#
#
# patch "annotate.cc"
#  from [aabab768147caacce00021d84c43fdb18970ff69]
#    to [26a161ceac97a36cde42e45e36e65c849b99e341]
# 
# patch "automate.cc"
#  from [ae5795ae2ee9abf213cde05ab0ae22f8850979dc]
#    to [5be8a8ebdc7a162f0dd0b0cd79f65f3be66d4abf]
# 
# patch "cert.cc"
#  from [04f0ac834fe7b9f37cad403179372049bb60abf8]
#    to [d98658ea6742e5a25f6575d923ce0749849713f6]
# 
# patch "cert.hh"
#  from [b49be5a67073dafca0c1311ae4361d9ad9097e56]
#    to [a8a2f7ee562ac6b3685a81e0114fd94651bdec65]
# 
# patch "cmd_db.cc"
#  from [e176445d9c7e653766fb91b6a4d5ab41804ee1de]
#    to [d70d3eb0c456fc31de08cd9f16c487fc02d2e3fe]
# 
# patch "cmd_diff_log.cc"
#  from [caf5335a9a55a96e92391a998d953b4ddae1b92a]
#    to [02e74a470fac835fd9fe1a52dd0f3d641ee9419e]
# 
# patch "cmd_key_cert.cc"
#  from [67d6c867196333e7d7c0b4d97ab89a72c86472ea]
#    to [54cf94e72318fb08647301be92918e9f94b4e253]
# 
# patch "cmd_list.cc"
#  from [3557979a033d0b34331c21e84b1aac957ee4f8c4]
#    to [d46fdf13b05ef2fdb009aed2adafea6436112c7a]
# 
# patch "cmd_merging.cc"
#  from [528f14816d3bcc0753cf36de625817299ed65be0]
#    to [22376019b500781e104580a1dfa1678954e15872]
# 
# patch "cmd_packet.cc"
#  from [e661fbb33bf6182af21cbd7d7f83a56cf63b3656]
#    to [e519a5ad5cba195c20a6caedd75a165e58d3c08b]
# 
# patch "cmd_ws_commit.cc"
#  from [55bf3a32074c86e68d93fc43bdfaf217dcf61476]
#    to [5559c2b351ed529cfd71dc071e35841ebe8f72a2]
# 
# patch "database.cc"
#  from [901116b8a8dcc0743ea5c1318089be1a181eeb30]
#    to [ddc702beb36a7317da57480b789f64dd0c2f041a]
# 
# patch "database.hh"
#  from [deb173f296a5e4c7908f32ea40de2a985a7a8d78]
#    to [874796e56fe674718be27ae6832e9178edfd90bb]
# 
# patch "database_check.cc"
#  from [c3594aac68156411edfe0779e28f14655a198bf7]
#    to [7ac0f3bce63f4ef189137684433ee8658380fd92]
# 
# patch "lua_hooks.cc"
#  from [69a6fc1c56a61871e90cf7a0c397e5b15a74051e]
#    to [33bca9e22966624a7caaa69386b3e949517199ef]
# 
# patch "lua_hooks.hh"
#  from [bd3e476d9506f29a4efd2751ea2b1fe3fff03617]
#    to [25ed66326986fb26e1887a752eb19eae19ed2302]
# 
# patch "migrate_ancestry.cc"
#  from [4dc87fb08f592d30bd238f40d2629f9e790511ab]
#    to [c02341580f9e65387807dc8f1ae3874d26e81198]
# 
# patch "netsync.cc"
#  from [a9f111f42f151d3c382caec6e1384ebe35ca6991]
#    to [126ff0ef642b515981807cd45f0799f9e121333d]
# 
# patch "project.cc"
#  from [a849cb079e798aecd8cf5620dcf21fb8ea1aa076]
#    to [584ceb9a5300c22f981e53d4b767ef195f9f2a44]
# 
# patch "project.hh"
#  from [6514b20663b3ec51c4bab9794d2fd5548e5bb0ff]
#    to [055d2051d5452036c0934c741f23153eac9c3fcc]
# 
# patch "update.cc"
#  from [7a3e42759fc4ce4b4ef3693b7dcca4cf7f477c12]
#    to [dba7f76d0acb65a068cac1dddb85f8d50a60304b]
#
============================================================
--- annotate.cc	aabab768147caacce00021d84c43fdb18970ff69
+++ annotate.cc	26a161ceac97a36cde42e45e36e65c849b99e341
@@ -343,17 +343,17 @@ static string
 }
 
 static string
-cert_string_value(vector< revision<cert> > const & certs,
+cert_string_value(vector<cert> const & certs,
                   cert_name const & name,
                   bool from_start, bool from_end,
                   string const & sep)
 {
-  for (vector< revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); ++i)
     {
-      if (i->inner().name == name)
+      if (i->name == name)
         {
-          cert_value tv(i->inner().value);
+          cert_value tv(i->value);
           string::size_type f = 0;
           string::size_type l = string::npos;
           if (from_start)
@@ -391,7 +391,7 @@ annotate_context::build_revisions_to_ann
   for (set<revision_id>::const_iterator i = seen.begin();
        i != seen.end(); i++)
     {
-      vector< revision<cert> > certs;
+      vector<cert> certs;
       project.get_revision_certs(*i, certs);
       project.db.erase_bogus_certs(certs);
 
============================================================
--- automate.cc	ae5795ae2ee9abf213cde05ab0ae22f8850979dc
+++ automate.cc	5be8a8ebdc7a162f0dd0b0cd79f65f3be66d4abf
@@ -1501,15 +1501,15 @@ CMD_AUTOMATE(packets_for_certs, N_("REVI
   packet_writer pw(output);
 
   revision_id r_id(decode_hexenc_as<revision_id>(idx(args, 0)(), origin::user));
-  vector< revision<cert> > certs;
+  vector<cert> certs;
 
   E(db.revision_exists(r_id), origin::user,
     F("no such revision '%s'") % r_id);
   project.get_revision_certs(r_id, certs);
 
-  for (vector< revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); i++)
-    pw.consume_revision_cert(i->inner());
+    pw.consume_revision_cert(*i);
 }
 
 // Name: packet_for_fdata
============================================================
--- cert.cc	04f0ac834fe7b9f37cad403179372049bb60abf8
+++ cert.cc	d98658ea6742e5a25f6575d923ce0749849713f6
@@ -16,19 +16,6 @@ using std::string;
 
 using std::string;
 
-// The alternaive is to #include "cert.hh" in vocab.*, which is even
-// uglier.
-
-#include "vocab_macros.hh"
-cc_DECORATE(revision)
-cc_DECORATE(manifest)
-template <typename T>
-static inline void
-verify(T & val)
-{}
-template class revision<cert>;
-template class manifest<cert>;
-
 bool
 cert::operator<(cert const & other) const
 {
============================================================
--- cert.hh	b49be5a67073dafca0c1311ae4361d9ad9097e56
+++ cert.hh	a8a2f7ee562ac6b3685a81e0114fd94651bdec65
@@ -38,7 +38,6 @@ struct cert : public origin_aware
   {}
 
