From owner-freebsd-questions@FreeBSD.ORG Sun Nov 28 17:51:50 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id AEA99106564A for ; Sun, 28 Nov 2010 17:51:50 +0000 (UTC) (envelope-from bluethundr@gmail.com) Received: from mail-bw0-f54.google.com (mail-bw0-f54.google.com [209.85.214.54]) by mx1.freebsd.org (Postfix) with ESMTP id D11348FC1D for ; Sun, 28 Nov 2010 17:51:49 +0000 (UTC) Received: by bwz2 with SMTP id 2so3438959bwz.13 for ; Sun, 28 Nov 2010 09:51:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=APYDr50SZqyFKTdC1CBB6W3JSdlhBc3ENwraVa+1KVs=; b=ZkF6pv2CCTfpUoAMspBM13mHTLZ2Ry7aqO/cgJ+P8jOCoLf1/YpGLNyVpeKJO9Ff94 EVRN/zbTUOPXKcfQGIB2oGm2N8ZwlPwCU6WhnN5GXkwhbZ99F5zCXjPo/63hyYJHuwLV cD83pz0i1psFhws8kphxZnnyav94eW6VGAMhw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=o5M9U3BScCi6xhiPPcE7PgncLYl+R4RYA+56ZQ/5KCui1piPatpWunIsJtoh8w/JZi tA1g7lJNf5KBH1eh9s2QPg2PGyRrc1JKAOLdPXJbn5jEiioW7aK+BA/+B00V6hIwoQH+ bpWy3Be+VMEiWS+2NR9gnIC2rwSwv2CJl0ATY= MIME-Version: 1.0 Received: by 10.204.112.69 with SMTP id v5mr2133602bkp.84.1290966708087; Sun, 28 Nov 2010 09:51:48 -0800 (PST) Received: by 10.204.10.72 with HTTP; Sun, 28 Nov 2010 09:51:48 -0800 (PST) In-Reply-To: <4CEE987D.9040008@locolomo.org> References: <4CEE987D.9040008@locolomo.org> Date: Sun, 28 Nov 2010 12:51:48 -0500 Message-ID: From: bluethundr To: freebsd-questions@freebsd.org Content-Type: multipart/mixed; boundary=0016e6d58cfc0d6adc0496209cb6 Subject: Re: can't use godaddy SSL cert X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Nov 2010 17:51:50 -0000 --0016e6d58cfc0d6adc0496209cb6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Eric and John Thanks for your input.. > As mentioned in my previous mail, there is no need to specify TLSCACertif= icateFile in > > slapd.conf unless your server will request client certific= ate for authentication. Nor is there > any point in trying multiple files, = you can concatenate the CA certificates into a single file. I have removed TLSCACertificateFile form slapd and now recognize that this directive is only needed on the client side. Thanks for clueing me into that. And here is my /etc/ldap.conf file on on the CentOS 5.5 client: [root@VIRCENT03:~]#cat /etc/ldap.conf host 192.168.1.44 base dc=3Dsummitnjhome,dc=3Dcom sudoers_base ou=3Dsudoers,ou=3DServices,dc=3Dsummitnjhome,dc=3Dcom scope sub pam_password exop nss_base_passwd ou=3Dstaff,dc=3Dsummitnjhome,dc=3Dcom nss_base_shadow ou=3Dstaff,dc=3Dsummitnjhome,dc=3Dcom TLS_CACERT /etc/openldap/cacerts/gd_sf_all.crt And here are the contents of the cacerts directory on the CentOS 55 client: [root@VIRCENT03:~]#ls -l /etc/openldap/cacerts/ total 36 -r--r--r-- 1 root root 27529 Nov 28 12:10 all.crt lrwxrwxrwx 1 root root 7 Nov 28 12:20 b737b221.0 -> all.crt And this is the way that nsswitch is setup on the CentOS client: passwd: files ldap shadow: files ldap group: files ldap sudoers: ldap I have revised the location of the cert files on the server noted in slapd.conf in order to separate out the certs from the cacerts. This is just to organize things a little more neatly. ## TLS options for slapd TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /usr/local/etc/openldap/certs/slapd.crt TLSCertificateKeyFile /usr/local/etc/openldap/certs/slapd.pem And here are the contents of the /usr/local/etc/openldap/certs directory, also on the server that is referenced in the TLS lines in slapd.conf: -r--r--r-- 1 root ldap 2309 Nov 26 18:52 LBSD2.summitnjhome.com.crt dr--r--r-- 3 root ldap 512 Nov 28 03:32 bak drwxr-xr-x 2 root ldap 512 Nov 28 03:26 cacerts -r--r--r-- 1 root ldap 2309 Nov 26 18:53 slapd.crt -r--r--r-- 1 root ldap 1781 Nov 26 18:36 slapd.csr -r--r--r-- 1 root ldap 3311 Nov 26 18:35 slapd.key -r--r--r-- 1 root ldap 3243 Nov 26 18:54 slapd.pem Here is the location of the cacert file on the server that the /etc/ldap.conf file on the client references; LBSD2# ls -l /usr/local/etc/openldap/certs/cacerts -r--r--r-- 1 root ldap 27529 Nov 28 15:49 all.crt The all.crt file is the result of concatenating these files together: all.crt gdroot-g2.crt sf_issuing.crt ca_bundle.crt sf_bundle.crt sfroot-g2.crt gd_bundle.crt sf-class2-root.crt sfsroot.crt gd-class2-root.crt sf_cross_intermediate.crt sfsroot-g2.crt gd_intermediate.crt sf_intermediate.crt Here is where the testing begins: [root@VIRCENT03:~]#openssl s_client -connect ldap.summitnjhome.com:389 -showcerts -CAfile /usr/local/etc/openldap/certs/cacerts/all.crt 10073:error:02001002:system library:fopen:No such file or directory:bss_file.c:122:fopen('/usr/local/etc/openldap/certs/cacerts/all.c= rt','r') 