ * an updated keystore is used by the existing default {@link SSLSocketFactory}.
+ */
+public class DefaultKeyManagerFactory {
+
+	/**
+	 * Keystore path system property or user preference.  Setting the system
+	 * property will take precedence over the user preference.
+	 */
+	public static final String KEYSTORE_PATH_PROPERTY = "ghidra.keystore";
+
+	/**
+	 * Password system property may be set.  If set, this password will be used
+	 * when accessing the keystore before attempting to use <code>customPasswordProvider</code>
+	 * if it has been set.
+	 */
+	public static final String KEYSTORE_PASSWORD_PROPERTY = "ghidra.password";
+
+	public static final String DEFAULT_PASSWORD = "changeme";
+
+	private static final int SELF_SIGNED_DURATION_DAYS = 2 * 365; // 2-years
+
+	// Certificate info when self-signed cert is used
+	private static X500Principal defaultIdentity;
+	private static List<String> defaultSubjectAlternativeNames;
+
+	// Factory maintains a single X509 key manager
+	private static final DefaultX509KeyManager keyManagerWrapper = new DefaultX509KeyManager();
+
+	/**
+	 * Prune path to trim leading and trailing white space. A null will be
+	 * returned if the pruned path is null or the empty string.
+	 *
+	 * @param path file path to be pruned (may be null)
+	 * @return pruned path or null if path was null or pruned path was the empty
+	 *         string
+	 */
+	private static String prunePath(String path) {
+		if (path != null) {
+			path = path.trim();
+			if (path.length() == 0) {
+				path = null;
+			}
+		}
+		return path;
+	}
+
+	/**
+	 * Set default user keystore file path (e.g., certificate file with private key).
+	 * This method will have no effect if the keystore had been set via the system
+	 * property and an error will be displayed.  Otherwise, the keystore will
+	 * be updated and the key manager re-initialized.  The user preference will be
+	 * updated unless a failure occurred while attempting to open the keystore.
+	 * This change will take immediate effect for the current executing application,
+	 * however, it may still be superseded by a system property setting when running
+	 * the application in the future. See {@link #getKeyStore()}.
+	 * 
+	 * @param path keystore file path or null to clear current key store and preference.
+	 * @param savePreference if true will be saved as user preference
+	 * @return true if successful else false if error occured (see log).
+	 */
+	public static synchronized boolean setDefaultKeyStore(String path, boolean savePreference) {
+
+		if (System.getProperty(KEYSTORE_PATH_PROPERTY) != null) {
+			Msg.showError(DefaultKeyManagerFactory.class, null, "Set KeyStore Failed",
+				"PKI KeyStore was set via system property and can not be changed");
+			return false;
+		}
+
+		path = prunePath(path);
+
+		try {
+			boolean keyInitialized = keyManagerWrapper.init(path);
+
+			if (savePreference && (path == null || keyInitialized)) {
+				Preferences.setProperty(KEYSTORE_PATH_PROPERTY, path);
+				Preferences.store();
+			}
+			return keyInitialized;
+		}
+		catch (CancelledException e) {
+			// ignore - keystore left unchanged
+			return false;
+		}
+	}
+
+	/**
+	 * Determine if active key manager is utilizing a generated self-signed certificate.
+	 * 
+	 * @return true if using self-signed certificate.
+	 */
+	public static synchronized boolean usingGeneratedSelfSignedCertificate() {
+		return keyManagerWrapper.usingGeneratedSelfSignedCertificate();
+	}
+
+	/**
+	 * Set the default self-signed principal identity to be used during initialization
+	 * if no keystore defined.  Current application key manager will be invalidated.
+	 * (NOTE: this is intended for server use only when client will not be performing
+	 * CA validation).
+	 * 
+	 * @param identity if not null and a KeyStore path has not be set, this
+	 * identity will be used to generate a self-signed certificate and private key
+	 */
+	public synchronized static void setDefaultIdentity(X500Principal identity) {
+		defaultIdentity = identity;
+		keyManagerWrapper.invalidateKey();
+	}
+
+	/**
+	 * Add the optional self-signed subject alternative name to be used during initialization
+	 * if no keystore defined.  Current application key manager will be invalidated.
+	 * (NOTE: this is intended for server use only when client will not be performing
+	 * CA validation).
+	 * @param subjectAltName name to be added to the current list of alternative subject names.
+	 * A null value will clear all names currently set.  
+	 * name will be used to generate a self-signed certificate and private key
+	 */
+	public synchronized static void addSubjectAlternativeName(String subjectAltName) {
+		if (subjectAltName == null) {
+			defaultSubjectAlternativeNames = null;
+		}
+		else {
+			if (defaultSubjectAlternativeNames == null) {
+				defaultSubjectAlternativeNames = new ArrayList<>();
+			}
+			defaultSubjectAlternativeNames.add(subjectAltName);
+		}
+		keyManagerWrapper.invalidateKey();
+	}
+
+	/**
+	 * Initialize key manager if needed.  Doing this explicitly independent of an SSL connection
+	 * allows application to bail before initiating connection.  This will get handshake failure
+	 * if user forgets keystore password or other keystore problem.
+	 * @return true if key manager initialized, otherwise false
+	 */
+	public synchronized static boolean initialize() {
+		try {
+			return keyManagerWrapper.init();
+		}
+		catch (CancelledException e) {
+			return false;
+		}
+	}
+
+	/**
+	 * Invalidate the existing default key manager.
+	 */
+	public synchronized static void invalidateKeyManager() {
+		keyManagerWrapper.invalidateKey();
+	}
+
+	/**
+	 * If the system property <i>ghidra.keystore</i> takes precedence in establishing 
+	 * the keystore.  If using a GUI and the system property has not been set, the 
+	 * user preference with the same name will be used.
+	 * @return active keystore path or null if currently not running with a keystore or
+	 * one has not been set.
+	 */
+	public static synchronized String getPreferredKeyStore() {
+		String path = prunePath(System.getProperty(KEYSTORE_PATH_PROPERTY));
+		if (path == null && !SystemUtilities.isInHeadlessMode()) {
+			path = prunePath(Preferences.getProperty(KEYSTORE_PATH_PROPERTY));
+		}
+		return path;
+	}
+
+	/**
+	 * Get the default/preferred key store path.
+	 * @return default key store path or null if not set
+	 */
+	public static synchronized String getKeyStore() {
+		return keyManagerWrapper.getKeyStore();
+	}
+
+	/**
+	 * Get the lazy default key manager associated with the preferred key store.
+	 * @return default key manager or null if not initialized
+	 */
+	public static synchronized X509ExtendedKeyManager getKeyManager() {
+		return keyManagerWrapper;
+	}
+
+	/**
+	 * <code>DefaultKeyManager</code> provides a wrapper for the X509 wrappedKeyManager whose
+	 * instantiation is delayed until needed.  When a wrapper method is first invoked, the
+	 * {@link DefaultX509KeyManager#init()} method is called to open the keystore
+	 * (which may require a password prompt) and establish the underlying X509KeyManager.
+	 */
+	private static class DefaultX509KeyManager extends X509ExtendedKeyManager {
+
+		private X509KeyManager wrappedKeyManager;
+		private String keystorePath;
+		private boolean isSelfSigned = false;
+
+		@Override
+		public String chooseEngineServerAlias(String keyType, Principal[] issuers,
+				SSLEngine engine) {
+			return super.chooseEngineServerAlias(keyType, issuers, engine);
+		}
+
+		@Override
+		public String chooseEngineClientAlias(String[] keyType, Principal[] issuers,
+				SSLEngine engine) {
+			return super.chooseEngineClientAlias(keyType, issuers, engine);
+		}
+
+		@Override
+		public synchronized String chooseClientAlias(String[] keyType, Principal[] issuers,
+				Socket socket) {
+			try {
+				init();
+			}
+			catch (CancelledException e) {
+				// ignore
+			}
+			if (wrappedKeyManager == null) {
+				return null;
+			}
+			return wrappedKeyManager.chooseClientAlias(keyType, issuers, socket);
+		}
+
+		@Override
+		public synchronized String chooseServerAlias(String keyType, Principal[] issuers,
+				Socket socket) {
+			try {
+				init();
+			}
+			catch (CancelledException e) {
+				// ignore
+			}
+			if (wrappedKeyManager == null) {
+				return null;
+			}
+			return wrappedKeyManager.chooseServerAlias(keyType, issuers, socket);
+		}
+
+		@Override
+		public String[] getClientAliases(String keyType, Principal[] issuers) {
+			try {
+				init();
+			}
+			catch (CancelledException e) {
+				// ignore
+			}
+			if (wrappedKeyManager == null) {
+				return null;
+			}
+			return wrappedKeyManager.getClientAliases(keyType, issuers);
+		}
+
+		@Override
+		public String[] getServerAliases(String keyType, Principal[] issuers) {
+			try {
+				init();
+			}
+			catch (CancelledException e) {
+				// ignore
+			}
+			if (wrappedKeyManager == null) {
+				return null;
+			}
+			return wrappedKeyManager.getServerAliases(keyType, issuers);
+		}
+
+		@Override
+		public X509Certificate[] getCertificateChain(String alias) {
+			if (wrappedKeyManager == null) {
+				return null;
+			}
+			return wrappedKeyManager.getCertificateChain(alias);
+		}
+
+		@Override
+		public PrivateKey getPrivateKey(String alias) {
+			if (wrappedKeyManager == null) {
+				return null;
+			}
+			return wrappedKeyManager.getPrivateKey(alias);
+		}
+
+		/**
+		 * Invalidate the active keystore and key manager
+		 */
+		private synchronized void invalidateKey() {
+			wrappedKeyManager = null;
+			keystorePath = null;
+			isSelfSigned = false;
+		}
+
+		/**
+		 * Return active keystore path or preferred keystore path if not yet initialized.
+		 * @return active keystore path or preferred keystore path if not yet initialized.
+		 */
+		private synchronized String getKeyStore() {
+			return keystorePath != null ? keystorePath : getPreferredKeyStore();
+		}
+
+		/**
+		 * Determine if active key manager is utilizing a generated self-signed certificate.
+		 * @return true if using self-signed certificate.
+		 */
+		private synchronized boolean usingGeneratedSelfSignedCertificate() {
+			return wrappedKeyManager != null && isSelfSigned;
+		}
+
+		/**
+		 * Initialize the default x509KeyManager singleton wrappedKeyManager associated with the 
+		 * preferred keystore path.
+		 * If the <code>x509KeyManager</code> already exists, this method has no affect.  If the
+		 * <code>keystorePath</code> has not already been set, the <code>getPreferredKeyStore()</code>
+		 * method will be invoked to obtain the keystore which should be used in establishing the
+		 * <code>wrappedKeyManager</code>.  If no keystore has been identified and the Default Identity
+		 * has been set, a self-signed certificate will be generated.  If nothing has been set, the
+		 * wrappedKeyManager will remain null and false will be returned.  If an error occurs it
+		 * will be logged and key managers will remain uninitialized.
+		 * @return true if key manager initialized successfully or was previously initialized, else
+		 * false if keystore path has not been set and default identity for self-signed certificate
+		 * has not be established (see {@link DefaultKeyManagerFactory#setDefaultIdentity(X500Principal)}).
+		 * @throws CancelledException user cancelled keystore password entry request
+		 */
+		private synchronized boolean init() throws CancelledException {
+			if (wrappedKeyManager != null) {
+				return true;
+			}
+			return init(getPreferredKeyStore());
+		}
+
+		/**
+		 * Initialize the default x509KeyManager singleton wrappedKeyManager using the specified path.
+		 * If the <code>x509KeyManager</code> already exists for the specified keystore path,
+		 * this method has no affect.  If no keystore has been identified and the Default Identity
+		 * has been set, a self-signed certificate will be generated.  If nothing has been set, the
+		 * wrappedKeyManager will remain null and false will be returned.  If an error occurs it
+		 * will be logged and key managers will remain uninitialized.
+		 * @param newKeystorePath specifies the keystore to be opened or null for no keystore
+		 * @return true if key manager initialized successfully or was previously initialized, else
+		 * false if new keystore path was not specified and default identity for self-signed certificate
+		 * has not be established (see {@link DefaultKeyManagerFactory#setDefaultIdentity(X500Principal)}).
+		 * @throws CancelledException user cancelled keystore password entry request
+		 */
+		private synchronized boolean init(String newKeystorePath) throws CancelledException {
+
+			if (wrappedKeyManager != null) {
+				if (StringUtils.equals(keystorePath, newKeystorePath)) {
+					return true;
+				}
+				invalidateKey();
+			}
+
+			isSelfSigned = false;
+			try {
+				if (newKeystorePath != null && newKeystorePath.length() != 0) {
+					Msg.info(DefaultKeyManagerFactory.class,
+						"Using certificate keystore: " + newKeystorePath);
+					// Password optionally specified via property
+					String keystorePwd = System.getProperty(KEYSTORE_PASSWORD_PROPERTY);
+					wrappedKeyManager =
+						ApplicationKeyManagerFactory.getKeyManager(newKeystorePath, keystorePwd);
+					keystorePath = newKeystorePath; // update current keystore path
+				}
+				else if (defaultIdentity != null) {
+					// use self-signed keystore as fallback (intended for server use only)
+					Msg.info(this, "Using self-signed certificate: " + defaultIdentity.getName());
+					char[] pwd = DEFAULT_PASSWORD.toCharArray();
+					KeyStore selfSignedKeyStore = PKIUtils.createKeyStore("defaultSigKey",
+						defaultIdentity.getName(), SELF_SIGNED_DURATION_DAYS, null, null, "JKS",
+						defaultSubjectAlternativeNames, pwd);
+					wrappedKeyManager = ApplicationKeyManagerFactory
+							.getKeyManagerFromKeyStore(selfSignedKeyStore, pwd);
+					isSelfSigned = true;
+				}
+				else {
+					return false;
+				}
+				return true;
+			}
+			catch (CancelledException e) {
+				throw e;
+			}
+			catch (Exception e) {
+				Msg.showError(this, null, "PKI Keystore Failure",
+					"Failed to create PKI key manager: " + e.getMessage(), e);
+			}
+			return false;
+		}
+	}
+
+	/**
+	 * Sign the supplied token byte array using an installed certificate from
+	 * one of the specified authorities
+	 * @param authorities trusted certificate authorities used to constrain client certificate
+	 *   (may be null or empty array if CA constraint does not matter).
+	 * @param token token byte array
+	 * @return signed token object
+	 * @throws NoSuchAlgorithmException algorithm associated within signing certificate not found
+	 * @throws SignatureException failed to generate SignedToken
+	 * @throws CertificateException error associated with signing certificate
+	 */
+	public static SignedToken getSignedToken(Principal[] authorities, byte[] token)
+			throws NoSuchAlgorithmException, SignatureException, CertificateException {
+
+		PrivateKey privateKey = null;
+		X509Certificate[] certificateChain = null;
+		try {
+			X509ExtendedKeyManager x509KeyManager = getKeyManager();
+			if (x509KeyManager != null) {
+				String alias = x509KeyManager.chooseClientAlias(new String[] { PKIUtils.RSA_TYPE },
+					authorities, null);
+				if (alias != null) {
+					privateKey = x509KeyManager.getPrivateKey(alias);
+					certificateChain = x509KeyManager.getCertificateChain(alias);
+				}
+			}
+			if (privateKey == null || certificateChain == null) {
+				CertificateException e =
+					new CertificateException("suitable PKI certificate not found");
+				e.printStackTrace();
+				throw e;
+			}
+
+			//
+			// See JAVA Examples in a Nutshell (p.358) for use of Signer and
+			// IdentityScope classes
+			//
+
+			String algorithm = certificateChain[0].getSigAlgName();
+			Signature sig = Signature.getInstance(algorithm);
+			try {
+				sig.initSign(privateKey);
+			}
+			catch (InvalidKeyException e) {
+				throw new CertificateException("suitable PKI certificate not found", e);
+			}
+			sig.update(token);
+
+			return new SignedToken(token, sig.sign(), certificateChain, algorithm);
+		}
+		finally {
+			if (privateKey != null) {
+				// Note: Keystore destroy only supported in Java 1.8
+				try {
+					privateKey.destroy();
+				}
+				catch (DestroyFailedException e) {
+					// ignore - may not be supported by all keystores
+				}
+			}
+		}
+	}
+
+	/**
+	 * Verify that the specified sigBytes reflect my signature of the specified token.
+	 * @param authorities trusted certificate authorities used to constrain client certificate
+	 *   (may be null or empty array if CA constraint does not matter).
+	 * @param token byte array token
+	 * @param signature token signature
+	 * @return true if signature is my signature
+	 * @throws NoSuchAlgorithmException algorithym associated within signing certificate not found
+	 * @throws SignatureException failed to generate SignedToken
+	 * @throws CertificateException error associated with signing certificate
+	 */
+	public static boolean isMySignature(Principal[] authorities, byte[] token, byte[] signature)
+			throws NoSuchAlgorithmException, SignatureException, CertificateException {
+		SignedToken signedToken = getSignedToken(authorities, token);
+		return Arrays.equals(signature, signedToken.signature);
+	}
+}

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -26,21 +26,17 @@
 /**
  * Initialize the default SSLContext for use by all SSL connections (e.g., https).
  * It is the responsibility of the Application to properly invoke this initializer 
- * to ensure that the default SSLContext is properly established. While HTTPS URL connections
- * will make use of this default SSLContext, other SSL connections may need to 
- * specify the {@link ApplicationSSLSocketFactory} to leverage the applications
- * default SSLContext.
+ * to ensure that the default SSLContext is properly established.
  * <p>
  * The property <code>jdk.tls.client.protocols</code> should be set to restrict secure
  * client connections to a specific set of enabled TLS protocols (e.g., TLSv1.2,TLSv1.3).
  * See <A href="https://java.com/en/configure_crypto.html">JDK and JRE Cryptographic Algorithms</A> 
  * for details.
  * 
- * @see ApplicationTrustManagerFactory
- * @see ApplicationKeyManagerFactory
- * @see ApplicationKeyManagerUtils
+ * @see DefaultTrustManagerFactory
+ * @see DefaultKeyManagerFactory
  */
-public class SSLContextInitializer implements ModuleInitializer {
+public class DefaultSSLContextInitializer implements ModuleInitializer {
 
 	private static final String DEFAULT_SSL_PROTOCOL = "TLS";
 
@@ -56,8 +52,8 @@ public class SSLContextInitializer implements ModuleInitializer {
 	public static synchronized boolean initialize(boolean reset) {
 		if (reset) {
 			sslContext = null;
-			ApplicationTrustManagerFactory.invalidateTrustManagers();
-			ApplicationKeyManagerFactory.invalidateKeyManagers();
+			DefaultTrustManagerFactory.invalidateTrustManagers();
+			DefaultKeyManagerFactory.invalidateKeyManager();
 		}
 		return initialize();
 	}
@@ -73,15 +69,25 @@ public static synchronized boolean initialize() {
 			return true;
 		}
 
-		Msg.info(SSLContextInitializer.class, "Initializing SSL Context");
+		Msg.info(DefaultSSLContextInitializer.class, "Initializing SSL Context");
 
-		KeyManager[] keyManagers = ApplicationKeyManagerFactory.getInstance().getKeyManagers();
+		KeyManager keyManager = DefaultKeyManagerFactory.getKeyManager();
 
 		try {
 			// Use new instance of SSLContext to avoid adopting CA certs provided with Java
 			sslContext = SSLContext.getInstance(DEFAULT_SSL_PROTOCOL);
 			SecureRandom random = SecureRandomFactory.getSecureRandom();
-			sslContext.init(keyManagers, ApplicationTrustManagerFactory.getTrustManagers(), random);
+			sslContext.init(new KeyManager[] { keyManager },
+				DefaultTrustManagerFactory.getTrustManagers(), random);
+
+			//
+			// NOTE: The SslRMIClientSocketFactory and SslRMIServerSocketFactory both statically 
+			// cache their 'defaultSocketFactory' which prevents it from utilizing a new
+			// default SSLContext.  This requires us to employ a wrapped TrustManager and
+			// wrapped KeyManager to allow for them to possibly be revised after first use
+			// (e.g., JUnit testing, new user PKI Certificate, etc.).
+			//
+
 			SSLContext.setDefault(sslContext);
 
 			// Must install default HostnameVerifier - otherwise all traffic will fail
@@ -101,7 +107,7 @@ public static synchronized boolean initialize() {
 
 		}
 		catch (Exception e) {
-			Msg.error(SSLContextInitializer.class,
+			Msg.error(DefaultSSLContextInitializer.class,
 				"SSL Context initialization failed: " + e.getMessage(), e);
 		}
 		return false;

@@ -20,16 +20,20 @@
 import java.security.KeyStore;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
+import java.util.HashSet;
+import java.util.Set;
 
 import javax.net.ssl.*;
+import javax.rmi.ssl.SslRMIClientSocketFactory;
+import javax.security.auth.x500.X500Principal;
 
 import ghidra.framework.preferences.Preferences;
 import ghidra.util.Msg;
 
