ref: Change underscore to hyphen for principal tool.

MultiPart: 1/3

Change-Id: Ic63e48ace41dc1b46446beb3b3b918c093000ba6
diff --git a/cmd/mgmt/shell_test.sh b/cmd/mgmt/shell_test.sh
index 9a3be6b..35ca71e 100755
--- a/cmd/mgmt/shell_test.sh
+++ b/cmd/mgmt/shell_test.sh
@@ -243,7 +243,7 @@
   local -r PRINCIPAL_BIN="$(shell_test::build_go_binary 'v.io/x/ref/cmd/principal')"
   local -r FORKCRED=$(shell::tmp_dir)
   "${PRINCIPAL_BIN}" create --overwrite=true "${FORKCRED}" self >/dev/null || shell_test::fail "line ${LINENO}: create failed"
-  "${PRINCIPAL_BIN}" --v23.credentials="$1" bless --require_caveats=false "${FORKCRED}" "$2" >blessing || shell_test::fail "line ${LINENO}: bless failed"
+  "${PRINCIPAL_BIN}" --v23.credentials="$1" bless --require-caveats=false "${FORKCRED}" "$2" >blessing || shell_test::fail "line ${LINENO}: bless failed"
   "${PRINCIPAL_BIN}" --v23.credentials="${FORKCRED}" store setdefault blessing || shell_test::fail "line ${LINENO}: store setdefault failed"
   "${PRINCIPAL_BIN}" --v23.credentials="${FORKCRED}" store set blessing ... || shell_test::fail "line ${LINENO}: store set failed"
   echo "${FORKCRED}"
diff --git a/cmd/principal/doc.go b/cmd/principal/doc.go
index 54099fd..65c1932 100644
--- a/cmd/principal/doc.go
+++ b/cmd/principal/doc.go
@@ -151,7 +151,7 @@
    Duration of blessing validity (zero implies no expiration caveat)
  -overwrite=false
    If true, any existing principal data in the directory will be overwritten
- -require_caveats=true
+ -require-caveats=true
    If false, allow blessing without any caveats. This is typically not advised
    as the principal wielding the blessing will be almost as powerful as its
    blesser
@@ -167,26 +167,26 @@
 The blessings are sought for the principal specified by the environment that
 this tool is running in.
 
-The blessings obtained are set as default, unless the --set_default flag is set
+The blessings obtained are set as default, unless the --set-default flag is set
 to true, and are also set for sharing with all peers, unless a more specific
-peer pattern is provided using the --for_peer flag.
+peer pattern is provided using the --for-peer flag.
 
 Usage:
    principal seekblessings [flags]
 
 The principal seekblessings flags are:
- -add_to_roots=true
+ -add-to-roots=true
    If true, the root certificate of the blessing will be added to the
    principal's set of recognized root certificates
  -browser=true
    If false, the seekblessings command will not open the browser and only print
    the url to visit.
- -for_peer=...
+ -for-peer=...
    If non-empty, the blessings obtained will be marked for peers matching this
    pattern in the store
  -from=https://dev.v.io/auth/google
    URL to use to begin the seek blessings process
- -set_default=true
+ -set-default=true
    If true, the blessings obtained will be set as the default blessing in the
    store
 
@@ -198,9 +198,9 @@
 another invocation of this tool (remote process) and prints out the command to
 be run as the remote principal.
 
-The received blessings are set as default, unless the --set_default flag is set
+The received blessings are set as default, unless the --set-default flag is set
 to true, and are also set for sharing with all peers, unless a more specific
-peer pattern is provided using the --for_peer flag.
+peer pattern is provided using the --for-peer flag.
 
 TODO(ashankar,cnicolaou): Make this next paragraph possible! Requires the
 ability to obtain the proxied endpoint.
@@ -211,33 +211,33 @@
     principal --v23.proxy=proxy recvblessings
 
 The command to be run at the sender is of the form:
-    principal bless --remote_key=KEY --remote_token=TOKEN ADDRESS EXTENSION
+    principal bless --remote-key=KEY --remote-token=TOKEN ADDRESS EXTENSION
 
-The --remote_key flag is used to by the sender to "authenticate" the receiver,
+The --remote-key flag is used to by the sender to "authenticate" the receiver,
 ensuring it blesses the intended recipient and not any attacker that may have
 taken over the address.
 