   // These understand the netsync serialization.
-  // They also make revision<cert> and manifest<cert> work.
   explicit cert(std::string const & s);
   cert(std::string const & s, origin::type m);
 
@@ -56,9 +55,6 @@ struct cert : public origin_aware
   void marshal_for_netio(std::string & out) const;
 };
 
-EXTERN template class revision<cert>;
-EXTERN template class manifest<cert>;
-
 #endif // __CERT_HH__
 
 // Local Variables:
============================================================
--- cmd_db.cc	e176445d9c7e653766fb91b6a4d5ab41804ee1de
+++ cmd_db.cc	d70d3eb0c456fc31de08cd9f16c487fc02d2e3fe
@@ -543,7 +543,7 @@ CMD_HIDDEN(load_certs, "load_certs", "",
     options::opts::none)
 {
   database db(app);
-  vector< revision<cert> > certs;
+  vector<cert> certs;
 
   P(F("loading certs"));
   db.get_revision_certs(certs);
============================================================
--- cmd_diff_log.cc	caf5335a9a55a96e92391a998d953b4ddae1b92a
+++ cmd_diff_log.cc	02e74a470fac835fd9fe1a52dd0f3d641ee9419e
@@ -588,14 +588,14 @@ log_certs(project_t & project, ostream &
 log_certs(project_t & project, ostream & os, revision_id id, cert_name name,
           string label, string separator, bool multiline, bool newline)
 {
-  vector< revision<cert> > certs;
+  vector<cert> certs;
   bool first = true;
 
   if (multiline)
     newline = true;
 
   project.get_revision_certs_by_name(id, name, certs);
-  for (vector< revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); ++i)
     {
       if (first)
@@ -605,7 +605,7 @@ log_certs(project_t & project, ostream &
 
       if (multiline)
         os << "\n\n";
-      os << i->inner().value;
+      os << i->value;
       if (newline)
         os << '\n';
 
============================================================
--- cmd_key_cert.cc	67d6c867196333e7d7c0b4d97ab89a72c86472ea
+++ cmd_key_cert.cc	54cf94e72318fb08647301be92918e9f94b4e253
@@ -222,7 +222,8 @@ CMD(trusted, "trusted", "", CMD_REF(key_
     }
 
 
-  bool trusted = app.lua.hook_get_revision_cert_trust(signers, ident,
+  bool trusted = app.lua.hook_get_revision_cert_trust(signers,
+                                                      ident.inner(),
                                                       cname, value);
 
 
============================================================
--- cmd_list.cc	3557979a033d0b34331c21e84b1aac957ee4f8c4
+++ cmd_list.cc	d46fdf13b05ef2fdb009aed2adafea6436112c7a
@@ -70,11 +70,11 @@ CMD(certs, "certs", "", CMD_REF(list), "
 
   revision_id ident;
   complete(app.opts, app.lua,  project, idx(args, 0)(), ident);
-  vector< revision<cert> > ts;
+  vector<cert> ts;
   project.get_revision_certs(ident, ts);
 
   for (size_t i = 0; i < ts.size(); ++i)
-    certs.push_back(idx(ts, i).inner());
+    certs.push_back(idx(ts, i));
 
   {
     set<rsa_keypair_id> checked;
@@ -793,13 +793,13 @@ CMD_AUTOMATE(certs, N_("REV"),
   E(db.revision_exists(rid), origin::user,
     F("no such revision '%s'") % hrid);
 
-  vector< revision<cert> > ts;
+  vector<cert> ts;
   // FIXME_PROJECTS: after projects are implemented,
   // use the db version instead if no project is specified.
   project.get_revision_certs(rid, ts);
 
   for (size_t i = 0; i < ts.size(); ++i)
-    certs.push_back(idx(ts, i).inner());
+    certs.push_back(idx(ts, i));
 
   {
     set<rsa_keypair_id> checked;
@@ -831,7 +831,7 @@ CMD_AUTOMATE(certs, N_("REV"),
       signers.insert(keyid);
 
       bool trusted =
-        app.lua.hook_get_revision_cert_trust(signers, rid,
+        app.lua.hook_get_revision_cert_trust(signers, rid.inner(),
                                              name, tv);
 
       st.push_str_pair(syms::key, keyid());
============================================================
--- cmd_merging.cc	528f14816d3bcc0753cf36de625817299ed65be0
+++ cmd_merging.cc	22376019b500781e104580a1dfa1678954e15872
@@ -94,14 +94,14 @@ pick_branch_for_update(options & opts, d
   bool switched_branch = false;
 
   // figure out which branches the target is in
-  vector< revision<cert> > certs;
+  vector<cert> certs;
   db.get_revision_certs(chosen_rid, branch_cert_name, certs);
   db.erase_bogus_certs(certs);
 
   set< branch_name > branches;
-  for (vector< revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); i++)
-    branches.insert(typecast_vocab<branch_name>(i->inner().value));
+    branches.insert(typecast_vocab<branch_name>(i->value));
 
   if (branches.find(opts.branch) != branches.end())
     {
============================================================
--- cmd_packet.cc	e661fbb33bf6182af21cbd7d7f83a56cf63b3656
+++ cmd_packet.cc	e519a5ad5cba195c20a6caedd75a165e58d3c08b
@@ -120,7 +120,7 @@ namespace
     virtual void consume_revision_cert(cert const & t)
     {
       transaction_guard guard(db);
-      db.put_revision_cert(revision<cert>(t));
+      db.put_revision_cert(t);
       guard.commit();
     }
 
============================================================
--- cmd_ws_commit.cc	55bf3a32074c86e68d93fc43bdfaf217dcf61476
+++ cmd_ws_commit.cc	5559c2b351ed529cfd71dc071e35841ebe8f72a2
@@ -1332,11 +1332,11 @@ CMD(commit, "commit", "ci", CMD_REF(work
     // multiple certs with same name, etc. they can inquire further,
     // later.
     map<cert_name, cert_value> certs;
-    vector< revision<cert> > ctmp;
+    vector<cert> ctmp;
     project.get_revision_certs(restricted_rev_id, ctmp);
-    for (vector< revision<cert> >::const_iterator i = ctmp.begin();
+    for (vector<cert>::const_iterator i = ctmp.begin();
          i != ctmp.end(); ++i)
-      certs.insert(make_pair(i->inner().name, i->inner().value));
+      certs.insert(make_pair(i->name, i->value));
 
     revision_data rdat;
     db.get_revision(restricted_rev_id, rdat);
============================================================
--- database.cc	901116b8a8dcc0743ea5c1318089be1a181eeb30
+++ database.cc	ddc702beb36a7317da57480b789f64dd0c2f041a
@@ -3213,30 +3213,30 @@ bool
 
 
 bool
-database::revision_cert_exists(revision<cert> const & cert)
+database::revision_cert_exists(cert const & cert)
 {
-  return imp->cert_exists(cert.inner(), "revision_certs");
+  return imp->cert_exists(cert, "revision_certs");
 }
 
 bool
-database::put_revision_cert(revision<cert> const & cert)
+database::put_revision_cert(cert const & cert)
 {
   if (revision_cert_exists(cert))
     {
       L(FL("revision cert on '%s' already exists in db")
-        % cert.inner().ident);
+        % cert.ident);
       return false;
     }
 