 /**
- * <code>ApplicationTrustManagerFactory</code> provides the ability to establish
- * acceptable certificate authorities to be used with SSL connections and PKI 
- * authentication.  
+ * <code>DefaultTrustManagerFactory</code> provides the ability to establish
+ * acceptable certificate authorities to be used with the default SSLContext
+ * as established by {@link DefaultSSLContextInitializer}. 
  * <p>
  * The default behavior is for no trust authority to be established, in which case 
  * SSL peers will not be authenticated.  If CA certificates have been set, all SSL
@@ -47,8 +51,13 @@
  * <p>
  * The application may choose to set the file path automatically based upon the presence of
  * a <i>cacerts</i> file at a predetermined location.
+ * <p>
+ * NOTE: Since {@link SslRMIClientSocketFactory} and {@link SSLServerSocketFactory} employ a
+ * static cache of a default {@link SSLSocketFactory}, with its default {@link SSLContext}, we
+ * must utilize a wrapped implementation of the associated {@link X509TrustManager} so that any
+ * changes are used by the existing default {@link SSLSocketFactory}.
  */
-public class ApplicationTrustManagerFactory {
+public class DefaultTrustManagerFactory {
 
 	/**
 	 * The X509 cacerts file to be used when authenticating remote 
@@ -57,22 +66,20 @@ public class ApplicationTrustManagerFactory {
 	 */
 	public static final String GHIDRA_CACERTS_PATH_PROPERTY = "ghidra.cacerts";
 
+	private static final X509Certificate[] NO_CERTS = new X509Certificate[0];
+
 	/**
 	 * Use a singleton wrappedTrustManager so we can alter the true trustManager
 	 * as needed.  Once the installed trust manager is consumed by the SSL Engine,
 	 * we are unable to get it to use a new one.  Use of a wrapper solves this
 	 * issue which occurs during testing.
 	 */
-	private static X509TrustManager trustManager;
-	private static TrustManager[] wrappedTrustManagers;
-
-	private static boolean hasCAs;
-	private static Exception caError;
+	private static final WrappedTrustManager wrappedTrustManager = new WrappedTrustManager();
 
 	/**
 	 * <code>ApplicationTrustManagerFactory</code> constructor
 	 */
-	private ApplicationTrustManagerFactory() {
+	private DefaultTrustManagerFactory() {
 		// no instantiation - static methods only
 	}
 
@@ -83,138 +90,169 @@ private ApplicationTrustManagerFactory() {
 	 */
 	private static void init() {
 
-		if (wrappedTrustManagers == null) {
-			wrappedTrustManagers = new WrappedTrustManager[] { new WrappedTrustManager() };
-		}
-
 		String cacertsPath = System.getProperty(GHIDRA_CACERTS_PATH_PROPERTY);
 		if (cacertsPath == null || cacertsPath.length() == 0) {
 			// check user preferences if cacerts not set via system property
 			cacertsPath = Preferences.getProperty(GHIDRA_CACERTS_PATH_PROPERTY);
 			if (cacertsPath == null || cacertsPath.length() == 0) {
-				Msg.info(ApplicationTrustManagerFactory.class,
+				Msg.info(DefaultTrustManagerFactory.class,
 					"Trust manager disabled, cacerts have not been set");
-				trustManager = new OpenTrustManager();
+				wrappedTrustManager.setTrustManager(new OpenTrustManager());
 				return;
 			}
 		}
 
 		try {
-			Msg.info(ApplicationTrustManagerFactory.class,
+			Msg.info(DefaultTrustManagerFactory.class,
 				"Trust manager initializing with cacerts: " + cacertsPath);
-			KeyStore keyStore = ApplicationKeyStore.getCertificateStoreInstance(cacertsPath);
+			KeyStore keyStore = PKIUtils.loadCertificateStore(cacertsPath);
 			TrustManagerFactory tmf =
 				TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
 			tmf.init(keyStore);
+			X509TrustManager x509TrustMgr = null;
 			TrustManager[] trustManagers = tmf.getTrustManagers();
-			for (TrustManager trustManager2 : trustManagers) {
-				if (trustManager2 instanceof X509TrustManager) {
-					X509TrustManager mgr = (X509TrustManager) trustManager2;
-					ApplicationKeyStore.logCerts(mgr.getAcceptedIssuers());
-					trustManager = mgr;
+			for (TrustManager trustMgr : trustManagers) {
+				if (trustMgr instanceof X509TrustManager) {
+					x509TrustMgr = (X509TrustManager) trustMgr;
+					wrappedTrustManager.setTrustManager(x509TrustMgr);
+					PKIUtils.logCerts(x509TrustMgr.getAcceptedIssuers());
 					break;
 				}
 			}
-			hasCAs = true;
+			if (x509TrustMgr == null) {
+				throw new CertificateException("Failed to load any X509 certificates");
+			}
 		}
 		catch (GeneralSecurityException | IOException e) {
-			caError = e;
+			wrappedTrustManager.setTrustManagerError(e);
 			String msg = e.getMessage();
 			if (msg == null) {
 				msg = e.toString();
 			}
-			Msg.error(ApplicationTrustManagerFactory.class,
+			Msg.error(DefaultTrustManagerFactory.class,
 				"Failed to process cacerts (" + cacertsPath + "): " + msg, e);
 		}
 	}
 
 	/**
-	 * Determine if certificate authorities are in place.  If no certificate authorities
-	 * have been specified via the "ghidra.cacerts" property, all certificates will be 
-	 * trusted. 
-	 * @return true if certificate authorities are in place, else false.
+	 * Get trust manager after performing any necessary initialization.
+	 * 
+	 * @return trust managers
 	 */
-	public static boolean hasCertificateAuthorities() {
-		return hasCAs;
+	public static synchronized TrustManager[] getTrustManagers() {
+		if (wrappedTrustManager.trustManager == null) {
+			init();
+		}
+		return new TrustManager[] { wrappedTrustManager };
 	}
 
 	/**
-	 * Determine if a CA cert initialization error occurred
-	 * @return true if error occurred (see {@link #getCertError()})
+	 * Invalidate the active keystore and key manager.
+	 * 
+	 * NOTE: This should only be invoked by {@link DefaultSSLContextInitializer}.
 	 */
-	static boolean hasCertError() {
-		return caError != null;
+	static synchronized void invalidateTrustManagers() {
+		wrappedTrustManager.invalidate();
 	}
 
 	/**
-	 * Get the CA cert initialization error which occurred
-	 * during initialization 
-	 * @return error object or null if not applicable
+	 * Returns a list of trusted issuers (i.e., CA certificates) as established
+	 * by the {@link DefaultTrustManagerFactory}.
+	 * 
+	 * @return array of trusted Certificate Authorities
+	 * @throws CertificateException if failed to properly initialize trust manager
+	 * due to CA certificate error(s).
 	 */
-	static Exception getCertError() {
-		return caError;
+	public static X500Principal[] getTrustedIssuers() throws CertificateException {
+		return wrappedTrustManager.getTrustedIssuers();
 	}
 
 	/**
-	 * Get trust managers after performing any necessary initialization.
-	 * @return trust managers
+	 * Validate a client certificate ensuring that it is not expired and is
+	 * trusted based upon the active trust managers.
+	 * @param certChain X509 certificate chain
+	 * @param authType authentication type (i.e., "RSA")
+	 * @throws CertificateException if certificate validation fails
 	 */
-	static synchronized TrustManager[] getTrustManagers() {
-		if (trustManager == null) {
-			init();
-		}
-		return wrappedTrustManagers.clone();
+	public static void validateClient(X509Certificate[] certChain, String authType)
+			throws CertificateException {
+		wrappedTrustManager.checkClientTrusted(certChain, authType);
 	}
-	
-	/**
-     * Get trust manager after performing any necessary initialization.
-     * @return trust managers
-     */
-    public static synchronized X509TrustManager getTrustManager() {
-        if (trustManager == null) {
-            init();
-        }
-        return trustManager;
-    }
 
-	/**
-	 * Invalidate the active keystore and key manager 
-	 */
-	static synchronized void invalidateTrustManagers() {
-		trustManager = null;
-		caError = null;
-	}
+	private static class WrappedTrustManager implements X509TrustManager {
 
-	private static final X509Certificate[] NO_CERTS = new X509Certificate[0];
+		private X509TrustManager trustManager;
+		private Exception caError;
 
-	private static class WrappedTrustManager implements X509TrustManager {
+		WrappedTrustManager() {
+			invalidate();
+		}
+
+		void invalidate() {
+			this.trustManager = null;
+			this.caError = null;
+		}
+
+		synchronized void setTrustManager(X509TrustManager trustManager) {
+			this.trustManager = trustManager;
+			this.caError = null;
+		}
+
+		synchronized void setTrustManagerError(Exception caError) {
+			this.trustManager = null;
+			this.caError = caError;
+		}
 
 		@Override
-		public void checkClientTrusted(X509Certificate[] chain, String authType)
+		public synchronized void checkClientTrusted(X509Certificate[] chain, String authType)
 				throws CertificateException {
-			if (trustManager == null) {
-				throw new CertificateException("Trust manager not properly initialized");
-			}
+			checkTrustManager();
 			trustManager.checkClientTrusted(chain, authType);
 		}
 
 		@Override
-		public void checkServerTrusted(X509Certificate[] chain, String authType)
+		public synchronized void checkServerTrusted(X509Certificate[] chain, String authType)
 				throws CertificateException {
-			if (trustManager == null) {
-				throw new CertificateException("Trust manager not properly initialized");
-			}
+			checkTrustManager();
 			trustManager.checkServerTrusted(chain, authType);
 		}
 
 		@Override
-		public X509Certificate[] getAcceptedIssuers() {
+		public synchronized X509Certificate[] getAcceptedIssuers() {
 			if (trustManager == null) {
 				return NO_CERTS;
 			}
 			return trustManager.getAcceptedIssuers();
 		}
 
+		synchronized X500Principal[] getTrustedIssuers() throws CertificateException {
+
+			WrappedTrustManager trustMgr = wrappedTrustManager;
+			trustMgr.checkTrustManager();
+
+			X509Certificate[] acceptedIssuers = trustMgr.getAcceptedIssuers();
+			if (acceptedIssuers == null || acceptedIssuers.length == 0) {
+				return null; // trust all authorities
+			}
+
+			Set<X500Principal> set = new HashSet<>();
+			for (X509Certificate trustedCert : acceptedIssuers) {
+				set.add(trustedCert.getSubjectX500Principal());
+			}
+			X500Principal[] principals = new X500Principal[set.size()];
+			return set.toArray(principals);
+		}
+
+		private void checkTrustManager() throws CertificateException {
+			if (trustManager != null) {
+				return;
+			}
+			if (caError != null) {
+				throw new CertificateException("Failed to load CA certs", caError);
+			}
+			throw new CertificateException("Trust manager not properly initialized");
+		}
+
 	}
 
 	/**

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -47,8 +47,8 @@ public class HttpClients {
 	 * @throws IOException if error in PKI settings or crypto configuration 
 	 */
 	public static HttpClient.Builder newHttpClientBuilder() throws IOException {
-		if (!ApplicationKeyManagerFactory.initialize()) {
-			if (ApplicationKeyManagerFactory.getKeyStore() != null) {
+		if (!DefaultKeyManagerFactory.initialize()) {
+			if (DefaultKeyManagerFactory.getKeyStore() != null) {
 				throw new IOException("Failed to initialize PKI certificate keystore");
 			}
 		}

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -19,12 +19,11 @@
 import java.net.*;
 import java.util.Properties;
 
-import ghidra.net.ApplicationKeyManagerFactory;
+import ghidra.net.DefaultKeyManagerFactory;
 import ghidra.util.Msg;
 
 public class HttpUtil {
 
-
 	/**
 	 * Execute an HTTP/HTTPS GET request and return the resulting HttpURLConnection.
 	 * @param httpUrlString HTTP/HTTPS URL
@@ -35,16 +34,16 @@ public class HttpUtil {
 	 * @throws IOException if an error occurs while executing request
 	 */
 	public static HttpURLConnection getContent(String httpUrlString,
-			Properties httpRequestProperties, boolean allowRedirect) throws MalformedURLException,
-			IOException {
+			Properties httpRequestProperties, boolean allowRedirect)
+			throws MalformedURLException, IOException {
 
 		URL url = new URL(httpUrlString);
 		String protocol = url.getProtocol();
 
 		if ("https".equals(protocol)) {
 			// force password prompt before connecting
-			if (!ApplicationKeyManagerFactory.initialize()) {
-				if (ApplicationKeyManagerFactory.getKeyStore() != null) {
+			if (!DefaultKeyManagerFactory.initialize()) {
+				if (DefaultKeyManagerFactory.getKeyStore() != null) {
 					// Report error condition?
 					throw new IOException("Failed to initialize PKI certificate keystore");
 				}

@@ -42,15 +42,13 @@
 import generic.random.SecureRandomFactory;
 import ghidra.util.Msg;
 import ghidra.util.exception.AssertException;
+import ghidra.util.exception.CancelledException;
 
 /**
- * <code>ApplicationKeyManagerUtils</code> provides public methods for utilizing
- * the application PKI key management, including access to trusted issuers
- * (i.e., CA certificates), token signing and validation, and the ability to
- * generate keystores for testing or when a self-signed certificate will
- * suffice.
+ * {@link PKIUtils} provides supporting utilities for creating and accessing X509 certificate
+ * keystore files.
  */
-public class ApplicationKeyManagerUtils {
+public class PKIUtils {
 
 	public static final String RSA_TYPE = "RSA";
 
@@ -69,193 +67,61 @@ public class ApplicationKeyManagerUtils {
 
 	static {
 		/**
-		 * Bouncy Castle uses its BCStyle for X500Names which reverses Distingushed Name ordering.
+		 * Bouncy Castle uses its BCStyle for X500Names which reverses Distinguished Name ordering.
 		 * This is resolved by setting the default to RFC4519 style to ensure compatibility with 
 		 * Java's internal implementation of X500Name.
 		 * <p>
 		 * Note that this could become an issue if this static default is adjusted elsewhere.
-		 * It may be neccessary to set this at the start of all methods which rely on any of the
+		 * It may be necessary to set this at the start of all methods which rely on any of the
 		 * BC code for X500 certificate processing.
 		 * 
 		 */
 		X500Name.setDefaultStyle(RFC4519Style.INSTANCE);
 	}
 
-	private ApplicationKeyManagerUtils() {
-		// no instantiation - static methods only
-	}
-
-	/**
-	 * Sign the supplied token byte array using an installed certificate from
-	 * one of the specified authorities
-	 * @param authorities trusted certificate authorities used to constrain client certificate
-	 *   (may be null or empty array if CA constraint does not matter).
-	 * @param token token byte array
-	 * @return signed token object
-	 * @throws NoSuchAlgorithmException algorithym associated within signing certificate not found
-	 * @throws SignatureException failed to generate SignedToken
-	 * @throws CertificateException error associated with signing certificate
-	 */
-	public static SignedToken getSignedToken(Principal[] authorities, byte[] token)
-			throws NoSuchAlgorithmException, SignatureException, CertificateException {
-
-		PrivateKey privateKey = null;
-		X509Certificate[] certificateChain = null;
-		try {
-			ApplicationKeyManagerFactory keyManagerFactory =
-				ApplicationKeyManagerFactory.getInstance();
-			for (KeyManager keyManager : keyManagerFactory.getKeyManagers()) {
-				if (!(keyManager instanceof X509KeyManager)) {
-					continue;
-				}
-				X509KeyManager x509KeyManager = (X509KeyManager) keyManager;
-				String alias =
-					x509KeyManager.chooseClientAlias(new String[] { RSA_TYPE }, authorities, null);
-				if (alias != null) {
-					privateKey = x509KeyManager.getPrivateKey(alias);
-					certificateChain = x509KeyManager.getCertificateChain(alias);
-					break;
-				}
-			}
-
-			if (privateKey == null || certificateChain == null) {
-				CertificateException e =
-					new CertificateException("suitable PKI certificate not found");
-				e.printStackTrace();
-				throw e;
-			}
-
-			//
-			// See JAVA Examples in a Nutshell (p.358) for use of Signer and
-			// IdentityScope classes
-			//
-
-			String algorithm = certificateChain[0].getSigAlgName();
-			Signature sig = Signature.getInstance(algorithm);
-			try {
-				sig.initSign(privateKey);
-			}
-			catch (InvalidKeyException e) {
-				throw new CertificateException("suitable PKI certificate not found", e);
-			}
-			sig.update(token);
-
-			return new SignedToken(token, sig.sign(), certificateChain, algorithm);
-		}
-		finally {
-			if (privateKey != null) {
-				// Note: Keystore destroy only supported in Java 1.8
-				try {
-					privateKey.destroy();
-				}
-				catch (DestroyFailedException e) {
-					// ignore - may not be supported by all keystores
-				}
-			}
-		}
-	}
-
-	/**
-	 * Verify that the specified sigBytes reflect my signature of the specified token.
-	 * @param authorities trusted certificate authorities used to constrain client certificate
-	 *   (may be null or empty array if CA constraint does not matter).
-	 * @param token byte array token
-	 * @param signature token signature
-	 * @return true if signature is my signature
-	 * @throws NoSuchAlgorithmException algorithym associated within signing certificate not found
-	 * @throws SignatureException failed to generate SignedToken
-	 * @throws CertificateException error associated with signing certificate
-	 */
-	public static boolean isMySignature(Principal[] authorities, byte[] token, byte[] signature)
-			throws NoSuchAlgorithmException, SignatureException, CertificateException {
-		SignedToken signedToken = getSignedToken(authorities, token);
-		return Arrays.equals(signature, signedToken.signature);
-	}
-
 	/**
-	 * Returns a list of trusted issuers (i.e., CA certificates) as established
-	 * by the {@link ApplicationTrustManagerFactory}.
-	 * @return array of trusted Certificate Authorities
-	 * @throws CertificateException if failed to properly initialize trust manager
-	 * due to CA certificate error(s).
+	 * Establish X509TrustManager for the specified CA certificate storage.
+	 * 
+	 * @param caCertsFile CA certificates storage file
+	 * @return X509TrustManager
+	 * @throws CancelledException if password entry was cancelled
+	 * @throws GeneralSecurityException if error occured during truststore initialization
+	 * @throws IOException if file read error occurs
 	 */
-	public static X500Principal[] getTrustedIssuers() throws CertificateException {
+	public static X509TrustManager getTrustManager(File caCertsFile)
+			throws CancelledException, GeneralSecurityException, IOException {
 
-		TrustManager[] trustManagers = ApplicationTrustManagerFactory.getTrustManagers();
-		if (ApplicationTrustManagerFactory.hasCertError()) {
-			throw new CertificateException("failed to load CA certs",
-				ApplicationTrustManagerFactory.getCertError());
+		if (!caCertsFile.isFile()) {
+			throw new FileNotFoundException(
+				"CA Certificates file not found: " + caCertsFile.getAbsolutePath());
 		}
 
-		Set<X500Principal> set = new HashSet<>();
-
-		boolean openTrust = true;
-		for (TrustManager trustManager : trustManagers) {
-			if (!(trustManager instanceof X509TrustManager)) {
-				Msg.warn(ApplicationKeyManagerUtils.class,
-					"Unexpected trust manager implementation: " +
-						trustManager.getClass().getName());
-				openTrust = false;
-				continue;
-			}
-			X509TrustManager x509TrustManager = (X509TrustManager) trustManager;
-			X509Certificate[] acceptedIssuers = x509TrustManager.getAcceptedIssuers();
-			if (acceptedIssuers != null && acceptedIssuers.length != 0) {
-				openTrust = false;
-				for (X509Certificate trustedCert : acceptedIssuers) {
-					set.add(trustedCert.getSubjectX500Principal());
-				}
+		KeyStore keyStore = PKIUtils.loadCertificateStore(caCertsFile.getAbsolutePath());
+		TrustManagerFactory tmf =
+			TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+		tmf.init(keyStore);
+
+		X509TrustManager trustManager = null;
+		TrustManager[] trustManagers = tmf.getTrustManagers();
+		for (TrustManager trustManager2 : trustManagers) {
+			if (trustManager2 instanceof X509TrustManager mgr) {
+				//ApplicationKeyStore.logCerts(mgr.getAcceptedIssuers());
+				trustManager = mgr;
+				break;
 			}
 		}
 
-		if (openTrust) {
-			return null;// trust all authorities
-		}
-
-		X500Principal[] principals = new X500Principal[set.size()];
-		return set.toArray(principals);
-	}
-
-	/**
-	 * Validate a client certificate ensuring that it is not expired and is
-	 * trusted based upon the active trust managers.
-	 * @param certChain X509 certificate chain
-	 * @param authType authentication type (i.e., "RSA")
-	 * @throws CertificateException if certificate validation fails
-	 */
-	public static void validateClient(X509Certificate[] certChain, String authType)
-			throws CertificateException {
-
-		CertificateException checkFailure = null;
-
-		TrustManager[] trustManagers = ApplicationTrustManagerFactory.getTrustManagers();
-		if (ApplicationTrustManagerFactory.hasCertError()) {
-			throw new CertificateException("failed to load CA certs",
-				ApplicationTrustManagerFactory.getCertError());
+		if (trustManager == null) {
+			throw new CertStoreException(
+				"Failed to load X509 TrustManager from " + caCertsFile.getAbsolutePath());
 		}
 
-		for (TrustManager trustManager : trustManagers) {
-			if (!(trustManager instanceof X509TrustManager)) {
-				continue;
-			}
-			X509TrustManager x509TrustManager = (X509TrustManager) trustManager;
-
-			try {
-				x509TrustManager.checkClientTrusted(certChain, authType);
-				checkFailure = null;
-				break;
-			}
-			catch (CertificateException e) {
-				checkFailure = e;
-			}
-		}
-		if (checkFailure != null) {
-			throw checkFailure;// check failed - throw last failure
-		}
+		return trustManager;
 	}
 
 	/**
 	 * Pack ordered list of certs to create a certificate chain array
+	 * 
 	 * @param cert primary certificate
 	 * @param caCerts CA certificate chain.
 	 * @return ordered certificate chain
@@ -269,6 +135,7 @@ private static Certificate[] makeCertificateChain(Certificate cert, Certificate.
 
