From e2f4a26a8400f24883afd8c06139abef75c4814a Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 24 May 2011 14:00:57 +0000
Subject: [PATCH] Rejig the entire checking framework so that it uses the same
 xsl:message conventions as the system we're building into the aggregator
 code.  This means that the same checking transforms will be usable in both
 systems interchangeably. This also includes renaming the "fatal" template to
 "error" and adding a new "info" template. Update to sdss-mdcheck V1.3 to
 support these new conventions.

---
 build/check.xsl                        |   4 +--
 build/check_adfs.xsl                   |  10 +++----
 build/check_fixups.xsl                 |   6 ++--
 build/check_framework.xsl              |  39 ++++++++++++++++++++++---
 build/check_future.xsl                 |   4 +--
 build/check_idpdisc.xsl                |   8 ++---
 build/check_imported.xsl               |   2 +-
 build/check_init.xsl                   |   4 +--
 build/check_mdiop.xsl                  |   4 +--
 build/check_mdui.xsl                   |  24 +++++++--------
 build/check_misc.xsl                   |  36 +++++++++++------------
 build/check_namespaces.xsl             |   2 +-
 build/check_nokeyname.xsl              |   4 +--
 build/check_saml2int.xsl               |  12 ++++----
 build/check_shibboleth.xsl             |  20 ++++++-------
 build/check_vhosts.xsl                 |   2 +-
 tools/mdcheck/lib/sdss-mdcheck-1.2.jar | Bin 6782 -> 0 bytes
 tools/mdcheck/lib/sdss-mdcheck-1.3.jar | Bin 0 -> 6812 bytes
 18 files changed, 106 insertions(+), 75 deletions(-)
 delete mode 100644 tools/mdcheck/lib/sdss-mdcheck-1.2.jar
 create mode 100644 tools/mdcheck/lib/sdss-mdcheck-1.3.jar

diff --git a/build/check.xsl b/build/check.xsl
index fac6c068..c669b169 100644
--- a/build/check.xsl
+++ b/build/check.xsl
@@ -41,7 +41,7 @@
 	-->
 	<xsl:template match="md:EntityDescriptor[md:Organization/md:OrganizationName]
 		[not(ukfxMembers:isOwnerName($members, md:Organization/md:OrganizationName))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">unknown owner name: <xsl:value-of select="md:Organization/md:OrganizationName"/></xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -51,7 +51,7 @@
 		Check for badly formatted e-mail addresses.
 	-->
 	<xsl:template match="md:EmailAddress[mdxMail:dodgyAddress(.)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">badly formatted e-mail address: '<xsl:value-of select='.'/>'</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_adfs.xsl b/build/check_adfs.xsl
index 308d6f03..15e6bdfe 100644
--- a/build/check_adfs.xsl
+++ b/build/check_adfs.xsl
@@ -29,7 +29,7 @@
 	<xsl:template match="md:IDPSSODescriptor
 		[contains(@protocolSupportEnumeration, 'http://schemas.xmlsoap.org/ws/2003/07/secext')]
 		[not(md:SingleSignOnService/@Binding = 'http://schemas.xmlsoap.org/ws/2003/07/secext')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">ADFS IdP role lacks SSO service with appropriate Binding</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -45,7 +45,7 @@
 			The current UK federation metadata has one entity which breaks this rule at present.
 			Change this from "warning" to "fatal" once that has been resolved.
 		-->
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">ADFS SP role lacks SSO service with appropriate Binding</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -57,7 +57,7 @@
 	<xsl:template match="md:SingleSignOnService
 		[@Binding='http://schemas.xmlsoap.org/ws/2003/07/secext']
 		[not(contains(../@protocolSupportEnumeration, 'http://schemas.xmlsoap.org/ws/2003/07/secext'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">ADFS SingleSignOnService requires appropriate protocolSupportEnumeration</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -65,7 +65,7 @@
 	<xsl:template match="md:AssertionConsumerService
 		[@Binding='http://schemas.xmlsoap.org/ws/2003/07/secext']
 		[not(contains(../@protocolSupportEnumeration, 'http://schemas.xmlsoap.org/ws/2003/07/secext'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">ADFS AssertionConsumerService requires appropriate protocolSupportEnumeration</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -73,7 +73,7 @@
 	<xsl:template match="md:SingleLogoutService
 		[@Binding='http://schemas.xmlsoap.org/ws/2003/07/secext']
 		[not(contains(../@protocolSupportEnumeration, 'http://schemas.xmlsoap.org/ws/2003/07/secext'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">ADFS SingleLogoutService requires appropriate protocolSupportEnumeration</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_fixups.xsl b/build/check_fixups.xsl
index c92e6d8f..583d8e64 100644
--- a/build/check_fixups.xsl
+++ b/build/check_fixups.xsl
@@ -35,13 +35,13 @@
 	-->
 	
 	<xsl:template match="md:IDPSSODescriptor/md:KeyDescriptor[not(@use)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">IdP SSO KeyDescriptor lacking @use</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	
 	<xsl:template match="md:AttributeAuthorityDescriptor/md:KeyDescriptor[not(@use)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">IdP AA KeyDescriptor lacking @use</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -54,7 +54,7 @@
 		See https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness#MetadataCorrectness-Version2.0
 	-->
 	<xsl:template match="md:KeyDescriptor/md:EncryptionMethod">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">KeyDescriptor contains EncryptionMethod: OpenSAML-C 2.0 problem</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_framework.xsl b/build/check_framework.xsl
index 301cb1c1..613c1b6a 100644
--- a/build/check_framework.xsl
+++ b/build/check_framework.xsl
@@ -22,13 +22,13 @@
 	
 
 	<!--
-		Common template to call to report a fatal error on some element within an entity.
+		Common template to call to report an error on some element within an entity.
 	-->
-	<xsl:template name="fatal">
+	<xsl:template name="error">
 		<xsl:param name="m"/>
 		<xsl:variable name="entity" select="ancestor-or-self::md:EntityDescriptor"/>
 		<xsl:message terminate='no'>
-			<xsl:text>*** </xsl:text>
+			<xsl:text>[ERROR] </xsl:text>
 			<!--
 				If we're processing an aggregate, we need to indicate which
 				individual entity we're dealing with.
@@ -59,7 +59,38 @@
 		<xsl:param name="m"/>
 		<xsl:variable name="entity" select="ancestor-or-self::md:EntityDescriptor"/>
 		<xsl:message terminate='no'>
-			<xsl:text>??? </xsl:text>
+			<xsl:text>[WARN] </xsl:text>
+			<!--
+				If we're processing an aggregate, we need to indicate which
+				individual entity we're dealing with.
+			-->
+			<xsl:if test="ancestor-or-self::md:EntitiesDescriptor">
+				<!--
+					Use an ID if available, otherwise the entityID.
+				-->
+				<xsl:choose>
+					<xsl:when test="$entity/@ID">
+						<xsl:value-of select="$entity/@ID"/>
+					</xsl:when>
+					<xsl:otherwise>
+						<xsl:value-of select="$entity/@entityID"/>
+					</xsl:otherwise>
+				</xsl:choose>
+				<xsl:text>: </xsl:text>
+			</xsl:if>
+			<xsl:value-of select="$m"/>
+		</xsl:message>
+	</xsl:template>
+	
+	
+	<!--
+		Common template to call to report an informational message on some element within an entity.
+	-->
+	<xsl:template name="info">
+		<xsl:param name="m"/>
+		<xsl:variable name="entity" select="ancestor-or-self::md:EntityDescriptor"/>
+		<xsl:message terminate='no'>
+			<xsl:text>[INFO] </xsl:text>
 			<!--
 				If we're processing an aggregate, we need to indicate which
 				individual entity we're dealing with.
diff --git a/build/check_future.xsl b/build/check_future.xsl
index 5e574360..7e8a167a 100644
--- a/build/check_future.xsl
+++ b/build/check_future.xsl
@@ -38,7 +38,7 @@
 		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
 		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='encryption'])]
 		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML 2 SP has no encryption key</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -49,7 +49,7 @@
 	-->
 	