-  if (!revision_exists(revision_id(cert.inner().ident)))
+  if (!revision_exists(revision_id(cert.ident)))
     {
       W(F("cert revision '%s' does not exist in db")
-        % cert.inner().ident);
+        % cert.ident);
       W(F("dropping cert"));
       return false;
     }
 
-  imp->put_cert(cert.inner(), "revision_certs");
+  imp->put_cert(cert, "revision_certs");
   imp->cert_stamper.note_change();
   return true;
 }
@@ -3265,35 +3265,26 @@ outdated_indicator
 }
 
 outdated_indicator
-database::get_revision_certs(vector< revision<cert> > & ts)
+database::get_revision_certs(vector<cert> & certs)
 {
-  vector<cert> certs;
   imp->get_certs(certs, "revision_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
   return imp->cert_stamper.get_indicator();
 }
 
 outdated_indicator
 database::get_revision_certs(cert_name const & name,
-                            vector< revision<cert> > & ts)
+                            vector<cert> & certs)
 {
-  vector<cert> certs;
   imp->get_certs(name, certs, "revision_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
   return imp->cert_stamper.get_indicator();
 }
 
 outdated_indicator
 database::get_revision_certs(revision_id const & id,
                              cert_name const & name,
-                             vector< revision<cert> > & ts)
+                             vector<cert> & certs)
 {
-  vector<cert> certs;
   imp->get_certs(id.inner(), name, certs, "revision_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
   return imp->cert_stamper.get_indicator();
 }
 
@@ -3301,12 +3292,9 @@ database::get_revision_certs(revision_id
 database::get_revision_certs(revision_id const & id,
                              cert_name const & name,
                              cert_value const & val,
-                             vector< revision<cert> > & ts)
+                             vector<cert> & certs)
 {
-  vector<cert> certs;
   imp->get_certs(id.inner(), name, val, certs, "revision_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
   return imp->cert_stamper.get_indicator();
 }
 
@@ -3327,46 +3315,39 @@ database::get_revision_certs(cert_name c
 outdated_indicator
 database::get_revision_certs(cert_name const & name,
                              cert_value const & val,
-                             vector< revision<cert> > & ts)
+                             vector<cert> & certs)
 {
-  vector<cert> certs;
   imp->get_certs(name, val, certs, "revision_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
   return imp->cert_stamper.get_indicator();
 }
 
 outdated_indicator
 database::get_revision_certs(revision_id const & id,
-                             vector< revision<cert> > & ts)
+                             vector<cert> & certs)
 {
-  vector<cert> certs;
   imp->get_certs(id.inner(), certs, "revision_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
   return imp->cert_stamper.get_indicator();
 }
 
 outdated_indicator
 database::get_revision_certs(revision_id const & ident,
-                             vector<id> & ts)
+                             vector<id> & ids)
 {
   results res;
-  vector<cert> certs;
   imp->fetch(res, one_col, any_rows,
              query("SELECT hash "
                    "FROM revision_certs "
                    "WHERE id = ?")
              % blob(ident.inner()()));
-  ts.clear();
+  ids.clear();
   for (size_t i = 0; i < res.size(); ++i)
-    ts.push_back(id(res[i][0], origin::database));
+    ids.push_back(id(res[i][0], origin::database));
   return imp->cert_stamper.get_indicator();
 }
 
 void
 database::get_revision_cert(id const & hash,
-                            revision<cert> & c)
+                            cert & c)
 {
   results res;
   vector<cert> certs;
@@ -3377,7 +3358,7 @@ database::get_revision_cert(id const & h
              % blob(hash()));
   imp->results_to_certs(res, certs);
   I(certs.size() == 1);
-  c = revision<cert>(certs[0]);
+  c = certs[0];
 }
 
 bool
@@ -3394,28 +3375,6 @@ database::revision_cert_exists(revision_
   return (res.size() == 1);
 }
 
-void
-database::get_manifest_certs(manifest_id const & id,
-                             vector< manifest<cert> > & ts)
-{
-  vector<cert> certs;
-  imp->get_certs(id.inner(), certs, "manifest_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
-}
-
-
-void
-database::get_manifest_certs(cert_name const & name,
-                            vector< manifest<cert> > & ts)
-{
-  vector<cert> certs;
-  imp->get_certs(name, certs, "manifest_certs");
-  ts.clear();
-  add_decoration_to_container(certs, ts);
-}
-
-
 // FIXME: the bogus-cert family of functions is ridiculous
 // and needs to be replaced, or at least factored.
 namespace {
@@ -3425,7 +3384,7 @@ namespace {
     database & db;
     bogus_cert_p(database & db) : db(db) {};
 
-    bool cert_is_bogus(cert const & c) const
+    bool operator()(cert const & c) const
     {
       cert_status status = db.check_cert(c);
       if (status == cert_ok)
@@ -3449,133 +3408,99 @@ namespace {
           return true;
         }
     }
+  };
 
-    bool operator()(revision<cert> const & c) const
-    {
-      return cert_is_bogus(c.inner());
-    }
+  typedef bool (lua_hooks::*cert_trust_hook_t)(set<rsa_keypair_id> const &,
+                                               id const &,
+                                               cert_name const &,
+                                               cert_value const &);
 
-    bool operator()(manifest<cert> const & c) const
-    {
-      return cert_is_bogus(c.inner());
-    }
-  };
-} // anonymous namespace
+  void
+  erase_bogus_certs_internal(vector<cert> & certs,
+                             database & db, lua_hooks & lua,
+                             cert_trust_hook_t hook_get_cert_trust)
+  {
+    typedef vector<cert>::iterator it;
+    it e = remove_if(certs.begin(), certs.end(), bogus_cert_p(db));
+    certs.erase(e, certs.end());
 
-void
-database::erase_bogus_certs(vector< manifest<cert> > & certs)
-{
-  typedef vector< manifest<cert> >::iterator it;
-  it e = remove_if(certs.begin(), certs.end(), bogus_cert_p(*this));
-  certs.erase(e, certs.end());
+    vector<cert> tmp_certs;
 
