Check spelling of server API POD and tweak server docs

Also update the POD syntax check to the current version of that check
I use elsewhere.  Since I'm touching all the POD anyway, also rewrap
all of the POD to 74 columns.  Fix some references to MIT in the
Wallet::Kadmin::Heimdal module documentation.

18 files changed, 731 insertions, 584 deletions

diff --git a/perl/Wallet/ACL.pm b/perl/Wallet/ACL.pm
index 9136fc2..76e7354 100644
--- a/perl/Wallet/ACL.pm
+++ b/perl/Wallet/ACL.pm
@@ -1,7 +1,7 @@
 # Wallet::ACL -- Implementation of ACLs in the wallet system.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007, 2008 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2008, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -21,7 +21,7 @@ use POSIX qw(strftime);
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.05';
+$VERSION = '0.06';
 
 ##############################################################################
 # Constructors
@@ -427,6 +427,9 @@ __END__
 
 Wallet::ACL - Implementation of ACLs in the wallet system
 
+=for stopwords
+ACL DBH metadata HOSTNAME DATETIME timestamp Allbery
+
 =head1 SYNOPSIS
 
     my $acl = Wallet::ACL->create ('group:sysadmin');
@@ -445,22 +448,22 @@ Wallet::ACL - Implementation of ACLs in the wallet system
 
 =head1 DESCRIPTION
 
-Wallet::ACL implements the ACL system for the wallet: the methods to create,
-find, rename, and destroy ACLs; the methods to add and remove entries from
-an ACL; and the methods to list the contents of an ACL and check a principal
-against it.
+Wallet::ACL implements the ACL system for the wallet: the methods to
+create, find, rename, and destroy ACLs; the methods to add and remove
+entries from an ACL; and the methods to list the contents of an ACL and
+check a principal against it.
 
 An ACL is a list of zero or more ACL entries, each of which consists of a
-scheme and an identifier.  Each scheme is associated with a verifier module
-that checks Kerberos principals against identifiers for that scheme and
-returns whether the principal should be permitted access by that identifier.
-The interpretation of the identifier is entirely left to the scheme.  This
-module maintains the ACLs and dispatches check operations to the appropriate
-verifier module.
-
-Each ACL is identified by a human-readable name and a persistant unique
-numeric identifier.  The numeric identifier (ID) should be used to refer to
-the ACL so that it can be renamed as needed without breaking external
+scheme and an identifier.  Each scheme is associated with a verifier
+module that checks Kerberos principals against identifiers for that scheme
+and returns whether the principal should be permitted access by that
+identifier.  The interpretation of the identifier is entirely left to the
+scheme.  This module maintains the ACLs and dispatches check operations to
+the appropriate verifier module.
+
+Each ACL is identified by a human-readable name and a persistent unique
+numeric identifier.  The numeric identifier (ID) should be used to refer
+to the ACL so that it can be renamed as needed without breaking external
 references.
 
 =head1 CLASS METHODS
@@ -481,8 +484,8 @@ finding an existing one, creates a new ACL record in the database with the
 given NAME.  NAME must not be all-numeric, since that would conflict with
 the automatically assigned IDs.  Returns the new object on success and
 throws an exception on failure.  PRINCIPAL, HOSTNAME, and DATETIME are
-stored as history information.  PRINCIPAL should be the user who is creating
-the ACL.  If DATETIME isn't given, the current time is used.
+stored as history information.  PRINCIPAL should be the user who is
+creating the ACL.  If DATETIME isn't given, the current time is used.
 
 =back
 
@@ -492,42 +495,43 @@ the ACL.  If DATETIME isn't given, the current time is used.
 
 =item add(SCHEME, INSTANCE, PRINCIPAL, HOSTNAME [, DATETIME])
 
-Add the given ACL entry (given by SCHEME and INSTANCE) to this ACL.  Returns
-true on success and false on failure.  On failure, the caller should call
-error() to get the error message.  PRINCIPAL, HOSTNAME, and DATETIME are
-stored as history information.  PRINCIPAL should be the user who is adding
-the ACL entry.  If DATETIME isn't given, the current time is used.
+Add the given ACL entry (given by SCHEME and INSTANCE) to this ACL.
+Returns true on success and false on failure.  On failure, the caller
+should call error() to get the error message.  PRINCIPAL, HOSTNAME, and
+DATETIME are stored as history information.  PRINCIPAL should be the user
+who is adding the ACL entry.  If DATETIME isn't given, the current time is
+used.
 
 =item check(PRINCIPAL)
 
 Checks whether the given PRINCIPAL should be allowed access given ACL.
 Returns 1 if access was granted, 0 if access is declined, and undef on
-error.  On error, the caller should call error() to get the error text.  Any
-errors found by the individual ACL verifiers can be retrieved by calling
-check_errors().  Errors from individual ACL verifiers will not result in an
-error return from check(); instead, the check will continue with the next
-entry in the ACL.
+error.  On error, the caller should call error() to get the error text.
+Any errors found by the individual ACL verifiers can be retrieved by
+calling check_errors().  Errors from individual ACL verifiers will not
+result in an error return from check(); instead, the check will continue
+with the next entry in the ACL.
 
 check() returns success as soon as an entry in the ACL grants access to
 PRINCIPAL.  There is no provision for negative ACLs or exceptions.
 
 =item check_errors()
 
-Return (as a list in array context and a string with newlines between errors
-and at the end of the last error in scalar context) the errors, if any,
-returned by ACL verifiers for the last check operation.  If there were no
-errors from the last check() operation, returns the empty list in array
-context and undef in scalar context.
+Return (as a list in array context and a string with newlines between
+errors and at the end of the last error in scalar context) the errors, if
+any, returned by ACL verifiers for the last check operation.  If there
+were no errors from the last check() operation, returns the empty list in
+array context and undef in scalar context.
 
 =item destroy(PRINCIPAL, HOSTNAME [, DATETIME])
 
 Destroys this ACL from the database.  Note that this will fail due to
 integrity constraint errors if the ACL is still referenced by any object;
-the ACL must be removed from all objects first.  Returns true on success and
-false on failure.  On failure, the caller should call error() to get the
-error message.  PRINCIPAL, HOSTNAME, and DATETIME are stored as history
-information.  PRINCIPAL should be the user who is destroying the ACL.  If
-DATETIME isn't given, the current time is used.
+the ACL must be removed from all objects first.  Returns true on success
+and false on failure.  On failure, the caller should call error() to get
+the error message.  PRINCIPAL, HOSTNAME, and DATETIME are stored as
+history information.  PRINCIPAL should be the user who is destroying the
+ACL.  If DATETIME isn't given, the current time is used.
 
 =item error()
 
@@ -542,7 +546,8 @@ the ACL (not including changes to the name of the ACL) will be represented
 by two lines.  The first line will have a timestamp of the change followed
 by a description of the change, and the second line will give the user who
 made the change and the host from which the change was made.  On failure,
-returns undef, and the caller should call error() to get the error message.
+returns undef, and the caller should call error() to get the error
+message.
 
 =item id()
 
@@ -569,28 +574,29 @@ Returns the human-readable name of this ACL.
 =item remove(SCHEME, INSTANCE, PRINCIPAL, HOSTNAME [, DATETIME])
 
 Remove the given ACL line (given by SCHEME and INSTANCE) from this ACL.
-Returns true on success and false on failure.  On failure, the caller should
-call error() to get the error message.  PRINCIPAL, HOSTNAME, and DATETIME
-are stored as history information.  PRINCIPAL should be the user who is
-removing the ACL entry.  If DATETIME isn't given, the current time is used.
+Returns true on success and false on failure.  On failure, the caller
+should call error() to get the error message.  PRINCIPAL, HOSTNAME, and
+DATETIME are stored as history information.  PRINCIPAL should be the user
+who is removing the ACL entry.  If DATETIME isn't given, the current time
+is used.
 
 =item rename(NAME)
 
 Rename this ACL.  This changes the name used for human convenience but not
 the system-generated ACL ID that is used to reference this ACL.  The new
 NAME must not be all-numeric, since that would conflict with
-system-generated ACL IDs.  Returns true on success and false on failure.  On
-failure, the caller should call error() to get the error message.
+system-generated ACL IDs.  Returns true on success and false on failure.
+On failure, the caller should call error() to get the error message.
 
 Note that rename() operations are not logged in the ACL history.
 
 =item show()
 
-Returns a human-readable description of this ACL, including its membership.
-This method should only be used for display of the ACL to humans.  Use the
-list(), name(), and id() methods instead to get ACL information for use in
-other code.  On failure, returns undef, and the caller should call error()
-to get the error message.
+Returns a human-readable description of this ACL, including its
+membership.  This method should only be used for display of the ACL to
+humans.  Use the list(), name(), and id() methods instead to get ACL
+information for use in other code.  On failure, returns undef, and the
+caller should call error() to get the error message.
 
 =back
 
@@ -598,8 +604,8 @@ to get the error message.
 
 Wallet::ACL::Base(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/ACL/Base.pm b/perl/Wallet/ACL/Base.pm
index 004de75..9a8a3cb 100644
--- a/perl/Wallet/ACL/Base.pm
+++ b/perl/Wallet/ACL/Base.pm
@@ -1,7 +1,7 @@
 # Wallet::ACL::Base -- Parent class for wallet ACL verifiers.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -18,7 +18,7 @@ use vars qw($VERSION);
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.01';
+$VERSION = '0.02';
 
 ##############################################################################
 # Interface
@@ -59,6 +59,9 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+ACL Allbery
+
 =head1 NAME
 
 Wallet::ACL::Base - Generic parent class for wallet ACL verifiers
@@ -74,9 +77,9 @@ Wallet::ACL::Base - Generic parent class for wallet ACL verifiers
 
 =head1 DESCRIPTION
 
-Wallet::ACL::Base is the generic parent class for wallet ACL verifiers.  It
-provides default functions and behavior and all ACL verifiers should inherit
-from it.  It is not used directly.
+Wallet::ACL::Base is the generic parent class for wallet ACL verifiers.
+It provides default functions and behavior and all ACL verifiers should
+inherit from it.  It is not used directly.
 
 =head1 METHODS
 
@@ -84,8 +87,8 @@ from it.  It is not used directly.
 
 =item new()
 
-Creates a new ACL verifier.  The generic function provided here just creates
-and blesses an object.
+Creates a new ACL verifier.  The generic function provided here just
+creates and blesses an object.
 
 =item check(PRINCIPAL, ACL)
 
@@ -99,11 +102,11 @@ have failed.  Callers should call this function to get the error message
 after an undef return from any other instance method.
 
 For the convenience of child classes, this method can also be called with
-one or more error strings.  If so, those strings are concatenated together,
-trailing newlines are removed, any text of the form S<C< at \S+ line
-\d+\.?>> at the end of the message is stripped off, and the result is stored
-as the error.  Only child classes should call this method with an error
-string.
+one or more error strings.  If so, those strings are concatenated
+together, trailing newlines are removed, any text of the form S<C< at \S+
+line \d+\.?>> at the end of the message is stripped off, and the result is
+stored as the error.  Only child classes should call this method with an
+error string.
 
 =back
 
@@ -111,8 +114,8 @@ string.
 
 Wallet::ACL(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/ACL/Krb5.pm b/perl/Wallet/ACL/Krb5.pm
index 1c584c5..496fcf0 100644
--- a/perl/Wallet/ACL/Krb5.pm
+++ b/perl/Wallet/ACL/Krb5.pm
@@ -1,7 +1,7 @@
 # Wallet::ACL::Krb5 -- Wallet Kerberos v5 principal ACL verifier.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -22,7 +22,7 @@ use Wallet::ACL::Base;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.01';
+$VERSION = '0.02';
 
 ##############################################################################
 # Interface
@@ -50,6 +50,9 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+ACL krb5 Allbery
+
 =head1 NAME
 
 Wallet::ACL::Krb5 - Simple wallet ACL verifier for Kerberos principals
@@ -69,7 +72,7 @@ Wallet::ACL::Krb5 - Simple wallet ACL verifier for Kerberos principals
 =head1 DESCRIPTION
 
 Wallet::ACL::Krb5 is the simplest wallet ACL verifier, used to verify ACL
-lines of type krb5.  The value of such an ACL is a simple Kerberos
+lines of type C<krb5>.  The value of such an ACL is a simple Kerberos
 principal in its text display form, and the ACL grants access to a given
 principal if and only if the principal exactly matches the ACL.
 