 	<xsl:template match="@Location[contains(., '%')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">URL-encoded Location attribute; should be entity-encoded</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_idpdisc.xsl b/build/check_idpdisc.xsl
index fdf0f0cf..6cb582f3 100644
--- a/build/check_idpdisc.xsl
+++ b/build/check_idpdisc.xsl
@@ -30,7 +30,7 @@
 		<xsl:variable name="indices" select="descendant::idpdisc:DiscoveryResponse/@index"/>
 		<xsl:variable name="distinct.indices" select="set:distinct($indices)"/>
 		<xsl:if test="count($indices) != count($distinct.indices)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">DiscoveryResponse index values not all different</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
@@ -43,20 +43,20 @@
 	-->
 	
 	<xsl:template match="idpdisc:DiscoveryResponse[not(@index)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">missing index attribute on DiscoveryResponse</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	
 	<xsl:template match="idpdisc:DiscoveryResponse[not(@Binding)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">missing Binding attribute on DiscoveryResponse</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	
 	<xsl:template match="idpdisc:DiscoveryResponse[@Binding]
 		[@Binding!='urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol']">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">incorrect Binding value on DiscoveryResponse</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_imported.xsl b/build/check_imported.xsl
index e663fe9e..4daaa77e 100644
--- a/build/check_imported.xsl
+++ b/build/check_imported.xsl
@@ -33,7 +33,7 @@
 			IdPs registered with the UK federation are expected to have at least one scope.
 		-->
 		<xsl:if test="not(descendant::shibmd:Scope)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">this IdP does not have any Scope elements</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>		
diff --git a/build/check_init.xsl b/build/check_init.xsl
index 1aa56807..f33fd624 100644
--- a/build/check_init.xsl
+++ b/build/check_init.xsl
@@ -26,14 +26,14 @@
 	-->
 	
 	<xsl:template match="init:RequestInitiator[not(@Binding)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">missing Binding attribute on RequestInitiator</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	
 	<xsl:template match="init:RequestInitiator[@Binding]
 		[@Binding!='urn:oasis:names:tc:SAML:profiles:SSO:request-init']">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">incorrect Binding value on RequestInitiator</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_mdiop.xsl b/build/check_mdiop.xsl
index 4f404b33..167cdaf3 100644
--- a/build/check_mdiop.xsl
+++ b/build/check_mdiop.xsl
@@ -36,7 +36,7 @@
 		[not(ds:KeyInfo/ds:KeyName)]
 		[not(ds:KeyInfo/ds:KeyValue)]
 		[not(ds:KeyInfo/ds:X509Data/ds:X509Certificate)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">KeyDescriptor does not contain a key representation</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -45,7 +45,7 @@
 		Section 2.5.1: only one X.509 certificate may appear in any KeyDescriptor.
 	-->
 	<xsl:template match="md:KeyDescriptor[count(ds:KeyInfo/ds:X509Data/ds:X509Certificate)>1]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">KeyDescriptor contains more than one X509Certificate</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_mdui.xsl b/build/check_mdui.xsl
index da82da96..2380787a 100644
--- a/build/check_mdui.xsl
+++ b/build/check_mdui.xsl
@@ -37,7 +37,7 @@
 		<mdui:UIInfo> MUST NOT appear more than once within a given <md:Extensions> element.
 	-->
 	<xsl:template match="md:Extensions/mdui:UIInfo[position()>1]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">more than one UIInfo element in one Extensions element</xsl:with-param>
 		</xsl:call-template>		
 	</xsl:template>
@@ -50,7 +50,7 @@
 	-->
 	<xsl:template match="md:Extensions/mdui:*
 		[not(local-name()='UIInfo')][not(local-name()='DiscoHints')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">
 				<xsl:text>misspelled or misplaced mdui element within md:Extensions: </xsl:text>
 				<xsl:value-of select="local-name()"/>
@@ -69,13 +69,13 @@
 		SPSSODescriptor elements, which are the ones we'll actually make use of.]
 	-->
 	<xsl:template match="mdui:UIInfo[not(parent::md:Extensions)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">UIInfo appearing outside Extensions element</xsl:with-param>
 		</xsl:call-template>        
 	</xsl:template>
 	<xsl:template match="md:Extensions[mdui:UIInfo]
 		[not(parent::md:IDPSSODescriptor)][not(parent::md:SPSSODescriptor)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">UIInfo appearing outside role descriptor element</xsl:with-param>
 		</xsl:call-template>        
 	</xsl:template>
@@ -120,7 +120,7 @@
 		<xsl:variable name="l" select="$e/@xml:lang"></xsl:variable>
 		<xsl:variable name="u" select="set:distinct($l)"/>
 		<xsl:if test="count($l) != count($u)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">
 					<xsl:text>non-unique lang values on </xsl:text>
 					<xsl:value-of select="name($e)"/>
@@ -159,19 +159,19 @@
 			This is a SHOULD in the specification; we treat it as a MUST here.
 		-->
 		<xsl:if test="not(starts-with(., 'https://'))">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">mdui:Logo URL does not start with https://</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
 		<!-- Schema validity: must have a height attribute -->
 		<xsl:if test="not(@height)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">missing @height on <xsl:value-of select="name()"/></xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
 		<!-- Schema validity: must have a width attribute -->
 		<xsl:if test="not(@width)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">missing @width on <xsl:value-of select="name()"/></xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>   
@@ -197,7 +197,7 @@
 	<xsl:template name="localisedNameType">
 		<!-- Schema validity: must have an xml:lang attribute -->
 		<xsl:if test="not(@xml:lang)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">missing @xml:lang on <xsl:value-of select="name()"/></xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>	
@@ -210,12 +210,12 @@
 		<md:Extensions> element of an <md:IDPSSODescriptor> element.
 	-->
 	<xsl:template match="mdui:DiscoHints[not(parent::md:Extensions)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">DiscoHints appearing outside Extensions element</xsl:with-param>
 		</xsl:call-template>        
 	</xsl:template>
 	<xsl:template match="md:Extensions[mdui:DiscoHints][not(parent::md:IDPSSODescriptor)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">DiscoHints appearing outside IDPSSODescriptor element</xsl:with-param>
 		</xsl:call-template>        
 	</xsl:template>
@@ -226,7 +226,7 @@
 		<mdui:DiscoHints> MUST NOT appear more than once within a given <md:Extensions> element.
 	-->
 	<xsl:template match="md:Extensions/mdui:DiscoHints[position()>1]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">more than one DiscoHints element in one Extensions element</xsl:with-param>
 		</xsl:call-template>        
 	</xsl:template>
diff --git a/build/check_misc.xsl b/build/check_misc.xsl
index 1444c42a..69681d5c 100644
--- a/build/check_misc.xsl
+++ b/build/check_misc.xsl
@@ -45,7 +45,7 @@
 		<xsl:for-each select="$dup.entityIDs">
 			<xsl:variable name="dup.entityID" select="."/>
 			<xsl:for-each select="$entities[@entityID = $dup.entityID]">
-				<xsl:call-template name="fatal">
+				<xsl:call-template name="error">
 					<xsl:with-param name="m">duplicate entityID: <xsl:value-of select='$dup.entityID'/></xsl:with-param>
 				</xsl:call-template>
 			</xsl:for-each>
@@ -59,7 +59,7 @@
 		<xsl:for-each select="$dup.ODNs">
 			<xsl:variable name="dup.ODN" select="."/>
 			<xsl:for-each select="$idps[md:Organization/md:OrganizationDisplayName = $dup.ODN]">
-				<xsl:call-template name="fatal">
+				<xsl:call-template name="error">
 					<xsl:with-param name="m">duplicate OrganisationDisplayName: <xsl:value-of select='$dup.ODN'/></xsl:with-param>
 				</xsl:call-template>
 			</xsl:for-each>
@@ -76,7 +76,7 @@
 		Check for entities which do not have an OrganizationName at all.
 	-->
 	<xsl:template match="md:EntityDescriptor[not(md:Organization/md:OrganizationName)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">entity lacks OrganizationName</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -87,19 +87,19 @@
 	-->
 	
