 +	"bytes"
 +	"crypto/rand"
 +	"crypto/x509"
-+	"errors"
-+	"io/ioutil"
++	"fmt"
 +	"log"
-+	"os"
++	"path"
++	"time"
 +
 +	"code.google.com/p/goprotobuf/proto"
 +
-+	tao "github.com/jlmucb/cloudproxy/tao"
++	"github.com/jlmucb/cloudproxy/tao"
 +	"github.com/jlmucb/cloudproxy/util"
 +)
 +
-+const SizeofNonce = 32
++const NonceSize = 32
 +const ChallengeContext = "fileproxy-challenge"
 +
-+// Resource types: files, channels
-+type ResourceInfo struct {
-+	ResourceName      string
-+	ResourceType      string
-+	ResourceStatus    string
-+	ResourceLocation  string
-+	ResourceSize      int
-+	ResourceOwner     string
-+	DateCreated       string
-+	DateModified      string
++// A ResourceType is the type of resource managed by the handler.
++type ResourceType int
++
++// These constants represent the different types of resources.
++const (
++	File ResourceType = iota
++)
++
++// A ResourceStatus is the state in which a resource finds itself.
++type ResourceStatus int
++
++// These constants represent the difference states of resources.
++const (
++	Created ResourceStatus = iota
++)
++
++// A Resource represents a resource managed by a handler.
++type Resource struct {
++	Name              string
++	Type              ResourceType
++	Status            ResourceStatus
++	Location          string
++	Size              int
++	Owner             string
++	DateCreated       time.Time
++	DateModified      time.Time
 +	AuthenticatorType string
 +	Authenticator     [][]byte
 +}
 +
-+type PrincipalInfo struct {
-+	Name   string
-+	Der    []byte
-+	Status string
-+}
-+
++// A PrincipalStatus gives the current state of a principal on a channel.
++type PrincipalStatus int
++
++// These constants represent the different states of principals.
++const (
++	Authenticated PrincipalStatus = iota
++)
++
++// A Principal represents a principal authenticated on a channel (or trying
++// to authenticate on a channel).
++type Principal struct {
++	Name    string
++	CertDER []byte
++	Cert    *x509.Certificate
++	Status  PrincipalStatus
++}
++
++// A ResourceMaster manages a set of resources for a set of principals, using a
++// Guard to make authorization decisions.
 +type ResourceMaster struct {
-+	ProgramName      string
-+	Guard            tao.Guard
-+	BaseDirectory    string
-+	NumResources     int
-+	ResourceArray    []ResourceInfo
-+	NumPrincipals    int
-+	PrincipalArray   []PrincipalInfo
-+	Policy           []string
-+	AdditionalPolicy []string
++	ProgramName   string
++	Guard         tao.Guard
++	BaseDirectory string
++	Resources     map[string]*Resource
++	Principals    map[string]*Principal
++	Policy        []string
 +}
 +
 +// Policy for managing files in the fileserver.

 	help += "%[1]s [options] -(add|retract|query) rule\n"
 	help += "%[1]s [options] -clear\n"
 	flag.Usage = func() {
 		fmt.Fprintf(os.Stderr, help, os.Args[0])
@@ -103,40 +117,107 @@ func main() {
 		switch *guard {
 		case "ACLs":
 			cfg.ACLGuard.SignedACLsPath = rulesPath
 		case "Datalog":

 	if err != nil {
 		return nil, err
 	}
-	defer zeroBytes(m)
+	defer ZeroBytes(m)
 
 	return lh.taoHost.Encrypt(m)
 }
 
 // Unseal decrypts data for the child, but only if the policy is satisfied.
 func (lh *LinuxHost) Unseal(child *LinuxHostChild, sealed []byte) ([]byte, string, error) {
