to achieve the desired result. Sheesh.

running servers to avoid the big perl startup costs we have with starting a
brand new script each time a request comes in. At the moment, only the
sa/cm/am servers are going to run combined inside the new server, the other
APIs will use the old method. This new approach reduces minimal RPC time
from 1 second to 0.05 seconds, which makes it usable from the Portal web
interface to grab cluster data on the fly.

out to openssl, use the built in Crypt/X509 libraries, which is a lot
faster. We still have to call out if we want the URL, since that is in
another section that we cannot get, but that does not happen very often.
We also fall back to the slow path for some certs that use the Authority
Info Access section for the URN/UUID, since that is not available either.
But for Protogeni, we are mostly on the fast path.

so that we do not have to load a certificate from file just so the
context creator can get the filename out of it.

we already use on the mothership. Enable for the APT cluster.

interface. We do this with the AMV3 PerformOperationalAction call. The
actual updates are invoked from the apt_daemon; after a key change we just
set a flag in the apt_instances table.

Also some unrelated debugging code in APT_Instance.

type constraints, which means having to calculate type usage for
the experiment swapping in and making sure we do not cause an experiment
to swap out during a swapmod, because a policy changed.

the apt daemon that updates need to be pushed out to the instance clusters.
For now these are just ssh key updates, but will might expand to other
kinds of updates.

Have them contact testbed-ops instead.

Right now this is not run on a regular basis or even installed for
that matter. Maybe later. It can reduce the cache based on a variety
of criteria. See the script for details.

Differentiate a missing image file from an invalid image from
an image for which you have no access.

This is for the benefit of the cache cleaner so that it can find out
if an image file is still valid and/or up-to-date.

Now, we treat values < 0 as meaning 'no limit', and 0 means 'limit to
none'

image_import by URL to get initial images.

admins see it.

size, which for the first time has bit us. I need to change the schema, but
for now make sure we truncate/uniqify project names longer then 32 chars.

First, a "bug fix": By coincidence the snmpit Cisco module was able to
build up the mod/port-to-ifindex mapping on newer switches where
interface descriptions include a submodule ID (e.g.
"GigabitEthernet1/0/1" vs. "GigabitEthernet1/1"). However, it was
actually just grabbing the submodule ID in place of the module ID.  This
is OK (in some loose sense) for non-modular switches where everything is
effectivley on the same module. Not good for IOS/NX-OS switches with
actual modules and submodule identifiers. Things would not have worked
for these.  As a fix that retains backward compatibility, the Cisco
snmpit module now correctly extracts the module ID, but subtracts '1'
from it.  This allows existing installations that have zero-based module
numbering in their database for non-modular IOS/NX-OS switches with
submodule IDs to continue to work as is.

The above nonsense is not what I set out to do, however, and the commit
just gets worse. I extended the hack for non-modular switches with a mix
of gigabit and ten gigabit to bump any ten gigabit interface port's
module ID to "1". The existing hack already did this for non-modular
switches with a mix of fast Ethernet and gigabit.  Absolutely horrific.
I need a shower.