 	<xsl:template match="md:IDPSSODescriptor[not(md:KeyDescriptor)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">IdP SSO Descriptor lacking KeyDescriptor</xsl:with-param>
 		</xsl:call-template>    
 	</xsl:template>
 	
 	<xsl:template match="md:SPSSODescriptor[not(md:KeyDescriptor)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SP SSO Descriptor lacking KeyDescriptor</xsl:with-param>
 		</xsl:call-template>    
 	</xsl:template>
 	
 	<xsl:template match="md:AttributeAuthorityDescriptor[not(md:KeyDescriptor)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">IdP AA Descriptor lacking KeyDescriptor</xsl:with-param>
 		</xsl:call-template>    
 	</xsl:template>
@@ -113,7 +113,7 @@
 		<xsl:variable name="indices" select="md:AssertionConsumerService/@index"/>
 		<xsl:variable name="distinct.indices" select="set:distinct($indices)"/>
 		<xsl:if test="count($indices) != count($distinct.indices)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">AssertionConsumerService index values not all different</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
@@ -128,7 +128,7 @@
 		<xsl:variable name="indices" select="md:ArtifactResolutionService/@index"/>
 		<xsl:variable name="distinct.indices" select="set:distinct($indices)"/>
 		<xsl:if test="count($indices) != count($distinct.indices)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">ArtifactResolutionService index values not all different</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
@@ -144,7 +144,7 @@
 		Entity IDs should not contain space characters.
 	-->
 	<xsl:template match="md:EntityDescriptor[contains(@entityID, ' ')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">entity ID contains space character</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -156,7 +156,7 @@
 	<xsl:template match="md:EntityDescriptor[not(starts-with(@entityID, 'urn:mace:'))]
 		[not(starts-with(@entityID, 'http://'))]
 		[not(starts-with(@entityID, 'https://'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">entity ID <xsl:value-of select="@entityID"/> does not start with acceptable prefix</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -166,7 +166,7 @@
 		Check for OrganizationDisplayName elements containing line breaks.
 	-->
 	<xsl:template match="md:OrganizationDisplayName[contains(., '&#10;')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">OrganizationDisplayName contains line break</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -179,7 +179,7 @@
 		At present, however, this produces no false positives.
 	-->
 	<xsl:template match="*[contains(@Location, ' ')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m"><xsl:value-of select='local-name()'/> Location contains space character</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -195,7 +195,7 @@
 		At present, however, this simpler rule produces no false positives.
 	-->
 	<xsl:template match="*[@Location and not(starts-with(@Location,'https://'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m"><xsl:value-of select='local-name()'/> Location does not start with https://</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -206,7 +206,7 @@
 	-->
 	<xsl:template match="*[@Location and starts-with(@Location, 'https://')
 			and contains(@Location,':443/')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">
 				<xsl:value-of select='local-name()'/>
 				<xsl:text> Location </xsl:text>
@@ -221,7 +221,7 @@
 		Check for Locations that aren't valid URLs.
 	-->
 	<xsl:template match="*[@Location and mdxURL:invalidURL(@Location)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">
 				<xsl:value-of select='local-name()'/>
 				<xsl:text> Location is not a valid URL: </xsl:text>
@@ -238,7 +238,7 @@
 		At present, however, this produces no false positives.
 	-->
 	<xsl:template match="*[contains(@Binding, ' ')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m"><xsl:value-of select='local-name()'/> Binding contains space character</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -251,7 +251,7 @@
 		but it's nice to have a clear error message earlier in the process.
 	-->
 	<xsl:template match="@xml:lang[.='']">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">empty xml:lang attribute</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -261,7 +261,7 @@
 		A Shibboleth scope shouldn't be just "ac.uk".
 	-->
 	<xsl:template match="shibmd:Scope[.='ac.uk']">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">bare 'ac.uk' scope not permitted</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_namespaces.xsl b/build/check_namespaces.xsl
index d946b7b9..bb5478ba 100644
--- a/build/check_namespaces.xsl
+++ b/build/check_namespaces.xsl
@@ -83,7 +83,7 @@
 	-->
 	
 	<xsl:template match="*">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">
 				<xsl:text>Unknown namespace: </xsl:text>
 				<xsl:value-of select="namespace-uri()"/>
diff --git a/build/check_nokeyname.xsl b/build/check_nokeyname.xsl
index c265d2d8..ae93274a 100644
--- a/build/check_nokeyname.xsl
+++ b/build/check_nokeyname.xsl
@@ -31,7 +31,7 @@
 
 	
 	<xsl:template match="md:EntityDescriptor[md:IDPSSODescriptor][not(descendant::ds:KeyName)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">
 				<xsl:if test="descendant::md:Extensions/wayf:HideFromWAYF">
 					<xsl:text>(hidden) </xsl:text>
@@ -39,7 +39,7 @@
 				<xsl:text>identity provider lacks PKIX validatable credential</xsl:text>
 			</xsl:with-param>
 		</xsl:call-template>
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">
 				<xsl:value-of select="descendant::md:OrganizationDisplayName"/>
 				<xsl:text>: </xsl:text>
diff --git a/build/check_saml2int.xsl b/build/check_saml2int.xsl
index 6b0ab157..a52d4797 100644
--- a/build/check_saml2int.xsl
+++ b/build/check_saml2int.xsl
@@ -42,7 +42,7 @@
 		[md:NameIDFormat]
 		[not(md:NameIDFormat[.='urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'])]
 		[not(md:NameIDFormat[.='urn:oasis:names:tc:SAML:2.0:nameid-format:transient'])]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML2Int: SP excludes both SAML 2 name identifier formats</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -58,7 +58,7 @@
 		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
 		[md:NameIDFormat]
 		[not(md:NameIDFormat[.='urn:oasis:names:tc:SAML:2.0:nameid-format:transient'])]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML2Int: IdP excludes SAML 2 transient name identifier format</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -70,12 +70,12 @@
 		Check for correct NameFormat on Attribute elements.
 	-->
 	<xsl:template match="saml:Attribute[not(@NameFormat)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML2Int: Attribute element lacks NameFormat attribute</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	<xsl:template match="saml:Attribute[@NameFormat][not(@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML2Int: Attribute element has incorrect NameFormat attribute</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -86,12 +86,12 @@
 		might be added in future.
 	-->
 	<xsl:template match="md:RequestedAttribute[not(@NameFormat)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML2IntX: RequestedAttribute element lacks NameFormat attribute</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	<xsl:template match="md:RequestedAttribute[@NameFormat][not(@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML2IntX: RequestedAttribute element has incorrect NameFormat attribute</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_shibboleth.xsl b/build/check_shibboleth.xsl
index 14c16b9b..03ee5ddc 100644
--- a/build/check_shibboleth.xsl
+++ b/build/check_shibboleth.xsl
@@ -39,7 +39,7 @@
 	-->
 	<xsl:template match="md:OrganizationURL[not(starts-with(., 'http://'))]
 		[not(starts-with(., 'https://'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">OrganizationURL '<xsl:value-of select="."/>' does not start with acceptable prefix</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -57,14 +57,14 @@
 	-->
 	<xsl:template match="md:IDPSSODescriptor[md:SingleSignOnService[@Binding='urn:mace:shibboleth:1.0:profiles:AuthnRequest']]
 		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">Shibboleth 1.x auth request needs urn:oasis:names:tc:SAML:1.1:protocol in IDPSSODescriptor/@protocolSupportEnumeration</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
 	
