From ianh at brownpapertickets.com Sun Jul 30 16:53:44 2017
Content-Type: multipart/mixed; boundary="===============8172539176512698099=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Failed Upgrade?
Date: Sun, 30 Jul 2017 09:53:02 -0700
Message-ID: <90eeb6d6-2e9c-ba97-ce21-38d62aa88e9c@brownpapertickets.com>
--===============8172539176512698099==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
I had an unexpected restart of an IPA server that had apparently had
updates run but had not been restarted. ipactl says pki-tomcatd would
not start.
Strangely, the actual service appears to be running:
[root(a)seattlenfs slapd-BPT-ROCKS]# systemctl status
pki-tomcatd(a)pki-tomcat.service
=E2=97=8F pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat
Loaded: loaded (/lib/systemd/system/pki-tomcatd(a).service; enabled;
vendor preset: disabled)
Active: active (running) since Fri 2017-07-28 11:03:34 PDT; 36min ago
Process: 14289 ExecStartPre=3D/usr/bin/pkidaemon start %i (code=3Dexited,
status=3D0/SUCCESS)
Main PID: 14406 (java)
CGroup:
/system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service
=E2=94=94=E2=94=8014406 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
-DRESTEASY_LIB=3D/usr/share/java/resteasy-base
-Djava.library.path=3D/usr/lib64/nuxwdog-jni -classpath /usr/...
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: Jul 28, 2017
11:39:50 AM org.apache.catalina.core.ContainerBase backgroundProcess
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: WARNING: Exception
processing realm com.netscape.cms.tomcat.ProxyRealm(a)67cf2df background
process
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]:
javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java=
:1357)
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.process=
Children(ContainerBase.java:1543)
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.process=
Children(ContainerBase.java:1553)
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.process=
Children(ContainerBase.java:1553)
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(Con=
tainerBase.java:1521)
Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
java.lang.Thread.run(Thread.java:748)
However, the /var/log/ipaupgrade.log is full of trouble. It ends with:
2017-07-28T17:01:19Z DEBUG The CA status is: check interrupted due to
error: Retrieving CA status failed with status 500
2017-07-28T17:01:19Z DEBUG Waiting for CA to start...
2017-07-28T17:01:20Z DEBUG request POST
http://seattlenfs.bpt.rocks:8080/ca/admin/ca/getStatus
2017-07-28T17:01:20Z DEBUG request body ''
2017-07-28T17:01:20Z DEBUG response status 500
2017-07-28T17:01:20Z DEBUG response headers {'content-length': '2208',
'content-language': 'en', 'server': 'Apache-Coyote/1.1', 'connection':
'close', 'date': 'Fri, 28 Jul 2017 17:01:20 GMT', 'content-type':
'text/html;charset=3Dutf-8'}
2017-07-28T17:01:20Z DEBUG response body 'Apache
Tomcat/7.0.69 - Error report
HTTP Status 500 - Subsystem unavailable
type Exception
report
message Subsystem
unavailable
description The server encountered an
internal error that prevented it from fulfilling this
request.
exception
javax.ws.rs.ServiceUnavailableException: Subsystem
unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(P=
roxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.=
invoke(AuthenticatorBase.java:499)\n\torg.apache.catalina.valves.ErrorRepor=
tValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.Acce=
ssLogValve.invoke(AccessLogValve.java:956)\n\torg.apache.catalina.connector=
.CoyoteAdapter.service(CoyoteAdapter.java:436)\n\torg.apache.coyote.http11.=
AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)\n\torg.a=
pache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractPro=
tocol.java:625)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.r=
un(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWork=
er(ThreadPoolExecutor.java:1142)\n\tjava.util.concurrent.ThreadPoolExecutor=
$Worker.run(ThreadPoolExecutor.java:617)\n\torg.apache.tomcat.util.threads.=
TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run=
(Thread.java:745)\n
note
The full stack trace of the root cause is available in the Apache
Tomcat/7.0.69 logs.
Apache
Tomcat/7.0.69
'
2017-07-28T17:01:20Z DEBUG The CA status is: check interrupted due to
error: Retrieving CA status failed with status 500
2017-07-28T17:01:20Z DEBUG Waiting for CA to start...
2017-07-28T17:01:21Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2017-07-28T17:01:21Z DEBUG File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in
execute
return_value =3D self.run()
File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 48, in run
raise admintool.ScriptError(str(e))
2017-07-28T17:01:21Z DEBUG The ipa-server-upgrade command failed,
exception: ScriptError: CA did not start in 300.0s
2017-07-28T17:01:21Z ERROR CA did not start in 300.0s
2017-07-28T17:01:21Z ERROR The ipa-server-upgrade command failed. See
/var/log/ipaupgrade.log for more information
Should I just blindly run ipa-server-upgrade again?
Googling had me look at certificate expirations, they seem to be good.
[root(a)seattlenfs slapd-BPT-ROCKS]# getcert list | grep expires
expires: 2019-05-29 05:54:06 UTC
expires: 2019-05-29 05:53:57 UTC
expires: 2019-05-29 05:53:16 UTC
expires: 2035-07-16 12:51:42 UTC
expires: 2019-05-29 05:53:37 UTC
expires: 2018-08-15 05:20:24 UTC
expires: 2018-08-26 05:01:42 UTC
expires: 2018-08-26 05:01:43 UTC
[root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep ipa-
ipa-admintools.noarch 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-client.x86_64 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-client-common.noarch 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-common.noarch 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-python-compat.noarch 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-server.x86_64 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-server-common.noarch 4.4.0-14.el7.centos.7
@test-centos7-updates
ipa-server-dns.noarch 4.4.0-14.el7.centos.7
@test-centos7-updates
[root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep pki-
pki-base.noarch 10.3.3-19.el7_3
@updates
pki-base-java.noarch 10.3.3-19.el7_3
@updates
pki-ca.noarch 10.3.3-19.el7_3
@updates
pki-kra.noarch 10.3.3-19.el7_3
@updates
pki-server.noarch 10.3.3-19.el7_3
@updates
pki-tools.x86_64 10.3.3-19.el7_3
@updates
[root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep tomcat
tomcat.noarch 7.0.69-12.el7_3
@updates
tomcat-el-2.2-api.noarch 7.0.69-12.el7_3
@updates
tomcat-jsp-2.2-api.noarch 7.0.69-12.el7_3
@updates
tomcat-lib.noarch 7.0.69-12.el7_3
@updates
tomcat-servlet-3.0-api.noarch 7.0.69-12.el7_3
@updates
tomcatjss.noarch 7.1.2-3.el7
@base
[root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep java
java-1.7.0-openjdk.x86_64 1:1.7.0.141-2.6.10.1.el7_3
@test-centos7-updates
java-1.7.0-openjdk-devel.x86_64 1:1.7.0.141-2.6.10.1.el7_3
@test-centos7-updates
java-1.7.0-openjdk-headless.x86_64 1:1.7.0.141-2.6.10.1.el7_3
@test-centos7-updates
java-1.8.0-openjdk.x86_64 1:1.8.0.141-1.b16.el7_3
@updates
java-1.8.0-openjdk-headless.x86_64 1:1.8.0.141-1.b16.el7_3
@updates
javamail.noarch 1.4.6-8.el7
@base
javapackages-tools.noarch 3.4.1-11.el7
@base
javassist.noarch 3.16.1-10.el7
@base
nuxwdog-client-java.x86_64 1.0.3-5.el7
@base
pki-base-java.noarch 10.3.3-19.el7_3
@updates
python-javapackages.noarch 3.4.1-11.el7
@base
tzdata-java.noarch 2017a-1.el7
@test-centos7-updates
Any other useful information I can provide?
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============8172539176512698099==--
From pvoborni at redhat.com Mon Jul 31 07:57:05 2017
Content-Type: multipart/mixed; boundary="===============0577184679072358727=="
MIME-Version: 1.0
From: Petr Vobornik
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Mon, 31 Jul 2017 09:56:17 +0200
Message-ID:
In-Reply-To: 90eeb6d6-2e9c-ba97-ce21-38d62aa88e9c@brownpapertickets.com
--===============0577184679072358727==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On Sun, Jul 30, 2017 at 6:53 PM, Ian Harding via FreeIPA-users
wrote:
> I had an unexpected restart of an IPA server that had apparently had
> updates run but had not been restarted. ipactl says pki-tomcatd would
> not start.
>
> Strangely, the actual service appears to be running:
>
> [root(a)seattlenfs slapd-BPT-ROCKS]# systemctl status
> pki-tomcatd(a)pki-tomcat.service
> =E2=97=8F pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat
> Loaded: loaded (/lib/systemd/system/pki-tomcatd(a).service; enabled;
> vendor preset: disabled)
> Active: active (running) since Fri 2017-07-28 11:03:34 PDT; 36min ago
> Process: 14289 ExecStartPre=3D/usr/bin/pkidaemon start %i (code=3Dexite=
d,
> status=3D0/SUCCESS)
> Main PID: 14406 (java)
> CGroup:
> /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service
> =E2=94=94=E2=94=8014406 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
> -DRESTEASY_LIB=3D/usr/share/java/resteasy-base
> -Djava.library.path=3D/usr/lib64/nuxwdog-jni -classpath /usr/...
>
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: Jul 28, 2017
> 11:39:50 AM org.apache.catalina.core.ContainerBase backgroundProcess
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: WARNING: Exception
> processing realm com.netscape.cms.tomcat.ProxyRealm(a)67cf2df background
> process
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]:
> javax.ws.rs.ServiceUnavailableException: Subsystem unavailable
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137)
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.ja=
va:1357)
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.proce=
ssChildren(ContainerBase.java:1543)
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.proce=
ssChildren(ContainerBase.java:1553)
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.proce=
ssChildren(ContainerBase.java:1553)
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(C=
ontainerBase.java:1521)
> Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at
> java.lang.Thread.run(Thread.java:748)
>
> However, the /var/log/ipaupgrade.log is full of trouble. It ends with:
>
> 2017-07-28T17:01:19Z DEBUG The CA status is: check interrupted due to
> error: Retrieving CA status failed with status 500
> 2017-07-28T17:01:19Z DEBUG Waiting for CA to start...
> 2017-07-28T17:01:20Z DEBUG request POST
> http://seattlenfs.bpt.rocks:8080/ca/admin/ca/getStatus
> 2017-07-28T17:01:20Z DEBUG request body ''
> 2017-07-28T17:01:20Z DEBUG response status 500
> 2017-07-28T17:01:20Z DEBUG response headers {'content-length': '2208',
> 'content-language': 'en', 'server': 'Apache-Coyote/1.1', 'connection':
> 'close', 'date': 'Fri, 28 Jul 2017 17:01:20 GMT', 'content-type':
> 'text/html;charset=3Dutf-8'}
> 2017-07-28T17:01:20Z DEBUG response body 'Apache
> Tomcat/7.0.69 - Error report
> HTTP Status 500 - Subsystem unavailable
size=3D"1" noshade=3D"noshade">type Exception
> report
message Subsystem
> unavailable
description The server encountered an
> internal error that prevented it from fulfilling this
> request.
exception
>
javax.ws.rs.ServiceUnavailableException: Subsystem
> unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints=
(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBas=
e.invoke(AuthenticatorBase.java:499)\n\torg.apache.catalina.valves.ErrorRep=
ortValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.Ac=
cessLogValve.invoke(AccessLogValve.java:956)\n\torg.apache.catalina.connect=
or.CoyoteAdapter.service(CoyoteAdapter.java:436)\n\torg.apache.coyote.http1=
1.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)\n\torg=
.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractP=
rotocol.java:625)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor=
.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWo=
rker(ThreadPoolExecutor.java:1142)\n\tjava.util.concurrent.ThreadPoolExecut=
or$Worker.run(ThreadPoolExecutor.java:617)\n\torg.apache.tomcat.util.thread=
s.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.r=
un(Thread.java:745)\n
note
> The full stack trace of the root cause is available in the Apache
> Tomcat/7.0.69 logs.
Apache
> Tomcat/7.0.69
'
> 2017-07-28T17:01:20Z DEBUG The CA status is: check interrupted due to
> error: Retrieving CA status failed with status 500
> 2017-07-28T17:01:20Z DEBUG Waiting for CA to start...
> 2017-07-28T17:01:21Z ERROR IPA server upgrade failed: Inspect
> /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
> 2017-07-28T17:01:21Z DEBUG File
> "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in
> execute
> return_value =3D self.run()
> File
> "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py=
",
> line 48, in run
> raise admintool.ScriptError(str(e))
>
> 2017-07-28T17:01:21Z DEBUG The ipa-server-upgrade command failed,
> exception: ScriptError: CA did not start in 300.0s
> 2017-07-28T17:01:21Z ERROR CA did not start in 300.0s
> 2017-07-28T17:01:21Z ERROR The ipa-server-upgrade command failed. See
> /var/log/ipaupgrade.log for more information
>
>
> Should I just blindly run ipa-server-upgrade again?
>
> Googling had me look at certificate expirations, they seem to be good.
>
> [root(a)seattlenfs slapd-BPT-ROCKS]# getcert list | grep expires
> expires: 2019-05-29 05:54:06 UTC
> expires: 2019-05-29 05:53:57 UTC
> expires: 2019-05-29 05:53:16 UTC
> expires: 2035-07-16 12:51:42 UTC
> expires: 2019-05-29 05:53:37 UTC
> expires: 2018-08-15 05:20:24 UTC
> expires: 2018-08-26 05:01:42 UTC
> expires: 2018-08-26 05:01:43 UTC
>
> [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep ipa-
> ipa-admintools.noarch 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-client.x86_64 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-client-common.noarch 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-common.noarch 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-python-compat.noarch 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-server.x86_64 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-server-common.noarch 4.4.0-14.el7.centos.7
> @test-centos7-updates
> ipa-server-dns.noarch 4.4.0-14.el7.centos.7
> @test-centos7-updates
>
> [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep pki-
> pki-base.noarch 10.3.3-19.el7_3
> @updates
> pki-base-java.noarch 10.3.3-19.el7_3
> @updates
> pki-ca.noarch 10.3.3-19.el7_3
> @updates
> pki-kra.noarch 10.3.3-19.el7_3
> @updates
> pki-server.noarch 10.3.3-19.el7_3
> @updates
> pki-tools.x86_64 10.3.3-19.el7_3
> @updates
>
> [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep tomcat
> tomcat.noarch 7.0.69-12.el7_3
> @updates
> tomcat-el-2.2-api.noarch 7.0.69-12.el7_3
> @updates
> tomcat-jsp-2.2-api.noarch 7.0.69-12.el7_3
> @updates
> tomcat-lib.noarch 7.0.69-12.el7_3
> @updates
> tomcat-servlet-3.0-api.noarch 7.0.69-12.el7_3
> @updates
> tomcatjss.noarch 7.1.2-3.el7
> @base
>
> [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep java
> java-1.7.0-openjdk.x86_64 1:1.7.0.141-2.6.10.1.el7_3
> @test-centos7-updates
> java-1.7.0-openjdk-devel.x86_64 1:1.7.0.141-2.6.10.1.el7_3
> @test-centos7-updates
> java-1.7.0-openjdk-headless.x86_64 1:1.7.0.141-2.6.10.1.el7_3
> @test-centos7-updates
> java-1.8.0-openjdk.x86_64 1:1.8.0.141-1.b16.el7_3
> @updates
> java-1.8.0-openjdk-headless.x86_64 1:1.8.0.141-1.b16.el7_3
> @updates
> javamail.noarch 1.4.6-8.el7
> @base
> javapackages-tools.noarch 3.4.1-11.el7
> @base
> javassist.noarch 3.16.1-10.el7
> @base
> nuxwdog-client-java.x86_64 1.0.3-5.el7
> @base
> pki-base-java.noarch 10.3.3-19.el7_3
> @updates
> python-javapackages.noarch 3.4.1-11.el7
> @base
> tzdata-java.noarch 2017a-1.el7
> @test-centos7-updates
>
> Any other useful information I can provide?
There is a good page for reporting issues:
https://www.freeipa.org/page/Files_to_be_attached_to_bug_report#Dogtag_CA_f=
ailed
In your case, Dogtag CA did to start so the relevant section is:
ausearch -m AVC > avc.log
journalctl -u pki-tomcatd(a)pki-tomcat.service
/var/log/pki/pki-tomcat/ca/debug <---- usually most important
additionally:
/var/log/pki/pki-tomcat/ca/selftests.log
only in install:
/var/log/pki/pki-ca-spawn..log
-- =
Petr Vobornik
--===============0577184679072358727==--
From rcritten at redhat.com Mon Jul 31 18:35:41 2017
Content-Type: multipart/mixed; boundary="===============8737302312525971382=="
MIME-Version: 1.0
From: Rob Crittenden
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Mon, 31 Jul 2017 14:34:50 -0400
Message-ID: <97c7a0eb-e7ec-9026-f804-21381dee6f17@redhat.com>
In-Reply-To: 90eeb6d6-2e9c-ba97-ce21-38d62aa88e9c@brownpapertickets.com
--===============8737302312525971382==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Ian Harding via FreeIPA-users wrote:
> I had an unexpected restart of an IPA server that had apparently had
> updates run but had not been restarted. ipactl says pki-tomcatd would
> not start.
> =
> Strangely, the actual service appears to be running:
> =
dogtag is an application within tomcat so tomcat can run without dogtag
running.
We need to see more of the dogtag debug log to see what is going on.
I don't think re-running the upgrade command would help.
rob
--===============8737302312525971382==--
From ianh at brownpapertickets.com Mon Jul 31 23:46:33 2017
Content-Type: multipart/mixed; boundary="===============2211228541388510137=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Mon, 31 Jul 2017 16:32:22 -0700
Message-ID: <4a914ba4-b129-0c0d-beff-c0f81e19bf99@brownpapertickets.com>
In-Reply-To: 97c7a0eb-e7ec-9026-f804-21381dee6f17@redhat.com
--===============2211228541388510137==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 07/31/2017 11:34 AM, Rob Crittenden wrote:
> Ian Harding via FreeIPA-users wrote:
>> I had an unexpected restart of an IPA server that had apparently had
>> updates run but had not been restarted. ipactl says pki-tomcatd would
>> not start.
>>
>> Strangely, the actual service appears to be running:
>>
> =
> dogtag is an application within tomcat so tomcat can run without dogtag
> running.
> =
> We need to see more of the dogtag debug log to see what is going on.
> =
It looks like an authentication problem...
[28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
Error netscape.ldap.LDAPException: Authentication failed (49)
at =
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java=
:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at =
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1=
142)
at =
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:=
617)
at java.lang.Thread.run(Thread.java:745)
Internal Database Error encountered: Could not connect to LDAP server =
host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
Authentication failed (49)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
at =
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at =
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6=
2)
at =
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp=
l.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
75)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
24)
at =
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1=
270)
at =
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1=
195)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
at =
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java=
:5318)
at =
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java=
:5610)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
at =
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:=
899)
at =
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:156)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at =
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at =
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java=
:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at =
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1=
142)
at =
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:=
617)
at java.lang.Thread.run(Thread.java:745)
[28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown()
[28/Jul/2017:10:08:46][localhost-startStop-1]: =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUBSY=
STEM =
INITIALIZED =3D=3D=3D=3D=3D=3D=3D
[28/Jul/2017:10:08:46][localhost-startStop-1]: =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at =
autoShutdown? false
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init id=3Dde=
bug
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized debug
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initSubsystem =
id=3Dlog
[28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to init =
id=3Dlog
[28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
[28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
[28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
autoShutdown? false
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3Dlog
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized log
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem =
id=3Djss
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init =
id=3Djss
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
autoShutdown? false
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3Djss
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized jss
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem =
id=3Ddbs
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init =
id=3Ddbs
[28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() =
mEnableSerialMgmt=3Dtrue
[28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
LdapBoundConnFactor(DBSubsystem)
[28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: init
[28/Jul/2017:10:08:47][localhost-startStop-1]: =
LdapBoundConnFactory:doCloning true
[28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init()
[28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins
[28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends
[28/Jul/2017:10:08:47][localhost-startStop-1]: init: before =
makeConnection errorIfDown is true
[28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: =
errorIfDown true
[28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true
[28/Jul/2017:10:08:47][localhost-startStop-1]: =
SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
subsystemCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set =
client auth cert nickname subsystemCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: =
SSLClientCertificatSelectionCB: Entering!
[28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
ocspSigningCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
subsystemCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: =
SSLClientCertificateSelectionCB: desired cert found in list: =
subsystemCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: =
SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
[28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
Error netscape.ldap.LDAPException: Authentication failed (49)
at =
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBound=
ConnFactory.java:205)
at =
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor=
y.java:166)
at =
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor=
y.java:130)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
at =
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at =
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6=
2)
at =
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp=
l.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
75)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
24)
at =
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1=
270)
at =
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1=
195)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
at =
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java=
:5318)
at =
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java=
:5610)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
at =
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:=
899)
at =
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:156)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at =
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at =
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java=
:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at =
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1=
142)
at =
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:=
617)
at java.lang.Thread.run(Thread.java:745)
Internal Database Error encountered: Could not connect to LDAP server =
host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
Authentication failed (49)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
at =
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at =
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6=
2)
at =
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp=
l.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
75)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
24)
at =
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1=
270)
at =
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1=
195)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
at =
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java=
:5318)
at =
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java=
:5610)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
at =
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:=
899)
at =
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:156)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:145)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at =
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679)
at =
org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java=
:1966)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at =
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1=
142)
at =
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:=
617)
at java.lang.Thread.run(Thread.java:745)
[28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown()
[28/Jul/2017:10:13:29][localhost-startStop-2]: =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG SUBSY=
STEM =
INITIALIZED =3D=3D=3D=3D=3D=3D=3D
[28/Jul/2017:10:13:29][localhost-startStop-2]: =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
autoShutdown? false
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3Dde=
bug
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized debug
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem =
id=3Dlog
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init =
id=3Dlog
[28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
[28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
[28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
autoShutdown? false
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3Dlog
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized log
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem =
id=3Djss
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init =
id=3Djss
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
autoShutdown? false
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3Djss
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized jss
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem =
id=3Ddbs
[28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init =
id=3Ddbs
[28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() =
mEnableSerialMgmt=3Dtrue
[28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
LdapBoundConnFactor(DBSubsystem)
[28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: init
[28/Jul/2017:10:13:29][localhost-startStop-2]: =
LdapBoundConnFactory:doCloning true
[28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init()
[28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins
[28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends
[28/Jul/2017:10:13:29][localhost-startStop-2]: init: before =
makeConnection errorIfDown is true
[28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: =
errorIfDown true
[28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true
[28/Jul/2017:10:13:29][localhost-startStop-2]: =
SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
subsystemCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set =
client auth cert nickname subsystemCert cert-pki-ca
[28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened
Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
Error netscape.ldap.LDAPException: Authentication failed (49)
at =
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBound=
ConnFactory.java:205)
at =
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor=
y.java:166)
at =
com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor=
y.java:130)
at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
at =
com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114)
at javax.servlet.GenericServlet.init(GenericServlet.java:158)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at =
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6=
2)
at =
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp=
l.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
75)
at =
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1=
24)
at =
org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1=
270)
at =
org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1=
195)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
at =
org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java=
:5318)
at =
org.apache.catalina.core.StandardContext.startInternal(StandardContext.java=
:5610)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
at =
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:=
899)
at =
org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
at =
org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase=
.java:156)
> I don't think re-running the upgrade command would help.
> =
> rob
> =
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============2211228541388510137==--
From flo at redhat.com Tue Aug 1 08:49:04 2017
Content-Type: multipart/mixed; boundary="===============4543534041936500907=="
MIME-Version: 1.0
From: Florence Blanc-Renaud
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 01 Aug 2017 10:48:31 +0200
Message-ID: <44253e02-8887-85b8-137d-8e8eebb73d88@redhat.com>
In-Reply-To: 4a914ba4-b129-0c0d-beff-c0f81e19bf99@brownpapertickets.com
--===============4543534041936500907==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
> =
> =
> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>> Ian Harding via FreeIPA-users wrote:
>>> I had an unexpected restart of an IPA server that had apparently had
>>> updates run but had not been restarted. ipactl says pki-tomcatd would
>>> not start.
>>>
>>> Strangely, the actual service appears to be running:
>>>
>>
>> dogtag is an application within tomcat so tomcat can run without dogtag
>> running.
>>
>> We need to see more of the dogtag debug log to see what is going on.
>>
> =
> It looks like an authentication problem...
> =
> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
> Error netscape.ldap.LDAPException: Authentication failed (49)
> =
Hi,
dogtag stores its internal data in the LDAP server and needs to =
establish a secure LDAP connection. You can check how this connection is =
configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines:
internaldb.ldapauth.authtype=3DSslClientAuth
internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
internaldb.ldapauth.bindPWPrompt=3Dinternaldb
internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
internaldb.ldapconn.host=3Dvm-...
internaldb.ldapconn.port=3D636
internaldb.ldapconn.secureConn
authtype can be SslClientAuth (authentication with a ssl certificate) or =
BasicAuth (authentication with a bind DN and password stored in =
/var/lib/pki/pki-tomcat/conf/password.conf).
You can use this information to manually check the credentials. For =
instance with sslclientauth:
export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
(provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
HTH,
Flo.
> =
> =
> at =
> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja=
va:1966) =
> =
> at =
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> at =
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java=
:1142) =
> =
> at =
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav=
a:617) =
> =
> at java.lang.Thread.run(Thread.java:745)
> Internal Database Error encountered: Could not connect to LDAP server =
> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
> Authentication failed (49)
> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
> at =
> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1=
14) =
> =
> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at =
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java=
:62) =
> =
> at =
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI=
mpl.java:43) =
> =
> at java.lang.reflect.Method.invoke(Method.java:498)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
> at =
> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:175) =
> =
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:124) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java=
:1270) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java=
:1195) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
> at =
> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja=
va:5318) =
> =
> at =
> org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja=
va:5610) =
> =
> at =
> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
> at =
> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav=
a:899) =
> =
> at =
> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:156) =
> =
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:145) =
> =
> at java.security.AccessController.doPrivileged(Native Method)
> at =
> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
> at =
> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
> at =
> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:6=
79) =
> =
> at =
> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja=
va:1966) =
> =
> at =
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> at =
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java=
:1142) =
> =
> at =
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav=
a:617) =
> =
> at java.lang.Thread.run(Thread.java:745)
> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown()
> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUB=
SYSTEM =
> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at =
> autoShutdown? false
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init =
> id=3Ddebug
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized deb=
ug
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initSubsystem =
> id=3Dlog
> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to init =
> id=3Dlog
> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
> autoShutdown? false
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3D=
log
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized log
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem =
> id=3Djss
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init =
> id=3Djss
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
> autoShutdown? false
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3D=
jss
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized jss
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem =
> id=3Ddbs
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init =
> id=3Ddbs
> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() =
> mEnableSerialMgmt=3Dtrue
> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
> LdapBoundConnFactor(DBSubsystem)
> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: init
> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
> LdapBoundConnFactory:doCloning true
> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init()
> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins
> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends
> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before =
> makeConnection errorIfDown is true
> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: =
> errorIfDown true
> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true
> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
> subsystemCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set =
> client auth cert nickname subsystemCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
> SSLClientCertificatSelectionCB: Entering!
> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
> ocspSigningCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
> subsystemCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
> SSLClientCertificateSelectionCB: desired cert found in list: =
> subsystemCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
> Error netscape.ldap.LDAPException: Authentication failed (49)
> at =
> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBou=
ndConnFactory.java:205) =
> =
> at =
> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact=
ory.java:166) =
> =
> at =
> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact=
ory.java:130) =
> =
> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
> at =
> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1=
14) =
> =
> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at =
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java=
:62) =
> =
> at =
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI=
mpl.java:43) =
> =
> at java.lang.reflect.Method.invoke(Method.java:498)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
> at =
> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:175) =
> =
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:124) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java=
:1270) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java=
:1195) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
> at =
> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja=
va:5318) =
> =
> at =
> org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja=
va:5610) =
> =
> at =
> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
> at =
> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav=
a:899) =
> =
> at =
> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:156) =
> =
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:145) =
> =
> at java.security.AccessController.doPrivileged(Native Method)
> at =
> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
> at =
> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
> at =
> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:6=
79) =
> =
> at =
> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja=
va:1966) =
> =
> at =
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> at =
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java=
:1142) =
> =
> at =
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav=
a:617) =
> =
> at java.lang.Thread.run(Thread.java:745)
> Internal Database Error encountered: Could not connect to LDAP server =
> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
> Authentication failed (49)
> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
> at =
> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1=
14) =
> =
> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at =
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java=
:62) =
> =
> at =
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI=
mpl.java:43) =
> =
> at java.lang.reflect.Method.invoke(Method.java:498)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
> at =
> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:175) =
> =
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:124) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java=
:1270) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java=
:1195) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
> at =
> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja=
va:5318) =
> =
> at =
> org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja=
va:5610) =
> =
> at =
> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
> at =
> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav=
a:899) =
> =
> at =
> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:156) =
> =
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:145) =
> =
> at java.security.AccessController.doPrivileged(Native Method)
> at =
> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
> at =
> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
> at =
> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:6=
79) =
> =
> at =
> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja=
va:1966) =
> =
> at =
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> at =
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java=
:1142) =
> =
> at =
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav=
a:617) =
> =
> at java.lang.Thread.run(Thread.java:745)
> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown()
> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG SUB=
SYSTEM =
> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
> autoShutdown? false
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
> id=3Ddebug
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized deb=
ug
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem =
> id=3Dlog
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init =
> id=3Dlog
> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
> autoShutdown? false
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3D=
log
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized log
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem =
> id=3Djss
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init =
> id=3Djss
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
> autoShutdown? false
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3D=
jss
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized jss
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem =
> id=3Ddbs
> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init =
> id=3Ddbs
> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() =
> mEnableSerialMgmt=3Dtrue
> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
> LdapBoundConnFactor(DBSubsystem)
> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: init
> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
> LdapBoundConnFactory:doCloning true
> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init()
> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins
> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends
> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before =
> makeConnection errorIfDown is true
> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: =
> errorIfDown true
> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true
> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
> subsystemCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set =
> client auth cert nickname subsystemCert cert-pki-ca
> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened
> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
> Error netscape.ldap.LDAPException: Authentication failed (49)
> at =
> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBou=
ndConnFactory.java:205) =
> =
> at =
> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact=
ory.java:166) =
> =
> at =
> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact=
ory.java:130) =
> =
> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
> at =
> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
> at =
> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1=
14) =
> =
> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at =
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java=
:62) =
> =
> at =
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI=
mpl.java:43) =
> =
> at java.lang.reflect.Method.invoke(Method.java:498)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
> at =
> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
> at =
> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:175) =
> =
> at =
> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java=
:124) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java=
:1270) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java=
:1195) =
> =
> at =
> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
> at =
> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja=
va:5318) =
> =
> at =
> org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja=
va:5610) =
> =
> at =
> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
> at =
> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav=
a:899) =
> =
> at =
> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
> at =
> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa=
se.java:156) =
> =
> =
> =
>> I don't think re-running the upgrade command would help.
>>
>> rob
>>
>=20
--===============4543534041936500907==--
From ianh at brownpapertickets.com Tue Aug 1 13:12:27 2017
Content-Type: multipart/mixed; boundary="===============5180792033005011879=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 01 Aug 2017 06:11:50 -0700
Message-ID: <26a15abb-30d1-d2fc-cb34-17fe86409f15@brownpapertickets.com>
In-Reply-To: 44253e02-8887-85b8-137d-8e8eebb73d88@redhat.com
--===============5180792033005011879==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>
>>
>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>> Ian Harding via FreeIPA-users wrote:
>>>> I had an unexpected restart of an IPA server that had apparently had
>>>> updates run but had not been restarted. ipactl says pki-tomcatd would
>>>> not start.
>>>>
>>>> Strangely, the actual service appears to be running:
>>>>
>>>
>>> dogtag is an application within tomcat so tomcat can run without dogtag
>>> running.
>>>
>>> We need to see more of the dogtag debug log to see what is going on.
>>>
>>
>> It looks like an authentication problem...
>>
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>
> =
> Hi,
> =
> dogtag stores its internal data in the LDAP server and needs to =
> establish a secure LDAP connection. You can check how this connection is =
> configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines:
> =
> internaldb.ldapauth.authtype=3DSslClientAuth
> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
> internaldb.ldapconn.host=3Dvm-...
> internaldb.ldapconn.port=3D636
> internaldb.ldapconn.secureConn
> =
> authtype can be SslClientAuth (authentication with a ssl certificate) or =
> BasicAuth (authentication with a bind DN and password stored in =
> /var/lib/pki/pki-tomcat/conf/password.conf).
> =
> You can use this information to manually check the credentials. For =
> instance with sslclientauth:
> =
> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
> =
> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
> =
I found this:
internaldb.ldapauth.authtype=3DSslClientAuth
internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
internaldb.ldapauth.bindPWPrompt=3Dinternaldb
internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
internaldb.ldapconn.cloneReplicationPort=3D389
...
and when I try the ldapsearch I am presented with a prompt to provide a =
pin/password
Please enter pin, password, or pass phrase for security token 'ldap(0)':
but there is no password file...
ls -a /etc/pki/pki-tomcat/alias/
. .. cert8.db key3.db secmod.db
There are "internal" and "replicationdb" values in =
/var/lib/pki/pki-tomcat/conf/password.conf but they don't work in =
response to the ldapsearch prompt above.
Thank you so much for your help!
> HTH,
> Flo.
>>
>>
>> at =
>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j=
ava:1966) =
>>
>> at =
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> at =
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav=
a:1142) =
>>
>> at =
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja=
va:617) =
>>
>> at java.lang.Thread.run(Thread.java:745)
>> Internal Database Error encountered: Could not connect to LDAP server =
>> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
>> Authentication failed (49)
>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>> at =
>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:=
114) =
>>
>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> at =
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav=
a:62) =
>>
>> at =
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor=
Impl.java:43) =
>>
>> at java.lang.reflect.Method.invoke(Method.java:498)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>> at java.security.AccessController.doPrivileged(Native Method)
>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>> at =
>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:175) =
>>
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:124) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav=
a:1270) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav=
a:1195) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>> at =
>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j=
ava:5318) =
>>
>> at =
>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j=
ava:5610) =
>>
>> at =
>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>> at =
>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja=
va:899) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:156) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:145) =
>>
>> at java.security.AccessController.doPrivileged(Native Method)
>> at =
>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>> at =
>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>> at =
>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:=
679) =
>>
>> at =
>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j=
ava:1966) =
>>
>> at =
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> at =
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav=
a:1142) =
>>
>> at =
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja=
va:617) =
>>
>> at java.lang.Thread.run(Thread.java:745)
>> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown()
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SU=
BSYSTEM =
>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at =
>> autoShutdown? false
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: autoShutdown =
>> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init =
>> id=3Ddebug
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized =
>> debug
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: =
>> initSubsystem id=3Dlog
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to =
>> init id=3Dlog
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
>> autoShutdown? false
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown =
>> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init =
>> id=3Dlog
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized log
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>> initSubsystem id=3Djss
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to =
>> init id=3Djss
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
>> autoShutdown? false
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown =
>> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init =
>> id=3Djss
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized jss
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>> initSubsystem id=3Ddbs
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to =
>> init id=3Ddbs
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() =
>> mEnableSerialMgmt=3Dtrue
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
>> LdapBoundConnFactor(DBSubsystem)
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: init
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>> LdapBoundConnFactory:doCloning true
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init()
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before =
>> makeConnection errorIfDown is true
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: =
>> errorIfDown true
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>> subsystemCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set =
>> client auth cert nickname subsystemCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>> SSLClientCertificatSelectionCB: Entering!
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
>> ocspSigningCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
>> subsystemCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>> SSLClientCertificateSelectionCB: desired cert found in list: =
>> subsystemCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>> Error netscape.ldap.LDAPException: Authentication failed (49)
>> at =
>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBo=
undConnFactory.java:205) =
>>
>> at =
>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac=
tory.java:166) =
>>
>> at =
>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac=
tory.java:130) =
>>
>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>> at =
>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:=
114) =
>>
>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> at =
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav=
a:62) =
>>
>> at =
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor=
Impl.java:43) =
>>
>> at java.lang.reflect.Method.invoke(Method.java:498)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>> at java.security.AccessController.doPrivileged(Native Method)
>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>> at =
>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:175) =
>>
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:124) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav=
a:1270) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav=
a:1195) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>> at =
>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j=
ava:5318) =
>>
>> at =
>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j=
ava:5610) =
>>
>> at =
>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>> at =
>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja=
va:899) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:156) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:145) =
>>
>> at java.security.AccessController.doPrivileged(Native Method)
>> at =
>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>> at =
>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>> at =
>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:=
679) =
>>
>> at =
>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j=
ava:1966) =
>>
>> at =
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> at =
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav=
a:1142) =
>>
>> at =
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja=
va:617) =
>>
>> at java.lang.Thread.run(Thread.java:745)
>> Internal Database Error encountered: Could not connect to LDAP server =
>> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
>> Authentication failed (49)
>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>> at =
>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:=
114) =
>>
>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> at =
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav=
a:62) =
>>
>> at =
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor=
Impl.java:43) =
>>
>> at java.lang.reflect.Method.invoke(Method.java:498)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>> at java.security.AccessController.doPrivileged(Native Method)
>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>> at =
>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:175) =
>>
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:124) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav=
a:1270) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav=
a:1195) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>> at =
>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j=
ava:5318) =
>>
>> at =
>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j=
ava:5610) =
>>
>> at =
>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>> at =
>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja=
va:899) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:156) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:145) =
>>
>> at java.security.AccessController.doPrivileged(Native Method)
>> at =
>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>> at =
>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>> at =
>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:=
679) =
>>
>> at =
>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j=
ava:1966) =
>>
>> at =
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> at =
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav=
a:1142) =
>>
>> at =
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja=
va:617) =
>>
>> at java.lang.Thread.run(Thread.java:745)
>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown()
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG SU=
BSYSTEM =
>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>> autoShutdown? false
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
>> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>> id=3Ddebug
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized =
>> debug
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>> initSubsystem id=3Dlog
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>> init id=3Dlog
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>> autoShutdown? false
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
>> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>> id=3Dlog
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized log
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>> initSubsystem id=3Djss
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>> init id=3Djss
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>> autoShutdown? false
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown =
>> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>> id=3Djss
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized jss
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>> initSubsystem id=3Ddbs
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>> init id=3Ddbs
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() =
>> mEnableSerialMgmt=3Dtrue
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>> LdapBoundConnFactor(DBSubsystem)
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: init
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>> LdapBoundConnFactory:doCloning true
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init()
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before =
>> makeConnection errorIfDown is true
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: =
>> errorIfDown true
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>> subsystemCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set =
>> client auth cert nickname subsystemCert cert-pki-ca
>> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened
>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>> Error netscape.ldap.LDAPException: Authentication failed (49)
>> at =
>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBo=
undConnFactory.java:205) =
>>
>> at =
>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac=
tory.java:166) =
>>
>> at =
>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac=
tory.java:130) =
>>
>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>> at =
>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>> at =
>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:=
114) =
>>
>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> at =
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav=
a:62) =
>>
>> at =
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor=
Impl.java:43) =
>>
>> at java.lang.reflect.Method.invoke(Method.java:498)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>> at =
>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>> at java.security.AccessController.doPrivileged(Native Method)
>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>> at =
>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:175) =
>>
>> at =
>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav=
a:124) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav=
a:1270) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav=
a:1195) =
>>
>> at =
>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>> at =
>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j=
ava:5318) =
>>
>> at =
>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j=
ava:5610) =
>>
>> at =
>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>> at =
>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja=
va:899) =
>>
>> at =
>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133)
>> at =
>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB=
ase.java:156) =
>>
>>
>>
>>> I don't think re-running the upgrade command would help.
>>>
>>> rob
>>>
>>
> =
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============5180792033005011879==--
From flo at redhat.com Tue Aug 1 14:39:56 2017
Content-Type: multipart/mixed; boundary="===============0265493955462484505=="
MIME-Version: 1.0
From: Florence Blanc-Renaud
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 01 Aug 2017 16:39:12 +0200
Message-ID:
In-Reply-To: 26a15abb-30d1-d2fc-cb34-17fe86409f15@brownpapertickets.com
--===============0265493955462484505==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/01/2017 03:11 PM, Ian Harding wrote:
> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>
>>>
>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>> Ian Harding via FreeIPA-users wrote:
>>>>> I had an unexpected restart of an IPA server that had apparently had
>>>>> updates run but had not been restarted. ipactl says pki-tomcatd would
>>>>> not start.
>>>>>
>>>>> Strangely, the actual service appears to be running:
>>>>>
>>>>
>>>> dogtag is an application within tomcat so tomcat can run without dogtag
>>>> running.
>>>>
>>>> We need to see more of the dogtag debug log to see what is going on.
>>>>
>>>
>>> It looks like an authentication problem...
>>>
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>
>>
>> Hi,
>>
>> dogtag stores its internal data in the LDAP server and needs to =
>> establish a secure LDAP connection. You can check how this connection =
>> is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines:
>>
>> internaldb.ldapauth.authtype=3DSslClientAuth
>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>> internaldb.ldapconn.host=3Dvm-...
>> internaldb.ldapconn.port=3D636
>> internaldb.ldapconn.secureConn
>>
>> authtype can be SslClientAuth (authentication with a ssl certificate) =
>> or BasicAuth (authentication with a bind DN and password stored in =
>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>
>> You can use this information to manually check the credentials. For =
>> instance with sslclientauth:
>>
>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>
>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>
> =
> I found this:
> =
> internaldb.ldapauth.authtype=3DSslClientAuth
> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
> internaldb.ldapconn.cloneReplicationPort=3D389
> ...
> =
> and when I try the ldapsearch I am presented with a prompt to provide a =
> pin/password
> =
> Please enter pin, password, or pass phrase for security token 'ldap(0)':
> =
> but there is no password file...
> =
Hi,
you are right, in 4.4. there is no pwdfile.txt and the password can be =
found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag =
internal=3D...)
Can you check if the password with the tag internal=3D... allows to read =
the keys from the NSS db?
certutil -K -d /etc/pki/pki-tomcat/alias
(provide password)
If the password is not the right one, certutil will prompt you once =
again for it. This would mean that the password does not allow to access =
the key from the NSSdb and Dogtag will not be able to use the =
certificate for authentication.
Flo
> ls -a /etc/pki/pki-tomcat/alias/
> . .. cert8.db key3.db secmod.db
> =
> There are "internal" and "replicationdb" values in =
> /var/lib/pki/pki-tomcat/conf/password.conf but they don't work in =
> response to the ldapsearch prompt above.
> =
> Thank you so much for your help!
> =
>> HTH,
>> Flo.