10073:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:125: 10073:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279: CONNECTED(00000003) 10073:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: CONNECTED(00000003) 10065:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: As you can see I have provided openssl the full path to the all.crt file on the server and am still receiving a handshake failure. It looks like When I turn > No. I assume that your hostname is the CN indicated above, so your -h is = not the issue. >When you do -ZZ then ldapsearch will fail if it cannot vali= date the certificate. You can try >with a single -Z to see if it works. Yes the hostname is in the CN of the cert file. So I agree that -h is not the issue. :) When I try to turn on LDAP with tls on a centos machine, getent freezes when it tries to access the information in ldap: I have scp'd the cert file to the right location on the centos machine (/etc/openldap/cacerts) Here's what happens when I try to connect using openssl s_client from a remote machine (CentOS): [root@LCENT01 ~]# LBSD2# openssl s_client -connect ldap.summitnjhome.com:389 -showcerts -CAfile /usr/local/etc/openldap/certs/cacerts/gd_sf_all.crt -bash: LBSD2#: command not found [root@LCENT01 ~]# openssl s_client -connect ldap.summitnjhome.com:389 -showcerts -CAfile /usr/local/etc/openldap/certs/cacerts/gd_sf_all.crt 4299:error:02001002:system library:fopen:No such file or directory:bss_file.c:122:fopen('/usr/local/etc/openldap/certs/cacerts/gd_sf= _all.crt','r') 4299:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:125: 4299:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279: CONNECTED(00000003) 4299:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: As you can see I have provided openssl s_client with the full path to the cacert (all.crt) on the server. It looks as if it's claiming that the file isn't there, when it clearly is. If I do an ldapsearch from the CentOS client it claims that it can't verify the certificate: [root@VIRCENT03:~]#ldapsearch -h ldap -b "dc=3Dsummitnjhome,dc=3Dcom" -Z -D "cn=3DManager,dc=3Dsummitnjhome,dc=3Dcom" "(objectclass=3DsudoRole)" -W ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Enter LDAP Password: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed If I provide some more information with the -d -44 flags this is what I see= : [root@VIRCENT03:~]#ldapsearch -h ldap -b "dc=3Dsummitnjhome,dc=3Dcom" -d -44 -Z -D "cn=3DManager,dc=3Dsummitnjhome,dc=3Dcom" "(objectclass=3DsudoRol= e)" -W ber_dump: buf=3D0x8eb62e8 ptr=3D0x8eb62e8 end=3D0x8eb6307 len=3D31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.= 1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_dump: buf=3D0x8eb62e8 ptr=3D0x8eb62ed end=3D0x8eb6307 len=3D26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1= . 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_dump: buf=3D0x8eb7678 ptr=3D0x8eb7678 end=3D0x8eb7684 len=3D12 0000: 02 01 01 78 07 0a 01 00 04 00 04 00 ...x........ ber_dump: buf=3D0x8eb7678 ptr=3D0x8eb767b end=3D0x8eb7684 len=3D9 0000: 78 07 0a 01 00 04 00 04 00 x........ request done: ld 0x8ead530 msgid 1 ber_dump: buf=3D0x8eb7678 ptr=3D0x8eb767b end=3D0x8eb7684 len=3D9 0000: 78 07 0a 01 00 04 00 04 00 x........ ber_dump: buf=3D0x8eb7678 ptr=3D0x8eb767b end=3D0x8eb7684 len=3D9 0000: 78 07 0a 01 00 04 00 04 00 x........ ber_dump: buf=3D0x8eb7678 ptr=3D0x8eb7684 end=3D0x8eb7684 len=3D0 TLS certificate verification: Error, unable to get local issuer certificate TLS: can't connect. ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Enter LDAP Password: ldap_build_search_req ATTRS: supportedSASLMechanisms ber_dump: buf=3D0x8f1e6a0 ptr=3D0x8f1e6a0 end=3D0x8f1e6e0 len=3D64 0000: 30 3e 02 01 02 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9........= . 0010: 01 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 74 ..........objec= t 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...suppor= t 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanism= s ber_dump: buf=3D0x8f1e6a0 ptr=3D0x8f1e6a5 end=3D0x8f1e6e0 len=3D59 0000: 63 39 04 00 0a 01 00 0a 01 00 02 01 00 02 01 00 c9.............= . 