 	<xsl:template match="md:IDPSSODescriptor[md:SingleSignOnService[@Binding='urn:mace:shibboleth:1.0:profiles:AuthnRequest']]
 		[not(contains(@protocolSupportEnumeration, 'urn:mace:shibboleth:1.0'))]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">Shibboleth 1.x auth request needs urn:mace:shibboleth:1.0 in IDPSSODescriptor/@protocolSupportEnumeration</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -81,7 +81,7 @@
 	-->
 	<xsl:template match="md:IDPSSODescriptor[contains(@protocolSupportEnumeration, 'urn:mace:shibboleth:1.0')]
 		[not(md:SingleSignOnService[@Binding='urn:mace:shibboleth:1.0:profiles:AuthnRequest'])]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">Shibboleth 1.x support claimed but no appropriate SSO service binding</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -99,7 +99,7 @@
 		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol')]
 		[md:NameIDFormat]
 		[not(md:NameIDFormat[.='urn:mace:shibboleth:1.0:nameIdentifier'])]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SAML 1.1 SP excludes Shibboleth transient name identifier format</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -117,7 +117,7 @@
 		The issue here is that the KeyName does not have the ds: namespace.
 	-->
 	<xsl:template match="ds:KeyInfo/*[namespace-uri() != 'http://www.w3.org/2000/09/xmldsig#']">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">ds:KeyInfo child element not in ds namespace</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -133,7 +133,7 @@
 		See https://bugs.internet2.edu/jira/browse/SIDPO-34
 	-->
 	<xsl:template match="md:IDPSSODescriptor[descendant::saml:Attribute[not(@NameFormat)]]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">SIDPO-34: Attribute lacking NameFormat in IDPSSODescriptor</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -144,7 +144,7 @@
 		This has a default in the schema so omitting it can cause signing brittleness.
 	-->
 	<xsl:template match="shibmd:Scope[not(@regexp)]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">Scope <xsl:value-of select="."/> lacks @regexp</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -156,7 +156,7 @@
 		This isn't part of the specification, but is assumed by some software.
 	-->
 	<xsl:template match="shibmd:Scope[contains(., ' ')]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">Scope value contains space character</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
@@ -167,7 +167,7 @@
 		problems with comments inside certificate representations.
 	-->
 	<xsl:template match="ds:X509Certificate[comment()]">
-		<xsl:call-template name="fatal">
+		<xsl:call-template name="error">
 			<xsl:with-param name="m">X509Certificate contains XML comment</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
diff --git a/build/check_vhosts.xsl b/build/check_vhosts.xsl
index 4a09451f..7b7a1999 100644
--- a/build/check_vhosts.xsl
+++ b/build/check_vhosts.xsl
@@ -49,7 +49,7 @@
 		<!-- we expect these two sets to be disjoint -->
 		<xsl:variable name="bothHosts" select="set:distinct($ssoHosts | $soapHosts)"/>
 		<xsl:if test="count($bothHosts) != count($ssoHosts) + count($soapHosts)">
-			<xsl:call-template name="fatal">
+			<xsl:call-template name="error">
 				<xsl:with-param name="m">at least one SOAP location on same vhost as an SSO location</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
diff --git a/tools/mdcheck/lib/sdss-mdcheck-1.2.jar b/tools/mdcheck/lib/sdss-mdcheck-1.2.jar
deleted file mode 100644
index 47001af660361c1c4f0120378ab5ae42d47575ab..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6782