>>>
>>>
>>> at =
>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.=
java:1966) =
>>>
>>> at =
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja=
va:1142) =
>>>
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j=
ava:617) =
>>>
>>> at java.lang.Thread.run(Thread.java:745)
>>> Internal Database Error encountered: Could not connect to LDAP server =
>>> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
>>> Authentication failed (49)
>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>> at =
>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java=
:114) =
>>>
>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>> at =
>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja=
va:62) =
>>>
>>> at =
>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso=
rImpl.java:43) =
>>>
>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:175) =
>>>
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:124) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja=
va:1270) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja=
va:1195) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>>> at =
>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.=
java:5318) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.=
java:5610) =
>>>
>>> at =
>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j=
ava:899) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13=
3) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:156) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:145) =
>>>
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>>> at =
>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>>> at =
>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java=
:679) =
>>>
>>> at =
>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.=
java:1966) =
>>>
>>> at =
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja=
va:1142) =
>>>
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j=
ava:617) =
>>>
>>> at java.lang.Thread.run(Thread.java:745)
>>> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown()
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG S=
UBSYSTEM =
>>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init =
>>> id=3Ddebug
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized =
>>> debug
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: =
>>> initSubsystem id=3Dlog
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to =
>>> init id=3Dlog
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init =
>>> id=3Dlog
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized =
>>> log
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>> initSubsystem id=3Djss
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to =
>>> init id=3Djss
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init =
>>> id=3Djss
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized =
>>> jss
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>> initSubsystem id=3Ddbs
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to =
>>> init id=3Ddbs
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() =
>>> mEnableSerialMgmt=3Dtrue
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
>>> LdapBoundConnFactor(DBSubsystem)
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: =
>>> init
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>> LdapBoundConnFactory:doCloning true
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init()
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before =
>>> makeConnection errorIfDown is true
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: =
>>> errorIfDown true
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>> subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set =
>>> client auth cert nickname subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>> SSLClientCertificatSelectionCB: Entering!
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
>>> ocspSigningCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
>>> subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>> subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>> at =
>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapB=
oundConnFactory.java:205) =
>>>
>>> at =
>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa=
ctory.java:166) =
>>>
>>> at =
>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa=
ctory.java:130) =
>>>
>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>> at =
>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java=
:114) =
>>>
>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>> at =
>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja=
va:62) =
>>>
>>> at =
>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso=
rImpl.java:43) =
>>>
>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:175) =
>>>
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:124) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja=
va:1270) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja=
va:1195) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>>> at =
>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.=
java:5318) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.=
java:5610) =
>>>
>>> at =
>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j=
ava:899) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13=
3) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:156) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:145) =
>>>
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>>> at =
>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>>> at =
>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java=
:679) =
>>>
>>> at =
>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.=
java:1966) =
>>>
>>> at =
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja=
va:1142) =
>>>
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j=
ava:617) =
>>>
>>> at java.lang.Thread.run(Thread.java:745)
>>> Internal Database Error encountered: Could not connect to LDAP server =
>>> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: =
>>> Authentication failed (49)
>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>> at =
>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java=
:114) =
>>>
>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>> at =
>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja=
va:62) =
>>>
>>> at =
>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso=
rImpl.java:43) =
>>>
>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:175) =
>>>
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:124) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja=
va:1270) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja=
va:1195) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>>> at =
>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.=
java:5318) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.=
java:5610) =
>>>
>>> at =
>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j=
ava:899) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13=
3) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:156) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:145) =
>>>
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>>> at =
>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>>> at =
>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java=
:679) =
>>>
>>> at =
>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.=
java:1966) =
>>>
>>> at =
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja=
va:1142) =
>>>
>>> at =
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j=
ava:617) =
>>>
>>> at java.lang.Thread.run(Thread.java:745)
>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown()
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG S=
UBSYSTEM =
>>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>>> id=3Ddebug
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized =
>>> debug
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>> initSubsystem id=3Dlog
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>>> init id=3Dlog
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>>> id=3Dlog
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized =
>>> log
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>> initSubsystem id=3Djss
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>>> init id=3Djss
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>>> id=3Djss
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized =
>>> jss
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>> initSubsystem id=3Ddbs
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>>> init id=3Ddbs
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() =
>>> mEnableSerialMgmt=3Dtrue
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>> LdapBoundConnFactor(DBSubsystem)
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: =
>>> init
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>> LdapBoundConnFactory:doCloning true
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init()
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before =
>>> makeConnection errorIfDown is true
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: =
>>> errorIfDown true
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>> subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set =
>>> client auth cert nickname subsystemCert cert-pki-ca
>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened
>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>> at =
>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapB=
oundConnFactory.java:205) =
>>>
>>> at =
>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa=
ctory.java:166) =
>>>
>>> at =
>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa=
ctory.java:130) =
>>>
>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>> at =
>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>> at =
>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java=
:114) =
>>>
>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>> at =
>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja=
va:62) =
>>>
>>> at =
>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso=
rImpl.java:43) =
>>>
>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>> at =
>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>> at java.security.AccessController.doPrivileged(Native Method)
>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320)
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:175) =
>>>
>>> at =
>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja=
va:124) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja=
va:1270) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja=
va:1195) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085)
>>> at =
>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.=
java:5318) =
>>>
>>> at =
>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.=
java:5610) =
>>>
>>> at =
>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>> at =
>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j=
ava:899) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13=
3) =
>>>
>>> at =
>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container=
Base.java:156) =
>>>
>>>
>>>
>>>> I don't think re-running the upgrade command would help.
>>>>
>>>> rob
>>>>
>>>
>>
>=20
--===============0265493955462484505==--
From ianh at brownpapertickets.com Tue Aug 1 17:03:53 2017
Content-Type: multipart/mixed; boundary="===============1477773526450600254=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 01 Aug 2017 10:03:07 -0700
Message-ID: <3e986b45-f163-80f0-2f88-ef3880ea441d@brownpapertickets.com>
In-Reply-To: b8f5fd77-6f4a-d19c-a11d-e49fc0858cce@redhat.com
--===============1477773526450600254==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
> On 08/01/2017 03:11 PM, Ian Harding wrote:
>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>
>>>>
>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>> I had an unexpected restart of an IPA server that had apparently had
>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd =
>>>>>> would
>>>>>> not start.
>>>>>>
>>>>>> Strangely, the actual service appears to be running:
>>>>>>
>>>>>
>>>>> dogtag is an application within tomcat so tomcat can run without =
>>>>> dogtag
>>>>> running.
>>>>>
>>>>> We need to see more of the dogtag debug log to see what is going on.
>>>>>
>>>>
>>>> It looks like an authentication problem...
>>>>
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>
>>>
>>> Hi,
>>>
>>> dogtag stores its internal data in the LDAP server and needs to =
>>> establish a secure LDAP connection. You can check how this connection =
>>> is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines:
>>>
>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>> internaldb.ldapconn.host=3Dvm-...
>>> internaldb.ldapconn.port=3D636
>>> internaldb.ldapconn.secureConn
>>>
>>> authtype can be SslClientAuth (authentication with a ssl certificate) =
>>> or BasicAuth (authentication with a bind DN and password stored in =
>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>
>>> You can use this information to manually check the credentials. For =
>>> instance with sslclientauth:
>>>
>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>
>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>
>>
>> I found this:
>>
>> internaldb.ldapauth.authtype=3DSslClientAuth
>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>> internaldb.ldapconn.cloneReplicationPort=3D389
>> ...
>>
>> and when I try the ldapsearch I am presented with a prompt to provide =
>> a pin/password
>>
>> Please enter pin, password, or pass phrase for security token 'ldap(0)':
>>
>> but there is no password file...
>>
> Hi,
> =
> you are right, in 4.4. there is no pwdfile.txt and the password can be =
> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag =
> internal=3D...)
> =
> Can you check if the password with the tag internal=3D... allows to read =
> the keys from the NSS db?
> certutil -K -d /etc/pki/pki-tomcat/alias
> (provide password)
That works...
# certutil -K -d /etc/pki/pki-tomcat/alias
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private =
Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
< 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
< 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate =
DB:auditSigningCert cert-pki-ca
< 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert =
cert-pki-ca
< 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate =
DB:ocspSigningCert cert-pki-ca
< 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert =
cert-pki-ca
< 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate =
DB:subsystemCert cert-pki-ca
But this doesn't (with the same password from password.conf)
# ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
Please enter pin, password, or pass phrase for security token 'ldap(0)':
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Invalid credentials (49)
That password is getting me somewhere though, since if I put in a =
nonsense or incorrect password it just prompts over and over.
> =
> If the password is not the right one, certutil will prompt you once =
> again for it. This would mean that the password does not allow to access =
> the key from the NSSdb and Dogtag will not be able to use the =
> certificate for authentication.
> =
> Flo
> =
>> ls -a /etc/pki/pki-tomcat/alias/
>> . .. cert8.db key3.db secmod.db
>>
>> There are "internal" and "replicationdb" values in =
>> /var/lib/pki/pki-tomcat/conf/password.conf but they don't work in =
>> response to the ldapsearch prompt above.
>>
>> Thank you so much for your help!
>>
>>> HTH,
>>> Flo.
>>>>
>>>>
>>>> at =
>>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig=
.java:1966) =
>>>>
>>>> at =
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j=
ava:1142) =
>>>>
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.=
java:617) =
>>>>
>>>> at java.lang.Thread.run(Thread.java:745)
>>>> Internal Database Error encountered: Could not connect to LDAP =
>>>> server host seattlenfs.bpt.rocks port 636 Error =
>>>> netscape.ldap.LDAPException: Authentication failed (49)
>>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>>> at =
>>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav=
a:114) =
>>>>
>>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> at =
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j=
ava:62) =
>>>>
>>>> at =
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess=
orImpl.java:43) =
>>>>
>>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32=
0) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:175) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:124) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j=
ava:1270) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j=
ava:1195) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108=
5) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext=
.java:5318) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext=
.java:5610) =
>>>>
>>>> at =
>>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.=
java:899) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1=
33) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:156) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:145) =
>>>>
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>>>> at =
>>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>>>> at =
>>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.jav=
a:679) =
>>>>
>>>> at =
>>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig=
.java:1966) =
>>>>
>>>> at =
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j=
ava:1142) =
>>>>
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.=
java:617) =
>>>>
>>>> at java.lang.Thread.run(Thread.java:745)
>>>> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown()
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG =
>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at =
>>>> autoShutdown? false
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init =
>>>> id=3Ddebug
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: =
>>>> initialized debug
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: =
>>>> initSubsystem id=3Dlog
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to =
>>>> init id=3Dlog
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
>>>> autoShutdown? false
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init =
>>>> id=3Dlog
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>>> initialized log
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>>> initSubsystem id=3Djss
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to =
>>>> init id=3Djss
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at =
>>>> autoShutdown? false
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init =
>>>> id=3Djss
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>>> initialized jss
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: =
>>>> initSubsystem id=3Ddbs
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to =
>>>> init id=3Ddbs
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() =
>>>> mEnableSerialMgmt=3Dtrue
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating =
>>>> LdapBoundConnFactor(DBSubsystem)
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: =
>>>> init
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>>> LdapBoundConnFactory:doCloning true
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init()
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init =
>>>> begins
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before =
>>>> makeConnection errorIfDown is true
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: =
>>>> errorIfDown true
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>>> subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set =
>>>> client auth cert nickname subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>>> SSLClientCertificatSelectionCB: Entering!
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
>>>> ocspSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: =
>>>> subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>> subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: =
>>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>> at =
>>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(Ldap=
BoundConnFactory.java:205) =
>>>>
>>>> at =
>>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF=
actory.java:166) =
>>>>
>>>> at =
>>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF=
actory.java:130) =
>>>>
>>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>>> at =
>>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav=
a:114) =
>>>>
>>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> at =
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j=
ava:62) =
>>>>
>>>> at =
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess=
orImpl.java:43) =
>>>>
>>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32=
0) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:175) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:124) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j=
ava:1270) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j=
ava:1195) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108=
5) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext=
.java:5318) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext=
.java:5610) =
>>>>
>>>> at =
>>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.=
java:899) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1=
33) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:156) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:145) =
>>>>
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>>>> at =
>>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>>>> at =
>>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.jav=
a:679) =
>>>>
>>>> at =
>>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig=
.java:1966) =
>>>>
>>>> at =
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j=
ava:1142) =
>>>>
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.=
java:617) =
>>>>
>>>> at java.lang.Thread.run(Thread.java:745)
>>>> Internal Database Error encountered: Could not connect to LDAP =
>>>> server host seattlenfs.bpt.rocks port 636 Error =
>>>> netscape.ldap.LDAPException: Authentication failed (49)
>>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>>> at =
>>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav=
a:114) =
>>>>
>>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> at =
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j=
ava:62) =
>>>>
>>>> at =
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess=
orImpl.java:43) =
>>>>
>>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32=
0) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:175) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:124) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j=
ava:1270) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j=
ava:1195) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108=
5) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext=
.java:5318) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext=
.java:5610) =
>>>>
>>>> at =
>>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.=
java:899) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1=
33) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:156) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:145) =
>>>>
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873)
>>>> at =
>>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
>>>> at =
>>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.jav=
a:679) =
>>>>
>>>> at =
>>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig=
.java:1966) =
>>>>
>>>> at =
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j=
ava:1142) =
>>>>
>>>> at =
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.=
java:617) =
>>>>
>>>> at java.lang.Thread.run(Thread.java:745)
>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown()
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG =
>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>>>> autoShutdown? false
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>>>> id=3Ddebug
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> initialized debug
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> initSubsystem id=3Dlog
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>>>> init id=3Dlog
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>>>> autoShutdown? false
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>>>> id=3Dlog
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> initialized log
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> initSubsystem id=3Djss
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>>>> init id=3Djss
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at =
>>>> autoShutdown? false
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init =
>>>> id=3Djss
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> initialized jss
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: =
>>>> initSubsystem id=3Ddbs
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to =
>>>> init id=3Ddbs
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() =
>>>> mEnableSerialMgmt=3Dtrue
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating =
>>>> LdapBoundConnFactor(DBSubsystem)
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: =
>>>> init
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>>> LdapBoundConnFactory:doCloning true
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init()
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init =
>>>> begins
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before =
>>>> makeConnection errorIfDown is true
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: =
>>>> errorIfDown true
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =
>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>>> subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set =
>>>> client auth cert nickname subsystemCert cert-pki-ca
>>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened
>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 =
>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>> at =
>>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(Ldap=
BoundConnFactory.java:205) =
>>>>
>>>> at =
>>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF=
actory.java:166) =
>>>>
>>>> at =
>>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF=
actory.java:130) =
>>>>
>>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172)
>>>> at =
>>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078)
>>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570)
>>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188)
>>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621)
>>>> at =
>>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav=
a:114) =
>>>>
>>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> at =
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j=
ava:62) =
>>>>
>>>> at =
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess=
orImpl.java:43) =
>>>>
>>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285)
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32=
0) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:175) =
>>>>
>>>> at =
>>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j=
ava:124) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j=
ava:1270) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j=
ava:1195) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108=
5) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext=
.java:5318) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext=
.java:5610) =
>>>>
>>>> at =
>>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147)
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.=
java:899) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1=
33) =
>>>>
>>>> at =
>>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe=
rBase.java:156) =
>>>>
>>>>
>>>>
>>>>> I don't think re-running the upgrade command would help.
>>>>>
>>>>> rob
>>>>>
>>>>
>>>
>>
> =
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============1477773526450600254==--
From rcritten at redhat.com Tue Aug 1 19:04:05 2017
Content-Type: multipart/mixed; boundary="===============0859076021646391306=="
MIME-Version: 1.0
From: Rob Crittenden
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 01 Aug 2017 15:03:21 -0400
Message-ID:
In-Reply-To: 3e986b45-f163-80f0-2f88-ef3880ea441d@brownpapertickets.com
--===============0859076021646391306==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Ian Harding wrote:
> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>
>>>>>
>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>> I had an unexpected restart of an IPA server that had apparently had
>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd
>>>>>>> would
>>>>>>> not start.
>>>>>>>
>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>
>>>>>>
>>>>>> dogtag is an application within tomcat so tomcat can run without
>>>>>> dogtag
>>>>>> running.
>>>>>>
>>>>>> We need to see more of the dogtag debug log to see what is going on.
>>>>>>
>>>>>
>>>>> It looks like an authentication problem...
>>>>>
>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636
>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>
>>>>
>>>> Hi,
>>>>
>>>> dogtag stores its internal data in the LDAP server and needs to
>>>> establish a secure LDAP connection. You can check how this
>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>> the lines:
>>>>
>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>> internaldb.ldapconn.host=3Dvm-...
>>>> internaldb.ldapconn.port=3D636
>>>> internaldb.ldapconn.secureConn
>>>>
>>>> authtype can be SslClientAuth (authentication with a ssl
>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>
>>>> You can use this information to manually check the credentials. For
>>>> instance with sslclientauth:
>>>>
>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>
>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>
>>>
>>> I found this:
>>>
>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>> ...
>>>
>>> and when I try the ldapsearch I am presented with a prompt to provide
>>> a pin/password
>>>
>>> Please enter pin, password, or pass phrase for security token 'ldap(0)':
>>>
>>> but there is no password file...
>>>
>> Hi,
>>
>> you are right, in 4.4. there is no pwdfile.txt and the password can be
>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>> internal=3D...)
>>
>> Can you check if the password with the tag internal=3D... allows to read
>> the keys from the NSS db?
>> certutil -K -d /etc/pki/pki-tomcat/alias
>> (provide password)
> =
> That works...
> =
> # certutil -K -d /etc/pki/pki-tomcat/alias
> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
> Key and Certificate Services"
> Enter Password or Pin for "NSS Certificate DB":
> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate
> DB:auditSigningCert cert-pki-ca
> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
> cert-pki-ca
> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate
> DB:ocspSigningCert cert-pki-ca
> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
> cert-pki-ca
> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate
> DB:subsystemCert cert-pki-ca
> =
> But this doesn't (with the same password from password.conf)
> =
> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
> Please enter pin, password, or pass phrase for security token 'ldap(0)':
> SASL/EXTERNAL authentication started
> ldap_sasl_interactive_bind_s: Invalid credentials (49)
> =
> That password is getting me somewhere though, since if I put in a
> nonsense or incorrect password it just prompts over and over.
Let's step back a second. You upgraded from what to what?
Are you running in SELinux enforcing mode?
If so can you run:
# ausearch -m AVC
I suspect that the subsystem cert was renewed and everything wasn't
updated properly. If I'm right this is unrelated to the upgrade it just
shone a spotlight on it.
Can you run these commands:
$ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
and
# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
cert-pki-ca' | grep Serial
# certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
The description attribute in the ldapsearch output is of the form 2;#;DN;DN
The # should match the serial number in the first certutil output
The ASCII blob (minus the BEGIN/END headers) should match one of the
userCertificate attributes.
rob
--===============0859076021646391306==--
From ianh at brownpapertickets.com Tue Aug 1 23:46:14 2017
Content-Type: multipart/mixed; boundary="===============8250142675854330470=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 01 Aug 2017 16:43:15 -0700
Message-ID: <9b0d6fa9-f327-42df-1ad3-c7b9acd9f32d@brownpapertickets.com>
In-Reply-To: ac159308-eb9c-e0e9-9ab4-446f96bebaee@redhat.com
--===============8250142675854330470==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/01/2017 12:03 PM, Rob Crittenden wrote:
> Ian Harding wrote:
>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>
>>>>>>
>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>> I had an unexpected restart of an IPA server that had apparently h=
ad
>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd
>>>>>>>> would
>>>>>>>> not start.
>>>>>>>>
>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>
>>>>>>>
>>>>>>> dogtag is an application within tomcat so tomcat can run without
>>>>>>> dogtag
>>>>>>> running.
>>>>>>>
>>>>>>> We need to see more of the dogtag debug log to see what is going on.
>>>>>>>
>>>>>>
>>>>>> It looks like an authentication problem...
>>>>>>
>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened
>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636
>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>
>>>>>
>>>>> Hi,
>>>>>
>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>> establish a secure LDAP connection. You can check how this
>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>> the lines:
>>>>>
>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>> internaldb.ldapconn.port=3D636
>>>>> internaldb.ldapconn.secureConn
>>>>>
>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>
>>>>> You can use this information to manually check the credentials. For
>>>>> instance with sslclientauth:
>>>>>
>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>
>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>
>>>>
>>>> I found this:
>>>>
>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>> ...
>>>>
>>>> and when I try the ldapsearch I am presented with a prompt to provide
>>>> a pin/password
>>>>
>>>> Please enter pin, password, or pass phrase for security token 'ldap(0)=
':
>>>>
>>>> but there is no password file...
>>>>
>>> Hi,
>>>
>>> you are right, in 4.4. there is no pwdfile.txt and the password can be
>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>> internal=3D...)
>>>
>>> Can you check if the password with the tag internal=3D... allows to read
>>> the keys from the NSS db?
>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>> (provide password)
>>
>> That works...
>>
>> # certutil -K -d /etc/pki/pki-tomcat/alias
>> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
>> Key and Certificate Services"
>> Enter Password or Pin for "NSS Certificate DB":
>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate
>> DB:auditSigningCert cert-pki-ca
>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>> cert-pki-ca
>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate
>> DB:ocspSigningCert cert-pki-ca
>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>> cert-pki-ca
>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate
>> DB:subsystemCert cert-pki-ca
>>
>> But this doesn't (with the same password from password.conf)
>>
>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>> Please enter pin, password, or pass phrase for security token 'ldap(0)':
>> SASL/EXTERNAL authentication started
>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>
>> That password is getting me somewhere though, since if I put in a
>> nonsense or incorrect password it just prompts over and over.
> =
> Let's step back a second. You upgraded from what to what?
There wasn't much of a change... I just assumed someone ran yum upgrade =
and didn't restart, then the power outage... it looks like not much of a =
version change though.
# grep ipa /var/log/yum.log
Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:45:32 Installed: ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:47:05 Installed: python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:47:05 Installed: ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:47:06 Installed: python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:47:36 Installed: ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch
# grep pki /var/log/yum.log
Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
> =
> Are you running in SELinux enforcing mode?
# getenforce
Enforcing
> =
> If so can you run:
> =
> # ausearch -m AVC
> =
# ausearch -m AVC
The NOLOG option to log_format is deprecated. Please use the write_logs =
option.
The NOLOG option is overriding the write_logs current setting.
----
time->Mon Mar 14 10:39:01 2016
type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e syscall=
=3D2 =
success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0=
items=3D0 =
ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D581400001 =
suid=3D0 =
fsuid=3D581400001 egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) =
ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } for =
pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D11639=
3517 =
scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
> I suspect that the subsystem cert was renewed and everything wasn't
> updated properly. If I'm right this is unrelated to the upgrade it just
> shone a spotlight on it.
> =
> Can you run these commands:
> =
> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
> =
This returns
$ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
... stuff ...
ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
Subsystem,O=3DBPT.ROCKS
> and
> =
> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
> cert-pki-ca' | grep Serial
> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca'=
-a
> =
These both return
# certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
cert-pki-ca' | grep Serial
Enter Password or Pin for "NSS Certificate DB":
certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized =
Object Identifier.
# certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
cert-pki-ca' -a
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private =
Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized =
Object Identifier.
which seems weird.
> The description attribute in the ldapsearch output is of the form 2;#;DN;=
DN
> =
> The # should match the serial number in the first certutil output
> =
> The ASCII blob (minus the BEGIN/END headers) should match one of the
> userCertificate attributes.
> =
> rob
> =
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============8250142675854330470==--
From flo at redhat.com Wed Aug 2 07:12:33 2017
Content-Type: multipart/mixed; boundary="===============3295431487290206174=="
MIME-Version: 1.0
From: Florence Blanc-Renaud
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Wed, 02 Aug 2017 09:11:17 +0200
Message-ID:
In-Reply-To: 9b0d6fa9-f327-42df-1ad3-c7b9acd9f32d@brownpapertickets.com
--===============3295431487290206174==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/02/2017 01:43 AM, Ian Harding wrote:
> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>> Ian Harding wrote:
>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>
>>>>>>>
>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>> apparently had
>>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd
>>>>>>>>> would
>>>>>>>>> not start.
>>>>>>>>>
>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>
>>>>>>>>
>>>>>>>> dogtag is an application within tomcat so tomcat can run without
>>>>>>>> dogtag
>>>>>>>> running.
>>>>>>>>
>>>>>>>> We need to see more of the dogtag debug log to see what is going =
>>>>>>>> on.
>>>>>>>>
>>>>>>>
>>>>>>> It looks like an authentication problem...
>>>>>>>
>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake =
>>>>>>> happened
>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636
>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>> establish a secure LDAP connection. You can check how this
>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>> the lines:
>>>>>>
>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>> internaldb.ldapconn.port=3D636
>>>>>> internaldb.ldapconn.secureConn
>>>>>>
>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>
>>>>>> You can use this information to manually check the credentials. For
>>>>>> instance with sslclientauth:
>>>>>>
>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>
>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>
>>>>>
>>>>> I found this:
>>>>>
>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>> ...
>>>>>
>>>>> and when I try the ldapsearch I am presented with a prompt to provide
>>>>> a pin/password
>>>>>
>>>>> Please enter pin, password, or pass phrase for security token =
>>>>> 'ldap(0)':
>>>>>
>>>>> but there is no password file...
>>>>>
>>>> Hi,
>>>>
>>>> you are right, in 4.4. there is no pwdfile.txt and the password can be
>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>> internal=3D...)
>>>>
>>>> Can you check if the password with the tag internal=3D... allows to re=
ad
>>>> the keys from the NSS db?
>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>> (provide password)
>>>
>>> That works...
>>>
>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
>>> Key and Certificate Services"
>>> Enter Password or Pin for "NSS Certificate DB":
>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate
>>> DB:auditSigningCert cert-pki-ca
>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>> cert-pki-ca
>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate
>>> DB:ocspSigningCert cert-pki-ca
>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>> cert-pki-ca
>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate
>>> DB:subsystemCert cert-pki-ca
>>>
>>> But this doesn't (with the same password from password.conf)
>>>
>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>> Please enter pin, password, or pass phrase for security token 'ldap(0)':
>>> SASL/EXTERNAL authentication started
>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>
>>> That password is getting me somewhere though, since if I put in a
>>> nonsense or incorrect password it just prompts over and over.
>>
>> Let's step back a second. You upgraded from what to what?
> =
> There wasn't much of a change... I just assumed someone ran yum upgrade =
> and didn't restart, then the power outage... it looks like not much of a =
> version change though.
> =
> # grep ipa /var/log/yum.log
> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
> Jan 08 04:45:32 Installed: ipa-client-common-4.4.0-14.el7.centos.1.1.noar=
ch
> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
> Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
> Jan 08 04:47:05 Installed: python2-ipaclient-4.4.0-14.el7.centos.1.1.noar=
ch
> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
> Jan 08 04:47:05 Installed: ipa-server-common-4.4.0-14.el7.centos.1.1.noar=
ch
> Jan 08 04:47:06 Installed: python2-ipaserver-4.4.0-14.el7.centos.1.1.noar=
ch
> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
> Jan 08 04:47:36 Installed: ipa-python-compat-4.4.0-14.el7.centos.1.1.noar=
ch
> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch
> =
> # grep pki /var/log/yum.log
> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
> =
> =
>>
>> Are you running in SELinux enforcing mode?
> =
> # getenforce
> Enforcing
> =
>>
>> If so can you run:
>>
>> # ausearch -m AVC
>>
> =
> # ausearch -m AVC
> The NOLOG option to log_format is deprecated. Please use the write_logs =
> option.
> The NOLOG option is overriding the write_logs current setting.
> ----
> time->Mon Mar 14 10:39:01 2016
> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e syscall=
=3D2 =
> success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42=
e0 items=3D0 =
> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D58140000=
1 suid=3D0 =
> fsuid=3D581400001 egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none=
) =
> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } for =
> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D116=
393517 =
> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
> =
> =
>> I suspect that the subsystem cert was renewed and everything wasn't
>> updated properly. If I'm right this is unrelated to the upgrade it just
>> shone a spotlight on it.
>>
>> Can you run these commands:
>>
>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>
> =
> This returns
> =
> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
> ... stuff ...
> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
> Subsystem,O=3DBPT.ROCKS
> =
>> and
>>
>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>> cert-pki-ca' | grep Serial
>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>> cert-pki-ca' -a
>>
> =
> These both return
> =
> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
> cert-pki-ca' | grep Serial
> Enter Password or Pin for "NSS Certificate DB":
> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized =
> Object Identifier.
> =
> =
> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
> cert-pki-ca' -a
> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private =
> Key and Certificate Services"
> Enter Password or Pin for "NSS Certificate DB":
> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized =
> Object Identifier.
> =
Hi,
you made a typo and requested the keys (-K) instead of the certs (-L). =
Please retry with -L and you should be able to see the certificate serial.
Flo.
> =
> which seems weird.
> =
>> The description attribute in the ldapsearch output is of the form =
>> 2;#;DN;DN
>>
>> The # should match the serial number in the first certutil output
>>
>> The ASCII blob (minus the BEGIN/END headers) should match one of the
>> userCertificate attributes.
>>
>> rob
>>
>=20
--===============3295431487290206174==--
From ianh at brownpapertickets.com Wed Aug 2 23:08:08 2017
Content-Type: multipart/mixed; boundary="===============4390725634595251771=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Wed, 02 Aug 2017 14:51:47 -0700
Message-ID: <829dc322-a677-7aad-7724-b12b4b35ab18@brownpapertickets.com>
In-Reply-To: b839bdc7-0e5a-c365-48cf-81ab2bf119f7@redhat.com
--===============4390725634595251771==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
> On 08/02/2017 01:43 AM, Ian Harding wrote:
>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>> Ian Harding wrote:
>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>> apparently had
>>>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd
>>>>>>>>>> would
>>>>>>>>>> not start.
>>>>>>>>>>
>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> dogtag is an application within tomcat so tomcat can run without
>>>>>>>>> dogtag
>>>>>>>>> running.
>>>>>>>>>
>>>>>>>>> We need to see more of the dogtag debug log to see what is =
>>>>>>>>> going on.
>>>>>>>>>
>>>>>>>>
>>>>>>>> It looks like an authentication problem...
>>>>>>>>
>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake =
>>>>>>>> happened
>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636
>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>>
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>> the lines:
>>>>>>>
>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>
>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>
>>>>>>> You can use this information to manually check the credentials. For
>>>>>>> instance with sslclientauth:
>>>>>>>
>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>
>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>
>>>>>>
>>>>>> I found this:
>>>>>>
>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>> ...
>>>>>>
>>>>>> and when I try the ldapsearch I am presented with a prompt to provide
>>>>>> a pin/password
>>>>>>
>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>> 'ldap(0)':
>>>>>>
>>>>>> but there is no password file...
>>>>>>
>>>>> Hi,
>>>>>
>>>>> you are right, in 4.4. there is no pwdfile.txt and the password can be
>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>>> internal=3D...)
>>>>>
>>>>> Can you check if the password with the tag internal=3D... allows to r=
ead
>>>>> the keys from the NSS db?
>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>> (provide password)
>>>>
>>>> That works...
>>>>
>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private
>>>> Key and Certificate Services"
>>>> Enter Password or Pin for "NSS Certificate DB":
>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>> Certificate
>>>> DB:auditSigningCert cert-pki-ca
>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>> cert-pki-ca
>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>> Certificate
>>>> DB:ocspSigningCert cert-pki-ca
>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>> cert-pki-ca
>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>> Certificate
>>>> DB:subsystemCert cert-pki-ca
>>>>
>>>> But this doesn't (with the same password from password.conf)
>>>>
>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>> Please enter pin, password, or pass phrase for security token =
>>>> 'ldap(0)':
>>>> SASL/EXTERNAL authentication started
>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>
>>>> That password is getting me somewhere though, since if I put in a
>>>> nonsense or incorrect password it just prompts over and over.
>>>
>>> Let's step back a second. You upgraded from what to what?
>>
>> There wasn't much of a change... I just assumed someone ran yum =
>> upgrade and didn't restart, then the power outage... it looks like not =
>> much of a version change though.
>>
>> # grep ipa /var/log/yum.log
>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:45:32 Installed: =
>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>> Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:47:05 Installed: =
>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:47:05 Installed: =
>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:47:06 Installed: =
>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:47:36 Installed: =
>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>
>> # grep pki /var/log/yum.log
>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>
>>
>>>
>>> Are you running in SELinux enforcing mode?
>>
>> # getenforce
>> Enforcing
>>
>>>
>>> If so can you run:
>>>
>>> # ausearch -m AVC
>>>
>>
>> # ausearch -m AVC
>> The NOLOG option to log_format is deprecated. Please use the =
>> write_logs option.
>> The NOLOG option is overriding the write_logs current setting.
>> ----
>> time->Mon Mar 14 10:39:01 2016
>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e syscal=
l=3D2 =
>> success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f4=
2e0 =
>> items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 euid=
=3D581400001 =
>> suid=3D0 fsuid=3D581400001 egid=3D581400001 sgid=3D0 fsgid=3D581400001 =
>> tty=3D(none) ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } for =
>> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D11=
6393517 =
>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>
>>
>>> I suspect that the subsystem cert was renewed and everything wasn't
>>> updated properly. If I'm right this is unrelated to the upgrade it just
>>> shone a spotlight on it.
>>>
>>> Can you run these commands:
>>>
>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>
>>
>> This returns
>>
>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>> ... stuff ...
>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>> Subsystem,O=3DBPT.ROCKS
>>
>>> and
>>>
>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>> cert-pki-ca' | grep Serial
>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>> cert-pki-ca' -a
>>>
>>
>> These both return
>>
>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>> cert-pki-ca' | grep Serial
>> Enter Password or Pin for "NSS Certificate DB":
>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>> Unrecognized Object Identifier.
>>
>>
>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>> cert-pki-ca' -a
>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>> Private Key and Certificate Services"
>> Enter Password or Pin for "NSS Certificate DB":
>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>> Unrecognized Object Identifier.
>>
> Hi,
> =
> you made a typo and requested the keys (-K) instead of the certs (-L). =
> Please retry with -L and you should be able to see the certificate serial.
> =
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
...
ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
Subsystem,O=3DBPT.ROCKS
So the serial is 4?
[root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
'subsystemCert cert-pki-ca' | grep Serial
Serial Number: 1341718541 (0x4ff9000d)
Which is NOT 4...
[root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
'subsystemCert cert-pki-ca' -a
-----BEGIN CERTIFICATE-----
MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
...
sjeiFbUFtoMnfmHLIYpe5QAR
-----END CERTIFICATE-----
And this cert is NOT the same.
Thank you again for your time!
Ian
> Flo.
>>
>> which seems weird.
>>
>>> The description attribute in the ldapsearch output is of the form =
>>> 2;#;DN;DN
>>>
>>> The # should match the serial number in the first certutil output
>>>
>>> The ASCII blob (minus the BEGIN/END headers) should match one of the
>>> userCertificate attributes.
>>>
>>> rob
>>>
>>
> =
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============4390725634595251771==--
From flo at redhat.com Thu Aug 3 07:29:46 2017
Content-Type: multipart/mixed; boundary="===============0027247055320873546=="
MIME-Version: 1.0
From: Florence Blanc-Renaud
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Thu, 03 Aug 2017 09:28:49 +0200
Message-ID: <43de55b7-6aff-21e3-0338-ca5f34fa212f@redhat.com>
In-Reply-To: 829dc322-a677-7aad-7724-b12b4b35ab18@brownpapertickets.com
--===============0027247055320873546==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>> Ian Harding wrote:
>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>> apparently had
>>>>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd
>>>>>>>>>>> would
>>>>>>>>>>> not start.
>>>>>>>>>>>
>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> dogtag is an application within tomcat so tomcat can run without
>>>>>>>>>> dogtag
>>>>>>>>>> running.
>>>>>>>>>>
>>>>>>>>>> We need to see more of the dogtag debug log to see what is =
>>>>>>>>>> going on.
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>
>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake =
>>>>>>>>> happened
>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port =
>>>>>>>>> 636
>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>>>
>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>> the lines:
>>>>>>>>
>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>
>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>
>>>>>>>> You can use this information to manually check the credentials. For
>>>>>>>> instance with sslclientauth:
>>>>>>>>
>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>
>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>
>>>>>>>
>>>>>>> I found this:
>>>>>>>
>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>> ...
>>>>>>>
>>>>>>> and when I try the ldapsearch I am presented with a prompt to =
>>>>>>> provide
>>>>>>> a pin/password
>>>>>>>
>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>> 'ldap(0)':
>>>>>>>
>>>>>>> but there is no password file...
>>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> you are right, in 4.4. there is no pwdfile.txt and the password =
>>>>>> can be
>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>>>> internal=3D...)
>>>>>>
>>>>>> Can you check if the password with the tag internal=3D... allows to =
>>>>>> read
>>>>>> the keys from the NSS db?
>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>> (provide password)
>>>>>
>>>>> That works...
>>>>>
>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>> Private
>>>>> Key and Certificate Services"
>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>> Certificate
>>>>> DB:auditSigningCert cert-pki-ca
>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>>> cert-pki-ca
>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>> Certificate
>>>>> DB:ocspSigningCert cert-pki-ca
>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>> cert-pki-ca
>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>> Certificate
>>>>> DB:subsystemCert cert-pki-ca
>>>>>
>>>>> But this doesn't (with the same password from password.conf)
>>>>>
>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>> Please enter pin, password, or pass phrase for security token =
>>>>> 'ldap(0)':
>>>>> SASL/EXTERNAL authentication started
>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>
>>>>> That password is getting me somewhere though, since if I put in a
>>>>> nonsense or incorrect password it just prompts over and over.
>>>>
>>>> Let's step back a second. You upgraded from what to what?
>>>
>>> There wasn't much of a change... I just assumed someone ran yum =
>>> upgrade and didn't restart, then the power outage... it looks like =
>>> not much of a version change though.
>>>
>>> # grep ipa /var/log/yum.log
>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:45:32 Installed: =
>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>> Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:47:05 Installed: =
>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:47:05 Installed: =
>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:47:06 Installed: =
>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:47:36 Installed: =
>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>
>>> # grep pki /var/log/yum.log
>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>
>>>
>>>>
>>>> Are you running in SELinux enforcing mode?
>>>
>>> # getenforce
>>> Enforcing
>>>
>>>>
>>>> If so can you run:
>>>>
>>>> # ausearch -m AVC
>>>>
>>>
>>> # ausearch -m AVC
>>> The NOLOG option to log_format is deprecated. Please use the =
>>> write_logs option.
>>> The NOLOG option is overriding the write_logs current setting.
>>> ----
>>> time->Mon Mar 14 10:39:01 2016
>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e sysca=
ll=3D2 =
>>> success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f=
42e0 =
>>> items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 =
>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 sgid=3D0 =
>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" =
>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>> key=3D(null)
>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } fo=
r =
>>> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D1=
16393517 =
>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>
>>>
>>>> I suspect that the subsystem cert was renewed and everything wasn't
>>>> updated properly. If I'm right this is unrelated to the upgrade it just
>>>> shone a spotlight on it.
>>>>
>>>> Can you run these commands:
>>>>
>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>
>>>
>>> This returns
>>>
>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>> ... stuff ...
>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>> Subsystem,O=3DBPT.ROCKS
>>>
>>>> and
>>>>
>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>> cert-pki-ca' | grep Serial
>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>> cert-pki-ca' -a
>>>>
>>>
>>> These both return
>>>
>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>> cert-pki-ca' | grep Serial
>>> Enter Password or Pin for "NSS Certificate DB":
>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>> Unrecognized Object Identifier.
>>>
>>>
>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>> cert-pki-ca' -a
>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>> Private Key and Certificate Services"
>>> Enter Password or Pin for "NSS Certificate DB":
>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>> Unrecognized Object Identifier.
>>>
>> Hi,
>>
>> you made a typo and requested the keys (-K) instead of the certs (-L). =
>> Please retry with -L and you should be able to see the certificate =
>> serial.
>>
> =
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
-b =
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
> ...
> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
> Subsystem,O=3DBPT.ROCKS
> =
> So the serial is 4?
> =
> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
> 'subsystemCert cert-pki-ca' | grep Serial
> Serial Number: 1341718541 (0x4ff9000d)
> =
> Which is NOT 4...
> =
> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
> 'subsystemCert cert-pki-ca' -a
> -----BEGIN CERTIFICATE-----
> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
> ...
> sjeiFbUFtoMnfmHLIYpe5QAR
> -----END CERTIFICATE-----
> =
> And this cert is NOT the same.
> =
Hi,
when certmonger renews a certificate, it runs pre-save and post-save =
commands (which you can see in the output of getcert list). In your =
case, the post-save command for subsystemCert cert-pki-ca probably failed.
This command (on the renewal master) is responsible for copying the new =
cert from the NSS db to the LDAP server. You need first to check which =
IPA server is the renewal master (as the serial numbers are in a =
completely different range, I assume that you have multiple IPA servers =
configured with a CA instance):
$ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-`
$ kinit admin
$ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
"cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
'(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
dn: =
cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=
=3Dipadomain,dc=3Dcom
In this example the renewal master is vm-ipaserver.
If your renewal master is the machine on which the NSS DB =
/etc/pki/pki-tomcat/alias contains the newer cert, then you can manually =
run the scripts:
$ sudo /usr/libexec/ipa/certmonger/stop_pkicad
$ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca"
After that, check that the LDAP entry has been updated. If it is the =
case, you should be able to restart pki.
Flo
> Thank you again for your time!
> =
> Ian
> =
>> Flo.
>>>
>>> which seems weird.
>>>
>>>> The description attribute in the ldapsearch output is of the form =
>>>> 2;#;DN;DN
>>>>
>>>> The # should match the serial number in the first certutil output
>>>>
>>>> The ASCII blob (minus the BEGIN/END headers) should match one of the
>>>> userCertificate attributes.
>>>>
>>>> rob
>>>>
>>>
>>
>=20
--===============0027247055320873546==--
From ianh at brownpapertickets.com Thu Aug 3 22:15:44 2017
Content-Type: multipart/mixed; boundary="===============3760006118306233222=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Thu, 03 Aug 2017 14:13:20 -0700
Message-ID: <10d05c35-cf22-6008-8d2b-3ce352357cb1@brownpapertickets.com>
In-Reply-To: 43de55b7-6aff-21e3-0338-ca5f34fa212f@redhat.com
--===============3760006118306233222==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>> Ian Harding wrote:
>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>> apparently had
>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>> would
>>>>>>>>>>>> not start.
>>>>>>>>>>>>
>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run without
>>>>>>>>>>> dogtag
>>>>>>>>>>> running.
>>>>>>>>>>>
>>>>>>>>>>> We need to see more of the dogtag debug log to see what is =
>>>>>>>>>>> going on.
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>
>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake =
>>>>>>>>>> happened
>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks =
>>>>>>>>>> port 636
>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look =
>>>>>>>>> for
>>>>>>>>> the lines:
>>>>>>>>>
>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>
>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>
>>>>>>>>> You can use this information to manually check the credentials. =
>>>>>>>>> For
>>>>>>>>> instance with sslclientauth:
>>>>>>>>>
>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>
>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>
>>>>>>>>
>>>>>>>> I found this:
>>>>>>>>
>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>> ...
>>>>>>>>
>>>>>>>> and when I try the ldapsearch I am presented with a prompt to =
>>>>>>>> provide
>>>>>>>> a pin/password
>>>>>>>>
>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>> 'ldap(0)':
>>>>>>>>
>>>>>>>> but there is no password file...
>>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the password =
>>>>>>> can be
>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>>>>> internal=3D...)
>>>>>>>
>>>>>>> Can you check if the password with the tag internal=3D... allows to =
>>>>>>> read
>>>>>>> the keys from the NSS db?
>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>> (provide password)
>>>>>>
>>>>>> That works...
>>>>>>
>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>> Private
>>>>>> Key and Certificate Services"
>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>> Certificate
>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>> caSigningCert
>>>>>> cert-pki-ca
>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>> Certificate
>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>> cert-pki-ca
>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>> Certificate
>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>
>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>
>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>> 'ldap(0)':
>>>>>> SASL/EXTERNAL authentication started
>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>
>>>>>> That password is getting me somewhere though, since if I put in a
>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>
>>>>> Let's step back a second. You upgraded from what to what?