@@ -111,8 +114,8 @@ The PRINCIPAL parameter to check() was undefined or the empty string.
 
 Wallet::ACL(3), Wallet::ACL::Base(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/ACL/NetDB.pm b/perl/Wallet/ACL/NetDB.pm
index 6775c62..2096ba8 100644
--- a/perl/Wallet/ACL/NetDB.pm
+++ b/perl/Wallet/ACL/NetDB.pm
@@ -1,7 +1,7 @@
 # Wallet::ACL::NetDB -- Wallet NetDB role ACL verifier.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -23,7 +23,7 @@ use Wallet::Config;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.03';
+$VERSION = '0.04';
 
 ##############################################################################
 # Interface
@@ -135,6 +135,9 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+ACL NetDB remctl DNS DHCP Allbery netdb
+
 =head1 NAME
 
 Wallet::ACL::NetDB - Wallet ACL verifier for NetDB roles
@@ -154,9 +157,10 @@ Wallet::ACL::NetDB - Wallet ACL verifier for NetDB roles
 =head1 DESCRIPTION
 
 Wallet::ACL::NetDB checks a principal against the NetDB roles for a given
-host.  It is used to verify ACL lines of type netdb.  The value of such an
-ACL is a node, and the ACL grants access to a given principal if and only
-if that principal has one of the roles user, admin, or team for that node.
+host.  It is used to verify ACL lines of type C<netdb>.  The value of such
+an ACL is a node, and the ACL grants access to a given principal if and
+only if that principal has one of the roles user, admin, or team for that
+node.
 
 To use this object, several configuration parameters must be set.  See
 Wallet::Config(3) for details on those configuration parameters and
@@ -227,7 +231,7 @@ error message or otherwise returned failure.
 The ACL parameter to check() was malformed.  Currently, this error is only
 given if ACL is undefined or the empty string.
 
-=item malformed NetDBL remctl token: %s
+=item malformed NetDB remctl token: %s
 
 The Net::Remctl Perl library returned a malformed token.  This should
 never happen and indicates a bug in Net::Remctl.
@@ -248,12 +252,12 @@ grant access is not currently configurable.
 Net::Remctl(3), Wallet::ACL(3), Wallet::ACL::Base(3), Wallet::Config(3),
 wallet-backend(8)
 
-NetDB is a free software system for managing DNS, DHCP, and related machine
-information for large organizations.  For more information on NetDB, see
-L<http://www.stanford.edu/group/networking/netdb/>.
+NetDB is a free software system for managing DNS, DHCP, and related
+machine information for large organizations.  For more information on
+NetDB, see L<http://www.stanford.edu/group/networking/netdb/>.
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/ACL/NetDB/Root.pm b/perl/Wallet/ACL/NetDB/Root.pm
index cbd1387..3aeebda 100644
--- a/perl/Wallet/ACL/NetDB/Root.pm
+++ b/perl/Wallet/ACL/NetDB/Root.pm
@@ -1,7 +1,7 @@
 # Wallet::ACL::NetDB::Root -- Wallet NetDB role ACL verifier (root instances).
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -23,7 +23,7 @@ use Wallet::Config;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.01';
+$VERSION = '0.02';
 
 ##############################################################################
 # Interface
@@ -48,6 +48,9 @@ sub check {
 # Documentation
 ##############################################################################
 
+=for stopwords
+ACL NetDB DNS DHCP Allbery
+
 =head1 NAME
 
 Wallet::ACL::NetDB::Root - Wallet ACL verifier for NetDB roles (root instances)
@@ -66,13 +69,14 @@ Wallet::ACL::NetDB::Root - Wallet ACL verifier for NetDB roles (root instances)
 
 =head1 DESCRIPTION
 
-Wallet::ACL::NetDB::Root works identically to Wallet::ACL::NetDB except that
-it requires the principal to be a root instance (in other words, to be in
-the form <principal>/root@<realm>) and strips the C</root> portion from the
-principal before checking against NetDB roles.  As with the base NetDB ACL
-verifier, the value of a netdb-root ACL is a node, and the ACL grants access
-to a given principal if and only if the that principal (with C</root>
-stripped) has one of the roles user, admin, or team for that node.
+Wallet::ACL::NetDB::Root works identically to Wallet::ACL::NetDB except
+that it requires the principal to be a root instance (in other words, to
+be in the form <principal>/root@<realm>) and strips the C</root> portion
+from the principal before checking against NetDB roles.  As with the base
+NetDB ACL verifier, the value of a C<netdb-root> ACL is a node, and the
+ACL grants access to a given principal if and only if the that principal
+(with C</root> stripped) has one of the roles user, admin, or team for
+that node.
 
 To use this object, the same configuration parameters must be set as for
 Wallet::ACL::NetDB.  See Wallet::Config(3) for details on those
@@ -85,11 +89,11 @@ configuration.
 
 =item check(PRINCIPAL, ACL)
 
-Returns true if PRINCIPAL is granted access according to ACL, false if not,
-and undef on an error (see L<"DIAGNOSTICS"> below).  ACL is a node, and
-PRINCIPAL will be granted access if it has an instance of C<root> and if
-(with C</root> stripped off and the realm stripped off if configured) has
-the user, admin, or team role for that node.
+Returns true if PRINCIPAL is granted access according to ACL, false if
+not, and undef on an error (see L<"DIAGNOSTICS"> below).  ACL is a node,
+and PRINCIPAL will be granted access if it has an instance of C<root> and
+if (with C</root> stripped off and the realm stripped off if configured)
+has the user, admin, or team role for that node.
 
 =back
 
@@ -106,15 +110,15 @@ grant access is not currently configurable.
 
 =head1 SEE ALSO
 
-Net::Remctl(3), Wallet::ACL(3), Wallet::ACL::Base(3), Wallet::ACL::NetDB(3),
-Wallet::Config(3), wallet-backend(8)
+Net::Remctl(3), Wallet::ACL(3), Wallet::ACL::Base(3),
+Wallet::ACL::NetDB(3), Wallet::Config(3), wallet-backend(8)
 
-NetDB is a free software system for managing DNS, DHCP, and related machine
-information for large organizations.  For more information on NetDB, see
-L<http://www.stanford.edu/group/networking/netdb/>.
+NetDB is a free software system for managing DNS, DHCP, and related
+machine information for large organizations.  For more information on
+NetDB, see L<http://www.stanford.edu/group/networking/netdb/>.
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/Admin.pm b/perl/Wallet/Admin.pm
index ff87b94..b4b3d86 100644
--- a/perl/Wallet/Admin.pm
+++ b/perl/Wallet/Admin.pm
@@ -1,7 +1,7 @@
 # Wallet::Admin -- Wallet system administrative interface.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2008, 2009 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2008, 2009, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -413,6 +413,9 @@ __DATA__
 
 Wallet::Admin - Wallet system administrative interface
 
+=for stopwords
+ACL hostname ACLs SQL wildcard Allbery
+
 =head1 SYNOPSIS
 
     use Wallet::Admin;
@@ -429,9 +432,9 @@ thin wrapper around this object that provides a command-line interface to
 its actions.
 
 To use this object, several configuration variables must be set (at least
-the database configuration).  For information on those variables and how to
-set them, see Wallet::Config(3).  For more information on the normal user
-interface to the wallet server, see Wallet::Server(3).
+the database configuration).  For information on those variables and how
+to set them, see Wallet::Config(3).  For more information on the normal
+user interface to the wallet server, see Wallet::Server(3).
 
 =head1 CLASS METHODS
 
@@ -491,11 +494,11 @@ at least one ACL, but an error can be distinguished from the odd case of a
 database with no ACLs by calling error().  error() is guaranteed to return
 the error message if there was an error and undef if there was no error.
 
-There are currently two search types.  'empty' takes no arguments, and will
-return only those acls that have no entries within them.  'entry' takes two
-arguments -- an entry scheme and an entry identifier -- and will return
-any ACLs with an entry that matches the given scheme and contains the
-given identifier.
+There are currently two search types.  C<empty> takes no arguments and
+will return only those ACLs that have no entries within them.  C<entry>
+takes two arguments, an entry scheme and an entry identifier, and will
+return any ACLs with an entry that matches the given scheme and contains
+the given identifier.
 
 =item list_objects(TYPE, SEARCH)
 
@@ -503,7 +506,7 @@ Returns a list of all objects matching a search type and string in the
 database, or all objects in the database if no search information is
 given.  The return value is a list of references to pairs of type and
 name.  For example, if two objects existed in the database, both of type
-"keytab" and with values "host/example.com" and "foo", list_objects()
+C<keytab> and with values C<host/example.com> and C<foo>, list_objects()
 with no arguments would return:
 
     ([ 'keytab', 'host/example.com' ], [ 'keytab', 'foo' ])
@@ -513,13 +516,13 @@ database containing no objects, the caller should call error().  error()
 is guaranteed to return the error message if there was an error and undef
 if there was no error.
 
-There are four types of searches currently.  'type' (with a given type)
+There are four types of searches currently.  C<type> (with a given type)
 will return only those entries where the type matches the given type.
-'owner', with a given owner, will only return those objects owned by the
-given acl name.  'flag', with a given flag name, will only return those
-items with a flag set to the given value.  'acl' operates like 'owner',
-but will return only those objects that have the given acl name on any
-of the possible acl settings, not just owner.
+C<owner>, with a given owner, will only return those objects owned by the
+given ACL name.  C<flag>, with a given flag name, will only return those
+items with a flag set to the given value.  C<acl> operates like C<owner>,
+but will return only those objects that have the given ACL name on any of
+the possible ACL settings, not just owner.
 
 =item register_object (TYPE, CLASS)
 
@@ -559,8 +562,8 @@ the error message if there was an error and undef if there was no error.
 
 wallet-admin(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/Config.pm b/perl/Wallet/Config.pm
index ae8cf9c..c59d3e3 100644
--- a/perl/Wallet/Config.pm
+++ b/perl/Wallet/Config.pm
@@ -23,6 +23,11 @@ $PATH = $ENV{WALLET_CONFIG} || '/etc/wallet/wallet.conf';
 
 Wallet::Config - Configuration handling for the wallet server
 
+=for stopwords
+DBI DSN SQLite subdirectories KEYTAB keytab kadmind KDC add-ons kadmin DNS
+SRV kadmin keytabs remctl backend lowercased NETDB ACL NetDB unscoped
+usernames rekey hostnames Allbery wallet-backend keytab-backend
+
 =head1 SYNOPSIS
 
     use Wallet::Config;
@@ -63,9 +68,9 @@ variable DB_DRIVER to C<MySQL>, use:
 
     $DB_DRIVER = 'MySQL';
 
-Always remember the initial dollar sign (C<$>) and ending semicolon (C<;>).
-Those familiar with Perl syntax can of course use the full range of Perl
-expressions.
+Always remember the initial dollar sign (C<$>) and ending semicolon
+(C<;>).  Those familiar with Perl syntax can of course use the full range
+of Perl expressions.
 
 This configuration file should end with the line:
 
@@ -80,11 +85,11 @@ file.
 
 =item DB_DRIVER
 
-Sets the Perl database driver to use for the wallet database.  Common values
-would be C<SQLite> or C<MySQL>.  Less common values would be C<Oracle>,
-C<Sybase>, or C<ODBC>.  The appropriate DBD::* Perl module for the chosen
-driver must be installed and will be dynamically loaded by the wallet.  For
-more information, see DBI(3).
+Sets the Perl database driver to use for the wallet database.  Common
+values would be C<SQLite> or C<MySQL>.  Less common values would be
+C<Oracle>, C<Sybase>, or C<ODBC>.  The appropriate DBD::* Perl module for
+the chosen driver must be installed and will be dynamically loaded by the
+wallet.  For more information, see DBI(3).
 
 This variable must be set.
 
@@ -95,8 +100,8 @@ our $DB_DRIVER;
 =item DB_INFO
 
 Sets the remaining contents for the DBI DSN (everything after the driver).
-Using this variable provides full control over the connect string passed to
-DBI.  When using SQLite, set this variable to the path to the SQLite
+Using this variable provides full control over the connect string passed
+to DBI.  When using SQLite, set this variable to the path to the SQLite
 database.  If this variable is set, DB_NAME, DB_HOST, and DB_PORT are
 ignored.  For more information, see DBI(3) and the documentation for the
 database driver you're using.
@@ -111,9 +116,10 @@ our $DB_INFO;
 =item DB_NAME
 
 If DB_INFO is not set, specifies the database name.  The third part of the
-DBI connect string will be set to C<database=DB_NAME>, possibly with a host
-and port appended if DB_HOST and DB_PORT are set.  For more information, see
-DBI(3) and the documentation for the database driver you're using.
+DBI connect string will be set to C<database=DB_NAME>, possibly with a
+host and port appended if DB_HOST and DB_PORT are set.  For more
+information, see DBI(3) and the documentation for the database driver
+you're using.
 