zcmb7I1yod9+XiHi&Y`=zI|k_n85kN#DPe|gluikeMw+2Zx<gXBq@@u>ln?|I)DN!L
zi{9&Z|L@;xopbh@d7o#$XRkNTel%5YAfqE(4OTyGi9aTP-q0?e>hch2PGt=RZp}Z<
zP!U)z&AL?Chwong?Q?kne>PK>)=*ZE*M@MZD;%kh46CVfa!q2Xa<Yw$jMr-Myx?DZ
z<-(yd_MAhNQwH_s7F;)xh`o!!t2yJL7J;gkwp%7!1&{&*KY?G1(2rnP>*(?y6@FKh
zu8p+FBwScjrJjn=a|eD<u$Qc>36}{M!Vj+y{_yJ3k-x@`%bC0VUvB@?0Oh-Zx#hpu
zVEkp{de_zUUknL;HH6-^w6(IlUj5HaW8is0ed$;K<<eZg2dG=Qncp>cGnc)BGyHM4
za^bRcFn4v$)PZVGOW{74B1WQ>;?M*G5y2`L#<^@NczsA(wirQtA9&%p$cxAckVDg*
z=m2{DuL%B$n<j=iG-{JL%dPFp_dT-Tt$du@r@n<4ZLSj(giIWlt|XB>5gii2Y@D{X
zQ4&Ivb+`-<Ay<k@-H;q-RNDlswkPrg>(Ob^Sp$$8qVu?N1Z(pjK+?>sy{8h8$TG)c
z%TlJc@Jr{TN)62HE1{_X*j$4<)N^(UIfOs?j#)N7*{~6#g5s;ku$HaqH5mDrl(Ce5
zVcReyM$~)2yr7MEsHUZCTSrgbIi{^IXm9%kKH)STX$yxHjn%8c#bjPJkRBKG?TL|l
z0x|WFe!8Kt9yEA&rU&7+Mln?z4CB#sVaZZS-dhnd(mZ#2vf?nUw@jtbQMM&A#8XJw
zlFfMmohx+4t%0Mpm(4@NcZdhe)38epF1g<siCuwVduZ&<&Sol?zBG3XntQ6I*qagI
zjaRh;nGslaM(N)?jv;=_EY1iC4{*Ho03~Z}ZTcJLgIrH7fZqyv!$flzc#msSsKx5#
zKtMF^BH;LrZmzKD@B(^rG!Ja(jZ{(eP5nocp+<fwg}QUt{I`sN)eQ8(<<S($^5xIH
zf?<g9yEXVZ8P$d>FDC`{q=>V9O>$+EDo5LHK_3U4B%n_X3l`<uz)v7clhE)AFZ&_B
z#%P%Z-DXquF0-wd%R`fZCJT!TJT7ti6eHi=Ly29_j8pL={{-I|SzNaY&$1W9ueL0n
zv<$yt@SZ9y)fkVm*Xf#2<(|j#`G6#VBY;<jacJVpE=Z*bTydTXJ~-S73=oIMOtVca
zl6*n=MvG)>yWex?G1iJVK8WE}6wY4mYVGuz&L%S}eIx4tDhyZQ#+P1t0h8Xes%PL*
zksPqEk_pA@8|!Cwl#%_|6F^W95TtO_e}K1j<1D{=ecx7;=2#`IBHUIy;OwJ-a;hz&
zoq&0~5;wR8Gc5k&<FLW-fZGYNW{>>*BD@kWNMwM#1@RY(rEvX^`N$>MtMW|MWK7c0
zE}H1p5vKSY#`LN0EVC#SsVndofS-?cLicfgRD$oRX6YI;U4NNs^*0d^g#MRQQ}>p4
zadC7}vvYN`g8fLjBnVWSTnG37hF>#S!zlnP)v-4$4g<90cGPQC6P3sle8xvE(Y+&-
z@|1A_-ugsFaUdmo(tk~l5-roCpL#9M#cz*E%G)_2VKB>e9Q4|I4D|Zt`RT3kZ%907
zB|Y8ec9`qI0+nl}VL0v#JW1VxjJLGJr&;~Vx7@8h$qitQzz<4d4PHXF$K76bXK1{4
zrL^HGSjV8e!BTu1+|w4eM7D>T;nc3c-?pRss_jk!Qd+m{c{NlAT4j+Wv-*)u8>xLP
z-EFpD)nmuN{R<5c_Z0AWJ)Jyy3%~_T-%Wn6FD;5%ZYYZWG>Wfo*u!?bIH~)vK>KvK
zw!`!kz~q8AS6FXQW|-^f`|RFwl>vr$`mv2L<pSz*i?Cn|%cIni6y;StCy?lBd4-by
zGm{bp(K*W27TfbmL(gcmB+~YWx9M7f$U~+Q;DXx{LusXy$d9p8;?(`N5Rh@`l*~M`
z+ojrwAo`*UlHP`U4rp&$VS!<-##N6S7g^&Q%+INOyJSpVLBbhCsl$|}J3Sx?2QcA`
z>c_%;rJ4J>&eZ*kgl210Dkvrc<YYvcerWv}q7iQSJG#SD!cL^B8O+lHwP1~xLu6;@
z!zd<w23a(%>tXf+?P0Yjd-?En`x~okh-E!ASgT}b*sJ6s;lhHCd;zh69AmXsctu8y
zkiw`pfq{G~NT0qfi3fgdzi_OQNW{MR=>i-hft$SBuuy(aK1`kz*&|d3lt~VHtI(b(
zzk?=vj{_-O*6it1*I98lEK-{H>0~(>_w=V=0&u;RcJXs@pXV>^uzIx3+oAX*B0&KO
zvzldW)6^2^KF<C_lq?`r=q=3T`MGZqn*{NoO2yu4%5VUA+K4G$(|lh*+!(KAvH?hm
zBA&Lx390IUcBI%~lRO=)tw5^XgK>OXR<h9&P817l=XUx?zHxzg+HZ&}e{{Pyi_WpX
z5%>JYA+ZvNV?J|&gY>3u6kP&rS4<wGos;C4yoh8x!*+d3``D#+pY(IegSe*fPoSGI
zrpntoB*kmMStr8XrdYPUyfC~y>m`FVIu|K;O!wVb5Q|0h>j*Hl&1^NxuH6uc)fB~2
ze+h^QR3mATNS%va-|hiUNR80s2H(~+ym;LzcVF#AOeL7PRqjh*@hy)?bdz&WvHQMq
zMnNv~6iYJM%`wqwX450YB>GgV{X0Y`jgR=48*=u+*zuTWXm;}=k=dd|ow)DjQpkAP
zRButlfH|gK(DapblGC<_H|8G$4q@w@y<Y*p7J><fZ|WMCA2JSv2nbC7Lm~LH*Xnuu
z0cR+`jaerwU=qYK($K}f!WB+<geA-n5kvc8o<e|DDJMK(nU=%BdV0YCtsTb*`p~9~
zP~P575ahr<%V1_$7rwaIIxh<)B=n^|>9~0DV0CG9kBI}e7U#V$y#Hlo|Lf%i`r3Ij
z4pBcWMYS4ze@?_ts%NID5J=q{4)N2M<vlrfsz|LmTKB2;4nAuJ_o$ymDAdJ8<qO+4
z0jQ^)*s&v4mjpPv-jiW(U=w;qWyjgG4BR1;43uS)EHTHHEZBfyxmKHUtk7#<X*?@B
zOk+LckYo<?)$udo@R!Ck1=cJVZ9K&}#W+x9qdG8u9&S#pfE-M}aRA05w(N|$DHwvh
z9!x?Qbl(8e^l&{jD!g|+yzfAV*H67~?*3U=l%k&(q|Z{)PrI)XB2j5(xZA-r5Gl?%
z8DhVXoG<0rAS&EHBG;|LqDk&)unw}w7nrIY#B6o8$wtbzYV<A;#U*?5F!ZxJv$<&G
zM8B8Fg3ZDn<De~vg{a+2AAl9O_0|q7s=r*Qc3f*MC0v$wdJoIJMdQUD<Kx?O@nJy=
zoX$nUb)NDfz{pdp=jar|^in*E2y?ved&ioli5K}$Ue%n2YLjWE?XZq13zK1>#WWi&
zlD@B37v9l)`jMbvu94w1WW<RDPnkjHKAtl3i+j!1y>9AuDSdXkFC1w~9%mZI#>Y&R
z=ZL)P9R<}v4j@oh-E@?0-A?kDrH@HQgkI#EctgAujQ5P7gB?`E3l=B6@WBmp{)QR1
zyp3D!#i+U&Hm?d4TTfAMM=x-9vLqGN*3T^yGJXjKsMBz?@oyU4hATeH>z;h3ZK$C8
zVe*_)QAFc0WP)&nTaU^}V^O}ltB-GpWM;j(ScvI%!0h%UAe1i7OI~AYn<SB=hc!uJ