-  vector< manifest<cert> > tmp_certs;
+    // sorry, this is a crazy data structure
+    typedef tuple<id, cert_name, cert_value> trust_key;
+    typedef map< trust_key,
+      pair< shared_ptr< set<rsa_keypair_id> >, it > > trust_map;
+    trust_map trust;
 
-  // Sorry, this is a crazy data structure
-  typedef tuple< manifest_id, cert_name, cert_value > trust_key;
-  typedef map< trust_key,
-    pair< shared_ptr< set<rsa_keypair_id> >, it > > trust_map;
-  trust_map trust;
+    for (it i = certs.begin(); i != certs.end(); ++i)
+      {
+        trust_key key = trust_key(i->ident.inner(),
+                                  i->name,
+                                  i->value);
+        trust_map::iterator j = trust.find(key);
+        shared_ptr< set<rsa_keypair_id> > s;
+        if (j == trust.end())
+          {
+            s.reset(new set<rsa_keypair_id>());
+            trust.insert(make_pair(key, make_pair(s, i)));
+          }
+        else
+          s = j->second.first;
+        s->insert(i->key);
+      }
 
-  for (it i = certs.begin(); i != certs.end(); ++i)
-    {
-      trust_key key = trust_key(manifest_id(i->inner().ident.inner()),
-                                i->inner().name,
-                                i->inner().value);
-      trust_map::iterator j = trust.find(key);
-      shared_ptr< set<rsa_keypair_id> > s;
-      if (j == trust.end())
-        {
-          s.reset(new set<rsa_keypair_id>());
-          trust.insert(make_pair(key, make_pair(s, i)));
-        }
-      else
-        s = j->second.first;
-      s->insert(i->inner().key);
-    }
-
-  for (trust_map::const_iterator i = trust.begin();
-       i != trust.end(); ++i)
-    {
-      if (lua.hook_get_manifest_cert_trust(*(i->second.first),
-                                           get<0>(i->first),
-                                           get<1>(i->first),
-                                           get<2>(i->first)))
-        {
-          if (global_sanity.debug_p())
-            L(FL("trust function liked %d signers of %s cert on manifest %s")
+    for (trust_map::const_iterator i = trust.begin();
+         i != trust.end(); ++i)
+      {
+        if ((lua.*hook_get_cert_trust)(*(i->second.first),
+                                       get<0>(i->first),
+                                       get<1>(i->first),
+                                       get<2>(i->first)))
+          {
+            if (global_sanity.debug_p())
+              L(FL("trust function liked %d signers of %s cert on revision %s")
+                % i->second.first->size()
+                % get<1>(i->first)
+                % get<0>(i->first));
+            tmp_certs.push_back(*(i->second.second));
+          }
+        else
+          {
+            W(F("trust function disliked %d signers of %s cert on revision %s")
               % i->second.first->size()
               % get<1>(i->first)
               % get<0>(i->first));
-          tmp_certs.push_back(*(i->second.second));
-        }
-      else
-        {
-          W(F("trust function disliked %d signers of %s cert on manifest %s")
-            % i->second.first->size()
-            % get<1>(i->first)
-            % get<0>(i->first));
-        }
-    }
-  certs = tmp_certs;
-}
+          }
+      }
+    certs = tmp_certs;
+  }
+} // anonymous namespace
 
 void
-database::erase_bogus_certs(vector< revision<cert> > & certs)
+database::erase_bogus_certs(vector<cert> & certs)
 {
-  typedef vector< revision<cert> >::iterator it;
-  it e = remove_if(certs.begin(), certs.end(), bogus_cert_p(*this));
-  certs.erase(e, certs.end());
+  erase_bogus_certs_internal(certs, *this, this->lua,
+                             &lua_hooks::hook_get_revision_cert_trust);
+}
 
-  vector< revision<cert> > tmp_certs;
+// These are only used by migration from old manifest-style ancestry, so we
+// don't much worry that they are not perfectly typesafe.  Also, we know
+// that the callers want bogus certs erased.
 
-  // sorry, this is a crazy data structure
-  typedef tuple< revision_id, cert_name, cert_value > trust_key;
-  typedef map< trust_key,
-    pair< shared_ptr< set<rsa_keypair_id> >, it > > trust_map;
-  trust_map trust;
+void
+database::get_manifest_certs(manifest_id const & id, std::vector<cert> & certs)
+{
+  imp->get_certs(id.inner(), certs, "manifest_certs");
+  erase_bogus_certs_internal(certs, *this, this->lua,
+                             &lua_hooks::hook_get_manifest_cert_trust);
+}
 
-  for (it i = certs.begin(); i != certs.end(); ++i)
-    {
-      trust_key key = trust_key(i->inner().ident,
-                                i->inner().name,
-                                i->inner().value);
-      trust_map::iterator j = trust.find(key);
-      shared_ptr< set<rsa_keypair_id> > s;
-      if (j == trust.end())
-        {
-          s.reset(new set<rsa_keypair_id>());
-          trust.insert(make_pair(key, make_pair(s, i)));
-        }
-      else
-        s = j->second.first;
-      s->insert(i->inner().key);
-    }
-
-  for (trust_map::const_iterator i = trust.begin();
-       i != trust.end(); ++i)
-    {
-      if (lua.hook_get_revision_cert_trust(*(i->second.first),
-                                           get<0>(i->first),
-                                           get<1>(i->first),
-                                           get<2>(i->first)))
-        {
-          if (global_sanity.debug_p())
-            L(FL("trust function liked %d signers of %s cert on revision %s")
-              % i->second.first->size()
-              % get<1>(i->first)
-              % get<0>(i->first));
-          tmp_certs.push_back(*(i->second.second));
-        }
-      else
-        {
-          W(F("trust function disliked %d signers of %s cert on revision %s")
-            % i->second.first->size()
-            % get<1>(i->first)
-            % get<0>(i->first));
-        }
-    }
-  certs = tmp_certs;
+void
+database::get_manifest_certs(cert_name const & name, std::vector<cert> & certs)
+{
+  imp->get_certs(name, certs, "manifest_certs");
+  erase_bogus_certs_internal(certs, *this, this->lua,
+                             &lua_hooks::hook_get_manifest_cert_trust);
 }
 
 // completions
============================================================
--- database.hh	deb173f296a5e4c7908f32ea40de2a985a7a8d78
+++ database.hh	874796e56fe674718be27ae6832e9178edfd90bb
@@ -262,35 +262,35 @@ public:
   //
   // note: this section is ridiculous. please do something about it.
 public:
-  bool revision_cert_exists(revision<cert> const & cert);
+  bool revision_cert_exists(cert const & cert);
   bool revision_cert_exists(revision_id const & hash);
 