 	/**
 	 * Export X.509 certificates to the specified outFile.
+	 * 
 	 * @param certificates certificates to be stored 
 	 * @param outFile output file
 	 * @throws IOException if error occurs writing to outFile
@@ -300,6 +167,7 @@ public static void exportX509Certificates(Certificate[] certificates, File outFi
 	/**
 	 * Generate a new {@link X509Certificate} with RSA {@link KeyPair} and create/update a {@link KeyStore}
 	 * optionally backed by a keyFile.  
+	 * 
 	 * @param alias entry alias with keystore
 	 * @param dn distinguished name (e.g., "CN=Ghidra Test, O=Ghidra, OU=Test, C=US" )
 	 * @param durationDays number of days which generated certificate should remain valid
@@ -407,7 +275,7 @@ public ProtectionParameter getProtectionParameter() {
 					keyStore.store(out, protectedPassphrase);
 					out.flush();
 					out.getFD().sync();
-					Msg.debug(ApplicationKeyManagerUtils.class,
+					Msg.debug(PKIUtils.class,
 						out.getChannel().size() + " bytes written to key/cert file: " + keyFile);
 				}
 				catch (SyncFailedException e) {
@@ -420,8 +288,7 @@ public ProtectionParameter getProtectionParameter() {
 				keyFile.setWritable(false);
 			}
 
-			Msg.debug(ApplicationKeyManagerUtils.class,
-				"Certificate Generated (" + alias + "): " + dn);
+			Msg.debug(PKIUtils.class, "Certificate Generated (" + alias + "): " + dn);
 
 			return keyStore;
 		}
@@ -441,6 +308,7 @@ public ProtectionParameter getProtectionParameter() {
 	/**
 	 * Generate a new {@link X509Certificate} with RSA {@link KeyPair} and create/update a {@link KeyStore}
 	 * optionally backed by a keyFile.  
+	 * 
 	 * @param alias entry alias with keystore
 	 * @param dn distinguished name (e.g., "CN=Ghidra Test, O=Ghidra, OU=Test, C=US" )
 	 * @param durationDays number of days which generated certificate should remain valid
@@ -477,4 +345,224 @@ public static final PrivateKeyEntry createKeyEntry(String alias, String dn, int
 		}
 	}
 
+	/**
+	 * Load the all certificates from the specified certificate store in a standard
+	 * X.509 form (e.g., concatenation of Base64 encoded certificates: *.pem, *.crt, *.cer, *.der) 
+	 * or Java JKS (*.jks) form.
+	 * 
+	 * @param certsPath certificate(s) storage file path
+	 * @return KeyStore containing certificates
+	 * @throws IOException if failure occurred reading and processing keystore file.
+	 * @throws NoSuchAlgorithmException if the algorithm used to check the integrity of the 
+	 * 			keystore cannot be found
+	 * @throws CertificateException if any of the certificates in the keystore could not be loaded 
+	 * @throws KeyStoreException if a general error occurred opening/processing keystore
+	 */
+	public static KeyStore loadCertificateStore(String certsPath)
+			throws IOException, KeyStoreException, NoSuchAlgorithmException, CertificateException {
+
+		int certCount = 0;
+
+		KeyStore store = KeyStore.getInstance(KeyStore.getDefaultType());
+		store.load(null);
+
+		// Attempt to read certificates in Base64 encoded form
+		InputStream fis = new FileInputStream(certsPath);
+		BufferedInputStream bis = new BufferedInputStream(fis);
+
+		try {
+			CertificateFactory cf = CertificateFactory.getInstance("X.509");
+			while (bis.available() > 0) {
+				try {
+					Certificate cert = cf.generateCertificate(bis);
+					if (cert instanceof X509Certificate) {
+						X509Certificate x509Cert = (X509Certificate) cert;
+						String name = getCommonName(x509Cert.getSubjectX500Principal());
+						store.setCertificateEntry(name, cert);
+						++certCount;
+					}
+				}
+				catch (CertificateException e) {
+					// Must handle blank lines at bottom of file
+					Throwable cause = e.getCause();
+					if (cause != null && "Empty input".equals(cause.getMessage())) {
+						break; // end of file
+					}
+					throw e;
+				}
+			}
+		}
+		finally {
+			bis.close();
+		}
+
+		if (certCount == 0) {
+			// Processing JKS files above produce "Empty input", if no certs read
+			// try reading as keystore without password 
+			return getKeyStoreInstance(certsPath, null);
+		}
+		return store;
+	}
+
+	/**
+	 * Attempt to load a client/server keystore in a PKCS12 form (*.p12, *.pks, *.pfx) or 
+	 * Java JKS (*.jks) form.
+	 * 
+	 * @param keystorePath JKS or PKCS12 keystore file path
+	 * @param password keystore password
+	 * @return keystore instance
+	 * @throws IOException if failure occurred reading and processing keystore file or if the 
+	 * 			given password was incorrect. If the error is due to a wrong password, the 
+	 * 			{@link Throwable#getCause cause} of the {@code IOException} should be an
+	 * 			{@code UnrecoverableKeyException}
+	 * @throws NoSuchAlgorithmException if the algorithm used to check the integrity of the 
+	 * 			keystore cannot be found
+	 * @throws CertificateException if any of the certificates in the keystore could not be loaded 
+	 * @throws KeyStoreException if a general error occurred opening/processing keystore
+	 */
+	public static synchronized KeyStore getKeyStoreInstance(String keystorePath, char[] password)
+			throws IOException, KeyStoreException, NoSuchAlgorithmException, CertificateException {
+
+		String type = PKIUtils.detectKeyStoreType(keystorePath);
+		if (type == null) {
+			throw new KeyStoreException("Unsupported PKI key store file type: " + keystorePath);
+		}
+
+		KeyStore ks = KeyStore.getInstance(type);
+
+		InputStream fis = new FileInputStream(keystorePath);
+		BufferedInputStream bis = new BufferedInputStream(fis);
+		try {
+			ks.load(bis, password);
+		}
+		finally {
+			bis.close();
+		}
+		return ks;
+	}
+
+	/**
+	 * Attempt to detect PKI KeyStore type ("JKS" or "PKCS12") for the specified file.
+	 * 
+	 * @param keystorePath key store file path
+	 * @return "JKS", "PKCS12" or null
+	 * @throws IOException if file read error occurs
+	 */
+	public static String detectKeyStoreType(String keystorePath) throws IOException {
+		try (FileInputStream fis = new FileInputStream(keystorePath)) {
+			byte[] header = new byte[4];
+			int read = fis.read(header);
+			if (read < 4) {
+				return null;
+			}
+
+			// Check for JKS magic number: FEEDFEED
+			if ((header[0] & 0xFF) == 0xFE && (header[1] & 0xFF) == 0xED &&
+				(header[2] & 0xFF) == 0xFE && (header[3] & 0xFF) == 0xED) {
+				return "JKS";
+			}
+
+			// Check for PKCS12: starts with 0x30 0x82
+			if ((header[0] & 0xFF) == 0x30 && (header[1] & 0xFF) == 0x82) {
+				return "PKCS12";
+			}
+
+			return null;
+		}
+	}
+
+	/**
+	 * Extract Common Name (CN) from specified principal subject Distinguished Name (DN)
+	 * 
+	 * @param subject X.509 certificate subject
+	 * @return Common Name or full subject name if unable to extract CN from DN
+	 */
+	private static String getCommonName(Principal subject) {
+
+		// Subject name should be distinguished-name (DN) which starts with common-name (CN)
+		String name = subject.getName();
+		int commaIndex = name.indexOf(',');
+		String firstElement = commaIndex < 0 ? name : name.substring(0, commaIndex);
+
+		int equalsIndex = firstElement.indexOf('=');
+		if (equalsIndex <= 0) {
+			return name; // bad common name
+		}
+
+		String fieldName = firstElement.substring(0, equalsIndex).trim();
+		String fieldValue = firstElement.substring(equalsIndex + 1).trim();
+
+		if (!fieldName.equalsIgnoreCase("CN")) {
+			return name; // bad common name
+		}
+
+		return fieldValue;
+	}
+
+	/**
+	 * Log all X509 certificates contained within keystore
+	 * 
+	 * @param keyStore certificate keystore
+	 */
+	static void logCerts(KeyStore keyStore) {
+		try {
+			Enumeration<String> aliases = keyStore.aliases();
+			while (aliases.hasMoreElements()) {
+				String alias = aliases.nextElement();
+				Certificate certificate = keyStore.getCertificate(alias);
+				if (certificate == null) {
+					continue;
+				}
+				else if (certificate instanceof X509Certificate) {
+					logCert(alias, (X509Certificate) certificate);
+				}
+				else {
+					Msg.warn(PKIUtils.class, "Ignore unrecognized certificate: alias=" + alias +
+						", type=" + certificate.getType());
+				}
+			}
+		}
+		catch (KeyStoreException e) {
+			Msg.error(PKIUtils.class, "KeyStore failure", e);
+		}
+	}
+
+	/**
+	 * Log all X509 certificates contained within array
+	 * 
+	 * @param x509Certs array of certificates
+	 */
+	public static void logCerts(X509Certificate[] x509Certs) {
+		for (X509Certificate x509Cert : x509Certs) {
+			logCert(null, x509Cert);
+		}
+	}
+
+	/**
+	 * Log specified X509 certificate details
+	 * 
+	 * @param alias certificate alias or null if not applicable
+	 * @param x509Cert X509 certificate
+	 */
+	static void logCert(String alias, X509Certificate x509Cert) {
+
+		X500Principal subj = x509Cert.getSubjectX500Principal();
+		X500Principal issuer = x509Cert.getIssuerX500Principal();
+
+		Date now = new Date();
+
+		String label = alias != null ? (alias + ": ") : "";
+		if (now.compareTo(x509Cert.getNotAfter()) > 0) {
+			Msg.warn(PKIUtils.class,
+				"   " + label + getCommonName(subj) + ", issued by " + getCommonName(issuer) +
+					", S/N " + x509Cert.getSerialNumber().toString(16) + ", expired " +
+					x509Cert.getNotAfter() + " **EXPIRED**");
+		}
+		else {
+			Msg.info(PKIUtils.class,
+				"   " + label + getCommonName(subj) + ", issued by " + getCommonName(issuer) +
+					", S/N " + x509Cert.getSerialNumber().toString(16) + ", expires " +
+					x509Cert.getNotAfter());
+		}
+	}
 }

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -21,7 +21,6 @@
 import java.security.*;
 import java.security.cert.X509Certificate;
 
-import javax.net.ssl.KeyManager;
 import javax.net.ssl.X509ExtendedKeyManager;
 
 import org.junit.*;
@@ -73,8 +72,8 @@ public void setUp() throws Exception {
 		keystoreFile = createTempFile("test-key", ".p12");
 		keystoreFile.delete();
 
-		ApplicationKeyManagerUtils.createKeyStore(ALIAS, TEST_IDENTITY, 2, null, keystoreFile,
-			"PKCS12", null, TEST_PWD.toCharArray());
+		PKIUtils.createKeyStore(ALIAS, TEST_IDENTITY, 2, null, keystoreFile, "PKCS12", null,
+			TEST_PWD.toCharArray());
 
 		ApplicationKeyManagerFactory.setKeyStorePasswordProvider(passwordProvider);
 	}
@@ -89,45 +88,39 @@ public void tearDown() throws Exception {
 	@Test
 	public void testCancelledPasswordOnSetCertificate() throws Exception {
 
-		assertNull(ApplicationKeyManagerFactory.getKeyStore());
-		ApplicationKeyManagerFactory instance = ApplicationKeyManagerFactory.getInstance();
-		KeyManager[] keyManagers = instance.getKeyManagers();
-		assertEquals(1, keyManagers.length);
-		assertTrue("", keyManagers[0] instanceof X509ExtendedKeyManager);
-		X509ExtendedKeyManager keyManager = (X509ExtendedKeyManager) keyManagers[0];
+		assertNull(DefaultKeyManagerFactory.getKeyStore());
+		X509ExtendedKeyManager keyManager = DefaultKeyManagerFactory.getKeyManager();
+		assertNotNull(keyManager);
 
 		// verify that no certs are installed
 		assertNull(keyManager.getCertificateChain(ALIAS));
 		assertNull(keyManager.getClientAliases("RSA", null));
 
 		passwordProvider.cancelNextEntry();
 
-		ApplicationKeyManagerFactory.setKeyStore(keystoreFile.getAbsolutePath(), false);
+		DefaultKeyManagerFactory.setDefaultKeyStore(keystoreFile.getAbsolutePath(), false);
 
 		// verify that no certs are installed
-		assertEquals(null, ApplicationKeyManagerFactory.getKeyStore());
+		assertEquals(null, DefaultKeyManagerFactory.getKeyStore());
 		assertNull(keyManager.getCertificateChain(ALIAS));
 		assertNull(keyManager.getClientAliases("RSA", null));
 	}
 
 	@Test
 	public void testSetClearCertificate() throws Exception {
 
-		assertNull(ApplicationKeyManagerFactory.getKeyStore());
-		ApplicationKeyManagerFactory instance = ApplicationKeyManagerFactory.getInstance();
-		KeyManager[] keyManagers = instance.getKeyManagers();
-		assertEquals(1, keyManagers.length);
-		assertTrue("", keyManagers[0] instanceof X509ExtendedKeyManager);
-		X509ExtendedKeyManager keyManager = (X509ExtendedKeyManager) keyManagers[0];
+		assertNull(DefaultKeyManagerFactory.getKeyStore());
+		X509ExtendedKeyManager keyManager = DefaultKeyManagerFactory.getKeyManager();
+		assertNotNull(keyManager);
 
 		// verify that no certs are installed
 		assertNull(keyManager.getCertificateChain(ALIAS));
 		assertNull(keyManager.getClientAliases("RSA", null));
 
-		ApplicationKeyManagerFactory.setKeyStore(keystoreFile.getAbsolutePath(), false);
+		DefaultKeyManagerFactory.setDefaultKeyStore(keystoreFile.getAbsolutePath(), false);
 
 		// verify that generated cert is installed
-		assertEquals(keystoreFile.getAbsolutePath(), ApplicationKeyManagerFactory.getKeyStore());
+		assertEquals(keystoreFile.getAbsolutePath(), DefaultKeyManagerFactory.getKeyStore());
 		X509Certificate[] chain = keyManager.getCertificateChain(ALIAS);
 		assertNotNull(chain);
 		String[] aliases = keyManager.getClientAliases("RSA", new Principal[0]); // any CA allowed
@@ -158,10 +151,10 @@ public void testSetClearCertificate() throws Exception {
 		}
 
 		// clear keystore
-		ApplicationKeyManagerFactory.setKeyStore(null, false);
+		DefaultKeyManagerFactory.setDefaultKeyStore(null, false);
 
 		// verify that no certs are installed
-		assertNull(ApplicationKeyManagerFactory.getKeyStore());
+		assertNull(DefaultKeyManagerFactory.getKeyStore());
 		assertNull(keyManager.getCertificateChain(ALIAS));
 		assertNull(keyManager.getClientAliases("RSA", null));
 

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -24,8 +24,8 @@
 import docking.widgets.OptionDialog;
 import docking.widgets.filechooser.GhidraFileChooser;
 import docking.widgets.filechooser.GhidraFileChooserMode;
-import ghidra.net.ApplicationKeyManagerFactory;
-import ghidra.net.ApplicationKeyManagerUtils;
+import ghidra.net.DefaultKeyManagerFactory;
+import ghidra.net.PKIUtils;
 import ghidra.util.HelpLocation;
 import ghidra.util.filechooser.ExtensionFileFilter;
 import ghidra.util.filechooser.GhidraFileFilter;
@@ -38,7 +38,7 @@ class EditActionManager {
 	 * PKCS Private Key/Certificate File Filter
 	 */
 	public static final GhidraFileFilter CERTIFICATE_FILE_FILTER =
-		new ExtensionFileFilter(ApplicationKeyManagerUtils.PKCS_FILE_EXTENSIONS, "PKCS Key File");
+		new ExtensionFileFilter(PKIUtils.PKCS_FILE_EXTENSIONS, "PKCS Key File");
 
 	private FrontEndPlugin plugin;
 	private FrontEndTool tool;
@@ -68,8 +68,8 @@ public void actionPerformed(ActionContext context) {
 // ACTIONS - auto generated
 		editPluginPathAction.setEnabled(true);
 
-		editPluginPathAction.setMenuBarData(new MenuData(new String[] { ToolConstants.MENU_EDIT,
-			"Plugin Path..." }, "GEdit"));
+		editPluginPathAction.setMenuBarData(
+			new MenuData(new String[] { ToolConstants.MENU_EDIT, "Plugin Path..." }, "GEdit"));
 
 		editCertPathAction = new DockingAction("Set PKI Certificate", plugin.getName()) {
 			@Override
@@ -80,8 +80,8 @@ public void actionPerformed(ActionContext context) {
 // ACTIONS - auto generated
 		editCertPathAction.setEnabled(true);
 
-		editCertPathAction.setMenuBarData(new MenuData(new String[] { ToolConstants.MENU_EDIT,
-			"Set PKI Certificate..." }, "PKI"));
+		editCertPathAction.setMenuBarData(new MenuData(
+			new String[] { ToolConstants.MENU_EDIT, "Set PKI Certificate..." }, "PKI"));
 
 		clearCertPathAction = new DockingAction("Clear PKI Certificate", plugin.getName()) {
 			@Override
@@ -90,13 +90,13 @@ public void actionPerformed(ActionContext context) {
 			}
 		};
 // ACTIONS - auto generated
-		clearCertPathAction.setEnabled(ApplicationKeyManagerFactory.getKeyStore() != null);
+		clearCertPathAction.setEnabled(DefaultKeyManagerFactory.getKeyStore() != null);
 
-		clearCertPathAction.setMenuBarData(new MenuData(new String[] { ToolConstants.MENU_EDIT,
-			"Clear PKI Certificate..." }, "PKI"));
+		clearCertPathAction.setMenuBarData(new MenuData(
+			new String[] { ToolConstants.MENU_EDIT, "Clear PKI Certificate..." }, "PKI"));
 
-		clearCertPathAction.setHelpLocation(new HelpLocation("FrontEndPlugin",
-			"Set_PKI_Certificate"));
+		clearCertPathAction
+				.setHelpLocation(new HelpLocation("FrontEndPlugin", "Set_PKI_Certificate"));
 		tool.addAction(editCertPathAction);
 		tool.addAction(clearCertPathAction);
 		tool.addAction(editPluginPathAction);
@@ -112,7 +112,7 @@ private void editPluginPath() {
 
 	private void clearCertPath() {
 
-		String path = ApplicationKeyManagerFactory.getKeyStore();
+		String path = DefaultKeyManagerFactory.getKeyStore();
 		if (path == null) {
 			// unexpected
 			clearCertPathAction.setEnabled(false);
@@ -124,7 +124,7 @@ private void clearCertPath() {
 			return;
 		}
 
-		ApplicationKeyManagerFactory.setKeyStore(null, true);
+		DefaultKeyManagerFactory.setDefaultKeyStore(null, true);
 		clearCertPathAction.setEnabled(false);
 	}
 
@@ -134,7 +134,7 @@ private void editCertPath() {
 
 		File dir = null;
 		File oldFile = null;
-		String path = ApplicationKeyManagerFactory.getKeyStore();
+		String path = DefaultKeyManagerFactory.getKeyStore();
 		if (path != null) {
 			oldFile = new File(path);
 			dir = oldFile.getParentFile();
@@ -163,7 +163,7 @@ private void editCertPath() {
 			if (file == null) {
 				return; // cancelled
 			}
-			ApplicationKeyManagerFactory.setKeyStore(file.getAbsolutePath(), true);
+			DefaultKeyManagerFactory.setDefaultKeyStore(file.getAbsolutePath(), true);
 			clearCertPathAction.setEnabled(true);
 			validInput = true;
 		}

@@ -28,6 +28,7 @@
 import docking.widgets.OptionDialog;
 import docking.widgets.PasswordChangeDialog;
 import docking.widgets.filechooser.GhidraFileChooser;
+import generic.hash.HashUtilities;
 import ghidra.framework.client.ClientUtil;
 import ghidra.framework.client.RepositoryAdapter;
 import ghidra.framework.model.*;

@@ -4,9 +4,9 @@
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- * 
+ *
  *      http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -33,7 +33,7 @@
 import generic.test.category.PortSensitiveCategory;
 import ghidra.framework.model.ServerInfo;
 import ghidra.framework.remote.GhidraServerHandle;
-import ghidra.net.ApplicationKeyManagerFactory;
+import ghidra.net.DefaultKeyManagerFactory;
 import ghidra.server.remote.ServerTestUtil;
 import ghidra.test.AbstractGhidraHeadlessIntegrationTest;
 import ghidra.util.task.TaskMonitor;
@@ -46,7 +46,7 @@ public class GhidraServerSerialFilterFailureTest extends AbstractGhidraHeadlessI
 