zvJZX8m9BiDo+5!)<w7vjR;d4d=Hv>)p<SghHF>DUHl4jS!(-*w2A}c*KO`%A*De^=
zNZwOi#)^)R<X5S%zUjGjt5}Y3Bnd{)&A<Y&>1i-N*%689mmPiIyj$<xZB?6byR2c(
z&4*Nw|0qJHbvj07!D(KFfoN`amdzH8D0Y)y342_sf+X3hnWOAZ*;<gYQ^{TEgxIDs
zvjZAAfBnGwIaFFVhyGo6hXHKD)!9SJce;mnC|7$<2{ZV?LvAuVN@l|B#<inQYex0E
z@U7apayD<C(S{OE#5oxc5QtQ642V4lYJ79X`k>H~J{=-avdJn@vGH2$K_I0VSI@4S
zM6iuc#>62-R?!o5rlF8lxd99j)-4}!AGiAjdZ+ct7KWbP^2uzXPH*69o0vs-l2X4h
zWoO^MTV0M$-@f|=qCe!2nUZ^bT<mL5=ZDx-2kYG?;Ha3;dcBxW*Svwd?#}b>*VfKR
z>&EZ^!LWk-8<{{@jrVZdV8K1Bxf@~T$U=e+cD85&?rwFSZYb%CWJ|4!4Fc{0P)vbF
zKq@nmqW-a?*w<Kp9?P1KMbDf^?sw~neU0>wTwfLY8vISGp)zE_eg@D_%8pwvpN69(
zj$T|?7{&*zsWuyv+9j5S$i2y!)<Fe4{PaYJ2iJpRacqy0dmt5ia~KszIDC=WxoLak
z9+o9-sE3$mR`TSrLtew_yN2#Iv5SR*SU9u@c9`bP<=BAmWdzzdE!g8r0yMX$Xdk<;
z_EeHcY}*TFu$&<#8~9mH+~VZa$V2YgRNLuSySEWdOg@~AN%AqgUF7UuY^4r;8>}J&
zl%nsvdsF}xkUo1Xxso>Fc@9{l*|S-i>CI12`~46Q*pi)j<_-r-L~ohF-ra|1F3vi}
zhD{MRMp12zj-|2SFvf&kFrivOq3A9;*VyW6A?s@!@eTm#v|Z?gT@UH5z_aC18+ZTh
zeS&Rb+^pQJr!Uc}9y5Nz;=@+e$`<T!b+DA>oKxiw2fpYmbwAoGsH9M~dwZrB<kbQf
z7oDWg+1@|6D5~UB^hk>ovhPZ&*zhQf;Pme=GA{LsU^;x~L!x5b+u<nFlTygmq+xy_
zxP&%WC!fX}1juJUuPe<`<FlT$nW)MuQ9G{96MQGw_hgv-rAc!V_mYm^G@BQe${H~i
z+Uo8DXWHSk#@dX91gDb-_UtAoKJ4`XEYgWpz`5SV2IHFp(D`O@37Nv=mxI{6CSPR6
z2ks=2!P%XOH%<jKdQ$l?mwl0~!Wl=o21kdT$p>JN8bYHe%K4$B1=i9g;~}OTXs=l?
z<Dy_}(5dy9d`1x&j@etD)%lsb0$(~Xq3TmjWRk}8b|_l&UN=@)>@@nGC}jr9+qaSG
z;Vx~J#_8{B#yvb6=VBb)W!eC`nkbv_CsPIblko4hz1CX&0LxFus8!(cC3zi@B)Y6a
zFX9PwwTnCo<8{nyn9IeSvy_B&p}%BdG)l|MjCWw9I}W9zU8jr-;dlpkuxi3>pO;sW
zG32fey6}2k1p2@?7m_8!SRoR1w2-7n+2;qisVN<>Jk+B<anH$<wo`tFUSHyDC{ns3
z?LxIQcCB05mh-C$qO*}`fLW|wsA3=O`g|!G6(Jv&JSW#9SIPpFoi+-wfhXWVqoxOs
zNE$6jLk(n`up1|*8uJl7c|PyKi9B<0!uf<savFS#>%%*YLr6}6S)Aq^^C52;fhis}
z(+x)vL@e)XiL`LFk}y=GEu<TzJ0aA4S~y(epBV@lJuR8`1|!=(L~{?VKW9lJA&<n&
zwx1S#Iz}QL!yAPQ)e#Rt&$mU5az-8w;|ZSrkPCtPgjaVLlXcU{KHntm?k?w1O*QGl
zz0*WG-J}(pFM>1h6c^`N7d`4axV+C&G^lbIwM8RrNKRUHoh}U>tAK-&>`s66hHR?B
zz-PU}FTzne%L<bp@XBF_CIaIk9;nl0(cTxPu1Sidey<pPeBaZIIewhe875(M{8)8c
z+OW(&H~>4Lj=F5nBQt}1&}5`y%21|x_zb5bR>di!`4stE7Cb!LqE{m3-q`Rb2E&*H
ziEo(nn+Cci32>Jn_qU>1AZ3;DTC#R29g{?qc`22nokn(p6bT91Jag{c7<@9C7fiYL
zr!?<)v9I(u2ch_hs~4)Bu2Xv1EQY&h0CXddl^enmpT99ov^>CXV~1Ye&LP1GZ+#C|
z+_)-}KcT%*5O%d|Jw-?9ZTGg@Wo;9H;;b+alsQF~lTo2`vsp(f>K-U~ef{fb_D_Wg
z=kkl}FNFze?qLP{Nn`oD97Xm|V|RNlb4#wjX)}MvG5;&>3e5RWy@vi$<f70Er2-=%
zAe;lf>otG#^ryvtA#rkqa(O`=VjzRCB_3SRfT{EuOv?bh4u!pL00G;OMm;_QDcu6N
zh|lVDI90X(D3No>BlvBv_mQ<PMU;m^6|$%8oY2sN%ntFnQ8c>+1(p%9{#C$iA=52?
ziAUnbYZmFLN0~{ACmyYROH0pNS)=SfTs-v(=}I1j*Tk}N6%vHdSitDpCNe}zX8aRn
zzgftcH8lHjnqaim&eVnA*Uco^KESY~^(7_H<m*N%5nA*-)!CU#b#`F4XB9PjHXfbe
z7%k2d>^iHfnOMa-ND+8*wA_GG=T2p6?%m6ur-|G8g%cfW-bU4LFgS(;RpBR-F94uJ
z%*^CFC(rGGb`fa>ZeeMld!d$uu9(&7fYA8En5W$a3?7+yvr*{Ep;^?#oji=*Q<}X`
z3g78qL6Na8(lzl9)>52I<G;|QvaZW?YV!4Km61=r!A8N@o-tEAiW(|Sbij$%!Re*l
zPm@{Y^_eu8>3O*pTJZ==uGkTmkc-48k0CcQzMk>~nuAqw1B0e;E4#^rc}Ahq^<?_y
zr`z7Fi?*7e%mgr%d=A56q#}w%Q;b^CNL_nrre>0+abW<(A~TKAT9V#WjE8Vbt>Amo
z&Au3TkIKr%_?b^#?j%%HKu64+RxDFn`0h&$>w#DTyB#anav+t;=K7s^#K8$(5i;)Q
ztDR@Z7v~Z-1UA(R@Ex3I?n{FTsRrmBaCxG!dY^=P;Q>a`Z^bh!PKY??1WE~GDUq>h
zhD~zs##17b^gp+_^*_w95y|#ckhI163Su^-denm-|5b%)P3hK!%Ln4?gUwZhXB(m5
z*jz@o-Q^|tzeo60a5}j-I$626*;%=2d)yvX<y7HNRtGDULJrh9R7W?pJlKaIPO9o!
zJarHrfqFin20j5jr&BC24<C=f8rz>*uHXy)4HfPoZq5U>YR=JFRkc}m4OXsg6%MvR
zHB~h(#HgUNmS)yL(vrai<4ctm5eazXzl+S5?q3dEg!j@{&%e^_8uok9`O5fezyp6t
z@t-8<YleU7zgGhB_i?pw`{ncxx%k@CE1mm?$<^~pF#bNS04tZ%OTZuU@qfo$3CQ2a
z6$T0M2j<U`_1}S4g7P(x{a4_1x%xrydx7}}1w7FB_XPhUH(zhv?-jLc?g8Xq-s*>Q
zzjFUpU;FzSe?P2WuQ7r8f3NZV=zh)l`*w4^sTTM@#oCYN^J7E*3BGDS*WkE+f`94<
z|K`M1tX}gB{438dedU@I72$X7=?5)55c4v6{>q~7Z}yXOzmWdftbXSHU3IzUF1Zv^
b{vX`ewMJ7F@J9w=BVZ!{E<?tW=!*0|JniiH