-The --remote_token flag is used by the sender to authenticate itself to the
+The --remote-token flag is used by the sender to authenticate itself to the
 receiver. This helps ensure that the receiver rejects blessings from senders who
 just happened to guess the network address of the 'recvblessings' invocation.
 
-If the --remote_arg_file flag is provided to recvblessings, the remote key,
+If the --remote-arg-file flag is provided to recvblessings, the remote key,
 remote token and object address of this principal will be written to the
 specified location. This file can be supplied to bless:
-		principal bless --remote_arg_file FILE EXTENSION
+		principal bless --remote-arg-file FILE EXTENSION
 
 Usage:
    principal recvblessings [flags]
 
 The principal recvblessings flags are:
- -for_peer=...
+ -for-peer=...
    If non-empty, the blessings received will be marked for peers matching this
    pattern in the store
- -remote_arg_file=
+ -remote-arg-file=
    If non-empty, the remote key, remote token, and principal will be written to
    the specified file in a JSON object. This can be provided to 'principal bless
-   --remote_arg_file FILE EXTENSION'.
- -set_default=true
+   --remote-arg-file FILE EXTENSION'.
+ -set-default=true
    If true, the blessings received will be set as the default blessing in the
    store
 
@@ -294,12 +294,12 @@
     V23_CREDENTIALS=<path to alice> principal bless <path to bob> friend
 and this will dump the blessing to STDOUT.
 
-With the --remote_key and --remote_token flags, this command can be used to
+With the --remote-key and --remote-token flags, this command can be used to
 bless a principal on a remote machine as well. In this case, the blessing is not
 dumped to STDOUT but sent to the remote end. Use 'principal help recvblessings'
 for more details on that.
 
-When --remote_arg_file is specified, only the blessing extension is required, as
+When --remote-arg-file is specified, only the blessing extension is required, as
 all other arguments will be extracted from the specified file.
 
 Usage:
@@ -311,9 +311,9 @@
 containing any other blessings of that
     principal,
 OR (c) The object name produced by the 'recvblessings' command of this tool
-    running on behalf of another principal (if the --remote_key and
-    --remote_token flags are specified).
-OR (d) None (if the --remote_arg_file flag is specified, only <extension> should
+    running on behalf of another principal (if the --remote-key and
+    --remote-token flags are specified).
+OR (d) None (if the --remote-arg-file flag is specified, only <extension> should
 be provided
     to bless).
 
@@ -324,16 +324,16 @@
    "package/path".CaveatName:VDLExpressionParam to attach to this blessing
  -for=0
    Duration of blessing validity (zero implies no expiration caveat)
- -remote_arg_file=
+ -remote-arg-file=
    File containing bless arguments written by 'principal recvblessings
-   -remote_arg_file FILE EXTENSION' command. This can be provided to bless in
-   place of --remote_key, --remote_token, and <principal>.
- -remote_key=
+   -remote-arg-file FILE EXTENSION' command. This can be provided to bless in
+   place of --remote-key, --remote-token, and <principal>.
+ -remote-key=
    Public key of the remote principal to bless (obtained from the
    'recvblessings' command run by the remote principal
- -remote_token=
+ -remote-token=
    Token provided by principal running the 'recvblessings' command
- -require_caveats=true
+ -require-caveats=true
    If false, allow blessing without any caveats. This is typically not advised
    as the principal wielding the blessing will be almost as powerful as its
    blesser
@@ -369,7 +369,7 @@
 tool. - is used for STDIN.
 
 The principal set default flags are:
- -add_to_roots=true
+ -add-to-roots=true
    If true, the root certificate of the blessing will be added to the
    principal's set of recognized root certificates
 
@@ -397,7 +397,7 @@
 can be shared with.
 