 Either DB_INFO or DB_NAME must be set.
 
@@ -124,8 +130,8 @@ our $DB_NAME;
 =item DB_HOST
 
 If DB_INFO is not set, specifies the database host.  C<;host=DB_HOST> will
-be appended to the DBI connect string.  For more information, see DBI(3) and
-the documentation for the database driver you're using.
+be appended to the DBI connect string.  For more information, see DBI(3)
+and the documentation for the database driver you're using.
 
 =cut
 
@@ -135,8 +141,8 @@ our $DB_HOST;
 
 If DB_PORT is not set, specifies the database port.  C<;port=DB_PORT> will
 be appended to the DBI connect string.  If this variable is set, DB_HOST
-should also be set.  For more information, see DBI(3) and the documentation
-for the database driver you're using.
+should also be set.  For more information, see DBI(3) and the
+documentation for the database driver you're using.
 
 =cut
 
@@ -153,8 +159,8 @@ our $DB_USER;
 
 =item DB_PASSWORD
 
-Specifies the password for database authentication.  Some database backends,
-particularly SQLite, do not need this.
+Specifies the password for database authentication.  Some database
+backends, particularly SQLite, do not need this.
 
 =cut
 
@@ -205,9 +211,10 @@ C<keytab> object type (the Wallet::Object::Keytab class).
 =item KEYTAB_FILE
 
 Specifies the keytab to use to authenticate to B<kadmind>.  The principal
-whose key is stored in this keytab must have the ability to create, modify,
-inspect, and delete any principals that should be managed by the wallet.
-(In MIT Kerberos F<kadm5.acl> parlance, this is C<admci> privileges.)
+whose key is stored in this keytab must have the ability to create,
+modify, inspect, and delete any principals that should be managed by the
+wallet.  (In MIT Kerberos F<kadm5.acl> parlance, this is C<admci>
+privileges.)
 
 KEYTAB_FILE must be set to use keytab objects.
 
@@ -218,12 +225,13 @@ our $KEYTAB_FILE;
 =item KEYTAB_FLAGS
 
 These flags, if any, are passed to the C<addprinc> command when creating a
-new principal in the Kerberos KDC.  To not pass any flags, set KEYTAB_FLAGS
-to the empty string.  The default value is C<-clearpolicy>, which clears any
-password strength policy from principals created by the wallet.  (Since the
-wallet randomizes the keys, password strength checking is generally
-pointless and may interact poorly with the way C<addprinc -randkey> works
-when third-party add-ons for password strength checking are used.)
+new principal in the Kerberos KDC.  To not pass any flags, set
+KEYTAB_FLAGS to the empty string.  The default value is C<-clearpolicy>,
+which clears any password strength policy from principals created by the
+wallet.  (Since the wallet randomizes the keys, password strength checking
+is generally pointless and may interact poorly with the way C<addprinc
+-randkey> works when third-party add-ons for password strength checking
+are used.)
 
 =cut
 
@@ -264,9 +272,9 @@ our $KEYTAB_KRBTYPE;
 The principal whose key is stored in KEYTAB_FILE.  The wallet will
 authenticate as this principal to the kadmin service.
 
-KEYTAB_PRINCIPAL must be set to use keytab objects, at least until B<kadmin>
-is smart enough to use the first principal found in the keytab it's using
-for authentication.
+KEYTAB_PRINCIPAL must be set to use keytab objects, at least until
+B<kadmin> is smart enough to use the first principal found in the keytab
+it's using for authentication.
 
 =cut
 
@@ -289,11 +297,11 @@ our $KEYTAB_REALM;
 =item KEYTAB_TMP
 
 A directory into which the wallet can write keytabs temporarily while
-processing C<get> commands from clients.  The keytabs are written into this
-directory with predictable names, so this should not be a system temporary
-directory such as F</tmp> or F</var/tmp>.  It's best to create a directory
-solely for this purpose that's owned by the user the wallet server will run
-as.
+processing C<get> commands from clients.  The keytabs are written into
+this directory with predictable names, so this should not be a system
+temporary directory such as F</tmp> or F</var/tmp>.  It's best to create a
+directory solely for this purpose that's owned by the user the wallet
+server will run as.
 
 KEYTAB_TMP must be set to use keytab objects.
 
@@ -305,20 +313,20 @@ our $KEYTAB_TMP;
 
 =head2 Retrieving Existing Keytabs
 
-The keytab object backend optionally supports retrieving existing keys, and
-hence keytabs, for Kerberos principals by contacting the KDC via remctl and
-talking to B<keytab-backend>.  This is enabled by setting the C<unchanging>
-flag on keytab objects.  To configure that support, set the following
-variables.
+The keytab object backend optionally supports retrieving existing keys,
+and hence keytabs, for Kerberos principals by contacting the KDC via
+remctl and talking to B<keytab-backend>.  This is enabled by setting the
+C<unchanging> flag on keytab objects.  To configure that support, set the
+following variables.
 
 =over 4
 
 =item KEYTAB_REMCTL_CACHE
 
-Specifies the ticket cache to use when retrieving existing keytabs from the
-KDC.  This is only used to implement support for the C<unchanging> flag.
-The ticket cache must be for a principal with access to run C<keytab
-retrieve> via remctl on KEYTAB_REMCTL_HOST.
+Specifies the ticket cache to use when retrieving existing keytabs from
+the KDC.  This is only used to implement support for the C<unchanging>
+flag.  The ticket cache must be for a principal with access to run
+C<keytab retrieve> via remctl on KEYTAB_REMCTL_HOST.
 
 =cut
 
@@ -326,10 +334,10 @@ our $KEYTAB_REMCTL_CACHE;
 
 =item KEYTAB_REMCTL_HOST
 
-The host to which to connect with remctl to retrieve existing keytabs.  This
-is only used to implement support for the C<unchanging> flag.  This host
-must provide the C<keytab retrieve> command and KEYTAB_REMCTL_CACHE must
-also be set to a ticket cache for a principal with access to run that
+The host to which to connect with remctl to retrieve existing keytabs.
+This is only used to implement support for the C<unchanging> flag.  This
+host must provide the C<keytab retrieve> command and KEYTAB_REMCTL_CACHE
+must also be set to a ticket cache for a principal with access to run that
 command.
 
 =cut
@@ -339,9 +347,10 @@ our $KEYTAB_REMCTL_HOST;
 =item KEYTAB_REMCTL_PRINCIPAL
 
 The service principal to which to authenticate when retrieving existing
-keytabs.  This is only used to implement support for the C<unchanging> flag.
-If this variable is not set, the default is formed by prepending C<host/> to
-KEYTAB_REMCTL_HOST.  (Note that KEYTAB_REMCTL_HOST is not lowercased first.)
+keytabs.  This is only used to implement support for the C<unchanging>
+flag.  If this variable is not set, the default is formed by prepending
+C<host/> to KEYTAB_REMCTL_HOST.  (Note that KEYTAB_REMCTL_HOST is not
+lowercased first.)
 
 =cut
 
@@ -365,18 +374,18 @@ our $KEYTAB_REMCTL_PORT;
 These configuration variables are only needed if you intend to use the
 C<netdb> ACL type (the Wallet::ACL::NetDB class).  They specify the remctl
 connection information for retrieving user roles from NetDB and the local
-realm to remove from principals (since NetDB normally expects unscoped local
-usernames).
+realm to remove from principals (since NetDB normally expects unscoped
+local usernames).
 
 =over 4
 
 =item NETDB_REALM
 
 The wallet uses fully-qualified principal names (including the realm), but
-NetDB normally expects local usernames without the realm.  If this variable
-is set, the given realm will be stripped from any principal names before
-passing them to NetDB.  Principals in other realms will be passed to NetDB
-without modification.
+NetDB normally expects local usernames without the realm.  If this
+variable is set, the given realm will be stripped from any principal names
+before passing them to NetDB.  Principals in other realms will be passed
+to NetDB without modification.
 
 =cut
 
@@ -385,9 +394,9 @@ our $NETDB_REALM;
 =item NETDB_REMCTL_CACHE
 
 Specifies the ticket cache to use when querying the NetDB remctl interface
-for user roles.  The ticket cache must be for a principal with access to run
-C<netdb node-roles> via remctl on KEYTAB_REMCTL_HOST.  This variable must be
-set to use NetDB ACLs.
+for user roles.  The ticket cache must be for a principal with access to
+run C<netdb node-roles> via remctl on KEYTAB_REMCTL_HOST.  This variable
+must be set to use NetDB ACLs.
 
 =cut
 
@@ -406,10 +415,10 @@ our $NETDB_REMCTL_HOST;
 
 =item NETDB_REMCTL_PRINCIPAL
 
-The service principal to which to authenticate when querying NetDB for user
-roles.  If this variable is not set, the default is formed by prepending
-C<host/> to NETDB_REMCTL_HOST.  (Note that NETDB_REMCTL_HOST is not
-lowercased first.)
+The service principal to which to authenticate when querying NetDB for
+user roles.  If this variable is not set, the default is formed by
+prepending C<host/> to NETDB_REMCTL_HOST.  (Note that NETDB_REMCTL_HOST is
+not lowercased first.)
 
 =cut
 
@@ -417,9 +426,9 @@ our $NETDB_REMCTL_PRINCIPAL;
 
 =item NETDB_REMCTL_PORT
 
-The port on NETDB_REMCTL_HOST to which to connect with remctl to query NetDB
-for user roles.  If this variable is not set, the default remctl port will
-be used.
+The port on NETDB_REMCTL_HOST to which to connect with remctl to query
+NetDB for user roles.  If this variable is not set, the default remctl
+port will be used.
 
 =cut
 
@@ -430,17 +439,18 @@ our $NETDB_REMCTL_PORT;
 =head1 DEFAULT OWNERS
 
 By default, only users in the ADMIN ACL can create new objects in the
-wallet.  To allow other users to create new objects, define a Perl function
-named default_owner.  This function will be called whenever a non-ADMIN user
-tries to create a new object and will be passed the type and name of the
-object.  It should return undef if there is no default owner for that
-object.  If there is, it should return a list containing the name to use for
-the ACL and then zero or more anonymous arrays of two elements each giving
-the type and identifier for each ACL entry.
-
-For example, the following simple function says to use a default owner named
-C<default> with one entry of type C<krb5> and identifier C<rra@example.com>
-for the object with type C<keytab> and name C<host/example.com>:
+wallet.  To allow other users to create new objects, define a Perl
+function named default_owner.  This function will be called whenever a
+non-ADMIN user tries to create a new object and will be passed the type
+and name of the object.  It should return undef if there is no default
+owner for that object.  If there is, it should return a list containing
+the name to use for the ACL and then zero or more anonymous arrays of two
+elements each giving the type and identifier for each ACL entry.
+
+For example, the following simple function says to use a default owner
+named C<default> with one entry of type C<krb5> and identifier
+C<rra@example.com> for the object with type C<keytab> and name
+C<host/example.com>:
 
     sub default_owner {
         my ($type, $name) = @_;
@@ -453,8 +463,8 @@ for the object with type C<keytab> and name C<host/example.com>:
 
 Of course, normally this function is used for more complex mappings.  Here
 is a more complete example.  For objects of type keytab corresponding to
-various types of per-machine principals, return a default owner that sets as
-owner anyone with a NetDB role for that system and the system's host
+various types of per-machine principals, return a default owner that sets
+as owner anyone with a NetDB role for that system and the system's host
 principal.  This permits authorization management using NetDB while also
 allowing the system to bootstrap itself once the host principal has been
 downloaded and rekey itself using the old host principal.
@@ -474,17 +484,19 @@ downloaded and rekey itself using the old host principal.
         return ($acl_name, @acl);
     }
 
-The auto-created ACL used for the owner of the new object will, in the above
-example, be named C<host/I<system>> where I<system> is the fully-qualified
-name of the system as derived from the keytab being requested.
-
-If the name of the ACL returned by the default_owner function matches an ACL
-that already exists in the wallet database, the existing ACL will be
-compared to the default ACL returned by the default_owner function.  If the
-existing ACL has the same entries as the one returned by default_owner,
-creation continues if the user is authorized by that ACL.  If they don't
-match, creation of the object is rejected, since the presence of an existing
-ACL may indicate that something different is being done with this object.
+The auto-created ACL used for the owner of the new object will, in the
+above example, be named C<host/I<system>> where I<system> is the
+fully-qualified name of the system as derived from the keytab being
+requested.
+
+If the name of the ACL returned by the default_owner function matches an
+ACL that already exists in the wallet database, the existing ACL will be
+compared to the default ACL returned by the default_owner function.  If
+the existing ACL has the same entries as the one returned by
+default_owner, creation continues if the user is authorized by that ACL.
+If they don't match, creation of the object is rejected, since the
+presence of an existing ACL may indicate that something different is being
+done with this object.
 