diff --git a/tools/mdcheck/lib/sdss-mdcheck-1.3.jar b/tools/mdcheck/lib/sdss-mdcheck-1.3.jar
new file mode 100644
index 0000000000000000000000000000000000000000..3553e0451f47a7982c5d4d1af33d434fe399e42a
GIT binary patch
literal 6812
zcmb7I2RN1e`#&A)Sdo>zBEqp}Q6$1~j6=xE-iKq)6f&|m*~cbigkvOo&#WS4Mj1I)
zwjXbAuX^8p@BjDzUe`0O>$yLl`+lD59?$oq0>Qw<1Dq{&XVlF<ZvH&so?f9c>QZ2N
zC0QPoKg~b@wNtYOX$Cx#)5jjC2iebNP$?yOSs68TZm8@gw6{kQ0_Gkfgn&8vdj~3D
zydwhB3l3Zg{heG8@NE#ze6~g`1!p6RTTMy`j1&S>b4ukXCZokCi4lO2dy)3QHcy`@
z2skP<&OUn@M{FBhqNyO<X(J%v=XQlupIe_B@FOY!fJoE-m*6o@qjI+XE9`$7V1G9-
zH2xPG{J(4*O&lHn#gOz@L%4~tg{kqmcM#x?6Y6H9Ihh*mX<R9%uDO2?fSNiPnix76
zN}s`5{y3XDa2wkgIy$DRTdNJL5KB~pvqu1xDtBZsF)e$ph^vzkw`~+=gRgXVc0>k{
zSdc2h+8*Ty0K<ECF%DJ3J?$9kue)qXul2pE^V~`4v-LhYMw2$O2(#=`8s%Wf43mp2
z)++GjeWlv>i53<I=ecV~r(?HSiIM;bW*)9)<&p_<zA$m!A)GP>tt4UjA)(|~hcz^o
z#5;(cZq=o!DuVg$jBJ)d2l$G`t3z}lRsDlG6H5Afg2kL-b@_w$3M{nf_XIsXb8m<?
z@n#5T%71`;Sm)P{>U3(K-G*UDyYyRJXn|5eEiNK4RB=-YHe}ZLwTIdVOOoQFu93SE
zEEZR_u*$0IjN|Df8E-f)@HbxLXQ3u38jEs!NjwCtn_nXPsDt##rX|M@UbKj>v%Vpd
zW0M|(h(Nwh^JBj!thY0lxz=ML74&+$Cz6-|i9=*UU=)NWW~ZH7-N;K@r@l-;ZnEZ4
zFsnl#P}VN=f`Ll==9@6-ftO&-+bPIo^Z9u_lCqlJ2D5nH=0Vlsha8?wyzRW+CHpFl
zx-Ir`gk@}S>+#+M+OWDYBNRfWov@Q>m#@oTnQzw^4L(j~KyMlcSQODO5}U0nHme0R
z$R?Tg`ntZzT@K*%P&;~kd-SV&|8`9%R=t76#)_*QOwei6wu(R*N#me>2iE-DYEEO#
zlndQX=;0!UBmI23Ik{H+vUOO&*u>TgI8~<6i!PL3-C|CniPo<9Aw*~<U-e76Lo_-1
z!BgE}3JIxlwRo9_DucS?88a~)iAz@iw~pQegVrzPRfEzo%Z6<LGrV@h*F~B-I#LcN
zKMTs-$dX9h4Oquzey}tZ$gQ2+b|h{)#F6lDFl@3}=?f>iA~tHW*?j5U)lhwpeI-5w
zx%oCw3FV7n)f+f3#8r9}#N?yuv+tu)lT_B)$=6PrmnfHlH1^yg8}0zH$;!T->*8DB
zh)KKE)MLE$usCOhIZ85MY@EfLPBni?Mq6cxnE_a$O4-8C`pw^u#WaW6DjybmwY%Qq
zURUsACSp8!Ro`W%WliZ%g-l!dMo`ilj4Zxpk^Wzaezbw_b+$f|yfSfGXD2uSfbjoP
zXHa(;2M0R`MN3B~Q`;Z)7I)86lT?%VWQwKKP!AG{_mGCwsQfYh%gPA$dzU6(;%YUr
zYdsf9PA)~g%XSsP8n9Gm_}CnQ%)?Zc$YaQ0D9m#d5vR@|JdQd@Ox^42wKKCl-am-A
zbwROdh}baEMxqP_-y{E6{e|2U`c}Cp6XfQP<E1h6rY+AACT!A##+bn^U}}%lTD*nm
zS<vs(W`BWyV{mW)p)W5|+*fOj747L=$+WDIz}F(*VO`}r8P561U5}Rq|3C%e<5aI5
zK68gMFp@5=q43JlW1nLFEgb9c^fVKc$`U!MIjY&VQ-KoLawiv|{<x=(jcHLBK17fb
zkkAuPX;cvwJQ&qVMVLp$-ytN7ppYi;fMUwb9MsE-rF5APv0VoQh!8G`@;$Cbmjt-h
zChB=8WRDWo2Y#c<ybZ%Mzrm=~QY#I*Fay#bu$1E?V0iNSox}U!NPAtzG3c<OKkZOp
zY`CKw4Jt^Ld8=?vtcgI%{31>wxPVvyTd*}Q%F=*f&ZIRNI&*J_eO356%fwTb%N?fW
zP`GH5w!#HvYRV;mGR>}}Jp~ap9Vs2dj4`1mr4mC_nUAviiniKQU7qlPr40jHdwWAP
zGW>bs5TZD_n|P#g5vAmh#^A;{q4!5KSiUG+vZdxlz&gP1$9Ov;zl<WV8yXX0F{<Gl
zo*uz7M!BvDW}Dq@n%E7ph9BLM47VuT-AD8MusTRLi#_gln(Di>Ag$iM2it$nKM3c|
zl?^nkW&6_fG*8ON#E$-vN50;&ci2@;r>n{z59XI!S0pg(3?dCBSAykp6xOCv<wu24
zTlpjed&ZFn)Z@F(<>Bn~g}Eo;nLQ>DYI*_6y1pEG7P^Q?jSzT7X02)#?wYvNJ}iqB
zj(iz3#r-XT9Fu85BGYPYp@Ao8p$UVQS;qbD=kY+wSL}kyTi9&(4u<Jfl>w1*`2ks;
z4DvyYZ<GdCvF_iod_ZqKr#^H@*D}CsC|k{Y2()|EToX6H2M>)rgwed4#{@f7Sy&qv
zh7rkIrc|Nl^WgJoOi~PXMfI&VD`?1kdf<nUm*Frj$vCfZ_F$nDUq8VyOD;NHpAhSO
zV_f=A@|>ejaqv+XPx9<aDL++7Ubnw(!a|dM#QiXA2ux+hFC7h9J^J)kSmB^yTZN<R
z0}(p#y0+);5sG0}pr~H>3pUbrM^f)0e1rjaJMTmW%Xz{t70+84#W!)cw+#HAw;Ekc
zm9_Eg#kz&57fpTG1_k#sQk~KrI>IRYX%X#5xo=_%n7omXd>@?LdmJT^cg0Xzra8u{
zfIU?vNIl1)FymfQb$(IQqrZL{zIThsLy2X`>8}oy900ibKXi*fr?Hm1SIh$4$xX|N
z?3o2#^+*T?u*%K{;VxNv5%TQa8w#C#iuY(?cb(hAB2&pCFc-To0ml7(a8U%Q>Rne9
zlosw|+pDKECE*-+ohPME+4V^1+ru<ksDeUay7$J-fdlc^2i^xuCrW9+QoNJxMpk0E
zZ`ffLyyTD^--l&ON&*u!Ho|mQ%tU3gyfz!byv7OkuP!N4YABahS|?CBi|3Q9N2FHe
zfP0n{5`m*-C4I6Z@)MqzTR~4KK^M1JeUAcC`B&8uYWzuS0^r4NC-F-Ht6Vm623GIC
zDBnn)!>wpry2A9xB-E?UxTBaJ=uS>-3F-}ISxuW>6B;t$dY8b)X_!(EsKf$_RvG5h
z#<)B{SleoLet7Pb_hdx4MQpW|v`J2!)l#Fn!;`B;ev-_l1+`2V<shv4J`qW0#aO^G
zTon@?2EtdDUCkbXKt|IF;7#(wk|Qgwv+|tk<4n`GitUOFpA6D)9I?#e9}n{~;A7@~
zi-{gyqa4!bpvze&uXLsxMFH?7KxBKB50$(54g|TH{hwrp0vF9#g4q0Y_)Tnvm+;+7
z?-=a3SyrrV%`(FXb;2!mWSKM6^%&L-`MwA)<>&3w%xb*1WZWj<7<ZN%T%guqlvBxi
z{qdy{um|FkW*<w=G~dQ?Az}VHj<sM>TN|)}e%Ml2?OIl#aDIUVsTd2@gTfhp+*Rl3
zXKD;%#(p@+l&BCWa>k(`>MoU-;hx19r(pd>n$OIRjBAJjLP#Jqq7_`hIyG)Op(AjA