 The principal set forpeer flags are:
- -add_to_roots=true
+ -add-to-roots=true
    If true, the root certificate of the blessing will be added to the
    principal's set of recognized root certificates
 
diff --git a/cmd/principal/main.go b/cmd/principal/main.go
index 3e67cb7..67fb4e1 100644
--- a/cmd/principal/main.go
+++ b/cmd/principal/main.go
@@ -65,7 +65,7 @@
 	flagRecvBlessingsSetDefault bool
 	flagRecvBlessingsForPeer    string
 
-	errNoCaveats = fmt.Errorf("no caveats provided: it is generally dangerous to bless another principal without any caveats as that gives them almost unrestricted access to the blesser's credentials. If you really want to do this, set --require_caveats=false")
+	errNoCaveats = fmt.Errorf("no caveats provided: it is generally dangerous to bless another principal without any caveats as that gives them almost unrestricted access to the blesser's credentials. If you really want to do this, set --require-caveats=false")
 	cmdDump      = &cmdline.Command{
 		Name:  "dump",
 		Short: "Dump out information about the principal",
@@ -192,12 +192,12 @@
     V23_CREDENTIALS=<path to alice> principal bless <path to bob> friend
 and this will dump the blessing to STDOUT.
 
-With the --remote_key and --remote_token flags, this command can be used to
+With the --remote-key and --remote-token flags, this command can be used to
 bless a principal on a remote machine as well. In this case, the blessing is
 not dumped to STDOUT but sent to the remote end. Use 'principal help
 recvblessings' for more details on that.
 
-When --remote_arg_file is specified, only the blessing extension is required, as all other
+When --remote-arg-file is specified, only the blessing extension is required, as all other
 arguments will be extracted from the specified file.
 `,
 		ArgsName: "[<principal to bless>] <extension>",
@@ -210,10 +210,10 @@
     principal,
 OR
 (c) The object name produced by the 'recvblessings' command of this tool
-    running on behalf of another principal (if the --remote_key and
-    --remote_token flags are specified).
+    running on behalf of another principal (if the --remote-key and
+    --remote-token flags are specified).
 OR
-(d) None (if the --remote_arg_file flag is specified, only <extension> should be provided
+(d) None (if the --remote-arg-file flag is specified, only <extension> should be provided
     to bless).
 
 <extension> is the string extension that will be applied to create the
@@ -222,9 +222,9 @@
 	`,
 		Run: func(cmd *cmdline.Command, args []string) error {
 			if len(flagRemoteArgFile) > 0 && len(args) != 1 {
-				return fmt.Errorf("when --remote_arg_file is provided, only <extension> is expected, provided %d", len(args))
+				return fmt.Errorf("when --remote-arg-file is provided, only <extension> is expected, provided %d", len(args))
 			} else if len(flagRemoteArgFile) == 0 && len(args) != 2 {
-				return fmt.Errorf("require exactly two arguments when --remote_arg_file is not provided, provided %d", len(args))
+				return fmt.Errorf("require exactly two arguments when --remote-arg-file is not provided, provided %d", len(args))
 			}
 
 			ctx, shutdown := v23.Init()
@@ -260,7 +260,7 @@
 			}
 
 			// Send blessings to a "server" started by a "recvblessings" command, either
-			// with the --remote_arg_file flag, or with --remote_key and --remote_token flags.
+			// with the --remote-arg-file flag, or with --remote-key and --remote-token flags.
 			if len(remoteKey) > 0 {
 				granter := &granter{p, with, extension, caveats, remoteKey}
 				return blessOverNetwork(ctx, tobless, granter, remoteToken)
@@ -589,9 +589,9 @@
 The blessings are sought for the principal specified by the environment that
 this tool is running in.
 
-The blessings obtained are set as default, unless the --set_default flag is
+The blessings obtained are set as default, unless the --set-default flag is
 set to true, and are also set for sharing with all peers, unless a more
-specific peer pattern is provided using the --for_peer flag.
+specific peer pattern is provided using the --for-peer flag.
 `,
 		Run: func(cmd *cmdline.Command, args []string) error {
 			// Initialize the runtime first so that any local errors are reported
@@ -646,9 +646,9 @@
 from another invocation of this tool (remote process) and prints out the
 command to be run as the remote principal.
 
-The received blessings are set as default, unless the --set_default flag is
+The received blessings are set as default, unless the --set-default flag is
 set to true, and are also set for sharing with all peers, unless a more
-specific peer pattern is provided using the --for_peer flag.
+specific peer pattern is provided using the --for-peer flag.
 