 	@Before
 	public void setUp() throws Exception {
-		System.clearProperty(ApplicationKeyManagerFactory.KEYSTORE_PATH_PROPERTY);
+		System.clearProperty(DefaultKeyManagerFactory.KEYSTORE_PATH_PROPERTY);
 	}
 
 	@After
@@ -79,7 +79,6 @@ private void startServer(int authMode, boolean altLoginName, boolean enableSSH,
 			enableAnonymous);
 	}
 
-
 	static class BogusPrincipal implements Principal, java.io.Serializable {
 
 		private String username;
@@ -110,10 +109,10 @@ public void testSerializationFailure() throws Exception {
 		startServer(-1, false, false, false);
 
 		ServerInfo server = new ServerInfo("localhost", ServerTestUtil.GHIDRA_TEST_SERVER_PORT);
-		
+
 		GhidraServerHandle serverHandle =
 			ServerConnectTask.getGhidraServerHandle(server, TaskMonitor.DUMMY);
-		
+
 		try {
 			serverHandle.getRepositoryServer(getBogusUserSubject(), new Callback[0]);
 			fail("serial filter rejection failed to perform");
@@ -125,7 +124,7 @@ public void testSerializationFailure() throws Exception {
 			assertTrue("expected remote invalid class exceptionn",
 				cause instanceof InvalidClassException);
 		}
-		
+
 	}
 
 }

@@ -29,6 +29,7 @@
 
 import org.apache.commons.lang3.RandomStringUtils;
 
+import generic.hash.HashUtilities;
 import generic.test.*;
 import ghidra.framework.Application;
 import ghidra.framework.client.*;
@@ -424,9 +425,9 @@ public static synchronized void startServer(String dirPath, int port, int authMo
 			"     Enable Anonymous Login: " + enableAnonymousAuthentication);
 
 		// Force client-side use of newly generated CA certificates
-		System.setProperty(ApplicationTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY,
+		System.setProperty(DefaultTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY,
 			getTestPkiCACertsPath());
-		SSLContextInitializer.initialize(true);
+		DefaultSSLContextInitializer.initialize(true);
 
 		ArrayList<String> argList = new ArrayList<>();
 		String javaCommand =
@@ -441,11 +442,11 @@ public static synchronized void startServer(String dirPath, int port, int authMo
 		argList.add("-Xdebug");
 		argList.add("-Xnoagent");
 		argList.add("-Djava.compiler=NONE");
-		argList.add("-D" + ApplicationTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY + "=" +
+		argList.add("-D" + DefaultTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY + "=" +
 			getTestPkiCACertsPath());
-		argList.add("-D" + ApplicationKeyManagerFactory.KEYSTORE_PATH_PROPERTY + "=" +
+		argList.add("-D" + DefaultKeyManagerFactory.KEYSTORE_PATH_PROPERTY + "=" +
 			getTestPkiServerKeystorePath());
-		argList.add("-D" + ApplicationKeyManagerFactory.KEYSTORE_PASSWORD_PROPERTY + "=" +
+		argList.add("-D" + DefaultKeyManagerFactory.KEYSTORE_PASSWORD_PROPERTY + "=" +
 			TEST_PKI_SERVER_PASSPHRASE);
 		argList.add("-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=*:18202"); // *: for remote debug support
 		argList.add("-DSystemUtilities.isTesting=true");
@@ -622,7 +623,7 @@ public static RepositoryServerAdapter getServerAdapter(File serverRoot, String[]
 
 	public static synchronized void disposeServer() {
 
-		System.setProperty(ApplicationTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY, "");
+		System.setProperty(DefaultTrustManagerFactory.GHIDRA_CACERTS_PATH_PROPERTY, "");
 
 		if (serverProcess != null) {
 
@@ -939,23 +940,22 @@ private static void generatePkiCerts() throws Exception {
 
 		// Generate CA certificate and keystore
 		Msg.info(ServerTestUtil.class, "Generating self-signed CA cert: " + caPath);
-		PrivateKeyEntry caEntry =
-			ApplicationKeyManagerUtils.createKeyEntry("test-CA", TEST_PKI_CA_DN, 2, null, null,
-				"PKCS12", null, ApplicationKeyManagerFactory.DEFAULT_PASSWORD.toCharArray());
-		ApplicationKeyManagerUtils.exportX509Certificates(caEntry.getCertificateChain(), caFile);
+		PrivateKeyEntry caEntry = PKIUtils.createKeyEntry("test-CA", TEST_PKI_CA_DN, 2, null, null,
+			"PKCS12", null, DefaultKeyManagerFactory.DEFAULT_PASSWORD.toCharArray());
+		PKIUtils.exportX509Certificates(caEntry.getCertificateChain(), caFile);
 
 		// Generate User/Client certificate and keystore
 		Msg.info(ServerTestUtil.class, "Generating test user key/cert (signed by test-CA, pwd: " +
 			TEST_PKI_USER_PASSPHRASE + "): " + userKeystorePath);
-		ApplicationKeyManagerUtils.createKeyEntry("test-sig", TEST_PKI_USER_DN, 2, caEntry,
-			userKeystoreFile, "PKCS12", null, TEST_PKI_USER_PASSPHRASE.toCharArray());
+		PKIUtils.createKeyEntry("test-sig", TEST_PKI_USER_DN, 2, caEntry, userKeystoreFile,
+			"PKCS12", null, TEST_PKI_USER_PASSPHRASE.toCharArray());
 
 		// Generate Server certificate and keystore
 		Msg.info(ServerTestUtil.class, "Generating test server key/cert (signed by test-CA, pwd: " +
 			TEST_PKI_SERVER_PASSPHRASE + "): " + serverKeystorePath);
 
-		ApplicationKeyManagerUtils.createKeyEntry("test-sig", TEST_PKI_SERVER_DN, 2, caEntry,
-			serverKeystoreFile, "PKCS12", null, TEST_PKI_SERVER_PASSPHRASE.toCharArray());
+		PKIUtils.createKeyEntry("test-sig", TEST_PKI_SERVER_DN, 2, caEntry, serverKeystoreFile,
+			"PKCS12", null, TEST_PKI_SERVER_PASSPHRASE.toCharArray());
 	}
 
 	/**

@@ -0,0 +1,275 @@
+# Developer's Guide: Getting Started
+
+Install OpenJDK 11 and make sure it's the default java.
+
+Install Eclipse, at least version 2018-12, and ensure it is launched using OpenJDK 11.
+Technically, you can launch with any JRE/JDK, but it's up to you ensure OpenJDK 11 is properly configured in Eclipse.
+
+Optionally install Gradle 5.0, and ensure it is launched using OpenJDK 11.
+These instructions assume you are using the gradle wrapper, so adjust the commands accordingly if you choose to use your own Gradle installation.
+
+## Setup Repositories
+
+Of course, you may choose any directory for your working copy, but these instructions will assume you have cloned the repo to `~/git`.
+Be sure to adjust the commands to match your chosen working directory if different than suggested:
+
+```bash
+cd ~/git
+git clone git@github.com:NationalSecurityAgency/ghidra.git
+```
+
+Ghidra's build uses artifact named as available in Maven Central and Bintray JCenter, when possible.
+Unfortunately, in some cases, the artifact or the particular version we desire is not available.
+So, in addition to mavenCentral and jcenter, you must configure a flatDir-style repository for manually-downloaded dependencies.
+
+Create `~/.gradle/init.d/repos.gradle` with the following contents:
+
+```groovy
+ext.HOME = System.getProperty('user.home')
+
+allprojects {
+    repositories {
+        mavenCentral()
+        jcenter()
+        flatDir name:'flat', dirs:["$HOME/flatRepo"]
+    }
+}
+```
+
+You should also create the `~/flatRepo` folder to hold the manually-downloaded dependencies:
+
+```bash
+mkdir ~/flatRepo
+```
+
+If you prefer not to modify your user-wide Gradle configuration, you may use
+Gradle's other init script facilities, but you're on your own.
+
+## Get Dependencies for FileFormats:
+
+Download `dex-tools-2.0.zip` from the dex2jar project's releases page on GitHub.
+Unpack the `dex-*.jar` files from the `lib` directory to `~/flatRepo`:
+
+```bash
+cd ~/Downloads   # Or wherever
+curl -OL https://github.com/pxb1988/dex2jar/releases/download/2.0/dex-tools-2.0.zip
+unzip dex-tools-2.0.zip
+cp dex2jar-2.0/lib/dex-*.jar ~/flatRepo/
+
+```
+
+Download `AXMLPrinter2.jar` from the "android4me" archive on code.google.com.
+Place it in `~/flatRepo`:
+
+```bash
+cd ~/flatRepo
+curl -OL https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/android4me/AXMLPrinter2.jar
+```
+
+## Get Dependencies for DMG:
+
+Download `hfsexplorer-0_21-bin.zip` from www.catacombae.org.
+Unpack the `lib` directory to `~/flatRepo.`:
+
+```bash
+cd ~/Downloads   # Or wherever
+curl -OL https://sourceforge.net/projects/catacombae/files/HFSExplorer/0.21/hfsexplorer-0_21-bin.zip
+mkdir hfsx
+cd hfsx
+unzip ../hfsexplorer-0_21-bin.zip
+cd lib
+cp csframework.jar hfsx_dmglib.jar hfsx.jar iharder-base64.jar ~/flatRepo/
+```
+
+## Import Gradle Project
+
+At this point, you may import Ghidra into Eclipse using the integrated BuildShip plugin.
+If you prefer another IDE, there's no reason it shouldn't work, but you're on your own.
+Note that the GhidraDevPlugin requires Eclipse PDE.
+Close this project to clean up the errors, unless you are developing the GhidraDevPlugin.
+You may see build path errors until the environment is properly prepared, as described below.
+
+## Prepare the Environment
+
+There are a few preparatory tasks you should execute before, or immediately after, importing the project.
+These tasks will build and index the online help, and place it somewhere accessible to Ghidra when launched from Eclipse, among other things.
+This task also attempts to unpack some SDKs and/or larger dependencies required by Ghidra.
+We do not provide these packages out-of-the-box because of technical and legal constraints on our distributing them.
+These include the Eclipse CDT, PyDev for Eclipse, and "Yet another Java service wrapper."
+If you would like to build the dependent modules, please see the relevant sections below.
+For now, we will exclude the affected unpack tasks.
+From the project root, execute:
+
+```bash
+./gradlew prepDev -x yajswDevUnpack
+```
+
+Optionally, to pre-compile all the language modules, you may also execute:
+
+```bash
+./gradlew sleighCompile
+```
+
+Refresh the Gradle project in Eclipse.
+You should not see any errors at this point, and you can accomplish many development tasks.
+However, some features of Ghidra will not be functional until further steps are taken.
+
+### Building the natives
+
+Some of Ghidra's components are built for the native platform.
+We currently support Linux, macOS, and Windows 64-bit x86 systems.
+Others should be possible, but we do not support them.
+
+#### decompile
+
+Install bison and flex.
+Now build using Gradle:
+
+On Linux:
+
+```bash
+./gradlew decompileLinux64Executable
+```
+On macOS:
+
+```bash
+./gradlew decompileOsx64Executable
+```
+
+On Windows:
+
+```cmd
+gradlew decompileWin64Executable
+```
+
+#### demangler_gnu
+
+Build using Gradle:
+
+On Linux:
+
+```bash
+./gradlew demangler_gnuLinux64Executable
+```
+On macOS:
+
+```bash
+./gradlew demangler_gnuOsx64Executable
+```
+
+On Windows:
+
+```cmd
+gradlew demangler_gnuWin64Executable
+```
+
+#### sleigh
+
+The sleigh compiler has been ported to Java, and Ghidra will automatically compile slaspec files that it finds are out of date.
+The native sleigh compiler may still be useful for those who'd like quicker feedback by compiling from the command line. To build the native sleigh compiler, install bison and flex.
+Now, use Gradle:
+
+On Linux:
+
+```bash
+./gradlew sleighLinux64Executable
+```
+On macOS:
+
+```bash
+./gradlew sleighOsx64Executable
+```
+
+On Windows:
+
+```cmd
+gradlew sleighWin64Executable
+```
+
+### Get Dependencies for GhidraDev
+
+Building the GhidraDev plugin for Eclipse requires the CDT and PyDev plugins for Eclipse.
+Download `cdt-8.6.0.zip` from The Eclipse Foundation, and place it in a directory named:
+`ghidra.bin/GhidraBuild/EclipsePlugins/GhidraDev/buildDependencies/`.
+`ghidra.bin` must be a sibling of `ghidra`.
+To respect the CDT project's resources, you will need to download the file using a browser, or at the very least, locate a suitable mirror on your own:
+
+```bash
+cd ~/Downloads   # Or wherever
+curl -OL http://$CHOOSE_YOUR_MIRROR/pub/eclipse/tools/cdt/releases/8.6/cdt-8.6.0.zip
+mkdir -p ~/git/ghidra.bin/GhidraBuild/EclipsePlugins/GhidraDev/buildDependencies/
+cp ~/Downloads/cdt-8.6.0.zip ~/git/ghidra.bin/GhidraBuild/EclipsePlugins/GhidraDev/buildDependencies/
+```
+
+Download `PyDev 6.3.1.zip` from www.pydev.org, and place it in the same directory:
+
+```bash
+cd ~/Downloads   # Or wherever
+curl -OL https://sourceforge.net/projects/pydev/files/pydev/PyDev%206.3.1/PyDev%206.3.1.zip
+cp ~/Downloads/'PyDev 6.3.1.zip' ~/git/ghidra.bin/GhidraBuild/EclipsePlugins/GhidraDev/buildDependencies/
+```
+
+Use Gradle to unpack the dependencies for development and building.
+First, you will need to uncomment the GhidraDev project in the ```settings.gradle``` file.
+Then, from your clone:
+
+```bash
+./gradlew cdtUnpack pyDevUnpack
+```
+
+### Get Dependencies for GhidraServer
+
+Building the GhidraServer requires "Yet another Java service wrapper" (yajsw) version 12.12.
+Note that building the full Ghidra package requires building the GhidraServer.
+Download `yajsw-stable-12.12.zip` from their project on www.sourceforge.net, and place it in a directory named:
+`ghidra.bin/Ghidra/Features/GhidraSerer/`:
+
+```bash
+cd ~/Downloads   # Or wherever
+curl -OL https://sourceforge.net/projects/yajsw/files/yajsw/yajsw-stable-12.12/yajsw-stable-12.12.zip
+mkdir -p ~/git/ghidra.bin/Ghidra/Features/GhidraServer/
+cp ~/Downloads/yajsw-stable-12.12.zip ~/git/ghidra.bin/Ghidra/Features/GhidraServer/
+```
+
+Use Gradle to unpack the wrapper for development.
+From your clone:
+
+```bash
+./gradlew yajswDevUnpack
+```
+
+# Build the full Ghidra package
+
+If you've followed all of the steps above, except perhaps importing to Eclipse, you should be able to produce a build.
+Before building, you may want to update the version and release name.
+These properties are kept in `Ghidra/application.properties`.
+
+If you want it included, you must also build the GhidraDevPlugin module first.
+We do not yet have instructions for building the GhidraDevPlugin.
+It should be relatively straightforward for anyone familiar with Eclipse PDE.
+
+To build the full package, use Gradle:
+
+```bash
+./gradlew buildGhidra
+```
+
+The output will be placed in `build/dist/`.
+It will be named according to the version, release name, build date, and platform.
+To test it, unzip it where you like, and execute `./ghidraRun`.
+
+# Building Supporting Data
+
+Some features of Ghidra require the curation of rather extensive data bases.
+These include the Data Type Archives and Function ID Databases, both of which require collecting header files and libraries for the relevant SDKs and platforms.
+Much of this work is done by hand, and the results are simply copied into the build.
+We intend to document these procedures as soon as we can.
+In the meantime, those artifacts can always be extracted from our binary release.
+
+## Building Data Type Archives
+
+TODO
+
+## Building FID Databases
+
+TODO

@@ -0,0 +1,56 @@
+# Set the default behavior, in case people don't have core.autocrlf set.
+* text=auto
+
+# Explicitly declare text files you want to always be normalized and converted
+# to native line endings on checkout.
+*.java text
+*.gradle text
+*.manifest text
+*.css text
+*.htm text
+*.html text
+*.js text
+*.json text
+*.jsp text
+*.jspf text
+*.jspx text
+*.properties text
+*.sh text
+*.tld text
+*.txt text
+*.tag text
+*.xml text
+*.c text
+*.h text
+*.cpp text
+*.hh text
+*.cc text
+
+# Declare files that will always have CRLF line endings on checkout.
+*.sln text eol=crlf
+*.vcproj text eol=crlf
+*.vcxproj text eol=crlf
+*.bat text eol=crlf
+
+# Denote all files that are truly binary and should not be modified.
+*.png binary
+*.jpg binary
+*.class binary
+*.dll binary
+*.ear binary
+*.gif binary
+*.ico binary
+*.jar binary
+*.jpeg binary
+*.so binary
+*.war binary
+*.pdf binary
+*.exe binary
+*.lib binary
+*.sa binary
+*.gz binary
+*.gzf binary
+*.tgz binary
+*.tar binary
+
+

@@ -1,14 +1,63 @@
-.gradle
+*.class
+Thumbs.db
+.DS_Store
+.svn
+excludedFiles.txt
+.classpath
+.project
+ghidra.repos.config
+
+/*/*/*/*/*/bin/
+/*/*/*/*/*/build/
+/*/*/*/*/bin/
+/*/*/*/*/build/
+/*/*/*/bin/
+/*/*/*/build/
+/*/*/bin/
+/*/*/build/
+/*/bin/
+/*/build/
 /build/
+/bin/
+
+**/dist
+repositories/
+*.sla
+
+# Misc files
+*.setting
+*.settings
+*.directory
+.gradle/
+.settings/
+
+# File locks
+*.ulock
+*.lock
+
+# Gradle creates these per developer
+**/vs/
+
+# Misc files produced while executing application
+Ghidra/.ghidraSvrKeys
+wrapper.log*
 
-# Ignore Gradle GUI config
-gradle-app.setting
+# Ignore object files
+*.o
+*.obj
 
-# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
-!gradle-wrapper.jar
+# Ignore MS Visual Studio artifcats
+Release
+#Debug
+*.ncb
+*.suo
+*.aps
+*.vcproj.*
 
-# Cache of project
-.gradletasknamecache
+# Ignore UNIX backup files
+*~
+*.swp
 
-# # Work around https://youtrack.jetbrains.com/issue/IDEA-116898
-# gradle/wrapper/gradle-wrapper.properties
+# Ignore eclipse project files
+.project
+.classpath

@@ -0,0 +1,69 @@
+apply plugin: 'eclipse'
+eclipse.project.name = 'GPL CabExtract'
+
+project.ext.cabextract = "cabextract-1.6"
+
+
+/*********************************************************************************
+ * CabExtract extraction task
+ *
+ * Unpacks the cabextract tar file that's needed for the symbol server.  This
+ * is only unpacked for building the tool; once it's built, this unzipped 
+ * archive is removed.
+ *
+ * NOTE: Ant is used so that timestamps are properly preserved, failure to 
+ * do so can cause the aclocal utility to be required which may be missing!
+ *********************************************************************************/
+ task unpackCabExtract (type: Copy) {
+ 
+ 	doFirst {
+ 		delete file("build/${cabextract}")
+ 	}
+ 	
+ 	doLast {
+ 		// Force all unpacked files to have the same timestamp
+ 		ant.touch() {
+ 			fileset(dir: file("build/${cabextract}"))
+	    }
+ 	}
+ 	
+	from tarTree(file("data/${cabextract}.tar.gz"))
+	into 'build'
+	
+	// Force the task to be executed every time by setting to false.
+	// This is done since configure changes the contents for a platform
+	outputs.upToDateWhen { false }
+ }
+
+/*********************************************************************************
+ * CabExtract platform specific tasks
+ *
+ * The cabextract tool requires that its 'configure' script is called before make.
+ *********************************************************************************/
+['linux64', 'osx64'].each { platform ->
+		
+	def configureName = "${platform}CabExtractConfigure"
+	def makeName = "${platform}CabExtractMake" // native Make task found automatically
+	
+	task (configureName, type: Exec) {
+		group "private"
+		workingDir "build/${cabextract}"
+		executable "./configure"
+		dependsOn unpackCabExtract
+	}
+	
+	task (makeName, type: Exec) {
+		group "private"
+		workingDir "build/${cabextract}"
+		executable "make"
+		dependsOn configureName
+		doLast {
+			copy {
+				from "build/${cabextract}/cabextract"
+				into "build/os/${platform}"
+			}
+		}
+	}
+}
+
+

@@ -0,0 +1,8 @@
+##VERSION: 2.0
+##MODULE IP: GPL 3
+##MODULE IP: Public Domain
+.classpath||Public Domain||||END|
+.project||Public Domain||||END|
+Module.manifest||Public Domain||||END|
+build.gradle||Public Domain||||END|
+data/cabextract-1.6.tar.gz||GPL 3||||END|