>>>>
>>>> There wasn't much of a change... I just assumed someone ran yum =
>>>> upgrade and didn't restart, then the power outage... it looks like =
>>>> not much of a version change though.
>>>>
>>>> # grep ipa /var/log/yum.log
>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:45:32 Installed: =
>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>> Jan 08 04:47:04 Installed: =
>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:47:05 Installed: =
>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:47:05 Installed: =
>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:47:06 Installed: =
>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:47:36 Installed: =
>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>
>>>> # grep pki /var/log/yum.log
>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>
>>>>
>>>>>
>>>>> Are you running in SELinux enforcing mode?
>>>>
>>>> # getenforce
>>>> Enforcing
>>>>
>>>>>
>>>>> If so can you run:
>>>>>
>>>>> # ausearch -m AVC
>>>>>
>>>>
>>>> # ausearch -m AVC
>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>> write_logs option.
>>>> The NOLOG option is overriding the write_logs current setting.
>>>> ----
>>>> time->Mon Mar 14 10:39:01 2016
>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e =
>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 =
>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295 =
uid=3D0 =
>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 s=
gid=3D0 =
>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" =
>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>> key=3D(null)
>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } f=
or =
>>>> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" =
>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>
>>>>
>>>>> I suspect that the subsystem cert was renewed and everything wasn't
>>>>> updated properly. If I'm right this is unrelated to the upgrade it =
>>>>> just
>>>>> shone a spotlight on it.
>>>>>
>>>>> Can you run these commands:
>>>>>
>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>
>>>>
>>>> This returns
>>>>
>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>> ... stuff ...
>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>> Subsystem,O=3DBPT.ROCKS
>>>>
>>>>> and
>>>>>
>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>> cert-pki-ca' | grep Serial
>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>> cert-pki-ca' -a
>>>>>
>>>>
>>>> These both return
>>>>
>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>> cert-pki-ca' | grep Serial
>>>> Enter Password or Pin for "NSS Certificate DB":
>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>> Unrecognized Object Identifier.
>>>>
>>>>
>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>> cert-pki-ca' -a
>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>> Private Key and Certificate Services"
>>>> Enter Password or Pin for "NSS Certificate DB":
>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>> Unrecognized Object Identifier.
>>>>
>>> Hi,
>>>
>>> you made a typo and requested the keys (-K) instead of the certs =
>>> (-L). Please retry with -L and you should be able to see the =
>>> certificate serial.
>>>
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>> ...
>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>> Subsystem,O=3DBPT.ROCKS
>>
>> So the serial is 4?
>>
>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>> 'subsystemCert cert-pki-ca' | grep Serial
>> Serial Number: 1341718541 (0x4ff9000d)
>>
>> Which is NOT 4...
>>
>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>> 'subsystemCert cert-pki-ca' -a
>> -----BEGIN CERTIFICATE-----
>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>> ...
>> sjeiFbUFtoMnfmHLIYpe5QAR
>> -----END CERTIFICATE-----
>>
>> And this cert is NOT the same.
>>
> Hi,
> =
> when certmonger renews a certificate, it runs pre-save and post-save =
> commands (which you can see in the output of getcert list). In your =
> case, the post-save command for subsystemCert cert-pki-ca probably failed.
> =
> This command (on the renewal master) is responsible for copying the new =
> cert from the NSS db to the LDAP server. You need first to check which =
> IPA server is the renewal master (as the serial numbers are in a =
> completely different range, I assume that you have multiple IPA servers =
> configured with a CA instance):
> =
> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-`
> $ kinit admin
> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
> dn: =
> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=
=3Dipadomain,dc=3Dcom =
> =
> =
> In this example the renewal master is vm-ipaserver.
> =
I get this
$ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
"cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
'(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
dn: cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=3D=
bpt,dc=3Drocks
Which is the other FreeIPA server.
> If your renewal master is the machine on which the NSS DB =
> /etc/pki/pki-tomcat/alias contains the newer cert, then you can manually =
> run the scripts:
If I'm interpreting this correctly, then it is... so I ran this on the =
broken machine (seattlenfs)
> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
> cert-pki-ca"
> =
I ran this, it took a while, then I re-checked and the serial still =
seems to be 4
$ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
...
ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
Subsystem,O=3DBPT.ROCKS
Here's what was in /var/log/pki/pki-tomcat/ca/debug
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUBSY=
STEM =
INITIALIZED =3D=3D=3D=3D=3D=3D=3D
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
autoShutdown? false
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3Dde=
bug
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized debug
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem =
id=3Dlog
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init =
id=3Dlog
[03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
[03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
[03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
autoShutdown? false
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3Dlog
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized log
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem =
id=3Djss
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init =
id=3Djss
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
autoShutdown? false
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown =
crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look =
for cert for auto-shutdown support:auditSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
cert:auditSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3Djss
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized jss
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem =
id=3Ddbs
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init =
id=3Ddbs
[03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() =
mEnableSerialMgmt=3Dtrue
[03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
LdapBoundConnFactor(DBSubsystem)
[03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: init
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
LdapBoundConnFactory:doCloning true
[03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
[03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins
[03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends
[03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
makeConnection errorIfDown is true
[03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
errorIfDown true
[03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
subsystemCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set =
client auth cert nickname subsystemCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
SSLClientCertificatSelectionCB: Entering!
[03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
ocspSigningCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
subsystemCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
SSLClientCertificateSelectionCB: desired cert found in list: =
subsystemCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: =
SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
[03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened
[03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
I really appreciate you sticking with me through this. I owe you.
- Ian
> After that, check that the LDAP entry has been updated. If it is the =
> case, you should be able to restart pki.
> =
> Flo
> =
>> Thank you again for your time!
>>
>> Ian
>>
>>> Flo.
>>>>
>>>> which seems weird.
>>>>
>>>>> The description attribute in the ldapsearch output is of the form =
>>>>> 2;#;DN;DN
>>>>>
>>>>> The # should match the serial number in the first certutil output
>>>>>
>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of the
>>>>> userCertificate attributes.
>>>>>
>>>>> rob
>>>>>
>>>>
>>>
>>
> =
-- =
Ian Harding
IT Director
Brown Paper Tickets
1-800-838-3006 ext 7186
http://www.brownpapertickets.com
--===============3760006118306233222==--
From flo at redhat.com Fri Aug 4 09:17:44 2017
Content-Type: multipart/mixed; boundary="===============7421681902227138929=="
MIME-Version: 1.0
From: Florence Blanc-Renaud
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Fri, 04 Aug 2017 11:16:49 +0200
Message-ID:
In-Reply-To: 10d05c35-cf22-6008-8d2b-3ce352357cb1@brownpapertickets.com
--===============7421681902227138929==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>> Ian Harding wrote:
>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>>> apparently had
>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>> would
>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run =
>>>>>>>>>>>> without
>>>>>>>>>>>> dogtag
>>>>>>>>>>>> running.
>>>>>>>>>>>>
>>>>>>>>>>>> We need to see more of the dogtag debug log to see what is =
>>>>>>>>>>>> going on.
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>
>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake =
>>>>>>>>>>> happened
>>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks =
>>>>>>>>>>> port 636
>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> Hi,
>>>>>>>>>>
>>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, =
>>>>>>>>>> look for
>>>>>>>>>> the lines:
>>>>>>>>>>
>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-=
ca
>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>
>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>
>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>> credentials. For
>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>
>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>
>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> I found this:
>>>>>>>>>
>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca
>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>> ...
>>>>>>>>>
>>>>>>>>> and when I try the ldapsearch I am presented with a prompt to =
>>>>>>>>> provide
>>>>>>>>> a pin/password
>>>>>>>>>
>>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>>> 'ldap(0)':
>>>>>>>>>
>>>>>>>>> but there is no password file...
>>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the password =
>>>>>>>> can be
>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>>>>>> internal=3D...)
>>>>>>>>
>>>>>>>> Can you check if the password with the tag internal=3D... allows =
>>>>>>>> to read
>>>>>>>> the keys from the NSS db?
>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>> (provide password)
>>>>>>>
>>>>>>> That works...
>>>>>>>
>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>>> Private
>>>>>>> Key and Certificate Services"
>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>> Certificate
>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>>>>> cert-pki-ca
>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>> Certificate
>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>> cert-pki-ca
>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>> Certificate
>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>
>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>
>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>> 'ldap(0)':
>>>>>>> SASL/EXTERNAL authentication started
>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>
>>>>>>> That password is getting me somewhere though, since if I put in a
>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>
>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>
>>>>> There wasn't much of a change... I just assumed someone ran yum =
>>>>> upgrade and didn't restart, then the power outage... it looks like =
>>>>> not much of a version change though.
>>>>>
>>>>> # grep ipa /var/log/yum.log
>>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:45:32 Installed: =
>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>> Jan 08 04:47:04 Installed: =
>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:47:05 Installed: =
>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:47:05 Installed: =
>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:47:06 Installed: =
>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:47:36 Installed: =
>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:42 Updated: =
>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:43 Updated: =
>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:44 Updated: =
>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:45 Updated: =
>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>> Jul 28 09:55:48 Updated: =
>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>
>>>>> # grep pki /var/log/yum.log
>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>
>>>>>
>>>>>>
>>>>>> Are you running in SELinux enforcing mode?
>>>>>
>>>>> # getenforce
>>>>> Enforcing
>>>>>
>>>>>>
>>>>>> If so can you run:
>>>>>>
>>>>>> # ausearch -m AVC
>>>>>>
>>>>>
>>>>> # ausearch -m AVC
>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>> write_logs option.
>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>> ----
>>>>> time->Mon Mar 14 10:39:01 2016
>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e =
>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 =
>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295=
uid=3D0 =
>>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 =
sgid=3D0 =
>>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" =
>>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>> key=3D(null)
>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } =
>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" =
>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>
>>>>>
>>>>>> I suspect that the subsystem cert was renewed and everything wasn't
>>>>>> updated properly. If I'm right this is unrelated to the upgrade it =
>>>>>> just
>>>>>> shone a spotlight on it.
>>>>>>
>>>>>> Can you run these commands:
>>>>>>
>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>
>>>>>
>>>>> This returns
>>>>>
>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>> ... stuff ...
>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>
>>>>>> and
>>>>>>
>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>> cert-pki-ca' | grep Serial
>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>> cert-pki-ca' -a
>>>>>>
>>>>>
>>>>> These both return
>>>>>
>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>> cert-pki-ca' | grep Serial
>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>> Unrecognized Object Identifier.
>>>>>
>>>>>
>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>> cert-pki-ca' -a
>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>> Private Key and Certificate Services"
>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>> Unrecognized Object Identifier.
>>>>>
>>>> Hi,
>>>>
>>>> you made a typo and requested the keys (-K) instead of the certs =
>>>> (-L). Please retry with -L and you should be able to see the =
>>>> certificate serial.
>>>>
>>>
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>> ...
>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>> Subsystem,O=3DBPT.ROCKS
>>>
>>> So the serial is 4?
>>>
>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>> 'subsystemCert cert-pki-ca' | grep Serial
>>> Serial Number: 1341718541 (0x4ff9000d)
>>>
>>> Which is NOT 4...
>>>
>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>> 'subsystemCert cert-pki-ca' -a
>>> -----BEGIN CERTIFICATE-----
>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>> ...
>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>> -----END CERTIFICATE-----
>>>
>>> And this cert is NOT the same.
>>>
>> Hi,
>>
>> when certmonger renews a certificate, it runs pre-save and post-save =
>> commands (which you can see in the output of getcert list). In your =
>> case, the post-save command for subsystemCert cert-pki-ca probably =
>> failed.
>>
>> This command (on the renewal master) is responsible for copying the =
>> new cert from the NSS db to the LDAP server. You need first to check =
>> which IPA server is the renewal master (as the serial numbers are in a =
>> completely different range, I assume that you have multiple IPA =
>> servers configured with a CA instance):
>>
>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-`
>> $ kinit admin
>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>> dn: =
>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,d=
c=3Dipadomain,dc=3Dcom =
>>
>>
>> In this example the renewal master is vm-ipaserver.
>>
> =
> I get this
> =
> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
> dn: cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=
=3Dbpt,dc=3Drocks
> =
> Which is the other FreeIPA server.
> =
Hi Ian,
it's getting difficult to follow this thread, so could we step back and =
summarize?
- On server freeipa-sea (=3Drenewal master), the CA component is installed =
and 'subsystemCert cert-pki-ca' has Serial number 4 in the NSSDB =
/etc/pki/pki-tomcat/alias
- On server seattlenfs (where PKI fails to restart), the CA component is =
installed and 'subsystemCert cert-pki-ca' has Serial number 1341718541 =
in the NSSDB /etc/pki/pki-tomcat/alias.
- In the LDAP servers, the cert is stored in the entry =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is the =
cert from freeipa-sea).
If you check the certificates dates, I guess that the most recent one is =
on server seattlenfs (because of serial numbers). Can you confirm this =
(because our goal is to have the most recent cert stored in all the =
NSSDBs and in LDAP)?
Thanks,
Flo
>> If your renewal master is the machine on which the NSS DB =
>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>> manually run the scripts:
> =
> If I'm interpreting this correctly, then it is... so I ran this on the =
> broken machine (seattlenfs)
> =
>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>> cert-pki-ca"
>>
> =
> I ran this, it took a while, then I re-checked and the serial still =
> seems to be 4
> =
> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
> ...
> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
> Subsystem,O=3DBPT.ROCKS
> =
> Here's what was in /var/log/pki/pki-tomcat/ca/debug
> =
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUB=
SYSTEM =
> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
> autoShutdown? false
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
> id=3Ddebug
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized deb=
ug
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem =
> id=3Dlog
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init =
> id=3Dlog
> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
> autoShutdown? false
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3D=
log
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized log
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem =
> id=3Djss
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init =
> id=3Djss
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
> autoShutdown? false
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown =
> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look =
> for cert for auto-shutdown support:auditSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
> cert:auditSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3D=
jss
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized jss
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem =
> id=3Ddbs
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init =
> id=3Ddbs
> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() =
> mEnableSerialMgmt=3Dtrue
> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
> LdapBoundConnFactor(DBSubsystem)
> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: init
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> LdapBoundConnFactory:doCloning true
> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins
> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends
> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
> makeConnection errorIfDown is true
> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
> errorIfDown true
> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
> subsystemCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set =
> client auth cert nickname subsystemCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> SSLClientCertificatSelectionCB: Entering!
> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
> ocspSigningCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
> subsystemCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> SSLClientCertificateSelectionCB: desired cert found in list: =
> subsystemCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened
> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
> =
> =
> I really appreciate you sticking with me through this. I owe you.
> =
> - Ian
> =
>> After that, check that the LDAP entry has been updated. If it is the =
>> case, you should be able to restart pki.
>>
>> Flo
>>
>>> Thank you again for your time!
>>>
>>> Ian
>>>
>>>> Flo.
>>>>>
>>>>> which seems weird.
>>>>>
>>>>>> The description attribute in the ldapsearch output is of the form =
>>>>>> 2;#;DN;DN
>>>>>>
>>>>>> The # should match the serial number in the first certutil output
>>>>>>
>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of the
>>>>>> userCertificate attributes.
>>>>>>
>>>>>> rob
>>>>>>
>>>>>
>>>>
>>>
>>
>=20
--===============7421681902227138929==--
From ianh at brownpapertickets.com Fri Aug 4 21:03:34 2017
Content-Type: multipart/mixed; boundary="===============3441199417339637142=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Fri, 04 Aug 2017 14:02:44 -0700
Message-ID: <0d346ba2-7727-f18c-1bda-9cb9b72b1140@brownpapertickets.com>
In-Reply-To: dd5e8cd3-5498-bc55-891c-5da39ced8238@redhat.com
--===============3441199417339637142==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>> Ian Harding wrote:
>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>>>> apparently had
>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>> would
>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run =
>>>>>>>>>>>>> without
>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>> running.
>>>>>>>>>>>>>
>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what is =
>>>>>>>>>>>>> going on.
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>
>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>> handshake happened
>>>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks =
>>>>>>>>>>>> port 636
>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> Hi,
>>>>>>>>>>>
>>>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, =
>>>>>>>>>>> look for
>>>>>>>>>>> the lines:
>>>>>>>>>>>
>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>
>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>
>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>> credentials. For
>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>
>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>
>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>>>>> (provide the password from =
>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> I found this:
>>>>>>>>>>
>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipa=
ca
>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-=
ca
>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>> ...
>>>>>>>>>>
>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt to =
>>>>>>>>>> provide
>>>>>>>>>> a pin/password
>>>>>>>>>>
>>>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>>>> 'ldap(0)':
>>>>>>>>>>
>>>>>>>>>> but there is no password file...
>>>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>> password can be
>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>>>>>>> internal=3D...)
>>>>>>>>>
>>>>>>>>> Can you check if the password with the tag internal=3D... allows =
>>>>>>>>> to read
>>>>>>>>> the keys from the NSS db?
>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>> (provide password)
>>>>>>>>
>>>>>>>> That works...
>>>>>>>>
>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>>>> Private
>>>>>>>> Key and Certificate Services"
>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>> Certificate
>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>>>>>> cert-pki-ca
>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>> Certificate
>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>>> cert-pki-ca
>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>> Certificate
>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>
>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>
>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>> 'ldap(0)':
>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>
>>>>>>>> That password is getting me somewhere though, since if I put in a
>>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>>
>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>
>>>>>> There wasn't much of a change... I just assumed someone ran yum =
>>>>>> upgrade and didn't restart, then the power outage... it looks =
>>>>>> like not much of a version change though.
>>>>>>
>>>>>> # grep ipa /var/log/yum.log
>>>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:45:32 Installed: =
>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>>> Jan 08 04:47:04 Installed: =
>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:47:05 Installed: =
>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:47:05 Updated: =
>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:47:05 Installed: =
>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:47:06 Installed: =
>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>> Jan 08 04:47:27 Updated: =
>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:47:36 Installed: =
>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:42 Updated: =
>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:43 Updated: =
>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:44 Updated: =
>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:45 Updated: =
>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>> Jul 28 09:55:48 Updated: =
>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>
>>>>>> # grep pki /var/log/yum.log
>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>
>>>>>>
>>>>>>>
>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>
>>>>>> # getenforce
>>>>>> Enforcing
>>>>>>
>>>>>>>
>>>>>>> If so can you run:
>>>>>>>
>>>>>>> # ausearch -m AVC
>>>>>>>
>>>>>>
>>>>>> # ausearch -m AVC
>>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>>> write_logs option.
>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>> ----
>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e =
>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D=
1 =
>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D429496729=
5 uid=3D0 =
>>>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001=
sgid=3D0 =
>>>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" =
>>>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c102=
3 =
>>>>>> key=3D(null)
>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } =
>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" =
>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>
>>>>>>
>>>>>>> I suspect that the subsystem cert was renewed and everything wasn't
>>>>>>> updated properly. If I'm right this is unrelated to the upgrade =
>>>>>>> it just
>>>>>>> shone a spotlight on it.
>>>>>>>
>>>>>>> Can you run these commands:
>>>>>>>
>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>
>>>>>>
>>>>>> This returns
>>>>>>
>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>> ... stuff ...
>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>
>>>>>>> and
>>>>>>>
>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>> cert-pki-ca' | grep Serial
>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>> cert-pki-ca' -a
>>>>>>>
>>>>>>
>>>>>> These both return
>>>>>>
>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>> cert-pki-ca' | grep Serial
>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>> Unrecognized Object Identifier.
>>>>>>
>>>>>>
>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>> cert-pki-ca' -a
>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>> Private Key and Certificate Services"
>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>> Unrecognized Object Identifier.
>>>>>>
>>>>> Hi,
>>>>>
>>>>> you made a typo and requested the keys (-K) instead of the certs =
>>>>> (-L). Please retry with -L and you should be able to see the =
>>>>> certificate serial.
>>>>>
>>>>
>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>> ...
>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>> Subsystem,O=3DBPT.ROCKS
>>>>
>>>> So the serial is 4?
>>>>
>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>
>>>> Which is NOT 4...
>>>>
>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>> -n 'subsystemCert cert-pki-ca' -a
>>>> -----BEGIN CERTIFICATE-----
>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>> ...
>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>> -----END CERTIFICATE-----
>>>>
>>>> And this cert is NOT the same.
>>>>
>>> Hi,
>>>
>>> when certmonger renews a certificate, it runs pre-save and post-save =
>>> commands (which you can see in the output of getcert list). In your =
>>> case, the post-save command for subsystemCert cert-pki-ca probably =
>>> failed.
>>>
>>> This command (on the renewal master) is responsible for copying the =
>>> new cert from the NSS db to the LDAP server. You need first to check =
>>> which IPA server is the renewal master (as the serial numbers are in =
>>> a completely different range, I assume that you have multiple IPA =
>>> servers configured with a CA instance):
>>>
>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-`
>>> $ kinit admin
>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>> dn: =
>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,=
dc=3Dipadomain,dc=3Dcom =
>>>
>>>
>>> In this example the renewal master is vm-ipaserver.
>>>
>>
>> I get this
>>
>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>> dn: =
>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=3Db=
pt,dc=3Drocks
>>
>> Which is the other FreeIPA server.
>>
> Hi Ian,
>
> it's getting difficult to follow this thread, so could we step back =
> and summarize?
Yes, it is. Sorry.
>
> - On server freeipa-sea (=3Drenewal master), the CA component is =
> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in the =
> NSSDB /etc/pki/pki-tomcat/alias
No?
[root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
'subsystemCert cert-pki-ca' | grep Serial
Serial Number: 1341718541 (0x4ff9000d)
> - On server seattlenfs (where PKI fails to restart), the CA component =
> is installed and 'subsystemCert cert-pki-ca' has Serial number =
> 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
Yes
[root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
'subsystemCert cert-pki-ca' | grep Serial
Serial Number: 1341718541 (0x4ff9000d)
>
> - In the LDAP servers, the cert is stored in the entry =
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is th=
e =
> cert from freeipa-sea).
This is where the difference is. There are two certificates on the =
master and only one on the other. I wonder if this is a result of the =
slow motion replication trainwreck I have going on due to a zombie =
replica in the ldap database that no longer exists in the real world and =
I can't seem to get rid of.
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
userCertificate:: =
MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
Subsystem
,O=3DBPT.ROCKS
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
Subsystem,O=3DBPT.RO
CKS
> If you check the certificates dates, I guess that the most recent one =
> is on server seattlenfs (because of serial numbers). Can you confirm =
> this (because our goal is to have the most recent cert stored in all =
> the NSSDBs and in LDAP)?
>
> Thanks,
> Flo
>
>
>>> If your renewal master is the machine on which the NSS DB =
>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>>> manually run the scripts:
>>
>> If I'm interpreting this correctly, then it is... so I ran this on =
>> the broken machine (seattlenfs)
>>
>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>>> cert-pki-ca"
>>>
>>
>> I ran this, it took a while, then I re-checked and the serial still =
>> seems to be 4
>>
>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>> ...
>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>> Subsystem,O=3DBPT.ROCKS
>>
>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SU=
BSYSTEM =
>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
>> autoShutdown? false
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>> autoShutdown crumb file path? =
>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>> id=3Ddebug
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized =
>> debug
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>> initSubsystem id=3Dlog
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>> init id=3Dlog
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
>> autoShutdown? false
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>> autoShutdown crumb file path? =
>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>> id=3Dlog
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized =
>> log
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>> initSubsystem id=3Djss
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>> init id=3Djss
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
>> autoShutdown? false
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>> autoShutdown crumb file path? =
>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>> cert:auditSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>> id=3Djss
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized =
>> jss
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>> initSubsystem id=3Ddbs
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>> init id=3Ddbs
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() =
>> mEnableSerialMgmt=3Dtrue
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>> LdapBoundConnFactor(DBSubsystem)
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: =
>> init
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> LdapBoundConnFactory:doCloning true
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>> makeConnection errorIfDown is true
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>> errorIfDown true
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>> subsystemCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set =
>> client auth cert nickname subsystemCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> SSLClientCertificatSelectionCB: Entering!
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>> ocspSigningCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>> subsystemCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> SSLClientCertificateSelectionCB: desired cert found in list: =
>> subsystemCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened
>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
>>
>>
>> I really appreciate you sticking with me through this. I owe you.
>>
>> - Ian
>>
>>> After that, check that the LDAP entry has been updated. If it is the =
>>> case, you should be able to restart pki.
>>>
>>> Flo
>>>
>>>> Thank you again for your time!
>>>>
>>>> Ian
>>>>
>>>>> Flo.
>>>>>>
>>>>>> which seems weird.
>>>>>>
>>>>>>> The description attribute in the ldapsearch output is of the =
>>>>>>> form 2;#;DN;DN
>>>>>>>
>>>>>>> The # should match the serial number in the first certutil output
>>>>>>>
>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of =
>>>>>>> the
>>>>>>> userCertificate attributes.
>>>>>>>
>>>>>>> rob
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>
--===============3441199417339637142==--
From flo at redhat.com Mon Aug 7 07:23:18 2017
Content-Type: multipart/mixed; boundary="===============0930980801637162743=="
MIME-Version: 1.0
From: Florence Blanc-Renaud
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Mon, 07 Aug 2017 09:22:43 +0200
Message-ID: <331efb67-dd3b-2350-3470-5d1a9b9252c3@redhat.com>
In-Reply-To: 0d346ba2-7727-f18c-1bda-9cb9b72b1140@brownpapertickets.com
--===============0930980801637162743==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
> =
>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>> Ian Harding wrote:
>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>>>>> apparently had
>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run =
>>>>>>>>>>>>>> without
>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what is =
>>>>>>>>>>>>>> going on.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>
>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks =
>>>>>>>>>>>>> port 636
>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49)
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> Hi,
>>>>>>>>>>>>
>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to
>>>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, =
>>>>>>>>>>>> look for
>>>>>>>>>>>> the lines:
>>>>>>>>>>>>
>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>
>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>
>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>> credentials. For
>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>
>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>
>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> I found this:
>>>>>>>>>>>
>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dip=
aca
>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki=
-ca
>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>> ...
>>>>>>>>>>>
>>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt to =
>>>>>>>>>>> provide
>>>>>>>>>>> a pin/password
>>>>>>>>>>>
>>>>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>>>>> 'ldap(0)':
>>>>>>>>>>>
>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>
>>>>>>>>>> Hi,
>>>>>>>>>>
>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>> password can be
>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag
>>>>>>>>>> internal=3D...)
>>>>>>>>>>
>>>>>>>>>> Can you check if the password with the tag internal=3D... allows =
>>>>>>>>>> to read
>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>> (provide password)
>>>>>>>>>
>>>>>>>>> That works...
>>>>>>>>>
>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>>>>> Private
>>>>>>>>> Key and Certificate Services"
>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>> Certificate
>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>>>>>>> cert-pki-ca
>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>> Certificate
>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>>>> cert-pki-ca
>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>> Certificate
>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>
>>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>>
>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>>> 'ldap(0)':
>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>
>>>>>>>>> That password is getting me somewhere though, since if I put in a
>>>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>>>
>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>
>>>>>>> There wasn't much of a change... I just assumed someone ran yum =
>>>>>>> upgrade and didn't restart, then the power outage... it looks =
>>>>>>> like not much of a version change though.
>>>>>>>
>>>>>>> # grep ipa /var/log/yum.log
>>>>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>
>>>>>>> # grep pki /var/log/yum.log
>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>
>>>>>>>
>>>>>>>>
>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>
>>>>>>> # getenforce
>>>>>>> Enforcing
>>>>>>>
>>>>>>>>
>>>>>>>> If so can you run:
>>>>>>>>
>>>>>>>> # ausearch -m AVC
>>>>>>>>
>>>>>>>
>>>>>>> # ausearch -m AVC
>>>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>>>> write_logs option.
>>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>>> ----
>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e =
>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=
=3D1 =
>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D42949672=
95 uid=3D0 =
>>>>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D58140000=
1 sgid=3D0 =
>>>>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" =
>>>>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c10=
23 =
>>>>>>> key=3D(null)
>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } =
>>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" =
>>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>
>>>>>>>
>>>>>>>> I suspect that the subsystem cert was renewed and everything wasn't
>>>>>>>> updated properly. If I'm right this is unrelated to the upgrade =
>>>>>>>> it just
>>>>>>>> shone a spotlight on it.
>>>>>>>>
>>>>>>>> Can you run these commands:
>>>>>>>>
>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>
>>>>>>>
>>>>>>> This returns
>>>>>>>
>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>> Enter LDAP Password:
>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>> userCertificate:: =
>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>> ... stuff ...
>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>
>>>>>>>> and
>>>>>>>>
>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>> cert-pki-ca' -a
>>>>>>>>
>>>>>>>
>>>>>>> These both return
>>>>>>>
>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>> cert-pki-ca' | grep Serial
>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>> Unrecognized Object Identifier.
>>>>>>>
>>>>>>>
>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>> cert-pki-ca' -a
>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>>> Private Key and Certificate Services"
>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>> Unrecognized Object Identifier.
>>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> you made a typo and requested the keys (-K) instead of the certs =
>>>>>> (-L). Please retry with -L and you should be able to see the =
>>>>>> certificate serial.
>>>>>>
>>>>>
>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti=
on
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>> ...
>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>
>>>>> So the serial is 4?
>>>>>
>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>
>>>>> Which is NOT 4...
>>>>>
>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>> 'subsystemCert cert-pki-ca' -a
>>>>> -----BEGIN CERTIFICATE-----
>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>> ...
>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>> -----END CERTIFICATE-----
>>>>>
>>>>> And this cert is NOT the same.
>>>>>
>>>> Hi,
>>>>
>>>> when certmonger renews a certificate, it runs pre-save and post-save =
>>>> commands (which you can see in the output of getcert list). In your =
>>>> case, the post-save command for subsystemCert cert-pki-ca probably =
>>>> failed.
>>>>
>>>> This command (on the renewal master) is responsible for copying the =
>>>> new cert from the NSS db to the LDAP server. You need first to check =
>>>> which IPA server is the renewal master (as the serial numbers are in =
>>>> a completely different range, I assume that you have multiple IPA =
>>>> servers configured with a CA instance):
>>>>
>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-`
>>>> $ kinit admin
>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>> dn: =
>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc=
,dc=3Dipadomain,dc=3Dcom =
>>>>
>>>>
>>>> In this example the renewal master is vm-ipaserver.
>>>>
>>>
>>> I get this
>>>
>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>> dn: =
>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=3D=
bpt,dc=3Drocks
>>>
>>> Which is the other FreeIPA server.
>>>
>> Hi Ian,
>>
>> it's getting difficult to follow this thread, so could we step back =
>> and summarize?
> Yes, it is. Sorry.
>>
>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in the =
>> NSSDB /etc/pki/pki-tomcat/alias
> No?
> =
> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
> 'subsystemCert cert-pki-ca' | grep Serial
> Serial Number: 1341718541 (0x4ff9000d)
>> - On server seattlenfs (where PKI fails to restart), the CA component =
>> is installed and 'subsystemCert cert-pki-ca' has Serial number =
>> 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
> Yes
> =
> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
> 'subsystemCert cert-pki-ca' | grep Serial
> Serial Number: 1341718541 (0x4ff9000d)
> =
>>
>> - In the LDAP servers, the cert is stored in the entry =
>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is t=
he =
>> cert from freeipa-sea).
> This is where the difference is. There are two certificates on the =
> master and only one on the other. I wonder if this is a result of the =
> slow motion replication trainwreck I have going on due to a zombie =
> replica in the ldap database that no longer exists in the real world and =
> I can't seem to get rid of.
> =
Hi,
the remaining issue is a replication problem. There is a =
"Troubleshooting replication" section [1] in IdM Admin guide that may =
help you.
Regarding your zombie replica, which commands did you use to try to =
remove it, and what was the output?
Flo
[1] =
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht=
ml/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-replic=
ation.html
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W=
-b =
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>
> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> userCertificate:: =
> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
> description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC=
A =
> Subsystem
> ,O=3DBPT.ROCKS
> =
> =
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
-b =
> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>
> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
> Subsystem,O=3DBPT.RO
> CKS
> =
>> If you check the certificates dates, I guess that the most recent one =
>> is on server seattlenfs (because of serial numbers). Can you confirm =
>> this (because our goal is to have the most recent cert stored in all =
>> the NSSDBs and in LDAP)?
>>
>> Thanks,
>> Flo
>>
>>
>>>> If your renewal master is the machine on which the NSS DB =
>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>>>> manually run the scripts:
>>>
>>> If I'm interpreting this correctly, then it is... so I ran this on =
>>> the broken machine (seattlenfs)
>>>
>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>>>> cert-pki-ca"
>>>>
>>>
>>> I ran this, it took a while, then I re-checked and the serial still =
>>> seems to be 4
>>>
>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>> ...
>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>> Subsystem,O=3DBPT.ROCKS
>>>
>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG S=
UBSYSTEM =
>>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>>> id=3Ddebug
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized =
>>> debug
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>> initSubsystem id=3Dlog
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>> init id=3Dlog
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>>> id=3Dlog
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized =
>>> log
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>> initSubsystem id=3Djss
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>> init id=3Djss
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at =
>>> autoShutdown? false
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>> autoShutdown crumb file path? =
>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>> cert:auditSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>>> id=3Djss
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized =
>>> jss
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>> initSubsystem id=3Ddbs
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>> init id=3Ddbs
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() =
>>> mEnableSerialMgmt=3Dtrue
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>> LdapBoundConnFactor(DBSubsystem)
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: =
>>> init
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> LdapBoundConnFactory:doCloning true
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>> makeConnection errorIfDown is true
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>> errorIfDown true
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>> subsystemCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set =
>>> client auth cert nickname subsystemCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> SSLClientCertificatSelectionCB: Entering!
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>> ocspSigningCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>> subsystemCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>> subsystemCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened
>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
>>>
>>>
>>> I really appreciate you sticking with me through this. I owe you.
>>>
>>> - Ian
>>>
>>>> After that, check that the LDAP entry has been updated. If it is the =
>>>> case, you should be able to restart pki.
>>>>
>>>> Flo
>>>>
>>>>> Thank you again for your time!
>>>>>
>>>>> Ian
>>>>>
>>>>>> Flo.
>>>>>>>
>>>>>>> which seems weird.
>>>>>>>
>>>>>>>> The description attribute in the ldapsearch output is of the =
>>>>>>>> form 2;#;DN;DN
>>>>>>>>
>>>>>>>> The # should match the serial number in the first certutil output
>>>>>>>>
>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of =
>>>>>>>> the
>>>>>>>> userCertificate attributes.
>>>>>>>>
>>>>>>>> rob
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.=
org
--===============0930980801637162743==--
From tbordaz at redhat.com Tue Aug 8 14:53:03 2017
Content-Type: multipart/mixed; boundary="===============5361506650663838278=="
MIME-Version: 1.0
From: thierry bordaz
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Mon, 07 Aug 2017 08:44:58 +0000
Message-ID: <59882871.1000106@redhat.com>
In-Reply-To: 331efb67-dd3b-2350-3470-5d1a9b9252c3@redhat.com
--===============5361506650663838278==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>
>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>> Ian Harding wrote:
>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>>>>>> apparently had
>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run =
>>>>>>>>>>>>>>> without
>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what =
>>>>>>>>>>>>>>> is going on.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed =
>>>>>>>>>>>>>> (49)
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>
>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and =
>>>>>>>>>>>>> needs to
>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, =
>>>>>>>>>>>>> look for
>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>
>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>
>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>
>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>
>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>
>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> I found this:
>>>>>>>>>>>>
>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Di=
paca
>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>> ...
>>>>>>>>>>>>
>>>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt =
>>>>>>>>>>>> to provide
>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>
>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>
>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>
>>>>>>>>>>> Hi,
>>>>>>>>>>>
>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>> password can be
>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with =
>>>>>>>>>>> the tag
>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>
>>>>>>>>>>> Can you check if the password with the tag internal=3D... =
>>>>>>>>>>> allows to read
>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>> (provide password)
>>>>>>>>>>
>>>>>>>>>> That works...
>>>>>>>>>>
>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>> User Private
>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>> Certificate
>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>>>>>>>> cert-pki-ca
>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>> Certificate
>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>>>>> cert-pki-ca
>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>> Certificate
>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>
>>>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>>>
>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL
>>>>>>>>>> Please enter pin, password, or pass phrase for security token =
>>>>>>>>>> 'ldap(0)':
>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>
>>>>>>>>>> That password is getting me somewhere though, since if I put =
>>>>>>>>>> in a
>>>>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>>>>
>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>
>>>>>>>> There wasn't much of a change... I just assumed someone ran yum =
>>>>>>>> upgrade and didn't restart, then the power outage... it looks =
>>>>>>>> like not much of a version change though.
>>>>>>>>
>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>
>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>
>>>>>>>>
>>>>>>>>>
>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>
>>>>>>>> # getenforce
>>>>>>>> Enforcing
>>>>>>>>
>>>>>>>>>
>>>>>>>>> If so can you run:
>>>>>>>>>
>>>>>>>>> # ausearch -m AVC
>>>>>>>>>
>>>>>>>>
>>>>>>>> # ausearch -m AVC
>>>>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>>>>> write_logs option.
>>>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>>>> ----
>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e =
>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=
=3D1 =
>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967=
295 =
>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 =
>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D429=
4967295 =
>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } =
>>>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2=
" =
>>>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>
>>>>>>>>
>>>>>>>>> I suspect that the subsystem cert was renewed and everything =
>>>>>>>>> wasn't
>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>> upgrade it just
>>>>>>>>> shone a spotlight on it.
>>>>>>>>>
>>>>>>>>> Can you run these commands:
>>>>>>>>>
>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>>
>>>>>>>>
>>>>>>>> This returns
>>>>>>>>
>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>> Enter LDAP Password:
>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>> userCertificate:: =
>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>> ... stuff ...
>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>
>>>>>>>>> and
>>>>>>>>>
>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>> cert-pki-ca' -a
>>>>>>>>>
>>>>>>>>
>>>>>>>> These both return
>>>>>>>>
>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>
>>>>>>>>
>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>> cert-pki-ca' -a
>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User =
>>>>>>>> Private Key and Certificate Services"
>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> you made a typo and requested the keys (-K) instead of the certs =
>>>>>>> (-L). Please retry with -L and you should be able to see the =
>>>>>>> certificate serial.
>>>>>>>
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript=
ion
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>> ...
>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>
>>>>>> So the serial is 4?
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>
>>>>>> Which is NOT 4...
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>> -n 'subsystemCert cert-pki-ca' -a
>>>>>> -----BEGIN CERTIFICATE-----
>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>> ...
>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>> -----END CERTIFICATE-----
>>>>>>
>>>>>> And this cert is NOT the same.
>>>>>>
>>>>> Hi,
>>>>>
>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>> post-save commands (which you can see in the output of getcert =
>>>>> list). In your case, the post-save command for subsystemCert =
>>>>> cert-pki-ca probably failed.
>>>>>
>>>>> This command (on the renewal master) is responsible for copying =
>>>>> the new cert from the NSS db to the LDAP server. You need first to =
>>>>> check which IPA server is the renewal master (as the serial =
>>>>> numbers are in a completely different range, I assume that you =
>>>>> have multiple IPA servers configured with a CA instance):
>>>>>
>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-`
>>>>> $ kinit admin
>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>> dn: =
>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Det=
c,dc=3Dipadomain,dc=3Dcom =
>>>>>
>>>>>
>>>>> In this example the renewal master is vm-ipaserver.
>>>>>
>>>>
>>>> I get this
>>>>
>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>> dn: =
>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=
=3Dbpt,dc=3Drocks =
>>>>
>>>>
>>>> Which is the other FreeIPA server.
>>>>
>>> Hi Ian,
>>>
>>> it's getting difficult to follow this thread, so could we step back =
>>> and summarize?
>> Yes, it is. Sorry.
>>>
>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in the =
>>> NSSDB /etc/pki/pki-tomcat/alias
>> No?
>>
>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>> 'subsystemCert cert-pki-ca' | grep Serial
>> Serial Number: 1341718541 (0x4ff9000d)
>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>> component is installed and 'subsystemCert cert-pki-ca' has Serial =
>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>> Yes
>>
>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>> 'subsystemCert cert-pki-ca' | grep Serial
>> Serial Number: 1341718541 (0x4ff9000d)
>>
>>>
>>> - In the LDAP servers, the cert is stored in the entry =
>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is =
the =
>>> cert from freeipa-sea).
>> This is where the difference is. There are two certificates on the =
>> master and only one on the other. I wonder if this is a result of =
>> the slow motion replication trainwreck I have going on due to a =
>> zombie replica in the ldap database that no longer exists in the real =
>> world and I can't seem to get rid of.
>>
> Hi,
>
> the remaining issue is a replication problem. There is a =
> "Troubleshooting replication" section [1] in IdM Admin guide that may =
> help you.
>
> Regarding your zombie replica, which commands did you use to try to =
> remove it, and what was the output?
>
> Flo
>
> [1] =
> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/=
html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-repl=
ication.html
>
Hi,
To debug replication latency or problem we would need several info but =
starting with the results of the following commands
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
"uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
and
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
From the output you may only copy/past the ones related to userCertificate
Also to dump the current replication status, send the result of
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
"o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-=
ffffffff-ffffffff))"
and
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
"o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-=
ffffffff-ffffffff))"
Regards
thierry
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>
>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> userCertificate:: =
>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>> description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D=
CA =
>> Subsystem
>> ,O=3DBPT.ROCKS
>>
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>
>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>> Subsystem,O=3DBPT.RO
>> CKS
>>
>>> If you check the certificates dates, I guess that the most recent =
>>> one is on server seattlenfs (because of serial numbers). Can you =
>>> confirm this (because our goal is to have the most recent cert =
>>> stored in all the NSSDBs and in LDAP)?
>>>
>>> Thanks,
>>> Flo
>>>
>>>
>>>>> If your renewal master is the machine on which the NSS DB =
>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>>>>> manually run the scripts:
>>>>
>>>> If I'm interpreting this correctly, then it is... so I ran this on =
>>>> the broken machine (seattlenfs)
>>>>
>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>>>>> cert-pki-ca"
>>>>>
>>>>
>>>> I ran this, it took a while, then I re-checked and the serial still =
>>>> seems to be 4
>>>>
>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>> ...
>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>> Subsystem,O=3DBPT.ROCKS
>>>>
>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG =
>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>> at autoShutdown? false
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>>>> id=3Ddebug
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> initialized debug
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> initSubsystem id=3Dlog
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>>> init id=3Dlog
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>> at autoShutdown? false
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>>>> id=3Dlog
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> initialized log
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> initSubsystem id=3Djss
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>>> init id=3Djss
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>> at autoShutdown? false
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> autoShutdown crumb file path? =
>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>> cert:auditSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init =
>>>> id=3Djss
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> initialized jss
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>> initSubsystem id=3Ddbs
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>>> init id=3Ddbs
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() =
>>>> mEnableSerialMgmt=3Dtrue
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>> LdapBoundConnFactor(DBSubsystem)
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> LdapBoundConnFactory: init
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> LdapBoundConnFactory:doCloning true
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init =
>>>> begins
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>> makeConnection errorIfDown is true
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>>> errorIfDown true
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>>> subsystemCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: =
>>>> set client auth cert nickname subsystemCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> SSLClientCertificatSelectionCB: Entering!
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>> ocspSigningCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>> subsystemCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>> subsystemCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened
>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
>>>>
>>>>
>>>> I really appreciate you sticking with me through this. I owe you.
>>>>
>>>> - Ian
>>>>
>>>>> After that, check that the LDAP entry has been updated. If it is =
>>>>> the case, you should be able to restart pki.
>>>>>
>>>>> Flo
>>>>>
>>>>>> Thank you again for your time!
>>>>>>
>>>>>> Ian
>>>>>>
>>>>>>> Flo.