 TODO(ashankar,cnicolaou): Make this next paragraph possible! Requires
 the ability to obtain the proxied endpoint.
@@ -659,21 +659,21 @@
     principal --v23.proxy=proxy recvblessings
 
 The command to be run at the sender is of the form:
-    principal bless --remote_key=KEY --remote_token=TOKEN ADDRESS EXTENSION
+    principal bless --remote-key=KEY --remote-token=TOKEN ADDRESS EXTENSION
 
-The --remote_key flag is used to by the sender to "authenticate" the receiver,
+The --remote-key flag is used to by the sender to "authenticate" the receiver,
 ensuring it blesses the intended recipient and not any attacker that may have
 taken over the address.
 
-The --remote_token flag is used by the sender to authenticate itself to the
+The --remote-token flag is used by the sender to authenticate itself to the
 receiver. This helps ensure that the receiver rejects blessings from senders
 who just happened to guess the network address of the 'recvblessings'
 invocation.
 
-If the --remote_arg_file flag is provided to recvblessings, the remote key, remote token
+If the --remote-arg-file flag is provided to recvblessings, the remote key, remote token
 and object address of this principal will be written to the specified location.
 This file can be supplied to bless:
-		principal bless --remote_arg_file FILE EXTENSION
+		principal bless --remote-arg-file FILE EXTENSION
 
 `,
 		Run: func(cmd *cmdline.Command, args []string) error {
@@ -718,9 +718,9 @@
 					return fmt.Errorf("failed to write recvblessings info to %v: %v", flagRemoteArgFile, err)
 				}
 				fmt.Printf("make %q accessible to the blesser, possibly by copying the file over and then run:\n", flagRemoteArgFile)
-				fmt.Printf("principal bless --remote_arg_file=%v %v", flagRemoteArgFile, extension)
+				fmt.Printf("principal bless --remote-arg-file=%v %v", flagRemoteArgFile, extension)
 			} else {
-				fmt.Printf("principal bless --remote_key=%v --remote_token=%v %v %v\n", p.PublicKey(), service.token, eps[0].Name(), extension)
+				fmt.Printf("principal bless --remote-key=%v --remote-token=%v %v %v\n", p.PublicKey(), service.token, eps[0].Name(), extension)
 			}
 			fmt.Println()
 			fmt.Println("...waiting for sender..")
@@ -731,10 +731,10 @@
 
 func blessArgs(args []string) (tobless, extension, remoteKey, remoteToken string, err error) {
 	if len(flagRemoteArgFile) > 0 && (len(flagBlessRemoteKey)+len(flagBlessRemoteToken) > 0) {
-		return "", "", "", "", fmt.Errorf("--remote_key and --remote_token cannot be provided with --remote_arg_file")
+		return "", "", "", "", fmt.Errorf("--remote-key and --remote-token cannot be provided with --remote-arg-file")
 	}
 	if (len(flagBlessRemoteKey) == 0) != (len(flagBlessRemoteToken) == 0) {
-		return "", "", "", "", fmt.Errorf("either both --remote_key and --remote_token should be set, or neither should")
+		return "", "", "", "", fmt.Errorf("either both --remote-key and --remote-token should be set, or neither should")
 	}
 
 	if len(flagRemoteArgFile) == 0 {
@@ -806,32 +806,32 @@
 	cmdFork.Flags.BoolVar(&flagCreateOverwrite, "overwrite", false, "If true, any existing principal data in the directory will be overwritten")
 	cmdFork.Flags.Var(&flagForkCaveats, "caveat", flagForkCaveats.usage())
 	cmdFork.Flags.DurationVar(&flagForkFor, "for", 0, "Duration of blessing validity (zero implies no expiration caveat)")
-	cmdFork.Flags.BoolVar(&flagForkRequireCaveats, "require_caveats", true, "If false, allow blessing without any caveats. This is typically not advised as the principal wielding the blessing will be almost as powerful as its blesser")
+	cmdFork.Flags.BoolVar(&flagForkRequireCaveats, "require-caveats", true, "If false, allow blessing without any caveats. This is typically not advised as the principal wielding the blessing will be almost as powerful as its blesser")
 	cmdFork.Flags.StringVar(&flagForkWith, "with", "", "Path to file containing blessing to extend")
 