@@ -0,0 +1,2 @@
+MODULE FILE LICENSE: os/linux64/cabextract GPL 3
+MODULE FILE LICENSE: os/osx64/cabextract GPL 3

@@ -0,0 +1,109 @@
+apply plugin: 'eclipse'
+eclipse.project.name = 'GPL DemanglerGnu'
+
+apply from: "../nativeBuildProperties.gradle"
+
+
+/****************************************************************************
+ * Defines the platforms we have to support in Ghidra.  This model is used 
+ * for all native builds and should be extended by each module as-needed.
+ ****************************************************************************/
+model {
+
+	// define the platforms that we support in ghidra
+	platforms {
+		win64 {
+			architecture 'x86_64'
+			operatingSystem 'windows'
+		}
+		linux64 {
+			architecture 'x86_64'
+			operatingSystem 'linux'
+		}
+		osx64 {
+			architecture 'x86_64'
+			operatingSystem 'osx'
+		}
+	}	
+}
+
+
+/**
+ * This project has some native 'c' code we need to include in the zip for licensing 
+ * and build reasons. So include them here, but we have to do something special: the 
+ * source is divided up into folders for makefiles, headers and .c files:
+ * 		/headers
+ * 		/c
+ * 		/build
+ *
+ * The contents of all these need to be merged into the same folder for distribution.  
+ * Hence the following 3 'from' clauses:
+ */
+task zipBuildableSource(type:Zip) {
+
+	group 'private'
+	description "Collects the source files needed to build this module."
+	baseName project.name + "-src-for-build"
+	extension 'zip'
+			
+	from (project.projectDir.toString() + "/src/demangler_gnu/c") {
+		into "/src/demangler_gnu"
+	}
+	from (project.projectDir.toString() + "/src/demangler_gnu/headers") {
+		into "/src/demangler_gnu"
+	}
+	from (project.projectDir.toString() + "/src/demangler_gnu/build") {
+		into "/src/demangler_gnu"
+	}
+	from (project.projectDir.toString() + "/src/demangler_gnu/README.txt")
+}
+
+model {
+	components {
+		demangler_gnu(NativeExecutableSpec) {
+			targetPlatform "win64"
+			targetPlatform "linux64"
+			targetPlatform "osx64"
+			sources {
+				c {
+					source {
+						srcDir "src/demangler_gnu/c"
+					}
+					exportedHeaders {
+						srcDir "src/demangler_gnu/headers"
+					}
+				}
+			}
+			
+		}
+	}
+}
+
+model {
+	binaries {
+		all{ b ->
+			if (toolChain in Gcc) {
+				cCompiler.args "-DMAIN_CPLUS_DEM"
+				cCompiler.args "-DHAVE_STDLIB_H"
+				cCompiler.args "-DHAVE_STRING_H"
+				if (targetPlatform.operatingSystem.linux) {
+//					linker.args "-static"
+				}
+			}
+			else if (toolChain in VisualCpp) {
+				cCompiler.args "/D_CONSOLE"
+				cCompiler.args "/DMAIN_CPLUS_DEM"
+				cCompiler.args "-DHAVE_STDLIB_H"
+				cCompiler.args "-DHAVE_STRING_H"
+			}
+			else if (toolChain in Clang) {
+				cCompiler.args "-DMAIN_CPLUS_DEM"
+				cCompiler.args "-DHAVE_STDLIB_H"
+				cCompiler.args "-DHAVE_STRING_H"
+				if (targetPlatform.operatingSystem.linux) {
+//					linker.args "-static"
+				}
+			}
+		}
+	}
+}

@@ -0,0 +1,11 @@
+##VERSION: 2.0
+##MODULE IP: GPL 3
+##MODULE IP: GPL 3 Linking Permitted
+##MODULE IP: LGPL 2.1
+##MODULE IP: LGPL 3.0
+##MODULE IP: Public Domain
+.classpath||GHIDRA||||END|
+.project||Public Domain||||END|
+Module.manifest||Public Domain||||END|
+build.gradle||Public Domain||||END|
+src/demangler_gnu/README.txt||Public Domain||||END|

@@ -0,0 +1,3 @@
+MODULE FILE LICENSE: os/linux64/demangler_gnu GPL 3
+MODULE FILE LICENSE: os/osx64/demangler_gnu GPL 3
+MODULE FILE LICENSE: os/win64/demangler_gnu.exe GPL 3
\ No newline at end of file

@@ -0,0 +1,488 @@
+/* ###
+ * IP: LGPL 2.1
+ * REVIEWED: YES
+ * NOTE: license is not in file, but in the directory from whence it came: binutils-2.24/libiberty/COPYING.LIB
+ */
+/* alloca.c -- allocate automatically reclaimed memory
+   (Mostly) portable public-domain implementation -- D A Gwyn
+
+   This implementation of the PWB library alloca function,
+   which is used to allocate space off the run-time stack so
+   that it is automatically reclaimed upon procedure exit,
+   was inspired by discussions with J. Q. Johnson of Cornell.
+   J.Otto Tennant <jot@cray.com> contributed the Cray support.
+
+   There are some preprocessor constants that can
+   be defined when compiling for your specific system, for
+   improved efficiency; however, the defaults should be okay.
+
+   The general concept of this implementation is to keep
+   track of all alloca-allocated blocks, and reclaim any
+   that are found to be deeper in the stack than the current
+   invocation.  This heuristic does not reclaim storage as
+   soon as it becomes invalid, but it will do so eventually.
+
+   As a special case, alloca(0) reclaims storage without
+   allocating any.  It is a good idea to use alloca(0) in
+   your main control loop, etc. to force garbage collection.  */
+
+/*
+
+@deftypefn Replacement void* alloca (size_t @var{size})
+
+This function allocates memory which will be automatically reclaimed
+after the procedure exits.  The @libib{} implementation does not free
+the memory immediately but will do so eventually during subsequent
+calls to this function.  Memory is allocated using @code{xmalloc} under
+normal circumstances.
+
+The header file @file{alloca-conf.h} can be used in conjunction with the
+GNU Autoconf test @code{AC_FUNC_ALLOCA} to test for and properly make
+available this function.  The @code{AC_FUNC_ALLOCA} test requires that
+client code use a block of preprocessor code to be safe (see the Autoconf
+manual for more); this header incorporates that logic and more, including
+the possibility of a GCC built-in function.
+
+@end deftypefn
+
+*/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <libiberty.h>
+
+#ifdef HAVE_STRING_H
+#include <string.h>
+#endif
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+
+/* These variables are used by the ASTRDUP implementation that relies
+   on C_alloca.  */
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+const char *libiberty_optr;
+char *libiberty_nptr;
+unsigned long libiberty_len;
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+/* If your stack is a linked list of frames, you have to
+   provide an "address metric" ADDRESS_FUNCTION macro.  */
+
+#if defined (CRAY) && defined (CRAY_STACKSEG_END)
+static long i00afunc ();
+#define ADDRESS_FUNCTION(arg) (char *) i00afunc (&(arg))
+#else
+#define ADDRESS_FUNCTION(arg) &(arg)
+#endif
+
+#ifndef NULL
+#define	NULL	0
+#endif
+
+/* Define STACK_DIRECTION if you know the direction of stack
+   growth for your system; otherwise it will be automatically
+   deduced at run-time.
+
+   STACK_DIRECTION > 0 => grows toward higher addresses
+   STACK_DIRECTION < 0 => grows toward lower addresses
+   STACK_DIRECTION = 0 => direction of growth unknown  */
+
+#ifndef STACK_DIRECTION
+#define	STACK_DIRECTION	0	/* Direction unknown.  */
+#endif
+
+#if STACK_DIRECTION != 0
+
+#define	STACK_DIR	STACK_DIRECTION	/* Known at compile-time.  */
+
+#else /* STACK_DIRECTION == 0; need run-time code.  */
+
+static int stack_dir;		/* 1 or -1 once known.  */
+#define	STACK_DIR	stack_dir
+
+static void
+find_stack_direction (void)
+{
+  static char *addr = NULL;	/* Address of first `dummy', once known.  */
+  auto char dummy;		/* To get stack address.  */
+
+  if (addr == NULL)
+    {				/* Initial entry.  */
+      addr = ADDRESS_FUNCTION (dummy);
+
+      find_stack_direction ();	/* Recurse once.  */
+    }
+  else
+    {
+      /* Second entry.  */
+      if (ADDRESS_FUNCTION (dummy) > addr)
+	stack_dir = 1;		/* Stack grew upward.  */
+      else
+	stack_dir = -1;		/* Stack grew downward.  */
+    }
+}
+
+#endif /* STACK_DIRECTION == 0 */
+
+/* An "alloca header" is used to:
+   (a) chain together all alloca'ed blocks;
+   (b) keep track of stack depth.
+
+   It is very important that sizeof(header) agree with malloc
+   alignment chunk size.  The following default should work okay.  */
+
+#ifndef	ALIGN_SIZE
+#define	ALIGN_SIZE	sizeof(double)
+#endif
+
+typedef union hdr
+{
+  char align[ALIGN_SIZE];	/* To force sizeof(header).  */
+  struct
+    {
+      union hdr *next;		/* For chaining headers.  */
+      char *deep;		/* For stack depth measure.  */
+    } h;
+} header;
+
+static header *last_alloca_header = NULL;	/* -> last alloca header.  */
+
+/* Return a pointer to at least SIZE bytes of storage,
+   which will be automatically reclaimed upon exit from
+   the procedure that called alloca.  Originally, this space
+   was supposed to be taken from the current stack frame of the
+   caller, but that method cannot be made to work for some
+   implementations of C, for example under Gould's UTX/32.  */
+
+/* @undocumented C_alloca */
+
+PTR
+C_alloca (size_t size)
+{
+  auto char probe;		/* Probes stack depth: */
+  register char *depth = ADDRESS_FUNCTION (probe);
+
+#if STACK_DIRECTION == 0
+  if (STACK_DIR == 0)		/* Unknown growth direction.  */
+    find_stack_direction ();
+#endif
+
+  /* Reclaim garbage, defined as all alloca'd storage that
+     was allocated from deeper in the stack than currently.  */
+
+  {
+    register header *hp;	/* Traverses linked list.  */
+
+    for (hp = last_alloca_header; hp != NULL;)
+      if ((STACK_DIR > 0 && hp->h.deep > depth)
+	  || (STACK_DIR < 0 && hp->h.deep < depth))
+	{
+	  register header *np = hp->h.next;
+
+	  free ((PTR) hp);	/* Collect garbage.  */
+
+	  hp = np;		/* -> next header.  */
+	}
+      else
+	break;			/* Rest are not deeper.  */
+
+    last_alloca_header = hp;	/* -> last valid storage.  */
+  }
+
+  if (size == 0)
+    return NULL;		/* No allocation required.  */
+
+  /* Allocate combined header + user data storage.  */
+
+  {
+    register void *new_storage = XNEWVEC (char, sizeof (header) + size);
+    /* Address of header.  */
+
+    if (new_storage == 0)
+      abort();
+
+    ((header *) new_storage)->h.next = last_alloca_header;
+    ((header *) new_storage)->h.deep = depth;
+
+    last_alloca_header = (header *) new_storage;
+
+    /* User storage begins just after header.  */
+
+    return (PTR) ((char *) new_storage + sizeof (header));
+  }
+}
+
+#if defined (CRAY) && defined (CRAY_STACKSEG_END)
+
+#ifdef DEBUG_I00AFUNC
+#include <stdio.h>
+#endif
+
+#ifndef CRAY_STACK
+#define CRAY_STACK
+#ifndef CRAY2
+/* Stack structures for CRAY-1, CRAY X-MP, and CRAY Y-MP */
+struct stack_control_header
+  {
+    long shgrow:32;		/* Number of times stack has grown.  */
+    long shaseg:32;		/* Size of increments to stack.  */
+    long shhwm:32;		/* High water mark of stack.  */
+    long shsize:32;		/* Current size of stack (all segments).  */
+  };
+
+/* The stack segment linkage control information occurs at
+   the high-address end of a stack segment.  (The stack
+   grows from low addresses to high addresses.)  The initial
+   part of the stack segment linkage control information is
+   0200 (octal) words.  This provides for register storage
+   for the routine which overflows the stack.  */
+
+struct stack_segment_linkage
+  {
+    long ss[0200];		/* 0200 overflow words.  */
+    long sssize:32;		/* Number of words in this segment.  */
+    long ssbase:32;		/* Offset to stack base.  */
+    long:32;
+    long sspseg:32;		/* Offset to linkage control of previous
+				   segment of stack.  */
+    long:32;
+    long sstcpt:32;		/* Pointer to task common address block.  */
+    long sscsnm;		/* Private control structure number for
+				   microtasking.  */
+    long ssusr1;		/* Reserved for user.  */
+    long ssusr2;		/* Reserved for user.  */
+    long sstpid;		/* Process ID for pid based multi-tasking.  */
+    long ssgvup;		/* Pointer to multitasking thread giveup.  */
+    long sscray[7];		/* Reserved for Cray Research.  */
+    long ssa0;
+    long ssa1;
+    long ssa2;
+    long ssa3;
+    long ssa4;
+    long ssa5;
+    long ssa6;
+    long ssa7;
+    long sss0;
+    long sss1;
+    long sss2;
+    long sss3;
+    long sss4;
+    long sss5;
+    long sss6;
+    long sss7;
+  };
+
+#else /* CRAY2 */
+/* The following structure defines the vector of words
+   returned by the STKSTAT library routine.  */
+struct stk_stat
+  {
+    long now;			/* Current total stack size.  */
+    long maxc;			/* Amount of contiguous space which would
+				   be required to satisfy the maximum
+				   stack demand to date.  */
+    long high_water;		/* Stack high-water mark.  */
+    long overflows;		/* Number of stack overflow ($STKOFEN) calls.  */
+    long hits;			/* Number of internal buffer hits.  */
+    long extends;		/* Number of block extensions.  */
+    long stko_mallocs;		/* Block allocations by $STKOFEN.  */
+    long underflows;		/* Number of stack underflow calls ($STKRETN).  */
+    long stko_free;		/* Number of deallocations by $STKRETN.  */
+    long stkm_free;		/* Number of deallocations by $STKMRET.  */
+    long segments;		/* Current number of stack segments.  */
+    long maxs;			/* Maximum number of stack segments so far.  */
+    long pad_size;		/* Stack pad size.  */
+    long current_address;	/* Current stack segment address.  */
+    long current_size;		/* Current stack segment size.  This
+				   number is actually corrupted by STKSTAT to
+				   include the fifteen word trailer area.  */
+    long initial_address;	/* Address of initial segment.  */
+    long initial_size;		/* Size of initial segment.  */
+  };
+
+/* The following structure describes the data structure which trails
+   any stack segment.  I think that the description in 'asdef' is
+   out of date.  I only describe the parts that I am sure about.  */
+
+struct stk_trailer
+  {
+    long this_address;		/* Address of this block.  */
+    long this_size;		/* Size of this block (does not include
+				   this trailer).  */
+    long unknown2;
+    long unknown3;
+    long link;			/* Address of trailer block of previous
+				   segment.  */
+    long unknown5;
+    long unknown6;
+    long unknown7;
+    long unknown8;
+    long unknown9;
+    long unknown10;
+    long unknown11;
+    long unknown12;
+    long unknown13;
+    long unknown14;
+  };
+
+#endif /* CRAY2 */
+#endif /* not CRAY_STACK */
+
+#ifdef CRAY2
+/* Determine a "stack measure" for an arbitrary ADDRESS.
+   I doubt that "lint" will like this much.  */
+
+static long
+i00afunc (long *address)
+{
+  struct stk_stat status;
+  struct stk_trailer *trailer;
+  long *block, size;
+  long result = 0;
+
+  /* We want to iterate through all of the segments.  The first
+     step is to get the stack status structure.  We could do this
+     more quickly and more directly, perhaps, by referencing the
+     $LM00 common block, but I know that this works.  */
+
+  STKSTAT (&status);
+
+  /* Set up the iteration.  */
+
+  trailer = (struct stk_trailer *) (status.current_address
+				    + status.current_size
+				    - 15);
+
+  /* There must be at least one stack segment.  Therefore it is
+     a fatal error if "trailer" is null.  */
+
+  if (trailer == 0)
+    abort ();
+
+  /* Discard segments that do not contain our argument address.  */
+
+  while (trailer != 0)
+    {
+      block = (long *) trailer->this_address;
+      size = trailer->this_size;
+      if (block == 0 || size == 0)
+	abort ();
+      trailer = (struct stk_trailer *) trailer->link;
+      if ((block <= address) && (address < (block + size)))
+	break;
+    }
+
+  /* Set the result to the offset in this segment and add the sizes
+     of all predecessor segments.  */
+
+  result = address - block;
+
+  if (trailer == 0)
+    {
+      return result;
+    }
+
+  do
+    {
+      if (trailer->this_size <= 0)
+	abort ();
+      result += trailer->this_size;
+      trailer = (struct stk_trailer *) trailer->link;
+    }
+  while (trailer != 0);
+
+  /* We are done.  Note that if you present a bogus address (one
+     not in any segment), you will get a different number back, formed
+     from subtracting the address of the first block.  This is probably
+     not what you want.  */
+
+  return (result);
+}
+
+#else /* not CRAY2 */
+/* Stack address function for a CRAY-1, CRAY X-MP, or CRAY Y-MP.
+   Determine the number of the cell within the stack,
+   given the address of the cell.  The purpose of this
+   routine is to linearize, in some sense, stack addresses
+   for alloca.  */
+
+static long
+i00afunc (long address)
+{
+  long stkl = 0;
+
+  long size, pseg, this_segment, stack;
+  long result = 0;
+
+  struct stack_segment_linkage *ssptr;
+
+  /* Register B67 contains the address of the end of the
+     current stack segment.  If you (as a subprogram) store
+     your registers on the stack and find that you are past
+     the contents of B67, you have overflowed the segment.
+
+     B67 also points to the stack segment linkage control
+     area, which is what we are really interested in.  */
+
+  stkl = CRAY_STACKSEG_END ();
+  ssptr = (struct stack_segment_linkage *) stkl;
+
+  /* If one subtracts 'size' from the end of the segment,
+     one has the address of the first word of the segment.
+
+     If this is not the first segment, 'pseg' will be
+     nonzero.  */
+
+  pseg = ssptr->sspseg;
+  size = ssptr->sssize;
+
+  this_segment = stkl - size;
+
+  /* It is possible that calling this routine itself caused
+     a stack overflow.  Discard stack segments which do not
+     contain the target address.  */
+
+  while (!(this_segment <= address && address <= stkl))
+    {
+#ifdef DEBUG_I00AFUNC
+      fprintf (stderr, "%011o %011o %011o\n", this_segment, address, stkl);
+#endif
+      if (pseg == 0)
+	break;
+      stkl = stkl - pseg;
+      ssptr = (struct stack_segment_linkage *) stkl;
+      size = ssptr->sssize;
+      pseg = ssptr->sspseg;
+      this_segment = stkl - size;
+    }
+
+  result = address - this_segment;
+
+  /* If you subtract pseg from the current end of the stack,
+     you get the address of the previous stack segment's end.
+     This seems a little convoluted to me, but I'll bet you save
+     a cycle somewhere.  */
+
+  while (pseg != 0)
+    {
+#ifdef DEBUG_I00AFUNC
+      fprintf (stderr, "%011o %011o\n", pseg, size);
+#endif
+      stkl = stkl - pseg;
+      ssptr = (struct stack_segment_linkage *) stkl;
+      size = ssptr->sssize;
+      pseg = ssptr->sspseg;
+      result += size;
+    }
+  return (result);
+}
+
+#endif /* not CRAY2 */
+#endif /* CRAY */