-  bool put_revision_cert(revision<cert> const & cert);
+  bool put_revision_cert(cert const & cert);
 
   // this variant has to be rather coarse and fast, for netsync's use
   outdated_indicator get_revision_cert_nobranch_index(std::vector< std::pair<revision_id,
                               std::pair<revision_id, rsa_keypair_id> > > & idx);
 
   // Only used by database_check.cc
-  outdated_indicator get_revision_certs(std::vector< revision<cert> > & certs);
+  outdated_indicator get_revision_certs(std::vector<cert> & certs);
 
   outdated_indicator get_revision_certs(cert_name const & name,
-                          std::vector< revision<cert> > & certs);
+                          std::vector<cert> & certs);
 
   outdated_indicator get_revision_certs(revision_id const & ident,
                           cert_name const & name,
-                          std::vector< revision<cert> > & certs);
+                          std::vector<cert> & certs);
 
   // Only used by get_branch_certs (project.cc)
   outdated_indicator get_revision_certs(cert_name const & name,
                           cert_value const & val,
-                          std::vector< revision<cert> > & certs);
+                          std::vector<cert> & certs);
 
   // Only used by revision_is_in_branch (project.cc)
   outdated_indicator get_revision_certs(revision_id const & ident,
                           cert_name const & name,
                           cert_value const & value,
-                          std::vector< revision<cert> > & certs);
+                          std::vector<cert> & certs);
 
   // Only used by get_branch_heads (project.cc)
   outdated_indicator get_revisions_with_cert(cert_name const & name,
@@ -300,24 +300,16 @@ public:
   // Used through project.cc, and by
   // anc_graph::add_node_for_oldstyle_revision (revision.cc)
   outdated_indicator get_revision_certs(revision_id const & ident,
-                          std::vector< revision<cert> > & certs);
+                          std::vector<cert> & certs);
 
   // Used through get_revision_cert_hashes (project.cc)
   outdated_indicator get_revision_certs(revision_id const & ident,
                           std::vector<id> & hashes);
 
-  void get_revision_cert(id const & hash,
-                         revision<cert> & c);
+  void get_revision_cert(id const & hash, cert & c);
 
-  void get_manifest_certs(manifest_id const & ident,
-                          std::vector< manifest<cert> > & certs);
+  void erase_bogus_certs(std::vector<cert> & certs);
 
-  void get_manifest_certs(cert_name const & name,
-                          std::vector< manifest<cert> > & certs);
-
-  void erase_bogus_certs(std::vector< manifest<cert> > & certs);
-  void erase_bogus_certs(std::vector< revision<cert> > & certs);
-
   //
   // --== Epochs ==--
   //
@@ -412,8 +404,10 @@ public:
 
   // for changesetify, rosterify
   void delete_existing_revs_and_certs();
+  void delete_existing_manifests();
 
-  void delete_existing_manifests();
+  void get_manifest_certs(manifest_id const & id, std::vector<cert> & certs);
+  void get_manifest_certs(cert_name const & name, std::vector<cert> & certs);
 
   // heights
   void get_rev_height(revision_id const & id,
============================================================
--- database_check.cc	c3594aac68156411edfe0779e28f14655a198bf7
+++ database_check.cc	7ac0f3bce63f4ef189137684433ee8658380fd92
@@ -49,11 +49,11 @@ struct checked_cert {
 using std::vector;
 
 struct checked_cert {
-  revision<cert> rcert;
+  cert rcert;
   bool found_key;
   bool good_sig;
 
-  checked_cert(revision<cert> const & c): rcert(c), found_key(false), good_sig(false) {}
+  checked_cert(cert const & c): rcert(c), found_key(false), good_sig(false) {}
 };
 
 struct checked_key {
@@ -458,7 +458,7 @@ check_certs(database & db,
             map<rsa_keypair_id, checked_key> & checked_keys,
             size_t & total_certs)
 {
-  vector< revision<cert> > certs;
+  vector<cert> certs;
   db.get_revision_certs(certs);
 
   total_certs = certs.size();
@@ -467,23 +467,22 @@ check_certs(database & db,
 
   ticker ticks(_("certs"), "c", certs.size()/70+1);
 
-  for (vector< revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); ++i)
     {
       checked_cert checked(*i);
-      checked.found_key = checked_keys[i->inner().key].found;
+      checked.found_key = checked_keys[i->key].found;
 
       if (checked.found_key)
         {
           string signed_text;
-          i->inner().signable_text(signed_text);
+          i->signable_text(signed_text);
           checked.good_sig
-            = (db.check_signature(i->inner().key,
-                                  signed_text, i->inner().sig) == cert_ok);
+            = (db.check_signature(i->key, signed_text, i->sig) == cert_ok);
         }
 
-      checked_keys[i->inner().key].sigs++;
-      checked_revisions[revision_id(i->inner().ident)].checked_certs.push_back(checked);
+      checked_keys[i->key].sigs++;
+      checked_revisions[i->ident].checked_certs.push_back(checked);
 
       ++ticks;
     }
@@ -816,19 +815,19 @@ report_certs(map<revision_id, checked_re
               unchecked_sigs++;
               P(F("revision %s unchecked signature in %s cert from missing key %s")
                 % i->first
-                % checked->rcert.inner().name
-                % checked->rcert.inner().key);
+                % checked->rcert.name
+                % checked->rcert.key);
             }
           else if (!checked->good_sig)
             {
               bad_sigs++;
               P(F("revision %s bad signature in %s cert from key %s")
                 % i->first
-                % checked->rcert.inner().name
-                % checked->rcert.inner().key);
+                % checked->rcert.name
+                % checked->rcert.key);
             }
 
-          cert_counts[checked->rcert.inner().name]++;
+          cert_counts[checked->rcert.name]++;
         }
 
       for (set<cert_name>::const_iterator n = cnames.begin();
============================================================
--- lua_hooks.cc	69a6fc1c56a61871e90cf7a0c397e5b15a74051e
+++ lua_hooks.cc	33bca9e22966624a7caaa69386b3e949517199ef
@@ -353,7 +353,7 @@ shared_trust_function_body(Lua & ll,
 static inline bool
 shared_trust_function_body(Lua & ll,
                            set<rsa_keypair_id> const & signers,
-                           hexenc<id> const & hash,
+                           id const & hash,
                            cert_name const & name,
                            cert_value const & val)
 {
@@ -369,9 +369,10 @@ shared_trust_function_body(Lua & ll,
       ++k;
     }
 
+  hexenc<id> hid(encode_hexenc(hash(), hash.made_from), hash.made_from);
   bool ok;
   bool exec_ok = ll
-    .push_str(hash())
+    .push_str(hid())
     .push_str(name())
     .push_str(val())
     .call(4, 1)
@@ -381,62 +382,29 @@ shared_trust_function_body(Lua & ll,
   return exec_ok && ok;
 }
 