 =head1 NAMING ENFORCEMENT
 
diff --git a/perl/Wallet/Database.pm b/perl/Wallet/Database.pm
index 68fb6bb..7b3474a 100644
--- a/perl/Wallet/Database.pm
+++ b/perl/Wallet/Database.pm
@@ -6,7 +6,7 @@
 # like DBI objects in the rest of the code.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2008 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2008, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -39,7 +39,7 @@ use Wallet::Config;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.01';
+$VERSION = '0.02';
 
 ##############################################################################
 # Core overrides
@@ -84,6 +84,9 @@ __END__
 
 Wallet::Dabase - Wrapper module for wallet database connections
 
+=for stopwords
+DBI RaiseError PrintError AutoCommit Allbery
+
 =head1 SYNOPSIS
 
     use Wallet::Database;
@@ -93,9 +96,9 @@ Wallet::Dabase - Wrapper module for wallet database connections
 
 Wallet::Database is a thin wrapper module around DBI that takes care of
 building a connect string and setting database options based on wallet
-configuration.  The only overriden method is connect().  All other methods
-should work the same as in DBI and Wallet::Database objects should be
-usable exactly as if they were DBI objects.
+configuration.  The only overridden method is connect().  All other
+methods should work the same as in DBI and Wallet::Database objects should
+be usable exactly as if they were DBI objects.
 
 connect() will obtain the database connection information from the wallet
 configuration; see Wallet::Config(3) for more details.  It will also
@@ -120,8 +123,8 @@ configuration.
 
 DBI(3), Wallet::Config(3)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/Kadmin.pm b/perl/Wallet/Kadmin.pm
index 65ddf4b..b653f87 100644
--- a/perl/Wallet/Kadmin.pm
+++ b/perl/Wallet/Kadmin.pm
@@ -55,6 +55,9 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+Kadmin keytabs keytab Heimdal API kadmind kadmin
+
 =head1 NAME
 
 Wallet::Kadmin - Kadmin module wrapper for wallet keytabs
@@ -69,21 +72,21 @@ Wallet::Kadmin - Kadmin module wrapper for wallet keytabs
 
 =head1 DESCRIPTION
 
-Wallet::Kadmin is a wrapper to modules that provide an interface for keytab
-integration with the wallet.  Each module is meant to interface with a
-specific type of Kerberos implementation, such as MIT Kerberos or Heimdal
-Kerberos, and provide a standndard set of API calls used to interact with
-that implementation's kadmind.
+Wallet::Kadmin is a wrapper to modules that provide an interface for
+keytab integration with wallet.  Each module is meant to interface with a
+specific type of Kerberos implementation, such as MIT Kerberos or Heimdal,
+and provide a standard set of API calls used to interact with that
+implementation's kadmin interface.
 
 The class simply uses Wallet::Config to find which type of kadmind we have
 requested to use, and then returns an object to use for interacting with
 that kadmind.
 
 A keytab is an on-disk store for the key or keys for a Kerberos principal.
-Keytabs are used by services to verify incoming authentication from clients
-or by automated processes that need to authenticate to Kerberos.  To create
-a keytab, the principal has to be created in Kerberos and then a keytab is
-generated and stored in a file on disk.
+Keytabs are used by services to verify incoming authentication from
+clients or by automated processes that need to authenticate to Kerberos.
+To create a keytab, the principal has to be created in Kerberos and then a
+keytab is generated and stored in a file on disk.
 
 To use this object, several configuration parameters must be set.  See
 Wallet::Config(3) for details on those configuration parameters and
@@ -95,9 +98,9 @@ information about how to set wallet configuration.
 
 =item new()
 
-Finds the proper Kerberos implementation and calls the new() constructor for
-that implementation's module, returning the result.  If the implementation
-is not recognized or set, die with an error message.
+Finds the proper Kerberos implementation and calls the new() constructor
+for that implementation's module, returning the result.  If the
+implementation is not recognized or set, die with an error message.
 
 =back
 
@@ -105,8 +108,8 @@ is not recognized or set, die with an error message.
 
 kadmin(8), Wallet::Config(3), Wallet::Object::Keytab(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHORS
 
diff --git a/perl/Wallet/Kadmin/Heimdal.pm b/perl/Wallet/Kadmin/Heimdal.pm
index 428202b..2ad35e3 100644
--- a/perl/Wallet/Kadmin/Heimdal.pm
+++ b/perl/Wallet/Kadmin/Heimdal.pm
@@ -230,9 +230,12 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+keytabs keytab kadmin enctypes API ENCTYPES enctype Allbery Heimdal
+
 =head1 NAME
 
-Wallet::Kadmin::MIT - MIT admin interactions for wallet keytabs
+Wallet::Kadmin::Heimdal - Heimdal admin interactions for wallet keytabs
 
 =head1 SYNOPSIS
 
@@ -244,18 +247,18 @@ Wallet::Kadmin::MIT - MIT admin interactions for wallet keytabs
 
 =head1 DESCRIPTION
 
-Wallet::Kadmin::MIT is an interface for keytab integration with the wallet,
-specifically for using kadmin to create, delete, and add enctypes to keytabs.
-It implments the wallet kadmin API and provides the necessary glue to MIT
-Kerberos installs for each of these functions, while allowing the wallet
-to keep the details of what type of Kerberos installation is being used
-abstracted.
+Wallet::Kadmin::Heimdal is an interface for keytab integration with the
+wallet, specifically for using kadmin to create, delete, and add enctypes
+to keytabs.  It implements the wallet kadmin API and provides the
+necessary glue to Heimdal installs for each of these functions, while
+allowing the wallet to keep the details of what type of Kerberos
+installation is being used abstracted.
 
 A keytab is an on-disk store for the key or keys for a Kerberos principal.
-Keytabs are used by services to verify incoming authentication from clients
-or by automated processes that need to authenticate to Kerberos.  To create
-a keytab, the principal has to be created in Kerberos and then a keytab is
-generated and stored in a file on disk.
+Keytabs are used by services to verify incoming authentication from
+clients or by automated processes that need to authenticate to Kerberos.
+To create a keytab, the principal has to be created in Kerberos and then a
+keytab is generated and stored in a file on disk.
 
 To use this object, several configuration parameters must be set.  See
 Wallet::Config(3) for details on those configuration parameters and
@@ -268,17 +271,17 @@ information about how to set wallet configuration.
 =item addprinc(PRINCIPAL)
 
 Adds a new principal with a given name.  The principal is created with a
-random password, and any other flags set by Wallet::Config.  Returns true on
-success, or throws an error if there was a failure in adding the principal.
-If the principal already exists, return true as we are bringing our
-expectations in line with reality.
+random password, and any other flags set by Wallet::Config.  Returns true
+on success, or throws an error if there was a failure in adding the
+principal.  If the principal already exists, return true as we are
+bringing our expectations in line with reality.
 
 =item addprinc(PRINCIPAL)
 
-Removes a principal with the given name.  Returns true on success, or throws
-an error if there was a failure in removing the principal.  If the principal
-does not exist, return true as we are bringing our expectations in line with
-reality.
+Removes a principal with the given name.  Returns true on success, or
+throws an error if there was a failure in removing the principal.  If the
+principal does not exist, return true as we are bringing our expectations
+in line with reality.
 
 =item ktadd(PRINCIPAL, FILE, ENCTYPES)
 
@@ -290,19 +293,12 @@ otherwise true is returned.
 
 =back
 
-=head1 LIMITATIONS
-
-Currently, this implementation calls an external B<kadmin> program rather
- than using a native Perl module and therefore requires B<kadmin> be
-installed and parses its output.  It may miss some error conditions if the
-output of B<kadmin> ever changes.
-
 =head1 SEE ALSO
 
 kadmin(8), Wallet::Config(3), Wallet::Object::Keytab(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHORS
 
diff --git a/perl/Wallet/Kadmin/MIT.pm b/perl/Wallet/Kadmin/MIT.pm
index 49691b0..8449868 100644
--- a/perl/Wallet/Kadmin/MIT.pm
+++ b/perl/Wallet/Kadmin/MIT.pm
@@ -226,6 +226,9 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+keytabs keytab kadmin enctype enctypes API ENCTYPES Allbery
+
 =head1 NAME
 
 Wallet::Kadmin::MIT - MIT admin interactions for wallet keytabs
@@ -240,18 +243,18 @@ Wallet::Kadmin::MIT - MIT admin interactions for wallet keytabs
 
 =head1 DESCRIPTION
 
-Wallet::Kadmin::MIT is an interface for keytab integration with the wallet,
-specifically for using kadmin to create, delete, and add enctypes to keytabs.
-It implments the wallet kadmin API and provides the necessary glue to MIT
-Kerberos installs for each of these functions, while allowing the wallet
-to keep the details of what type of Kerberos installation is being used
-abstracted.
+Wallet::Kadmin::MIT is an interface for keytab integration with the
+wallet, specifically for using kadmin to create, delete, and add enctypes
+to keytabs.  It implements the wallet kadmin API and provides the
+necessary glue to MIT Kerberos installs for each of these functions, while
+allowing the wallet to keep the details of what type of Kerberos
+installation is being used abstracted.
 
 A keytab is an on-disk store for the key or keys for a Kerberos principal.
-Keytabs are used by services to verify incoming authentication from clients
-or by automated processes that need to authenticate to Kerberos.  To create
-a keytab, the principal has to be created in Kerberos and then a keytab is
-generated and stored in a file on disk.
+Keytabs are used by services to verify incoming authentication from
+clients or by automated processes that need to authenticate to Kerberos.
+To create a keytab, the principal has to be created in Kerberos and then a
+keytab is generated and stored in a file on disk.
 
 To use this object, several configuration parameters must be set.  See
 Wallet::Config(3) for details on those configuration parameters and
@@ -264,17 +267,17 @@ information about how to set wallet configuration.
 =item addprinc(PRINCIPAL)
 
 Adds a new principal with a given name.  The principal is created with a
-random password, and any other flags set by Wallet::Config.  Returns true on
-success, or throws an error if there was a failure in adding the principal.
-If the principal already exists, return true as we are bringing our
-expectations in line with reality.
+random password, and any other flags set by Wallet::Config.  Returns true
+on success, or throws an error if there was a failure in adding the
+principal.  If the principal already exists, return true as we are
+bringing our expectations in line with reality.
 
-=item addprinc(PRINCIPAL)
+=item delprinc(PRINCIPAL)
 
-Removes a principal with the given name.  Returns true on success, or throws
-an error if there was a failure in removing the principal.  If the principal
-does not exist, return true as we are bringing our expectations in line with
-reality.
+Removes a principal with the given name.  Returns true on success, or
+throws an error if there was a failure in removing the principal.  If the
+principal does not exist, return true as we are bringing our expectations
+in line with reality.
 
 =item ktadd(PRINCIPAL, FILE, ENCTYPES)
 
@@ -297,8 +300,8 @@ output of B<kadmin> ever changes.
 
 kadmin(8), Wallet::Config(3), Wallet::Object::Keytab(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHORS
 
diff --git a/perl/Wallet/Object/Base.pm b/perl/Wallet/Object/Base.pm
index fea0320..5097729 100644
--- a/perl/Wallet/Object/Base.pm
+++ b/perl/Wallet/Object/Base.pm
@@ -1,7 +1,7 @@
 # Wallet::Object::Base -- Parent class for any object stored in the wallet.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007, 2008 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2008, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -22,7 +22,7 @@ use Wallet::ACL;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.04';
+$VERSION = '0.05';
 
 ##############################################################################
 # Constructors
@@ -669,6 +669,10 @@ __END__
 
 Wallet::Object::Base - Generic parent class for wallet objects
 
+=for stopwords
+DBH HOSTNAME DATETIME ACL backend metadata timestamp Allbery wallet-backend
+backend-specific
+
 =head1 SYNOPSIS
 
     package Wallet::Object::Simple;
@@ -682,104 +686,107 @@ Wallet::Object::Base - Generic parent class for wallet objects
 =head1 DESCRIPTION
 
 Wallet::Object::Base is the generic parent class for wallet objects (data
-types that can be stored in the wallet system).  It provides defualt
+types that can be stored in the wallet system).  It provides default
 functions and behavior, including handling generic object settings.  All
 handlers for objects stored in the wallet should inherit from it.  It is
 not used directly.
 