@@ -0,0 +1,545 @@
+/* ###
+ * IP: LGPL 2.1
+ * REVIEWED: YES
+ * NOTE: from binutils 2.24
+ */
+/* Create and destroy argument vectors (argv's)
+   Copyright (C) 1992, 2001, 2010, 2012 Free Software Foundation, Inc.
+   Written by Fred Fish @ Cygnus Support
+
+This file is part of the libiberty library.
+Libiberty is free software; you can redistribute it and/or
+modify it under the terms of the GNU Library General Public
+License as published by the Free Software Foundation; either
+version 2 of the License, or (at your option) any later version.
+
+Libiberty is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Library General Public License for more details.
+
+You should have received a copy of the GNU Library General Public
+License along with libiberty; see the file COPYING.LIB.  If
+not, write to the Free Software Foundation, Inc., 51 Franklin Street - Fifth Floor,
+Boston, MA 02110-1301, USA.  */
+
+
+/*  Create and destroy argument vectors.  An argument vector is simply an
+    array of string pointers, terminated by a NULL pointer. */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+#include "ansidecl.h"
+#include "libiberty.h"
+#include "safe-ctype.h"
+
+/*  Routines imported from standard C runtime libraries. */
+
+#include <stddef.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#ifndef NULL
+#define NULL 0
+#endif
+
+#ifndef EOS
+#define EOS '\0'
+#endif
+
+#define INITIAL_MAXARGC 8	/* Number of args + NULL in initial argv */
+
+
+/*
+
+@deftypefn Extension char** dupargv (char **@var{vector})
+
+Duplicate an argument vector.  Simply scans through @var{vector},
+duplicating each argument until the terminating @code{NULL} is found.
+Returns a pointer to the argument vector if successful.  Returns
+@code{NULL} if there is insufficient memory to complete building the
+argument vector.
+
+@end deftypefn
+
+*/
+
+char **
+dupargv (char **argv)
+{
+  int argc;
+  char **copy;
+  
+  if (argv == NULL)
+    return NULL;
+  
+  /* the vector */
+  for (argc = 0; argv[argc] != NULL; argc++);
+  copy = (char **) xmalloc ((argc + 1) * sizeof (char *));
+
+  /* the strings */
+  for (argc = 0; argv[argc] != NULL; argc++)
+    {
+      int len = strlen (argv[argc]);
+      copy[argc] = (char *) xmalloc (len + 1);
+      strcpy (copy[argc], argv[argc]);
+    }
+  copy[argc] = NULL;
+  return copy;
+}
+
+/*
+
+@deftypefn Extension void freeargv (char **@var{vector})
+
+Free an argument vector that was built using @code{buildargv}.  Simply
+scans through @var{vector}, freeing the memory for each argument until
+the terminating @code{NULL} is found, and then frees @var{vector}
+itself.
+
+@end deftypefn
+
+*/
+
+void freeargv (char **vector)
+{
+  register char **scan;
+
+  if (vector != NULL)
+    {
+      for (scan = vector; *scan != NULL; scan++)
+	{
+	  free (*scan);
+	}
+      free (vector);
+    }
+}
+
+static void
+consume_whitespace (const char **input)
+{
+  while (ISSPACE (**input))
+    {
+      (*input)++;
+    }
+}
+
+static int
+only_whitespace (const char* input)
+{
+  while (*input != EOS && ISSPACE (*input))
+    input++;
+
+  return (*input == EOS);
+}
+
+/*
+
+@deftypefn Extension char** buildargv (char *@var{sp})
+
+Given a pointer to a string, parse the string extracting fields
+separated by whitespace and optionally enclosed within either single
+or double quotes (which are stripped off), and build a vector of
+pointers to copies of the string for each field.  The input string
+remains unchanged.  The last element of the vector is followed by a
+@code{NULL} element.
+
+All of the memory for the pointer array and copies of the string
+is obtained from @code{xmalloc}.  All of the memory can be returned to the
+system with the single function call @code{freeargv}, which takes the
+returned result of @code{buildargv}, as it's argument.
+
+Returns a pointer to the argument vector if successful.  Returns
+@code{NULL} if @var{sp} is @code{NULL} or if there is insufficient
+memory to complete building the argument vector.
+
+If the input is a null string (as opposed to a @code{NULL} pointer),
+then buildarg returns an argument vector that has one arg, a null
+string.
+
+@end deftypefn
+
+The memory for the argv array is dynamically expanded as necessary.
+
+In order to provide a working buffer for extracting arguments into,
+with appropriate stripping of quotes and translation of backslash
+sequences, we allocate a working buffer at least as long as the input
+string.  This ensures that we always have enough space in which to
+work, since the extracted arg is never larger than the input string.
+
+The argument vector is always kept terminated with a @code{NULL} arg
+pointer, so it can be passed to @code{freeargv} at any time, or
+returned, as appropriate.
+
+*/
+
+char **buildargv (const char *input)
+{
+  char *arg;
+  char *copybuf;
+  int squote = 0;
+  int dquote = 0;
+  int bsquote = 0;
+  int argc = 0;
+  int maxargc = 0;
+  char **argv = NULL;
+  char **nargv;
+
+  if (input != NULL)
+    {
+      copybuf = (char *) xmalloc (strlen (input) + 1);
+      /* Is a do{}while to always execute the loop once.  Always return an
+	 argv, even for null strings.  See NOTES above, test case below. */
+      do
+	{
+	  /* Pick off argv[argc] */
+	  consume_whitespace (&input);
+
+	  if ((maxargc == 0) || (argc >= (maxargc - 1)))
+	    {
+	      /* argv needs initialization, or expansion */
+	      if (argv == NULL)
+		{
+		  maxargc = INITIAL_MAXARGC;
+		  nargv = (char **) xmalloc (maxargc * sizeof (char *));
+		}
+	      else
+		{
+		  maxargc *= 2;
+		  nargv = (char **) xrealloc (argv, maxargc * sizeof (char *));
+		}
+	      argv = nargv;
+	      argv[argc] = NULL;
+	    }
+	  /* Begin scanning arg */
+	  arg = copybuf;
+	  while (*input != EOS)
+	    {
+	      if (ISSPACE (*input) && !squote && !dquote && !bsquote)
+		{
+		  break;
+		}
+	      else
+		{
+		  if (bsquote)
+		    {
+		      bsquote = 0;
+		      *arg++ = *input;
+		    }
+		  else if (*input == '\\')
+		    {
+		      bsquote = 1;
+		    }
+		  else if (squote)
+		    {
+		      if (*input == '\'')
+			{
+			  squote = 0;
+			}
+		      else
+			{
+			  *arg++ = *input;
+			}
+		    }
+		  else if (dquote)
+		    {
+		      if (*input == '"')
+			{
+			  dquote = 0;
+			}
+		      else
+			{
+			  *arg++ = *input;
+			}
+		    }
+		  else
+		    {
+		      if (*input == '\'')
+			{
+			  squote = 1;
+			}
+		      else if (*input == '"')
+			{
+			  dquote = 1;
+			}
+		      else
+			{
+			  *arg++ = *input;
+			}
+		    }
+		  input++;
+		}
+	    }
+	  *arg = EOS;
+	  argv[argc] = xstrdup (copybuf);
+	  argc++;
+	  argv[argc] = NULL;
+
+	  consume_whitespace (&input);
+	}
+      while (*input != EOS);
+
+      free (copybuf);
+    }
+  return (argv);
+}
+
+/*
+
+@deftypefn Extension int writeargv (const char **@var{argv}, FILE *@var{file})
+
+Write each member of ARGV, handling all necessary quoting, to the file
+named by FILE, separated by whitespace.  Return 0 on success, non-zero
+if an error occurred while writing to FILE.
+
+@end deftypefn
+
+*/
+
+int
+writeargv (char **argv, FILE *f)
+{
+  int status = 0;
+
+  if (f == NULL)
+    return 1;
+
+  while (*argv != NULL)
+    {
+      const char *arg = *argv;
+
+      while (*arg != EOS)
+        {
+          char c = *arg;
+
+          if (ISSPACE(c) || c == '\\' || c == '\'' || c == '"')
+            if (EOF == fputc ('\\', f))
+              {
+                status = 1;
+                goto done;
+              }
+
+          if (EOF == fputc (c, f))
+            {
+              status = 1;
+              goto done;
+            }
+          arg++;
+        }
+
+      if (EOF == fputc ('\n', f))
+        {
+          status = 1;
+          goto done;
+        }
+      argv++;
+    }
+
+ done:
+  return status;
+}
+
+/*
+
+@deftypefn Extension void expandargv (int *@var{argcp}, char ***@var{argvp})
+
+The @var{argcp} and @code{argvp} arguments are pointers to the usual
+@code{argc} and @code{argv} arguments to @code{main}.  This function
+looks for arguments that begin with the character @samp{@@}.  Any such
+arguments are interpreted as ``response files''.  The contents of the
+response file are interpreted as additional command line options.  In
+particular, the file is separated into whitespace-separated strings;
+each such string is taken as a command-line option.  The new options
+are inserted in place of the option naming the response file, and
+@code{*argcp} and @code{*argvp} will be updated.  If the value of
+@code{*argvp} is modified by this function, then the new value has
+been dynamically allocated and can be deallocated by the caller with
+@code{freeargv}.  However, most callers will simply call
+@code{expandargv} near the beginning of @code{main} and allow the
+operating system to free the memory when the program exits.
+
+@end deftypefn
+
+*/
+
+void
+expandargv (int *argcp, char ***argvp)
+{
+  /* The argument we are currently processing.  */
+  int i = 0;
+  /* Non-zero if ***argvp has been dynamically allocated.  */
+  int argv_dynamic = 0;
+  /* Limit the number of response files that we parse in order
+     to prevent infinite recursion.  */
+  unsigned int iteration_limit = 2000;
+  /* Loop over the arguments, handling response files.  We always skip
+     ARGVP[0], as that is the name of the program being run.  */
+  while (++i < *argcp)
+    {
+      /* The name of the response file.  */
+      const char *filename;
+      /* The response file.  */
+      FILE *f;
+      /* An upper bound on the number of characters in the response
+	 file.  */
+      long pos;
+      /* The number of characters in the response file, when actually
+	 read.  */
+      size_t len;
+      /* A dynamically allocated buffer used to hold options read from a
+	 response file.  */
+      char *buffer;
+      /* Dynamically allocated storage for the options read from the
+	 response file.  */
+      char **file_argv;
+      /* The number of options read from the response file, if any.  */
+      size_t file_argc;
+      /* We are only interested in options of the form "@file".  */
+      filename = (*argvp)[i];
+      if (filename[0] != '@')
+	continue;
+      /* If we have iterated too many times then stop.  */
+      if (-- iteration_limit == 0)
+	{
+	  fprintf (stderr, "%s: error: too many @-files encountered\n", (*argvp)[0]);
+	  xexit (1);
+	}
+      /* Read the contents of the file.  */
+      f = fopen (++filename, "r");
+      if (!f)
+	continue;
+      if (fseek (f, 0L, SEEK_END) == -1)
+	goto error;
+      pos = ftell (f);
+      if (pos == -1)
+	goto error;
+      if (fseek (f, 0L, SEEK_SET) == -1)
+	goto error;
+      buffer = (char *) xmalloc (pos * sizeof (char) + 1);
+      len = fread (buffer, sizeof (char), pos, f);
+      if (len != (size_t) pos
+	  /* On Windows, fread may return a value smaller than POS,
+	     due to CR/LF->CR translation when reading text files.
+	     That does not in-and-of itself indicate failure.  */
+	  && ferror (f))
+	goto error;
+      /* Add a NUL terminator.  */
+      buffer[len] = '\0';
+      /* If the file is empty or contains only whitespace, buildargv would
+	 return a single empty argument.  In this context we want no arguments,
+	 instead.  */
+      if (only_whitespace (buffer))
+	{
+	  file_argv = (char **) xmalloc (sizeof (char *));
+	  file_argv[0] = NULL;
+	}
+      else
+	/* Parse the string.  */
+	file_argv = buildargv (buffer);
+      /* If *ARGVP is not already dynamically allocated, copy it.  */
+      if (!argv_dynamic)
+	*argvp = dupargv (*argvp);
+      /* Count the number of arguments.  */
+      file_argc = 0;
+      while (file_argv[file_argc])
+	++file_argc;
+      /* Now, insert FILE_ARGV into ARGV.  The "+1" below handles the
+	 NULL terminator at the end of ARGV.  */ 
+      *argvp = ((char **) 
+		xrealloc (*argvp, 
+			  (*argcp + file_argc + 1) * sizeof (char *)));
+      memmove (*argvp + i + file_argc, *argvp + i + 1, 
+	       (*argcp - i) * sizeof (char *));
+      memcpy (*argvp + i, file_argv, file_argc * sizeof (char *));
+      /* The original option has been replaced by all the new
+	 options.  */
+      *argcp += file_argc - 1;
+      /* Free up memory allocated to process the response file.  We do
+	 not use freeargv because the individual options in FILE_ARGV
+	 are now in the main ARGV.  */
+      free (file_argv);
+      free (buffer);
+      /* Rescan all of the arguments just read to support response
+	 files that include other response files.  */
+      --i;
+    error:
+      /* We're all done with the file now.  */
+      fclose (f);
+    }
+}
+
+/*
+
+@deftypefn Extension int countargv (char **@var{argv})
+
+Return the number of elements in @var{argv}.
+Returns zero if @var{argv} is NULL.
+
+@end deftypefn
+
+*/
+
+int
+countargv (char **argv)
+{
+  int argc;
+
+  if (argv == NULL)
+    return 0;
+  for (argc = 0; argv[argc] != NULL; argc++)
+    continue;
+  return argc;
+}
+
+#ifdef MAIN
+
+/* Simple little test driver. */
+
+static const char *const tests[] =
+{
+  "a simple command line",
+  "arg 'foo' is single quoted",
+  "arg \"bar\" is double quoted",
+  "arg \"foo bar\" has embedded whitespace",
+  "arg 'Jack said \\'hi\\'' has single quotes",
+  "arg 'Jack said \\\"hi\\\"' has double quotes",
+  "a b c d e f g h i j k l m n o p q r s t u v w x y z 1 2 3 4 5 6 7 8 9",
+  
+  /* This should be expanded into only one argument.  */
+  "trailing-whitespace ",
+
+  "",
+  NULL
+};
+
+int
+main (void)
+{
+  char **argv;
+  const char *const *test;
+  char **targs;
+
+  for (test = tests; *test != NULL; test++)
+    {
+      printf ("buildargv(\"%s\")\n", *test);
+      if ((argv = buildargv (*test)) == NULL)
+	{
+	  printf ("failed!\n\n");
+	}
+      else
+	{
+	  for (targs = argv; *targs != NULL; targs++)
+	    {
+	      printf ("\t\"%s\"\n", *targs);
+	    }
+	  printf ("\n");
+	}
+      freeargv (argv);
+    }
+
+  return 0;
+}
+
+#endif	/* MAIN */

@@ -0,0 +1,401 @@
+/* ###
+ * IP: GPL 3 Linking Permitted
+ * REVIEWED: YES
+ */
+/* An abstract string datatype.
+   Copyright (C) 1998, 1999, 2000, 2002, 2004 Free Software Foundation, Inc.
+   Contributed by Mark Mitchell (mark@markmitchell.com).
+
+This file is part of GNU CC.
+   
+GNU CC is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+In addition to the permissions in the GNU General Public License, the
+Free Software Foundation gives you unlimited permission to link the
+compiled version of this file into combinations with other programs,
+and to distribute those combinations without any restriction coming
+from the use of this file.  (The General Public License restrictions
+do apply in other respects; for example, they cover modification of
+the file, and distribution when not linked into a combined
+executable.)
+
+GNU CC is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU CC; see the file COPYING.  If not, write to
+the Free Software Foundation, 51 Franklin Street - Fifth Floor,
+Boston, MA 02110-1301, USA.  */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+
+#ifdef HAVE_STRING_H
+#include <string.h>
+#endif
+
+#ifdef HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
+
+#include "libiberty.h"
+#include "dyn-string.h"
+
+/* Performs in-place initialization of a dyn_string struct.  This
+   function can be used with a dyn_string struct on the stack or
+   embedded in another object.  The contents of of the string itself
+   are still dynamically allocated.  The string initially is capable
+   of holding at least SPACE characeters, including the terminating
+   NUL.  If SPACE is 0, it will silently be increated to 1.  
+
+   If RETURN_ON_ALLOCATION_FAILURE is defined and memory allocation
+   fails, returns 0.  Otherwise returns 1.  */
+
+int
+dyn_string_init (struct dyn_string *ds_struct_ptr, int space)
+{
+  /* We need at least one byte in which to store the terminating NUL.  */
+  if (space == 0)
+    space = 1;
+
+#ifdef RETURN_ON_ALLOCATION_FAILURE
+  ds_struct_ptr->s = (char *) malloc (space);
+  if (ds_struct_ptr->s == NULL)
+    return 0;
+#else
+  ds_struct_ptr->s = XNEWVEC (char, space);
+#endif
+  ds_struct_ptr->allocated = space;
+  ds_struct_ptr->length = 0;
+  ds_struct_ptr->s[0] = '\0';
+
+  return 1;
+}
+
+/* Create a new dynamic string capable of holding at least SPACE
+   characters, including the terminating NUL.  If SPACE is 0, it will
+   be silently increased to 1.  If RETURN_ON_ALLOCATION_FAILURE is
+   defined and memory allocation fails, returns NULL.  Otherwise
+   returns the newly allocated string.  */
+
+dyn_string_t 
+dyn_string_new (int space)
+{
+  dyn_string_t result;
+#ifdef RETURN_ON_ALLOCATION_FAILURE
+  result = (dyn_string_t) malloc (sizeof (struct dyn_string));
+  if (result == NULL)
+    return NULL;
+  if (!dyn_string_init (result, space))
+    {
+      free (result);
+      return NULL;
+    }
+#else
+  result = XNEW (struct dyn_string);
+  dyn_string_init (result, space);
+#endif
+  return result;
+}
+
+/* Free the memory used by DS.  */
+
+void 
+dyn_string_delete (dyn_string_t ds)
+{
+  free (ds->s);
+  free (ds);
+}
+
+/* Returns the contents of DS in a buffer allocated with malloc.  It
+   is the caller's responsibility to deallocate the buffer using free.
+   DS is then set to the empty string.  Deletes DS itself.  */
+
+char*
+dyn_string_release (dyn_string_t ds)
+{
+  /* Store the old buffer.  */
+  char* result = ds->s;
+  /* The buffer is no longer owned by DS.  */
+  ds->s = NULL;
+  /* Delete DS.  */
+  free (ds);
+  /* Return the old buffer.  */
+  return result;
+}
+
+/* Increase the capacity of DS so it can hold at least SPACE
+   characters, plus the terminating NUL.  This function will not (at
+   present) reduce the capacity of DS.  Returns DS on success. 
+
+   If RETURN_ON_ALLOCATION_FAILURE is defined and a memory allocation
+   operation fails, deletes DS and returns NULL.  */
+
+dyn_string_t 
+dyn_string_resize (dyn_string_t ds, int space)
+{
+  int new_allocated = ds->allocated;
+
+  /* Increase SPACE to hold the NUL termination.  */
+  ++space;
+
+  /* Increase allocation by factors of two.  */
+  while (space > new_allocated)
+    new_allocated *= 2;
+    
+  if (new_allocated != ds->allocated)
+    {
+      ds->allocated = new_allocated;
+      /* We actually need more space.  */
+#ifdef RETURN_ON_ALLOCATION_FAILURE
+      ds->s = (char *) realloc (ds->s, ds->allocated);
+      if (ds->s == NULL)
+	{
+	  free (ds);
+	  return NULL;
+	}
+#else
+      ds->s = XRESIZEVEC (char, ds->s, ds->allocated);
+#endif
+    }
+
+  return ds;
+}
+
+/* Sets the contents of DS to the empty string.  */
+
+void
+dyn_string_clear (dyn_string_t ds)
+{
+  /* A dyn_string always has room for at least the NUL terminator.  */
+  ds->s[0] = '\0';
+  ds->length = 0;
+}
+
+/* Makes the contents of DEST the same as the contents of SRC.  DEST
+   and SRC must be distinct.  Returns 1 on success.  On failure, if
+   RETURN_ON_ALLOCATION_FAILURE, deletes DEST and returns 0.  */
+
+int
+dyn_string_copy (dyn_string_t dest, dyn_string_t src)
+{
+  if (dest == src)
+    abort ();
+
+  /* Make room in DEST.  */
+  if (dyn_string_resize (dest, src->length) == NULL)
+    return 0;
+  /* Copy DEST into SRC.  */
+  strcpy (dest->s, src->s);
+  /* Update the size of DEST.  */
+  dest->length = src->length;
+  return 1;
+}
+
+/* Copies SRC, a NUL-terminated string, into DEST.  Returns 1 on
+   success.  On failure, if RETURN_ON_ALLOCATION_FAILURE, deletes DEST
+   and returns 0.  */
+
+int
+dyn_string_copy_cstr (dyn_string_t dest, const char *src)
+{
+  int length = strlen (src);
+  /* Make room in DEST.  */
+  if (dyn_string_resize (dest, length) == NULL)
+    return 0;
+  /* Copy DEST into SRC.  */
+  strcpy (dest->s, src);
+  /* Update the size of DEST.  */
+  dest->length = length;
+  return 1;
+}
+
+/* Inserts SRC at the beginning of DEST.  DEST is expanded as
+   necessary.  SRC and DEST must be distinct.  Returns 1 on success.
+   On failure, if RETURN_ON_ALLOCATION_FAILURE, deletes DEST and
+   returns 0.  */
+
+int
+dyn_string_prepend (dyn_string_t dest, dyn_string_t src)
+{
+  return dyn_string_insert (dest, 0, src);
+}
+
+/* Inserts SRC, a NUL-terminated string, at the beginning of DEST.
+   DEST is expanded as necessary.  Returns 1 on success.  On failure,
+   if RETURN_ON_ALLOCATION_FAILURE, deletes DEST and returns 0. */
+
+int
+dyn_string_prepend_cstr (dyn_string_t dest, const char *src)
+{
+  return dyn_string_insert_cstr (dest, 0, src);
+}
+
+/* Inserts SRC into DEST starting at position POS.  DEST is expanded
+   as necessary.  SRC and DEST must be distinct.  Returns 1 on
+   success.  On failure, if RETURN_ON_ALLOCATION_FAILURE, deletes DEST
+   and returns 0.  */
+
+int
+dyn_string_insert (dyn_string_t dest, int pos, dyn_string_t src)
+{
+  int i;
+
+  if (src == dest)
+    abort ();
+
+  if (dyn_string_resize (dest, dest->length + src->length) == NULL)
+    return 0;
+  /* Make room for the insertion.  Be sure to copy the NUL.  */
+  for (i = dest->length; i >= pos; --i)
+    dest->s[i + src->length] = dest->s[i];
+  /* Splice in the new stuff.  */
+  strncpy (dest->s + pos, src->s, src->length);
+  /* Compute the new length.  */
+  dest->length += src->length;
+  return 1;
+}
+
+/* Inserts SRC, a NUL-terminated string, into DEST starting at
+   position POS.  DEST is expanded as necessary.  Returns 1 on
+   success.  On failure, RETURN_ON_ALLOCATION_FAILURE, deletes DEST
+   and returns 0.  */
+
+int
+dyn_string_insert_cstr (dyn_string_t dest, int pos, const char *src)
+{
+  int i;
+  int length = strlen (src);
+
+  if (dyn_string_resize (dest, dest->length + length) == NULL)
+    return 0;
+  /* Make room for the insertion.  Be sure to copy the NUL.  */
+  for (i = dest->length; i >= pos; --i)
+    dest->s[i + length] = dest->s[i];
+  /* Splice in the new stuff.  */
+  strncpy (dest->s + pos, src, length);
+  /* Compute the new length.  */
+  dest->length += length;
+  return 1;
+}
+
+/* Inserts character C into DEST starting at position POS.  DEST is
+   expanded as necessary.  Returns 1 on success.  On failure,
+   RETURN_ON_ALLOCATION_FAILURE, deletes DEST and returns 0.  */
+
+int
+dyn_string_insert_char (dyn_string_t dest, int pos, int c)
+{
+  int i;
+
+  if (dyn_string_resize (dest, dest->length + 1) == NULL)
+    return 0;
+  /* Make room for the insertion.  Be sure to copy the NUL.  */
+  for (i = dest->length; i >= pos; --i)
+    dest->s[i + 1] = dest->s[i];
+  /* Add the new character.  */
+  dest->s[pos] = c;
+  /* Compute the new length.  */
+  ++dest->length;
+  return 1;
+}
+     
+/* Append S to DS, resizing DS if necessary.  Returns 1 on success.
+   On failure, if RETURN_ON_ALLOCATION_FAILURE, deletes DEST and
+   returns 0.  */
+
+int
+dyn_string_append (dyn_string_t dest, dyn_string_t s)
+{
+  if (dyn_string_resize (dest, dest->length + s->length) == 0)
+    return 0;
+  strcpy (dest->s + dest->length, s->s);
+  dest->length += s->length;
+  return 1;
+}
+
+/* Append the NUL-terminated string S to DS, resizing DS if necessary.
+   Returns 1 on success.  On failure, if RETURN_ON_ALLOCATION_FAILURE,
+   deletes DEST and returns 0.  */
+
+int
+dyn_string_append_cstr (dyn_string_t dest, const char *s)
+{
+  int len = strlen (s);
+
+  /* The new length is the old length plus the size of our string, plus
+     one for the null at the end.  */
+  if (dyn_string_resize (dest, dest->length + len) == NULL)
+    return 0;
+  strcpy (dest->s + dest->length, s);
+  dest->length += len;
+  return 1;
+}
+
+/* Appends C to the end of DEST.  Returns 1 on success.  On failure,
+   if RETURN_ON_ALLOCATION_FAILURE, deletes DEST and returns 0.  */
+
+int
+dyn_string_append_char (dyn_string_t dest, int c)
+{
+  /* Make room for the extra character.  */
+  if (dyn_string_resize (dest, dest->length + 1) == NULL)
+    return 0;
+  /* Append the character; it will overwrite the old NUL.  */
+  dest->s[dest->length] = c;
+  /* Add a new NUL at the end.  */
+  dest->s[dest->length + 1] = '\0';
+  /* Update the length.  */
+  ++(dest->length);
+  return 1;
+}
+
+/* Sets the contents of DEST to the substring of SRC starting at START
+   and ending before END.  START must be less than or equal to END,
+   and both must be between zero and the length of SRC, inclusive.
+   Returns 1 on success.  On failure, if RETURN_ON_ALLOCATION_FAILURE,
+   deletes DEST and returns 0.  */
+
+int
+dyn_string_substring (dyn_string_t dest, dyn_string_t src,
+                      int start, int end)
+{
+  int i;
+  int length = end - start;
+
+  if (start > end || start > src->length || end > src->length)
+    abort ();
+
+  /* Make room for the substring.  */
+  if (dyn_string_resize (dest, length) == NULL)
+    return 0;
+  /* Copy the characters in the substring,  */
+  for (i = length; --i >= 0; )
+    dest->s[i] = src->s[start + i];
+  /* NUL-terimate the result.  */
+  dest->s[length] = '\0';
+  /* Record the length of the substring.  */
+  dest->length = length;
+
+  return 1;
+}
+
+/* Returns non-zero if DS1 and DS2 have the same contents.  */
+
+int
+dyn_string_eq (dyn_string_t ds1, dyn_string_t ds2)
+{
+  /* If DS1 and DS2 have different lengths, they must not be the same.  */
+  if (ds1->length != ds2->length)
+    return 0;
+  else
+    return !strcmp (ds1->s, ds2->s);
+}