0010: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclas= s 0020: 30 19 04 17 73 75 70 70 6f 72 74 65 64 53 41 53 0...supportedSA= S 0030: 4c 4d 65 63 68 61 6e 69 73 6d 73 LMechanisms ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I am including the output of a -d -1 as an attachment for those that are still curious because the output of that command is quite long. :) When I issue getent commands for passwd and group it hangs forever when it tries to access information from ldap: [root@VIRCENT03:~]#getent passwd | grep ldapAccount [root@VIRCENT03:~]#getent group | grep ldapAccount However if I remove TLS from the equation with the -x flag everything starts working again: [root@VIRCENT03:~]#ldapsearch -x -h ldap -b "dc=3Dsummitnjhome,dc=3Dcom" -D "cn=3DManager,dc=3Dsummitnjhome,dc=3Dcom" -w localG30rg3T0wn "(objectclass=3DsudoRole)" # extended LDIF # # LDAPv3 # base with scope subtree # filter: (objectclass=3DsudoRole) # requesting: ALL # # defaults, sudoers, Services, summitnjhome.com dn: cn=3Ddefaults,ou=3Dsudoers,ou=3DServices,dc=3Dsummitnjhome,dc=3Dcom objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here # %wheel, sudoers, Services, summitnjhome.com dn: cn=3D%wheel,ou=3Dsudoers,ou=3DServices,dc=3Dsummitnjhome,dc=3Dcom objectClass: top objectClass: sudoRole cn: %wheel sudoHost: ALL sudoRunAsUser: ALL sudoCommand: ALL sudoOption: !authenticate sudoUser: %wheel sudoUser: bluethundr # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 That's all I have for now. Sincere thanks to all those who have provided input. I'll keep pounding away at this and hopefully figure this out today. Best regards!!! freebsd-questions@freebsd.o On Thu, Nov 25, 2010 at 12:10 PM, Erik Norgaard wro= te: > On 25/11/10 17.26, bluethundr wrote: > >> I have setup the certificate chain in my slapd.conf like so: >> >> [root@LBSD2:/usr/home/bluethundr]#grep -i tls >> /usr/local/etc/openldap/slapd.conf## TLS options for slapd >> TLSCipherSuite HIGH:MEDIUM:+SSLv2 >> TLSCertificateFile >> =A0/usr/local/etc/openldap/cacerts/LBSD2.summitnjhome.com.crt >> TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/slapd.pem >> TLSCACertificateFile =A0/usr/local/etc/openldap/cacerts/sf_issuing.crt >> >> I have tried each of the following certs with no luck in getting my >> cert to talk to it's CA: >> >> -rw-r--r-- =A01 root =A0bluethundr =A02604 Nov 25 11:37 ca_bundle.crt >> -r--r----- =A01 root =A0ldap =A0 =A0 =A0 =A04604 Nov 24 18:57 gd_bundle.= crt >> -r--r----- =A01 root =A0ldap =A0 =A0 =A0 =A01537 Nov 25 02:00 sf_issuing= .crt > > As mentioned in my previous mail, there is no need to specify > TLSCACertificateFile in slapd.conf unless your server will request client > certificate for authentication. Nor is there any point in trying multiple > files, you can concatenate the CA certificates into a single fiel. > > Since these are certificates you can leave global read access. > >> and I get the same result for each when I attempt to connect to SSL on >> the LDAP server: >> >> [root@LCENT01:/tmp/Foswiki-1.1.2]#openssl s_client -connect >> ldap.example.com:389 -showcerts -CAfile sf_issuing.crt >> 13730:error:02001002:system library:fopen:No such file or >> directory:bss_file.c:122:fopen('sf_issuing.crt','r') >> 13730:error:2006D080:BIO routines:BIO_new_file:no such >> file:bss_file.c:125: >> 13730:error:0B084002:x509 certificate >> routines:X509_load_cert_crl_file:system lib:by_file.c:279: >> CONNECTED(00000003) >> 13730:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake >> failure:s23_lib.c:188: > > Can't find sf_issuing.crt, well, from your CWD it appears that the > certificate is not found in that path. > >> ldapsearch -h ldap.example.com -d -1 -ZZ "dc=3Dexample,dc=3Dcom" >> >> TLS certificate verification: depth: 0, err: 20, subject: >> /O=3DLBSD2.summitnjhome.com/OU=3DDomain Control >> Validated/CN=3DLBSD2.summitnjhome.com, issuer: >> /C=3DUS/ST=3DArizona/L=3DScottsdale/O=3DGoDaddy.com, >> Inc./OU=3Dhttp://certificates.godaddy.com/repository/CN=3DGo Daddy Secur= e >> Certification Authority/serialNumber=3D07969287 >> TLS certificate verification: Error, unable to get local issuer >> certificate >> tls_write: want=3D7, written=3D7 >> =A0 0000: =A015 03 01 00 02 02 30 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0 =A0 =A0 =A0 ......0 >> TLS trace: SSL3 alert write:fatal:unknown CA >> TLS trace: SSL_connect:error in SSLv3 read server certificate B >> TLS trace: SSL_connect:error in SSLv3 read server certificate B >> TLS: can't connect. >> ldap_perror >> ldap_start_tls: Connect error (-11) >> =A0 =A0 =A0 =A0additional info: error:14090086:SSL >> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >> >> It seems to indicate that it can't talk to it's CA... >> >> does anyone have any suggestions on how to make this work? > > No. I assume that your hostname is the CN indicated above, so your -h is = not > the issue. When you do -ZZ then ldapsearch will fail if it cannot validat= e > the certificate. You can try with a single -Z to see if it works. > > You have not included your ldap.conf above, the ldapsearch reads