 =head1 PUBLIC CLASS METHODS
 
-The following methods are called by the rest of the wallet system and should
-be implemented by all objects stored in the wallet.  They should be called
-with the desired wallet object class as the first argument (generally using
-the Wallet::Object::Type->new syntax).
+The following methods are called by the rest of the wallet system and
+should be implemented by all objects stored in the wallet.  They should be
+called with the desired wallet object class as the first argument
+(generally using the Wallet::Object::Type->new syntax).
 
 =over 4
 
 =item new(TYPE, NAME, DBH)
 
 Creates a new object with the given object type and name, based on data
-already in the database.  This method will only succeed if an object of the
-given TYPE and NAME is already present in the wallet database.  If no such
-object exits, throws an exception.  Otherwise, returns an object blessed
-into the class used for the new() call (so subclasses can leave this method
-alone and not override it).
+already in the database.  This method will only succeed if an object of
+the given TYPE and NAME is already present in the wallet database.  If no
+such object exits, throws an exception.  Otherwise, returns an object
+blessed into the class used for the new() call (so subclasses can leave
+this method alone and not override it).
 
-Takes a Wallet::Database object, which is stored in the object and used for
-any further operations.
+Takes a Wallet::Database object, which is stored in the object and used
+for any further operations.
 
 =item create(TYPE, NAME, DBH, PRINCIPAL, HOSTNAME [, DATETIME])
 
 Similar to new() but instead creates a new entry in the database.  This
 method will throw an exception if an entry for that type and name already
-exists in the database or if creating the database record fails.  Otherwise,
-a new database entry will be created with that type and name, no owner, no
-ACLs, no expiration, no flags, and with created by, from, and on set to the
-PRINCIPAL, HOSTNAME, and DATETIME parameters.  If DATETIME isn't given, the
-current time is used.  The database handle is treated as with new().
+exists in the database or if creating the database record fails.
+Otherwise, a new database entry will be created with that type and name,
+no owner, no ACLs, no expiration, no flags, and with created by, from, and
+on set to the PRINCIPAL, HOSTNAME, and DATETIME parameters.  If DATETIME
+isn't given, the current time is used.  The database handle is treated as
+with new().
 
 =back
 
 =head1 PUBLIC INSTANCE METHODS
 
 The following methods may be called on instantiated wallet objects.
-Normally, the only methods that a subclass will need to override are get(),
-store(), show(), and destroy().
+Normally, the only methods that a subclass will need to override are
+get(), store(), show(), and destroy().
 
-If the locked flag is set on an object, no actions may be performed on that
-object except for the flag methods and show().  All other actions will be
-rejected with an error saying the object is locked.
+If the locked flag is set on an object, no actions may be performed on
+that object except for the flag methods and show().  All other actions
+will be rejected with an error saying the object is locked.
 
 =over 4
 
 =item acl(TYPE [, ACL, PRINCIPAL, HOSTNAME [, DATETIME]])
 
-Sets or retrieves a given object ACL as a numeric ACL ID.  TYPE must be one
-of C<get>, C<store>, C<show>, C<destroy>, or C<flags>, corresponding to the
-ACLs kept on an object.  If no other arguments are given, returns the
-current ACL setting as an ACL ID or undef if that ACL isn't set.  If other
-arguments are given, change that ACL to ACL and return true on success and
-false on failure.  Pass in the empty string for ACL to clear the ACL.  The
-other arguments are used for logging and history and should indicate the
-user and host from which the change is made and the time of the change.
+Sets or retrieves a given object ACL as a numeric ACL ID.  TYPE must be
+one of C<get>, C<store>, C<show>, C<destroy>, or C<flags>, corresponding
+to the ACLs kept on an object.  If no other arguments are given, returns
+the current ACL setting as an ACL ID or undef if that ACL isn't set.  If
+other arguments are given, change that ACL to ACL and return true on
+success and false on failure.  Pass in the empty string for ACL to clear
+the ACL.  The other arguments are used for logging and history and should
+indicate the user and host from which the change is made and the time of
+the change.
 
 =item attr(ATTRIBUTE [, VALUES, PRINCIPAL, HOSTNAME [, DATETIME]])
 
 Sets or retrieves a given object attribute.  Attributes are used to store
-backend-specific information for a particular object type and ATTRIBUTE must
-be an attribute type known to the underlying object implementation.  The
-default implementation of this method rejects all attributes as unknown.
+backend-specific information for a particular object type and ATTRIBUTE
+must be an attribute type known to the underlying object implementation.
+The default implementation of this method rejects all attributes as
+unknown.
 
 If no other arguments besides ATTRIBUTE are given, returns the values of
 that attribute, if any, as a list.  On error, returns the empty list.  To
-distinguish between an error and an empty return, call error() afterwards.
+distinguish between an error and an empty return, call error() afterward.
 It is guaranteed to return undef unless there was an error.
 
 If other arguments are given, sets the given ATTRIBUTE values to VALUES,
-which must be a reference to an array (even if only one value is being set).
-Pass a reference to an empty array to clear the attribute values.  The other
-arguments are used for logging and history and should indicate the user and
-host from which the change is made and the time of the change.  Returns true
-on success and false on failure.
+which must be a reference to an array (even if only one value is being
+set).  Pass a reference to an empty array to clear the attribute values.
+The other arguments are used for logging and history and should indicate
+the user and host from which the change is made and the time of the
+change.  Returns true on success and false on failure.
 
 =item attr_show()
 
-Returns a formatted text description of the type-specific attributes of the
-object, or undef on error.  The default implementation of this method always
-returns the empty string.  If there are any type-specific attributes set,
-this method should return that metadata, formatted as key: value pairs with
-the keys right-aligned in the first 15 characters, followed by a space, a
-colon, and the value.
+Returns a formatted text description of the type-specific attributes of
+the object, or undef on error.  The default implementation of this method
+always returns the empty string.  If there are any type-specific
+attributes set, this method should return that metadata, formatted as key:
+value pairs with the keys right-aligned in the first 15 characters,
+followed by a space, a colon, and the value.
 
 =item destroy(PRINCIPAL, HOSTNAME [, DATETIME])
 
 Destroys the object by removing all record of it from the database.  The
-Wallet::Object::Base implementation handles the generic database work,
-but any subclass should override this method to do any deletion of files
-or entries in external databases and any other database entries and then
-call the parent method to handle the generic database cleanup.  Returns
-true on success and false on failure.  The arguments are used for logging
-and history and should indicate the user and host from which the change is
+Wallet::Object::Base implementation handles the generic database work, but
+any subclass should override this method to do any deletion of files or
+entries in external databases and any other database entries and then call
+the parent method to handle the generic database cleanup.  Returns true on
+success and false on failure.  The arguments are used for logging and
+history and should indicate the user and host from which the change is
 made and the time of the change.
 
 =item error([ERROR ...])
@@ -789,47 +796,50 @@ have failed.  Callers should call this function to get the error message
 after an undef return from any other instance method.
 
 For the convenience of child classes, this method can also be called with
-one or more error strings.  If so, those strings are concatenated together,
-trailing newlines are removed, any text of the form S<C< at \S+ line
-\d+\.?>> at the end of the message is stripped off, and the result is stored
-as the error.  Only child classes should call this method with an error
-string.
+one or more error strings.  If so, those strings are concatenated
+together, trailing newlines are removed, any text of the form S<C< at \S+
+line \d+\.?>> at the end of the message is stripped off, and the result is
+stored as the error.  Only child classes should call this method with an
+error string.
 
 =item expires([EXPIRES, PRINCIPAL, HOSTNAME [, DATETIME]])
 
 Sets or retrieves the expiration date of an object.  If no arguments are
-given, returns the current expiration or undef if no expiration is set.  If
-arguments are given, change the expiration to EXPIRES and return true on
-success and false on failure.  EXPIRES must be in the format C<YYYY-MM-DD
-HH:MM:SS>, although the time portion may be omitted.  Pass in the empty
-string for EXPIRES to clear the expiration date.
-
-The other arguments are used for logging and history and should indicate the
-user and host from which the change is made and the time of the change.
+given, returns the current expiration or undef if no expiration is set.
+If arguments are given, change the expiration to EXPIRES and return true
+on success and false on failure.  EXPIRES must be in the format
+C<YYYY-MM-DD HH:MM:SS>, although the time portion may be omitted.  Pass in
+the empty string for EXPIRES to clear the expiration date.
+
+The other arguments are used for logging and history and should indicate
+the user and host from which the change is made and the time of the
+change.
 
 =item flag_check(FLAG)
 
-Check whether the given flag is set on an object.  Returns true if set, C<0>
-if not set, and undef on error.
+Check whether the given flag is set on an object.  Returns true if set,
+C<0> if not set, and undef on error.
 
 =item flag_clear(FLAG, PRINCIPAL, HOSTNAME [, DATETIME])
 
 Clears FLAG on an object.  Returns true on success and false on failure.
-The other arguments are used for logging and history and should indicate the
-user and host from which the change is made and the time of the change.
+The other arguments are used for logging and history and should indicate
+the user and host from which the change is made and the time of the
+change.
 
 =item flag_list()
 
 List the flags set on an object.  If no flags are set, returns the empty
-list.  On failure, returns an empty list.  To distinguish between the empty
-response and an error, the caller should call error() after an empty return.
-It is guaranteed to return undef if there was no error.
+list.  On failure, returns an empty list.  To distinguish between the
+empty response and an error, the caller should call error() after an empty
+return.  It is guaranteed to return undef if there was no error.
 
 =item flag_set(FLAG, PRINCIPAL, HOSTNAME [, DATETIME])
 
 Sets FLAG on an object.  Returns true on success and false on failure.
-The other arguments are used for logging and history and should indicate the
-user and host from which the change is made and the time of the change.
+The other arguments are used for logging and history and should indicate
+the user and host from which the change is made and the time of the
+change.
 
 =item get(PRINCIPAL, HOSTNAME [, DATETIME])
 
@@ -856,9 +866,9 @@ Sets or retrieves the owner of an object as a numeric ACL ID.  If no
 arguments are given, returns the current owner ACL ID or undef if none is
 set.  If arguments are given, change the owner to OWNER and return true on
 success and false on failure.  Pass in the empty string for OWNER to clear
-the owner.  The other arguments are used for logging and history and should
-indicate the user and host from which the change is made and the time of the
-change.
+the owner.  The other arguments are used for logging and history and
+should indicate the user and host from which the change is made and the
+time of the change.
 
 =item show()
 
@@ -866,17 +876,17 @@ Returns a formatted text description of the object suitable for human
 display, or undef on error.  All of the base metadata about the object,
 formatted as key: value pairs with the keys aligned in the first 15
 characters followed by a space, a colon, and the value.  The attr_show()
-method of the object is also called and any formatted output it returns will
-be included.  If any ACLs or an owner are set, after this data there is a
-blank line and then the information for each unique ACL, separated by blank
-lines.
+method of the object is also called and any formatted output it returns
+will be included.  If any ACLs or an owner are set, after this data there
+is a blank line and then the information for each unique ACL, separated by
+blank lines.
 
 =item store(DATA, PRINCIPAL, HOSTNAME [, DATETIME])
 
 Store user-supplied data into the given object.  This may not be supported
-by all backends (for instance, backends that automatically generate the data
-will not support this).  The default implementation rejects all store()
-calls with an error message saying that the object is immutable.
+by all backends (for instance, backends that automatically generate the
+data will not support this).  The default implementation rejects all
+store() calls with an error message saying that the object is immutable.
 
 =item type()
 
@@ -894,23 +904,24 @@ provided for subclasses to call to implement some generic actions.
 =item log_action (ACTION, PRINCIPAL, HOSTNAME, DATETIME)
 
 Updates the history tables and trace information appropriately for ACTION,
-which should be either C<get> or C<store>.  No other changes are made to the
-database, just updates of the history table and trace fields with the
+which should be either C<get> or C<store>.  No other changes are made to
+the database, just updates of the history table and trace fields with the
 provided data about who performed the action and when.
 