@@ -0,0 +1,184 @@
+/* ###
+ * IP: GPL 3
+ * REVIEWED: YES
+ */
+/* getopt_long and getopt_long_only entry points for GNU getopt.
+   Copyright (C) 1987,88,89,90,91,92,93,94,96,97,98,2005
+     Free Software Foundation, Inc.
+
+   NOTE: This source is derived from an old version taken from the GNU C
+   Library (glibc).
+
+   This program is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by the
+   Free Software Foundation; either version 2, or (at your option) any
+   later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301,
+   USA.  */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#if !defined __STDC__ || !__STDC__
+/* This is a separate conditional since some stdc systems
+   reject `defined (const)'.  */
+#ifndef const
+#define const
+#endif
+#endif
+
+#include <stdio.h>
+
+#include "getopt.h"
+
+/* Comment out all this code if we are using the GNU C Library, and are not
+   actually compiling the library itself.  This code is part of the GNU C
+   Library, but also included in many other GNU distributions.  Compiling
+   and linking in this code is a waste when using the GNU C library
+   (especially if it is a shared library).  Rather than having every GNU
+   program understand `configure --with-gnu-libc' and omit the object files,
+   it is simpler to just do this in the source for each such file.  */
+
+#define GETOPT_INTERFACE_VERSION 2
+#if !defined _LIBC && defined __GLIBC__ && __GLIBC__ >= 2
+#include <gnu-versions.h>
+#if _GNU_GETOPT_INTERFACE_VERSION == GETOPT_INTERFACE_VERSION
+#define ELIDE_CODE
+#endif
+#endif
+
+#ifndef ELIDE_CODE
+
+
+/* This needs to come after some library #include
+   to get __GNU_LIBRARY__ defined.  */
+#ifdef __GNU_LIBRARY__
+#include <stdlib.h>
+#endif
+
+#ifndef	NULL
+#define NULL 0
+#endif
+
+int
+getopt_long (int argc,  char *const *argv,  const char *options,
+             const struct option *long_options, int *opt_index)
+{
+  return _getopt_internal (argc, argv, options, long_options, opt_index, 0);
+}
+
+/* Like getopt_long, but '-' as well as '--' can indicate a long option.
+   If an option that starts with '-' (not '--') doesn't match a long option,
+   but does match a short option, it is parsed as a short option
+   instead.  */
+
+int
+getopt_long_only (int argc, char *const *argv, const char *options,
+                  const struct option *long_options, int *opt_index)
+{
+  return _getopt_internal (argc, argv, options, long_options, opt_index, 1);
+}
+
+
+#endif	/* Not ELIDE_CODE.  */
+
+#ifdef TEST
+
+#include <stdio.h>
+
+int
+main (int argc, char **argv)
+{
+  int c;
+  int digit_optind = 0;
+
+  while (1)
+    {
+      int this_option_optind = optind ? optind : 1;
+      int option_index = 0;
+      static struct option long_options[] =
+      {
+	{"add", 1, 0, 0},
+	{"append", 0, 0, 0},
+	{"delete", 1, 0, 0},
+	{"verbose", 0, 0, 0},
+	{"create", 0, 0, 0},
+	{"file", 1, 0, 0},
+	{0, 0, 0, 0}
+      };
+
+      c = getopt_long (argc, argv, "abc:d:0123456789",
+		       long_options, &option_index);
+      if (c == -1)
+	break;
+
+      switch (c)
+	{
+	case 0:
+	  printf ("option %s", long_options[option_index].name);
+	  if (optarg)
+	    printf (" with arg %s", optarg);
+	  printf ("\n");
+	  break;
+
+	case '0':
+	case '1':
+	case '2':
+	case '3':
+	case '4':
+	case '5':
+	case '6':
+	case '7':
+	case '8':
+	case '9':
+	  if (digit_optind != 0 && digit_optind != this_option_optind)
+	    printf ("digits occur in two different argv-elements.\n");
+	  digit_optind = this_option_optind;
+	  printf ("option %c\n", c);
+	  break;
+
+	case 'a':
+	  printf ("option a\n");
+	  break;
+
+	case 'b':
+	  printf ("option b\n");
+	  break;
+
+	case 'c':
+	  printf ("option c with value `%s'\n", optarg);
+	  break;
+
+	case 'd':
+	  printf ("option d with value `%s'\n", optarg);
+	  break;
+
+	case '?':
+	  break;
+
+	default:
+	  printf ("?? getopt returned character code 0%o ??\n", c);
+	}
+    }
+
+  if (optind < argc)
+    {
+      printf ("non-option ARGV-elements: ");
+      while (optind < argc)
+	printf ("%s ", argv[optind++]);
+      printf ("\n");
+    }
+
+  exit (0);
+}
+
+#endif /* TEST */