 	cmdBless.Flags.Var(&flagBlessCaveats, "caveat", flagBlessCaveats.usage())
 	cmdBless.Flags.DurationVar(&flagBlessFor, "for", 0, "Duration of blessing validity (zero implies no expiration caveat)")
-	cmdBless.Flags.BoolVar(&flagBlessRequireCaveats, "require_caveats", true, "If false, allow blessing without any caveats. This is typically not advised as the principal wielding the blessing will be almost as powerful as its blesser")
+	cmdBless.Flags.BoolVar(&flagBlessRequireCaveats, "require-caveats", true, "If false, allow blessing without any caveats. This is typically not advised as the principal wielding the blessing will be almost as powerful as its blesser")
 	cmdBless.Flags.StringVar(&flagBlessWith, "with", "", "Path to file containing blessing to extend")
-	cmdBless.Flags.StringVar(&flagBlessRemoteKey, "remote_key", "", "Public key of the remote principal to bless (obtained from the 'recvblessings' command run by the remote principal")
-	cmdBless.Flags.StringVar(&flagBlessRemoteToken, "remote_token", "", "Token provided by principal running the 'recvblessings' command")
-	cmdBless.Flags.StringVar(&flagRemoteArgFile, "remote_arg_file", "", "File containing bless arguments written by 'principal recvblessings -remote_arg_file FILE EXTENSION' command. This can be provided to bless in place of --remote_key, --remote_token, and <principal>.")
+	cmdBless.Flags.StringVar(&flagBlessRemoteKey, "remote-key", "", "Public key of the remote principal to bless (obtained from the 'recvblessings' command run by the remote principal")
+	cmdBless.Flags.StringVar(&flagBlessRemoteToken, "remote-token", "", "Token provided by principal running the 'recvblessings' command")
+	cmdBless.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "File containing bless arguments written by 'principal recvblessings -remote-arg-file FILE EXTENSION' command. This can be provided to bless in place of --remote-key, --remote-token, and <principal>.")
 
 	cmdSeekBlessings.Flags.StringVar(&flagSeekBlessingsFrom, "from", "https://dev.v.io/auth/google", "URL to use to begin the seek blessings process")
-	cmdSeekBlessings.Flags.BoolVar(&flagSeekBlessingsSetDefault, "set_default", true, "If true, the blessings obtained will be set as the default blessing in the store")
-	cmdSeekBlessings.Flags.StringVar(&flagSeekBlessingsForPeer, "for_peer", string(security.AllPrincipals), "If non-empty, the blessings obtained will be marked for peers matching this pattern in the store")
+	cmdSeekBlessings.Flags.BoolVar(&flagSeekBlessingsSetDefault, "set-default", true, "If true, the blessings obtained will be set as the default blessing in the store")
+	cmdSeekBlessings.Flags.StringVar(&flagSeekBlessingsForPeer, "for-peer", string(security.AllPrincipals), "If non-empty, the blessings obtained will be marked for peers matching this pattern in the store")
 	cmdSeekBlessings.Flags.BoolVar(&flagSeekBlessingsBrowser, "browser", true, "If false, the seekblessings command will not open the browser and only print the url to visit.")
-	cmdSeekBlessings.Flags.BoolVar(&flagAddToRoots, "add_to_roots", true, "If true, the root certificate of the blessing will be added to the principal's set of recognized root certificates")
+	cmdSeekBlessings.Flags.BoolVar(&flagAddToRoots, "add-to-roots", true, "If true, the root certificate of the blessing will be added to the principal's set of recognized root certificates")
 
-	cmdSetForPeer.Flags.BoolVar(&flagAddToRoots, "add_to_roots", true, "If true, the root certificate of the blessing will be added to the principal's set of recognized root certificates")
+	cmdSetForPeer.Flags.BoolVar(&flagAddToRoots, "add-to-roots", true, "If true, the root certificate of the blessing will be added to the principal's set of recognized root certificates")
 
-	cmdSetDefault.Flags.BoolVar(&flagAddToRoots, "add_to_roots", true, "If true, the root certificate of the blessing will be added to the principal's set of recognized root certificates")
+	cmdSetDefault.Flags.BoolVar(&flagAddToRoots, "add-to-roots", true, "If true, the root certificate of the blessing will be added to the principal's set of recognized root certificates")
 
 	cmdCreate.Flags.BoolVar(&flagCreateOverwrite, "overwrite", false, "If true, any existing principal data in the directory will be overwritten")
 