-This function commits its transaction when complete and therefore should not
-be called inside another transaction.  Normally it's called as a separate
-transaction after the data is successfully stored or retrieved.
+This function commits its transaction when complete and therefore should
+not be called inside another transaction.  Normally it's called as a
+separate transaction after the data is successfully stored or retrieved.
 
 =item log_set (FIELD, OLD, NEW, PRINCIPAL, HOSTNAME, DATETIME)
 
-Updates the history tables for the change in a setting value for an object.
-FIELD should be one of C<owner>, C<acl_get>, C<acl_store>, C<acl_show>,
-C<acl_destroy>, C<acl_flags>, C<expires>, C<flags>, or a value starting with
-C<type_data> followed by a space and a type-specific field name.  The last
-form is the most common form used by a subclass.  OLD is the previous value
-of the field or undef if the field was unset, and NEW is the new value of
-the field or undef if the field should be unset.
+Updates the history tables for the change in a setting value for an
+object.  FIELD should be one of C<owner>, C<acl_get>, C<acl_store>,
+C<acl_show>, C<acl_destroy>, C<acl_flags>, C<expires>, C<flags>, or a
+value starting with C<type_data> followed by a space and a type-specific
+field name.  The last form is the most common form used by a subclass.
+OLD is the previous value of the field or undef if the field was unset,
+and NEW is the new value of the field or undef if the field should be
+unset.
 
 This function does not commit and does not catch database exceptions.  It
 should normally be called as part of a larger transaction that implements
@@ -922,8 +933,8 @@ the change in the setting.
 
 wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/Object/File.pm b/perl/Wallet/Object/File.pm
index be72d7f..69262f6 100644
--- a/perl/Wallet/Object/File.pm
+++ b/perl/Wallet/Object/File.pm
@@ -1,7 +1,7 @@
 # Wallet::Object::File -- File object implementation for the wallet.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2008 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2008, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -24,7 +24,7 @@ use Wallet::Object::Base;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.01';
+$VERSION = '0.02';
 
 ##############################################################################
 # File naming
@@ -136,6 +136,9 @@ __END__
 
 Wallet::Object::File - File object implementation for wallet
 
+=for stopwords
+API HOSTNAME DATETIME keytab remctld backend nul Allbery wallet-backend
+
 =head1 SYNOPSIS
 
     my @name = qw(file mysql-lsdb)
@@ -163,17 +166,18 @@ set wallet configuration.
 =head1 METHODS
 
 This object mostly inherits from Wallet::Object::Base.  See the
-documentation for that class for all generic methods.  Below are only those
-methods that are overridden or behave specially for this implementation.
+documentation for that class for all generic methods.  Below are only
+those methods that are overridden or behave specially for this
+implementation.
 
 =over 4
 
 =item destroy(PRINCIPAL, HOSTNAME [, DATETIME])
 
 Destroys a file object by removing it from the database and deleting the
-corresonding file on the wallet server.  Returns true on success and false
-on failure.  The caller should call error() to get the error message after
-a failure.  PRINCIPAL, HOSTNAME, and DATETIME are stored as history
+corresponding file on the wallet server.  Returns true on success and
+false on failure.  The caller should call error() to get the error message
+after a failure.  PRINCIPAL, HOSTNAME, and DATETIME are stored as history
 information.  PRINCIPAL should be the user who is destroying the object.
 If DATETIME isn't given, the current time is used.
 
diff --git a/perl/Wallet/Object/Keytab.pm b/perl/Wallet/Object/Keytab.pm
index b604907..760280f 100644
--- a/perl/Wallet/Object/Keytab.pm
+++ b/perl/Wallet/Object/Keytab.pm
@@ -382,6 +382,10 @@ __END__
 # Documentation
 ##############################################################################
 
+=for stopwords
+keytab API KDC keytabs HOSTNAME DATETIME enctypes enctype DBH metadata
+unmanaged kadmin Allbery
+
 =head1 NAME
 
 Wallet::Object::Keytab - Keytab object implementation for wallet
@@ -396,17 +400,17 @@ Wallet::Object::Keytab - Keytab object implementation for wallet
 
 =head1 DESCRIPTION
 
-Wallet::Object::Keytab is a representation of Kerberos keytab objects in the
-wallet.  It implements the wallet object API and provides the necessary
-glue to create principals in a Kerberos KDC, create and return keytabs for
-those principals, and delete them out of Kerberos when the wallet object is
-destroyed.
+Wallet::Object::Keytab is a representation of Kerberos keytab objects in
+the wallet.  It implements the wallet object API and provides the
+necessary glue to create principals in a Kerberos KDC, create and return
+keytabs for those principals, and delete them out of Kerberos when the
+wallet object is destroyed.
 
 A keytab is an on-disk store for the key or keys for a Kerberos principal.
-Keytabs are used by services to verify incoming authentication from clients
-or by automated processes that need to authenticate to Kerberos.  To create
-a keytab, the principal has to be created in Kerberos and then a keytab is
-generated and stored in a file on disk.
+Keytabs are used by services to verify incoming authentication from
+clients or by automated processes that need to authenticate to Kerberos.
+To create a keytab, the principal has to be created in Kerberos and then a
+keytab is generated and stored in a file on disk.
 
 This implementation generates a new random key (and hence invalidates all
 existing keytabs) each time the keytab is retrieved with the get() method.
@@ -418,8 +422,9 @@ information about how to set wallet configuration.
 =head1 METHODS
 
 This object mostly inherits from Wallet::Object::Base.  See the
-documentation for that class for all generic methods.  Below are only those
-methods that are overridden or behave specially for this implementation.
+documentation for that class for all generic methods.  Below are only
+those methods that are overridden or behave specially for this
+implementation.
 
 =over 4
 
@@ -453,12 +458,12 @@ enctypes than those requested by this attribute.
 
 If no other arguments besides ATTRIBUTE are given, returns the values of
 that attribute, if any, as a list.  On error, returns the empty list.  To
-distinguish between an error and an empty return, call error() afterwards.
+distinguish between an error and an empty return, call error() afterward.
 It is guaranteed to return undef unless there was an error.
 
 If other arguments are given, sets the given ATTRIBUTE values to VALUES,
-which must be a reference to an array (even if only one value is being set).
-Pass a reference to an empty array to clear the attribute values.
+which must be a reference to an array (even if only one value is being
+set).  Pass a reference to an empty array to clear the attribute values.
 PRINCIPAL, HOSTNAME, and DATETIME are stored as history information.
 PRINCIPAL should be the user who is destroying the object.  If DATETIME
 isn't given, the current time is used.
@@ -467,12 +472,12 @@ isn't given, the current time is used.
 
 This is a class method and should be called on the Wallet::Object::Keytab
 class.  It creates a new object with the given TYPE and NAME (TYPE is
-normally C<keytab> and must be for the rest of the wallet system to use the
-right class, but this module doesn't check for ease of subclassing), using
-DBH as the handle to the wallet metadata database.  PRINCIPAL, HOSTNAME, and
-DATETIME are stored as history information.  PRINCIPAL should be the user
-who is creating the object.  If DATETIME isn't given, the current time is
-used.
+normally C<keytab> and must be for the rest of the wallet system to use
+the right class, but this module doesn't check for ease of subclassing),
+using DBH as the handle to the wallet metadata database.  PRINCIPAL,
+HOSTNAME, and DATETIME are stored as history information.  PRINCIPAL
+should be the user who is creating the object.  If DATETIME isn't given,
+the current time is used.
 
 When a new keytab object is created, the Kerberos principal designated by
 NAME is also created in the Kerberos realm determined from the wallet
@@ -515,9 +520,9 @@ used.
 
 =item KEYTAB_TMP/keytab.<pid>
 
-The keytab is created in this file using C<ktadd> and then read into memory.
-KEYTAB_TMP is set in the wallet configuration, and <pid> is the process ID
-of the current process.  The file is unlinked after being read.
+The keytab is created in this file using C<ktadd> and then read into
+memory.  KEYTAB_TMP is set in the wallet configuration, and <pid> is the
+process ID of the current process.  The file is unlinked after being read.
 
 =back
 
@@ -536,8 +541,8 @@ wallet database do not have realm information.
 
 kadmin(8), Wallet::Config(3), Wallet::Object::Base(3), wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/Schema.pm b/perl/Wallet/Schema.pm
index 252da03..589a15d 100644
--- a/perl/Wallet/Schema.pm
+++ b/perl/Wallet/Schema.pm
@@ -133,6 +133,10 @@ __DATA__
 
 Wallet::Schema - Database schema for the wallet system
 
+=for stopwords
+SQL ACL API APIs enums Enums Keytab Backend keytab backend enctypes
+enctype Allbery
+
 =head1 SYNOPSIS
 
     use Wallet::Schema;
@@ -157,30 +161,30 @@ MySQL and may require some modifications for other databases.
 
 =item new()
 
-Instantiates a new Wallet::Schema object.  This parses the documentation and
-extracts the schema, but otherwise doesn't do anything.
+Instantiates a new Wallet::Schema object.  This parses the documentation
+and extracts the schema, but otherwise doesn't do anything.
 
 =item create(DBH)
 
-Given a connected database handle, runs the SQL commands necessary to create
-the wallet database in an otherwise empty database.  This method will not
-drop any existing tables and will therefore fail if a wallet database has
-already been created.  On any error, this method will throw a database
-exception.
+Given a connected database handle, runs the SQL commands necessary to
+create the wallet database in an otherwise empty database.  This method
+will not drop any existing tables and will therefore fail if a wallet
+database has already been created.  On any error, this method will throw a
+database exception.
 
 =item drop(DBH)
 
 Given a connected database handle, drop all of the wallet tables from that
-database if any of those tables exist.  This method will only remove tables
-that are part of the current schema or one of the previous known schema and
-won't remove other tables.  On any error, this method will throw a database
-exception.
+database if any of those tables exist.  This method will only remove
+tables that are part of the current schema or one of the previous known
+schema and won't remove other tables.  On any error, this method will
+throw a database exception.
 
 =item sql()
 
-Returns the schema and the population of the normalization tables as a list
-of SQL commands to run to create the wallet database in an otherwise empty
-database.
+Returns the schema and the population of the normalization tables as a
+list of SQL commands to run to create the wallet database in an otherwise
+empty database.
 
 =back
 
@@ -188,8 +192,8 @@ database.
 
 =head2 Normalization Tables
 
-The following are normalization tables used to constrain the values in other
-tables.
+The following are normalization tables used to constrain the values in
+other tables.
 
 Holds the supported flag names:
 
@@ -221,16 +225,16 @@ Holds the supported ACL schemes and their corresponding Perl classes:
       values ('netdb-root', 'Wallet::ACL::NetDB::Root');
 
 If you have extended the wallet to support additional object types or
-additional ACL schemes, you will want to add additional rows to these tables
-mapping those types or schemes to Perl classes that implement the object or
-ACL verifier APIs.
+additional ACL schemes, you will want to add additional rows to these
+tables mapping those types or schemes to Perl classes that implement the
+object or ACL verifier APIs.
 
 =head2 ACL Tables
 
-A wallet ACL consists of zero or more ACL entries, each of which is a scheme
-and an identifier.  The scheme identifies the check that should be performed
-and the identifier is additional scheme-specific information.  Each ACL
-references entries in the following table:
+A wallet ACL consists of zero or more ACL entries, each of which is a
+scheme and an identifier.  The scheme identifies the check that should be
+performed and the identifier is additional scheme-specific information.
+Each ACL references entries in the following table:
 
   create table acls
      (ac_id               integer auto_increment primary key,
@@ -249,8 +253,9 @@ in:
   create index ae_id on acl_entries (ae_id);
 
 ACLs may be referred to in the API via either the numeric ID or the
-human-readable name, but internally ACLs are always referenced by numeric ID
-so that they can be renamed without requiring complex data modifications.
+human-readable name, but internally ACLs are always referenced by numeric
+ID so that they can be renamed without requiring complex data
+modifications.
 