ldap.con= f, > including where to find any ca certificates. Either you have not installe= d > the godaddy CA certificate or not updated our ldap.conf accordingly. > > BR, Erik > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.o= rg" > --=20 Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys B6D6EAC3 --0016e6d58cfc0d6adc0496209cb6 Content-Type: text/plain; charset=US-ASCII; name="detailed-ldapsearch.txt" Content-Disposition: attachment; filename="detailed-ldapsearch.txt" Content-Transfer-Encoding: base64 X-Attachment-Id: f_gh27zvoa0 W3Jvb3RAVklSQ0VOVDAzOn5dI2xkYXBzZWFyY2ggLWggbGRhcCAtYiAiZGM9c3VtbWl0bmpob21l LGRjPWNvbSIgLWQgLTEgLVogLUQgImNuPU1hbmFnZXIsZGM9c3VtbWl0bmpob21lLGRjPWNvbSIg IihvYmplY3RjbGFzcz1zdWRvUm9sZSkiIC1XCmxkYXBfY3JlYXRlCmxkYXBfdXJsX3BhcnNlX2V4 dChsZGFwOi8vbGRhcCkKbGRhcF9leHRlbmRlZF9vcGVyYXRpb25fcwpsZGFwX2V4dGVuZGVkX29w ZXJhdGlvbgpsZGFwX3NlbmRfaW5pdGlhbF9yZXF1ZXN0CmxkYXBfbmV3X2Nvbm5lY3Rpb24gMSAx IDAKbGRhcF9pbnRfb3Blbl9jb25uZWN0aW9uCmxkYXBfY29ubmVjdF90b19ob3N0OiBUQ1AgbGRh cDozODkKbGRhcF9uZXdfc29ja2V0OiAzCmxkYXBfcHJlcGFyZV9zb2NrZXQ6IDMKbGRhcF9jb25u ZWN0X3RvX2hvc3Q6IFRyeWluZyAxOTIuMTY4LjEuNDQ6Mzg5CmxkYXBfY29ubmVjdF90aW1lb3V0 OiBmZDogMyB0bTogLTEgYXN5bmM6IDAKbGRhcF9vcGVuX2RlZmNvbm46IHN1Y2Nlc3NmdWwKbGRh cF9zZW5kX3NlcnZlcl9yZXF1ZXN0CmJlcl9zY2FuZiBmbXQgKHtpdCkgYmVyOgpiZXJfZHVtcDog YnVmPTB4YTAzMTJlOCBwdHI9MHhhMDMxMmU4IGVuZD0weGEwMzEzMDcgbGVuPTMxCiAgMDAwMDog IDMwIDFkIDAyIDAxIDAxIDc3IDE4IDgwICAxNiAzMSAyZSAzMyAyZSAzNiAyZSAzMSAgIDAuLi4u dy4uLjEuMy42LjEgIAogIDAwMTA6ICAyZSAzNCAyZSAzMSAyZSAzMSAzNCAzNiAgMzYgMmUgMzIg MzAgMzAgMzMgMzcgICAgICAuNC4xLjE0NjYuMjAwMzcgICAKYmVyX3NjYW5mIGZtdCAoeykgYmVy OgpiZXJfZHVtcDogYnVmPTB4YTAzMTJlOCBwdHI9MHhhMDMxMmVkIGVuZD0weGEwMzEzMDcgbGVu PTI2CiAgMDAwMDogIDc3IDE4IDgwIDE2IDMxIDJlIDMzIDJlICAzNiAyZSAzMSAyZSAzNCAyZSAz MSAyZSAgIHcuLi4xLjMuNi4xLjQuMS4gIAogIDAwMTA6ICAzMSAzNCAzNiAzNiAyZSAzMiAzMCAz MCAgMzMgMzcgICAgICAgICAgICAgICAgICAgICAxNDY2LjIwMDM3ICAgICAgICAKYmVyX2ZsdXNo OiAzMSBieXRlcyB0byBzZCAzCiAgMDAwMDogIDMwIDFkIDAyIDAxIDAxIDc3IDE4IDgwICAxNiAz MSAyZSAzMyAyZSAzNiAyZSAzMSAgIDAuLi4udy4uLjEuMy42LjEgIAogIDAwMTA6ICAyZSAzNCAy ZSAzMSAyZSAzMSAzNCAzNiAgMzYgMmUgMzIgMzAgMzAgMzMgMzcgICAgICAuNC4xLjE0NjYuMjAw MzcgICAKbGRhcF93cml0ZTogd2FudD0zMSwgd3JpdHRlbj0zMQogIDAwMDA6ICAzMCAxZCAwMiAw MSAwMSA3NyAxOCA4MCAgMTYgMzEgMmUgMzMgMmUgMzYgMmUgMzEgICAwLi4uLncuLi4xLjMuNi4x ICAKICAwMDEwOiAgMmUgMzQgMmUgMzEgMmUgMzEgMzQgMzYgIDM2IDJlIDMyIDMwIDMwIDMzIDM3 ICAgICAgLjQuMS4xNDY2LjIwMDM3ICAgCmxkYXBfcmVzdWx0IGxkIDB4YTAyODUzMCBtc2dpZCAx CndhaXQ0bXNnIGxkIDB4YTAyODUzMCBtc2dpZCAxIChpbmZpbml0ZSB0aW1lb3V0KQp3YWl0NG1z ZyBjb250aW51ZSBsZCAweGEwMjg1MzAgbXNnaWQgMSBhbGwgMQoqKiBsZCAweGEwMjg1MzAgQ29u bmVjdGlvbnM6CiogaG9zdDogbGRhcCAgcG9ydDogMzg5ICAoZGVmYXVsdCkKICByZWZjbnQ6IDIg IHN0YXR1czogQ29ubmVjdGVkCiAgbGFzdCB1c2VkOiBTdW4gTm92IDI4IDEyOjM5OjU1IDIwMTAK CioqIGxkIDB4YTAyODUzMCBPdXRzdGFuZGluZyBSZXF1ZXN0czoKICogbXNnaWQgMSwgIG9yaWdp ZCAxLCBzdGF0dXMgSW5Qcm9ncmVzcwogICBvdXRzdGFuZGluZyByZWZlcnJhbHMgMCwgcGFyZW50 IGNvdW50IDAKKiogbGQgMHhhMDI4NTMwIFJlc3BvbnNlIFF1ZXVlOgogICBFbXB0eQpsZGFwX2No a1Jlc3BvbnNlTGlzdCBsZCAweGEwMjg1MzAgbXNnaWQgMSBhbGwgMQpsZGFwX2Noa1Jlc3BvbnNl TGlzdCByZXR1cm5zIGxkIDB4YTAyODUzMCBOVUxMCmxkYXBfaW50X3NlbGVjdApyZWFkMW1zZzog bGQgMHhhMDI4NTMwIG1zZ2lkIDEgYWxsIDEKYmVyX2dldF9uZXh0CmxkYXBfcmVhZDogd2FudD04 LCBnb3Q9OAogIDAwMDA6ICAzMCAwYyAwMiAwMSAwMSA3OCAwNyAwYSAgICAgICAgICAgICAgICAg ICAgICAgICAgICAwLi4uLnguLiAgICAgICAgICAKbGRhcF9yZWFkOiB3YW50PTYsIGdvdD02CiAg MDAwMDogIDAxIDAwIDA0IDAwIDA0IDAwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IC4uLi4uLiAgICAgICAgICAgIApiZXJfZ2V0X25leHQ6IHRhZyAweDMwIGxlbiAxMiBjb250ZW50 czoKYmVyX2R1bXA6IGJ1Zj0weGEwMzI2OTAgcHRyPTB4YTAzMjY5MCBlbmQ9MHhhMDMyNjljIGxl bj0xMgogIDAwMDA6ICAwMiAwMSAwMSA3OCAwNyAwYSAwMSAwMCAgMDQgMDAgMDQgMDAgICAgICAg ICAgICAgICAuLi54Li4uLi4uLi4gICAgICAKcmVhZDFtc2c6IGxkIDB4YTAyODUzMCBtc2dpZCAx IG1lc3NhZ2UgdHlwZSBleHRlbmRlZC1yZXN1bHQKYmVyX3NjYW5mIGZtdCAoe2VhYSkgYmVyOgpi ZXJfZHVtcDogYnVmPTB4YTAzMjY5MCBwdHI9MHhhMDMyNjkzIGVuZD0weGEwMzI2OWMgbGVuPTkK ICAwMDAwOiAgNzggMDcgMGEgMDEgMDAgMDQgMDAgMDQgIDAwICAgICAgICAgICAgICAgICAgICAg ICAgeC4uLi4uLi4uICAgICAgICAgCnJlYWQxbXNnOiBsZCAweGEwMjg1MzAgMCBuZXcgcmVmZXJy YWxzCnJlYWQxbXNnOiAgbWFyayByZXF1ZXN0IGNvbXBsZXRlZCwgbGQgMHhhMDI4NTMwIG1zZ2lk IDEKcmVxdWVzdCBkb25lOiBsZCAweGEwMjg1MzAgbXNnaWQgMQpyZXNfZXJybm86IDAsIHJlc19l cnJvcjogPD4sIHJlc19tYXRjaGVkOiA8PgpsZGFwX2ZyZWVfcmVxdWVzdCAob3JpZ2lkIDEsIG1z Z2lkIDEpCmxkYXBfcGFyc2VfZXh0ZW5kZWRfcmVzdWx0CmJlcl9zY2FuZiBmbXQgKHtlYWEpIGJl cjoKYmVyX2R1bXA6IGJ1Zj0weGEwMzI2OTAgcHRyPTB4YTAzMjY5MyBlbmQ9MHhhMDMyNjljIGxl bj05CiAgMDAwMDogIDc4IDA3IDBhIDAxIDAwIDA0IDAwIDA0ICAwMCAgICAgICAgICAgICAgICAg ICAgICAgIHguLi4uLi4uLiAgICAgICAgIApsZGFwX3BhcnNlX3Jlc3VsdApiZXJfc2NhbmYgZm10 