>>>>>>>>
>>>>>>>> which seems weird.
>>>>>>>>
>>>>>>>>> The description attribute in the ldapsearch output is of the =
>>>>>>>>> form 2;#;DN;DN
>>>>>>>>>
>>>>>>>>> The # should match the serial number in the first certutil output
>>>>>>>>>
>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one =
>>>>>>>>> of the
>>>>>>>>> userCertificate attributes.
>>>>>>>>>
>>>>>>>>> rob
>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to =
>> freeipa-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to =
> freeipa-users-leave(a)lists.fedorahosted.org
--===============5361506650663838278==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm
LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPGJyPgogICAgPGJyPgogICAgPGRpdiBjbGFz
cz0ibW96LWNpdGUtcHJlZml4Ij5PbiAwOC8wNy8yMDE3IDA5OjIyIEFNLCBGbG9yZW5jZQogICAg
ICBCbGFuYy1SZW5hdWQgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAg
ICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQx
YTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0LzIwMTcgMTE6
MDIgUE0sIElhbiBIYXJkaW5nIHZpYSBGcmVlSVBBLXVzZXJzCiAgICAgIHdyb3RlOgogICAgICA8
YnI+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDgvNC8xNyAyOjE2IEFNLCBGbG9y
ZW5jZSBCbGFuYy1SZW5hdWQKICAgICAgICB3cm90ZToKICAgICAgICA8YnI+CiAgICAgICAgPGJy
PgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6MTMgUE0s
IElhbiBIYXJkaW5nIHZpYQogICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZToKICAgICAgICAg
IDxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTI6
MjggQU0sIEZsb3JlbmNlCiAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZToKICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3
IDExOjUxIFBNLCBJYW4gSGFyZGluZwogICAgICAgICAgICAgIHZpYSBGcmVlSVBBLXVzZXJzIHdy
b3RlOgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj
aXRlIj5PbiAwOC8wMi8yMDE3IDEyOjExIEFNLCBGbG9yZW5jZQogICAgICAgICAgICAgICAgQmxh
bmMtUmVuYXVkIHdyb3RlOgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAwMTo0MyBBTSwgSWFuCiAgICAgICAg
ICAgICAgICAgIEhhcmRpbmcgd3JvdGU6CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAxMjowMyBQTSwg
Um9iCiAgICAgICAgICAgICAgICAgICAgQ3JpdHRlbmRlbiB3cm90ZToKICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFu
IEhhcmRpbmcgd3JvdGU6CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDA3OjM5IEFNLAog
ICAgICAgICAgICAgICAgICAgICAgICBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6CiAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv
dGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAwMzoxMSBQTSwKICAgICAgICAgICAgICAgICAg
ICAgICAgICBJYW4gSGFyZGluZyB3cm90ZToKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgv
MDEvMjAxNyAwMTo0OAogICAgICAgICAgICAgICAgICAgICAgICAgICAgQU0sIEZsb3JlbmNlIEJs
YW5jLVJlbmF1ZCB3cm90ZToKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIw
MTcgMDE6MzIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQU0sIElhbiBIYXJkaW5nIHZp
YSBGcmVlSVBBLXVzZXJzIHdyb3RlOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT24gMDcvMzEv
MjAxNyAxMTozNCBBTSwgUm9iIENyaXR0ZW5kZW4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICB3cm90ZToKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFuIEhhcmRp
bmcgdmlhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIHdy
b3RlOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBoYWQgYW4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdW5leHBlY3RlZCByZXN0YXJ0IG9mIGFu
IElQQSBzZXJ2ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhhdCBoYWQg
YXBwYXJlbnRseSBoYWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1cGRhdGVzIHJ1biBidXQgaGFkIG5v
dCBiZWVuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJlc3RhcnRlZC4gaXBh
Y3RsIHNheXMgcGtpLXRvbWNhdGQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3b3VsZAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIG5vdCBzdGFydC4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIFN0cmFuZ2VseSwgdGhlIGFjdHVhbCBzZXJ2aWNlCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFwcGVhcnMgdG8gYmUgcnVubmluZzoK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgaXMgYW4gYXBwbGljYXRpb24g
d2l0aGluIHRvbWNhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc28gdG9tY2F0
IGNhbiBydW4gd2l0aG91dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBy
dW5uaW5nLgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgV2UgbmVlZCB0byBzZWUgbW9yZSBvZiB0aGUgZG9ndGFnCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBkZWJ1ZyBsb2cgdG8gc2VlIHdoYXQgaXMgZ29pbmcgb24uCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBJdCBsb29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0aW9uCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgcHJvYmxlbS4uLgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNTTCBoYW5k
c2hha2UgaGFwcGVuZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgQ291bGQgbm90IGNvbm5lY3QgdG8gTERBUCBzZXJ2
ZXIgaG9zdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlYXR0bGVuZnMuYnB0LnJv
Y2tzIHBvcnQgNjM2CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yIG5ldHNjYXBlLmxkYXAuTERBUEV4Y2VwdGlv
bjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRoZW50aWNhdGlvbiBmYWlsZWQg
KDQ5KQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxv
Y2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBIaSwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGRvZ3RhZyBzdG9yZXMgaXRzIGludGVybmFsIGRhdGEgaW4gdGhlCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIExEQVAgc2VydmVyIGFuZCBuZWVkcyB0bwogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVzdGFi
bGlzaCBhIHNlY3VyZSBMREFQIGNvbm5lY3Rpb24uIFlvdQogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBjYW4gY2hlY2sgaG93IHRoaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25uZWN0aW9uIGlzIGNvbmZpZ3Vy
ZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9j
YS9DUy5jZmcsIGxvb2sgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xD
bGllbnRBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49Y249RGlyZWN0b3J5
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1hbmFnZXIKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5h
bGRiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lz
dGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGludGVybmFsZGIubGRhcGNvbm4uaG9zdD12bS0uLi4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBj
b25uLnBvcnQ9NjM2CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5zZWN1cmVDb25uCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRodHlwZSBjYW4gYmUgU3Ns
Q2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0aGVudGljYXRpb24g
d2l0aCBhIHNzbAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGNlcnRpZmljYXRlKSBvciBCYXNpY0F1dGggKGF1dGhlbnRpY2F0
aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGggYSBiaW5kIEROIGFuZAogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIHBhc3N3b3JkIHN0b3JlZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFy
L2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYpLgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgWW91IGNhbiB1c2UgdGhpcyBpbmZvcm1hdGlvbiB0
byBtYW51YWxseQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjaGVjayB0aGUgY3JlZGVu
dGlhbHMuIEZvcgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGluc3RhbmNlIHdpdGggc3NsY2xpZW50YXV0aDoKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBMREFQVExTX0NBQ0VSVERJUj0vZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgZXhwb3J0IExEQVBUTFNfQ0VSVD0nc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGxkYXBzZWFyY2ggLUggPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVl
dGV4dCIgaHJlZj0ibGRhcHM6Ly8iPmxkYXBzOi8vPC9hPmBob3N0bmFtZWA6NjM2IC1iICIiCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1zIGJhc2UgLVkgRVhURVJOQUwKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAo
cHJvdmlkZSB0aGUgcGFzc3dvcmQgZnJvbQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAv
ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzL3B3ZGZpbGUudHh0KQogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczoKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGF1dGguYXV0
aHR5cGU9U3NsQ2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgppbnRl
cm5hbGRiLmxkYXBhdXRoLmJpbmRETj11aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5hbGRiCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5h
bGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5jbG9u
ZVJlcGxpY2F0aW9uUG9ydD0zODkKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIC4uLgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgYW5kIHdoZW4gSSB0cnkgdGhlIGxkYXBzZWFyY2ggSSBhbSBwcmVzZW50ZWQKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGggYSBwcm9tcHQgdG8gcHJvdmlkZQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBw
aW4vcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSBl
bnRlciBwaW4sIHBhc3N3b3JkLCBvciBwYXNzIHBocmFzZQogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgZm9yIHNlY3VyaXR5IHRva2VuICdsZGFwKDApJzoKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZCBmaWxlLi4uCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg
ICAgICAgICAgIEhpLAogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgeW91IGFyZSByaWdo
dCwgaW4gNC40LiB0aGVyZSBpcyBubyBwd2RmaWxlLnR4dAogICAgICAgICAgICAgICAgICAgICAg
ICAgIGFuZCB0aGUgcGFzc3dvcmQgY2FuIGJlCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgIGZvdW5kIGluCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29yZC5jb25mCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgKHdpdGggdGhlIHRhZwogICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4pCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRoIHRo
ZSB0YWcKICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4gYWxsb3dzIHRvIHJl
YWQKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPwogICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2kt
dG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIChwcm92aWRlIHBhc3N3b3JkKQogICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQgd29ya3MuLi4KICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9wa2kvcGtpLXRvbWNh
dC9hbGlhcwogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTIENlcnRpZmljYXRlIERCIiBpbgogICAg
ICAgICAgICAgICAgICAgICAgICBzbG90ICJOU1MgVXNlciBQcml2YXRlCiAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgS2V5IGFuZCBDZXJ0aWZpY2F0
ZSBTZXJ2aWNlcyIKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9yICJOU1MgQ2VydGlmaWNhdGUgREIiOgog
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICZsdDsg
MCZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgIDBmMzI3ZTc2MGE3ZWVjZGNmNjk3M2Y1
ZGM1N2NhNTM2N2M1OTJkNjTCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgIChvcnBoYW4pCiAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAx
Jmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgYjEyNTgwYzdjNjk2Y2ZjZDhhZWZjOTQw
NWE3YTg3MGIyNGI3Yjk2YcKgwqAgTlNTCiAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmlj
YXRlCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
REI6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgMiZndDsgcnNhCiAgICAgICAgICAgICAg
ICAgICAgICAgIDg4MWI3MjU0YzQwZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAg
ICAgICAgICAgICAgICAgICAgY2FTaWduaW5nQ2VydAogICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0OyByc2EKICAgICAg
ICAgICAgICAgICAgICAgICAgZmE5YTI1NWExZDE1NTg1YWMyODA2NGMwZjQ5ODZlNDE2YmM0ODQw
M8KgwqAgTlNTCiAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlCiAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdD
ZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgJmx0OyA0Jmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgM2ZiNjA5
ZDBmN2Q3MmMyZDMyNWQ2YTJkYzE2NTc3YTdmN2U1YTAxZgogICAgICAgICAgICAgICAgICAgICAg
ICBTZXJ2ZXItQ2VydAogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgJmx0OyA1Jmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAg
MWU5NDc5YTk1NTZhZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAgTlNTCiAgICAgICAg
ICAgICAgICAgICAgICAgIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgREI6c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYQogICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgQnV0IHRoaXMgZG9lc24ndCAod2l0aCB0aGUgc2FtZSBwYXNz
d29yZCBmcm9tCiAgICAgICAgICAgICAgICAgICAgICAgIHBhc3N3b3JkLmNvbmYpCiAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAjIGxkYXBzZWFyY2ggLUggPGEgY2xhc3M9Im1vei10eHQtbGluay1m
cmVldGV4dCIgaHJlZj0ibGRhcHM6Ly8iPmxkYXBzOi8vPC9hPmBob3N0bmFtZWA6NjM2IC1iICIi
IC1zCiAgICAgICAgICAgICAgICAgICAgICAgIGJhc2UgLVkgRVhURVJOQUwKICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgZW50ZXIgcGlu
LCBwYXNzd29yZCwgb3IgcGFzcyBwaHJhc2UgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgIHNl
Y3VyaXR5IHRva2VuICdsZGFwKDApJzoKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICBTQVNML0VYVEVSTkFMIGF1dGhlbnRpY2F0aW9uIHN0YXJ0ZWQK
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBsZGFw
X3Nhc2xfaW50ZXJhY3RpdmVfYmluZF9zOiBJbnZhbGlkCiAgICAgICAgICAgICAgICAgICAgICAg
IGNyZWRlbnRpYWxzICg0OSkKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQgcGFzc3dvcmQg
aXMgZ2V0dGluZyBtZSBzb21ld2hlcmUgdGhvdWdoLAogICAgICAgICAgICAgICAgICAgICAgICBz
aW5jZSBpZiBJIHB1dCBpbiBhCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgbm9uc2Vuc2Ugb3IgaW5jb3JyZWN0IHBhc3N3b3JkIGl0IGp1c3QgcHJv
bXB0cwogICAgICAgICAgICAgICAgICAgICAgICBvdmVyIGFuZCBvdmVyLgogICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBMZXQncyBzdGVwIGJh
Y2sgYSBzZWNvbmQuIFlvdSB1cGdyYWRlZCBmcm9tIHdoYXQKICAgICAgICAgICAgICAgICAgICAg
IHRvIHdoYXQ/CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICBUaGVyZSB3YXNuJ3QgbXVjaCBvZiBhIGNoYW5nZS4uLiBJIGp1c3QgYXNzdW1lZAogICAgICAg
ICAgICAgICAgICAgIHNvbWVvbmUgcmFuIHl1bSB1cGdyYWRlIGFuZCBkaWRuJ3QgcmVzdGFydCwg
dGhlbiB0aGUKICAgICAgICAgICAgICAgICAgICBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MgbGlr
ZSBub3QgbXVjaCBvZiBhIHZlcnNpb24KICAgICAgICAgICAgICAgICAgICBjaGFuZ2UgdGhvdWdo
LgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgIyBncmVwIGlwYSAvdmFyL2xvZy95dW0ubG9nCiAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6
CiAgICAgICAgICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5u
b2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4
IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1v
bi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAgICAgICAgICAg
ICAgICAgICAgbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0CiAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNyBVcGRhdGVk
OgogICAgICAgICAgICAgICAgICAgIHB5dGhvbi1saWJpcGFfaGJhYy0xLjE0LjAtNDMuZWw3XzMu
NC54ODZfNjQKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFu
IDA4IDA0OjQ2OjA4IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICBweXRob24taXBhZGRy
ZXNzLTEuMC4xNi0yLmVsNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg
ICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3Rh
bGxlZDoKICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcu
Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgaXBhLWFk
bWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAg
ICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4x
LjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEph
biAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFz
ZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAg
ICAgICAgICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NAogICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTcgVXBkYXRl
ZDoKICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4x
Lng4Nl82NAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKYW4g
MDggMDQ6NDc6MjMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLTQuNC4w
LTE0LmVsNy5jZW50b3MuMS4xLng4Nl82NAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjM2IEluc3Rh
bGxlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcu
Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtcHl0
aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NAogICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAg
ICAgICAgICAgICAgICBpcGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQy
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC1jb21tb24tNC40LjAtMTQu
ZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBpcGEt
c2VydmVyLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgog
ICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhbGliLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5u
b2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSnVsIDI4
IDA5OjU1OjQ0IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFjbGllbnQt
NC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAg
ICAgICBweXRob24yLWlwYXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NSBV
cGRhdGVkOgogICAgICAgICAgICAgICAgICAgIGlwYS1hZG1pbnRvb2xzLTQuNC4wLTE0LmVsNy5j
ZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgSnVsIDI4IDA5OjU1OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVu
dC00LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAg
ICAgICAgIGlwYS1zZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NAogICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRl
ZDoKICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2VudG9z
Ljcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEp1
bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgIGlwYS1weXRob24tY29t
cGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICMgZ3JlcCBwa2kg
L3Zhci9sb2cveXVtLmxvZwogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDY6MDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBwa2ktYmFz
ZS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowOSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAg
IGtyYjUtcGtpbml0LTEuMTQuMS0yNy5lbDdfMy54ODZfNjQKICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IEluc3RhbGxlZDoKICAgICAg
ICAgICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2gKICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVw
ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcGtpLXRvb2xzLTEwLjMuMy0xNC5lbDdfMy54ODZf
NjQKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0
OjQ3OjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQu
ZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
IEphbiAwOCAwNDo0NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgIHBraS1rcmEtMTAu
My4zLTE0LmVsN18zLm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBwa2kt
Y2EtMTAuMy4zLTE0LmVsN18zLm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRhdGVkOgogICAgICAgICAg
ICAgICAgICAgIHBraS1iYXNlLWphdmEtMTAuMy4zLTE5LmVsN18zLm5vYXJjaAogICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRl
ZDoKICAgICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE5LmVsN18zLng4Nl82NAog
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6
MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMuMy0xOS5lbDdf
My5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSnVs
IDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4zLjMt
MTkuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgIHBraS1jYS0x
MC4zLjMtMTkuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICBBcmUgeW91IHJ1bm5pbmcgaW4gU0VMaW51eCBlbmZvcmNpbmcg
bW9kZT8KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Js
b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICMg
Z2V0ZW5mb3JjZQogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBF
bmZvcmNpbmcKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgSWYgc28gY2FuIHlvdSBydW46
CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQwogICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwv
YmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
IyBhdXNlYXJjaCAtbSBBVkMKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgVGhlIE5PTE9HIG9wdGlvbiB0byBsb2dfZm9ybWF0IGlzIGRlcHJlY2F0ZWQuIFBsZWFz
ZQogICAgICAgICAgICAgICAgICAgIHVzZSB0aGUgd3JpdGVfbG9ncyBvcHRpb24uCiAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gaXMg
b3ZlcnJpZGluZyB0aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgIGN1cnJlbnQgc2V0
dGluZy4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgLS0tLQog
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICB0aW1lLSZndDtNb24g
TWFyIDE0IDEwOjM5OjAxIDIwMTYKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgdHlwZT1TWVNDQUxMIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6CiAg
ICAgICAgICAgICAgICAgICAgYXJjaD1jMDAwMDAzZSBzeXNjYWxsPTIgc3VjY2Vzcz1ubyBleGl0
PS0xMwogICAgICAgICAgICAgICAgICAgIGEwPTdmYmNhYjAzOGQxMCBhMT04MDAgYTI9MSBhMz03
ZmJjYTYwZjQyZTAgaXRlbXM9MAogICAgICAgICAgICAgICAgICAgIHBwaWQ9MTQwNiBwaWQ9MTI5
NjUgYXVpZD00Mjk0OTY3Mjk1IHVpZD0wIGdpZD0wCiAgICAgICAgICAgICAgICAgICAgZXVpZD01
ODE0MDAwMDEgc3VpZD0wIGZzdWlkPTU4MTQwMDAwMSBlZ2lkPTU4MTQwMDAwMQogICAgICAgICAg
ICAgICAgICAgIHNnaWQ9MCBmc2dpZD01ODE0MDAwMDEgdHR5PShub25lKSBzZXM9NDI5NDk2NzI5
NQogICAgICAgICAgICAgICAgICAgIGNvbW09InNzaGQiIGV4ZT0iL3Vzci9zYmluL3NzaGQiCiAg
ICAgICAgICAgICAgICAgICAgc3Viaj1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAu
YzEwMjMKICAgICAgICAgICAgICAgICAgICBrZXk9KG51bGwpCiAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2
NzoxNzUzNyk6IGF2YzrCoAogICAgICAgICAgICAgICAgICAgIGRlbmllZCB7IHJlYWQgfSBmb3Ig
cGlkPTEyOTY1IGNvbW09InNzaGQiCiAgICAgICAgICAgICAgICAgICAgbmFtZT0iYXV0aG9yaXpl
ZF9rZXlzIiBkZXY9ImRtLTIiIGlubz0xMTYzOTM1MTcKICAgICAgICAgICAgICAgICAgICBzY29u
dGV4dD1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAuYzEwMjMKICAgICAgICAgICAg
ICAgICAgICB0Y29udGV4dD1zeXN0ZW1fdTpvYmplY3Rfcjp1bmxhYmVsZWRfdDpzMAogICAgICAg
ICAgICAgICAgICAgIHRjbGFzcz1maWxlCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBzdXNwZWN0IHRoYXQgdGhlIHN1YnN5c3Rl
bQogICAgICAgICAgICAgICAgICAgICAgY2VydCB3YXMgcmVuZXdlZCBhbmQgZXZlcnl0aGluZyB3
YXNuJ3QKICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHVw
ZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0aGlzIGlzIHVucmVsYXRlZAogICAgICAgICAg
ICAgICAgICAgICAgdG8gdGhlIHVwZ3JhZGUgaXQganVzdAogICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgc2hvbmUgYSBzcG90bGlnaHQgb24gaXQuCiAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICBDYW4geW91IHJ1biB0aGVzZSBjb21tYW5kczoKICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICQgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVz
ZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAg
ICBkZXNjcmlwdGlvbgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgVGhpcyByZXR1cm5zCiAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAg
ICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlm
aWNhdGUKICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbgogICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOgogICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1w
ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB
Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAuLi4gc3R1ZmYgLi4uCiAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxW
YTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAg
ICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MK
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPmFuZAogICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgIyBjZXJ0dXRpbCAtTCAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAg
ICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwKICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwgLWQg
L2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5
c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hCiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgog
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBUaGVzZSBib3RoIHJl
dHVybgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2Fs
aWFzIC1uCiAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIHwg
Z3JlcCBTZXJpYWwKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
RW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlIERCIjoKICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlz
dGluZyBrZXlzOgogICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lE
OiBVbnJlY29nbml6ZWQgT2JqZWN0CiAgICAgICAgICAgICAgICAgICAgSWRlbnRpZmllci4KICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMv
cGtpL3BraS10b21jYXQvYWxpYXPCoCAtbgogICAgICAgICAgICAgICAgICAgICdzdWJzeXN0ZW1D
ZXJ0IGNlcnQtcGtpLWNhJyAtYQogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIgaW4K
ICAgICAgICAgICAgICAgICAgICBzbG90ICJOU1MgVXNlciBQcml2YXRlIEtleSBhbmQgQ2VydGlm
aWNhdGUgU2VydmljZXMiCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6CiAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVt
IGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVE
X09JRDogVW5yZWNvZ25pemVkIE9iamVjdAogICAgICAgICAgICAgICAgICAgIElkZW50aWZpZXIu
CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICBIaSwKICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIHlv
dSBtYWRlIGEgdHlwbyBhbmQgcmVxdWVzdGVkIHRoZSBrZXlzICgtSykgaW5zdGVhZCBvZgogICAg
ICAgICAgICAgICAgICB0aGUgY2VydHMgKC1MKS4gUGxlYXNlIHJldHJ5IHdpdGggLUwgYW5kIHlv
dSBzaG91bGQgYmUKICAgICAgICAgICAgICAgICAgYWJsZSB0byBzZWUgdGhlIGNlcnRpZmljYXRl
IHNlcmlhbC4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp
cmVjdG9yeQogICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1w
ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9u
CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3Jk
OgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIs
b3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIHVz
ZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5C
Z2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgIC4uLgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
Wk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPQogICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0
ZQogICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxP
PUJQVC5ST0NLUwogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgU28gdGhlIHNlcmlhbCBpcyA0PwogICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMg
Y2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMg
LW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnCiAgICAgICAgICAgICAgICB8IGdyZXAgU2Vy
aWFsCiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDCoMKg
IFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpCiAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBXaGljaCBpcyBOT1QgNC4u
LgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAg
IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2En
CiAgICAgICAgICAgICAgICAtYQogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICAgICAgICAgICAgICA8YnI+Ck1JSURiakND
QWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMK
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIC4uLgogICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgc2plaUZiVUZ0b01uZm1ITElZcGU1UUFSCiAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBBbmQg
dGhpcyBjZXJ0IGlzIE5PVCB0aGUgc2FtZS4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgSGks
CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICB3aGVu
IGNlcnRtb25nZXIgcmVuZXdzIGEgY2VydGlmaWNhdGUsIGl0IHJ1bnMgcHJlLXNhdmUgYW5kCiAg
ICAgICAgICAgICAgcG9zdC1zYXZlIGNvbW1hbmRzICh3aGljaCB5b3UgY2FuIHNlZSBpbiB0aGUg
b3V0cHV0IG9mCiAgICAgICAgICAgICAgZ2V0Y2VydCBsaXN0KS4gSW4geW91ciBjYXNlLCB0aGUg
cG9zdC1zYXZlIGNvbW1hbmQgZm9yCiAgICAgICAgICAgICAgc3Vic3lzdGVtQ2VydCBjZXJ0LXBr
aS1jYSBwcm9iYWJseSBmYWlsZWQuCiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICBUaGlzIGNvbW1hbmQgKG9uIHRoZSByZW5ld2FsIG1hc3RlcikgaXMg
cmVzcG9uc2libGUgZm9yCiAgICAgICAgICAgICAgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0
aGUgTlNTIGRiIHRvIHRoZSBMREFQIHNlcnZlci4KICAgICAgICAgICAgICBZb3UgbmVlZCBmaXJz
dCB0byBjaGVjayB3aGljaCBJUEEgc2VydmVyIGlzIHRoZSByZW5ld2FsCiAgICAgICAgICAgICAg
bWFzdGVyIChhcyB0aGUgc2VyaWFsIG51bWJlcnMgYXJlIGluIGEgY29tcGxldGVseQogICAgICAg
ICAgICAgIGRpZmZlcmVudCByYW5nZSwgSSBhc3N1bWUgdGhhdCB5b3UgaGF2ZSBtdWx0aXBsZSBJ
UEEKICAgICAgICAgICAgICBzZXJ2ZXJzIGNvbmZpZ3VyZWQgd2l0aCBhIENBIGluc3RhbmNlKToK
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICQgZXhw
b3J0IEJBU0VETj1gZ3JlcCBiYXNlZG4gL2V0Yy9pcGEvZGVmYXVsdC5jb25mIHwgY3V0CiAgICAg
ICAgICAgICAgLWQ9IC1mMi1gCiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICQga2lu
aXQgYWRtaW4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1M
TEwgLVEgLWggYGhvc3RuYW1lYCAtcCAzODkgLVkgR1NTQVBJIC1iCiAgICAgICAgICAgICAgImNu
PW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICcoJmFtcDsoY249
Q0EpKGlwYUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScgZG4KICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgZG46CiAgICAgICAgICAgICAgY249Q0EsY249dm0taXBhc2VydmVy
LmlwYWRvbWFpbi5jb20sY249bWFzdGVycyxjbj1pcGEsY249ZXRjLGRjPWlwYWRvbWFpbixkYz1j
b20KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIElu
IHRoaXMgZXhhbXBsZSB0aGUgcmVuZXdhbCBtYXN0ZXIgaXMgdm0taXBhc2VydmVyLgogICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBJIGdldCB0aGlzCiAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtUSAtaCBgaG9z
dG5hbWVgIC1wIDM4OSAtWSBHU1NBUEkgLWIKICAgICAgICAgICAgImNuPW1hc3RlcnMsY249aXBh
LGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJp
bmc9Y2FSZW5ld2FsTWFzdGVyKSknIGRuCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgZG46
CiAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2VhLmJwdC5yb2Nrcyxjbj1tYXN0ZXJzLGNu
PWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICBXaGljaCBpcyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuCiAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgSGkgSWFuLAogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgaXQn
cyBnZXR0aW5nIGRpZmZpY3VsdCB0byBmb2xsb3cgdGhpcyB0aHJlYWQsIHNvIGNvdWxkIHdlIHN0
ZXAKICAgICAgICAgIGJhY2sgYW5kIHN1bW1hcml6ZT8KICAgICAgICAgIDxicj4KICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgWWVzLCBpdCBpcy7CoCBTb3JyeS4KICAgICAgICA8YnI+CiAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICAt
IE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlIENBIGNvbXBvbmVu
dCBpcwogICAgICAgICAgaW5zdGFsbGVkIGFuZCAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScg
aGFzIFNlcmlhbCBudW1iZXIgNAogICAgICAgICAgaW4gdGhlIE5TU0RCIC9ldGMvcGtpL3BraS10
b21jYXQvYWxpYXMKICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg
Tm8/CiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBp
YW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1u
ICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8IGdyZXAKICAgICAgICBTZXJpYWwKICAgICAg
ICA8YnI+CiAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx
ICgweDRmZjkwMDBkKQogICAgICAgIDxicj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij4tIE9uIHNlcnZlciBzZWF0dGxlbmZzICh3aGVyZSBQS0kgZmFpbHMKICAgICAgICAgIHRvIHJl
c3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50IGlzIGluc3RhbGxlZCBhbmQgJ3N1YnN5c3RlbUNlcnQK
ICAgICAgICAgIGNlcnQtcGtpLWNhJyBoYXMgU2VyaWFsIG51bWJlciAxMzQxNzE4NTQxIGluIHRo
ZSBOU1NEQgogICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcy4KICAgICAgICAgIDxi
cj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgWWVzCiAgICAgICAgPGJyPgogICAgICAg
IDxicj4KICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZCAvZXRj
L3BraS9wa2ktdG9tY2F0L2FsaWFzCiAgICAgICAgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2kt
Y2EnIHwgZ3JlcCBTZXJpYWwKICAgICAgICA8YnI+CiAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBT
ZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKQogICAgICAgIDxicj4KICAgICAg
ICA8YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICA8YnI+CiAg
ICAgICAgICAtIEluIHRoZSBMREFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUg
ZW50cnkKICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2Egd2l0aCBTZXJp
YWwgbnVtYmVyIDQgKGkuZS4gaXQKICAgICAgICAgIGlzIHRoZSBjZXJ0IGZyb20gZnJlZWlwYS1z
ZWEpLgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICBUaGlzIGlz
IHdoZXJlIHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28gY2VydGlmaWNhdGVzIG9u
CiAgICAgICAgdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24gdGhlIG90aGVyLsKgIEkgd29uZGVy
IGlmIHRoaXMgaXMgYQogICAgICAgIHJlc3VsdCBvZiB0aGUgc2xvdyBtb3Rpb24gcmVwbGljYXRp
b24gdHJhaW53cmVjayBJIGhhdmUgZ29pbmcgb24KICAgICAgICBkdWUgdG8gYSB6b21iaWUgcmVw
bGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0IG5vIGxvbmdlcgogICAgICAgIGV4aXN0cyBp
biB0aGUgcmVhbCB3b3JsZCBhbmQgSSBjYW4ndCBzZWVtIHRvIGdldCByaWQgb2YuCiAgICAgICAg
PGJyPgogICAgICAgIDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBIaSwKICAgICAgPGJy
PgogICAgICA8YnI+CiAgICAgIHRoZSByZW1haW5pbmcgaXNzdWUgaXMgYSByZXBsaWNhdGlvbiBw
cm9ibGVtLiBUaGVyZSBpcyBhCiAgICAgICJUcm91Ymxlc2hvb3RpbmcgcmVwbGljYXRpb24iIHNl
Y3Rpb24gWzFdIGluIElkTSBBZG1pbiBndWlkZSB0aGF0CiAgICAgIG1heSBoZWxwIHlvdS4KICAg
ICAgPGJyPgogICAgICA8YnI+CiAgICAgIFJlZ2FyZGluZyB5b3VyIHpvbWJpZSByZXBsaWNhLCB3
aGljaCBjb21tYW5kcyBkaWQgeW91IHVzZSB0byB0cnkKICAgICAgdG8gcmVtb3ZlIGl0LCBhbmQg
d2hhdCB3YXMgdGhlIG91dHB1dD8KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIEZsbwogICAg
ICA8YnI+CiAgICAgIDxicj4KICAgICAgWzFdCjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl
eHQiIGhyZWY9Imh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9S
ZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRo
ZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWwi
Pmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0Vu
dGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlv
bl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgog
ICAgICA8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBIaSw8YnI+CiAgICA8YnI+
CiAgICBUbyBkZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVl
ZCBzZXZlcmFsIGluZm8KICAgIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRzIG9mIHRoZSBm
b2xsb3dpbmcgY29tbWFuZHM8YnI+CiAgICA8YnI+CiAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5o
XSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgIC1XIC1iICJ1
aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICBhbmQ8
YnI+CiAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp
cmVjdG9yeSBtYW5hZ2VyJyAtVwogICAgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj
YSBuc2NwZW50cnl3c2k8YnI+CiAgICA8YnI+CiAgICBGcm9tIHRoZSBvdXRwdXQgeW91IG1heSBv
bmx5IGNvcHkvcGFzdCB0aGUgb25lcyByZWxhdGVkIHRvCiAgICB1c2VyQ2VydGlmaWNhdGU8YnI+
CiAgICA8YnI+CiAgICA8YnI+CiAgICA8Zm9udCBzaXplPSItMSI+PC9mb250PkFsc28gdG8gZHVt
cCB0aGUgY3VycmVudCByZXBsaWNhdGlvbiBzdGF0dXMsCiAgICBzZW5kIHRoZSByZXN1bHTCoCBv
Zjxicj4KICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2Nu
PWRpcmVjdG9yeSBtYW5hZ2VyJwogICAgLVcgLWIgIm89aXBhY2EiPGZvbnQgc2l6ZT0iLTEiPjxp
PiA8L2k+IigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZm
Zi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAgICAgYW5kPGJyPgogICAgPC9m
b250Pltyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0
b3J5CiAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+IDwvaT4i
KCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZm
ZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICA8YnI+CiAgICAgIFJlZ2FyZHM8YnI+
CiAgICAgIHRoaWVycnk8YnI+CiAgICA8L2ZvbnQ+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRl
PSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAg
ICAgIHR5cGU9ImNpdGUiPgogICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5bcm9vdEBmcmVl
aXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMCiAgICAgICAgLUQgJ2NuPWRpcmVjdG9yeSBt
YW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgdXNl
ckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uCiAgICAgICAgPGJyPgogICAgICAgIEVudGVyIExEQVAg
UGFzc3dvcmQ6CiAgICAgICAgPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3Bs
ZSxvPWlwYWNhCiAgICAgICAgPGJyPgogICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAg
TUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtE
QWxDCiAgICAgICAgPGJyPgogICAgICAgIMKgICZsdDt0cnVuY2F0ZWQmZ3Q7CiAgICAgICAgPGJy
PgogICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9G
Yz0KICAgICAgICA8YnI+CiAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICBNSUlEYmpD
Q0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUsKICAg
ICAgICA8YnI+CiAgICAgICAgJmx0O3RydW5jYXRlZCZndDsgZnVRUVptUDFYcktrcmZzamVpRmJV
RnRvTW5mbUhMSVlwZTVRQVIKICAgICAgICA8YnI+CiAgICAgICAgZGVzY3JpcHRpb246IDI7MTM0
MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1D
QSBTdWJzeXN0ZW0KICAgICAgICA8YnI+CiAgICAgICAgwqAgLE89QlBULlJPQ0tTCiAgICAgICAg
PGJyPgogICAgICAgIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBp
YW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2VyJyAt
VyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAg
ICAgIGRlc2NyaXB0aW9uCiAgICAgICAgPGJyPgogICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6
CiAgICAgICAgPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh
CiAgICAgICAgPGJyPgogICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgTUlJRGN6Q0NB
bHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAg
ICAgPGJyPgogICAgICAgIMKgICZsdDt0cnVuY2F0ZWQmZ3Q7CiAgICAgICAgPGJyPgogICAgICAg
IMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAg
ICA8YnI+CiAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHks
Tz1CUFQuUk9DS1M7Q049Q0EKICAgICAgICBTdWJzeXN0ZW0sTz1CUFQuUk8KICAgICAgICA8YnI+
CiAgICAgICAgwqAgQ0tTCiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICA8YmxvY2tx
dW90ZSB0eXBlPSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlIGNlcnRpZmljYXRlcyBkYXRlcywgSQog
ICAgICAgICAgZ3Vlc3MgdGhhdCB0aGUgbW9zdCByZWNlbnQgb25lIGlzIG9uIHNlcnZlciBzZWF0
dGxlbmZzCiAgICAgICAgICAoYmVjYXVzZSBvZiBzZXJpYWwgbnVtYmVycykuIENhbiB5b3UgY29u
ZmlybSB0aGlzIChiZWNhdXNlIG91cgogICAgICAgICAgZ29hbCBpcyB0byBoYXZlIHRoZSBtb3N0
IHJlY2VudCBjZXJ0IHN0b3JlZCBpbiBhbGwgdGhlIE5TU0RCcwogICAgICAgICAgYW5kIGluIExE
QVApPwogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgVGhhbmtzLAogICAg
ICAgICAgPGJyPgogICAgICAgICAgRmxvCiAgICAgICAgICA8YnI+CiAgICAgICAgICA8YnI+CiAg
ICAgICAgICA8YnI+CiAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4KICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWYgeW91ciByZW5ld2FsIG1hc3RlciBpcyB0aGUK
ICAgICAgICAgICAgICBtYWNoaW5lIG9uIHdoaWNoIHRoZSBOU1MgREIgL2V0Yy9wa2kvcGtpLXRv
bWNhdC9hbGlhcwogICAgICAgICAgICAgIGNvbnRhaW5zIHRoZSBuZXdlciBjZXJ0LCB0aGVuIHlv
dSBjYW4gbWFudWFsbHkgcnVuIHRoZQogICAgICAgICAgICAgIHNjcmlwdHM6CiAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgSWYgSSdtIGludGVycHJldGluZyB0aGlzIGNvcnJlY3RseSwgdGhlbiBpdCBpcy4uLiBz
byBJIHJhbgogICAgICAgICAgICB0aGlzIG9uIHRoZSBicm9rZW4gbWFjaGluZSAoc2VhdHRsZW5m
cykKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxibG9ja3F1
b3RlIHR5cGU9ImNpdGUiPiQgc3VkbwogICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2Vy
dG1vbmdlci9zdG9wX3BraWNhZAogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAkIHN1
ZG8gL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X2NhX2NlcnQKICAgICAgICAgICAg
ICAic3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSIKICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgSSByYW4gdGhpcywgaXQgdG9vayBhIHdoaWxlLCB0aGVuIEkgcmUtY2hlY2tlZCBh
bmQgdGhlCiAgICAgICAgICAgIHNlcmlhbCBzdGlsbCBzZWVtcyB0byBiZSA0CiAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAn
Y249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9
cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDoKICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYQogICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgIE1JSURjekNDQWx1
Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgIC4uLgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIMKg
IFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNlcnRpZmljYXRlIEF1dGhv
cml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAgICBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MK
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIEhlcmUncyB3aGF0
IHdhcyBpbiAvdmFyL2xvZy9wa2kvcGtpLXRvbWNhdC9jYS9kZWJ1ZwogICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICA9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogPT09PT3CoCBERUJVRwogICAg
ICAgICAgICBTVUJTWVNURU0gSU5JVElBTElaRUTCoMKgID09PT09PT0KICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIHJlc3RhcnQgYXQg
YXV0b1NodXRkb3duPyBmYWxzZQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAg
ICAgICBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAvdmFyL2xpYi9w
a2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0ZG93bi5jcnVtYgogICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTog
Q01TRW5naW5lOgogICAgICAgICAgICBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNo
dXRkb3duCiAgICAgICAgICAgIHN1cHBvcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQog
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICBmb3VuZCBjZXJ0OmF1ZGl0
U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAg
ICAgICAgICAgZG9uZSBpbml0IGlkPWRlYnVnCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6
CiAgICAgICAgICAgIGluaXRpYWxpemVkIGRlYnVnCiAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdp
bmU6CiAgICAgICAgICAgIGluaXRTdWJzeXN0ZW0gaWQ9bG9nCiAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBD
TVNFbmdpbmU6CiAgICAgICAgICAgIHJlYWR5IHRvIGluaXQgaWQ9bG9nCiAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOiBDcmVhdGluZwogICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtp
LXRvbWNhdC9sb2dzL2NhL3NpZ25lZEF1ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTog
Q3JlYXRpbmcKICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21j
YXQvbG9ncy9jYS9zeXN0ZW0pCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDcmVhdGluZwogICAgICAgICAg
ICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2NhL3RyYW5zYWN0
aW9ucykKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd
W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgcmVzdGFydCBh
dCBhdXRvU2h1dGRvd24/IGZhbHNlCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAg
ICAgICAgIGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgIC92YXIvbGli
L3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iCiAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd
OiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yIGF1dG8t
c2h1dGRvd24KICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh
CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGZvdW5kIGNlcnQ6YXVk
aXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFsw
My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgog
ICAgICAgICAgICBkb25lIGluaXQgaWQ9bG9nCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6
CiAgICAgICAgICAgIGluaXRpYWxpemVkIGxvZwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5l
OgogICAgICAgICAgICBpbml0U3Vic3lzdGVtIGlkPWpzcwogICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01T
RW5naW5lOgogICAgICAgICAgICByZWFkeSB0byBpbml0IGlkPWpzcwogICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XTogQ01TRW5naW5lOgogICAgICAgICAgICByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93bj8gZmFsc2UK
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs
aG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgYXV0b1NodXRkb3duIGNy
dW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9h
dXRvU2h1dGRvd24uY3J1bWIKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAg
ICAgYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICBz
dXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENN
U0VuZ2luZToKICAgICAgICAgICAgZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtp
LWNhCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGRvbmUgaW5pdCBp
ZD1qc3MKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd
W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgaW5pdGlhbGl6
ZWQganNzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx
XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGluaXRTdWJz
eXN0ZW0gaWQ9ZGJzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIHJl
YWR5IHRvIGluaXQgaWQ9ZGJzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBEQlN1YnN5c3RlbToKICAgICAg
ICAgICAgaW5pdCgpIG1FbmFibGVTZXJpYWxNZ210PXRydWUKICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENy
ZWF0aW5nCiAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3IoREJTdWJzeXN0ZW0pCiAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdAogICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgTGRhcEJvdW5kQ29ubkZhY3Rvcnk6ZG9DbG9uaW5n
IHRydWUKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd
W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IExkYXBBdXRoSW5mbzoKICAgICAgICAgICAgaW5pdCgp
CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOiBMZGFwQXV0aEluZm86CiAgICAgICAgICAgIGluaXQgYmVnaW5z
CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOiBMZGFwQXV0aEluZm86CiAgICAgICAgICAgIGluaXQgZW5kcwog
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXTogaW5pdDogYmVmb3JlCiAgICAgICAgICAgIG1ha2VDb25uZWN0aW9u
IGVycm9ySWZEb3duIGlzIHRydWUKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgIG1ha2VD
b25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVlCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBUQ1AKICAgICAg
ICAgICAgS2VlcC1BbGl2ZTogdHJ1ZQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgU1NM
Q2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogU2V0dGluZyBkZXNpcmVkIGNlcnQKICAgICAg
ICAgICAgbmlja25hbWUgdG86IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0
b3AtMV06CiAgICAgICAgICAgIExkYXBKc3NTU0xTb2NrZXQ6IHNldCBjbGllbnQgYXV0aCBjZXJ0
IG5pY2tuYW1lCiAgICAgICAgICAgIHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EKICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06CiAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRTZWxlY3Rpb25DQjogRW50
ZXJpbmchCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx
XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDYW5kaWRhdGUKICAgICAgICAgICAgY2VydDogb2Nz
cFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDYW5kaWRhdGUKICAg
ICAgICAgICAgY2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogZGVzaXJlZCBj
ZXJ0IGZvdW5kIGluIGxpc3Q6CiAgICAgICAgICAgIHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EK
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs
aG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0
aW9uQ0I6IHJldHVybmluZzogc3Vic3lzdGVtQ2VydAogICAgICAgICAgICBjZXJ0LXBraS1jYQog
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXTogU1NMIGhhbmRzaGFrZQogICAgICAgICAgICBoYXBwZW5lZAogICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgQ01TRW5naW5lLnNodXRkb3duKCkKICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgSSBy
ZWFsbHkgYXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoIHRoaXMuwqAgSQog
ICAgICAgICAgICBvd2UgeW91LgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgLSBJYW4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkFmdGVyIHRoYXQsIGNoZWNrIHRoYXQgdGhlIExE
QVAKICAgICAgICAgICAgICBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUgY2Fz
ZSwgeW91IHNob3VsZCBiZQogICAgICAgICAgICAgIGFibGUgdG8gcmVzdGFydCBwa2kuCiAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBGbG8KICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3Rl
IHR5cGU9ImNpdGUiPlRoYW5rIHlvdSBhZ2FpbiBmb3IgeW91ciB0aW1lIQogICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgSWFuCiAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2tx
dW90ZSB0eXBlPSJjaXRlIj5GbG8uCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgIHdoaWNoIHNlZW1zIHdlaXJkLgogICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSI+VGhlIGRlc2NyaXB0aW9uIGF0dHJpYnV0ZSBpbgogICAgICAgICAg
ICAgICAgICAgICAgdGhlIGxkYXBzZWFyY2ggb3V0cHV0IGlzIG9mIHRoZSBmb3JtIDI7IztETjtE
TgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRoZSBzZXJpYWwgbnVtYmVy
IGluIHRoZSBmaXJzdAogICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWwgb3V0cHV0CiAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICBUaGUgQVNDSUkgYmxvYiAobWludXMgdGhlIEJFR0lOL0VORCBoZWFkZXJz
KQogICAgICAgICAgICAgICAgICAgICAgc2hvdWxkIG1hdGNoIG9uZSBvZiB0aGUKICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBh
dHRyaWJ1dGVzLgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgcm9iCiAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv
dGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8YnI+
CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fCiAgICAgICAgPGJyPgogICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tCiAg
ICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZy
ZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5m
ZWRvcmFob3N0ZWQub3JnPC9hPgogICAgICAgIDxicj4KICAgICAgICBUbyB1bnN1YnNjcmliZSBz
ZW5kIGFuIGVtYWlsIHRvCiAgICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRl
ZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y
ZyI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgogICAgICAg
IDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBfX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fXwogICAgICA8YnI+CiAgICAgIEZyZWVJUEEtdXNlcnMgbWFp
bGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1h
aWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnNA
bGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgPGJyPgogICAgICBUbyB1bnN1YnNjcmli
ZSBzZW5kIGFuIGVtYWlsIHRvCiAgICAgIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0
ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5v
cmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAg
PGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo=
--===============5361506650663838278==--
From ianh at brownpapertickets.com Tue Aug 8 20:34:20 2017
Content-Type: multipart/mixed; boundary="===============5624228806415025913=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 08 Aug 2017 13:33:45 -0700
Message-ID: <2f60c4af-680c-4382-9704-41a24c8121a2@brownpapertickets.com>
In-Reply-To: 59882871.1000106@redhat.com
--===============5624228806415025913==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 8/7/17 1:44 AM, thierry bordaz wrote:
>
>
> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>
>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>>>>>>> apparently had
>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can =
>>>>>>>>>>>>>>>> run without
>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what =
>>>>>>>>>>>>>>>> is going on.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed =
>>>>>>>>>>>>>>> (49)
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and =
>>>>>>>>>>>>>> needs to
>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and
>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>
>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3D=
ipaca
>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>> ...