 Currently, the ACL named C<ADMIN> (case-sensitive) is special-cased in the
 Wallet::Server code and granted global access.
@@ -269,17 +274,18 @@ table.
       ah_on               datetime not null);
   create index ah_acl on acl_history (ah_acl);
 
-ah_action must be one of C<create>, C<destroy>, C<add>, or C<remove> (enums
-aren't used for compatibility with databases other than MySQL).  For a
-change of type create or destroy, only the action and the trace records (by,
-from, and on) are stored.  For a change to the lines of an ACL, the scheme
-and identifier of the line that was added or removed is included.  Note that
-changes to the ACL name are not recorded; ACLs are always tracked by
-system-generated ID, so name changes are purely cosmetic.
+ah_action must be one of C<create>, C<destroy>, C<add>, or C<remove>
+(enums aren't used for compatibility with databases other than MySQL).
+For a change of type create or destroy, only the action and the trace
+records (by, from, and on) are stored.  For a change to the lines of an
+ACL, the scheme and identifier of the line that was added or removed is
+included.  Note that changes to the ACL name are not recorded; ACLs are
+always tracked by system-generated ID, so name changes are purely
+cosmetic.
 
-ah_by stores the authenticated identity that made the change, ah_from stores
-the host from which they made the change, and ah_on stores the time the
-change was made.
+ah_by stores the authenticated identity that made the change, ah_from
+stores the host from which they made the change, and ah_on stores the time
+the change was made.
 
 =head2 Object Tables
 
@@ -311,13 +317,13 @@ table:
   create index ob_expires on objects (ob_expires);
 
 Object names are not globally unique but only unique within their type, so
-the table has a joint primary key.  Each object has an owner and then up to
-five more specific ACLs.  The owner provides permission for get, store, and
-show operations if no more specific ACL is set.  It does not provide
+the table has a joint primary key.  Each object has an owner and then up
+to five more specific ACLs.  The owner provides permission for get, store,
+and show operations if no more specific ACL is set.  It does not provide
 permission for destroy or flags.
 
-The ob_acl_flags ACL controls who can set flags on this object.  Each object
-may have zero or more flags associated with it:
+The ob_acl_flags ACL controls who can set flags on this object.  Each
+object may have zero or more flags associated with it:
 
   create table flags
      (fl_type             varchar(16)
@@ -348,27 +354,28 @@ this table:
       oh_on               datetime not null);
   create index oh_object on object_history (oh_type, oh_name);
 
-oh_action must be one of C<create>, C<destroy>, C<get>, C<store>, or C<set>.
-oh_field must be one of C<owner>, C<acl_get>, C<acl_store>, C<acl_show>,
-C<acl_destroy>, C<acl_flags>, C<expires>, C<flags>, or C<type_data>.  Enums
-aren't used for compatibility with databases other than MySQL.
-
-For a change of type create, get, store, or destroy, only the action and the
-trace records (by, from, and on) are stored.  For changes to columns or to
-the flags table, oh_field takes what attribute is changed, oh_from takes the
-previous value converted to a string and oh_to takes the next value
-similarly converted to a string.  The special field value "type_data" is
-used when type-specific data is changed, and in that case (and only that
-case) some type-specific name for the data being changed is stored in
-oh_type_field.
+oh_action must be one of C<create>, C<destroy>, C<get>, C<store>, or
+C<set>.  oh_field must be one of C<owner>, C<acl_get>, C<acl_store>,
+C<acl_show>, C<acl_destroy>, C<acl_flags>, C<expires>, C<flags>, or
+C<type_data>.  Enums aren't used for compatibility with databases other
+than MySQL.
+
+For a change of type create, get, store, or destroy, only the action and
+the trace records (by, from, and on) are stored.  For changes to columns
+or to the flags table, oh_field takes what attribute is changed, oh_from
+takes the previous value converted to a string and oh_to takes the next
+value similarly converted to a string.  The special field value
+"type_data" is used when type-specific data is changed, and in that case
+(and only that case) some type-specific name for the data being changed is
+stored in oh_type_field.
 
 When clearing a flag, oh_old will have the name of the flag and oh_new
 will be null.  When setting a flag, oh_old will be null and oh_new will
 have the name of the flag.
 
-oh_by stores the authenticated identity that made the change, oh_from stores
-the host from which they made the change, and oh_on stores the time the
-change was made.
+oh_by stores the authenticated identity that made the change, oh_from
+stores the host from which they made the change, and oh_on stores the time
+the change was made.
 
 =head2 Keytab Backend Data
 
@@ -406,16 +413,16 @@ and then the restrictions for a given keytab are stored in this table:
       primary key (ke_name, ke_enctype));
   create index ke_name on keytab_enctypes (ke_name);
 
-To use this functionality, you will need to populate the enctypes table with
-the enctypes that a keytab may be restricted to.  Currently, there is no
-automated mechanism to do this.
+To use this functionality, you will need to populate the enctypes table
+with the enctypes that a keytab may be restricted to.  Currently, there is
+no automated mechanism to do this.
 
 =head1 SEE ALSO
 
 wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/Wallet/Server.pm b/perl/Wallet/Server.pm
index 40e48a3..dd596c4 100644
--- a/perl/Wallet/Server.pm
+++ b/perl/Wallet/Server.pm
@@ -1,7 +1,7 @@
 # Wallet::Server -- Wallet system server implementation.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007, 2008 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2008, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
@@ -23,7 +23,7 @@ use Wallet::Schema;
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-$VERSION = '0.07';
+$VERSION = '0.08';
 
 ##############################################################################
 # Utility methods
@@ -714,6 +714,10 @@ __END__
 
 Wallet::Server - Wallet system server implementation
 
+=for stopwords
+keytabs metadata backend HOSTNAME ACL timestamp ACL's nul Allbery
+backend-specific wallet-backend
+
 =head1 SYNOPSIS
 
     use Wallet::Server;
@@ -725,8 +729,8 @@ Wallet::Server - Wallet system server implementation
 Wallet::Server is the top-level class that implements the wallet server.
 The wallet is a system for storing, generating, and retrieving secure
 information such as Kerberos keytabs.  The server maintains metadata about
-the objects, checks access against ACLs, and dispatches requests for objects
-to backend implementations for that object type.
+the objects, checks access against ACLs, and dispatches requests for
+objects to backend implementations for that object type.
 
 Wallet::Server is normally instantiated and used by B<wallet-backend>, a
 thin wrapper around this object that determines the authenticated remote
@@ -734,8 +738,8 @@ user and gets user input and then calls the appropriate method of this
 object.
 
 To use this object, several configuration variables must be set (at least
-the database configuration).  For information on those variables and how to
-set them, see Wallet::Config(3).
+the database configuration).  For information on those variables and how
+to set them, see Wallet::Config(3).
 
 =head1 CLASS METHODS
 
@@ -765,11 +769,12 @@ failure to get the error message.
 
 Gets or sets the ACL type ACL to ID for the object identified by TYPE and
 NAME.  ACL should be one of C<get>, C<store>, C<show>, C<destroy>, or
-C<flags>.  If ID is not given, returns the current setting of that ACL as a
-numeric ACL ID or undef if that ACL isn't set or on failure.  To distinguish
-between an ACL that isn't set and a failure to retrieve the ACL, the caller
-should call error() after an undef return.  If error() also returns undef,
-that ACL wasn't set; otherwise, error() will return the error message.
+C<flags>.  If ID is not given, returns the current setting of that ACL as
+a numeric ACL ID or undef if that ACL isn't set or on failure.  To
+distinguish between an ACL that isn't set and a failure to retrieve the
+ACL, the caller should call error() after an undef return.  If error()
+also returns undef, that ACL wasn't set; otherwise, error() will return
+the error message.
 
 If ID is given, sets the specified ACL to ID, which can be either the name
 of an ACL or a numeric ACL ID.  To set an ACL, the current user must be
@@ -798,64 +803,65 @@ failure.
 
 Destroys the ACL identified by ID, which may be either the ACL name or its
 numeric ID.  This call will fail if the ACL is still referenced by any
-object.  The ADMIN ACL may not be destroyed.  To destroy an ACL, the current
-user must be authorized by the ADMIN ACL.  Returns true on success and false
-on failure.
+object.  The ADMIN ACL may not be destroyed.  To destroy an ACL, the
+current user must be authorized by the ADMIN ACL.  Returns true on success
+and false on failure.
 
 =item acl_history(ID)
 
-Returns the history of the ACL identified by ID, which may be either the ACL
-name or its numeric ID.  To see the history of an ACL, the current user must
-be authorized by the ADMIN ACL.  Each change that modifies the ACL (not
-counting changes in the name of the ACL) will be represented by two lines.
-The first line will have a timestamp of the change followed by a description
-of the change, and the second line will give the user who made the change
-and the host from which the change was made.  Returns undef on failure.
+Returns the history of the ACL identified by ID, which may be either the
+ACL name or its numeric ID.  To see the history of an ACL, the current
+user must be authorized by the ADMIN ACL.  Each change that modifies the
+ACL (not counting changes in the name of the ACL) will be represented by
+two lines.  The first line will have a timestamp of the change followed by
+a description of the change, and the second line will give the user who
+made the change and the host from which the change was made.  Returns
+undef on failure.
 
 =item acl_remove(ID, SCHEME, IDENTIFIER)
 
 Removes from the ACL identified by ID the entry matching SCHEME and
 IDENTIFIER.  ID may be either the name of the ACL or its numeric ID.  The
 last entry in the ADMIN ACL cannot be removed.  To remove an entry from an
-ACL, the current user must be authorized by the ADMIN ACL.  Returns true on
-success and false on failure.
+ACL, the current user must be authorized by the ADMIN ACL.  Returns true
+on success and false on failure.
 
 =item acl_rename(OLD, NEW)
 
 Renames the ACL identified by OLD to NEW.  This changes the human-readable
-name, not the underlying numeric ID, so the ACL's associations with objects
-will be unchanged.  The ADMIN ACL may not be renamed.  OLD may be either the
-current name or the numeric ID.  NEW must not be all-numeric.  To rename an
-ACL, the current user must be authorized by the ADMIN ACL.  Returns true on
-success and false on failure.
+name, not the underlying numeric ID, so the ACL's associations with
+objects will be unchanged.  The ADMIN ACL may not be renamed.  OLD may be
+either the current name or the numeric ID.  NEW must not be all-numeric.
+To rename an ACL, the current user must be authorized by the ADMIN ACL.
+Returns true on success and false on failure.
 
 =item acl_show(ID)
 
 Returns a human-readable description, including membership, of the ACL
 identified by ID, which may be either the ACL name or its numeric ID.  To
-show an ACL, the current user must be authorized by the ADMIN ACL (although
-be aware that anyone with show access to an object can see the membership of
-ACLs associated with that object through the show() method).  Returns the
-human-readable description on success and undef on failure.
+show an ACL, the current user must be authorized by the ADMIN ACL
+(although be aware that anyone with show access to an object can see the
+membership of ACLs associated with that object through the show() method).
+Returns the human-readable description on success and undef on failure.
 
 =item attr(TYPE, NAME, ATTRIBUTE [, VALUE ...])
 
 Sets or retrieves a given object attribute.  Attributes are used to store
-backend-specific information for a particular object type and ATTRIBUTE must
-be an attribute type known to the underlying object implementation.
+backend-specific information for a particular object type and ATTRIBUTE
+must be an attribute type known to the underlying object implementation.
 
 If VALUE is not given, returns the values of that attribute, if any, as a
 list.  On error, returns the empty list.  To distinguish between an error
-and an empty return, call error() afterwards.  It is guaranteed to return
-undef unless there was an error.  To retrieve an attribute setting, the user
-must be authorized by the ADMIN ACL, the show ACL if set, or the owner ACL
-if the show ACL is not set.
+and an empty return, call error() afterward.  It is guaranteed to return
+undef unless there was an error.  To retrieve an attribute setting, the
+user must be authorized by the ADMIN ACL, the show ACL if set, or the
+owner ACL if the show ACL is not set.
 
-If VALUE is given, sets the given ATTRIBUTE values to VALUE, which is one or
-more attribute values.  Pass the empty string as the only VALUE to clear the
-attribute values.  Returns true on success and false on failure.  To set an
-attribute value, the user must be authorized by the ADMIN ACL, the store ACL
-if set, or the owner ACL if the store ACL is not set.
+If VALUE is given, sets the given ATTRIBUTE values to VALUE, which is one
+or more attribute values.  Pass the empty string as the only VALUE to
+clear the attribute values.  Returns true on success and false on failure.
+To set an attribute value, the user must be authorized by the ADMIN ACL,
+the store ACL if set, or the owner ACL if the store ACL is not set.
 