ICh7aWFhKSBiZXI6CmJlcl9kdW1wOiBidWY9MHhhMDMyNjkwIHB0cj0weGEwMzI2OTMgZW5kPTB4 YTAzMjY5YyBsZW49OQogIDAwMDA6ICA3OCAwNyAwYSAwMSAwMCAwNCAwMCAwNCAgMDAgICAgICAg ICAgICAgICAgICAgICAgICB4Li4uLi4uLi4gICAgICAgICAKYmVyX3NjYW5mIGZtdCAofSkgYmVy OgpiZXJfZHVtcDogYnVmPTB4YTAzMjY5MCBwdHI9MHhhMDMyNjljIGVuZD0weGEwMzI2OWMgbGVu PTAKCmxkYXBfbXNnZnJlZQpUTFMgdHJhY2U6IFNTTF9jb25uZWN0OmJlZm9yZS9jb25uZWN0IGlu aXRpYWxpemF0aW9uCnRsc193cml0ZTogd2FudD0xMjEsIHdyaXR0ZW49MTIxCiAgMDAwMDogIDgw IDc3IDAxIDAzIDAxIDAwIDRlIDAwICAwMCAwMCAyMCAwMCAwMCAzOSAwMCAwMCAgIC53Li4uLk4u Li4gLi45Li4gIAogIDAwMTA6ICAzOCAwMCAwMCAzNSAwMCAwMCAxNiAwMCAgMDAgMTMgMDAgMDAg MGEgMDcgMDAgYzAgICA4Li41Li4uLi4uLi4uLi4uICAKICAwMDIwOiAgMDAgMDAgMzMgMDAgMDAg MzIgMDAgMDAgIDJmIDAzIDAwIDgwIDAwIDAwIDA1IDAwICAgLi4zLi4yLi4vLi4uLi4uLiAgCiAg MDAzMDogIDAwIDA0IDAxIDAwIDgwIDAwIDAwIDE1ICAwMCAwMCAxMiAwMCAwMCAwOSAwNiAwMCAg IC4uLi4uLi4uLi4uLi4uLi4gIAogIDAwNDA6ICA0MCAwMCAwMCAxNCAwMCAwMCAxMSAwMCAgMDAg MDggMDAgMDAgMDYgMDQgMDAgODAgICBALi4uLi4uLi4uLi4uLi4uICAKICAwMDUwOiAgMDAgMDAg MDMgMDIgMDAgODAgMDAgMDAgIGZmIGQyIDQ5IDFhIGI4IGEyIDU5IDI5ICAgLi4uLi4uLi4uLkku Li5ZKSAgCiAgMDA2MDogIDhmIDU2IGRkIGFmIDllIGZiIDliIGY3ICAxYSBjZCA3ZiBmZCBmNCAx MiBlZCBjMiAgIC5WLi4uLi4uLi4uLi4uLi4gIAogIDAwNzA6ICBjOCA3YyA5YiA3NCBmYiBiZiAy MiAxMCAgM2UgICAgICAgICAgICAgICAgICAgICAgICAufC50Li4iLj4gICAgICAgICAKVExTIHRy YWNlOiBTU0xfY29ubmVjdDpTU0x2Mi92MyB3cml0ZSBjbGllbnQgaGVsbG8gQQp0bHNfcmVhZDog d2FudD03LCBnb3Q9NwogIDAwMDA6ICAxNiAwMyAwMSAwMCA0YSAwMiAwMCAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAuLi4uSi4uICAgICAgICAgICAKdGxzX3JlYWQ6IHdhbnQ9NzIsIGdv dD03MgogIDAwMDA6ICAwMCA0NiAwMyAwMSA0YyBmMiBjZCAwNCAgMzYgNzcgYmMgMzYgZmQgYTMg YzYgYmQgICAuRi4uTC4uLjZ3LjYuLi4uICAKICAwMDEwOiAgOWQgZDQgMmYgMDMgNmEgOWQgZTcg NWEgIDkyIGZlIDU4IDFhIGFiIDk4IDdiIDNhICAgLi4vLmouLlouLlguLi57OiAgCiAgMDAyMDog IGQxIDA5IDhmIDgyIDIwIGM0IDg0IDlhICAyYiAyMiA2ZiA5YiBmNyA5MiA0ZSAxOCAgIC4uLi4g Li4uKyJvLi4uTi4gIAogIDAwMzA6ICA5NiA4NiAwZSA0YSAwYSA1ZCAxNCAwZCAgYTkgZjcgMTcg ZGIgOTQgMjEgNGMgM2YgICAuLi5KLl0uLi4uLi4uIUw/ICAKICAwMDQwOiAgY2QgZTAgNmYgNDEg ZjYgMDAgMzUgMDAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi5vQS4uNS4gICAgICAgICAg ClRMUyB0cmFjZTogU1NMX2Nvbm5lY3Q6U1NMdjMgcmVhZCBzZXJ2ZXIgaGVsbG8gQQp0bHNfcmVh ZDogd2FudD01LCBnb3Q9NQogIDAwMDA6ICAxNiAwMyAwMSAwNiA4YiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAuLi4uLiAgICAgICAgICAgICAKdGxzX3JlYWQ6IHdhbnQ9MTY3 NSwgZ290PTEzNjQKICAwMDAwOiAgMGIgMDAgMDYgODcgMDAgMDYgODQgMDAgIDA2IDgxIDMwIDgy IDA2IDdkIDMwIDgyICAgLi4uLi4uLi4uLjAuLn0wLiAgCiAgMDAxMDogIDA1IDY1IGEwIDAzIDAy IDAxIDAyIDAyICAwNyAwNCAzMCBkNyBhMCAyNyA2NSA0MCAgIC5lLi4uLi4uLi4wLi4nZUAgIAog IDAwMjA6ICAzMCAwZCAwNiAwOSAyYSA4NiA0OCA4NiAgZjcgMGQgMDEgMDEgMDUgMDUgMDAgMzAg ICAwLi4uKi5ILi4uLi4uLi4wICAKICAwMDMwOiAgODEgY2EgMzEgMGIgMzAgMDkgMDYgMDMgIDU1 IDA0IDA2IDEzIDAyIDU1IDUzIDMxICAgLi4xLjAuLi5VLi4uLlVTMSAgCiAgMDA0MDogIDEwIDMw IDBlIDA2IDAzIDU1IDA0IDA4ICAxMyAwNyA0MSA3MiA2OSA3YSA2ZiA2ZSAgIC4wLi4uVS4uLi5B cml6b24gIAogIDAwNTA6ICA2MSAzMSAxMyAzMCAxMSAwNiAwMyA1NSAgMDQgMDcgMTMgMGEgNTMg NjMgNmYgNzQgICBhMS4wLi4uVS4uLi5TY290ICAKICAwMDYwOiAgNzQgNzMgNjQgNjEgNmMgNjUg MzEgMWEgIDMwIDE4IDA2IDAzIDU1IDA0IDBhIDEzICAgdHNkYWxlMS4wLi4uVS4uLiAgCiAgMDA3 MDogIDExIDQ3IDZmIDQ0IDYxIDY0IDY0IDc5ICAyZSA2MyA2ZiA2ZCAyYyAyMCA0OSA2ZSAgIC5H b0RhZGR5LmNvbSwgSW4gIAogIDAwODA6ICA2MyAyZSAzMSAzMyAzMCAzMSAwNiAwMyAgNTUgMDQg MGIgMTMgMmEgNjggNzQgNzQgICBjLjEzMDEuLlUuLi4qaHR0ICAKICAwMDkwOiAgNzAgM2EgMmYg MmYgNjMgNjUgNzIgNzQgIDY5IDY2IDY5IDYzIDYxIDc0IDY1IDczICAgcDovL2NlcnRpZmljYXRl cyAgCiAgMDBhMDogIDJlIDY3IDZmIDY0IDYxIDY0IDY0IDc5ICAyZSA2MyA2ZiA2ZCAyZiA3MiA2 NSA3MCAgIC5nb2RhZGR5LmNvbS9yZXAgIAogIDAwYjA6ICA2ZiA3MyA2OSA3NCA2ZiA3MiA3OSAz MSAgMzAgMzAgMmUgMDYgMDMgNTUgMDQgMDMgICBvc2l0b3J5MTAwLi4uVS4uICAKICAwMGMwOiAg MTMgMjcgNDcgNmYgMjAgNDQgNjEgNjQgIDY0IDc5IDIwIDUzIDY1IDYzIDc1IDcyICAgLidHbyBE YWRkeSBTZWN1ciAgCiAgMDBkMDogIDY1IDIwIDQzIDY1IDcyIDc0IDY5IDY2ICA2OSA2MyA2MSA3 NCA2OSA2ZiA2ZSAyMCAgIGUgQ2VydGlmaWNhdGlvbiAgIAogIDAwZTA6ICA0MSA3NSA3NCA2OCA2 ZiA3MiA2OSA3NCAgNzkgMzEgMTEgMzAgMGYgMDYgMDMgNTUgICBBdXRob3JpdHkxLjAuLi5VICAK ICAwMGYwOiAgMDQgMDUgMTMgMDggMzAgMzcgMzkgMzYgIDM5IDMyIDM4IDM3IDMwIDFlIDE3IDBk ICAgLi4uLjA3OTY5Mjg3MC4uLiAgCiAgMDEwMDogIDMxIDMwIDMxIDMxIDMyIDM2IDMxIDM5ICAz MyAzNSAzMSAzNyA1YSAxNyAwZCAzMSAgIDEwMTEyNjE5MzUxN1ouLjEgIAogIDAxMTA6ICAzMSAz MSAzMSAzMiAzNSAzMCAzMSAzMCAgMzEgMzQgMzEgNWEgMzAgNjUgMzEgMWYgICAxMTEyNTAxMDE0 MVowZTEuICAKICAwMTIwOiAgMzAgMWQgMDYgMDMgNTUgMDQgMGEgMTMgIDE2IDRjIDQyIDUzIDQ0 IDMyIDJlIDczICAgMC4uLlUuLi4uTEJTRDIucyAgCiAgMDEzMDogIDc1IDZkIDZkIDY5IDc0IDZl IDZhIDY4ICA2ZiA2ZCA2NSAyZSA2MyA2ZiA2ZCAzMSAgIHVtbWl0bmpob21lLmNvbTEgIAogIDAx NDA6ICAyMSAzMCAxZiAwNiAwMyA1NSAwNCAwYiAgMTMgMTggNDQgNmYgNmQgNjEgNjkgNmUgICAh