@@ -0,0 +1,1056 @@
+/* ###
+ * IP: GPL 3
+ * REVIEWED: YES
+ */
+/* Getopt for GNU.
+   NOTE: getopt is now part of the C library, so if you don't know what
+   "Keep this file name-space clean" means, talk to drepper@gnu.org
+   before changing it!
+
+   Copyright (C) 1987, 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995,
+   1996, 1997, 1998, 2005 Free Software Foundation, Inc.
+
+   NOTE: This source is derived from an old version taken from the GNU C
+   Library (glibc).
+
+   This program is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by the
+   Free Software Foundation; either version 2, or (at your option) any
+   later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301,
+   USA.  */
+
+/* This tells Alpha OSF/1 not to define a getopt prototype in <stdio.h>.
+   Ditto for AIX 3.2 and <stdlib.h>.  */
+#ifndef _NO_PROTO
+# define _NO_PROTO
+#endif
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#if !defined __STDC__ || !__STDC__
+/* This is a separate conditional since some stdc systems
+   reject `defined (const)'.  */
+# ifndef const
+#  define const
+# endif
+#endif
+
+#include "ansidecl.h"
+#include <stdio.h>
+
+/* Comment out all this code if we are using the GNU C Library, and are not
+   actually compiling the library itself.  This code is part of the GNU C
+   Library, but also included in many other GNU distributions.  Compiling
+   and linking in this code is a waste when using the GNU C library
+   (especially if it is a shared library).  Rather than having every GNU
+   program understand `configure --with-gnu-libc' and omit the object files,
+   it is simpler to just do this in the source for each such file.  */
+
+#define GETOPT_INTERFACE_VERSION 2
+#if !defined _LIBC && defined __GLIBC__ && __GLIBC__ >= 2
+# include <gnu-versions.h>
+# if _GNU_GETOPT_INTERFACE_VERSION == GETOPT_INTERFACE_VERSION
+#  define ELIDE_CODE
+# endif
+#endif
+
+#ifndef ELIDE_CODE
+
+
+/* This needs to come after some library #include
+   to get __GNU_LIBRARY__ defined.  */
+#ifdef	__GNU_LIBRARY__
+/* Don't include stdlib.h for non-GNU C libraries because some of them
+   contain conflicting prototypes for getopt.  */
+# include <stdlib.h>
+# include <unistd.h>
+#endif	/* GNU C library.  */
+
+#ifdef VMS
+# include <unixlib.h>
+# if HAVE_STRING_H - 0
+#  include <string.h>
+# endif
+#endif
+
+#ifndef _
+/* This is for other GNU distributions with internationalized messages.
+   When compiling libc, the _ macro is predefined.  */
+# if (HAVE_LIBINTL_H && ENABLE_NLS) || defined _LIBC
+#  include <libintl.h>
+#  define _(msgid)	gettext (msgid)
+# else
+#  define _(msgid)	(msgid)
+# endif
+#endif
+
+/* This version of `getopt' appears to the caller like standard Unix `getopt'
+   but it behaves differently for the user, since it allows the user
+   to intersperse the options with the other arguments.
+
+   As `getopt' works, it permutes the elements of ARGV so that,
+   when it is done, all the options precede everything else.  Thus
+   all application programs are extended to handle flexible argument order.
+
+   Setting the environment variable POSIXLY_CORRECT disables permutation.
+   Then the behavior is completely standard.
+
+   GNU application programs can use a third alternative mode in which
+   they can distinguish the relative order of options and other arguments.  */
+
+#include "getopt.h"
+
+/* For communication from `getopt' to the caller.
+   When `getopt' finds an option that takes an argument,
+   the argument value is returned here.
+   Also, when `ordering' is RETURN_IN_ORDER,
+   each non-option ARGV-element is returned here.  */
+
+char *optarg = NULL;
+
+/* Index in ARGV of the next element to be scanned.
+   This is used for communication to and from the caller
+   and for communication between successive calls to `getopt'.
+
+   On entry to `getopt', zero means this is the first call; initialize.
+
+   When `getopt' returns -1, this is the index of the first of the
+   non-option elements that the caller should itself scan.
+
+   Otherwise, `optind' communicates from one call to the next
+   how much of ARGV has been scanned so far.  */
+
+/* 1003.2 says this must be 1 before any call.  */
+int optind = 1;
+
+/* Formerly, initialization of getopt depended on optind==0, which
+   causes problems with re-calling getopt as programs generally don't
+   know that. */
+
+int __getopt_initialized = 0;
+
+/* The next char to be scanned in the option-element
+   in which the last option character we returned was found.
+   This allows us to pick up the scan where we left off.
+
+   If this is zero, or a null string, it means resume the scan
+   by advancing to the next ARGV-element.  */
+
+static char *nextchar;
+
+/* Callers store zero here to inhibit the error message
+   for unrecognized options.  */
+
+int opterr = 1;
+
+/* Set to an option character which was unrecognized.
+   This must be initialized on some systems to avoid linking in the
+   system's own getopt implementation.  */
+
+int optopt = '?';
+
+/* Describe how to deal with options that follow non-option ARGV-elements.
+
+   If the caller did not specify anything,
+   the default is REQUIRE_ORDER if the environment variable
+   POSIXLY_CORRECT is defined, PERMUTE otherwise.
+
+   REQUIRE_ORDER means don't recognize them as options;
+   stop option processing when the first non-option is seen.
+   This is what Unix does.
+   This mode of operation is selected by either setting the environment
+   variable POSIXLY_CORRECT, or using `+' as the first character
+   of the list of option characters.
+
+   PERMUTE is the default.  We permute the contents of ARGV as we scan,
+   so that eventually all the non-options are at the end.  This allows options
+   to be given in any order, even with programs that were not written to
+   expect this.
+
+   RETURN_IN_ORDER is an option available to programs that were written
+   to expect options and other ARGV-elements in any order and that care about
+   the ordering of the two.  We describe each non-option ARGV-element
+   as if it were the argument of an option with character code 1.
+   Using `-' as the first character of the list of option characters
+   selects this mode of operation.
+
+   The special argument `--' forces an end of option-scanning regardless
+   of the value of `ordering'.  In the case of RETURN_IN_ORDER, only
+   `--' can cause `getopt' to return -1 with `optind' != ARGC.  */
+
+static enum
+{
+  REQUIRE_ORDER, PERMUTE, RETURN_IN_ORDER
+} ordering;
+
+/* Value of POSIXLY_CORRECT environment variable.  */
+static char *posixly_correct;
+
+#ifdef	__GNU_LIBRARY__
+/* We want to avoid inclusion of string.h with non-GNU libraries
+   because there are many ways it can cause trouble.
+   On some systems, it contains special magic macros that don't work
+   in GCC.  */
+# include <string.h>
+# define my_index	strchr
+#else
+
+# if HAVE_STRING_H
+#  include <string.h>
+# else
+#  if HAVE_STRINGS_H
+#   include <strings.h>
+#  endif
+# endif
+
+/* Avoid depending on library functions or files
+   whose names are inconsistent.  */
+
+#if HAVE_STDLIB_H && HAVE_DECL_GETENV
+#  include <stdlib.h>
+#elif !defined(getenv)
+#  ifdef __cplusplus
+extern "C" {
+#  endif /* __cplusplus */
+extern char *getenv (const char *);
+#  ifdef __cplusplus
+}
+#  endif /* __cplusplus */
+#endif
+
+static char *
+my_index (const char *str, int chr)
+{
+  while (*str)
+    {
+      if (*str == chr)
+	return (char *) str;
+      str++;
+    }
+  return 0;
+}
+
+/* If using GCC, we can safely declare strlen this way.
+   If not using GCC, it is ok not to declare it.  */
+#ifdef __GNUC__
+/* Note that Motorola Delta 68k R3V7 comes with GCC but not stddef.h.
+   That was relevant to code that was here before.  */
+# if (!defined __STDC__ || !__STDC__) && !defined strlen
+/* gcc with -traditional declares the built-in strlen to return int,
+   and has done so at least since version 2.4.5. -- rms.  */
+extern int strlen (const char *);
+# endif /* not __STDC__ */
+#endif /* __GNUC__ */
+
+#endif /* not __GNU_LIBRARY__ */
+
+/* Handle permutation of arguments.  */
+
+/* Describe the part of ARGV that contains non-options that have
+   been skipped.  `first_nonopt' is the index in ARGV of the first of them;
+   `last_nonopt' is the index after the last of them.  */
+
+static int first_nonopt;
+static int last_nonopt;
+
+#ifdef _LIBC
+/* Bash 2.0 gives us an environment variable containing flags
+   indicating ARGV elements that should not be considered arguments.  */
+
+/* Defined in getopt_init.c  */
+extern char *__getopt_nonoption_flags;
+
+static int nonoption_flags_max_len;
+static int nonoption_flags_len;
+
+static int original_argc;
+static char *const *original_argv;
+
+/* Make sure the environment variable bash 2.0 puts in the environment
+   is valid for the getopt call we must make sure that the ARGV passed
+   to getopt is that one passed to the process.  */
+static void
+__attribute__ ((unused))
+store_args_and_env (int argc, char *const *argv)
+{
+  /* XXX This is no good solution.  We should rather copy the args so
+     that we can compare them later.  But we must not use malloc(3).  */
+  original_argc = argc;
+  original_argv = argv;
+}
+# ifdef text_set_element
+text_set_element (__libc_subinit, store_args_and_env);
+# endif /* text_set_element */
+
+# define SWAP_FLAGS(ch1, ch2) \
+  if (nonoption_flags_len > 0)						      \
+    {									      \
+      char __tmp = __getopt_nonoption_flags[ch1];			      \
+      __getopt_nonoption_flags[ch1] = __getopt_nonoption_flags[ch2];	      \
+      __getopt_nonoption_flags[ch2] = __tmp;				      \
+    }
+#else	/* !_LIBC */
+# define SWAP_FLAGS(ch1, ch2)
+#endif	/* _LIBC */
+
+/* Exchange two adjacent subsequences of ARGV.
+   One subsequence is elements [first_nonopt,last_nonopt)
+   which contains all the non-options that have been skipped so far.
+   The other is elements [last_nonopt,optind), which contains all
+   the options processed since those non-options were skipped.
+
+   `first_nonopt' and `last_nonopt' are relocated so that they describe
+   the new indices of the non-options in ARGV after they are moved.  */
+
+#if defined __STDC__ && __STDC__
+static void exchange (char **);
+#endif
+
+static void
+exchange (char **argv)
+{
+  int bottom = first_nonopt;
+  int middle = last_nonopt;
+  int top = optind;
+  char *tem;
+
+  /* Exchange the shorter segment with the far end of the longer segment.
+     That puts the shorter segment into the right place.
+     It leaves the longer segment in the right place overall,
+     but it consists of two parts that need to be swapped next.  */
+
+#ifdef _LIBC
+  /* First make sure the handling of the `__getopt_nonoption_flags'
+     string can work normally.  Our top argument must be in the range
+     of the string.  */
+  if (nonoption_flags_len > 0 && top >= nonoption_flags_max_len)
+    {
+      /* We must extend the array.  The user plays games with us and
+	 presents new arguments.  */
+      char *new_str = (char *) malloc (top + 1);
+      if (new_str == NULL)
+	nonoption_flags_len = nonoption_flags_max_len = 0;
+      else
+	{
+	  memset (mempcpy (new_str, __getopt_nonoption_flags,
+			   nonoption_flags_max_len),
+		  '\0', top + 1 - nonoption_flags_max_len);
+	  nonoption_flags_max_len = top + 1;
+	  __getopt_nonoption_flags = new_str;
+	}
+    }
+#endif
+
+  while (top > middle && middle > bottom)
+    {
+      if (top - middle > middle - bottom)
+	{
+	  /* Bottom segment is the short one.  */
+	  int len = middle - bottom;
+	  register int i;
+
+	  /* Swap it with the top part of the top segment.  */
+	  for (i = 0; i < len; i++)
+	    {
+	      tem = argv[bottom + i];
+	      argv[bottom + i] = argv[top - (middle - bottom) + i];
+	      argv[top - (middle - bottom) + i] = tem;
+	      SWAP_FLAGS (bottom + i, top - (middle - bottom) + i);
+	    }
+	  /* Exclude the moved bottom segment from further swapping.  */
+	  top -= len;
+	}
+      else
+	{
+	  /* Top segment is the short one.  */
+	  int len = top - middle;
+	  register int i;
+
+	  /* Swap it with the bottom part of the bottom segment.  */
+	  for (i = 0; i < len; i++)
+	    {
+	      tem = argv[bottom + i];
+	      argv[bottom + i] = argv[middle + i];
+	      argv[middle + i] = tem;
+	      SWAP_FLAGS (bottom + i, middle + i);
+	    }
+	  /* Exclude the moved top segment from further swapping.  */
+	  bottom += len;
+	}
+    }
+
+  /* Update records for the slots the non-options now occupy.  */
+
+  first_nonopt += (optind - last_nonopt);
+  last_nonopt = optind;
+}
+
+/* Initialize the internal data when the first call is made.  */
+
+#if defined __STDC__ && __STDC__
+static const char *_getopt_initialize (int, char *const *, const char *);
+#endif
+static const char *
+_getopt_initialize (int argc ATTRIBUTE_UNUSED,
+		    char *const *argv ATTRIBUTE_UNUSED,
+		    const char *optstring)
+{
+  /* Start processing options with ARGV-element 1 (since ARGV-element 0
+     is the program name); the sequence of previously skipped
+     non-option ARGV-elements is empty.  */
+
+  first_nonopt = last_nonopt = optind;
+
+  nextchar = NULL;
+
+  posixly_correct = getenv ("POSIXLY_CORRECT");
+
+  /* Determine how to handle the ordering of options and nonoptions.  */
+
+  if (optstring[0] == '-')
+    {
+      ordering = RETURN_IN_ORDER;
+      ++optstring;
+    }
+  else if (optstring[0] == '+')
+    {
+      ordering = REQUIRE_ORDER;
+      ++optstring;
+    }
+  else if (posixly_correct != NULL)
+    ordering = REQUIRE_ORDER;
+  else
+    ordering = PERMUTE;
+
+#ifdef _LIBC
+  if (posixly_correct == NULL
+      && argc == original_argc && argv == original_argv)
+    {
+      if (nonoption_flags_max_len == 0)
+	{
+	  if (__getopt_nonoption_flags == NULL
+	      || __getopt_nonoption_flags[0] == '\0')
+	    nonoption_flags_max_len = -1;
+	  else
+	    {
+	      const char *orig_str = __getopt_nonoption_flags;
+	      int len = nonoption_flags_max_len = strlen (orig_str);
+	      if (nonoption_flags_max_len < argc)
+		nonoption_flags_max_len = argc;
+	      __getopt_nonoption_flags =
+		(char *) malloc (nonoption_flags_max_len);
+	      if (__getopt_nonoption_flags == NULL)
+		nonoption_flags_max_len = -1;
+	      else
+		memset (mempcpy (__getopt_nonoption_flags, orig_str, len),
+			'\0', nonoption_flags_max_len - len);
+	    }
+	}
+      nonoption_flags_len = nonoption_flags_max_len;
+    }
+  else
+    nonoption_flags_len = 0;
+#endif
+
+  return optstring;
+}
+
+/* Scan elements of ARGV (whose length is ARGC) for option characters
+   given in OPTSTRING.
+
+   If an element of ARGV starts with '-', and is not exactly "-" or "--",
+   then it is an option element.  The characters of this element
+   (aside from the initial '-') are option characters.  If `getopt'
+   is called repeatedly, it returns successively each of the option characters
+   from each of the option elements.
+
+   If `getopt' finds another option character, it returns that character,
+   updating `optind' and `nextchar' so that the next call to `getopt' can
+   resume the scan with the following option character or ARGV-element.
+
+   If there are no more option characters, `getopt' returns -1.
+   Then `optind' is the index in ARGV of the first ARGV-element
+   that is not an option.  (The ARGV-elements have been permuted
+   so that those that are not options now come last.)
+
+   OPTSTRING is a string containing the legitimate option characters.
+   If an option character is seen that is not listed in OPTSTRING,
+   return '?' after printing an error message.  If you set `opterr' to
+   zero, the error message is suppressed but we still return '?'.
+
+   If a char in OPTSTRING is followed by a colon, that means it wants an arg,
+   so the following text in the same ARGV-element, or the text of the following
+   ARGV-element, is returned in `optarg'.  Two colons mean an option that
+   wants an optional arg; if there is text in the current ARGV-element,
+   it is returned in `optarg', otherwise `optarg' is set to zero.
+
+   If OPTSTRING starts with `-' or `+', it requests different methods of
+   handling the non-option ARGV-elements.
+   See the comments about RETURN_IN_ORDER and REQUIRE_ORDER, above.
+
+   Long-named options begin with `--' instead of `-'.
+   Their names may be abbreviated as long as the abbreviation is unique
+   or is an exact match for some defined option.  If they have an
+   argument, it follows the option name in the same ARGV-element, separated
+   from the option name by a `=', or else the in next ARGV-element.
+   When `getopt' finds a long-named option, it returns 0 if that option's
+   `flag' field is nonzero, the value of the option's `val' field
+   if the `flag' field is zero.
+
+   The elements of ARGV aren't really const, because we permute them.
+   But we pretend they're const in the prototype to be compatible
+   with other systems.
+
+   LONGOPTS is a vector of `struct option' terminated by an
+   element containing a name which is zero.
+
+   LONGIND returns the index in LONGOPT of the long-named option found.
+   It is only valid when a long-named option has been found by the most
+   recent call.
+
+   If LONG_ONLY is nonzero, '-' as well as '--' can introduce
+   long-named options.  */
+
+int
+_getopt_internal (int argc, char *const *argv, const char *optstring,
+                  const struct option *longopts,
+                  int *longind, int long_only)
+{
+  optarg = NULL;
+
+  if (optind == 0 || !__getopt_initialized)
+    {
+      if (optind == 0)
+	optind = 1;	/* Don't scan ARGV[0], the program name.  */
+      optstring = _getopt_initialize (argc, argv, optstring);
+      __getopt_initialized = 1;
+    }
+
+  /* Test whether ARGV[optind] points to a non-option argument.
+     Either it does not have option syntax, or there is an environment flag
+     from the shell indicating it is not an option.  The later information
+     is only used when the used in the GNU libc.  */
+#ifdef _LIBC
+# define NONOPTION_P (argv[optind][0] != '-' || argv[optind][1] == '\0'	      \
+		      || (optind < nonoption_flags_len			      \
+			  && __getopt_nonoption_flags[optind] == '1'))
+#else
+# define NONOPTION_P (argv[optind][0] != '-' || argv[optind][1] == '\0')
+#endif
+
+  if (nextchar == NULL || *nextchar == '\0')
+    {
+      /* Advance to the next ARGV-element.  */
+
+      /* Give FIRST_NONOPT & LAST_NONOPT rational values if OPTIND has been
+	 moved back by the user (who may also have changed the arguments).  */
+      if (last_nonopt > optind)
+	last_nonopt = optind;
+      if (first_nonopt > optind)
+	first_nonopt = optind;
+
+      if (ordering == PERMUTE)
+	{
+	  /* If we have just processed some options following some non-options,
+	     exchange them so that the options come first.  */
+
+	  if (first_nonopt != last_nonopt && last_nonopt != optind)
+	    exchange ((char **) argv);
+	  else if (last_nonopt != optind)
+	    first_nonopt = optind;
+
+	  /* Skip any additional non-options
+	     and extend the range of non-options previously skipped.  */
+
+	  while (optind < argc && NONOPTION_P)
+	    optind++;
+	  last_nonopt = optind;
+	}
+
+      /* The special ARGV-element `--' means premature end of options.
+	 Skip it like a null option,
+	 then exchange with previous non-options as if it were an option,
+	 then skip everything else like a non-option.  */
+
+      if (optind != argc && !strcmp (argv[optind], "--"))
+	{
+	  optind++;
+
+	  if (first_nonopt != last_nonopt && last_nonopt != optind)
+	    exchange ((char **) argv);
+	  else if (first_nonopt == last_nonopt)
+	    first_nonopt = optind;
+	  last_nonopt = argc;
+
+	  optind = argc;
+	}
+
+      /* If we have done all the ARGV-elements, stop the scan
+	 and back over any non-options that we skipped and permuted.  */
+
+      if (optind == argc)
+	{
+	  /* Set the next-arg-index to point at the non-options
+	     that we previously skipped, so the caller will digest them.  */
+	  if (first_nonopt != last_nonopt)
+	    optind = first_nonopt;
+	  return -1;
+	}
+
+      /* If we have come to a non-option and did not permute it,
+	 either stop the scan or describe it to the caller and pass it by.  */
+
+      if (NONOPTION_P)
+	{
+	  if (ordering == REQUIRE_ORDER)
+	    return -1;
+	  optarg = argv[optind++];
+	  return 1;
+	}
+
+      /* We have found another option-ARGV-element.
+	 Skip the initial punctuation.  */
+
+      nextchar = (argv[optind] + 1
+		  + (longopts != NULL && argv[optind][1] == '-'));
+    }
+
+  /* Decode the current option-ARGV-element.  */
+
+  /* Check whether the ARGV-element is a long option.
+
+     If long_only and the ARGV-element has the form "-f", where f is
+     a valid short option, don't consider it an abbreviated form of
+     a long option that starts with f.  Otherwise there would be no
+     way to give the -f short option.
+
+     On the other hand, if there's a long option "fubar" and
+     the ARGV-element is "-fu", do consider that an abbreviation of
+     the long option, just like "--fu", and not "-f" with arg "u".
+
+     This distinction seems to be the most useful approach.  */
+
+  if (longopts != NULL
+      && (argv[optind][1] == '-'
+	  || (long_only && (argv[optind][2] || !my_index (optstring, argv[optind][1])))))
+    {
+      char *nameend;
+      const struct option *p;
+      const struct option *pfound = NULL;
+      int exact = 0;
+      int ambig = 0;
+      int indfound = -1;
+      int option_index;
+
+      for (nameend = nextchar; *nameend && *nameend != '='; nameend++)
+	/* Do nothing.  */ ;
+
+      /* Test all long options for either exact match
+	 or abbreviated matches.  */
+      for (p = longopts, option_index = 0; p->name; p++, option_index++)
+	if (!strncmp (p->name, nextchar, nameend - nextchar))
+	  {
+	    if ((unsigned int) (nameend - nextchar)
+		== (unsigned int) strlen (p->name))
+	      {
+		/* Exact match found.  */
+		pfound = p;
+		indfound = option_index;
+		exact = 1;
+		break;
+	      }
+	    else if (pfound == NULL)
+	      {
+		/* First nonexact match found.  */
+		pfound = p;
+		indfound = option_index;
+	      }
+	    else
+	      /* Second or later nonexact match found.  */
+	      ambig = 1;
+	  }
+
+      if (ambig && !exact)
+	{
+	  if (opterr)
+	    fprintf (stderr, _("%s: option `%s' is ambiguous\n"),
+		     argv[0], argv[optind]);
+	  nextchar += strlen (nextchar);
+	  optind++;
+	  optopt = 0;
+	  return '?';
+	}
+
+      if (pfound != NULL)
+	{
+	  option_index = indfound;
+	  optind++;
+	  if (*nameend)
+	    {
+	      /* Don't test has_arg with >, because some C compilers don't
+		 allow it to be used on enums.  */
+	      if (pfound->has_arg)
+		optarg = nameend + 1;
+	      else
+		{
+		  if (opterr)
+		    {
+		      if (argv[optind - 1][1] == '-')
+			/* --option */
+			fprintf (stderr,
+				 _("%s: option `--%s' doesn't allow an argument\n"),
+				 argv[0], pfound->name);
+		      else
+			/* +option or -option */
+			fprintf (stderr,
+				 _("%s: option `%c%s' doesn't allow an argument\n"),
+				 argv[0], argv[optind - 1][0], pfound->name);
+
+		      nextchar += strlen (nextchar);
+
+		      optopt = pfound->val;
+		      return '?';
+		    }
+		}
+	    }
+	  else if (pfound->has_arg == 1)
+	    {
+	      if (optind < argc)
+		optarg = argv[optind++];
+	      else
+		{
+		  if (opterr)
+		    fprintf (stderr,
+			   _("%s: option `%s' requires an argument\n"),
+			   argv[0], argv[optind - 1]);
+		  nextchar += strlen (nextchar);
+		  optopt = pfound->val;
+		  return optstring[0] == ':' ? ':' : '?';
+		}
+	    }
+	  nextchar += strlen (nextchar);
+	  if (longind != NULL)
+	    *longind = option_index;
+	  if (pfound->flag)
+	    {
+	      *(pfound->flag) = pfound->val;
+	      return 0;
+	    }
+	  return pfound->val;
+	}
+
+      /* Can't find it as a long option.  If this is not getopt_long_only,
+	 or the option starts with '--' or is not a valid short
+	 option, then it's an error.
+	 Otherwise interpret it as a short option.  */
+      if (!long_only || argv[optind][1] == '-'
+	  || my_index (optstring, *nextchar) == NULL)
+	{
+	  if (opterr)
+	    {
+	      if (argv[optind][1] == '-')
+		/* --option */
+		fprintf (stderr, _("%s: unrecognized option `--%s'\n"),
+			 argv[0], nextchar);
+	      else
+		/* +option or -option */
+		fprintf (stderr, _("%s: unrecognized option `%c%s'\n"),
+			 argv[0], argv[optind][0], nextchar);
+	    }
+	  nextchar = (char *) "";
+	  optind++;
+	  optopt = 0;
+	  return '?';
+	}
+    }
+
+  /* Look at and handle the next short option-character.  */
+
+  {
+    char c = *nextchar++;
+    char *temp = my_index (optstring, c);
+
+    /* Increment `optind' when we start to process its last character.  */
+    if (*nextchar == '\0')
+      ++optind;
+
+    if (temp == NULL || c == ':')
+      {
+	if (opterr)
+	  {
+	    if (posixly_correct)
+	      /* 1003.2 specifies the format of this message.  */
+	      fprintf (stderr, _("%s: illegal option -- %c\n"),
+		       argv[0], c);
+	    else
+	      fprintf (stderr, _("%s: invalid option -- %c\n"),
+		       argv[0], c);
+	  }
+	optopt = c;
+	return '?';
+      }
+    /* Convenience. Treat POSIX -W foo same as long option --foo */
+    if (temp[0] == 'W' && temp[1] == ';')
+      {
+	char *nameend;
+	const struct option *p;
+	const struct option *pfound = NULL;
+	int exact = 0;
+	int ambig = 0;
+	int indfound = 0;
+	int option_index;
+
+	/* This is an option that requires an argument.  */
+	if (*nextchar != '\0')
+	  {
+	    optarg = nextchar;
+	    /* If we end this ARGV-element by taking the rest as an arg,
+	       we must advance to the next element now.  */
+	    optind++;
+	  }
+	else if (optind == argc)
+	  {
+	    if (opterr)
+	      {
+		/* 1003.2 specifies the format of this message.  */
+		fprintf (stderr, _("%s: option requires an argument -- %c\n"),
+			 argv[0], c);
+	      }
+	    optopt = c;
+	    if (optstring[0] == ':')
+	      c = ':';
+	    else
+	      c = '?';
+	    return c;
+	  }
+	else
+	  /* We already incremented `optind' once;
+	     increment it again when taking next ARGV-elt as argument.  */
+	  optarg = argv[optind++];
+
+	/* optarg is now the argument, see if it's in the
+	   table of longopts.  */
+
+	for (nextchar = nameend = optarg; *nameend && *nameend != '='; nameend++)
+	  /* Do nothing.  */ ;
+
+	/* Test all long options for either exact match
+	   or abbreviated matches.  */
+	for (p = longopts, option_index = 0; p->name; p++, option_index++)
+	  if (!strncmp (p->name, nextchar, nameend - nextchar))
+	    {
+	      if ((unsigned int) (nameend - nextchar) == strlen (p->name))
+		{
+		  /* Exact match found.  */
+		  pfound = p;
+		  indfound = option_index;
+		  exact = 1;
+		  break;
+		}
+	      else if (pfound == NULL)
+		{
+		  /* First nonexact match found.  */
+		  pfound = p;
+		  indfound = option_index;
+		}
+	      else
+		/* Second or later nonexact match found.  */
+		ambig = 1;
+	    }
+	if (ambig && !exact)
+	  {
+	    if (opterr)
+	      fprintf (stderr, _("%s: option `-W %s' is ambiguous\n"),
+		       argv[0], argv[optind]);
+	    nextchar += strlen (nextchar);
+	    optind++;
+	    return '?';
+	  }
+	if (pfound != NULL)
+	  {
+	    option_index = indfound;
+	    if (*nameend)
+	      {
+		/* Don't test has_arg with >, because some C compilers don't
+		   allow it to be used on enums.  */
+		if (pfound->has_arg)
+		  optarg = nameend + 1;
+		else
+		  {
+		    if (opterr)
+		      fprintf (stderr, _("\
+%s: option `-W %s' doesn't allow an argument\n"),
+			       argv[0], pfound->name);
+
+		    nextchar += strlen (nextchar);
+		    return '?';
+		  }
+	      }
+	    else if (pfound->has_arg == 1)
+	      {
+		if (optind < argc)
+		  optarg = argv[optind++];
+		else
+		  {
+		    if (opterr)
+		      fprintf (stderr,
+			       _("%s: option `%s' requires an argument\n"),
+			       argv[0], argv[optind - 1]);
+		    nextchar += strlen (nextchar);
+		    return optstring[0] == ':' ? ':' : '?';
+		  }
+	      }
+	    nextchar += strlen (nextchar);
+	    if (longind != NULL)
+	      *longind = option_index;
+	    if (pfound->flag)
+	      {
+		*(pfound->flag) = pfound->val;
+		return 0;
+	      }
+	    return pfound->val;
+	  }
+	  nextchar = NULL;
+	  return 'W';	/* Let the application handle it.   */
+      }
+    if (temp[1] == ':')
+      {
+	if (temp[2] == ':')
+	  {
+	    /* This is an option that accepts an argument optionally.  */
+	    if (*nextchar != '\0')
+	      {
+		optarg = nextchar;
+		optind++;
+	      }
+	    else
+	      optarg = NULL;
+	    nextchar = NULL;
+	  }
+	else
+	  {
+	    /* This is an option that requires an argument.  */
+	    if (*nextchar != '\0')
+	      {
+		optarg = nextchar;
+		/* If we end this ARGV-element by taking the rest as an arg,
+		   we must advance to the next element now.  */
+		optind++;
+	      }
+	    else if (optind == argc)
+	      {
+		if (opterr)
+		  {
+		    /* 1003.2 specifies the format of this message.  */
+		    fprintf (stderr,
+			   _("%s: option requires an argument -- %c\n"),
+			   argv[0], c);
+		  }
+		optopt = c;
+		if (optstring[0] == ':')
+		  c = ':';
+		else
+		  c = '?';
+	      }
+	    else
+	      /* We already incremented `optind' once;
+		 increment it again when taking next ARGV-elt as argument.  */
+	      optarg = argv[optind++];
+	    nextchar = NULL;
+	  }
+      }
+    return c;
+  }
+}
+
+int
+getopt (int argc, char *const *argv, const char *optstring)
+{
+  return _getopt_internal (argc, argv, optstring,
+			   (const struct option *) 0,
+			   (int *) 0,
+			   0);
+}
+
+#endif	/* Not ELIDE_CODE.  */
+
+#ifdef TEST
+
+/* Compile with -DTEST to make an executable for use in testing
+   the above definition of `getopt'.  */
+
+int
+main (int argc, char **argv)
+{
+  int c;
+  int digit_optind = 0;
+
+  while (1)
+    {
+      int this_option_optind = optind ? optind : 1;
+
+      c = getopt (argc, argv, "abc:d:0123456789");
+      if (c == -1)
+	break;
+
+      switch (c)
+	{
+	case '0':
+	case '1':
+	case '2':
+	case '3':
+	case '4':
+	case '5':
+	case '6':
+	case '7':
+	case '8':
+	case '9':
+	  if (digit_optind != 0 && digit_optind != this_option_optind)
+	    printf ("digits occur in two different argv-elements.\n");
+	  digit_optind = this_option_optind;
+	  printf ("option %c\n", c);
+	  break;
+
+	case 'a':
+	  printf ("option a\n");
+	  break;
+
+	case 'b':
+	  printf ("option b\n");
+	  break;
+
+	case 'c':
+	  printf ("option c with value `%s'\n", optarg);
+	  break;
+
+	case '?':
+	  break;
+
+	default:
+	  printf ("?? getopt returned character code 0%o ??\n", c);
+	}
+    }
+
+  if (optind < argc)
+    {
+      printf ("non-option ARGV-elements: ");
+      while (optind < argc)
+	printf ("%s ", argv[optind++]);
+      printf ("\n");
+    }
+
+  exit (0);
+}
+
+#endif /* TEST */