>>>>>>>>>>>>>
>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt =
>>>>>>>>>>>>> to provide
>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>
>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>
>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>
>>>>>>>>>>>> Hi,
>>>>>>>>>>>>
>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>>> password can be
>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with =
>>>>>>>>>>>> the tag
>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>
>>>>>>>>>>>> Can you check if the password with the tag internal=3D... =
>>>>>>>>>>>> allows to read
>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>> (provide password)
>>>>>>>>>>>
>>>>>>>>>>> That works...
>>>>>>>>>>>
>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>>> User Private
>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>> Certificate
>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert
>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>> Certificate
>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>> Certificate
>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>
>>>>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>>>>
>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>> EXTERNAL
>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>
>>>>>>>>>>> That password is getting me somewhere though, since if I put =
>>>>>>>>>>> in a
>>>>>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>>>>>
>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>
>>>>>>>>> There wasn't much of a change... I just assumed someone ran =
>>>>>>>>> yum upgrade and didn't restart, then the power outage... it =
>>>>>>>>> looks like not much of a version change though.
>>>>>>>>>
>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>
>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>
>>>>>>>>> # getenforce
>>>>>>>>> Enforcing
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> If so can you run:
>>>>>>>>>>
>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> # ausearch -m AVC
>>>>>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>>>>>> write_logs option.
>>>>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>>>>> ----
>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e =
>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=
=3D1 =
>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D429496=
7295 =
>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 =
>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) =
>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read =
} =
>>>>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-=
2" =
>>>>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c102=
3 =
>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>> I suspect that the subsystem cert was renewed and everything =
>>>>>>>>>> wasn't
>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>> upgrade it just
>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>
>>>>>>>>>> Can you run these commands:
>>>>>>>>>>
>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> This returns
>>>>>>>>>
>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>> Enter LDAP Password:
>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>> userCertificate:: =
>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>> ... stuff ...
>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>
>>>>>>>>>> and
>>>>>>>>>>
>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>>> cert-pki-ca' -a
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> These both return
>>>>>>>>>
>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>> cert-pki-ca' -a
>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>> User Private Key and Certificate Services"
>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> you made a typo and requested the keys (-K) instead of the =
>>>>>>>> certs (-L). Please retry with -L and you should be able to see =
>>>>>>>> the certificate serial.
>>>>>>>>
>>>>>>>
>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificat=
e =
>>>>>>> description
>>>>>>> Enter LDAP Password:
>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>> userCertificate:: =
>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>> ...
>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>
>>>>>>> So the serial is 4?
>>>>>>>
>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>
>>>>>>> Which is NOT 4...
>>>>>>>
>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>>> -n 'subsystemCert cert-pki-ca' -a
>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>> ...
>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>> -----END CERTIFICATE-----
>>>>>>>
>>>>>>> And this cert is NOT the same.
>>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>> post-save commands (which you can see in the output of getcert =
>>>>>> list). In your case, the post-save command for subsystemCert =
>>>>>> cert-pki-ca probably failed.
>>>>>>
>>>>>> This command (on the renewal master) is responsible for copying =
>>>>>> the new cert from the NSS db to the LDAP server. You need first =
>>>>>> to check which IPA server is the renewal master (as the serial =
>>>>>> numbers are in a completely different range, I assume that you =
>>>>>> have multiple IPA servers configured with a CA instance):
>>>>>>
>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2=
-`
>>>>>> $ kinit admin
>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>> dn: =
>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3De=
tc,dc=3Dipadomain,dc=3Dcom =
>>>>>>
>>>>>>
>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>
>>>>>
>>>>> I get this
>>>>>
>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>> dn: =
>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=
=3Dbpt,dc=3Drocks =
>>>>>
>>>>>
>>>>> Which is the other FreeIPA server.
>>>>>
>>>> Hi Ian,
>>>>
>>>> it's getting difficult to follow this thread, so could we step back =
>>>> and summarize?
>>> Yes, it is. Sorry.
>>>>
>>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in =
>>>> the NSSDB /etc/pki/pki-tomcat/alias
>>> No?
>>>
>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>> 'subsystemCert cert-pki-ca' | grep Serial
>>> Serial Number: 1341718541 (0x4ff9000d)
>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>> component is installed and 'subsystemCert cert-pki-ca' has Serial =
>>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>> Yes
>>>
>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>> 'subsystemCert cert-pki-ca' | grep Serial
>>> Serial Number: 1341718541 (0x4ff9000d)
>>>
>>>>
>>>> - In the LDAP servers, the cert is stored in the entry =
>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is =
>>>> the cert from freeipa-sea).
>>> This is where the difference is. There are two certificates on the =
>>> master and only one on the other. I wonder if this is a result of =
>>> the slow motion replication trainwreck I have going on due to a =
>>> zombie replica in the ldap database that no longer exists in the =
>>> real world and I can't seem to get rid of.
>>>
>> Hi,
>>
>> the remaining issue is a replication problem. There is a =
>> "Troubleshooting replication" section [1] in IdM Admin guide that may =
>> help you.
>>
>> Regarding your zombie replica, which commands did you use to try to =
>> remove it, and what was the output?
>>
>> Flo
>>
>> [1] =
>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7=
/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-rep=
lication.html
>>
>
> Hi,
>
> To debug replication latency or problem we would need several info but =
> starting with the results of the following commands
>
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
"uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
nscpentrywsi: =
entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
75274897
nscpentrywsi: =
modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
90004: 20170608055334Z
nscpentrywsi: =
modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
003: cn=3DDirectory Manager
nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
nscpentrywsi: cn: pkidbuser
nscpentrywsi: createTimestamp: 20150716125146Z
nscpentrywsi: creatorsName: cn=3Ddirectory manager
nscpentrywsi: description;vucsn-5938e688000104290001: =
2;1341718541;CN=3DCertific
ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
2;4;CN=3DCertifica
te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
nscpentrywsi: mail:
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: person
nscpentrywsi: objectClass: organizationalPerson
nscpentrywsi: objectClass: inetOrgPerson
nscpentrywsi: objectClass: cmsuser
nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
nscpentrywsi: sn: pkidbuser
nscpentrywsi: uid: pkidbuser
nscpentrywsi: userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
MIIDbjCCAlagAwIBAgI
AR
nscpentrywsi: userPassword::
nscpentrywsi: userstate: 1
nscpentrywsi: usertype: agentType
nscpentrywsi: parentid: 2
nscpentrywsi: entryid: 51
> and
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
Enter LDAP Password:
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
nscpentrywsi: userCertificate:: =
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
nscpentrywsi: description: 2;4;CN=3DCertificate =
Authority,O=3DBPT.ROCKS;CN=3DCA Subs
ystem,O=3DBPT.ROCKS
nscpentrywsi: entryid: 51
nscpentrywsi: parentid: 2
nscpentrywsi: modifyTimestamp: 20150716125146Z
nscpentrywsi: createTimestamp: 20150716125146Z
nscpentrywsi: modifiersName: cn=3Ddirectory manager
nscpentrywsi: creatorsName: cn=3Ddirectory manager
nscpentrywsi: userPassword::
nscpentrywsi: userstate: 1
nscpentrywsi: usertype: agentType
nscpentrywsi: mail:
nscpentrywsi: cn: pkidbuser
nscpentrywsi: sn: pkidbuser
nscpentrywsi: uid: pkidbuser
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: person
nscpentrywsi: objectClass: organizationalPerson
nscpentrywsi: objectClass: inetOrgPerson
nscpentrywsi: objectClass: cmsuser
nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
nscpentrywsi: entryusn: 86
>
> From the output you may only copy/past the ones related to userCertificate
>
>
> Also to dump the current replication status, send the result of
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b =
> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffffff=
f-ffffffff-ffffffff))"
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
"o=3Dipaca" =
"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ffff=
ffff))"
Enter LDAP Password:
dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
cn: replica
nsDS5Flags: 1
nsDS5ReplicaBindDN: cn=3DReplication Manager =
cloneAgreement1-freeipa-sea.bpt.roc
ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nsDS5ReplicaBindDN: cn=3DReplication Manager =
masterAgreement1-seattlenfs.bpt.roc
ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nsDS5ReplicaId: 1065
nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
nsDS5ReplicaRoot: o=3Dipaca
nsDS5ReplicaType: 3
nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
nsds5replicabinddngroup: cn=3Dreplication =
managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
dc=3Drocks
nsds5replicabinddngroupcheckinterval: 60
objectClass: top
objectClass: nsDS5Replica
objectClass: extensibleobject
nsds50ruv: {replicageneration} 57c291d9000004290000
nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
57f840bf00000429000
0 598a1c40000104290000
nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
nsds5agmtmaxcsn: =
o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
tlenfs.bpt.rocks;389;unavailable
nsds5agmtmaxcsn: =
o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
tlenfs.bpt.rocks;389;unavailable
nsruvReplicaLastModified: {replica 1065 =
ldap://freeipa-sea.bpt.rocks:389} 598a
1c16
nsruvReplicaLastModified: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
00000
000
nsds5ReplicaChangeCount: 885
nsds5replicareapactive: 0
> and
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b =
> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffffff=
f-ffffffff-ffffffff))"
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
"o=3Dipaca" =
"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ffff=
ffff))"
Enter LDAP Password:
dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
cn: replica
nsDS5Flags: 1
nsDS5ReplicaBindDN: cn=3DReplication Manager =
cloneAgreement1-seattlenfs.bpt.rock
s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nsDS5ReplicaId: 1290
nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
nsDS5ReplicaRoot: o=3Dipaca
nsDS5ReplicaType: 3
nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
nsds5replicabinddngroup: cn=3Dreplication =
managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
dc=3Drocks
nsds5replicabinddngroupcheckinterval: 60
objectClass: top
objectClass: nsDS5Replica
objectClass: extensibleobject
nsds50ruv: {replicageneration} 55c8f3ae000000600000
nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
57be804c0000050a0000
587236150000050a0000
nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
57b103d400000429000
0 57be8043000704290000
nsds5agmtmaxcsn: =
o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
pa-sea.bpt.rocks;389;1065;587236150000050a0000
nsruvReplicaLastModified: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
00000
000
nsruvReplicaLastModified: {replica 1065 =
ldap://freeipa-sea.bpt.rocks:389} 0000
0000
nsds5ReplicaChangeCount: 3
nsds5replicareapactive: 0
>
> Regards
> thierry
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>
>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> userCertificate:: =
>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>> description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=
=3DCA =
>>> Subsystem
>>> ,O=3DBPT.ROCKS
>>>
>>>
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>
>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>> Subsystem,O=3DBPT.RO
>>> CKS
>>>
>>>> If you check the certificates dates, I guess that the most recent =
>>>> one is on server seattlenfs (because of serial numbers). Can you =
>>>> confirm this (because our goal is to have the most recent cert =
>>>> stored in all the NSSDBs and in LDAP)?
>>>>
>>>> Thanks,
>>>> Flo
>>>>
>>>>
>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>>>>>> manually run the scripts:
>>>>>
>>>>> If I'm interpreting this correctly, then it is... so I ran this on =
>>>>> the broken machine (seattlenfs)
>>>>>
>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>>>>>> cert-pki-ca"
>>>>>>
>>>>>
>>>>> I ran this, it took a while, then I re-checked and the serial =
>>>>> still seems to be 4
>>>>>
>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>> ...
>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>
>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG =
>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>>> at autoShutdown? false
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> autoShutdown crumb file path? =
>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>> cert:auditSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>> init id=3Ddebug
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> initialized debug
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> initSubsystem id=3Dlog
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>>>> init id=3Dlog
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>>> at autoShutdown? false
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> autoShutdown crumb file path? =
>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>> cert:auditSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>> init id=3Dlog
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> initialized log
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> initSubsystem id=3Djss
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>>>> init id=3Djss
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>>> at autoShutdown? false
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> autoShutdown crumb file path? =
>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to =
>>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>> cert:auditSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>> init id=3Djss
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> initialized jss
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>> initSubsystem id=3Ddbs
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to =
>>>>> init id=3Ddbs
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() =
>>>>> mEnableSerialMgmt=3Dtrue
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> LdapBoundConnFactory: init
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> LdapBoundConnFactory:doCloning true
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init =
>>>>> begins
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init =
>>>>> ends
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>> makeConnection errorIfDown is true
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>>>> errorIfDown true
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: =
>>>>> subsystemCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: =
>>>>> set client auth cert nickname subsystemCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>> ocspSigningCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>> subsystemCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>> subsystemCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened
>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
>>>>>
>>>>>
>>>>> I really appreciate you sticking with me through this. I owe you.
>>>>>
>>>>> - Ian
>>>>>
>>>>>> After that, check that the LDAP entry has been updated. If it is =
>>>>>> the case, you should be able to restart pki.
>>>>>>
>>>>>> Flo
>>>>>>
>>>>>>> Thank you again for your time!
>>>>>>>
>>>>>>> Ian
>>>>>>>
>>>>>>>> Flo.
>>>>>>>>>
>>>>>>>>> which seems weird.
>>>>>>>>>
>>>>>>>>>> The description attribute in the ldapsearch output is of the =
>>>>>>>>>> form 2;#;DN;DN
>>>>>>>>>>
>>>>>>>>>> The # should match the serial number in the first certutil =
>>>>>>>>>> output
>>>>>>>>>>
>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one =
>>>>>>>>>> of the
>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>
>>>>>>>>>> rob
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to =
>>> freeipa-users-leave(a)lists.fedorahosted.org
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to =
>> freeipa-users-leave(a)lists.fedorahosted.org
>
--===============5624228806415025913==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl
bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPHA+T24gOC83LzE3IDE6NDQgQU0sIHRoaWVy
cnkgYm9yZGF6IHdyb3RlOjxicj4KICAgIDwvcD4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
IGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPgogICAgICA8bWV0YSBjb250
ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+
CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgi
Pk9uIDA4LzA3LzIwMTcgMDk6MjIgQU0sIEZsb3JlbmNlCiAgICAgICAgQmxhbmMtUmVuYXVkIHZp
YSBGcmVlSVBBLXVzZXJzIHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3Rl
CiAgICAgICAgY2l0ZT0ibWlkOjMzMWVmYjY3LWRkM2ItMjM1MC0zNDcwLTVkMWE5YjkyNTJjM0By
ZWRoYXQuY29tIgogICAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0LzIwMTcgMTE6MDIgUE0sIElh
biBIYXJkaW5nIHZpYQogICAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICA8
YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiA4LzQvMTcgMjoxNiBBTSwgRmxvcmVuY2UgQmxhbmMt
UmVuYXVkCiAgICAgICAgICB3cm90ZTogPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDMvMjAxNyAxMToxMyBQTSwgSWFuIEhhcmRpbmcK
ICAgICAgICAgICAgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDMvMjAxNyAxMjoyOCBBTSwgRmxvcmVuY2UKICAg
ICAgICAgICAgICBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICA8YmxvY2tx
dW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDExOjUxIFBNLCBJYW4KICAgICAgICAgICAg
ICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAg
IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMTI6MTEgQU0sIEZsb3JlbmNl
CiAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg
ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDAxOjQzIEFNLCBJYW4K
ICAgICAgICAgICAgICAgICAgICBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAxMjowMyBQTSwgUm9iCiAg
ICAgICAgICAgICAgICAgICAgICBDcml0dGVuZGVuIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JYW4gSGFyZGluZyB3cm90ZTogPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8y
MDE3IDA3OjM5IEFNLAogICAgICAgICAgICAgICAgICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJl
bmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5
cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcgMDM6MTEKICAgICAgICAgICAgICAgICAgICAgICAgICAg
IFBNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAwMTo0OAogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBBTSwgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4
LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwMTozMiBBTSwgSWFuIEhh
cmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3
cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5
cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPbiAwNy8zMS8yMDE3IDExOjM0IEFNLCBS
b2IgQ3JpdHRlbmRlbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiPklhbiBIYXJkaW5nCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZpYSBG
cmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkkgaGFkIGFuCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgdW5leHBlY3RlZCByZXN0YXJ0IG9mIGFuIElQQQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciB0aGF0IGhhZCBhcHBhcmVudGx5IGhh
ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXBkYXRlcyBydW4g
YnV0IGhhZCBub3QgYmVlbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJl
c3RhcnRlZC4gaXBhY3RsIHNheXMgcGtpLXRvbWNhdGQKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
d291bGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vdCBzdGFy
dC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdHJhbmdlbHksIHRoZSBhY3R1YWwgc2Vy
dmljZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFwcGVhcnMgdG8gYmUg
cnVubmluZzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGRvZ3RhZyBpcyBhbiBhcHBsaWNhdGlvbiB3aXRoaW4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgdG9tY2F0IHNvIHRvbWNhdCBjYW4gcnVuIHdpdGhvdXQg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nLiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgV2UgbmVlZCB0byBzZWUgbW9yZSBvZiB0aGUgZG9ndGFnCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGRlYnVnIGxvZyB0byBzZWUgd2hhdCBpcyBnb2luZyBvbi4g
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJdCBs
b29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBwcm9ibGVtLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBTU0wgaGFu
ZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENv
dWxkIG5vdCBjb25uZWN0IHRvIExEQVAgc2VydmVyIGhvc3QKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHNlYXR0bGVuZnMuYnB0LnJvY2tzIHBvcnQgNjM2IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yIG5ldHNjYXBlLmxkYXAuTERBUEV4Y2VwdGlv
bjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhlbnRpY2F0aW9uIGZhaWxl
ZCAoNDkpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGRvZ3RhZyBzdG9yZXMgaXRzIGludGVybmFsIGRhdGEgaW4gdGhlCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTERBUCBzZXJ2ZXIgYW5kIG5lZWRzIHRvIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlc3RhYmxpc2ggYSBzZWN1cmUgTERB
UCBjb25uZWN0aW9uLiBZb3UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjYW4gY2hl
Y2sgaG93IHRoaXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rp
b24gaXMgY29uZmlndXJlZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMv
cGtpL3BraS10b21jYXQvY2EvQ1MuY2ZnLCBsb29rIGZvcgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgbGluZXM6
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CmludGVybmFsZGIubGRh
cGF1dGguYXV0aHR5cGU9U3NsQ2xpZW50QXV0aCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49Y249RGlyZWN0b3J5CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgTWFuYWdlciA8YnI+CmludGVybmFsZGIubGRhcGF1dGgu
YmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENl
cnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLmhvc3Q9dm0tLi4uIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLnBvcnQ9NjM2
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25u
LnNlY3VyZUNvbm4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRodHlwZSBjYW4gYmUgU3NsQ2xpZW50QXV0
aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEg
c3NsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSkgb3Ig
QmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9u
IHdpdGggYSBiaW5kIEROIGFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
cGFzc3dvcmQgc3RvcmVkIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9s
aWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29yZC5jb25mKS4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlvdSBjYW4gdXNlIHRoaXMgaW5mb3JtYXRp
b24gdG8gbWFudWFsbHkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjaGVjayB0aGUg
Y3JlZGVudGlhbHMuIEZvciA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW5z
dGFuY2Ugd2l0aCBzc2xjbGllbnRhdXRoOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNfQ0FDRVJURElSPS9ldGMvcGtpL3BraS10
b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgZXhwb3J0IExEQVBUTFNfQ0VSVD0nc3Vic3lzdGVtQ2Vy
dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGxkYXBzZWFyY2ggLUggPGEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBocmVmPSJsZGFwczovLyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwczovLzwv
YT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1iICIiIC1z
IGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChw
cm92aWRlIHRoZSBwYXNzd29yZCBmcm9tCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
L2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczogPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIu
bGRhcGF1dGguYXV0aHR5cGU9U3NsQ2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmluZEROPXVpZD1wa2lkYnVzZXIsb3U9cGVv
cGxlLG89aXBhY2EgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5h
bGRiIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lzdGVt
Q2VydCBjZXJ0LXBraS1jYSA8YnI+CmludGVybmFsZGIubGRhcGNvbm4uY2xvbmVSZXBsaWNhdGlv
blBvcnQ9Mzg5IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBhbmQgd2hlbiBJIHRyeSB0aGUgbGRhcHNlYXJjaCBJIGFtCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IHRvIHByb3ZpZGUgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBhIHBpbi9wYXNzd29yZCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxl
YXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MgcGhyYXNlCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGZvciBzZWN1cml0eSB0b2tlbiAnbGRhcCgwKSc6IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBi
dXQgdGhlcmUgaXMgbm8gcGFzc3dvcmQgZmlsZS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB5b3UgYXJlIHJpZ2h0LCBp
biA0LjQuIHRoZXJlIGlzIG5vCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwd2RmaWxlLnR4
dCBhbmQgdGhlIHBhc3N3b3JkIGNhbiBiZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBmb3VuZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10
b21jYXQvY29uZi9wYXNzd29yZC5jb25mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAod2l0
aCB0aGUgdGFnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsPS4uLikg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgQ2FuIHlvdSBjaGVjayBpZiB0aGUgcGFzc3dvcmQgd2l0aCB0aGUgdGFnCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4gYWxsb3dzIHRvIHJlYWQgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPyA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2kt
dG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIChwcm92aWRlIHBh
c3N3b3JkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBUaGF0
IHdvcmtzLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4g
Ik5TUyBDZXJ0aWZpY2F0ZSBEQiIKICAgICAgICAgICAgICAgICAgICAgICAgICBpbiBzbG90ICJO
U1MgVXNlciBQcml2YXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBLZXkgYW5kIENl
cnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIg
UGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgREIiOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAwJmd0OyByc2EK
ICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdjYTUz
NjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgIChvcnBoYW4pIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDEmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAg
ICAgICAgIGIxMjU4MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4NzBiMjRiN2I5NmHCoMKgIE5TUwog
ICAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICBEQjphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAmbHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAg
IDg4MWI3MjU0YzQwZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAg
ICAgICAgICAgICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBj
ZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0OyByc2EK
ICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlhMjU1YTFkMTU1ODVhYzI4MDY0YzBmNDk4NmU0
MTZiYzQ4NDAzwqDCoCBOU1MKICAgICAgICAgICAgICAgICAgICAgICAgICBDZXJ0aWZpY2F0ZSA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtp
LWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQogICAgICAg
ICAgICAgICAgICAgICAgICAgIDNmYjYwOWQwZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3ZjdlNWEw
MWYKICAgICAgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICZsdDsgNSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5NDc5YTk1NTZhZjkz
MzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAgTlNTCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3Rl
bUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhpcyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lIHBh
c3N3b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNzd29yZC5jb25mKSA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICMgbGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1v
ei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imxk
YXBzOi8vIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXBzOi8vPC9hPmBob3N0bmFtZWA6NjM2
CiAgICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIgLXMgYmFzZSAtWSBFWFRFUk5BTCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9y
IHBhc3MgcGhyYXNlIGZvcgogICAgICAgICAgICAgICAgICAgICAgICAgIHNlY3VyaXR5IHRva2Vu
ICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFNBU0wvRVhURVJOQUwg
YXV0aGVudGljYXRpb24gc3RhcnRlZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgbGRh
cF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczogSW52YWxpZAogICAgICAgICAgICAgICAgICAgICAg
ICAgIGNyZWRlbnRpYWxzICg0OSkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29t
ZXdoZXJlIHRob3VnaCwKICAgICAgICAgICAgICAgICAgICAgICAgICBzaW5jZSBpZiBJIHB1dCBp
biBhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBub25zZW5zZSBvciBpbmNvcnJlY3Qg
cGFzc3dvcmQgaXQganVzdCBwcm9tcHRzCiAgICAgICAgICAgICAgICAgICAgICAgICAgb3ZlciBh
bmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgTGV0J3Mgc3Rl
cCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQgZnJvbSB3aGF0CiAgICAgICAgICAgICAgICAg
ICAgICAgIHRvIHdoYXQ/IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFRoZXJlIHdh
c24ndCBtdWNoIG9mIGEgY2hhbmdlLi4uIEkganVzdCBhc3N1bWVkCiAgICAgICAgICAgICAgICAg
ICAgICBzb21lb25lIHJhbiB5dW0gdXBncmFkZSBhbmQgZGlkbid0IHJlc3RhcnQsIHRoZW4KICAg
ICAgICAgICAgICAgICAgICAgIHRoZSBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MgbGlrZSBub3Qg
bXVjaCBvZiBhCiAgICAgICAgICAgICAgICAgICAgICB2ZXJzaW9uIGNoYW5nZSB0aG91Z2guIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgZ3Jl
cCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg
MDQ6NDU6MzIgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQu
MC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFu
IDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQt
Y29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICBKYW4gMDggMDQ6NDY6MDYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGxp
YmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDY6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIHB5dGhv
bi1saWJpcGFfaGJhYy0xLjE0LjAtNDMuZWw3XzMuNC54ODZfNjQgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjQ2OjA4IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg
IHB5dGhvbi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICBKYW4gMDggMDQ6NDc6MDQgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAg
cHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICBpcGEtYWRtaW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5u
b2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxl
ZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5j
ZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6
MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40
LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEph
biAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgc3NzZC1pcGEtMS4x
NC4wLTQzLmVsN18zLjQueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw
NDo0NzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC00LjQuMC0x
NC5lbDcuY2VudG9zLjEuMS54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4
IDA0OjQ3OjIzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLTQuNC4w
LTE0LmVsNy5jZW50b3MuMS4xLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4g
MDggMDQ6NDc6MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItZG5z
LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICBKYW4gMDggMDQ6NDc6MzYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLXB5
dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgIEphbiAwOCAwNDo1MDowNyBFcmFzZWQ6CiAgICAgICAgICAgICAgICAgICAg
ICBpcGEtcHl0aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAgICAgICAgICAg
ICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDIgVXBkYXRlZDoKICAgICAgICAgICAgICAg
ICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJy
PgogICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQzIFVwZGF0ZWQ6CiAgICAgICAg
ICAgICAgICAgICAgICBpcGEtc2VydmVyLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9h
cmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgog
ICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy43
Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDQgVXBkYXRl
ZDoKICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhY2xpZW50LTQuNC4wLTE0LmVsNy5j
ZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ1
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYXNlcnZlci00LjQuMC0x
NC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAw
OTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40
LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwg
MjggMDk6NTU6NDYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40
LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwg
MjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40
LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwg
MjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItZG5z
LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAg
SnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9u
LWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgZ3JlcCBwa2kgL3Zhci9sb2cveXVt
LmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDUgVXBkYXRlZDoK
ICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJy
PgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA5IFVwZGF0ZWQ6CiAgICAgICAg
ICAgICAgICAgICAgICBrcmI1LXBraW5pdC0xLjE0LjEtMjcuZWw3XzMueDg2XzY0IDxicj4KICAg
ICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAg
ICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVwZGF0ZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAg
IHBraS1zZXJ2ZXItMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIHBraS1r
cmEtMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4g
MDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMt
MTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzox
NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtMTAuMy4zLTE5LmVsN18z
Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRl
ZDoKICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEtMTAuMy4zLTE5LmVsN18zLm5v
YXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoK
ICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTkuZWw3XzMueDg2XzY0IDxi
cj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAg
ICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAg
ICAgICAgICAgcGtpLWtyYS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg
cGtpLWNhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgQXJlIHlv
dSBydW5uaW5nIGluIFNFTGludXggZW5mb3JjaW5nIG1vZGU/IDxicj4KICAgICAgICAgICAgICAg
ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICMgZ2V0ZW5mb3JjZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBFbmZv
cmNpbmcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
SWYgc28gY2FuIHlvdSBydW46IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0g
QVZDIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gdG8gbG9nX2Zv
cm1hdCBpcyBkZXByZWNhdGVkLgogICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIHVzZSB0aGUg
d3JpdGVfbG9ncyBvcHRpb24uIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBv
cHRpb24gaXMgb3ZlcnJpZGluZyB0aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgICAg
Y3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAtLS0tIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgIHRpbWUtJmd0O01vbiBNYXIgMTQgMTA6Mzk6MDEgMjAxNiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NBTEwgbXNnPWF1ZGl0KDE0NTc5NzcxNDEu
NzY3OjE3NTM3KToKICAgICAgICAgICAgICAgICAgICAgIGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0y
IHN1Y2Nlc3M9bm8gZXhpdD0tMTMKICAgICAgICAgICAgICAgICAgICAgIGEwPTdmYmNhYjAzOGQx
MCBhMT04MDAgYTI9MSBhMz03ZmJjYTYwZjQyZTAKICAgICAgICAgICAgICAgICAgICAgIGl0ZW1z
PTAgcHBpZD0xNDA2IHBpZD0xMjk2NSBhdWlkPTQyOTQ5NjcyOTUgdWlkPTAKICAgICAgICAgICAg
ICAgICAgICAgIGdpZD0wIGV1aWQ9NTgxNDAwMDAxIHN1aWQ9MCBmc3VpZD01ODE0MDAwMDEKICAg
ICAgICAgICAgICAgICAgICAgIGVnaWQ9NTgxNDAwMDAxIHNnaWQ9MCBmc2dpZD01ODE0MDAwMDEg
dHR5PShub25lKQogICAgICAgICAgICAgICAgICAgICAgc2VzPTQyOTQ5NjcyOTUgY29tbT0ic3No
ZCIgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgIHN1Ymo9c3lzdGVt
X3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICBr
ZXk9KG51bGwpIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDIG1zZz1hdWRpdCgx
NDU3OTc3MTQxLjc2NzoxNzUzNyk6IGF2YzrCoAogICAgICAgICAgICAgICAgICAgICAgZGVuaWVk
IHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUgY29tbT0ic3NoZCIKICAgICAgICAgICAgICAgICAgICAg
IG5hbWU9ImF1dGhvcml6ZWRfa2V5cyIgZGV2PSJkbS0yIiBpbm89MTE2MzkzNTE3CiAgICAgICAg
ICAgICAgICAgICAgICBzY29udGV4dD1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAu
YzEwMjMKICAgICAgICAgICAgICAgICAgICAgIHRjb250ZXh0PXN5c3RlbV91Om9iamVjdF9yOnVu
bGFiZWxlZF90OnMwCiAgICAgICAgICAgICAgICAgICAgICB0Y2xhc3M9ZmlsZSA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JIHN1c3BlY3QgdGhhdCB0aGUK
ICAgICAgICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtIGNlcnQgd2FzIHJlbmV3ZWQgYW5kIGV2
ZXJ5dGhpbmcgd2Fzbid0CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgdXBkYXRlZCBwcm9wZXJseS4gSWYgSSdtIHJpZ2h0IHRoaXMgaXMgdW5yZWxh
dGVkCiAgICAgICAgICAgICAgICAgICAgICAgIHRvIHRoZSB1cGdyYWRlIGl0IGp1c3QgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBhIHNwb3RsaWdodCBvbiBpdC4gPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENhbiB5b3Ug
cnVuIHRoZXNlIGNvbW1hbmRzOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBt
YW5hZ2VyJyAtVwogICAgICAgICAgICAgICAgICAgICAgICAtYiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl
CiAgICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgVGhpcyByZXR1cm5zIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICQgbGRh
cHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAg
ICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl
CiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBkbjog
dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJ
QkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAuLi4gc3R1ZmYgLi4uIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84
ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtD
Tj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tT
O0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUwogICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv
dGUgdHlwZT0iY2l0ZSI+YW5kIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1kIC9ldGMvcGtpL3BraS10b21jYXQv
YWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgfCBncmVwIFNlcmlhbCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9h
bGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j
YScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICBUaGVzZSBib3RoIHJldHVybiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10
b21jYXQvYWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQt
cGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBh
c3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAgICAgICAgICAg
ICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAg
ICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lEOiBVbnJlY29nbml6ZWQgT2JqZWN0CiAg
ICAgICAgICAgICAgICAgICAgICBJZGVudGlmaWVyLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAj
IGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXPCoCAtbgogICAgICAgICAg
ICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTIENlcnRpZmljYXRlIERC
IiBpbgogICAgICAgICAgICAgICAgICAgICAgc2xvdCAiTlNTIFVzZXIgUHJpdmF0ZSBLZXkgYW5k
IENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBTZXJ2aWNlcyIgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRl
IERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGlu
ZyBrZXlzOgogICAgICAgICAgICAgICAgICAgICAgU0VDX0VSUk9SX1VOUkVDT0dOSVpFRF9PSUQ6
IFVucmVjb2duaXplZCBPYmplY3QKICAgICAgICAgICAgICAgICAgICAgIElkZW50aWZpZXIuIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgeW91IG1hZGUgYSB0eXBvIGFuZCByZXF1ZXN0ZWQgdGhl
IGtleXMgKC1LKSBpbnN0ZWFkCiAgICAgICAgICAgICAgICAgICAgb2YgdGhlIGNlcnRzICgtTCku
IFBsZWFzZSByZXRyeSB3aXRoIC1MIGFuZCB5b3UKICAgICAgICAgICAgICAgICAgICBzaG91bGQg
YmUgYWJsZSB0byBzZWUgdGhlIGNlcnRpZmljYXRlIHNlcmlhbC4gPGJyPgogICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBz
ZWFyY2ggLUxMTCAtRAogICAgICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1X
IC1iCiAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNl
ckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAg
ICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICBkbjog
dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgIHVz
ZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRB
TkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgIFpObzRlWDdq
TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAg
ICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgIEF1
dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFNvIHRoZSBzZXJpYWwgaXMgND8g
PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0
bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3Br
aS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgY2VydC1w
a2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDC
oMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpIDxicj4KICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBXaGljaCBpcyBOT1QgNC4uLiA8YnI+CiAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBp
YW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNh
dC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScg
LWEgPGJyPgogICAgICAgICAgICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0gPGJy
PgpNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZ
RFZRUUtEQWxDIDxicj4KICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAg
ICAgc2plaUZiVUZ0b01uZm1ITElZcGU1UUFSIDxicj4KICAgICAgICAgICAgICAgICAgLS0tLS1F
TkQgQ0VSVElGSUNBVEUtLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgQW5kIHRoaXMgY2VydCBpcyBOT1QgdGhlIHNhbWUuIDxicj4KICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg
SGksIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIHdoZW4gY2VydG1v
bmdlciByZW5ld3MgYSBjZXJ0aWZpY2F0ZSwgaXQgcnVucyBwcmUtc2F2ZQogICAgICAgICAgICAg
ICAgYW5kIHBvc3Qtc2F2ZSBjb21tYW5kcyAod2hpY2ggeW91IGNhbiBzZWUgaW4gdGhlIG91dHB1
dAogICAgICAgICAgICAgICAgb2YgZ2V0Y2VydCBsaXN0KS4gSW4geW91ciBjYXNlLCB0aGUgcG9z
dC1zYXZlIGNvbW1hbmQKICAgICAgICAgICAgICAgIGZvciBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtp
LWNhIHByb2JhYmx5IGZhaWxlZC4gPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgVGhpcyBjb21tYW5kIChvbiB0aGUgcmVuZXdhbCBtYXN0ZXIpIGlzIHJlc3BvbnNpYmxl
IGZvcgogICAgICAgICAgICAgICAgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0aGUgTlNTIGRi
IHRvIHRoZSBMREFQIHNlcnZlci4KICAgICAgICAgICAgICAgIFlvdSBuZWVkIGZpcnN0IHRvIGNo
ZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMgdGhlIHJlbmV3YWwKICAgICAgICAgICAgICAgIG1hc3Rl
ciAoYXMgdGhlIHNlcmlhbCBudW1iZXJzIGFyZSBpbiBhIGNvbXBsZXRlbHkKICAgICAgICAgICAg
ICAgIGRpZmZlcmVudCByYW5nZSwgSSBhc3N1bWUgdGhhdCB5b3UgaGF2ZSBtdWx0aXBsZSBJUEEK
ICAgICAgICAgICAgICAgIHNlcnZlcnMgY29uZmlndXJlZCB3aXRoIGEgQ0EgaW5zdGFuY2UpOiA8
YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAkIGV4cG9ydCBCQVNFRE49
YGdyZXAgYmFzZWRuIC9ldGMvaXBhL2RlZmF1bHQuY29uZiB8IGN1dAogICAgICAgICAgICAgICAg
LWQ9IC1mMi1gIDxicj4KICAgICAgICAgICAgICAgICQga2luaXQgYWRtaW4gPGJyPgogICAgICAg
ICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLVEgLWggYGhvc3RuYW1lYCAtcCAzODkgLVkgR1NT
QVBJIC1iCiAgICAgICAgICAgICAgICAiY249bWFzdGVycyxjbj1pcGEsY249ZXRjLCRCQVNFRE4i
CiAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FSZW5ld2Fs
TWFzdGVyKSknIGRuIDxicj4KICAgICAgICAgICAgICAgIGRuOgpjbj1DQSxjbj12bS1pcGFzZXJ2
ZXIuaXBhZG9tYWluLmNvbSxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9aXBhZG9tYWluLGRj
PWNvbQogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgSW4gdGhpcyBleGFtcGxlIHRoZSByZW5ld2FsIG1hc3RlciBpcyB2bS1pcGFzZXJ2ZXIu
IDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIEkgZ2V0IHRoaXMgPGJyPgogICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtUSAtaCBgaG9zdG5hbWVg
IC1wIDM4OSAtWSBHU1NBUEkgLWIKICAgICAgICAgICAgICAiY249bWFzdGVycyxjbj1pcGEsY249
ZXRjLCRCQVNFRE4iCiAgICAgICAgICAgICAgJygmYW1wOyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5n
PWNhUmVuZXdhbE1hc3RlcikpJyBkbiA8YnI+CiAgICAgICAgICAgICAgZG46CiAgICAgICAgICAg
ICAgY249Q0EsY249ZnJlZWlwYS1zZWEuYnB0LnJvY2tzLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0
YyxkYz1icHQsZGM9cm9ja3MKICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgIFdoaWNoIGlzIHRoZSBvdGhlciBGcmVlSVBBIHNlcnZlci4gPGJyPgogICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBIaSBJ
YW4sIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBpdCdzIGdldHRpbmcgZGlmZmlj
dWx0IHRvIGZvbGxvdyB0aGlzIHRocmVhZCwgc28gY291bGQgd2UKICAgICAgICAgICAgc3RlcCBi
YWNrIGFuZCBzdW1tYXJpemU/IDxicj4KICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg
IFllcywgaXQgaXMuwqAgU29ycnkuIDxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiPiA8YnI+CiAgICAgICAgICAgIC0gT24gc2VydmVyIGZyZWVpcGEtc2VhICg9cmVuZXdhbCBt
YXN0ZXIpLCB0aGUgQ0EgY29tcG9uZW50CiAgICAgICAgICAgIGlzIGluc3RhbGxlZCBhbmQgJ3N1
YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIGhhcyBTZXJpYWwKICAgICAgICAgICAgbnVtYmVyIDQg
aW4gdGhlIE5TU0RCIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgICAgTm8/IDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIFty
b290QGZyZWVpcGEtc2VhIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgL2V0Yy9wa2kv
cGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgfAogICAgICAg
ICAgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVt
YmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj4tIE9uIHNlcnZlciBzZWF0dGxlbmZzICh3aGVyZSBQS0kKICAgICAgICAgICAg
ZmFpbHMgdG8gcmVzdGFydCksIHRoZSBDQSBjb21wb25lbnQgaXMgaW5zdGFsbGVkIGFuZAogICAg
ICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgaGFzIFNlcmlhbCBudW1iZXIgMTM0
MTcxODU0MSBpbgogICAgICAgICAgICB0aGUgTlNTREIgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh
cy4gPGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgWWVzIDxicj4KICAgICAg
ICAgIDxicj4KICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1k
CiAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0IGNl
cnQtcGtpLWNhJyB8CiAgICAgICAgICBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAgICDCoMKgwqDC
oMKgwqDCoMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpIDxicj4KICAg
ICAgICAgIDxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAg
ICAgICAgIC0gSW4gdGhlIExEQVAgc2VydmVycywgdGhlIGNlcnQgaXMgc3RvcmVkIGluIHRoZSBl
bnRyeQogICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHdpdGggU2Vy
aWFsIG51bWJlciA0IChpLmUuCiAgICAgICAgICAgIGl0IGlzIHRoZSBjZXJ0IGZyb20gZnJlZWlw
YS1zZWEpLiA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICBUaGlzIGlzIHdo
ZXJlIHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28gY2VydGlmaWNhdGVzCiAgICAg
ICAgICBvbiB0aGUgbWFzdGVyIGFuZCBvbmx5IG9uZSBvbiB0aGUgb3RoZXIuwqAgSSB3b25kZXIg
aWYgdGhpcyBpcwogICAgICAgICAgYSByZXN1bHQgb2YgdGhlIHNsb3cgbW90aW9uIHJlcGxpY2F0
aW9uIHRyYWlud3JlY2sgSSBoYXZlCiAgICAgICAgICBnb2luZyBvbiBkdWUgdG8gYSB6b21iaWUg
cmVwbGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0IG5vCiAgICAgICAgICBsb25nZXIgZXhp
c3RzIGluIHRoZSByZWFsIHdvcmxkIGFuZCBJIGNhbid0IHNlZW0gdG8gZ2V0IHJpZAogICAgICAg
ICAgb2YuIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg
SGksIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgdGhlIHJlbWFpbmluZyBpc3N1ZSBpcyBhIHJl
cGxpY2F0aW9uIHByb2JsZW0uIFRoZXJlIGlzIGEKICAgICAgICAiVHJvdWJsZXNob290aW5nIHJl
cGxpY2F0aW9uIiBzZWN0aW9uIFsxXSBpbiBJZE0gQWRtaW4gZ3VpZGUKICAgICAgICB0aGF0IG1h
eSBoZWxwIHlvdS4gPGJyPgogICAgICAgIDxicj4KICAgICAgICBSZWdhcmRpbmcgeW91ciB6b21i
aWUgcmVwbGljYSwgd2hpY2ggY29tbWFuZHMgZGlkIHlvdSB1c2UgdG8gdHJ5CiAgICAgICAgdG8g
cmVtb3ZlIGl0LCBhbmQgd2hhdCB3YXMgdGhlIG91dHB1dD8gPGJyPgogICAgICAgIDxicj4KICAg