zHi9KfHnXL4ZbQP8-9#nPy)I%?Tp$}_l^C-1MoLXYRbzJ}7DivMIxUXNw#nRfXz|ev
zemvp#3FzEXjCHvf$l2e!1h#@JYEPllUc%)D#g&9GOU9;s#sgh!HVrsq9Li;+q;X1+
z#axcxL;*gm_ZiaSE~ZXArK7jGtffVv)#8i_rYb1;eBInU<ycEyxW;sKsb3SUSp=DG
zmJhm`v7KC1bUQe>v1;N?38yOMRXw{e*Ts25xb(~MC~BVHZBbX;WV$$Ztam4kON0=2
zYlu=-uv<~59yVP#p~+;`1)EA!oK%hRR-A>?Z{c&L>Pn3p_<cxjAH0SlLuESM?JU0r
zmcDR-;`PhM?s5g8ua?nq$}Tv={BX<ODQfIe^Iq{HRl*k&;&UAFey*K``%0$;2Fn2!
zm|XA{`LNvNiOJ1wOhEXx<>3CRTCQ3)I8}Y3TSkRL*p5q~mrpJZP~1mVy^FxO$+&%(
zVMXmP|E5_sA2j9VavN^Ok&5to8}cxE5Lhq|roQQ`^KN2u5QwY@xZ71nU^$w=If`fw
zh@@kk2MAi?RBVwt8@>aXI93gFsM?M5(h1~F1J>538U0?laSg3oddVs&uC!r0`jV=Z
ze7%;4*bx`R3Pim1t8>868!8T{vnP6vG`%P~cf;I_j6nYW&F6-Af;BWFDun3~bpzH*
zx7A@MnE?mutkh<CQC6x?L<4NT&2n<Z^(Wf;SQrxFCe{?PJf#~&aGSZK@3l)Z1>e`I
z4G`?T6L$Fu(9v0sNU*Z9vZ@j%Nt;@yy3z)2Wj#R#s>ZArmGTE-t{bRN&+=37Oue07
ziZ7T<h<Chi2}I7KcUPS6@7P_T=xGn;V*40te+YJX1bzBooT=s04eExFz$JocdXWfI
zJ)Mqzv3pUyeG50$4bpKUKFMN|bJ4&j-(E5954>BdOtH*hwR_2%i`O4Z)Fy|vCAuX~
zU#F`16SjjG_n|t;-m}K?uC4vstsO$*KI!-=EpJ%-m9`ysrcjfS!*z8obzBa>*CXp5
z@7AXt%D#{8D$9yZt#?ZTBa&%p$8mytse^RNS8-z9=WW}9$)jyky~Ll-(Bvo7Eed&&
z;Ma?SOB0R9v>LH9Q<&%+u3cSjvjb6GtWpAQREK^D6}zgCimOskY51*Fs-Fufh~aDB
z>Op2sEpwHcRNDU|4wf48fM)#q*t>u`nRoPcD3t|QxSwIx)UIm@=ofov+$R(2J>Z{`
zyo$+bcIh#7xY%2NurR9qNtD8~mt}c;;}>%ylJQF;FTk1}uog}ysPVt<Ju3Guj3d8S
zOxuB~HK}A<5wrTb7*QGS$#9}Y?JkgP_X@Fzo&SQN-JNLqP?c+Ki-%6C_-3f-ah%t>
zkx+u6E`O-=+MI=GAxOVKt7dOy-tk7f5e{dsv&DQ@5rMo7%(qLAR5%6+F(XblOmi>j
zq#>3HAu+~R=0qtCM;P|-P9(8TT7MmI+_)C(`P8{$mbg=L4(e7h%S&kI(@W1oxT!(;
z#HGtDdST%cR1sYh_AO3#JX-nN#@t&m0_#_v;htnlc@3dB;}O%VEp7?oHOLBYOp!1n
zyG77V!BC=z@dFL&{j9@)1In?;l2|KvfQx=%W&L=k&RSu`^&-|oc&s-EcXJ0Cmz9R}
z=5lz#9=FhPj@N<mv>LF_FR^X~bB)Z67#-BV>A82~_R!6aIUW$L*TNQ~74tFAI77#g
z-@42pQ74^GI9+3O3M4QG@|5kBhgZst9Ic)*61LIWwA}7|cU*tW9ktTQy|TJ=Vw_Su
z99(;x+bI;nvr4s_#8tE0N&CdL_LOyq2!8((#gSy8HXGPJ^(aN_3nN~y)Vj!tRG4AY
zgeE^1vtWK~iENTF8CogT<CYunqsvSZpQ{Oh=M%Jq7O}UGyU572Cx@u+#w|S7z4y%`
zPb-udnp*bR>5)CJZ#_BkXd@2)+=2FEa&p}3BChHLI1|nBz48X#b-Fgd6M*=d$P4*w
zIZZkGItll!)F(E+2t4l06DRQ}jQ%wQM3+Ie+&oLy$ysUn(46AWo`RUlFO@-W-E$Yo
z9Zo;aD^H{GUmD@mh?pL~^liZ}QTxTfVvm4GZL8PO$c(1G8J>hl&}Q-x50@HJb$I0w
zU&W@-!Gq|!ESA;0^zk7I2Y9y3{Dfki$%thJNu%-B=$v9Xo7(}4-}be_O~Egyl6HYs
z?|42mZCSc`_iM?O;nqh{_ULF>h0j}c!0VQ;HQbF}hdy|lem?XER|w~st3v&6*;mW2
z9{1{nOdMgAQ0aTKA6I67j4!-{Qy9z8-YpZSP@7EV`XQzna2yXUW7S=N=k!J%v?HC!
zG7jlZIx|Ddo^`m1UcYql5zq6*TWFqpth%)In8$siGy4pv<G(g<{}iBzPJhS#5}@FQ
zE~d6WNics`tEm5J>}<_#Xw3aL>E`b^wtvN)fx-WjbJXonH$StwNvZ+?fCH@Wa?al(
z{mJ<+BnUe=w;S9hOufr?l9yPb<AKz!?VA#{3?VI~1U6z2Xc;_DHb|B=7%%4&lHmO?
zFxy78id3DgKUrjQPUWSL2N)%NkgKsXx!YIcA|=;Sb=z=^|M+UDF!|p0X4?DNYiZ%6
zj%C#wtshoh+(aVkm4`ovicj${FqRsU78Dr=hoC`BL0WG?JVNG5R@)2<gPx%v#j0wa
z;e=}+CLMGoaVM5wBafbxMZOBcWv4RmQKwp+tSeuq=@qTYsf?v9n>KIn(rl+oY!b6n
zVDA=*H3@I@GZQX~F60>NRe6)#RI`fLzn&5e*U&4IO<4$2S&wUWxH6dmMK76vr!I(v
zF%$AtMECPLN`@hdOv0Ho$})KQ8z?kHLs}bznzdD#3kHW<Hbin+l&OQ=)GntMBEvF#
zJ`yVc=?_WPILp(q1h90MG!+80teiQmrkV|!>OZeqd{DVh5lzQfzVcXfo=$BEM|NQ1
zd0{$DeJOc)0BD;ovl&ZTIhI9`ue_?IVf$r+v%!Vd*h8A}<)Vp3=PvI<#uG6f85+XV
z9Xo$;3@G-_4YZsxL3PyU*k@I0mE?tF!98S=(t(&J`1LyqwM}cXu2s2o#wb*jlWv#T
zv9GxwVVG?XvY;6kf9P{cEmMmN{|%QEIZmEswVZVoE26K>J8}URo0{CDj@R1q7C$c3
zB#MUgU4=dZl_YD7H7ml_g}~*AlF{cy^<v<zg}cQ&0r+lj)1{J}8kC%R)tgz3TpN_Q
z+PXFU1@ti`TK38XHl(cAzlsfS1kol0Icf3(@9xiB&U$pNft(4n!=4ShW~Z5Ld3p%_
z?-_oUoCpUygsFp*rKzKui*g?XtiUA?Rh27LUx#u*`sQF4uR*c+Imts6$q1lDilIfJ
zV6qfnX|hlP0>YYZSV*wI=B5qdc4*C;kPQgFxS9>5Vw)spJ6J6^q=qC!fq$4J2J$$Q
zvBB0>!9mu_LHP3NcI*O>4CB8`(5KO#E@Hr{)Y<i~Dm#b$UXngDK3my7zf|~70`)n=
zKh@zg`S|-fbNuS`_75@nJkr1G&1Z7*_jLyNaC&<R_(NR&@0c@r`TIJ<05AN&{MoVo
zJMc_yJ_mCC3Ow&tKL~y=KmVY}_R;-4!M}*n=b!HPlG{0VE9Nh6^&_}nxqmCb{oTjk
zH|pm;HbDQkkMG;|bI#vSn;#$b<iv;Mr(F9ndwzV-e}d1Z&pEi{pWvUy!M_D@maFGH
zpZ=BSm$7nA3IhCYI{l!{_TfCup1-Q-`<wj~+%Kem&Z?ief7e{jxjRoql>Z0!d8<)@
UVEs`+7XcRmSf?rDLvcp>ALzLd_W%F@

literal 0
HcmV?d00001