-	cmdRecvBlessings.Flags.BoolVar(&flagRecvBlessingsSetDefault, "set_default", true, "If true, the blessings received will be set as the default blessing in the store")
-	cmdRecvBlessings.Flags.StringVar(&flagRecvBlessingsForPeer, "for_peer", string(security.AllPrincipals), "If non-empty, the blessings received will be marked for peers matching this pattern in the store")
-	cmdRecvBlessings.Flags.StringVar(&flagRemoteArgFile, "remote_arg_file", "", "If non-empty, the remote key, remote token, and principal will be written to the specified file in a JSON object. This can be provided to 'principal bless --remote_arg_file FILE EXTENSION'.")
+	cmdRecvBlessings.Flags.BoolVar(&flagRecvBlessingsSetDefault, "set-default", true, "If true, the blessings received will be set as the default blessing in the store")
+	cmdRecvBlessings.Flags.StringVar(&flagRecvBlessingsForPeer, "for-peer", string(security.AllPrincipals), "If non-empty, the blessings received will be marked for peers matching this pattern in the store")
+	cmdRecvBlessings.Flags.StringVar(&flagRemoteArgFile, "remote-arg-file", "", "If non-empty, the remote key, remote token, and principal will be written to the specified file in a JSON object. This can be provided to 'principal bless --remote-arg-file FILE EXTENSION'.")
 
 	cmdSet := &cmdline.Command{
 		Name:  "set",
diff --git a/cmd/principal/principal_v23_test.go b/cmd/principal/principal_v23_test.go
index c5381b8..bd357f5 100644
--- a/cmd/principal/principal_v23_test.go
+++ b/cmd/principal/principal_v23_test.go
@@ -135,11 +135,11 @@
 // For example,
 // principal recvblessings
 // would typically print something like:
-//    principal bless --remote_key=<some_public_key> --remote_token=<some_token> extensionfoo
+//    principal bless --remote-key=<some_public_key> --remote-token=<some_token> extensionfoo
 // as an example of command line to use to send the blessings over.
 //
 // In that case, this method would return:
-// { "--remote_key=<some_public_key>", "--remote_token=<some_token>", "extensionfoo"}
+// { "--remote-key=<some_public_key>", "--remote-token=<some_token>", "extensionfoo"}
 func blessArgsFromRecvBlessings(inv *v23tests.Invocation) []string {
 	cmd := inv.ExpectSetEventuallyRE("(^principal bless .*$)")[0][0]
 	return strings.Split(cmd, " ")[2:]
@@ -165,7 +165,7 @@
 	var args []string
 	{
 		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings")
-		args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(inv)...)
+		args = append([]string{"bless", "--require-caveats=false"}, blessArgsFromRecvBlessings(inv)...)
 		// Replace the random extension suggested by recvblessings with "friend/carol"
 		args[len(args)-1] = "friend/carol"
 	}
@@ -174,29 +174,29 @@
 	// Run recvblessings on carol, and have alice send blessings over
 	// (blessings received must be set as shareable with peers matching 'alice/...'.)
 	{
-		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=alice", "--set_default=false")
+		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for-peer=alice", "--set-default=false")
 		// recvblessings suggests a random extension, find the extension and replace it with friend/carol/foralice.
-		args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(inv)...)
+		args = append([]string{"bless", "--require-caveats=false"}, blessArgsFromRecvBlessings(inv)...)
 		args[len(args)-1] = "friend/carol/foralice"
 	}
 	bin.WithEnv(credEnv(aliceDir)).Start(args...).WaitOrDie(os.Stdout, os.Stderr)
 
-	// Run recvblessings on carol with the --remote_arg_file flag, and have bob send blessings over with the --remote_arg_file flag.
+	// Run recvblessings on carol with the --remote-arg-file flag, and have bob send blessings over with the --remote-arg-file flag.
 	{
-		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=bob", "--set_default=false", "--remote_arg_file="+bobBlessFile)
+		inv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for-peer=bob", "--set-default=false", "--remote-arg-file="+bobBlessFile)
 		// recvblessings suggests a random extension, use friend/carol/forbob instead.
-		args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(inv)...)
+		args = append([]string{"bless", "--require-caveats=false"}, blessArgsFromRecvBlessings(inv)...)
 		args[len(args)-1] = "friend/carol/forbob"
 	}
 	bin.WithEnv(credEnv(bobDir)).Start(args...).WaitOrDie(os.Stdout, os.Stderr)
 