MC4uLlUuLi4uRG9tYWluICAKICAwMTUwOiAgMjAgNDMgNmYgNmUgNzQgNzIgNmYgNmMgIDIwIDU2 IDYxIDZjIDY5IDY0IDYxIDc0ICAgIENvbnRyb2wgVmFsaWRhdCAgCiAgMDE2MDogIDY1IDY0IDMx IDFmIDMwIDFkIDA2IDAzICA1NSAwNCAwMyAxMyAxNiA0YyA0MiA1MyAgIGVkMS4wLi4uVS4uLi5M QlMgIAogIDAxNzA6ICA0NCAzMiAyZSA3MyA3NSA2ZCA2ZCA2OSAgNzQgNmUgNmEgNjggNmYgNmQg NjUgMmUgICBEMi5zdW1taXRuamhvbWUuICAKICAwMTgwOiAgNjMgNmYgNmQgMzAgODIgMDIgMjIg MzAgIDBkIDA2IDA5IDJhIDg2IDQ4IDg2IGY3ICAgY29tMC4uIjAuLi4qLkguLiAgCiAgMDE5MDog IDBkIDAxIDAxIDAxIDA1IDAwIDAzIDgyICAwMiAwZiAwMCAzMCA4MiAwMiAwYSAwMiAgIC4uLi4u Li4uLi4uMC4uLi4gIAogIDAxYTA6ICA4MiAwMiAwMSAwMCBkMyBmNSBjZSA3YSAgODMgMzcgNjcg ZjEgODcgZWQgNjEgMjUgICAuLi4uLi4uei43Zy4uLmElICAKICAwMWIwOiAgMDggNTIgNmUgYTIg ODkgMTEgOTIgOTUgIDk0IDU1IDM3IDI2IDdiIDFiIDM2IGYwICAgLlJuLi4uLi4uVTcmey42LiAg CiAgMDFjMDogIDk2IGQ4IDc3IDY2IGIzIGZlIGQxIDNkICBkYyBkOCAyYyBkZiBiNiAwNCAyYiAy YSAgIC4ud2YuLi49Li4sLi4uKyogIAogIDAxZDA6ICA1NSBjZSA0NiAyOSA1YiAxMCA2NiBjOSAg ODggYWEgMTQgOWMgZGIgNzUgZGQgZDIgICBVLkYpWy5mLi4uLi4udS4uICAKICAwMWUwOiAgMDgg MjggOWYgY2UgZjUgYjMgYmIgYmMgIDg3IGEwIDJmIDgyIDM0IDE4IDQ0IGQyICAgLiguLi4uLi4u Li8uNC5ELiAgCiAgMDFmMDogIGI5IDQ5IGZkIDgxIGUxIGYyIDk2IGMyICAzMiA0ZiA3NCA2MSBj OCBhZSBjYSAwNCAgIC5JLi4uLi4uMk90YS4uLi4gIAogIDAyMDA6ICA2MCA1ZiA5NyAwMiAwNCBi YyBlZSAyZCAgODEgNTMgOWMgODIgNjYgNzcgNWMgYWUgICBgXy4uLi4uLS5TLi5md1wuICAKICAw MjEwOiAgM2QgMTggYzMgNDIgOTggM2UgMGQgNDIgIDk3IDg0IDY4IDlmIGVhIDNmIGZjIDk5ICAg PS4uQi4+LkIuLmguLj8uLiAgCiAgMDIyMDogIDdhIGI0IDY4IDVmIGZhIDBlIDk5IGE3ICA3NiBh NSA1YyBjNSBhOSA0ZiA0ZiBiNSAgIHouaF8uLi4udi5cLi5PTy4gIAogIDAyMzA6ICA4OCA2NCBi MiBmMCBlMyAzNyAyMSBjMCAgODMgYzEgMmIgYjUgYmEgOTAgNjggNjMgICAuZC4uLjchLi4uKy4u LmhjICAKICAwMjQwOiAgYzQgOWIgZmUgOGQgY2UgN2QgZGEgZDQgIGY4IGUxIDU1IDBiIDI1IDE0 IDI0IDEwICAgLi4uLi59Li4uLlUuJS4kLiAgCiAgMDI1MDogIGZjIDE2IDUwIGVjIDNkIGI1IDFm IGQ4ICA0YSBjNyAxMiAzZiAzMiAwZCA5MSBjMCAgIC4uUC49Li4uSi4uPzIuLi4gIAogIDAyNjA6 ICBhZSBhZSBhMCAxNyBkNSA4OSAzYyA4MSAgM2YgZDAgMzEgZTEgYzcgODYgNzggOTAgICAuLi4u Li48Lj8uMS4uLnguICAKICAwMjcwOiAgY2EgODAgODIgMDMgODAgYmIgZGMgMWIgIGZhIDYwIDVj IDU1IGEzIDQxIGU1IDUwICAgLi4uLi4uLi4uYFxVLkEuUCAgCiAgMDI4MDogIDEwIGI1IGMwIDgw IDA4IDJmIDFlIDYwICBmZSA4YSA3ZiA1YSA1MyA5YyA4YiA0OCAgIC4uLi4uLy5gLi4uWlMuLkgg IAogIDAyOTA6ICBmNiBmNiBiZSA0MSBkYSA3OCBiZiA3ZCAgOTcgODcgNzUgMDUgNTMgY2IgYmQg NTMgICAuLi5BLngufS4udS5TLi5TICAKICAwMmEwOiAgYWQgOWMgMTIgZGIgYWIgZDggOTEgMzEg IDhhIDU4IDkzIGNjIDY0IDgwIDZmIDNjICAgLi4uLi4uLjEuWC4uZC5vPCAgCiAgMDJiMDogIDBh IGExIDc0IDllIDM0IDkxIDY1IGM3ICA1ZiBlMyA2MSBhNiA3YSBjZCA3YSBhYiAgIC4udC40LmUu Xy5hLnouei4gIAogIDAyYzA6ICBmNSBmNCBkNiA0YyA0MCBmMiBmMCA0NSAgMzMgODkgMzYgNTkg MzMgNTQgZmMgNWMgICAuLi5MQC4uRTMuNlkzVC5cICAKICAwMmQwOiAgMjggYjIgNzggMTkgMTcg YWMgZjIgZDEgIDkzIDRiIGI3IDJjIGY2IDk1IGM3IDg2ICAgKC54Li4uLi4uSy4sLi4uLiAgCiAg MDJlMDogIDQ0IDRiIGNmIDhmIGJkIDZjIDk5IDFjICAwZSA5NCBhNyAwMCA0NiBhZiA4NiBlNyAg IERLLi4ubC4uLi4uLkYuLi4gIAogIDAyZjA6ICA5NSA4MyA4MyA3NyA0YyA4MCBiMSBjNiAgZjAg MGUgODEgMmEgMDIgMTIgOTggMTIgICAuLi53TC4uLi4uLiouLi4uICAKICAwMzAwOiAgZmYgZjUg M2YgMTcgZTAgYzEgYjIgODQgIDdiIDUzIDdlIDhlIGY5IDUzIDczIDhhICAgLi4/Li4uLi57U34u LlNzLiAgCiAgMDMxMDogIGRlIGYyIDE5IDY1IGI3IGZlIDU2IDQ1ICBkMCAwNSBhMiAwMyAwNCA4 NCAxMSAyZCAgIC4uLmUuLlZFLi4uLi4uLi0gIAogIDAzMjA6ICAwZCAwYiA1ZiA1MiAzNCBjMSAy MiA0YSAgNDAgYzIgZTcgZDEgYjcgOTUgY2MgYTcgICAuLl9SNC4iSkAuLi4uLi4uICAKICAwMzMw OiAgNTkgMzggY2YgMGYgNzkgZDEgYWQgMTQgIDE0IDY1IGMxIDI3IDYwIDM2IGI4IDg0ICAgWTgu LnkuLi4uZS4nYDYuLiAgCiAgMDM0MDogIGU4IDM3IDk2IGVhIGNkIDYxIDhlIDlhICA3MSBiMCBj MCAyYyA2OCBlMyBhNyBiNCAgIC43Li4uYS4ucS4uLGguLi4gIAogIDAzNTA6ICAwYiA3YSBjYyA3 MSA0NCA2NSAxNCBhYyAgOWQgYmMgNTQgZjYgMDEgOGUgMTYgNjEgICAuei5xRGUuLi4uVC4uLi5h ICAKICAwMzYwOiAgZmIgODggYWIgYWUgZjcgODAgY2MgMWYgIDQwIDg3IGFiIDVlIDliIGQ4IGQ2 IDM3ICAgLi4uLi4uLi5ALi5eLi4uNyAgCiAgMDM3MDogIDNhIGM1IDJmIDViIDVmIDgwIGNmIDYy ICBiNiA5MyA4MCA1ZiA3YiA1ZiBlZiA2ZCAgIDouL1tfLi5iLi4uX3tfLm0gIAogIDAzODA6ICBj YiA4ZSBlZiA2NyBjOSBjMiA3OCAzNyAgYmIgM2UgYjAgZWUgYTMgMDcgOGEgYWIgICAuLi5nLi54 Ny4+Li4uLi4uICAKICAwMzkwOiAgYjcgMDIgNzYgYjYgYTAgMTggN2QgMzcgIGNjIDU0IDQ0IGU0 IGU1IGFkIDNlIGYwICAgLi52Li4ufTcuVEQuLi4+LiAgCiAgMDNhMDogIDk3IDM0IDc2IGM3IDAy IDAzIDAxIDAwICAwMSBhMyA4MiAwMSBjYSAzMCA4MiAwMSAgIC40di4uLi4uLi4uLi4wLi4gIAog IDAzYjA6ICBjNiAzMCAwZiAwNiAwMyA1NSAxZCAxMyAgMDEgMDEgZmYgMDQgMDUgMzAgMDMgMDEg ICAuMC4uLlUuLi4uLi4uMC4uICAKICAwM2MwOiAgMDEgMDAgMzAgMWQgMDYgMDMgNTUgMWQgIDI1 IDA0IDE2IDMwIDE0IDA2IDA4IDJiICAgLi4wLi4uVS4lLi4wLi4uKyAgCiAgMDNkMDogIDA2IDAx IDA1IDA1IDA3IDAzIDAxIDA2ICAwOCAyYiAwNiAwMSAwNSAwNSAwNyAwMyAgIC4uLi4uLi4uLisu Li4uLi4gIAogIDAzZTA6ICAwMiAzMCAwZSAwNiAwMyA1NSAxZCAwZiAgMDEgMDEgZmYgMDQgMDQg MDMgMDIgMDUgICAuMC4uLlUuLi4uLi4uLi4uICAKICAwM2YwOiAgYTAgMzAgMzMgMDYgMDMgNTUg MWQgMWYgIDA0IDJjIDMwIDJhIDMwIDI4IGEwIDI2ICAgLjAzLi5VLi4uLDAqMCguJiAgCiAgMDQw