-static inline bool
-shared_trust_function_body(Lua & ll,
-                           set<rsa_keypair_id> const & signers,
-                           id const & hash,
-                           cert_name const & name,
-                           cert_value const & val)
-{
-  hexenc<id> hid(encode_hexenc(hash(), hash.made_from), hash.made_from);
-  return shared_trust_function_body(ll, signers, hid, name, val);
-};
-
 bool
 lua_hooks::hook_get_revision_cert_trust(set<rsa_keypair_id> const & signers,
-                                       hexenc<id> const & id,
+                                       id const & hash,
                                        cert_name const & name,
                                        cert_value const & val)
 {
   Lua ll(st);
   ll.func("get_revision_cert_trust");
-  return shared_trust_function_body(ll, signers, id, name, val);
+  return shared_trust_function_body(ll, signers, hash, name, val);
 }
 
 bool
-lua_hooks::hook_get_revision_cert_trust(set<rsa_keypair_id> const & signers,
-                                       revision_id const & id,
-                                       cert_name const & name,
-                                       cert_value const & val)
-{
-  Lua ll(st);
-  ll.func("get_revision_cert_trust");
-  return shared_trust_function_body(ll, signers, id.inner(), name, val);
-}
-
-bool
 lua_hooks::hook_get_manifest_cert_trust(set<rsa_keypair_id> const & signers,
-                                        hexenc<id> const & id,
+                                        id const & hash,
                                         cert_name const & name,
                                         cert_value const & val)
 {
   Lua ll(st);
   ll.func("get_manifest_cert_trust");
-  return shared_trust_function_body(ll, signers, id, name, val);
+  return shared_trust_function_body(ll, signers, hash, name, val);
 }
 
 bool
-lua_hooks::hook_get_manifest_cert_trust(set<rsa_keypair_id> const & signers,
-                                        manifest_id const & id,
-                                        cert_name const & name,
-                                        cert_value const & val)
-{
-  Lua ll(st);
-  ll.func("get_manifest_cert_trust");
-  return shared_trust_function_body(ll, signers, id.inner(), name, val);
-}
-
-bool
 lua_hooks::hook_accept_testresult_change(map<rsa_keypair_id, bool> const & old_results,
                                          map<rsa_keypair_id, bool> const & new_results)
 {
============================================================
--- lua_hooks.hh	bd3e476d9506f29a4efd2751ea2b1fe3fff03617
+++ lua_hooks.hh	25ed66326986fb26e1887a752eb19eae19ed2302
@@ -58,21 +58,13 @@ public:
                          external & result);
   bool hook_persist_phrase_ok();
   bool hook_get_revision_cert_trust(std::set<rsa_keypair_id> const & signers,
-                                   hexenc<id> const & id,
+                                   id const & hash,
                                    cert_name const & name,
                                    cert_value const & val);
-  bool hook_get_revision_cert_trust(std::set<rsa_keypair_id> const & signers,
-                                   revision_id const & id,
-                                   cert_name const & name,
-                                   cert_value const & val);
   bool hook_get_manifest_cert_trust(std::set<rsa_keypair_id> const & signers,
-                                    hexenc<id> const & id,
+                                    id const & hash,
                                     cert_name const & name,
                                     cert_value const & val);
-  bool hook_get_manifest_cert_trust(std::set<rsa_keypair_id> const & signers,
-                                    manifest_id const & id,
-                                    cert_name const & name,
-                                    cert_value const & val);
   bool hook_accept_testresult_change(std::map<rsa_keypair_id, bool> const & old_results,
                                      std::map<rsa_keypair_id, bool> const & new_results);
 
============================================================
--- migrate_ancestry.cc	4dc87fb08f592d30bd238f40d2629f9e790511ab
+++ migrate_ancestry.cc	c02341580f9e65387807dc8f1ae3874d26e81198
@@ -344,16 +344,14 @@ anc_graph::add_node_for_old_manifest(man
       node_to_old_man.insert(make_pair(node, man));
 
       // load certs
-      vector< manifest<cert> > mcerts;
+      vector<cert> mcerts;
       db.get_manifest_certs(man, mcerts);
-      db.erase_bogus_certs(mcerts);
-      for(vector< manifest<cert> >::const_iterator i = mcerts.begin();
+      for(vector<cert>::const_iterator i = mcerts.begin();
           i != mcerts.end(); ++i)
         {
-          L(FL("loaded '%s' manifest cert for node %s") % i->inner().name % node);
+          L(FL("loaded '%s' manifest cert for node %s") % i->name % node);
           ++n_certs_in;
-          certs.insert(make_pair(node, make_pair(i->inner().name,
-                                                 i->inner().value)));
+          certs.insert(make_pair(node, make_pair(i->name, i->value)));
         }
     }
   else
@@ -387,19 +385,19 @@ u64 anc_graph::add_node_for_oldstyle_rev
       node_to_renames.insert(make_pair(node, renames));
 
       // load certs
-      vector< revision<cert> > rcerts;
+      vector<cert> rcerts;
       db.get_revision_certs(rev, rcerts);
       db.erase_bogus_certs(rcerts);
-      for(vector< revision<cert> >::const_iterator i = rcerts.begin();
+      for(vector<cert>::const_iterator i = rcerts.begin();
           i != rcerts.end(); ++i)
         {
-          L(FL("loaded '%s' revision cert for node %s") % i->inner().name % node);
+          L(FL("loaded '%s' revision cert for node %s") % i->name % node);
           ++n_certs_in;
-          certs.insert(make_pair(node, make_pair(i->inner().name,
-                                                 i->inner().value)));
+          certs.insert(make_pair(node, make_pair(i->name,
+                                                 i->value)));
 
-          if (i->inner().name == branch_cert_name)
-            branches.insert(i->inner().value());
+          if (i->name == branch_cert_name)
+            branches.insert(i->value());
         }
     }
   else
@@ -945,16 +943,15 @@ build_changesets_from_manifest_ancestry(
 
   P(F("rebuilding revision graph from manifest certs"));
 
-  vector< manifest<cert> > tmp;
+  vector<cert> tmp;
   db.get_manifest_certs(cert_name("ancestor"), tmp);
-  db.erase_bogus_certs(tmp);
 