-	listenerInv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for_peer=alice/...", "--set_default=false", "--vmodule=*=2", "--logtostderr")
+	listenerInv := bin.Start("--v23.credentials="+carolDir, "--v23.tcp.address=127.0.0.1:0", "recvblessings", "--for-peer=alice/...", "--set-default=false", "--vmodule=*=2", "--logtostderr")
 
-	args = append([]string{"bless", "--require_caveats=false"}, blessArgsFromRecvBlessings(listenerInv)...)
+	args = append([]string{"bless", "--require-caveats=false"}, blessArgsFromRecvBlessings(listenerInv)...)
 
 	{
-		// Mucking around with remote_key should fail.
-		cpy := strings.Split(regexp.MustCompile("remote_key=").ReplaceAllString(strings.Join(args, " "), "remote_key=BAD"), " ")
+		// Mucking around with remote-key should fail.
+		cpy := strings.Split(regexp.MustCompile("remote-key=").ReplaceAllString(strings.Join(args, " "), "remote-key=BAD"), " ")
 		var buf bytes.Buffer
 		if bin.WithEnv(credEnv(aliceDir)).Start(cpy...).Wait(os.Stdout, &buf) == nil {
 			t.Fatalf("%v should have failed, but did not", cpy)
@@ -210,7 +210,7 @@
 	{
 		var buf bytes.Buffer
 		// Mucking around with the token should fail.
-		cpy := strings.Split(regexp.MustCompile("remote_token=").ReplaceAllString(strings.Join(args, " "), "remote_token=BAD"), " ")
+		cpy := strings.Split(regexp.MustCompile("remote-token=").ReplaceAllString(strings.Join(args, " "), "remote-token=BAD"), " ")
 		if bin.WithEnv(credEnv(aliceDir)).Start(cpy...).Wait(os.Stdout, &buf) == nil {
 			t.Fatalf("%v should have failed, but did not", cpy)
 		}
@@ -412,8 +412,8 @@
 	} else if got, want := buf.String(), "ERROR: no caveats provided"; !strings.Contains(got, want) {
 		t.Errorf("fork returned error: %q, expected error to contain %q", got, want)
 	}
-	if err := bin.Start("--v23.credentials", parent, "fork", "--require_caveats=false", child, "child").Wait(os.Stdout, os.Stderr); err != nil {
-		t.Errorf("fork --require_caveats=false failed with: %v", err)
+	if err := bin.Start("--v23.credentials", parent, "fork", "--require-caveats=false", child, "child").Wait(os.Stdout, os.Stderr); err != nil {
+		t.Errorf("fork --require-caveats=false failed with: %v", err)
 	}
 }
 
@@ -442,8 +442,8 @@
 		}
 	}
 	{
-		// But succeed if --require_caveats=false is specified
-		redirect(t, bin.Start("bless", "--require_caveats=false", bobDir, "friend"), tmpfile)
+		// But succeed if --require-caveats=false is specified
+		redirect(t, bin.Start("bless", "--require-caveats=false", bobDir, "friend"), tmpfile)
 		got := removeCaveats(removePublicKeys(bin.Start("dumpblessings", tmpfile).Output()))
 		want := `Blessings          : alice/friend
 PublicKey          : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
@@ -505,7 +505,7 @@
 	bin.Start("create", aliceDir, "alice").WaitOrDie(os.Stdout, os.Stderr)
 	bin.Start("create", bobDir, "bob").WaitOrDie(os.Stdout, os.Stderr)
 	// Have bob create a "bob/friend" blessing and have alice recognize that.
-	redirect(t, bin.Start("--v23.credentials="+bobDir, "bless", "--require_caveats=false", aliceDir, "friend"), blessingFile)
+	redirect(t, bin.Start("--v23.credentials="+bobDir, "bless", "--require-caveats=false", aliceDir, "friend"), blessingFile)
 	bin.Start("--v23.credentials="+aliceDir, "addtoroots", blessingFile).WaitOrDie(os.Stdout, os.Stderr)
 	var (
 		// blessing roots lines that should match the keys