ICAgICBGbG8gPGJyPgogICAgICAgIDxicj4KICAgICAgICBbMV0KICAgICAgICA8YSBjbGFzcz0i
bW96LXR4dC1saW5rLWZyZWV0ZXh0IgpocmVmPSJodHRwczovL2FjY2Vzcy5yZWRoYXQuY29tL2Rv
Y3VtZW50YXRpb24vZW4tVVMvUmVkX0hhdF9FbnRlcnByaXNlX0xpbnV4LzcvaHRtbC9MaW51eF9E
b21haW5fSWRlbnRpdHlfQXV0aGVudGljYXRpb25fYW5kX1BvbGljeV9HdWlkZS90cm91YmxlLWdl
bi1yZXBsaWNhdGlvbi5odG1sIgogICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRw
czovL2FjY2Vzcy5yZWRoYXQuY29tL2RvY3VtZW50YXRpb24vZW4tVVMvUmVkX0hhdF9FbnRlcnBy
aXNlX0xpbnV4LzcvaHRtbC9MaW51eF9Eb21haW5fSWRlbnRpdHlfQXV0aGVudGljYXRpb25fYW5k
X1BvbGljeV9HdWlkZS90cm91YmxlLWdlbi1yZXBsaWNhdGlvbi5odG1sPC9hPjxicj4KICAgICAg
ICA8YnI+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICBIaSw8YnI+CiAgICAg
IDxicj4KICAgICAgVG8gZGVidWcgcmVwbGljYXRpb24gbGF0ZW5jeSBvciBwcm9ibGVtIHdlIHdv
dWxkIG5lZWQgc2V2ZXJhbCBpbmZvCiAgICAgIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRz
IG9mIHRoZSBmb2xsb3dpbmcgY29tbWFuZHM8YnI+CiAgICAgIDxicj4KICAgICAgW3Jvb3RAZnJl
ZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXIn
CiAgICAgIC1XIC1iICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3
c2k8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRh
cHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgIC1XIC1iICJ1aWQ9cGtp
ZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICBFbnRlciBMREFQ
IFBhc3N3b3JkOiA8YnI+CiAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxi
cj4KICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8
YnI+CiAgICBuc2NwZW50cnl3c2k6CiAgICBlbnRyeXVzbjthZGNzbi01OTM4ZTY4ODAwMDEwNDI5
MDAwNTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNTogPGJyPgogICAgwqA3NTI3NDg5Nzxicj4K
ICAgIG5zY3BlbnRyeXdzaToKICAgIG1vZGlmeVRpbWVzdGFtcDthZGNzbi01OTM4ZTY4ODAwMDEw
NDI5MDAwNDt2dWNzbi01OTM4ZTY4ODAwMDEwNDI8YnI+CiAgICDCoDkwMDA0OiAyMDE3MDYwODA1
NTMzNFo8YnI+CiAgICBuc2NwZW50cnl3c2k6CiAgICBtb2RpZmllcnNOYW1lO2FkY3NuLTU5Mzhl
Njg4MDAwMTA0MjkwMDAzO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwPGJyPgogICAgwqAwMDM6IGNu
PURpcmVjdG9yeSBNYW5hZ2VyPGJyPgogICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgw
OWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgIG5zY3BlbnRyeXdzaTogY246
IHBraWRidXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogY3JlYXRlVGltZXN0YW1wOiAyMDE1MDcx
NjEyNTE0Nlo8YnI+CiAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5
IG1hbmFnZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uO3Z1Y3NuLTU5MzhlNjg4
MDAwMTA0MjkwMDAxOgogICAgMjsxMzQxNzE4NTQxO0NOPUNlcnRpZmljPGJyPgogICAgwqBhdGUg
QXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAg
IG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVs
ZXRlZDoKICAgIDI7NDtDTj1DZXJ0aWZpY2E8YnI+CiAgICDCoHRlIEF1dGhvcml0eSxPPUJQVC5S
T0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICBuc2NwZW50cnl3c2k6IG1h
aWw6PGJyPgogICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogdG9wPGJyPgogICAgbnNjcGVu
dHJ5d3NpOiBvYmplY3RDbGFzczogcGVyc29uPGJyPgogICAgbnNjcGVudHJ5d3NpOiBvYmplY3RD
bGFzczogb3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENs
YXNzOiBpbmV0T3JnUGVyc29uPGJyPgogICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21z
dXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBU
LlJPQ0tTPGJyPgogICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJyPgogICAgbnNjcGVu
dHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmlj
YXRlOjoKICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8
YnI+CiAgICAmbHQ7c25pcCZndDs8YnI+CiAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhB
YTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgIG5zY3BlbnRyeXdzaTog
dXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAgIE1JSURiakND
QWxhZ0F3SUJBZ0k8YnI+CiAgICAmbHQ7c25pcCZndDs8YnI+CiAgICDCoEFSPGJyPgogICAgbnNj
cGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICBuc2NwZW50cnl3
c2k6IHVzZXJzdGF0ZTogMTxicj4KICAgIG5zY3BlbnRyeXdzaTogdXNlcnR5cGU6IGFnZW50VHlw
ZTxicj4KICAgIG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICBuc2NwZW50cnl3c2k6
IGVudHJ5aWQ6IDUxPGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5
ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IGFuZDxicj4KICAgICAgW3Jvb3RAc2VhdHRsZW5m
cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgICAg
LVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAg
ICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFw
c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVwogICAgLWIgdWlkPXBraWRi
dXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAgICBFbnRlciBMREFQIFBh
c3N3b3JkOiA8YnI+CiAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4K
ICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+
CiAgICBuc2NwZW50cnl3c2k6IHNlZUFsc286IENOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxi
cj4KICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgIE1JSURjekNDQWx1Z0F3
SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAmbHQ7c25pcCZndDs8YnI+
CiAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhk
ZkFQWE1Kb0ZjPTxicj4KICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0
aWZpY2F0ZQogICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnM8YnI+CiAgICDCoHlz
dGVtLE89QlBULlJPQ0tTPGJyPgogICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAg
IG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICBuc2NwZW50cnl3c2k6IG1vZGlmeVRp
bWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l
c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgIG5zY3BlbnRyeXdzaTogbW9kaWZpZXJzTmFt
ZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFt
ZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29y
ZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgog
ICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgbnNjcGVudHJ5d3Np
OiBtYWlsOjxicj4KICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNlcjxicj4KICAgIG5zY3Bl
bnRyeXdzaTogc246IHBraWRidXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVz
ZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICBuc2NwZW50
cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENs
YXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxicj4KICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xh
c3M6IGluZXRPcmdQZXJzb248YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1
c2VyPGJyPgogICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05
NmEwYjhiOC0xZmRkODA3NDxicj4KICAgIG5zY3BlbnRyeXdzaTogZW50cnl1c246IDg2PGJyPgog
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVk
aGF0LmNvbSI+IDxicj4KICAgICAgRnJvbSB0aGUgb3V0cHV0IHlvdSBtYXkgb25seSBjb3B5L3Bh
c3QgdGhlIG9uZXMgcmVsYXRlZCB0bwogICAgICB1c2VyQ2VydGlmaWNhdGU8YnI+CiAgICAgIDxi
cj4KICAgICAgPGJyPgogICAgICBBbHNvIHRvIGR1bXAgdGhlIGN1cnJlbnQgcmVwbGljYXRpb24g
c3RhdHVzLCBzZW5kIHRoZSByZXN1bHTCoCBvZjxicj4KICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEg
aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInCiAgICAgIC1X
IC1iICJvPWlwYWNhIjxmb250IHNpemU9Ii0xIj48aT4gPC9pPiIoJmFtcDsob2JqZWN0Y2xhc3M9
bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm
ZmYpKSI8YnI+CiAgICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICBbcm9vdEBmcmVlaXBhLXNl
YSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgIC1X
IC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlk
PWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgRW50ZXIgTERB
UCBQYXNzd29yZDogPGJyPgogICAgZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBp
bmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICBjbjogcmVwbGljYTxicj4KICAgIG5zRFM1RmxhZ3M6
IDE8YnI+CiAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAg
IGNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9jPGJyPgogICAgwqBrcy1wa2ktdG9t
Y2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgbnNEUzVSZXBsaWNhQmluZEROOiBjbj1S
ZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJv
Yzxicj4KICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgIG5z
RFM1UmVwbGljYUlkOiAxMDY1PGJyPgogICAgbnNEUzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3
OTExZTYtOTNlNmVmNGItNjlkY2MyZDE8YnI+CiAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNh
PGJyPgogICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgIG5zU3RhdGU6OiBLUVFBQUFBQUFB
QWhISXBaQUFBQUFBRUFBQUFBQUFBQUtnQUFBQUFBQUFBQkFBQUFBQUFBQUE9PTxicj4KICAgIG5z
ZHM1cmVwbGljYWJpbmRkbmdyb3VwOiBjbj1yZXBsaWNhdGlvbgogICAgbWFuYWdlcnMsY249c3lz
YWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICDCoGRjPXJvY2tzPGJyPgogICAgbnNkczVy
ZXBsaWNhYmluZGRuZ3JvdXBjaGVja2ludGVydmFsOiA2MDxicj4KICAgIG9iamVjdENsYXNzOiB0
b3A8YnI+CiAgICBvYmplY3RDbGFzczogbnNEUzVSZXBsaWNhPGJyPgogICAgb2JqZWN0Q2xhc3M6
IGV4dGVuc2libGVvYmplY3Q8YnI+CiAgICBuc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0g
NTdjMjkxZDkwMDAwMDQyOTAwMDA8YnI+CiAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEg
Y2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJw
dC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgIDU3
Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICDCoDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8YnI+CiAg
ICBuc2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4
dCIgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVu
ZnMuYnB0LnJvY2tzOjM4OTwvYT59PGJyPgogICAgbnNkczVhZ210bWF4Y3NuOgogICAgbz1pcGFj
YTtjbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0LnJvY2tzLXBraS10b21jYXQ7c2VhdDxi
cj4KICAgIMKgdGxlbmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICBuc2RzNWFn
bXRtYXhjc246CiAgICBvPWlwYWNhO21hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9j
a3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1bmF2YWls
YWJsZTxicj4KICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAg
PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh
LmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0gNTk4
YTxicj4KICAgIMKgMWMxNjxicj4KICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxp
Y2EgMTI5MAogICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDov
L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4
OTwvYT59IDAwMDAwPGJyPgogICAgwqAwMDA8YnI+CiAgICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3Vu
dDogODg1PGJyPgogICAgbnNkczVyZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgIDxibG9ja3F1
b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPjxm
b250CiAgICAgICAgc2l6ZT0iLTEiPiBhbmQ8YnI+CiAgICAgIDwvZm9udD5bcm9vdEBzZWF0dGxl
bmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICBtYW5hZ2Vy
JyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+IDwvaT4iKCZhbXA7KG9iamVjdGNs
YXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZm
ZmZmZmZmKSkiPGJyPgogICAgICA8L2ZvbnQ+PC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgPGJy
PgogICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJl
Y3RvcnkgbWFuYWdlcicgLVcKICAgIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5z
dG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZm
KSkiPGJyPgogICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgZG46IGNuPXJlcGxpY2Es
Y249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICBjbjogcmVwbGlj
YTxicj4KICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJl
cGxpY2F0aW9uIE1hbmFnZXIKICAgIGNsb25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nr
PGJyPgogICAgwqBzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1jb25maWc8YnI+CiAgICBuc0RT
NVJlcGxpY2FJZDogMTI5MDxicj4KICAgIG5zRFM1UmVwbGljYU5hbWU6IDg3MDZhYjFlLTZhODMx
MWU2LWE5YmZkYmJmLTc0ZGM3MzIzPGJyPgogICAgbnNEUzVSZXBsaWNhUm9vdDogbz1pcGFjYTxi
cj4KICAgIG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICBuc1N0YXRlOjogQ2dVQUFBQUFBQUFL
RllwWkFBQUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICBuc2Rz
NXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAgIG1hbmFnZXJzLGNuPXN5c2Fj
Y291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAgwqBkYz1yb2Nrczxicj4KICAgIG5zZHM1cmVw
bGljYWJpbmRkbmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICBvYmplY3RDbGFzczogdG9w
PGJyPgogICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgIG9iamVjdENsYXNzOiBl
eHRlbnNpYmxlb2JqZWN0PGJyPgogICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU1
YzhmM2FlMDAwMDAwNjAwMDAwPGJyPgogICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIGNs
YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y
b2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgNTdiZTgw
NGMwMDAwMDUwYTAwMDA8YnI+CiAgICDCoCA1ODcyMzYxNTAwMDAwNTBhMDAwMDxicj4KICAgIG5z
ZHM1MHJ1djoge3JlcGxpY2EgMTA2NSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBo
cmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2Vh
LmJwdC5yb2NrczozODk8L2E+fQogICAgNTdiMTAzZDQwMDAwMDQyOTAwMDxicj4KICAgIMKgMCA1
N2JlODA0MzAwMDcwNDI5MDAwMDxicj4KICAgIG5zZHM1YWdtdG1heGNzbjoKICAgIG89aXBhY2E7
Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ7ZnJlZWk8YnI+
CiAgICDCoHBhLXNlYS5icHQucm9ja3M7Mzg5OzEwNjU7NTg3MjM2MTUwMDAwMDUwYTAwMDA8YnI+
CiAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAKICAgIDxhIGNsYXNz
PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2Nr
czozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fSAwMDAwMDxicj4KICAg
IMKgMDAwPGJyPgogICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1CiAg
ICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1z
ZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fSAw
MDAwPGJyPgogICAgwqAwMDAwPGJyPgogICAgbnNkczVSZXBsaWNhQ2hhbmdlQ291bnQ6IDM8YnI+
CiAgICBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0i
Y2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAgICAg
ICBzaXplPSItMSI+IDxicj4KICAgICAgICBSZWdhcmRzPGJyPgogICAgICAgIHRoaWVycnk8YnI+
CiAgICAgIDwvZm9udD4KICAgICAgPGJsb2NrcXVvdGUKICAgICAgICBjaXRlPSJtaWQ6MzMxZWZi
NjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAgICAgdHlwZT0i
Y2l0ZSI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3Jvb3RAZnJlZWlwYS1zZWEg
aWFuaF0jIGxkYXBzZWFyY2ggLUxMTAogICAgICAgICAgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2Vy
JyAtVyAtYgogICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2Vy
dGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDog
PGJyPgogICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgog
ICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lC
QkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQyA8YnI+CiAgICAgICAgICDC
oCAmbHQ7dHJ1bmNhdGVkJmd0OyA8YnI+CiAgICAgICAgICDCoCBaTm80ZVg3ak5UOEFhMjNnRGw2
eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0
ZTo6CiAgICAgICAgICBNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFz
RkFEQTBNUkl3RUFZRFZRUUsgPGJyPgogICAgICAgICAgJmx0O3RydW5jYXRlZCZndDsgZnVRUVpt
UDFYcktrcmZzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgZGVzY3JpcHRp
b246IDI7MTM0MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgQXV0aG9yaXR5LE89QlBU
LlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+CiAgICAgICAgICDCoCAsTz1CUFQuUk9DS1MgPGJy
PgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgW3Jvb3RAc2VhdHRsZW5m
cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgIG1hbmFn
ZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl
CiAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3Jk
OiA8YnI+CiAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+
CiAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFn
SUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDIDxicj4KICAgICAgICAg
IMKgICZsdDt0cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dE
bDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgZGVzY3JpcHRpb246
IDI7NDtDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EKICAgICAgICAg
IFN1YnN5c3RlbSxPPUJQVC5STyA8YnI+CiAgICAgICAgICDCoCBDS1MgPGJyPgogICAgICAgICAg
PGJyPgogICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWYgeW91IGNoZWNrIHRoZSBj
ZXJ0aWZpY2F0ZXMgZGF0ZXMsIEkKICAgICAgICAgICAgZ3Vlc3MgdGhhdCB0aGUgbW9zdCByZWNl
bnQgb25lIGlzIG9uIHNlcnZlciBzZWF0dGxlbmZzCiAgICAgICAgICAgIChiZWNhdXNlIG9mIHNl
cmlhbCBudW1iZXJzKS4gQ2FuIHlvdSBjb25maXJtIHRoaXMgKGJlY2F1c2UKICAgICAgICAgICAg
b3VyIGdvYWwgaXMgdG8gaGF2ZSB0aGUgbW9zdCByZWNlbnQgY2VydCBzdG9yZWQgaW4gYWxsIHRo
ZQogICAgICAgICAgICBOU1NEQnMgYW5kIGluIExEQVApPyA8YnI+CiAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgVGhhbmtzLCA8YnI+CiAgICAgICAgICAgIEZsbyA8YnI+CiAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3VyIHJlbmV3YWwg
bWFzdGVyIGlzIHRoZQogICAgICAgICAgICAgICAgbWFjaGluZSBvbiB3aGljaCB0aGUgTlNTIERC
IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgIGNvbnRhaW5zIHRoZSBu
ZXdlciBjZXJ0LCB0aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZQogICAgICAgICAgICAgICAg
c2NyaXB0czogPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgSWYgSSdtIGludGVycHJldGluZyB0aGlzIGNvcnJlY3RseSwgdGhl
biBpdCBpcy4uLiBzbyBJIHJhbgogICAgICAgICAgICAgIHRoaXMgb24gdGhlIGJyb2tlbiBtYWNo
aW5lIChzZWF0dGxlbmZzKSA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxi
bG9ja3F1b3RlIHR5cGU9ImNpdGUiPiQgc3VkbwogICAgICAgICAgICAgICAgL3Vzci9saWJleGVj
L2lwYS9jZXJ0bW9uZ2VyL3N0b3BfcGtpY2FkIDxicj4KICAgICAgICAgICAgICAgICQgc3VkbyAv
dXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAg
InN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
IEkgcmFuIHRoaXMsIGl0IHRvb2sgYSB3aGlsZSwgdGhlbiBJIHJlLWNoZWNrZWQgYW5kIHRoZQog
ICAgICAgICAgICAgIHNlcmlhbCBzdGlsbCBzZWVtcyB0byBiZSA0IDxicj4KICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBt
YW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBh
Y2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAg
ICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICBkbjogdWlkPXBr
aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgdXNlckNlcnRpZmlj
YXRlOjoKICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJB
UXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
Li4uIDxicj4KICAgICAgICAgICAgICDCoCBaTm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4
WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAgICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNl
cnRpZmljYXRlCiAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5
c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIEhl
cmUncyB3aGF0IHdhcyBpbiAvdmFyL2xvZy9wa2kvcGtpLXRvbWNhdC9jYS9kZWJ1ZyA8YnI+CiAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j
YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICA9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiA9PT09PcKgCiAgICAgICAgICAgICAgREVC
VUcgU1VCU1lTVEVNIElOSVRJQUxJWkVEwqDCoCA9PT09PT09IDxicj4KICAgICAgICAgICAgICBb
MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg
ICAgPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0gPGJyPgogICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTog
Q01TRW5naW5lOgogICAgICAgICAgICAgIHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8
YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRT
dG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYXV0b1NodXRkb3duIGNydW1iIGZpbGUg
cGF0aD8KICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0
ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYWJvdXQgdG8gbG9v
ayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgIHN1cHBvcnQ6YXVkaXRT
aWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAg
Zm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAg
ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2lu
ZToKICAgICAgICAgICAgICBkb25lIGluaXQgaWQ9ZGVidWcgPGJyPgogICAgICAgICAgICAgIFsw
My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgog
ICAgICAgICAgICAgIGluaXRpYWxpemVkIGRlYnVnIDxicj4KICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAg
ICAgICAgICBpbml0U3Vic3lzdGVtIGlkPWxvZyA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAg
ICAgICAgcmVhZHkgdG8gaW5pdCBpZD1sb2cgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ3JlYXRpbmcKICAgICAgICAgICAg
ICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2NhL3NpZ25lZEF1
ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENyZWF0aW5nCiAgICAgICAgICAg
ICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9zeXN0ZW0p
IDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06IENyZWF0aW5nCiAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIv
cGtpL3BraS10b21jYXQvbG9ncy9jYS90cmFuc2FjdGlvbnMpCiAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XTogQ01TRW5naW5lOgogICAgICAgICAgICAgIHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxz
ZSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3Rh
cnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYXV0b1NodXRkb3duIGNydW1iIGZp
bGUgcGF0aD8KICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9T
aHV0ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYWJvdXQgdG8g
bG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgIHN1cHBvcnQ6YXVk
aXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3
OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAg
ICAgZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0Vu
Z2luZToKICAgICAgICAgICAgICBkb25lIGluaXQgaWQ9bG9nIDxicj4KICAgICAgICAgICAgICBb
MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToK
ICAgICAgICAgICAgICBpbml0aWFsaXplZCBsb2cgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAg
ICAgICAgIGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAg
ICAgICByZWFkeSB0byBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3
OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAg
ICAgcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4KICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAg
ICAgICAgICAgICBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgIC92
YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iIDxicj4KICAgICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENN
U0VuZ2luZToKICAgICAgICAgICAgICBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNo
dXRkb3duCiAgICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh
IDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgICBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmlu
Z0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICAgIGRvbmUg
aW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j
YWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICAgIGluaXRpYWxpemVk
IGpzcyA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgaW5pdFN1YnN5c3RlbSBpZD1k
YnMgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0
YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICAgIHJlYWR5IHRvIGluaXQgaWQ9ZGJz
IDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06CiAgICAgICAgICAgICAgREJTdWJzeXN0ZW06IGluaXQoKSBtRW5hYmxlU2VyaWFs
TWdtdD10cnVlIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs
aG9zdC1zdGFydFN0b3AtMV06IENyZWF0aW5nCiAgICAgICAgICAgICAgTGRhcEJvdW5kQ29ubkZh
Y3RvcihEQlN1YnN5c3RlbSkgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFj
dG9yeTogaW5pdCA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3J5OmRv
Q2xvbmluZyB0cnVlIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBpbml0KCkg
PGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0
U3RvcC0xXToKICAgICAgICAgICAgICBMZGFwQXV0aEluZm86IGluaXQgYmVnaW5zIDxicj4KICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
CiAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBpbml0IGVuZHMgPGJyPgogICAgICAgICAgICAg
IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogaW5pdDoKICAg
ICAgICAgICAgICBiZWZvcmUgbWFrZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+
CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVlIDxicj4K
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06IFRDUAogICAgICAgICAgICAgIEtlZXAtQWxpdmU6IHRydWUgPGJyPgogICAgICAgICAgICAg
IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg
ICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nIGRlc2lyZWQgY2Vy
dAogICAgICAgICAgICAgIG5pY2tuYW1lIHRvOiBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxi
cj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0
b3AtMV06CiAgICAgICAgICAgICAgTGRhcEpzc1NTTFNvY2tldDogc2V0IGNsaWVudCBhdXRoIGNl
cnQgbmlja25hbWUKICAgICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4K
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRlcmlu
ZyEgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0
YXJ0U3RvcC0xXTogQ2FuZGlkYXRlCiAgICAgICAgICAgICAgY2VydDogb2NzcFNpZ25pbmdDZXJ0
IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06IENhbmRpZGF0ZQogICAgICAgICAgICAgIGNlcnQ6IHN1YnN5
c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0
aWZpY2F0ZVNlbGVjdGlvbkNCOiBkZXNpcmVkIGNlcnQgZm91bmQgaW4KICAgICAgICAgICAgICBs
aXN0OiBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgU1NM
Q2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJuaW5nOiBzdWJzeXN0ZW1DZXJ0CiAg
ICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox
Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogU1NMCiAgICAgICAgICAgICAgaGFuZHNo
YWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgQ01TRW5naW5lLnNodXRkb3duKCkg
PGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
SSByZWFsbHkgYXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoIHRoaXMuwqAg
SQogICAgICAgICAgICAgIG93ZSB5b3UuIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgLSBJYW4gPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8YmxvY2tx
dW90ZSB0eXBlPSJjaXRlIj5BZnRlciB0aGF0LCBjaGVjayB0aGF0IHRoZSBMREFQCiAgICAgICAg
ICAgICAgICBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUgY2FzZSwgeW91IHNo
b3VsZCBiZQogICAgICAgICAgICAgICAgYWJsZSB0byByZXN0YXJ0IHBraS4gPGJyPgogICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoYW5rIHlvdSBhZ2Fp
biBmb3IgeW91ciB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgSWFuIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8
YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAgICA8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgd2hpY2ggc2Vl
bXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoZSBkZXNjcmlwdGlvbiBhdHRyaWJ1dGUK
ICAgICAgICAgICAgICAgICAgICAgICAgaW4gdGhlIGxkYXBzZWFyY2ggb3V0cHV0IGlzIG9mIHRo
ZSBmb3JtCiAgICAgICAgICAgICAgICAgICAgICAgIDI7IztETjtETiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1h
dGNoIHRoZSBzZXJpYWwgbnVtYmVyIGluIHRoZQogICAgICAgICAgICAgICAgICAgICAgICBmaXJz
dCBjZXJ0dXRpbCBvdXRwdXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5EIGhl
YWRlcnMpCiAgICAgICAgICAgICAgICAgICAgICAgIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGF0dHJpYnV0ZXMuIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBy
b2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgICA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICBfX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICBGcmVl
SVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1s
aW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0Bs
aXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
PmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgIDxicj4K
ICAgICAgICAgIFRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEKICAgICAgICAgICAg
Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgaHJlZj0ibWFpbHRv
OmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAg
bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhv
c3RlZC5vcmc8L2E+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4KICAg
ICAgICBGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgY2xhc3M9Im1v
ei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVz
ZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRy
dWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICA8YnI+
CiAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgY2xh
c3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVl
aXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICBtb3otZG8t
bm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y
ZzwvYT4KICAgICAgICA8YnI+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgPC9i
bG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo=
--===============5624228806415025913==--
From tbordaz at redhat.com Wed Aug 9 10:06:40 2017
Content-Type: multipart/mixed; boundary="===============8600127386348226288=="
MIME-Version: 1.0
From: thierry bordaz
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Wed, 09 Aug 2017 12:05:51 +0200
Message-ID: <598ADE7F.3080308@redhat.com>
In-Reply-To: 2f60c4af-680c-4382-9704-41a24c8121a2@brownpapertickets.com
--===============8600127386348226288==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Hi Ian,
Thanks for having gather those data.
#
# So pkidbuser entries have a same (old) userCertificate likely
generated during install
# But only freeipa-sea has a new one created on freeipa-sea around
Jun 8th 2017 05:54:16
# This recent certificate is identified by 5938e688000104290000
#
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
-W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
...
nscpentrywsi: userCertificate::
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
nscpentrywsi: userCertificate;vucsn-5938e688000104290000::
MIIDbjCCAlagAwIBAgI
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W
-b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
nscpentrywsi: userCertificate::
MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
#
# why 5938e688000104290000 value was not propagated to seattlenfs ?
# The most recent update (from freeipa-sea) that was replicated to
seattlenfs
# is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07).
# In addition seattlenfs received direct update (last one was in Jan
1017) that were not
# replicated to freeipa-sea
#
# The two servers have diverged because they can not replicate to
eachother because
# they were not correctly initialize.
# They have different "replicageneration" (57c291d9000004290000 vs
55c8f3ae000000600000)
#
# It is looking like freeipa-sea was created one or two years ago
and used to initialized seattlenfs.
# But later freeipa-sea was recreated.
#
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
-W -b "o=3Dipaca"
"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-=
ffffffff))"
Enter LDAP Password:
dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nsds50ruv: {replicageneration} 57c291d9000004290000
nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
57f840bf000004290000 598a1c40000104290000
nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
nsruvReplicaLastModified: {replica 1065
ldap://freeipa-sea.bpt.rocks:389} 598a1c16
nsruvReplicaLastModified: {replica 1290
ldap://seattlenfs.bpt.rocks:389} 00000000
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W
-b "o=3Dipaca"
"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-=
ffffffff))"
dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nsds50ruv: {replicageneration} 55c8f3ae000000600000
nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
57b103d4000004290000 57be8043000704290000
nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
57be804c0000050a0000 587236150000050a0000
nsruvReplicaLastModified: {replica 1290
ldap://seattlenfs.bpt.rocks:389} 00000000
nsruvReplicaLastModified: {replica 1065
ldap://freeipa-sea.bpt.rocks:389} 00000000
In conclusion:
From replication pov, the two instances can not communicate.
One solution would be to identify which instance is the good one, =
you want to keep.
and reinit the second one from that reference.
On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote:
>
> On 8/7/17 1:44 AM, thierry bordaz wrote:
>
>>
>>
>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>>
>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users =
>>>>>>>>>>>>>>> wrote:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had =
>>>>>>>>>>>>>>>>>> apparently had
>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can =
>>>>>>>>>>>>>>>>> run without
>>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see =
>>>>>>>>>>>>>>>>> what is going on.
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication =
>>>>>>>>>>>>>>>> failed (49)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and =
>>>>>>>>>>>>>>> needs to
>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN =
>>>>>>>>>>>>>>> and
>>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=
=3Dipaca
>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>>> ...
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a =
>>>>>>>>>>>>>> prompt to provide
>>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>>
>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>
>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>>>> password can be
>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with =
>>>>>>>>>>>>> the tag
>>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>>
>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... =
>>>>>>>>>>>>> allows to read
>>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>> (provide password)
>>>>>>>>>>>>
>>>>>>>>>>>> That works...
>>>>>>>>>>>>
>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>>>> User Private
>>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>>> Certificate
>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>>>>>>>> caSigningCert
>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>>> Certificate
>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>>> Certificate
>>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>>
>>>>>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>>>>>
>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>>
>>>>>>>>>>>> That password is getting me somewhere though, since if I =
>>>>>>>>>>>> put in a
>>>>>>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>>>>>>
>>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>>
>>>>>>>>>> There wasn't much of a change... I just assumed someone ran =
>>>>>>>>>> yum upgrade and didn't restart, then the power outage... it =
>>>>>>>>>> looks like not much of a version change though.
>>>>>>>>>>
>>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>
>>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>>
>>>>>>>>>> # getenforce
>>>>>>>>>> Enforcing
>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> If so can you run:
>>>>>>>>>>>
>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>>>>>>> write_logs option.
>>>>>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>>>>>> ----
>>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003=
e =
>>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a=
2=3D1 =
>>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D42949=
67295 =
>>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 =
>>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) =
>>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read =
>>>>>>>>>> } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"=
dm-2" =
>>>>>>>>>> ino=3D116393517 =
>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>> I suspect that the subsystem cert was renewed and everything =
>>>>>>>>>>> wasn't
>>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>>> upgrade it just
>>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>>
>>>>>>>>>>> Can you run these commands:
>>>>>>>>>>>
>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti=
on
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> This returns
>>>>>>>>>>
>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>> userCertificate:: =
>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>> ... stuff ...
>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC=
A =
>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>
>>>>>>>>>>> and
>>>>>>>>>>>
>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>>>> cert-pki-ca' -a
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> These both return
>>>>>>>>>>
>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>>> cert-pki-ca' -a
>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>> User Private Key and Certificate Services"
>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> you made a typo and requested the keys (-K) instead of the =
>>>>>>>>> certs (-L). Please retry with -L and you should be able to see =
>>>>>>>>> the certificate serial.
>>>>>>>>>
>>>>>>>>
>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertifica=
te =
>>>>>>>> description
>>>>>>>> Enter LDAP Password:
>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>> userCertificate:: =
>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>> ...
>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>
>>>>>>>> So the serial is 4?
>>>>>>>>
>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep =
>>>>>>>> Serial
>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>
>>>>>>>> Which is NOT 4...
>>>>>>>>
>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
>>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>> ...
>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>> -----END CERTIFICATE-----
>>>>>>>>
>>>>>>>> And this cert is NOT the same.
>>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>>> post-save commands (which you can see in the output of getcert =
>>>>>>> list). In your case, the post-save command for subsystemCert =
>>>>>>> cert-pki-ca probably failed.
>>>>>>>
>>>>>>> This command (on the renewal master) is responsible for copying =
>>>>>>> the new cert from the NSS db to the LDAP server. You need first =
>>>>>>> to check which IPA server is the renewal master (as the serial =
>>>>>>> numbers are in a completely different range, I assume that you =
>>>>>>> have multiple IPA servers configured with a CA instance):
>>>>>>>
>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f=
2-`
>>>>>>> $ kinit admin
>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>> dn: =
>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3D=
etc,dc=3Dipadomain,dc=3Dcom =
>>>>>>>
>>>>>>>
>>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>>
>>>>>>
>>>>>> I get this
>>>>>>
>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>> dn: =
>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=
=3Dbpt,dc=3Drocks =
>>>>>>
>>>>>>
>>>>>> Which is the other FreeIPA server.
>>>>>>
>>>>> Hi Ian,
>>>>>
>>>>> it's getting difficult to follow this thread, so could we step =
>>>>> back and summarize?
>>>> Yes, it is. Sorry.
>>>>>
>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in =
>>>>> the NSSDB /etc/pki/pki-tomcat/alias
>>>> No?
>>>>
>>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>>> component is installed and 'subsystemCert cert-pki-ca' has Serial =
>>>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>>> Yes
>>>>
>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>
>>>>>
>>>>> - In the LDAP servers, the cert is stored in the entry =
>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it i=
s =
>>>>> the cert from freeipa-sea).
>>>> This is where the difference is. There are two certificates on the =
>>>> master and only one on the other. I wonder if this is a result of =
>>>> the slow motion replication trainwreck I have going on due to a =
>>>> zombie replica in the ldap database that no longer exists in the =
>>>> real world and I can't seem to get rid of.
>>>>
>>> Hi,
>>>
>>> the remaining issue is a replication problem. There is a =
>>> "Troubleshooting replication" section [1] in IdM Admin guide that =
>>> may help you.
>>>
>>> Regarding your zombie replica, which commands did you use to try to =
>>> remove it, and what was the output?
>>>
>>> Flo
>>>
>>> [1] =
>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/=
7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-re=
plication.html
>>>
>>
>> Hi,
>>
>> To debug replication latency or problem we would need several info =
>> but starting with the results of the following commands
>>
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>> -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> nscpentrywsi: =
> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
> 75274897
> nscpentrywsi: =
> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
> 90004: 20170608055334Z
> nscpentrywsi: =
> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
> 003: cn=3DDirectory Manager
> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
> nscpentrywsi: cn: pkidbuser
> nscpentrywsi: createTimestamp: 20150716125146Z
> nscpentrywsi: creatorsName: cn=3Ddirectory manager
> nscpentrywsi: description;vucsn-5938e688000104290001: =
> 2;1341718541;CN=3DCertific
> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
> 2;4;CN=3DCertifica
> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
> nscpentrywsi: mail:
> nscpentrywsi: objectClass: top
> nscpentrywsi: objectClass: person
> nscpentrywsi: objectClass: organizationalPerson
> nscpentrywsi: objectClass: inetOrgPerson
> nscpentrywsi: objectClass: cmsuser
> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
> nscpentrywsi: sn: pkidbuser
> nscpentrywsi: uid: pkidbuser
> nscpentrywsi: userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>
> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
> MIIDbjCCAlagAwIBAgI
>
> AR
> nscpentrywsi: userPassword::
> nscpentrywsi: userstate: 1
> nscpentrywsi: usertype: agentType
> nscpentrywsi: parentid: 2
> nscpentrywsi: entryid: 51
>> and
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
> Enter LDAP Password:
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
> nscpentrywsi: userCertificate:: =
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>
> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
> nscpentrywsi: description: 2;4;CN=3DCertificate =
> Authority,O=3DBPT.ROCKS;CN=3DCA Subs
> ystem,O=3DBPT.ROCKS
> nscpentrywsi: entryid: 51
> nscpentrywsi: parentid: 2
> nscpentrywsi: modifyTimestamp: 20150716125146Z
> nscpentrywsi: createTimestamp: 20150716125146Z
> nscpentrywsi: modifiersName: cn=3Ddirectory manager
> nscpentrywsi: creatorsName: cn=3Ddirectory manager
> nscpentrywsi: userPassword::
> nscpentrywsi: userstate: 1
> nscpentrywsi: usertype: agentType
> nscpentrywsi: mail:
> nscpentrywsi: cn: pkidbuser
> nscpentrywsi: sn: pkidbuser
> nscpentrywsi: uid: pkidbuser
> nscpentrywsi: objectClass: top
> nscpentrywsi: objectClass: person
> nscpentrywsi: objectClass: organizationalPerson
> nscpentrywsi: objectClass: inetOrgPerson
> nscpentrywsi: objectClass: cmsuser
> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
> nscpentrywsi: entryusn: 86
>>
>> From the output you may only copy/past the ones related to =
>> userCertificate
>>
>>
>> Also to dump the current replication status, send the result of
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>> -b =
>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffff=
ff-ffffffff-ffffffff))"
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "o=3Dipaca" =
> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ff=
ffffff))"
> Enter LDAP Password:
> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
> cn: replica
> nsDS5Flags: 1
> nsDS5ReplicaBindDN: cn=3DReplication Manager =
> cloneAgreement1-freeipa-sea.bpt.roc
> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
> nsDS5ReplicaBindDN: cn=3DReplication Manager =
> masterAgreement1-seattlenfs.bpt.roc
> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
> nsDS5ReplicaId: 1065
> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
> nsDS5ReplicaRoot: o=3Dipaca
> nsDS5ReplicaType: 3
> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
> nsds5replicabinddngroup: cn=3Dreplication =
> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
> dc=3Drocks
> nsds5replicabinddngroupcheckinterval: 60
> objectClass: top
> objectClass: nsDS5Replica
> objectClass: extensibleobject
> nsds50ruv: {replicageneration} 57c291d9000004290000
> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
> 57f840bf00000429000
> 0 598a1c40000104290000
> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
> nsds5agmtmaxcsn: =
> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
> tlenfs.bpt.rocks;389;unavailable
> nsds5agmtmaxcsn: =
> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
> tlenfs.bpt.rocks;389;unavailable
> nsruvReplicaLastModified: {replica 1065 =
> ldap://freeipa-sea.bpt.rocks:389} 598a
> 1c16
> nsruvReplicaLastModified: {replica 1290 =
> ldap://seattlenfs.bpt.rocks:389} 00000
> 000
> nsds5ReplicaChangeCount: 885
> nsds5replicareapactive: 0
>> and
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b =
>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffff=
ff-ffffffff-ffffffff))"
>
>
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "o=3Dipaca" =
> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ff=
ffffff))"
> Enter LDAP Password:
> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
> cn: replica
> nsDS5Flags: 1
> nsDS5ReplicaBindDN: cn=3DReplication Manager =
> cloneAgreement1-seattlenfs.bpt.rock
> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
> nsDS5ReplicaId: 1290
> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
> nsDS5ReplicaRoot: o=3Dipaca
> nsDS5ReplicaType: 3
> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
> nsds5replicabinddngroup: cn=3Dreplication =
> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
> dc=3Drocks
> nsds5replicabinddngroupcheckinterval: 60
> objectClass: top
> objectClass: nsDS5Replica
> objectClass: extensibleobject
> nsds50ruv: {replicageneration} 55c8f3ae000000600000
> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
> 57be804c0000050a0000
> 587236150000050a0000
> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
> 57b103d400000429000
> 0 57be8043000704290000
> nsds5agmtmaxcsn: =
> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
> pa-sea.bpt.rocks;389;1065;587236150000050a0000
> nsruvReplicaLastModified: {replica 1290 =
> ldap://seattlenfs.bpt.rocks:389} 00000
> 000
> nsruvReplicaLastModified: {replica 1065 =
> ldap://freeipa-sea.bpt.rocks:389} 0000
> 0000
> nsds5ReplicaChangeCount: 3
> nsds5replicareapactive: 0
>>
>> Regards
>> thierry
>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>
>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> userCertificate:: =
>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>>> description: 2;1341718541;CN=3DCertificate =
>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem
>>>> ,O=3DBPT.ROCKS
>>>>
>>>>
>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>
>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>> Subsystem,O=3DBPT.RO
>>>> CKS
>>>>
>>>>> If you check the certificates dates, I guess that the most recent =
>>>>> one is on server seattlenfs (because of serial numbers). Can you =
>>>>> confirm this (because our goal is to have the most recent cert =
>>>>> stored in all the NSSDBs and in LDAP)?
>>>>>
>>>>> Thanks,
>>>>> Flo
>>>>>
>>>>>
>>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>>>>>>> manually run the scripts:
>>>>>>
>>>>>> If I'm interpreting this correctly, then it is... so I ran this =
>>>>>> on the broken machine (seattlenfs)
>>>>>>
>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>>>>>>> cert-pki-ca"
>>>>>>>
>>>>>>
>>>>>> I ran this, it took a while, then I re-checked and the serial =
>>>>>> still seems to be 4
>>>>>>
>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>> ...
>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>
>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>>
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG =
>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>>>> at autoShutdown? false
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> autoShutdown crumb file path? =
>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>> cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>> init id=3Ddebug
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> initialized debug
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> initSubsystem id=3Dlog
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>> to init id=3Dlog
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit)
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>>>> at autoShutdown? false
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> autoShutdown crumb file path? =
>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>> cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>> init id=3Dlog
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> initialized log
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> initSubsystem id=3Djss
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>> to init id=3Djss
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart =
>>>>>> at autoShutdown? false
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> autoShutdown crumb file path? =
>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>> cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>> init id=3Djss
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> initialized jss
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>> initSubsystem id=3Ddbs
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>> to init id=3Ddbs
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: =
>>>>>> init() mEnableSerialMgmt=3Dtrue
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> LdapBoundConnFactory: init
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> LdapBoundConnFactory:doCloning true
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init =
>>>>>> begins
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init =
>>>>>> ends
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>>> makeConnection errorIfDown is true
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>>>>> errorIfDown true
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname =
>>>>>> to: subsystemCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: =
>>>>>> set client auth cert nickname subsystemCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>> ocspSigningCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>> subsystemCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>>> subsystemCert cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert =
>>>>>> cert-pki-ca
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake =
>>>>>> happened
>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
>>>>>>
>>>>>>
>>>>>> I really appreciate you sticking with me through this. I owe you.