-  for (vector< manifest<cert> >::const_iterator i = tmp.begin();
+  for (vector<cert>::const_iterator i = tmp.begin();
        i != tmp.end(); ++i)
     {
       manifest_id child, parent;
-      child = manifest_id(i->inner().ident.inner());
-      parent = typecast_vocab<manifest_id>(i->inner().value);
+      child = manifest_id(i->ident.inner());
+      parent = typecast_vocab<manifest_id>(i->value);
 
       u64 parent_node = graph.add_node_for_old_manifest(parent);
       u64 child_node = graph.add_node_for_old_manifest(child);
============================================================
--- netsync.cc	a9f111f42f151d3c382caec6e1384ebe35ca6991
+++ netsync.cc	126ff0ef642b515981807cd45f0799f9e121333d
@@ -1063,16 +1063,16 @@ void
 }
 
 void
-session::note_cert(id const & c)
+session::note_cert(id const & i)
 {
   if (role == sink_role)
     return;
-  revision<cert> cert;
+  cert c;
   string str;
-  project.db.get_revision_cert(c, cert);
-  cert.inner().marshal_for_netio(str);
-  queue_data_cmd(cert_item, c, str);
-  sent_certs.push_back(cert.inner());
+  project.db.get_revision_cert(i, c);
+  c.marshal_for_netio(str);
+  queue_data_cmd(cert_item, i, str);
+  sent_certs.push_back(c);
 }
 
 
@@ -2206,10 +2206,10 @@ session::load_data(netcmd_item_type type
 
     case cert_item:
       {
-        revision<cert> c;
+        cert c;
         project.db.get_revision_cert(item, c);
         string tmp;
-        c.inner().marshal_for_netio(out);
+        c.marshal_for_netio(out);
       }
       break;
     }
@@ -2308,7 +2308,7 @@ session::process_data_cmd(netcmd_item_ty
         c.hash_code(tmp);
         if (! (tmp == item))
           throw bad_decode(F("hash check failed for revision cert '%s'") % hitem());
-        if (project.db.put_revision_cert(revision<cert>(c)))
+        if (project.db.put_revision_cert(c))
           written_certs.push_back(c);
       }
       break;
@@ -3349,21 +3349,21 @@ session::rebuild_merkle_trees(set<branch
          i != branchnames.end(); ++i)
       {
         // Get branch certs.
-        vector< revision<cert> > certs;
+        vector<cert> certs;
         project.get_branch_certs(*i, certs);
-        for (vector< revision<cert> >::const_iterator j = certs.begin();
+        for (vector<cert>::const_iterator j = certs.begin();
              j != certs.end(); j++)
           {
-            revision_id rid(j->inner().ident);
+            revision_id rid(j->ident);
             insert_with_parents(rid, rev_refiner, rev_enumerator,
                                 revision_ids, revisions_ticker);
             // Branch certs go in here, others later on.
             id item;
-            j->inner().hash_code(item);
+            j->hash_code(item);
             cert_refiner.note_local_item(item);
             rev_enumerator.note_cert(rid, item);
-            if (inserted_keys.find(j->inner().key) == inserted_keys.end())
-              inserted_keys.insert(j->inner().key);
+            if (inserted_keys.find(j->key) == inserted_keys.end())
+              inserted_keys.insert(j->key);
           }
       }
   }
============================================================
--- project.cc	a849cb079e798aecd8cf5620dcf21fb8ea1aa076
+++ project.cc	584ceb9a5300c22f981e53d4b767ef195f9f2a44
@@ -23,11 +23,12 @@
 #include "simplestring_xform.hh"
 #include "lexical_cast.hh"
 
-using std::string;
+using std::make_pair;
+using std::multimap;
+using std::pair;
 using std::set;
+using std::string;
 using std::vector;
-using std::multimap;
-using std::make_pair;
 using boost::lexical_cast;
 
 project_t::project_t(database & db)
@@ -35,22 +36,22 @@ void
 {}
 
 void
-project_t::get_branch_list(std::set<branch_name> & names,
+project_t::get_branch_list(set<branch_name> & names,
                            bool check_heads)
 {
   if (indicator.outdated())
     {
-      std::vector<std::string> got;
+      vector<string> got;
       indicator = db.get_branches(got);
       branches.clear();
       multimap<revision_id, revision_id> inverse_graph_cache;
 
-      for (std::vector<std::string>::iterator i = got.begin();
+      for (vector<string>::iterator i = got.begin();
            i != got.end(); ++i)
         {
           // check that the branch has at least one non-suspended head
           const branch_name branch(*i, origin::database);
-          std::set<revision_id> heads;
+          set<revision_id> heads;
 
           if (check_heads)
             get_branch_heads(branch, heads, false, &inverse_graph_cache);
@@ -65,20 +66,20 @@ project_t::get_branch_list(globish const
 
 void
 project_t::get_branch_list(globish const & glob,
-                           std::set<branch_name> & names,
+                           set<branch_name> & names,
                            bool check_heads)
 {
-  std::vector<std::string> got;
+  vector<string> got;
   db.get_branches(glob, got);
   names.clear();
   multimap<revision_id, revision_id> inverse_graph_cache;
 
-  for (std::vector<std::string>::iterator i = got.begin();
+  for (vector<string>::iterator i = got.begin();
        i != got.end(); ++i)
     {
       // check that the branch has at least one non-suspended head
       const branch_name branch(*i, origin::database);
-      std::set<revision_id> heads;
+      set<revision_id> heads;
 
       if (check_heads)
         get_branch_heads(branch, heads, false, &inverse_graph_cache);
@@ -100,7 +101,7 @@ namespace
     {}
     virtual bool operator()(revision_id const & rid)
     {
-      vector< revision<cert> > certs;
+      vector<cert> certs;
       db.get_revision_certs(rid,
                             cert_name(branch_cert_name),
                             typecast_vocab<cert_value>(branch),
@@ -120,7 +121,7 @@ namespace
     {}
     virtual bool operator()(revision_id const & rid)
     {
-      vector< revision<cert> > certs;
+      vector<cert> certs;
       db.get_revision_certs(rid,
                             cert_name(suspend_cert_name),
                             typecast_vocab<cert_value>(branch),
@@ -133,13 +134,13 @@ project_t::get_branch_heads(branch_name 
 
 void
 project_t::get_branch_heads(branch_name const & name,
-                            std::set<revision_id> & heads,
+                            set<revision_id> & heads,
                             bool ignore_suspend_certs,
                             multimap<revision_id, revision_id> * inverse_graph_cache_ptr)
 {
-  std::pair<branch_name, suspended_indicator>
+  pair<branch_name, suspended_indicator>
     cache_index(name, ignore_suspend_certs);
-  std::pair<outdated_indicator, std::set<revision_id> > &
+  pair<outdated_indicator, set<revision_id> > &
     branch = branch_heads[cache_index];
   if (branch.first.outdated())
     {
@@ -156,7 +157,7 @@ project_t::get_branch_heads(branch_name 
       if (!ignore_suspend_certs)
         {
           suspended_in_branch s(db, name);
-          std::set<revision_id>::iterator it = branch.second.begin();
+          set<revision_id>::iterator it = branch.second.begin();
           while (it != branch.second.end())
             if (s(*it))
               branch.second.erase(it++);
@@ -174,7 +175,7 @@ project_t::revision_is_in_branch(revisio
 project_t::revision_is_in_branch(revision_id const & id,
                                  branch_name const & branch)
 {
-  vector<revision<cert> > certs;
+  vector<cert> certs;
   db.get_revision_certs(id, branch_cert_name,
                         typecast_vocab<cert_value>(branch), certs);
 