 =item autocreate(TYPE, NAME)
 
@@ -877,9 +883,9 @@ for the existence of the object.
 
 =item create(TYPE, NAME)
 
-Creates a new object of type TYPE and name NAME.  TYPE must be a recognized
-type for which the wallet system has a backend implementation.  Returns true
-on success and false on failure.
+Creates a new object of type TYPE and name NAME.  TYPE must be a
+recognized type for which the wallet system has a backend implementation.
+Returns true on success and false on failure.
 
 To create an object using this method, the current user must be authorized
 by the ADMIN ACL.  Use autocreate() to create objects based on the default
@@ -888,18 +894,18 @@ owner as determined by the wallet configuration.
 =item destroy(TYPE, NAME)
 
 Destroys the object identified by TYPE and NAME.  This destroys any data
-that the wallet had saved about the object, may remove the underlying object
-from other external systems, and destroys the wallet database entry for the
-object.  To destroy an object, the current user must be authorized by the
-ADMIN ACL or the destroy ACL on the object; the owner ACL is not sufficient.
-Returns true on success and false on failure.
+that the wallet had saved about the object, may remove the underlying
+object from other external systems, and destroys the wallet database entry
+for the object.  To destroy an object, the current user must be authorized
+by the ADMIN ACL or the destroy ACL on the object; the owner ACL is not
+sufficient.  Returns true on success and false on failure.
 
 =item dbh()
 
-Returns the database handle of a Wallet::Server object.  This is used mostly
-for testing; normally, clients should perform all actions through the
-Wallet::Server object to ensure that authorization and history logging is
-done properly.
+Returns the database handle of a Wallet::Server object.  This is used
+mostly for testing; normally, clients should perform all actions through
+the Wallet::Server object to ensure that authorization and history logging
+is done properly.
 
 =item error()
 
@@ -909,12 +915,12 @@ after an undef return from any other instance method.
 
 =item expires(TYPE, NAME [, EXPIRES])
 
-Gets or sets the expiration for the object identified by TYPE and NAME.  If
-EXPIRES is not given, returns the current expiration or undef if no
-expiration is set or on an error.  To distinguish between an expiration that
-isn't set and a failure to retrieve the expiration, the caller should call
-error() after an undef return.  If error() also returns undef, that ACL
-wasn't set; otherwise, error() will return the error message.
+Gets or sets the expiration for the object identified by TYPE and NAME.
+If EXPIRES is not given, returns the current expiration or undef if no
+expiration is set or on an error.  To distinguish between an expiration
+that isn't set and a failure to retrieve the expiration, the caller should
+call error() after an undef return.  If error() also returns undef, that
+ACL wasn't set; otherwise, error() will return the error message.
 
 If EXPIRES is given, sets the expiration to EXPIRES.  EXPIRES must be in
 the format C<YYYY-MM-DD +HH:MM:SS>, although the time portion may be
@@ -924,23 +930,23 @@ ADMIN ACL.  Returns true for success and false for failure.
 
 =item flag_clear(TYPE, NAME, FLAG)
 
-Clears the flag FLAG on the object identified by TYPE and NAME.  To clear a
-flag, the current user must be authorized by the ADMIN ACL or the flags ACL
-on the object.
+Clears the flag FLAG on the object identified by TYPE and NAME.  To clear
+a flag, the current user must be authorized by the ADMIN ACL or the flags
+ACL on the object.
 
 =item flag_set(TYPE, NAME, FLAG)
 
 Sets the flag FLAG on the object identified by TYPE and NAME.  To set a
-flag, the current user must be authorized by the ADMIN ACL or the flags ACL
-on the object.
+flag, the current user must be authorized by the ADMIN ACL or the flags
+ACL on the object.
 
 =item get(TYPE, NAME)
 
 Returns the data associated with the object identified by TYPE and NAME.
-Depending on the object TYPE, this may generate new data and invalidate any
-existing data or it may return data previously stored or generated.  Note
-that this data may be binary and may contain nul characters.  To get an
-object, the current user must either be authorized by the owner ACL or
+Depending on the object TYPE, this may generate new data and invalidate
+any existing data or it may return data previously stored or generated.
+Note that this data may be binary and may contain nul characters.  To get
+an object, the current user must either be authorized by the owner ACL or
 authorized by the get ACL; however, if the get ACL is set, the owner ACL
 will not be checked.  Being a member of the ADMIN ACL does not provide any
 special privileges to get objects.
@@ -950,48 +956,49 @@ between undef and the empty string, which is valid object data.
 
 =item history(TYPE, NAME)
 
-Returns (as a string) the human-readable history of the object identified by
-TYPE and NAME, or undef on error.  To see the object history, the current
-user must be a member of the ADMIN ACL, authorized by the show ACL, or
-authorized by the owner ACL; however, if the show ACL is set, the owner ACL
-will not be checked.
+Returns (as a string) the human-readable history of the object identified
+by TYPE and NAME, or undef on error.  To see the object history, the
+current user must be a member of the ADMIN ACL, authorized by the show
+ACL, or authorized by the owner ACL; however, if the show ACL is set, the
+owner ACL will not be checked.
 
 =item owner(TYPE, NAME [, OWNER])
 
-Gets or sets the owner for the object identified by TYPE and NAME.  If OWNER
-is not given, returns the current owner as a numeric ACL ID or undef if no
-owner is set or on an error.  To distinguish between an owner that isn't set
-and a failure to retrieve the owner, the caller should call error() after an
-undef return.  If error() also returns undef, that ACL wasn't set;
-otherwise, error() will return the error message.
+Gets or sets the owner for the object identified by TYPE and NAME.  If
+OWNER is not given, returns the current owner as a numeric ACL ID or undef
+if no owner is set or on an error.  To distinguish between an owner that
+isn't set and a failure to retrieve the owner, the caller should call
+error() after an undef return.  If error() also returns undef, that ACL
+wasn't set; otherwise, error() will return the error message.
 
-If OWNER is given, sets the owner to OWNER, which may be either the name of
-an ACL or a numeric ACL ID.  To set an owner, the current user must be
+If OWNER is given, sets the owner to OWNER, which may be either the name
+of an ACL or a numeric ACL ID.  To set an owner, the current user must be
 authorized by the ADMIN ACL.  Returns true for success and false for
 failure.
 
-The owner of an object is permitted to get, store, and show that object, but
-cannot destroy or set flags on that object without being listed on those
-ACLs as well.
+The owner of an object is permitted to get, store, and show that object,
+but cannot destroy or set flags on that object without being listed on
+those ACLs as well.
 
 =item show(TYPE, NAME)
 
-Returns (as a string) a human-readable representation of the metadata stored
-for the object identified by TYPE and NAME, or undef on error.  Included is
-the metadata and entries of any ACLs associated with the object.  To show an
-object, the current user must be a member of the ADMIN ACL, authorized by
-the show ACL, or authorized by the owner ACL; however, if the show ACL is
-set, the owner ACL will not be checked.
+Returns (as a string) a human-readable representation of the metadata
+stored for the object identified by TYPE and NAME, or undef on error.
+Included is the metadata and entries of any ACLs associated with the
+object.  To show an object, the current user must be a member of the ADMIN
+ACL, authorized by the show ACL, or authorized by the owner ACL; however,
+if the show ACL is set, the owner ACL will not be checked.
 
 =item store(TYPE, NAME, DATA)
 
-Stores DATA for the object identified with TYPE and NAME for later retrieval
-with get.  Not all object types support this.  Note that DATA may be binary
-and may contain nul characters.  To store an object, the current user must
-either be authorized by the owner ACL or authorized by the store ACL;
-however, if the store ACL is set, the owner ACL is not checked.  Being a
-member of the ADMIN ACL does not provide any special privileges to store
-objects.  Returns true on success and false on failure.
+Stores DATA for the object identified with TYPE and NAME for later
+retrieval with get.  Not all object types support this.  Note that DATA
+may be binary and may contain nul characters.  To store an object, the
+current user must either be authorized by the owner ACL or authorized by
+the store ACL; however, if the store ACL is set, the owner ACL is not
+checked.  Being a member of the ADMIN ACL does not provide any special
+privileges to store objects.  Returns true on success and false on
+failure.
 
 =back
 
@@ -999,8 +1006,8 @@ objects.  Returns true on success and false on failure.
 
 wallet-backend(8)
 
-This module is part of the wallet system.  The current version is available
-from L<http://www.eyrie.org/~eagle/software/wallet/>.
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
 
 =head1 AUTHOR
 
diff --git a/perl/t/pod-spelling.t b/perl/t/pod-spelling.t
new file mode 100755
index 0000000..d3ab858
--- /dev/null
+++ b/perl/t/pod-spelling.t
@@ -0,0 +1,75 @@
+#!/usr/bin/perl -w
+#
+# Check for spelling errors in POD documentation
+#
+# Checks all POD files in the tree for spelling problems using Pod::Spell and
+# either aspell or ispell.  aspell is preferred.  This test is disabled unless
+# RRA_MAINTAINER_TESTS is set, since spelling dictionaries vary too much
+# between environments.
+#
+# Copyright 2008, 2009 Russ Allbery <rra@stanford.edu>
+#
+# This program is free software; you may redistribute it and/or modify it
+# under the same terms as Perl itself.
+
+use strict;
+use Test::More;
+
+# Skip all spelling tests unless the maintainer environment variable is set.
+plan skip_all => 'Spelling tests only run for maintainer'
+    unless $ENV{RRA_MAINTAINER_TESTS};
+
+# Load required Perl modules.
+eval 'use Test::Pod 1.00';
+plan skip_all => 'Test::Pod 1.00 required for testing POD' if $@;
+eval 'use Pod::Spell';
+plan skip_all => 'Pod::Spell required to test POD spelling' if $@;
+
+# Locate a spell-checker.  hunspell is not currently supported due to its lack
+# of support for contractions (at least in the version in Debian).
+my @spell;
+my %options = (aspell => [ qw(-d en_US --home-dir=./ list) ],
+               ispell => [ qw(-d american -l -p /dev/null) ]);
+SEARCH: for my $program (qw/aspell ispell/) {
+    for my $dir (split ':', $ENV{PATH}) {
+        if (-x "$dir/$program") {
+            @spell = ("$dir/$program", @{ $options{$program} });
+        }
+        last SEARCH if @spell;
+    }
+}
+plan skip_all => 'aspell or ispell required to test POD spelling'
+    unless @spell;
+
+# Prerequisites are satisfied, so we're going to do some testing.  Figure out
+# what POD files we have and from that develop our plan.
+$| = 1;
+my @pod = all_pod_files ();
+plan tests => scalar @pod;
+
+# Finally, do the checks.
+for my $pod (@pod) {
+    my $child = open (CHILD, '-|');
+    if (not defined $child) {
+        die "Cannot fork: $!\n";
+    } elsif ($child == 0) {
+        my $pid = open (SPELL, '|-', @spell) or die "Cannot run @spell: $!\n";
+        open (POD, '<', $pod) or die "Cannot open $pod: $!\n";
+        my $parser = Pod::Spell->new;
+        $parser->parse_from_filehandle (\*POD, \*SPELL);
+        close POD;
+        close SPELL;
+        exit ($? >> 8);
+    } else {
+        my @words = <CHILD>;
+        close CHILD;
+      SKIP: {
+            skip "@spell failed for $pod", 1 unless $? == 0;
+            for (@words) {
+                s/^\s+//;
+                s/\s+$//;
+            }
+            is ("@words", '', $pod);
+        }
+    }
+}
diff --git a/perl/t/pod.t b/perl/t/pod.t
index e9aa0a8..c467b82 100755
--- a/perl/t/pod.t
+++ b/perl/t/pod.t
@@ -1,16 +1,14 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 #
-# t/pod.t -- Test POD formatting for the wallet Perl modules.
+# Test POD formatting for the wallet Perl modules.
 #
 # Written by Russ Allbery <rra@stanford.edu>
-# Copyright 2007 Board of Trustees, Leland Stanford Jr. University
+# Copyright 2007, 2010 Board of Trustees, Leland Stanford Jr. University
 #
 # See LICENSE for licensing terms.
 
+use strict;
+use Test::More;
 eval 'use Test::Pod 1.00';
-if ($@) {
-    print "1..1\n";
-    print "ok 1 # skip - Test::Pod 1.00 required for testing POD\n";
-    exit;
-}
+plan skip_all => 'Test::Pod 1.00 required for testing POD' if $@;
 all_pod_files_ok ();