MDogIGEwIDI0IDg2IDIyIDY4IDc0IDc0IDcwICAzYSAyZiAyZiA2MyA3MiA2YyAyZSA2NyAgIC4k LiJodHRwOi8vY3JsLmcgIAogIDA0MTA6ICA2ZiA2NCA2MSA2NCA2NCA3OSAyZSA2MyAgNmYgNmQg MmYgNjcgNjQgNzMgMzEgMmQgICBvZGFkZHkuY29tL2dkczEtICAKICAwNDIwOiAgMzIgMzYgMmUg NjMgNzIgNmMgMzAgNGQgIDA2IDAzIDU1IDFkIDIwIDA0IDQ2IDMwICAgMjYuY3JsME0uLlUuIC5G MCAgCiAgMDQzMDogIDQ0IDMwIDQyIDA2IDBiIDYwIDg2IDQ4ICAwMSA4NiBmZCA2ZCAwMSAwNyAx NyAwMSAgIEQwQi4uYC5ILi4ubS4uLi4gIAogIDA0NDA6ICAzMCAzMyAzMCAzMSAwNiAwOCAyYiAw NiAgMDEgMDUgMDUgMDcgMDIgMDEgMTYgMjUgICAwMzAxLi4rLi4uLi4uLi4lICAKICAwNDUwOiAg NjggNzQgNzQgNzAgNzMgM2EgMmYgMmYgIDYzIDY1IDcyIDc0IDczIDJlIDY3IDZmICAgaHR0cHM6 Ly9jZXJ0cy5nbyAgCiAgMDQ2MDogIDY0IDYxIDY0IDY0IDc5IDJlIDYzIDZmICA2ZCAyZiA3MiA2 NSA3MCA2ZiA3MyA2OSAgIGRhZGR5LmNvbS9yZXBvc2kgIAogIDA0NzA6ICA3NCA2ZiA3MiA3OSAy ZiAzMCA4MSA4MCAgMDYgMDggMmIgMDYgMDEgMDUgMDUgMDcgICB0b3J5LzAuLi4uKy4uLi4uICAK ICAwNDgwOiAgMDEgMDEgMDQgNzQgMzAgNzIgMzAgMjQgIDA2IDA4IDJiIDA2IDAxIDA1IDA1IDA3 ICAgLi4udDByMCQuLisuLi4uLiAgCiAgMDQ5MDogIDMwIDAxIDg2IDE4IDY4IDc0IDc0IDcwICAz YSAyZiAyZiA2ZiA2MyA3MyA3MCAyZSAgIDAuLi5odHRwOi8vb2NzcC4gIAogIDA0YTA6ICA2NyA2 ZiA2NCA2MSA2NCA2NCA3OSAyZSAgNjMgNmYgNmQgMmYgMzAgNGEgMDYgMDggICBnb2RhZGR5LmNv bS8wSi4uICAKICAwNGIwOiAgMmIgMDYgMDEgMDUgMDUgMDcgMzAgMDIgIDg2IDNlIDY4IDc0IDc0 IDcwIDNhIDJmICAgKy4uLi4uMC4uPmh0dHA6LyAgCiAgMDRjMDogIDJmIDYzIDY1IDcyIDc0IDY5 IDY2IDY5ICA2MyA2MSA3NCA2NSA3MyAyZSA2NyA2ZiAgIC9jZXJ0aWZpY2F0ZXMuZ28gIAogIDA0 ZDA6ICA2NCA2MSA2NCA2NCA3OSAyZSA2MyA2ZiAgNmQgMmYgNzIgNjUgNzAgNmYgNzMgNjkgICBk YWRkeS5jb20vcmVwb3NpICAKICAwNGUwOiAgNzQgNmYgNzIgNzkgMmYgNjcgNjQgNWYgIDY5IDZl IDc0IDY1IDcyIDZkIDY1IDY0ICAgdG9yeS9nZF9pbnRlcm1lZCAgCiAgMDRmMDogIDY5IDYxIDc0 IDY1IDJlIDYzIDcyIDc0ICAzMCAxZiAwNiAwMyA1NSAxZCAyMyAwNCAgIGlhdGUuY3J0MC4uLlUu Iy4gIAogIDA1MDA6ICAxOCAzMCAxNiA4MCAxNCBmZCBhYyA2MSAgMzIgOTMgNmMgNDUgZDYgZTIg ZWUgODUgICAuMC4uLi4uYTIubEUuLi4uICAKICAwNTEwOiAgNWYgOWEgYmEgZTcgNzYgOTkgNjgg Y2MgIGU3IDMwIDNkIDA2IDAzIDU1IDFkIDExICAgXy4uLnYuaC4uMD0uLlUuLiAgCiAgMDUyMDog IDA0IDM2IDMwIDM0IDgyIDE2IDRjIDQyICA1MyA0NCAzMiAyZSA3MyA3NSA2ZCA2ZCAgIC42MDQu LkxCU0QyLnN1bW0gIAogIDA1MzA6ICA2OSA3NCA2ZSA2YSA2OCA2ZiA2ZCA2NSAgMmUgNjMgNmYg NmQgODIgMWEgNzcgNzcgICBpdG5qaG9tZS5jb20uLnd3ICAKICAwNTQwOiAgNzcgMmUgNGMgNDIg NTMgNDQgMzIgMmUgIDczIDc1IDZkIDZkIDY5IDc0IDZlIDZhICAgdy5MQlNEMi5zdW1taXRuaiAg CiAgMDU1MDogIDY4IDZmIDZkIDY1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGhvbWUgICAgICAgICAgICAgIAp0bHNfcmVhZDogd2FudD0zMTEsIGdvdD0zMTEKICAwMDAw OiAgMmUgNjMgNmYgNmQgMzAgMWQgMDYgMDMgIDU1IDFkIDBlIDA0IDE2IDA0IDE0IGY0ICAgLmNv bTAuLi5VLi4uLi4uLiAgCiAgMDAxMDogIDUzIDZkIDAxIDY5IDI5IDg2IDY5IGZjICBlZSA0ZSBk NSA5NCAwYyA5YSAwZSAyYyAgIFNtLmkpLmkuLk4uLi4uLiwgIAogIDAwMjA6ICAwMCA3NiAzMiAz MCAwZCAwNiAwOSAyYSAgODYgNDggODYgZjcgMGQgMDEgMDEgMDUgICAudjIwLi4uKi5ILi4uLi4u ICAKICAwMDMwOiAgMDUgMDAgMDMgODIgMDEgMDEgMDAgYTggIGUzIDFjIGVhIDUzIDg2IDQxIDcw IDYzICAgLi4uLi4uLi4uLi5TLkFwYyAgCiAgMDA0MDogIDQ1IDkzIDQ1IGUyIGZjIDYwIDZiIDQ2 ICBlMyBjOSBhNSA1MiBkMyA3OCBkMCBkYSAgIEUuRS4uYGtGLi4uUi54Li4gIAogIDAwNTA6ICAw OCBiMyAyYSA5NyBlZiA3NiBlNCAwYSAgNTYgZjEgOGUgZTUgNTYgOTIgMzUgMDQgICAuLiouLnYu LlYuLi5WLjUuICAKICAwMDYwOiAgY2IgN2IgZDggYzkgMDEgYmYgYjQgYjkgIDdkIDFhIGNmIDYx IDY4IGIwIDgwIDVlICAgLnsuLi4uLi59Li5haC4uXiAgCiAgMDA3MDogIDU0IGY0IDMwIGYzIGU1 IDFhIDI2IDIyICBhOSBjMyA3MiA2NCBiNiBiOSAyYyA2ZiAgIFQuMC4uLiYiLi5yZC4uLG8gIAog IDAwODA6ICAxYyA1NSAxNiAxNCBmZSBlYiA3MSBkOSAgNjkgYWUgNmYgODkgNWIgN2QgMzMgMjQg ICAuVS4uLi5xLmkuby5bfTMkICAKICAwMDkwOiAgMzMgYTMgMzMgNTQgNjMgZTAgNzkgYzUgIGJi IGM1IDk0IGE2IDJkIDBiIDRlIGY4ICAgMy4zVGMueS4uLi4uLS5OLiAgCiAgMDBhMDogIDJjIGU5 IGIwIDU5IGIzIGIzIGI0IDE4ICBjNyA2ZCBmZiAxMyBjMyA1YSAzZSAwZSAgICwuLlkuLi4uLm0u Li5aPi4gIAogIDAwYjA6ICAwZSAzNCA2YiA0MCA3MyA2ZCBiZiBlNiAgOWMgNzAgMzAgOTUgN2Ig ZTIgYWMgNmQgICAuNGtAc20uLi5wMC57Li5tICAKICAwMGMwOiAgYzggNTggOTIgZTQgY2EgMjYg YmUgNjUgIGE3IGRiIDYxIGIzIDQxIDhmIDBlIGM5ICAgLlguLi4mLmUuLmEuQS4uLiAgCiAgMDBk MDogIDVkIDBhIGM4IDhkIDVkIDNhIDFiIGIxICA1ZSBlOSAwYSAzZiBkOCBhOSA1OCBhYiAgIF0u Li5dOi4uXi4uPy4uWC4gIAogIDAwZTA6ICBhZiA2NSA0MSBhYSBkNyA0NyA0NyAzNCAgOTYgZjIg MTMgNmQgYTMgZGIgOWQgZTIgICAuZUEuLkdHNC4uLm0uLi4uICAKICAwMGYwOiAgNzIgOTYgZDMg ODcgMzQgMjUgOTIgZWIgIDk2IDM4IDVmIDdjIGY4IDJkIGUxIGU0ICAgci4uLjQlLi4uOF98Li0u LiAgCiAgMDEwMDogIDI2IGNlIGYzIGJhIGY0IGZiIDg5IDY1ICAwNiA1MCA4YyAyZSBlZSAyOCBl NCBjNyAgICYuLi4uLi5lLlAuLi4oLi4gIAogIDAxMTA6ICBlMyAyYSBiMSA1MCA0NCBiOCA5MSBl ZCAgZjUgYzQgNWYgOWMgZGQgYzYgNTUgZjcgICAuKi5QRC4uLi4uXy4uLlUuICAKICAwMTIwOiAg MGYgN2YgZTUgNWQgZjIgYWUgMTAgZWYgIGY0IGVmIGM1IDM4IGU3IGM3IGRjIDg1ICAgLi4uXS4u Li4uLi44Li4uLiAgCiAgMDEzMDogIDFlIDAxIGEzIDFiIGY2IGQ0IGY2ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIC4uLi4uLi4gICAgICAgICAgIApUTFMgY2VydGlmaWNhdGUgdmVyaWZp Y2F0aW9uOiBkZXB0aDogMCwgZXJyOiAyMCwgc3ViamVjdDogL089TEJTRDIuc3VtbWl0bmpob21l