@@ -203,7 +204,7 @@ project_t::revision_is_suspended_in_bran
 project_t::revision_is_suspended_in_branch(revision_id const & id,
                                  branch_name const & branch)
 {
-  vector<revision<cert> > certs;
+  vector<cert> certs;
   db.get_revision_certs(id, suspend_cert_name,
                         typecast_vocab<cert_value>(branch), certs);
 
@@ -231,14 +232,14 @@ project_t::get_revision_cert_hashes(revi
 
 outdated_indicator
 project_t::get_revision_cert_hashes(revision_id const & rid,
-                                    std::vector<id> & hashes)
+                                    vector<id> & hashes)
 {
   return db.get_revision_certs(rid, hashes);
 }
 
 outdated_indicator
 project_t::get_revision_certs(revision_id const & id,
-                              std::vector<revision<cert> > & certs)
+                              vector<cert> & certs)
 {
   return db.get_revision_certs(id, certs);
 }
@@ -246,7 +247,7 @@ project_t::get_revision_certs_by_name(re
 outdated_indicator
 project_t::get_revision_certs_by_name(revision_id const & id,
                                       cert_name const & name,
-                                      std::vector<revision<cert> > & certs)
+                                      vector<cert> & certs)
 {
   outdated_indicator i = db.get_revision_certs(id, name, certs);
   db.erase_bogus_certs(certs);
@@ -255,21 +256,21 @@ project_t::get_revision_branches(revisio
 
 outdated_indicator
 project_t::get_revision_branches(revision_id const & id,
-                                 std::set<branch_name> & branches)
+                                 set<branch_name> & branches)
 {
-  std::vector<revision<cert> > certs;
+  vector<cert> certs;
   outdated_indicator i = get_revision_certs_by_name(id, branch_cert_name, certs);
   branches.clear();
-  for (std::vector<revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); ++i)
-    branches.insert(typecast_vocab<branch_name>(i->inner().value));
+    branches.insert(typecast_vocab<branch_name>(i->value));
 
   return i;
 }
 
 outdated_indicator
 project_t::get_branch_certs(branch_name const & branch,
-                            std::vector<revision<cert> > & certs)
+                            vector<cert> & certs)
 {
   return db.get_revision_certs(branch_cert_name,
                                typecast_vocab<cert_value>(branch), certs);
@@ -302,15 +303,15 @@ project_t::get_tags(set<tag_t> & tags)
 outdated_indicator
 project_t::get_tags(set<tag_t> & tags)
 {
-  std::vector<revision<cert> > certs;
+  vector<cert> certs;
   outdated_indicator i = db.get_revision_certs(tag_cert_name, certs);
   db.erase_bogus_certs(certs);
   tags.clear();
-  for (std::vector<revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); ++i)
-    tags.insert(tag_t(revision_id(i->inner().ident),
-                      typecast_vocab<utf8>(i->inner().value),
-                      i->inner().key));
+    tags.insert(tag_t(revision_id(i->ident),
+                      typecast_vocab<utf8>(i->value),
+                      i->key));
 
   return i;
 }
@@ -389,7 +390,7 @@ project_t::put_cert(key_store & keys,
   load_key_pair(keys, t.key);
   keys.make_signature(db, t.key, signed_text, t.sig);
 
-  revision<cert> cc(t);
+  cert cc(t);
   return db.put_revision_cert(cc);
 }
 
@@ -440,20 +441,20 @@ describe_revision(project_t & project, r
   description += encode_hexenc(id.inner()(), id.inner().made_from);
 
   // append authors and date of this revision
-  vector< revision<cert> > tmp;
+  vector<cert> tmp;
   project.get_revision_certs_by_name(id, author_name, tmp);
-  for (vector< revision<cert> >::const_iterator i = tmp.begin();
+  for (vector<cert>::const_iterator i = tmp.begin();
        i != tmp.end(); ++i)
     {
       description += " ";
-      description += i->inner().value();
+      description += i->value();
     }
   project.get_revision_certs_by_name(id, date_name, tmp);
-  for (vector< revision<cert> >::const_iterator i = tmp.begin();
+  for (vector<cert>::const_iterator i = tmp.begin();
        i != tmp.end(); ++i)
     {
       description += " ";
-      description += i->inner().value();
+      description += i->value();
     }
 
   return description;
============================================================
--- project.hh	6514b20663b3ec51c4bab9794d2fd5548e5bb0ff
+++ project.hh	055d2051d5452036c0934c741f23153eac9c3fcc
@@ -99,14 +99,14 @@ public:
   outdated_indicator get_revision_cert_hashes(revision_id const & rid,
                                               std::vector<id> & hashes);
   outdated_indicator get_revision_certs(revision_id const & id,
-                                        std::vector<revision<cert> > & certs);
+                                        std::vector<cert> & certs);
   outdated_indicator get_revision_certs_by_name(revision_id const & id,
                                                 cert_name const & name,
-                                                std::vector<revision<cert> > & certs);
+                                                std::vector<cert> & certs);
   outdated_indicator get_revision_branches(revision_id const & id,
                                            std::set<branch_name> & branches);
   outdated_indicator get_branch_certs(branch_name const & branch,
-                                      std::vector<revision<cert> > & certs);
+                                      std::vector<cert> & certs);
 
   void put_standard_certs(key_store & keys,
                           revision_id const & id,
============================================================
--- update.cc	7a3e42759fc4ce4b4ef3693b7dcca4cf7f477c12
+++ update.cc	dba7f76d0acb65a068cac1dddb85f8d50a60304b
@@ -57,17 +57,17 @@ get_test_results_for_revision(project_t 
                               revision_id const & id,
                               map<rsa_keypair_id, bool> & results)
 {
-  vector< revision<cert> > certs;
+  vector<cert> certs;
   project.get_revision_certs_by_name(id, cert_name(testresult_cert_name),
                                      certs);
-  for (vector< revision<cert> >::const_iterator i = certs.begin();
+  for (vector<cert>::const_iterator i = certs.begin();
        i != certs.end(); ++i)
     {
-      cert_value cv = i->inner().value;
+      cert_value cv = i->value;
       try
         {
           bool test_ok = lexical_cast<bool>(cv());
-          results.insert(make_pair(i->inner().key, test_ok));
+          results.insert(make_pair(i->key, test_ok));
         }
       catch(boost::bad_lexical_cast &)
         {