[Demonstration 1]

[Buggy Method]
@Override
public boolean equals(Object o) {
    if (this == o)
        return true;
    if (o == null || getClass() != o.getClass())
        return false;
    ClassTemplate template = (ClassTemplate) o;
    return (pkg != null ? !pkg.equals(template.pkg) : template.pkg != null) && !(name != null ? !name.equals(template.name) : template.name != null);
}

[Buggy Hunk]
return (pkg != null ? !pkg.equals(template.pkg) : template.pkg != null)

[Patch]
return !(pkg != null ? !pkg.equals(template.pkg) : template.pkg != null)

[Demonstration 2]

[Buggy Method]
@Override
public ASN1Encodable getValue(final EndEntityInformation subject, final CA ca, final CertificateProfile certProfile, final PublicKey userPublicKey, final PublicKey caPublicKey, CertificateValidity val) throws CertificateExtensionException {
    org.bouncycastle.asn1.x509.AuthorityKeyIdentifier ret = null;
    // Default value is that we calculate it from scratch!
    // (If this is a root CA we must calculate the AuthorityKeyIdentifier from scratch)
    // (If the CA signing this cert does not have a SubjectKeyIdentifier we must calculate the AuthorityKeyIdentifier from scratch)
    JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils(SHA1DigestCalculator.buildSha1Instance());
    ret = extensionUtils.createAuthorityKeyIdentifier(caPublicKey);
    // If we have a CA-certificate (i.e. this is not a Root CA), we must take the authority key identifier from
    // the CA-certificates SubjectKeyIdentifier if it exists. If we don't do that we will get the wrong identifier if the
    // CA does not follow RFC3280 (guess if MS-CA follows RFC3280?)
    final X509Certificate cacert = (X509Certificate) ca.getCACertificate();
    final boolean isRootCA = (certProfile.getType() == CertificateConstants.CERTTYPE_ROOTCA);
    if ((cacert != null) && (!isRootCA)) {
        byte[] akibytes;
        akibytes = CertTools.getSubjectKeyId(cacert);
        if (akibytes != null) {
            // TODO: The code below is snipped from AuthorityKeyIdentifier.java in BC 1.36, because there is no method there
            // to set only a pre-computed key identifier
            // This should be replaced when such a method is added to BC
            final ASN1OctetString keyidentifier = new DEROctetString(akibytes);
            final ASN1EncodableVector v = new ASN1EncodableVector();
            v.add(new DERTaggedObject(false, 0, keyidentifier));
            final ASN1Sequence seq = new DERSequence(v);
            ret = org.bouncycastle.asn1.x509.AuthorityKeyIdentifier.getInstance(seq);
            if (log.isDebugEnabled()) {
                log.debug("Using AuthorityKeyIdentifier from CA-certificates SubjectKeyIdentifier.");
            }
        }
    }
    return ret;
}

[Buggy Hunk]
final X509Certificate cacert = (X509Certificate) ca.getCACertificate();

[Patch]
final X509Certificate cacert = getCACertificate(ca, caPublicKey);

[Demonstration 3]

[Buggy Method]
private MetadataManager getMetadataManager(KylinConfig config) throws Exception {
    return MetadataManager.getInstance(config);
}

[Buggy Hunk]
private MetadataManager getMetadataManager(KylinConfig config) throws Exception {

[Patch]
private static MetadataManager getMetadataManager(KylinConfig config) throws Exception {