LmNvbS9PVT1Eb21haW4gQ29udHJvbCBWYWxpZGF0ZWQvQ049TEJTRDIuc3VtbWl0bmpob21lLmNv bSwgaXNzdWVyOiAvQz1VUy9TVD1Bcml6b25hL0w9U2NvdHRzZGFsZS9PPUdvRGFkZHkuY29tLCBJ bmMuL09VPWh0dHA6Ly9jZXJ0aWZpY2F0ZXMuZ29kYWRkeS5jb20vcmVwb3NpdG9yeS9DTj1HbyBE YWRkeSBTZWN1cmUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkvc2VyaWFsTnVtYmVyPTA3OTY5Mjg3 ClRMUyBjZXJ0aWZpY2F0ZSB2ZXJpZmljYXRpb246IEVycm9yLCB1bmFibGUgdG8gZ2V0IGxvY2Fs IGlzc3VlciBjZXJ0aWZpY2F0ZQp0bHNfd3JpdGU6IHdhbnQ9Nywgd3JpdHRlbj03CiAgMDAwMDog IDE1IDAzIDAxIDAwIDAyIDAyIDMwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC4uLi4u LjAgICAgICAgICAgIApUTFMgdHJhY2U6IFNTTDMgYWxlcnQgd3JpdGU6ZmF0YWw6dW5rbm93biBD QQpUTFMgdHJhY2U6IFNTTF9jb25uZWN0OmVycm9yIGluIFNTTHYzIHJlYWQgc2VydmVyIGNlcnRp ZmljYXRlIEIKVExTIHRyYWNlOiBTU0xfY29ubmVjdDplcnJvciBpbiBTU0x2MyByZWFkIHNlcnZl ciBjZXJ0aWZpY2F0ZSBCClRMUzogY2FuJ3QgY29ubmVjdC4KbGRhcF9wZXJyb3IKbGRhcF9zdGFy dF90bHM6IENvbm5lY3QgZXJyb3IgKC0xMSkKCWFkZGl0aW9uYWwgaW5mbzogZXJyb3I6MTQwOTAw ODY6U1NMIHJvdXRpbmVzOlNTTDNfR0VUX1NFUlZFUl9DRVJUSUZJQ0FURTpjZXJ0aWZpY2F0ZSB2 ZXJpZnkgZmFpbGVkCkVudGVyIExEQVAgUGFzc3dvcmQ6IApsZGFwX3B2dF9zYXNsX2dldG1lY2gK bGRhcF9zZWFyY2gKcHV0X2ZpbHRlcjogIihvYmplY3RjbGFzcz0qKSIKcHV0X2ZpbHRlcjogc2lt cGxlCnB1dF9zaW1wbGVfZmlsdGVyOiAib2JqZWN0Y2xhc3M9KiIKbGRhcF9idWlsZF9zZWFyY2hf cmVxIEFUVFJTOgogICAgc3VwcG9ydGVkU0FTTE1lY2hhbmlzbXMKbGRhcF9zZW5kX2luaXRpYWxf cmVxdWVzdApsZGFwX3NlbmRfc2VydmVyX3JlcXVlc3QKYmVyX3NjYW5mIGZtdCAoe2l0KSBiZXI6 CmJlcl9kdW1wOiBidWY9MHhhMDk5YmM4IHB0cj0weGEwOTliYzggZW5kPTB4YTA5OWMwOCBsZW49 NjQKICAwMDAwOiAgMzAgM2UgMDIgMDEgMDIgNjMgMzkgMDQgIDAwIDBhIDAxIDAwIDBhIDAxIDAw IDAyICAgMD4uLi5jOS4uLi4uLi4uLiAgCiAgMDAxMDogIDAxIDAwIDAyIDAxIDAwIDAxIDAxIDAw ICA4NyAwYiA2ZiA2MiA2YSA2NSA2MyA3NCAgIC4uLi4uLi4uLi5vYmplY3QgIAogIDAwMjA6ICA2 MyA2YyA2MSA3MyA3MyAzMCAxOSAwNCAgMTcgNzMgNzUgNzAgNzAgNmYgNzIgNzQgICBjbGFzczAu Li5zdXBwb3J0ICAKICAwMDMwOiAgNjUgNjQgNTMgNDEgNTMgNGMgNGQgNjUgIDYzIDY4IDYxIDZl IDY5IDczIDZkIDczICAgZWRTQVNMTWVjaGFuaXNtcyAgCmJlcl9zY2FuZiBmbXQgKHspIGJlcjoK YmVyX2R1bXA6IGJ1Zj0weGEwOTliYzggcHRyPTB4YTA5OWJjZCBlbmQ9MHhhMDk5YzA4IGxlbj01 OQogIDAwMDA6ICA2MyAzOSAwNCAwMCAwYSAwMSAwMCAwYSAgMDEgMDAgMDIgMDEgMDAgMDIgMDEg MDAgICBjOS4uLi4uLi4uLi4uLi4uICAKICAwMDEwOiAgMDEgMDEgMDAgODcgMGIgNmYgNjIgNmEg IDY1IDYzIDc0IDYzIDZjIDYxIDczIDczICAgLi4uLi5vYmplY3RjbGFzcyAgCiAgMDAyMDogIDMw IDE5IDA0IDE3IDczIDc1IDcwIDcwICA2ZiA3MiA3NCA2NSA2NCA1MyA0MSA1MyAgIDAuLi5zdXBw b3J0ZWRTQVMgIAogIDAwMzA6ICA0YyA0ZCA2NSA2MyA2OCA2MSA2ZSA2OSAgNzMgNmQgNzMgICAg ICAgICAgICAgICAgICBMTWVjaGFuaXNtcyAgICAgICAKYmVyX2ZsdXNoOiA2NCBieXRlcyB0byBz ZCAzCiAgMDAwMDogIDMwIDNlIDAyIDAxIDAyIDYzIDM5IDA0ICAwMCAwYSAwMSAwMCAwYSAwMSAw MCAwMiAgIDA+Li4uYzkuLi4uLi4uLi4gIAogIDAwMTA6ICAwMSAwMCAwMiAwMSAwMCAwMSAwMSAw MCAgODcgMGIgNmYgNjIgNmEgNjUgNjMgNzQgICAuLi4uLi4uLi4ub2JqZWN0ICAKICAwMDIwOiAg NjMgNmMgNjEgNzMgNzMgMzAgMTkgMDQgIDE3IDczIDc1IDcwIDcwIDZmIDcyIDc0ICAgY2xhc3Mw Li4uc3VwcG9ydCAgCiAgMDAzMDogIDY1IDY0IDUzIDQxIDUzIDRjIDRkIDY1ICA2MyA2OCA2MSA2 ZSA2OSA3MyA2ZCA3MyAgIGVkU0FTTE1lY2hhbmlzbXMgIApsZGFwX3dyaXRlOiB3YW50PTY0LCB3 cml0dGVuPTY0CiAgMDAwMDogIDMwIDNlIDAyIDAxIDAyIDYzIDM5IDA0ICAwMCAwYSAwMSAwMCAw YSAwMSAwMCAwMiAgIDA+Li4uYzkuLi4uLi4uLi4gIAogIDAwMTA6ICAwMSAwMCAwMiAwMSAwMCAw MSAwMSAwMCAgODcgMGIgNmYgNjIgNmEgNjUgNjMgNzQgICAuLi4uLi4uLi4ub2JqZWN0ICAKICAw MDIwOiAgNjMgNmMgNjEgNzMgNzMgMzAgMTkgMDQgIDE3IDczIDc1IDcwIDcwIDZmIDcyIDc0ICAg Y2xhc3MwLi4uc3VwcG9ydCAgCiAgMDAzMDogIDY1IDY0IDUzIDQxIDUzIDRjIDRkIDY1ICA2MyA2 OCA2MSA2ZSA2OSA3MyA2ZCA3MyAgIGVkU0FTTE1lY2hhbmlzbXMgIApsZGFwX3Jlc3VsdCBsZCAw eGEwMjg1MzAgbXNnaWQgMgp3YWl0NG1zZyBsZCAweGEwMjg1MzAgbXNnaWQgMiAoaW5maW5pdGUg dGltZW91dCkKd2FpdDRtc2cgY29udGludWUgbGQgMHhhMDI4NTMwIG1zZ2lkIDIgYWxsIDEKKiog bGQgMHhhMDI4NTMwIENvbm5lY3Rpb25zOgoqIGhvc3Q6IGxkYXAgIHBvcnQ6IDM4OSAgKGRlZmF1 bHQpCiAgcmVmY250OiAyICBzdGF0dXM6IENvbm5lY3RlZAogIGxhc3QgdXNlZDogU3VuIE5vdiAy OCAxMjo0MDowMCAyMDEwCgoqKiBsZCAweGEwMjg1MzAgT3V0c3RhbmRpbmcgUmVxdWVzdHM6CiAq IG1zZ2lkIDIsICBvcmlnaWQgMiwgc3RhdHVzIEluUHJvZ3Jlc3MKICAgb3V0c3RhbmRpbmcgcmVm ZXJyYWxzIDAsIHBhcmVudCBjb3VudCAwCioqIGxkIDB4YTAyODUzMCBSZXNwb25zZSBRdWV1ZToK ICAgRW1wdHkKbGRhcF9jaGtSZXNwb25zZUxpc3QgbGQgMHhhMDI4NTMwIG1zZ2lkIDIgYWxsIDEK bGRhcF9jaGtSZXNwb25zZUxpc3QgcmV0dXJucyBsZCAweGEwMjg1MzAgTlVMTApsZGFwX2ludF9z ZWxlY3QKcmVhZDFtc2c6IGxkIDB4YTAyODUzMCBtc2dpZCAyIGFsbCAxCmJlcl9nZXRfbmV4dAps ZGFwX3JlYWQ6IHdhbnQ9OCwgZ290PTgKICAwMDAwOiAgMTYgMDMgMDEgMDAgMDQgMGUgMDAgMDAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uLi4uLi4gICAgICAgICAgCmJlcl9nZXRfbmV4 dCBmYWlsZWQuCmxkYXBfcGVycm9yCmxkYXBfc2FzbF9pbnRlcmFjdGl2ZV9iaW5kX3M6IENhbid0 IGNvbnRhY3QgTERBUCBzZXJ2ZXIgKC0xKQoJYWRkaXRpb25hbCBpbmZvOiBlcnJvcjoxNDA5MDA4 NjpTU0wgcm91dGluZXM6U1NMM19HRVRfU0VSVkVSX0NFUlRJRklDQVRFOmNlcnRpZmljYXRlIHZl cmlmeSBmYWlsZWQKCg== --0016e6d58cfc0d6adc0496209cb6--