>>>>>>
>>>>>> - Ian
>>>>>>
>>>>>>> After that, check that the LDAP entry has been updated. If it is =
>>>>>>> the case, you should be able to restart pki.
>>>>>>>
>>>>>>> Flo
>>>>>>>
>>>>>>>> Thank you again for your time!
>>>>>>>>
>>>>>>>> Ian
>>>>>>>>
>>>>>>>>> Flo.
>>>>>>>>>>
>>>>>>>>>> which seems weird.
>>>>>>>>>>
>>>>>>>>>>> The description attribute in the ldapsearch output is of the =
>>>>>>>>>>> form 2;#;DN;DN
>>>>>>>>>>>
>>>>>>>>>>> The # should match the serial number in the first certutil =
>>>>>>>>>>> output
>>>>>>>>>>>
>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match =
>>>>>>>>>>> one of the
>>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>>
>>>>>>>>>>> rob
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to =
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to =
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.=
org
--===============8600127386348226288==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm
LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgSGkgSWFuLDxicj4KICAgIDxicj4KICAgIFRo
YW5rcyBmb3IgaGF2aW5nIGdhdGhlciB0aG9zZSBkYXRhLiA8YnI+CiAgICA8dHQ+PGJyPgogICAg
PC90dD4KICAgIDxibG9ja3F1b3RlPjx0dD4jPC90dD48YnI+CiAgICAgIDx0dD4jIFNvIHBraWRi
dXNlciBlbnRyaWVzIGhhdmUgYSBzYW1lIChvbGQpIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgIGxp
a2VseSBnZW5lcmF0ZWQgZHVyaW5nIGluc3RhbGw8L3R0Pjxicj4KICAgICAgPHR0PiMgQnV0IG9u
bHkgZnJlZWlwYS1zZWEgaGFzIGEgbmV3IG9uZSBjcmVhdGVkIG9uIGZyZWVpcGEtc2VhCiAgICAg
ICAgYXJvdW5kIEp1biA4dGggMjAxNyAwNTo1NDoxNjwvdHQ+PGJyPgogICAgICA8dHQ+IyBUaGlz
IHJlY2VudCBjZXJ0aWZpY2F0ZSBpcyBpZGVudGlmaWVkIGJ5CiAgICAgICAgNTkzOGU2ODgwMDAx
MDQyOTAwMDAgPC90dD48YnI+CiAgICAgIDx0dD4jPC90dD48YnI+CiAgICAgIDx0dD5bcm9vdEBm
cmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAg
ICBtYW5hZ2VyJyAtVyAtYiAidWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVu
dHJ5d3NpPC90dD48YnI+CiAgICAgIDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1p
cGFjYTwvdHQ+PGJyPgogICAgICA8dHQ+Li4uPC90dD48YnI+CiAgICAgIDx0dD5uc2NwZW50cnl3
c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdr
cWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgPHR0Pm5zY3Bl
bnRyeXdzaTogdXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAg
ICAgICBNSUlEYmpDQ0FsYWdBd0lCQWdJICZsdDtzbmlwJmd0OzwvdHQ+PGJyPgogICAgICA8YnI+
CiAgICAgIDx0dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2Nu
PWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl
LG89aXBhY2EgbnNjcGVudHJ5d3NpPC90dD48YnI+CiAgICAgIDx0dD5kbjogdWlkPXBraWRidXNl
cixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAgICA8dHQ+bnNjcGVudHJ5d3NpOiB1c2Vy
Q2VydGlmaWNhdGU6OgogICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcw
QkFRc0ZBREEwTVIgJmx0O3NuaXAmZ3Q7PC90dD48YnI+CiAgICAgIDxicj4KICAgICAgPGJyPgog
ICAgICA8YnI+CiAgICAgIDx0dD4jPC90dD48YnI+CiAgICAgIDx0dD4jIHdoeSA1OTM4ZTY4ODAw
MDEwNDI5MDAwMCB2YWx1ZSB3YXMgbm90IHByb3BhZ2F0ZWQgdG8KICAgICAgICBzZWF0dGxlbmZz
ID88L3R0Pjxicj4KICAgICAgPHR0PiMgVGhlIG1vc3QgcmVjZW50IHVwZGF0ZSAoZnJvbSBmcmVl
aXBhLXNlYSkgdGhhdCB3YXMKICAgICAgICByZXBsaWNhdGVkIHRvIHNlYXR0bGVuZnM8L3R0Pjxi
cj4KICAgICAgPHR0PiMgaXPCoCAxIHllYXIgb2xkICg1N2JlODA0MzAwMDcwNDI5MDAwMCAtIEF1
ZyAyNXRoIDIwMTYKICAgICAgICAwNToyMTowNykuPC90dD48YnI+CiAgICAgIDx0dD4jIEluIGFk
ZGl0aW9uIHNlYXR0bGVuZnMgcmVjZWl2ZWQgZGlyZWN0IHVwZGF0ZSAobGFzdCBvbmUgd2FzCiAg
ICAgICAgaW4gSmFuIDEwMTcpIHRoYXQgd2VyZSBub3Q8L3R0Pjxicj4KICAgICAgPHR0PiMgcmVw
bGljYXRlZCB0byBmcmVlaXBhLXNlYTwvdHQ+PGJyPgogICAgICA8dHQ+IyA8L3R0Pjxicj4KICAg
ICAgPHR0PiMgVGhlIHR3byBzZXJ2ZXJzIGhhdmUgZGl2ZXJnZWQgYmVjYXVzZSB0aGV5IGNhbiBu
b3QgcmVwbGljYXRlCiAgICAgICAgdG8gZWFjaG90aGVyIGJlY2F1c2U8L3R0Pjxicj4KICAgICAg
PHR0PiMgdGhleSB3ZXJlIG5vdCBjb3JyZWN0bHkgaW5pdGlhbGl6ZS48L3R0Pjxicj4KICAgICAg
PHR0PiMgVGhleSBoYXZlIGRpZmZlcmVudCAicmVwbGljYWdlbmVyYXRpb24iCiAgICAgICAgKDU3
YzI5MWQ5MDAwMDA0MjkwMDAwIHZzIDU1YzhmM2FlMDAwMDAwNjAwMDAwKTwvdHQ+PGJyPgogICAg
ICA8dHQ+IzwvdHQ+PGJyPgogICAgICA8dHQ+IyBJdCBpcyBsb29raW5nIGxpa2UgZnJlZWlwYS1z
ZWEgd2FzIGNyZWF0ZWQgb25lIG9yIHR3byB5ZWFycwogICAgICAgIGFnbyBhbmQgdXNlZCB0byBp
bml0aWFsaXplZCBzZWF0dGxlbmZzLjwvdHQ+PGJyPgogICAgICA8dHQ+IyBCdXQgbGF0ZXIgZnJl
ZWlwYS1zZWEgd2FzIHJlY3JlYXRlZC48L3R0Pjxicj4KICAgICAgPHR0PiM8L3R0Pjxicj4KICAg
ICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp
cmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNs
YXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZm
ZmZmZmZmKSkiPC90dD48YnI+CiAgICAgIDx0dD5FbnRlciBMREFQIFBhc3N3b3JkOjwvdHQ+PGJy
PgogICAgICA8dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxj
bj1jb25maWc8L3R0Pjxicj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9u
fSA1N2MyOTFkOTAwMDAwNDI5MDAwMDwvdHQ+PGJyPgogICAgICA8dHQ+bnNkczUwcnV2OiB7cmVw
bGljYSAxMDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9m
cmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4
OTwvYT59CiAgICAgICAgNTdmODQwYmYwMDAwMDQyOTAwMDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8
L3R0Pjxicj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBjbGFzcz0ibW96
LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5
Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn08L3R0Pjxicj4KICAgICAgPHR0
Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAgICAgIDxhIGNsYXNz
PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j
a3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDU5OGExYzE2PC90
dD48YnI+CiAgICAgIDx0dD5uc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAK
ICAgICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2Vh
dHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9h
Pn0gMDAwMDAwMDA8L3R0Pjxicj4KICAgICAgPGJyPgogICAgICA8dHQ+W3Jvb3RAc2VhdHRsZW5m
cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2Vy
JyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlx
dWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAg
ICA8dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25m
aWc8L3R0Pjxicj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1NWM4
ZjNhZTAwMDAwMDYwMDAwMDwvdHQ+PGJyPgogICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYSAx
MDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBh
LXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59
CiAgICAgICAgNTdiMTAzZDQwMDAwMDQyOTAwMDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8L3R0Pjxi
cj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBjbGFzcz0ibW96LXR4dC1s
aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFw
Oi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn3CoAogICAgICAgIDU3YmU4MDRjMDAwMDA1
MGEwMDAwIDU4NzIzNjE1MDAwMDA1MGEwMDAwPC90dD48YnI+CiAgICAgIDx0dD5uc3J1dlJlcGxp
Y2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAKICAgICAgICA8YSBjbGFzcz0ibW96LXR4dC1s
aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFw
Oi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0gMDAwMDAwMDA8L3R0Pjxicj4KICAgICAg
PHR0Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAgICAgIDxhIGNs
YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQu
cm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDAwMDAwMDAw
PC90dD48L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgICBJbiBjb25jbHVzaW9uOjxi
cj4KICAgIMKgwqDCoCBGcm9tIHJlcGxpY2F0aW9uIHBvdiwgdGhlIHR3byBpbnN0YW5jZXMgY2Fu
IG5vdCBjb21tdW5pY2F0ZS48YnI+CiAgICDCoMKgwqAgT25lIHNvbHV0aW9uIHdvdWxkIGJlIHRv
IGlkZW50aWZ5IHdoaWNoIGluc3RhbmNlIGlzIHRoZSBnb29kCiAgICBvbmUsIHlvdSB3YW50IHRv
IGtlZXAuPGJyPgogICAgwqDCoMKgIGFuZCByZWluaXQgdGhlIHNlY29uZCBvbmUgZnJvbSB0aGF0
IHJlZmVyZW5jZS48YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8ZGl2IGNsYXNzPSJtb3otY2l0
ZS1wcmVmaXgiPk9uIDA4LzA4LzIwMTcgMTA6MzMgUE0sIElhbiBIYXJkaW5nIHZpYQogICAgICBG
cmVlSVBBLXVzZXJzIHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKICAgICAg
Y2l0ZT0ibWlkOjJmNjBjNGFmLTY4MGMtNDM4Mi05NzA0LTQxYTI0YzgxMjFhMkBicm93bnBhcGVy
dGlja2V0cy5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8bWV0YSBodHRwLWVxdWl2PSJD
b250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgICAgIDxw
Pk9uIDgvNy8xNyAxOjQ0IEFNLCB0aGllcnJ5IGJvcmRheiB3cm90ZTo8YnI+CiAgICAgIDwvcD4K
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZA
cmVkaGF0LmNvbSI+CiAgICAgICAgPG1ldGEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0
Zi04IgogICAgICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICAgICAgICA8YnI+CiAg
ICAgICAgPGJyPgogICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcv
MjAxNyAwOToyMiBBTSwgRmxvcmVuY2UKICAgICAgICAgIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQ
QS11c2VycyB3cm90ZTo8YnI+CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGJsb2NrcXVvdGUKICAg
ICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUyYzNAcmVk
aGF0LmNvbSIKICAgICAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0LzIwMTcgMTE6MDIgUE0sIElh
biBIYXJkaW5nIHZpYQogICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gOC80LzE3IDI6MTYgQU0sIEZsb3JlbmNlCiAg
ICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6MTMgUE0sIElh
biBIYXJkaW5nCiAgICAgICAgICAgICAgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAg
ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4IEFN
LCBGbG9yZW5jZQogICAgICAgICAgICAgICAgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAg
ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDExOjUxIFBN
LCBJYW4KICAgICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTog
PGJyPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8y
MDE3IDEyOjExIEFNLAogICAgICAgICAgICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3
cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9u
IDA4LzAyLzIwMTcgMDE6NDMgQU0sIElhbgogICAgICAgICAgICAgICAgICAgICAgSGFyZGluZyB3
cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+
T24gMDgvMDEvMjAxNyAxMjowMyBQTSwKICAgICAgICAgICAgICAgICAgICAgICAgUm9iIENyaXR0
ZW5kZW4gd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlw
ZT0iY2l0ZSI+SWFuIEhhcmRpbmcgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDA3OjM5CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBBTSwgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8w
MS8yMDE3IDAzOjExCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBNLCBJYW4gSGFyZGlu
ZyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
MDE6NDggQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDAxOjMyIEFNLCBJYW4gSGFyZGluZyB2
aWEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9
ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT24gMDcvMzEvMjAxNyAxMTozNCBBTSwg
Um9iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENyaXR0ZW5kZW4gd3JvdGU6
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlw
ZT0iY2l0ZSI+SWFuIEhhcmRpbmcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkkgaGFkIGFuCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1bmV4cGVjdGVkIHJlc3RhcnQgb2YgYW4gSVBB
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzZXJ2ZXIgdGhhdCBoYWQg
YXBwYXJlbnRseSBoYWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgdXBkYXRlcyBydW4gYnV0IGhhZCBub3QgYmVlbgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgcmVzdGFydGVkLiBpcGFjdGwgc2F5cwogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgcGtpLXRvbWNhdGQgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgd291bGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgbm90IHN0YXJ0LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBTdHJhbmdlbHksIHRoZSBhY3R1YWwgc2VydmljZQogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgYXBwZWFycyB0byBiZSBydW5uaW5nOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcg
aXMgYW4gYXBwbGljYXRpb24gd2l0aGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgdG9tY2F0IHNvIHRvbWNhdCBjYW4gcnVuIHdpdGhvdXQgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgcnVubmluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBX
ZSBuZWVkIHRvIHNlZSBtb3JlIG9mIHRoZSBkb2d0YWcKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBkZWJ1ZyBsb2cgdG8gc2VlIHdoYXQgaXMgZ29pbmcgb24uCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEl0IGxvb2tzIGxpa2UgYW4gYXV0aGVu
dGljYXRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJvYmxlbS4uLiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTU0wgaGFu
ZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Q291bGQgbm90IGNvbm5lY3QgdG8gTERBUCBzZXJ2ZXIKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaG9zdCBzZWF0dGxlbmZzLmJwdC5yb2NrcyBwb3J0IDYzNiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yIG5ldHNjYXBlLmxkYXAuTERBUEV4
Y2VwdGlvbjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aGVudGljYXRp
b24gZmFpbGVkICg0OSkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIHN0b3JlcyBpdHMgaW50
ZXJuYWwgZGF0YSBpbiB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExEQVAg
c2VydmVyIGFuZCBuZWVkcyB0byA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBlc3RhYmxpc2ggYSBzZWN1cmUgTERBUCBjb25uZWN0aW9uLgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgWW91IGNhbiBjaGVjayBob3cgdGhpcyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBjb25uZWN0aW9uIGlzIGNvbmZpZ3VyZWQgaW4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvY2EvQ1MuY2ZnLCBs
b29rCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmb3IgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBp
bnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVudEF1dGgKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGludGVybmFsZGIubGRhcGF1dGguYmluZEROPWNuPURpcmVjdG9yeQoKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIE1hbmFnZXIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kUFdQcm9tcHQ9aW50ZXJuYWxkYgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lz
dGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5o
b3N0PXZtLS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5h
bGRiLmxkYXBjb25uLnBvcnQ9NjM2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIGludGVybmFsZGIubGRhcGNvbm4uc2VjdXJlQ29ubiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBh
dXRodHlwZSBjYW4gYmUgU3NsQ2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGggYSBzc2wgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgY2VydGlmaWNhdGUpIG9yIEJhc2ljQXV0aAogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGggYSBiaW5kIEROIGFuZCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNzd29yZCBzdG9yZWQgaW4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2Nv
bmYvcGFzc3dvcmQuY29uZikuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBZb3UgY2FuIHVzZSB0aGlzIGluZm9ybWF0aW9uIHRvCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBtYW51YWxseSBjaGVjayB0aGUgY3JlZGVudGlhbHMu
IEZvciA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnN0YW5jZSB3aXRo
IHNzbGNsaWVudGF1dGg6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgTERBUFRMU19DQUNFUlRESVI9L2V0Yy9wa2kvcGtpLXRvbWNh
dC9hbGlhcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgZXhwb3J0IExEQVBUTFNfQ0VSVD0nc3Vic3lzdGVtQ2Vy
dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGxkYXBzZWFyY2ggLUggPGEKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9Im1vei10eHQtbGlu
ay1mcmVldGV4dCIgaHJlZj0ibGRhcHM6Ly8iPmxkYXBzOi8vPC9hPjwvYT5gaG9zdG5hbWVgOjYz
NgoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhU
RVJOQUwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKHByb3ZpZGUgdGhl
IHBhc3N3b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtp
L3BraS10b21jYXQvYWxpYXMvcHdkZmlsZS50eHQpCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJIGZv
dW5kIHRoaXM6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1T
c2xDbGllbnRBdXRoCgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj11aWQ9
cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGF1
dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0
aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBpbnRlcm5hbGRiLmxkYXBjb25uLmNsb25lUmVwbGljYXRpb25Qb3J0PTM4OQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBhbmQgd2hlbiBJIHRyeSB0aGUgbGRhcHNlYXJjaCBJIGFt
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJlc2VudGVkIHdpdGggYSBwcm9tcHQg
dG8gcHJvdmlkZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBwaW4vcGFz
c3dvcmQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgZW50ZXIgcGluLCBwYXNzd29yZCwgb3IgcGFz
cwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkgdG9r
ZW4gJ2xkYXAoMCknOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZCBm
aWxlLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICB5b3UgYXJlIHJpZ2h0LCBpbiA0LjQuIHRoZXJlIGlz
IG5vCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB3ZGZpbGUudHh0IGFuZCB0aGUgcGFz
c3dvcmQgY2FuIGJlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZm91bmQgaW4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29u
Zi9wYXNzd29yZC5jb25mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICh3aXRoIHRoZSB0
YWcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4pIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRoIHRoZSB0YWcKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWw9Li4uIGFsbG93cyB0byByZWFkIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPyA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtp
L3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJv
dmlkZSBwYXNzd29yZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgVGhhdCB3b3Jrcy4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtp
L3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0
aWw6IENoZWNraW5nIHRva2VuICJOU1MgQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIERCIiBpbiBzbG90ICJOU1MgVXNlciBQcml2YXRlIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIEtleSBhbmQgQ2VydGlmaWNhdGUgU2VydmljZXMiIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZp
Y2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgREIiOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAmbHQ7IDAmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
MGYzMjdlNzYwYTdlZWNkY2Y2OTczZjVkYzU3Y2E1MzY3YzU5MmQ2NMKgwqAKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIChvcnBoYW4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICZsdDsgMSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBiMTI1ODBjN2M2OTZj
ZmNkOGFlZmM5NDA1YTdhODcwYjI0YjdiOTZhwqDCoAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgTlNTIENlcnRpZmljYXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOmF1
ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgJmx0OyAyJmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDg4MWI3MjU0YzQw
ZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGNhU2lnbmluZ0NlcnQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2kt
Y2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0OyByc2EKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGZhOWEyNTVhMWQxNTU4NWFjMjgwNjRjMGY0OTg2ZTQxNmJj
NDg0MDPCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtp
LWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgNCZndDsgcnNhCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAzZmI2MDlkMGY3ZDcyYzJkMzI1ZDZhMmRjMTY1NzdhN2Y3
ZTVhMDFmCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAmbHQ7IDUmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5
NDc5YTk1NTZhZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBEQjpzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJ1dCB0aGlzIGRvZXNu
J3QgKHdpdGggdGhlIHNhbWUgcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZy
b20gcGFzc3dvcmQuY29uZikgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGhyZWY9ImxkYXBzOi8vIiBtb3otZG8tbm90LXNlbmQ9InRy
dWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXBzOi8vIj5sZGFw
czovLzwvYT48L2E+YGhvc3RuYW1lYDo2MzYKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAt
YiAiIiAtcyBiYXNlIC1ZIEVYVEVSTkFMIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
IFBsZWFzZSBlbnRlciBwaW4sIHBhc3N3b3JkLCBvciBwYXNzIHBocmFzZQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgZm9yIHNlY3VyaXR5IHRva2VuICdsZGFwKDApJzogPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgU0FTTC9FWFRFUk5BTCBhdXRoZW50aWNhdGlvbiBzdGFydGVk
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxkYXBfc2FzbF9pbnRlcmFjdGl2ZV9i
aW5kX3M6IEludmFsaWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRlbnRpYWxzICg0
OSkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgVGhhdCBwYXNzd29yZCBpcyBnZXR0aW5nIG1lIHNvbWV3aGVyZQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgdGhvdWdoLCBzaW5jZSBpZiBJIHB1dCBpbiBhIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIG5vbnNlbnNlIG9yIGluY29ycmVjdCBwYXNzd29yZCBp
dCBqdXN0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcm9tcHRzIG92ZXIgYW5kIG92ZXIu
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIExldCdzIHN0ZXAg
YmFjayBhIHNlY29uZC4gWW91IHVwZ3JhZGVkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAg
ICB3aGF0IHRvIHdoYXQ/IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl
PgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFRo
ZXJlIHdhc24ndCBtdWNoIG9mIGEgY2hhbmdlLi4uIEkganVzdCBhc3N1bWVkCiAgICAgICAgICAg
ICAgICAgICAgICAgIHNvbWVvbmUgcmFuIHl1bSB1cGdyYWRlIGFuZCBkaWRuJ3QgcmVzdGFydCwg
dGhlbgogICAgICAgICAgICAgICAgICAgICAgICB0aGUgcG93ZXIgb3V0YWdlLi4uIGl0IGxvb2tz
IGxpa2Ugbm90IG11Y2ggb2YgYQogICAgICAgICAgICAgICAgICAgICAgICB2ZXJzaW9uIGNoYW5n
ZSB0aG91Z2guIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAjIGdyZXAgaXBhIC92YXIvbG9nL3l1bS5sb2cgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICBKYW4gMDggMDQ6NDU6MzIgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAg
ICAgICBpcGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAgICAgICAgICAg
ICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5v
YXJjaAogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
IEphbiAwOCAwNDo0NjowNiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBsaWJpcGFf
aGJhYy0xLjE0LjAtNDMuZWw3XzMuNC54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICBKYW4gMDggMDQ6NDY6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9u
LWxpYmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIEphbiAwOCAwNDo0NjowOCBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAg
ICAgIHB5dGhvbi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNCBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAg
ICAgICAgIHB5dGhvbjItaXBhbGliLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3Mu
MS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgIEphbiAwOCAwNDo0NzowNSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBp
cGEtYWRtaW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2ggPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDUgSW5zdGFsbGVkOgogICAgICAgICAgICAg
ICAgICAgICAgICBpcGEtc2VydmVyLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2Fy
Y2gKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBK
YW4gMDggMDQ6NDc6MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICBweXRob24y
LWlwYXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDcgVXBk
YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgc3NzZC1pcGEtMS4xNC4wLTQzLmVsN18zLjQu
eDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE3IFVwZGF0
ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40LjAtMTQuZWw3LmNlbnRv
cy4xLjEueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIz
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40LjAtMTQuZWw3
LmNlbnRvcy4xLjEueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0
OjQ3OjI3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItZG5zLTQu
NC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
IEphbiAwOCAwNDo0NzozNiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1w
eXRob24tY29tcGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo1MDowNyBF
cmFzZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1weXRob24tNC4yLjAtMTUuMC4xLmVs
Ny5jZW50b3MuMTkueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5
OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAt
MTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy
OCAwOTo1NTo0MiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LWNv
bW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgSnVsIDI4IDA5OjU1OjQzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlw
YS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAg
ICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NCBVcGRhdGVkOgogICAgICAg
ICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjcu
bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ1IFVwZGF0
ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2VydmVyLTQuNC4wLTE0LmVs
Ny5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6
NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40
LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEp1
bCAyOCAwOTo1NTo0NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50
LTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNl
cnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlw
YS1zZXJ2ZXItZG5zLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgaXBhLXB5dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgIyBn
cmVwIHBraSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFu
IDA4IDA0OjQ2OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEw
LjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg
MDQ6NDY6MDkgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAga3JiNS1wa2luaXQtMS4x
NC4xLTI3LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw
NDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEt
MTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAw
OCAwNDo0NzoxOSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAu
My4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw
NDo0NzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMu
My0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6
NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4zLjMtMTQu
ZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIy
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMtMTQuZWw3XzMu
bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjE2IFVwZGF0
ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xOS5lbDdfMy5ub2Fy
Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoK
ICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTkuZWw3XzMubm9h
cmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjE3IFVwZGF0ZWQ6
CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTkuZWw3XzMueDg2XzY0
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgIHBraS1zZXJ2ZXItMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAg
ICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MjEgVXBkYXRlZDoKICAgICAgICAg
ICAgICAgICAgICAgICAgcGtpLWNhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICBBcmUgeW91IHJ1bm5pbmcgaW4gU0VMaW51eCBlbmZvcmNpbmcgbW9k
ZT8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgIyBnZXRlbmZvcmNlIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgRW5mb3JjaW5nIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj
aXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIElmIHNvIGNhbiB5b3UgcnVuOiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICMgYXVzZWFyY2ggLW0gQVZDIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gdG8gbG9nX2Zvcm1hdCBp
cyBkZXByZWNhdGVkLgogICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgdXNlIHRoZSB3cml0
ZV9sb2dzIG9wdGlvbi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0
aW9uIGlzIG92ZXJyaWRpbmcgdGhlIHdyaXRlX2xvZ3MKICAgICAgICAgICAgICAgICAgICAgICAg
Y3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC0tLS0gPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICB0aW1lLSZndDtNb24gTWFyIDE0IDEwOjM5OjAxIDIwMTYg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NBTEwgbXNnPWF1ZGl0KDE0NTc5
NzcxNDEuNzY3OjE3NTM3KToKICAgICAgICAgICAgICAgICAgICAgICAgYXJjaD1jMDAwMDAzZSBz
eXNjYWxsPTIgc3VjY2Vzcz1ubyBleGl0PS0xMwogICAgICAgICAgICAgICAgICAgICAgICBhMD03
ZmJjYWIwMzhkMTAgYTE9ODAwIGEyPTEgYTM9N2ZiY2E2MGY0MmUwCiAgICAgICAgICAgICAgICAg
ICAgICAgIGl0ZW1zPTAgcHBpZD0xNDA2IHBpZD0xMjk2NSBhdWlkPTQyOTQ5NjcyOTUKICAgICAg
ICAgICAgICAgICAgICAgICAgdWlkPTAgZ2lkPTAgZXVpZD01ODE0MDAwMDEgc3VpZD0wCiAgICAg
ICAgICAgICAgICAgICAgICAgIGZzdWlkPTU4MTQwMDAwMSBlZ2lkPTU4MTQwMDAwMSBzZ2lkPTAK
ICAgICAgICAgICAgICAgICAgICAgICAgZnNnaWQ9NTgxNDAwMDAxIHR0eT0obm9uZSkgc2VzPTQy
OTQ5NjcyOTUKICAgICAgICAgICAgICAgICAgICAgICAgY29tbT0ic3NoZCIgZXhlPSIvdXNyL3Ni
aW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgICAgc3Viaj1zeXN0ZW1fdTpzeXN0ZW1fcjpz
c2hkX3Q6czAtczA6YzAuYzEwMjMKICAgICAgICAgICAgICAgICAgICAgICAga2V5PShudWxsKSA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDIG1zZz1hdWRpdCgxNDU3OTc3MTQx
Ljc2NzoxNzUzNyk6IGF2YzrCoAogICAgICAgICAgICAgICAgICAgICAgICBkZW5pZWQgeyByZWFk
IH0gZm9yIHBpZD0xMjk2NSBjb21tPSJzc2hkIgogICAgICAgICAgICAgICAgICAgICAgICBuYW1l
PSJhdXRob3JpemVkX2tleXMiIGRldj0iZG0tMiIgaW5vPTExNjM5MzUxNwogICAgICAgICAgICAg
ICAgICAgICAgICBzY29udGV4dD1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAuYzEw
MjMKICAgICAgICAgICAgICAgICAgICAgICAgdGNvbnRleHQ9c3lzdGVtX3U6b2JqZWN0X3I6dW5s
YWJlbGVkX3Q6czAKICAgICAgICAgICAgICAgICAgICAgICAgdGNsYXNzPWZpbGUgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBzdXNwZWN0IHRo
YXQgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtIGNlcnQgd2FzIHJlbmV3
ZWQgYW5kIGV2ZXJ5dGhpbmcKICAgICAgICAgICAgICAgICAgICAgICAgICB3YXNuJ3QgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0
aGlzIGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgdW5yZWxhdGVkIHRvIHRoZSB1cGdyYWRl
IGl0IGp1c3QgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIHNob25lIGEgc3BvdGxpZ2h0
IG9uIGl0LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIENhbiB5b3UgcnVuIHRoZXNlIGNvbW1hbmRzOiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJj
aCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcKICAgICAgICAgICAgICAgICAgICAg
ICAgICAtYiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1w
ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBk
ZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgVGhpcyByZXR1cm5zIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAt
RCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XCiAgICAgICAgICAgICAgICAgICAgICAgIC1iIHVp
ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgdXNl
ckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgRW50
ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBr
aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIHVz
ZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB
Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC4uLiBzdHVmZiAuLi4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICBaTm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4
WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246
IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1C
UFQuUk9DS1M7Q049Q0EKICAgICAgICAgICAgICAgICAgICAgICAgU3Vic3lzdGVtLE89QlBULlJP
Q0tTIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5hbmQgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1kIC9l
dGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vi
c3lzdGVtQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwg
Z3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwg
LWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAg
ICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgVGhlc2UgYm90aCBy
ZXR1cm4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbgogICAg
ICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgfCBncmVwIFNl
cmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBm
b3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAg
ICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09JRDogVW5yZWNvZ25p
emVkIE9iamVjdAogICAgICAgICAgICAgICAgICAgICAgICBJZGVudGlmaWVyLiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10b21jYXQv
YWxpYXPCoCAtbgogICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBr
aS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcg
dG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIgaW4KICAgICAgICAgICAgICAgICAgICAgICAgc2xv
dCAiTlNTIFVzZXIgUHJpdmF0ZSBLZXkgYW5kIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAg
ICAgICAgIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3
b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6CiAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGlu
ZyBrZXlzOgogICAgICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09J
RDogVW5yZWNvZ25pemVkIE9iamVjdAogICAgICAgICAgICAgICAgICAgICAgICBJZGVudGlmaWVy
LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICB5b3UgbWFkZSBhIHR5cG8gYW5k
IHJlcXVlc3RlZCB0aGUga2V5cyAoLUspCiAgICAgICAgICAgICAgICAgICAgICBpbnN0ZWFkIG9m
IHRoZSBjZXJ0cyAoLUwpLiBQbGVhc2UgcmV0cnkgd2l0aCAtTAogICAgICAgICAgICAgICAgICAg
ICAgYW5kIHlvdSBzaG91bGQgYmUgYWJsZSB0byBzZWUgdGhlIGNlcnRpZmljYXRlCiAgICAgICAg
ICAgICAgICAgICAgICBzZXJpYWwuIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxM
TCAtRAogICAgICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAg
ICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0
aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAg
ICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgZG46
IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAg
IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFn
SUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAg
ICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQu
Uk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBT
byB0aGUgc2VyaWFsIGlzIDQ/IDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAg
ICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0
CiAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAg
ICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0
MSAoMHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICBXaGljaCBpcyBOT1QgNC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1k
CiAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lz
dGVtQ2VydAogICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tIDxicj4KICAgICAgICAgICAg
ICAgICAgICBNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBN
Ukl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgc2plaUZiVUZ0b01uZm1ITElZcGU1UUFS
IDxicj4KICAgICAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIDxicj4K
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgQW5kIHRoaXMgY2Vy
dCBpcyBOT1QgdGhlIHNhbWUuIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICB3aGVuIGNlcnRtb25nZXIgcmVuZXdz
IGEgY2VydGlmaWNhdGUsIGl0IHJ1bnMgcHJlLXNhdmUKICAgICAgICAgICAgICAgICAgYW5kIHBv
c3Qtc2F2ZSBjb21tYW5kcyAod2hpY2ggeW91IGNhbiBzZWUgaW4gdGhlCiAgICAgICAgICAgICAg
ICAgIG91dHB1dCBvZiBnZXRjZXJ0IGxpc3QpLiBJbiB5b3VyIGNhc2UsIHRoZSBwb3N0LXNhdmUK
ICAgICAgICAgICAgICAgICAgY29tbWFuZCBmb3Igc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSBw
cm9iYWJseSBmYWlsZWQuCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICBUaGlzIGNvbW1hbmQgKG9uIHRoZSByZW5ld2FsIG1hc3Rl
cikgaXMgcmVzcG9uc2libGUKICAgICAgICAgICAgICAgICAgZm9yIGNvcHlpbmcgdGhlIG5ldyBj
ZXJ0IGZyb20gdGhlIE5TUyBkYiB0byB0aGUgTERBUAogICAgICAgICAgICAgICAgICBzZXJ2ZXIu
IFlvdSBuZWVkIGZpcnN0IHRvIGNoZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMKICAgICAgICAgICAg
ICAgICAgdGhlIHJlbmV3YWwgbWFzdGVyIChhcyB0aGUgc2VyaWFsIG51bWJlcnMgYXJlIGluIGEK
ICAgICAgICAgICAgICAgICAgY29tcGxldGVseSBkaWZmZXJlbnQgcmFuZ2UsIEkgYXNzdW1lIHRo
YXQgeW91IGhhdmUKICAgICAgICAgICAgICAgICAgbXVsdGlwbGUgSVBBIHNlcnZlcnMgY29uZmln
dXJlZCB3aXRoIGEgQ0EgaW5zdGFuY2UpOiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgJCBleHBvcnQgQkFTRUROPWBncmVwIGJhc2VkbiAvZXRjL2lwYS9kZWZh
dWx0LmNvbmYgfAogICAgICAgICAgICAgICAgICBjdXQgLWQ9IC1mMi1gIDxicj4KICAgICAgICAg
ICAgICAgICAgJCBraW5pdCBhZG1pbiA8YnI+CiAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJj
aCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQSSAtYgogICAgICAgICAgICAg
ICAgICAiY249bWFzdGVycyxjbj1pcGEsY249ZXRjLCRCQVNFRE4iCiAgICAgICAgICAgICAgICAg
ICcoJmFtcDsoY249Q0EpKGlwYUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScgZG4gPGJy
PgogICAgICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgICAgY249Q0EsY249dm0taXBh
c2VydmVyLmlwYWRvbWFpbi5jb20sY249bWFzdGVycyxjbj1pcGEsY249ZXRjLGRjPWlwYWRvbWFp
bixkYz1jb20KCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICBJbiB0aGlzIGV4YW1wbGUgdGhlIHJlbmV3YWwgbWFzdGVyIGlzIHZt
LWlwYXNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBJIGdldCB0
aGlzIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICQgbGRhcHNlYXJj
aCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQSSAtYgogICAgICAgICAgICAg
ICAgImNuPW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICAgJygm
YW1wOyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJyBkbiA8YnI+CiAg
ICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2VhLmJw
dC5yb2Nrcyxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBXaGljaCBp
cyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgSGkgSWFuLCA8YnI+CiAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgIGl0J3MgZ2V0dGluZyBkaWZmaWN1bHQgdG8gZm9s
bG93IHRoaXMgdGhyZWFkLCBzbyBjb3VsZCB3ZQogICAgICAgICAgICAgIHN0ZXAgYmFjayBhbmQg
c3VtbWFyaXplPyA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgWWVz
LCBpdCBpcy7CoCBTb3JyeS4gPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij4gPGJyPgogICAgICAgICAgICAgIC0gT24gc2VydmVyIGZyZWVpcGEtc2VhICg9cmVuZXdhbCBt
YXN0ZXIpLCB0aGUgQ0EKICAgICAgICAgICAgICBjb21wb25lbnQgaXMgaW5zdGFsbGVkIGFuZCAn
c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgaGFzCiAgICAgICAgICAgICAgU2VyaWFsIG51bWJl
ciA0IGluIHRoZSBOU1NEQiAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAg
ICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBObz8gPGJyPgogICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAg
ICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtp
LWNhJyB8CiAgICAgICAgICAgIGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgwqDCoMKgwqDC
oMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAg
ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPi0gT24gc2VydmVyIHNlYXR0bGVuZnMgKHdo
ZXJlIFBLSQogICAgICAgICAgICAgIGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50
IGlzIGluc3RhbGxlZCBhbmQKICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j
YScgaGFzIFNlcmlhbCBudW1iZXIgMTM0MTcxODU0MQogICAgICAgICAgICAgIGluIHRoZSBOU1NE
QiAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzLiA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90
ZT4KICAgICAgICAgICAgWWVzIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbcm9v
dEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAvZXRjL3BraS9w
a2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8CiAgICAgICAg
ICAgIGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwg
TnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAtIElu
IHRoZSBMREFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUgZW50cnkKICAgICAg
ICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHdpdGggU2VyaWFsIG51bWJl
ciA0IChpLmUuCiAgICAgICAgICAgICAgaXQgaXMgdGhlIGNlcnQgZnJvbSBmcmVlaXBhLXNlYSku
IDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBUaGlzIGlzIHdoZXJl
IHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28gY2VydGlmaWNhdGVzCiAgICAgICAg
ICAgIG9uIHRoZSBtYXN0ZXIgYW5kIG9ubHkgb25lIG9uIHRoZSBvdGhlci7CoCBJIHdvbmRlciBp
ZiB0aGlzCiAgICAgICAgICAgIGlzIGEgcmVzdWx0IG9mIHRoZSBzbG93IG1vdGlvbiByZXBsaWNh
dGlvbiB0cmFpbndyZWNrIEkgaGF2ZQogICAgICAgICAgICBnb2luZyBvbiBkdWUgdG8gYSB6b21i
aWUgcmVwbGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0CiAgICAgICAgICAgIG5vIGxvbmdl
ciBleGlzdHMgaW4gdGhlIHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qgc2VlbSB0byBnZXQKICAgICAg
ICAgICAgcmlkIG9mLiA8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgIDwvYmxvY2txdW90
ZT4KICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICB0aGUgcmVtYWlu
aW5nIGlzc3VlIGlzIGEgcmVwbGljYXRpb24gcHJvYmxlbS4gVGhlcmUgaXMgYQogICAgICAgICAg
IlRyb3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBbMV0gaW4gSWRNIEFkbWluIGd1
aWRlCiAgICAgICAgICB0aGF0IG1heSBoZWxwIHlvdS4gPGJyPgogICAgICAgICAgPGJyPgogICAg
ICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1hbmRzIGRpZCB5
b3UgdXNlIHRvCiAgICAgICAgICB0cnkgdG8gcmVtb3ZlIGl0LCBhbmQgd2hhdCB3YXMgdGhlIG91
dHB1dD8gPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgRmxvIDxicj4KICAgICAgICAgIDxi
cj4KICAgICAgICAgIFsxXSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgpocmVmPSJo
dHRwczovL2FjY2Vzcy5yZWRoYXQuY29tL2RvY3VtZW50YXRpb24vZW4tVVMvUmVkX0hhdF9FbnRl
cnByaXNlX0xpbnV4LzcvaHRtbC9MaW51eF9Eb21haW5fSWRlbnRpdHlfQXV0aGVudGljYXRpb25f
YW5kX1BvbGljeV9HdWlkZS90cm91YmxlLWdlbi1yZXBsaWNhdGlvbi5odG1sIgogICAgICAgICAg
ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1l
bnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFp
bl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJl
cGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90
ZT4KICAgICAgICA8YnI+CiAgICAgICAgSGksPGJyPgogICAgICAgIDxicj4KICAgICAgICBUbyBk
ZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZCBzZXZlcmFs
CiAgICAgICAgaW5mbyBidXQgc3RhcnRpbmcgd2l0aCB0aGUgcmVzdWx0cyBvZiB0aGUgZm9sbG93
aW5nIGNvbW1hbmRzPGJyPgogICAgICAgIDxicj4KICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBp
YW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2VyJyAt
VyAtYiAidWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVudHJ5d3NpPGJyPgog
ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2Vh
cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJwogICAgICAtVyAtYiAidWlkPXBraWRi
dXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVudHJ5d3NpPGJyPgogICAgICBFbnRlciBMREFQ
IFBhc3N3b3JkOiA8YnI+CiAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh
PGJyPgogICAgICBuc2NwZW50cnl3c2k6IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlw
YWNhPGJyPgogICAgICBuc2NwZW50cnl3c2k6CiAgICAgIGVudHJ5dXNuO2FkY3NuLTU5MzhlNjg4
MDAwMTA0MjkwMDA1O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1OiA8YnI+CiAgICAgIMKgNzUy
NzQ4OTc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaToKICAgICAgbW9kaWZ5VGltZXN0YW1wO2FkY3Nu
LTU5MzhlNjg4MDAwMTA0MjkwMDA0O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0Mjxicj4KICAgICAgwqA5
MDAwNDogMjAxNzA2MDgwNTUzMzRaPGJyPgogICAgICBuc2NwZW50cnl3c2k6CiAgICAgIG1vZGlm
aWVyc05hbWU7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDM7dnVjc24tNTkzOGU2ODgwMDAxMDQy
OTA8YnI+CiAgICAgIMKgMDAzOiBjbj1EaXJlY3RvcnkgTWFuYWdlcjxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxi
cj4KICAgICAgbnNjcGVudHJ5d3NpOiBjbjogcGtpZGJ1c2VyPGJyPgogICAgICBuc2NwZW50cnl3
c2k6IGNyZWF0ZVRpbWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgICBuc2NwZW50cnl3
c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgIG5zY3BlbnRy
eXdzaTogZGVzY3JpcHRpb247dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDE6CiAgICAgIDI7MTM0
MTcxODU0MTtDTj1DZXJ0aWZpYzxicj4KICAgICAgwqBhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tT
O0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBkZXNj
cmlwdGlvbjt2ZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMjtkZWxldGVkOgogICAgICAyOzQ7Q049
Q2VydGlmaWNhPGJyPgogICAgICDCoHRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJz
eXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbWFpbDo8YnI+CiAgICAg
IG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBv
YmplY3RDbGFzczogcGVyc29uPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBv
cmdhbml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczog
aW5ldE9yZ1BlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21zdXNl
cjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNvOiBDTj1DQSBTdWJzeXN0ZW0sTz1CUFQu
Uk9DS1M8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogc246IHBraWRidXNlcjxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2Vy
dGlmaWNhdGU6OgogICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNG
QURBME1SPGJyPgogICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgIMKgY0JkNG5PVjRtOUErcVJa
Tm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9PGJyPgogICAgICBu
c2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMDo6
CiAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8YnI+CiAgICAgICZsdDtzbmlwJmd0Ozxicj4KICAg
ICAgwqBBUjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZn
dDs8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgogICAgICBuc2NwZW50
cnl3c2k6IHVzZXJ0eXBlOiBhZ2VudFR5cGU8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogcGFyZW50
aWQ6IDI8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogZW50cnlpZDogNTE8YnI+CiAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20i
PgogICAgICAgIGFuZDxicj4KICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2Vh
cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lk
YnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgbnNjcGVudHJ5d3NpPGJyPgogICAgICA8L2Jsb2NrcXVv
dGU+CiAgICAgIDxicj4KICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAt
TExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgICAgLVcgLWIgdWlkPXBraWRidXNlcixv
dT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAgICAgIEVudGVyIExEQVAgUGFzc3dv
cmQ6IDxicj4KICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+
CiAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tT
PGJyPgogICAgICBuc2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgIE1JSURjekND
QWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICZsdDtzbmlw
Jmd0Ozxicj4KICAgICAgwqBjQmQ0bk9WNG05QStxUlpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFT
eGx5RThYRW84ZGZBUFhNSm9GYz08YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246
IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vi
czxicj4KICAgICAgwqB5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBl
bnRyeWlkOiA1MTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBwYXJlbnRpZDogMjxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBtb2RpZnlUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBtb2RpZmllcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAg
ICAgbnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgog
ICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnR5
cGU6IGFnZW50VHlwZTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiBjbjogcGtpZGJ1c2VyPGJyPgogICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lk
YnVzZXI8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAgIG5z
Y3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmpl
Y3RDbGFzczogcGVyc29uPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdh
bml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogaW5l
dE9yZ1BlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21zdXNlcjxi
cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEw
YjhiOC0xZmRkODA3NDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeXVzbjogODY8YnI+CiAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJl
ZGhhdC5jb20iPiA8YnI+CiAgICAgICAgRnJvbSB0aGUgb3V0cHV0IHlvdSBtYXkgb25seSBjb3B5
L3Bhc3QgdGhlIG9uZXMgcmVsYXRlZCB0bwogICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTxicj4KICAg
ICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIEFsc28gdG8gZHVtcCB0aGUgY3VycmVudCBy
ZXBsaWNhdGlvbiBzdGF0dXMsIHNlbmQgdGhlIHJlc3VsdMKgIG9mPGJyPgogICAgICAgIFtyb290
QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAg
ICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250IHNpemU9Ii0xIj48aT4gPC9pPiIoJmFt
cDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYt
ZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgPC9mb250PjwvYmxvY2txdW90ZT4KICAg
ICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0
b3J5IG1hbmFnZXInCiAgICAgIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5z
dG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZm
KSkiPGJyPgogICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgIGRuOiBjbj1yZXBs
aWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBjbjog
cmVwbGljYTxicj4KICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgbnNEUzVSZXBsaWNhQmlu
ZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgIGNsb25lQWdyZWVtZW50MS1mcmVlaXBh
LXNlYS5icHQucm9jPGJyPgogICAgICDCoGtzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1jb25m
aWc8YnI+CiAgICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgog
ICAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvYzxicj4KICAgICAgwqBrcy1w
a2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICBuc0RTNVJlcGxpY2FJZDog
MTA2NTxicj4KICAgICAgbnNEUzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3OTExZTYtOTNlNmVm
NGItNjlkY2MyZDE8YnI+CiAgICAgIG5zRFM1UmVwbGljYVJvb3Q6IG89aXBhY2E8YnI+CiAgICAg
IG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICAgIG5zU3RhdGU6OiBLUVFBQUFBQUFBQWhISXBa
QUFBQUFBRUFBQUFBQUFBQUtnQUFBQUFBQUFBQkFBQUFBQUFBQUE9PTxicj4KICAgICAgbnNkczVy
ZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAgICAgIG1hbmFnZXJzLGNuPXN5c2Fj
Y291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAgICDCoGRjPXJvY2tzPGJyPgogICAgICBuc2Rz
NXJlcGxpY2FiaW5kZG5ncm91cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICBvYmplY3RDbGFz
czogdG9wPGJyPgogICAgICBvYmplY3RDbGFzczogbnNEUzVSZXBsaWNhPGJyPgogICAgICBvYmpl
Y3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdl
bmVyYXRpb259IDU3YzI5MWQ5MDAwMDA0MjkwMDAwPGJyPgogICAgICBuc2RzNTBydXY6IHtyZXBs
aWNhIDEwNjUgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgIGNsYXNzPSJtb3otdHh0
LWxpbmstZnJlZXRleHQiCiAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2Nr
czozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgNTdmODQw
YmYwMDAwMDQyOTAwMDxicj4KICAgICAgwqAwIDU5OGExYzQwMDAwMTA0MjkwMDAwPGJyPgogICAg
ICBuc2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAg
ICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgaHJlZj0ibGRhcDovL3Nl
YXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwv
YT59PGJyPgogICAgICBuc2RzNWFnbXRtYXhjc246CiAgICAgIG89aXBhY2E7Y2xvbmVBZ3JlZW1l
bnQxLWZyZWVpcGEtc2VhLmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgIMKgdGxl
bmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICAgIG5zZHM1YWdtdG1heGNzbjoK
ICAgICAgbz1pcGFjYTttYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10
b21jYXQ7c2VhdDxicj4KICAgICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1bmF2YWlsYWJsZTxi
cj4KICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhIG1vei1k
by1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0Igog
ICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJl
ZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgIDU5OGE8YnI+CiAgICAgIMKgMWMxNjxi
cj4KICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhIG1vei1k
by1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0Igog
ICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0
dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAwMDAwMDxicj4KICAgICAgwqAwMDA8YnI+
CiAgICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiA4ODU8YnI+CiAgICAgIG5zZHM1cmVwbGlj
YXJlYXBhY3RpdmU6IDA8YnI+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1p
ZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPjxmb250CiAgICAgICAgICBzaXplPSItMSI+
IGFuZDxicj4KICAgICAgICA8L2ZvbnQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJj
aCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8
Zm9udCBzaXplPSItMSI+PGk+IDwvaT4iKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShu
c1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAg
ICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgICBbcm9v
dEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5h
Z2VyJwogICAgICAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9u
ZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4K
ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICBkbjogY249cmVwbGljYSxjbj1v
XDNEaXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgY246IHJlcGxpY2E8
YnI+CiAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249
UmVwbGljYXRpb24gTWFuYWdlcgogICAgICBjbG9uZUFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQu
cm9jazxicj4KICAgICAgwqBzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1jb25maWc8YnI+CiAg
ICAgIG5zRFM1UmVwbGljYUlkOiAxMjkwPGJyPgogICAgICBuc0RTNVJlcGxpY2FOYW1lOiA4NzA2
YWIxZS02YTgzMTFlNi1hOWJmZGJiZi03NGRjNzMyMzxicj4KICAgICAgbnNEUzVSZXBsaWNhUm9v
dDogbz1pcGFjYTxicj4KICAgICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgICAgbnNTdGF0
ZTo6IENnVUFBQUFBQUFBS0ZZcFpBQUFBQUFBQUFBQUFBQUFBS2dBQUFBQUFBQUFCQUFBQUFBQUFB
QT09PGJyPgogICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAg
ICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICAgIMKgZGM9
cm9ja3M8YnI+CiAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8
YnI+CiAgICAgIG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAgIG9iamVjdENsYXNzOiBuc0RTNVJl
cGxpY2E8YnI+CiAgICAgIG9iamVjdENsYXNzOiBleHRlbnNpYmxlb2JqZWN0PGJyPgogICAgICBu
c2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAwMDA8YnI+CiAg
ICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAg
ICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICBocmVmPSJsZGFwOi8v
c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5
PC9hPn0KICAgICAgNTdiZTgwNGMwMDAwMDUwYTAwMDA8YnI+CiAgICAgIMKgIDU4NzIzNjE1MDAw
MDA1MGEwMDAwPGJyPgogICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgbW96LWRvLW5v
dC1zZW5kPSJ0cnVlIgogICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAg
ICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBh
LXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgNTdiMTAzZDQwMDAwMDQyOTAwMDxicj4KICAg
ICAgwqAwIDU3YmU4MDQzMDAwNzA0MjkwMDAwPGJyPgogICAgICBuc2RzNWFnbXRtYXhjc246CiAg
ICAgIG89aXBhY2E7Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21j
YXQ7ZnJlZWk8YnI+CiAgICAgIMKgcGEtc2VhLmJwdC5yb2NrczszODk7MTA2NTs1ODcyMzYxNTAw
MDAwNTBhMDAwMDxicj4KICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAx
MjkwIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5r
LWZyZWV0ZXh0IgogICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODki
PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAwMDAwMDxicj4KICAg
ICAgwqAwMDA8YnI+CiAgICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2
NSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1m
cmVldGV4dCIKICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+
bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAwMDAwPGJyPgogICAg
ICDCoDAwMDA8YnI+CiAgICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiAzPGJyPgogICAgICBu
c2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
IiBjaXRlPSJtaWQ6NTk4ODI4NzEuMTAwMDEwNkByZWRoYXQuY29tIj48Zm9udAogICAgICAgICAg
c2l6ZT0iLTEiPiA8YnI+CiAgICAgICAgICBSZWdhcmRzPGJyPgogICAgICAgICAgdGhpZXJyeTxi
cj4KICAgICAgICA8L2ZvbnQ+CiAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgIGNpdGU9Im1p
ZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUyYzNAcmVkaGF0LmNvbSIKICAgICAg
ICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3Jvb3RA
ZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2gKICAgICAgICAgICAgLUxMTCAtRCAnY249ZGly
ZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl
LG89aXBhY2EgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICBkbjogdWlkPXBr
aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0
ZTo6CiAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZB
REEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIMKgICZsdDt0
cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZh
MVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6
CiAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNG
QURBME1SSXdFQVlEVlFRSwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICZsdDt0cnVuY2F0
ZWQmZ3Q7IGZ1UVFabVAxWHJLa3Jmc2plaUZiVUZ0b01uZm1ITElZcGU1UUFSIDxicj4KICAgICAg
ICAgICAgZGVzY3JpcHRpb246IDI7MTM0MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAg
ICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtIDxicj4KICAgICAgICAgICAg
wqAgLE89QlBULlJPQ0tTIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249
ZGlyZWN0b3J5CiAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVv
cGxlLG89aXBhY2EKICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4K
ICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICBkbjogdWlk
PXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZp
Y2F0ZTo6CiAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFR
c0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIMKgICZs
dDt0cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1
TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAy
OzQ7Q049Q2VydGlmaWNhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAg
IFN1YnN5c3RlbSxPPUJQVC5STyA8YnI+CiAgICAgICAgICAgIMKgIENLUyA8YnI+CiAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWYgeW91IGNoZWNr
IHRoZSBjZXJ0aWZpY2F0ZXMgZGF0ZXMsCiAgICAgICAgICAgICAgSSBndWVzcyB0aGF0IHRoZSBt
b3N0IHJlY2VudCBvbmUgaXMgb24gc2VydmVyIHNlYXR0bGVuZnMKICAgICAgICAgICAgICAoYmVj
YXVzZSBvZiBzZXJpYWwgbnVtYmVycykuIENhbiB5b3UgY29uZmlybSB0aGlzIChiZWNhdXNlCiAg
ICAgICAgICAgICAgb3VyIGdvYWwgaXMgdG8gaGF2ZSB0aGUgbW9zdCByZWNlbnQgY2VydCBzdG9y
ZWQgaW4gYWxsIHRoZQogICAgICAgICAgICAgIE5TU0RCcyBhbmQgaW4gTERBUCk/IDxicj4KICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgVGhhbmtzLCA8YnI+CiAgICAgICAgICAgICAg
RmxvIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg
dHlwZT0iY2l0ZSI+SWYgeW91ciByZW5ld2FsIG1hc3RlciBpcyB0aGUKICAgICAgICAgICAgICAg
ICAgbWFjaGluZSBvbiB3aGljaCB0aGUgTlNTIERCIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMK
ICAgICAgICAgICAgICAgICAgY29udGFpbnMgdGhlIG5ld2VyIGNlcnQsIHRoZW4geW91IGNhbiBt
YW51YWxseSBydW4gdGhlCiAgICAgICAgICAgICAgICAgIHNjcmlwdHM6IDxicj4KICAgICAgICAg
ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
IElmIEknbSBpbnRlcnByZXRpbmcgdGhpcyBjb3JyZWN0bHksIHRoZW4gaXQgaXMuLi4gc28gSQog
ICAgICAgICAgICAgICAgcmFuIHRoaXMgb24gdGhlIGJyb2tlbiBtYWNoaW5lIChzZWF0dGxlbmZz
KSA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj4kIHN1ZG8KICAgICAgICAgICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0
bW9uZ2VyL3N0b3BfcGtpY2FkIDxicj4KICAgICAgICAgICAgICAgICAgJCBzdWRvIC91c3IvbGli
ZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICJzdWJz
eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgIEkgcmFuIHRoaXMsIGl0IHRvb2sgYSB3aGlsZSwgdGhlbiBJIHJlLWNoZWNrZWQgYW5kIHRo
ZQogICAgICAgICAgICAgICAgc2VyaWFsIHN0aWxsIHNlZW1zIHRvIGJlIDQgPGJyPgogICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp
cmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1w
ZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9u
IDxicj4KICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAg
ICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAg
ICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lC
QWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICDCoCBaTm80
ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAg
ICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgIEF1
dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgSGVyZSdzIHdoYXQgd2FzIGluIC92YXIv
bG9nL3BraS9wa2ktdG9tY2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09IDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXTogPT09PT3CoAogICAgICAgICAgICAgICAgREVCVUcgU1VCU1lTVEVN
IElOSVRJQUxJWkVEwqDCoCA9PT09PT09IDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgID09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09IDxicj4KICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4K
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUg
cGF0aD8KICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1No
dXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b
bG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQg
dG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgICAgc3VwcG9y
dDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
IENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4K
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0IGlkPWRlYnVnIDxicj4K
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgZGVidWcgPGJyPgog
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0U3Vic3lzdGVtIGlkPWxvZyA8YnI+
CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0
b3AtMV06CiAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9bG9nIDxi
cj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0
U3RvcC0xXTogQ3JlYXRpbmcKICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGli
L3BraS9wa2ktdG9tY2F0L2xvZ3MvY2Evc2lnbmVkQXVkaXQvY2FfYXVkaXQpCgogICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOiBDcmVhdGluZwogICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUo
L3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9zeXN0ZW0pIDxicj4KICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ3JlYXRp
bmcKICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9wa2ktdG9tY2F0
L2xvZ3MvY2EvdHJhbnNhY3Rpb25zKQoKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4K
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUg
cGF0aD8KICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1No
dXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b
bG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQg
dG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgICAgc3VwcG9y
dDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
IENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4K
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0IGlkPWxvZyA8YnI+CiAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGxvZyA8YnI+CiAgICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
CiAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1qc3MgPGJyPgog
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93bj8g
ZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24g
Y3J1bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQv
bG9ncy9hdXRvU2h1dGRvd24uY3J1bWIgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3
OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5n
aW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNodXRkb3duCiAgICAgICAgICAg
ICAgICBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAg
ICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAg
ICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1w
a2ktY2EgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQgaWQ9
anNzIDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQganNz
IDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0
YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdFN1YnN5c3RlbSBpZD1k
YnMgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZWFkeSB0byBpbml0IGlk
PWRicyA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z
dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICBEQlN1YnN5c3RlbTogaW5pdCgpIG1FbmFi
bGVTZXJpYWxNZ210PXRydWUgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUy
OjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDcmVhdGluZwogICAgICAgICAgICAgICAgTGRh
cEJvdW5kQ29ubkZhY3RvcihEQlN1YnN5c3RlbSkgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg
TGRhcEJvdW5kQ29ubkZhY3Rvcnk6IGluaXQgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgTGRh
cEJvdW5kQ29ubkZhY3Rvcnk6ZG9DbG9uaW5nIHRydWUgPGJyPgogICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgTGRhcEF1dGhJbmZvOiBpbml0KCkgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3
OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgTGRhcEF1
dGhJbmZvOiBpbml0IGJlZ2lucyA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICBMZGFwQXV0aElu
Zm86IGluaXQgZW5kcyA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd
W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IGluaXQ6CiAgICAgICAgICAgICAgICBiZWZvcmUgbWFr
ZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICBtYWtlQ29ubmVjdGlvbjogZXJyb3JJZkRvd24gdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICBb
MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IFRDUAogICAgICAg
ICAgICAgICAgS2VlcC1BbGl2ZTogdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICBTU0xD
bGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nIGRlc2lyZWQgY2VydAogICAgICAg
ICAgICAgICAgbmlja25hbWUgdG86IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg
ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd
OgogICAgICAgICAgICAgICAgTGRhcEpzc1NTTFNvY2tldDogc2V0IGNsaWVudCBhdXRoIGNlcnQg
bmlja25hbWUKICAgICAgICAgICAgICAgIHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgog
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRl
cmluZyEgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOiBDYW5kaWRhdGUKICAgICAgICAgICAgICAgIGNlcnQ6IG9jc3BTaWdu
aW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENhbmRpZGF0ZQogICAgICAgICAgICAgICAg
Y2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBkZXNpcmVkIGNlcnQgZm91bmQgaW4K
ICAgICAgICAgICAgICAgIGxpc3Q6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg
ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd
OgogICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJu
aW5nOgogICAgICAgICAgICAgICAgc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
IFNTTAogICAgICAgICAgICAgICAgaGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgIENNU0VuZ2luZS5zaHV0ZG93bigpIDxicj4KICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIEkgcmVhbGx5IGFwcHJlY2lhdGUg
eW91IHN0aWNraW5nIHdpdGggbWUgdGhyb3VnaCB0aGlzLsKgCiAgICAgICAgICAgICAgICBJIG93
ZSB5b3UuIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIC0gSWFuIDxi
cj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9
ImNpdGUiPkFmdGVyIHRoYXQsIGNoZWNrIHRoYXQgdGhlIExEQVAKICAgICAgICAgICAgICAgICAg
ZW50cnkgaGFzIGJlZW4gdXBkYXRlZC4gSWYgaXQgaXMgdGhlIGNhc2UsIHlvdSBzaG91bGQKICAg
ICAgICAgICAgICAgICAgYmUgYWJsZSB0byByZXN0YXJ0IHBraS4gPGJyPgogICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIEZsbyA8YnI+CiAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+VGhhbmsgeW91IGFn
YWluIGZvciB5b3VyIHRpbWUhCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBJYW4gPGJyPgogICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5GbG8u
IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIHdoaWNoIHNlZW1zIHdlaXJkLiA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg
dHlwZT0iY2l0ZSI+VGhlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgYXR0
cmlidXRlIGluIHRoZSBsZGFwc2VhcmNoIG91dHB1dCBpcyBvZiB0aGUKICAgICAgICAgICAgICAg
ICAgICAgICAgICBmb3JtIDI7IztETjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSAjIHNob3VsZCBtYXRjaCB0aGUgc2Vy
aWFsIG51bWJlciBpbiB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICBmaXJzdCBjZXJ0dXRp
bCBvdXRwdXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICBUaGUgQVNDSUkgYmxvYiAobWludXMgdGhlIEJFR0lOL0VORCBoZWFkZXJz
KQogICAgICAgICAgICAgICAgICAgICAgICAgIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUgYXR0cmlidXRlcy4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0
IC0tIDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAg
ICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQu
b3JnIgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9Im1vei10
eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVk
b3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjwv
YT4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVt
YWlsIHRvIDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIK
ICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRv
cmFob3N0ZWQub3JnIgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xh
c3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMt
bGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5m
ZWRvcmFob3N0ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICAgICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX18gPGJyPgogICAgICAgICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEK
ICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAg
aHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAg
ICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJl
dmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
Ij5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9hPgogICAgICAgICAg
PGJyPgogICAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAg
ICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICBocmVmPSJt
YWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAg
ICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2
aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3Rl
ZC5vcmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48L2E+
CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIDxicj4KICAgICAg
PC9ibG9ja3F1b3RlPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0IGNsYXNz
PSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgPGJyPgogICAgICA8cHJl
IHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K
RnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJy
ZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9y
ZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgpUbyB1bnN1YnNjcmli
ZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhy
ZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZy
ZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPC9wcmU+CiAgICA8
L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg==
--===============8600127386348226288==--
From ianh at brownpapertickets.com Wed Aug 9 19:31:30 2017
Content-Type: multipart/mixed; boundary="===============4767585338843903604=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Wed, 09 Aug 2017 12:30:52 -0700
Message-ID:
In-Reply-To: 598ADE7F.3080308@redhat.com
--===============4767585338843903604==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 8/9/17 3:05 AM, thierry bordaz wrote:
> Hi Ian,
>
> Thanks for having gather those data.
>
> #
> # So pkidbuser entries have a same (old) userCertificate likely
> generated during install
> # But only freeipa-sea has a new one created on freeipa-sea around
> Jun 8th 2017 05:54:16
> # This recent certificate is identified by 5938e688000104290000
> #
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> ...
> nscpentrywsi: userCertificate::
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
> nscpentrywsi: userCertificate;vucsn-5938e688000104290000::
> MIIDbjCCAlagAwIBAgI
>
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
> nscpentrywsi: userCertificate::
> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>
>
>
> #
> # why 5938e688000104290000 value was not propagated to seattlenfs ?
> # The most recent update (from freeipa-sea) that was replicated to
> seattlenfs
> # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07).
> # In addition seattlenfs received direct update (last one was in
> Jan 1017) that were not
> # replicated to freeipa-sea
> #
> # The two servers have diverged because they can not replicate to
> eachother because
> # they were not correctly initialize.
> # They have different "replicageneration" (57c291d9000004290000 vs
> 55c8f3ae000000600000)
> #
> # It is looking like freeipa-sea was created one or two years ago
> and used to initialized seattlenfs.
> # But later freeipa-sea was recreated.
>
That's about right.
>
> #
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
> -W -b "o=3Dipaca"
> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff=
f-ffffffff))"
> Enter LDAP Password:
> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
> nsds50ruv: {replicageneration} 57c291d9000004290000
> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
> 57f840bf000004290000 598a1c40000104290000
> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
> nsruvReplicaLastModified: {replica 1065
> ldap://freeipa-sea.bpt.rocks:389} 598a1c16
> nsruvReplicaLastModified: {replica 1290
> ldap://seattlenfs.bpt.rocks:389} 00000000
>
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
> -W -b "o=3Dipaca"
> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff=
f-ffffffff))"
> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
> nsds50ruv: {replicageneration} 55c8f3ae000000600000
> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
> 57b103d4000004290000 57be8043000704290000
> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
> 57be804c0000050a0000 587236150000050a0000
> nsruvReplicaLastModified: {replica 1290
> ldap://seattlenfs.bpt.rocks:389} 00000000
> nsruvReplicaLastModified: {replica 1065
> ldap://freeipa-sea.bpt.rocks:389} 00000000
>
>
>
> In conclusion:
> From replication pov, the two instances can not communicate.
> One solution would be to identify which instance is the good one, =
> you want to keep.
> and reinit the second one from that reference.
>
What exactly does reinit mean? I have run
ipa-replica-manage re-initialize --from freeipa-sea.bpt.rocks
several times over the years when replication has stopped.
Replication actually is working, as far as user and machine accounts and =
attributes are concerned anyway, and has been for a while.
There is a zombie server freeipa-dal.bpt.rocks that I can't get rid =
of... it shows up in the GUI on the Topology page but generates a Server =
not found error. I don't know if that's related.
>
> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote:
>>
>> On 8/7/17 1:44 AM, thierry bordaz wrote:
>>
>>>
>>>
>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>>>
>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users =
>>>>>>>>>>>>>>>> wrote:
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that =
>>>>>>>>>>>>>>>>>>> had apparently had
>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can =
>>>>>>>>>>>>>>>>>> run without
>>>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see =
>>>>>>>>>>>>>>>>>> what is going on.
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication =
>>>>>>>>>>>>>>>>> failed (49)
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and =
>>>>>>>>>>>>>>>> needs to
>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this
>>>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind =
>>>>>>>>>>>>>>>> DN and
>>>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=
=3Dipaca
>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>>>> ...
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a =
>>>>>>>>>>>>>>> prompt to provide
>>>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>>>>> password can be
>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with =
>>>>>>>>>>>>>> the tag
>>>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... =
>>>>>>>>>>>>>> allows to read
>>>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>> (provide password)
>>>>>>>>>>>>>
>>>>>>>>>>>>> That works...
>>>>>>>>>>>>>
>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>>>>> User Private
>>>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>>>>>>>>> caSigningCert
>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert
>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>>>
>>>>>>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>>>>>>
>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>>>
>>>>>>>>>>>>> That password is getting me somewhere though, since if I =
>>>>>>>>>>>>> put in a
>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and over.
>>>>>>>>>>>>
>>>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>>>
>>>>>>>>>>> There wasn't much of a change... I just assumed someone ran =
>>>>>>>>>>> yum upgrade and didn't restart, then the power outage... it =
>>>>>>>>>>> looks like not much of a version change though.
>>>>>>>>>>>
>>>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>>>> Jul 28 09:55:41 Updated: =
>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:46 Updated: =
>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>
>>>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>>>
>>>>>>>>>>> # getenforce
>>>>>>>>>>> Enforcing
>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> If so can you run:
>>>>>>>>>>>>
>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use the =
>>>>>>>>>>> write_logs option.
>>>>>>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>>>>>>> ----
>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc00000=
3e =
>>>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 =
a2=3D1 =
>>>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294=
967295 =
>>>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 =
>>>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) =
>>>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { =
>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" =
>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 =
>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>> I suspect that the subsystem cert was renewed and =
>>>>>>>>>>>> everything wasn't
>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>>>> upgrade it just
>>>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>>>
>>>>>>>>>>>> Can you run these commands:
>>>>>>>>>>>>
>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript=
ion
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> This returns
>>>>>>>>>>>
>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti=
on
>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>> ... stuff ...
>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D=
CA =
>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>
>>>>>>>>>>>> and
>>>>>>>>>>>>
>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> These both return
>>>>>>>>>>>
>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert =
>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>>> User Private Key and Certificate Services"
>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>>>
>>>>>>>>>> Hi,
>>>>>>>>>>
>>>>>>>>>> you made a typo and requested the keys (-K) instead of the =
>>>>>>>>>> certs (-L). Please retry with -L and you should be able to =
>>>>>>>>>> see the certificate serial.
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertific=
ate =
>>>>>>>>> description
>>>>>>>>> Enter LDAP Password:
>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>> userCertificate:: =
>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>> ...
>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>
>>>>>>>>> So the serial is 4?
>>>>>>>>>
>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>> grep Serial
>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>
>>>>>>>>> Which is NOT 4...
>>>>>>>>>
>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
>>>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>> ...
>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>>> -----END CERTIFICATE-----
>>>>>>>>>
>>>>>>>>> And this cert is NOT the same.
>>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>>>> post-save commands (which you can see in the output of getcert =
>>>>>>>> list). In your case, the post-save command for subsystemCert =
>>>>>>>> cert-pki-ca probably failed.
>>>>>>>>
>>>>>>>> This command (on the renewal master) is responsible for copying =
>>>>>>>> the new cert from the NSS db to the LDAP server. You need first =
>>>>>>>> to check which IPA server is the renewal master (as the serial =
>>>>>>>> numbers are in a completely different range, I assume that you =
>>>>>>>> have multiple IPA servers configured with a CA instance):
>>>>>>>>
>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -=
f2-`
>>>>>>>> $ kinit admin
>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>> dn: =
>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=
=3Detc,dc=3Dipadomain,dc=3Dcom =
>>>>>>>>
>>>>>>>>
>>>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>>>
>>>>>>>
>>>>>>> I get this
>>>>>>>
>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>> dn: =
>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,d=
c=3Dbpt,dc=3Drocks =
>>>>>>>
>>>>>>>
>>>>>>> Which is the other FreeIPA server.
>>>>>>>
>>>>>> Hi Ian,
>>>>>>
>>>>>> it's getting difficult to follow this thread, so could we step =
>>>>>> back and summarize?
>>>>> Yes, it is. Sorry.
>>>>>>
>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in =
>>>>>> the NSSDB /etc/pki/pki-tomcat/alias
>>>>> No?
>>>>>
>>>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>>>> component is installed and 'subsystemCert cert-pki-ca' has Serial =
>>>>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>>>> Yes
>>>>>
>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>
>>>>>>
>>>>>> - In the LDAP servers, the cert is stored in the entry =
>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it =
is =
>>>>>> the cert from freeipa-sea).
>>>>> This is where the difference is. There are two certificates on =
>>>>> the master and only one on the other. I wonder if this is a =
>>>>> result of the slow motion replication trainwreck I have going on =
>>>>> due to a zombie replica in the ldap database that no longer exists =
>>>>> in the real world and I can't seem to get rid of.
>>>>>
>>>> Hi,
>>>>
>>>> the remaining issue is a replication problem. There is a =
>>>> "Troubleshooting replication" section [1] in IdM Admin guide that =
>>>> may help you.
>>>>
>>>> Regarding your zombie replica, which commands did you use to try to =
>>>> remove it, and what was the output?
>>>>
>>>> Flo
>>>>
>>>> [1] =
>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux=
/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-r=
eplication.html
>>>>
>>>
>>> Hi,
>>>
>>> To debug replication latency or problem we would need several info =
>>> but starting with the results of the following commands
>>>
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>> -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> nscpentrywsi: =
>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
>> 75274897
>> nscpentrywsi: =
>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
>> 90004: 20170608055334Z
>> nscpentrywsi: =
>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
>> 003: cn=3DDirectory Manager
>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>> nscpentrywsi: cn: pkidbuser
>> nscpentrywsi: createTimestamp: 20150716125146Z
>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>> nscpentrywsi: description;vucsn-5938e688000104290001: =
>> 2;1341718541;CN=3DCertific
>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
>> 2;4;CN=3DCertifica
>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>> nscpentrywsi: mail:
>> nscpentrywsi: objectClass: top
>> nscpentrywsi: objectClass: person
>> nscpentrywsi: objectClass: organizationalPerson
>> nscpentrywsi: objectClass: inetOrgPerson
>> nscpentrywsi: objectClass: cmsuser
>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>> nscpentrywsi: sn: pkidbuser
>> nscpentrywsi: uid: pkidbuser
>> nscpentrywsi: userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>
>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
>> MIIDbjCCAlagAwIBAgI
>>
>> AR
>> nscpentrywsi: userPassword::
>> nscpentrywsi: userstate: 1
>> nscpentrywsi: usertype: agentType
>> nscpentrywsi: parentid: 2
>> nscpentrywsi: entryid: 51
>>> and
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>> Enter LDAP Password:
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>> nscpentrywsi: userCertificate:: =
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>
>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>> nscpentrywsi: description: 2;4;CN=3DCertificate =
>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs
>> ystem,O=3DBPT.ROCKS
>> nscpentrywsi: entryid: 51
>> nscpentrywsi: parentid: 2
>> nscpentrywsi: modifyTimestamp: 20150716125146Z
>> nscpentrywsi: createTimestamp: 20150716125146Z
>> nscpentrywsi: modifiersName: cn=3Ddirectory manager
>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>> nscpentrywsi: userPassword::
>> nscpentrywsi: userstate: 1
>> nscpentrywsi: usertype: agentType
>> nscpentrywsi: mail:
>> nscpentrywsi: cn: pkidbuser
>> nscpentrywsi: sn: pkidbuser
>> nscpentrywsi: uid: pkidbuser
>> nscpentrywsi: objectClass: top
>> nscpentrywsi: objectClass: person
>> nscpentrywsi: objectClass: organizationalPerson
>> nscpentrywsi: objectClass: inetOrgPerson
>> nscpentrywsi: objectClass: cmsuser
>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>> nscpentrywsi: entryusn: 86
>>>
>>> From the output you may only copy/past the ones related to =
>>> userCertificate
>>>
>>>
>>> Also to dump the current replication status, send the result of
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>> -W -b =
>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffff=
fff-ffffffff-ffffffff))"
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>> -b "o=3Dipaca" =
>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-f=
fffffff))"
>> Enter LDAP Password:
>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>> cn: replica
>> nsDS5Flags: 1
>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>> cloneAgreement1-freeipa-sea.bpt.roc
>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>> masterAgreement1-seattlenfs.bpt.roc
>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>> nsDS5ReplicaId: 1065
>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
>> nsDS5ReplicaRoot: o=3Dipaca
>> nsDS5ReplicaType: 3
>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
>> nsds5replicabinddngroup: cn=3Dreplication =
>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>> dc=3Drocks
>> nsds5replicabinddngroupcheckinterval: 60
>> objectClass: top
>> objectClass: nsDS5Replica
>> objectClass: extensibleobject
>> nsds50ruv: {replicageneration} 57c291d9000004290000
>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>> 57f840bf00000429000
>> 0 598a1c40000104290000
>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>> nsds5agmtmaxcsn: =
>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
>> tlenfs.bpt.rocks;389;unavailable
>> nsds5agmtmaxcsn: =
>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
>> tlenfs.bpt.rocks;389;unavailable
>> nsruvReplicaLastModified: {replica 1065 =
>> ldap://freeipa-sea.bpt.rocks:389} 598a
>> 1c16
>> nsruvReplicaLastModified: {replica 1290 =
>> ldap://seattlenfs.bpt.rocks:389} 00000
>> 000
>> nsds5ReplicaChangeCount: 885
>> nsds5replicareapactive: 0
>>> and
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>>> -b =
>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffff=
fff-ffffffff-ffffffff))"
>>
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b "o=3Dipaca" =
>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-f=
fffffff))"
>> Enter LDAP Password:
>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>> cn: replica
>> nsDS5Flags: 1
>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>> cloneAgreement1-seattlenfs.bpt.rock
>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>> nsDS5ReplicaId: 1290
>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
>> nsDS5ReplicaRoot: o=3Dipaca
>> nsDS5ReplicaType: 3
>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
>> nsds5replicabinddngroup: cn=3Dreplication =
>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>> dc=3Drocks
>> nsds5replicabinddngroupcheckinterval: 60
>> objectClass: top
>> objectClass: nsDS5Replica
>> objectClass: extensibleobject
>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
>> 57be804c0000050a0000
>> 587236150000050a0000
>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>> 57b103d400000429000
>> 0 57be8043000704290000
>> nsds5agmtmaxcsn: =
>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
>> pa-sea.bpt.rocks;389;1065;587236150000050a0000
>> nsruvReplicaLastModified: {replica 1290 =
>> ldap://seattlenfs.bpt.rocks:389} 00000
>> 000
>> nsruvReplicaLastModified: {replica 1065 =
>> ldap://freeipa-sea.bpt.rocks:389} 0000
>> 0000
>> nsds5ReplicaChangeCount: 3
>> nsds5replicareapactive: 0
>>>
>>> Regards
>>> thierry
>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti=
on
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>
>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> userCertificate:: =
>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>>>> description: 2;1341718541;CN=3DCertificate =
>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem
>>>>> ,O=3DBPT.ROCKS
>>>>>
>>>>>
>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti=
on
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>
>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>> Subsystem,O=3DBPT.RO
>>>>> CKS
>>>>>
>>>>>> If you check the certificates dates, I guess that the most recent =
>>>>>> one is on server seattlenfs (because of serial numbers). Can you =
>>>>>> confirm this (because our goal is to have the most recent cert =
>>>>>> stored in all the NSSDBs and in LDAP)?
>>>>>>
>>>>>> Thanks,
>>>>>> Flo
>>>>>>
>>>>>>
>>>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can =
>>>>>>>> manually run the scripts:
>>>>>>>
>>>>>>> If I'm interpreting this correctly, then it is... so I ran this =
>>>>>>> on the broken machine (seattlenfs)
>>>>>>>
>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert =
>>>>>>>> cert-pki-ca"
>>>>>>>>
>>>>>>>
>>>>>>> I ran this, it took a while, then I re-checked and the serial =
>>>>>>> still seems to be 4
>>>>>>>
>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>> Enter LDAP Password:
>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>> userCertificate:: =
>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>> ...
>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>
>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>>>
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBU=
G =
>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> restart at autoShutdown? false
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> autoShutdown crumb file path? =
>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>>> cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>> init id=3Ddebug
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> initialized debug
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> initSubsystem id=3Dlog
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>>> to init id=3Dlog
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit=
) =
>>>>>>>
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> restart at autoShutdown? false
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> autoShutdown crumb file path? =
>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>>> cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>> init id=3Dlog
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> initialized log
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> initSubsystem id=3Djss
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>>> to init id=3Djss
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> restart at autoShutdown? false
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> autoShutdown crumb file path? =
>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>>> cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>> init id=3Djss
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> initialized jss
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>> initSubsystem id=3Ddbs
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>>> to init id=3Ddbs
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: =
>>>>>>> init() mEnableSerialMgmt=3Dtrue
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> LdapBoundConnFactory: init
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> LdapBoundConnFactory:doCloning true
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init()
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>> init begins
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>> init ends
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>>>> makeConnection errorIfDown is true
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>>>>>> errorIfDown true
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname =
>>>>>>> to: subsystemCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: =
>>>>>>> set client auth cert nickname subsystemCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>>> ocspSigningCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>>> subsystemCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>>>> subsystemCert cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert =
>>>>>>> cert-pki-ca
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake =
>>>>>>> happened
>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown()
>>>>>>>
>>>>>>>
>>>>>>> I really appreciate you sticking with me through this. I owe you.
>>>>>>>
>>>>>>> - Ian
>>>>>>>
>>>>>>>> After that, check that the LDAP entry has been updated. If it =
>>>>>>>> is the case, you should be able to restart pki.
>>>>>>>>
>>>>>>>> Flo
>>>>>>>>
>>>>>>>>> Thank you again for your time!
>>>>>>>>>
>>>>>>>>> Ian
>>>>>>>>>
>>>>>>>>>> Flo.
>>>>>>>>>>>
>>>>>>>>>>> which seems weird.
>>>>>>>>>>>
>>>>>>>>>>>> The description attribute in the ldapsearch output is of =
>>>>>>>>>>>> the form 2;#;DN;DN
>>>>>>>>>>>>
>>>>>>>>>>>> The # should match the serial number in the first certutil =
>>>>>>>>>>>> output
>>>>>>>>>>>>
>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match =
>>>>>>>>>>>> one of the
>>>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>>>
>>>>>>>>>>>> rob
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>> To unsubscribe send an email to =
>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email to =
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>
>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.=
org
>
--===============4767585338843903604==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl
bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPHA+T24gOC85LzE3IDM6MDUgQU0sIHRoaWVy
cnkgYm9yZGF6IHdyb3RlOjxicj4KICAgIDwvcD4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
IGNpdGU9Im1pZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICA8bWV0YSBjb250
ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+
CiAgICAgIEhpIElhbiw8YnI+CiAgICAgIDxicj4KICAgICAgVGhhbmtzIGZvciBoYXZpbmcgZ2F0
aGVyIHRob3NlIGRhdGEuIDxicj4KICAgICAgPHR0Pjxicj4KICAgICAgPC90dD4KICAgICAgPGJs
b2NrcXVvdGU+PHR0PiM8L3R0Pjxicj4KICAgICAgICA8dHQ+IyBTbyBwa2lkYnVzZXIgZW50cmll
cyBoYXZlIGEgc2FtZSAob2xkKSB1c2VyQ2VydGlmaWNhdGUKICAgICAgICAgIGxpa2VseSBnZW5l
cmF0ZWQgZHVyaW5nIGluc3RhbGw8L3R0Pjxicj4KICAgICAgICA8dHQ+IyBCdXQgb25seSBmcmVl
aXBhLXNlYSBoYXMgYSBuZXcgb25lIGNyZWF0ZWQgb24gZnJlZWlwYS1zZWEKICAgICAgICAgIGFy
b3VuZCBKdW4gOHRoIDIwMTcgMDU6NTQ6MTY8L3R0Pjxicj4KICAgICAgICA8dHQ+IyBUaGlzIHJl
Y2VudCBjZXJ0aWZpY2F0ZSBpcyBpZGVudGlmaWVkIGJ5CiAgICAgICAgICA1OTM4ZTY4ODAwMDEw
NDI5MDAwMCA8L3R0Pjxicj4KICAgICAgICA8dHQ+IzwvdHQ+PGJyPgogICAgICAgIDx0dD5bcm9v
dEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAg
ICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBu
c2NwZW50cnl3c2k8L3R0Pjxicj4KICAgICAgICA8dHQ+ZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVv
cGxlLG89aXBhY2E8L3R0Pjxicj4KICAgICAgICA8dHQ+Li4uPC90dD48YnI+CiAgICAgICAgPHR0
Pm5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgIE1JSURjekNDQWx1Z0F3
SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVIgJmx0O3NuaXAmZ3Q7PC90dD48YnI+CiAg
ICAgICAgPHR0Pm5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAw
MTA0MjkwMDAwOjoKICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0kgJmx0O3NuaXAmZ3Q7PC90
dD48YnI+CiAgICAgICAgPGJyPgogICAgICAgIDx0dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBs
ZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicgLVcgLWIg
dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8L3R0Pjxicj4KICAg
ICAgICA8dHQ+ZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8L3R0Pjxicj4KICAg
ICAgICA8dHQ+bnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgTUlJRGN6
Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8L3R0
Pjxicj4KICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICA8dHQ+
IzwvdHQ+PGJyPgogICAgICAgIDx0dD4jIHdoeSA1OTM4ZTY4ODAwMDEwNDI5MDAwMCB2YWx1ZSB3
YXMgbm90IHByb3BhZ2F0ZWQgdG8KICAgICAgICAgIHNlYXR0bGVuZnMgPzwvdHQ+PGJyPgogICAg
ICAgIDx0dD4jIFRoZSBtb3N0IHJlY2VudCB1cGRhdGUgKGZyb20gZnJlZWlwYS1zZWEpIHRoYXQg
d2FzCiAgICAgICAgICByZXBsaWNhdGVkIHRvIHNlYXR0bGVuZnM8L3R0Pjxicj4KICAgICAgICA8
dHQ+IyBpc8KgIDEgeWVhciBvbGQgKDU3YmU4MDQzMDAwNzA0MjkwMDAwIC0gQXVnIDI1dGggMjAx
NgogICAgICAgICAgMDU6MjE6MDcpLjwvdHQ+PGJyPgogICAgICAgIDx0dD4jIEluIGFkZGl0aW9u
IHNlYXR0bGVuZnMgcmVjZWl2ZWQgZGlyZWN0IHVwZGF0ZSAobGFzdCBvbmUKICAgICAgICAgIHdh
cyBpbiBKYW4gMTAxNykgdGhhdCB3ZXJlIG5vdDwvdHQ+PGJyPgogICAgICAgIDx0dD4jIHJlcGxp
Y2F0ZWQgdG8gZnJlZWlwYS1zZWE8L3R0Pjxicj4KICAgICAgICA8dHQ+IyA8L3R0Pjxicj4KICAg
ICAgICA8dHQ+IyBUaGUgdHdvIHNlcnZlcnMgaGF2ZSBkaXZlcmdlZCBiZWNhdXNlIHRoZXkgY2Fu
IG5vdAogICAgICAgICAgcmVwbGljYXRlIHRvIGVhY2hvdGhlciBiZWNhdXNlPC90dD48YnI+CiAg
ICAgICAgPHR0PiMgdGhleSB3ZXJlIG5vdCBjb3JyZWN0bHkgaW5pdGlhbGl6ZS48L3R0Pjxicj4K
ICAgICAgICA8dHQ+IyBUaGV5IGhhdmUgZGlmZmVyZW50ICJyZXBsaWNhZ2VuZXJhdGlvbiIKICAg
ICAgICAgICg1N2MyOTFkOTAwMDAwNDI5MDAwMCB2cyA1NWM4ZjNhZTAwMDAwMDYwMDAwMCk8L3R0
Pjxicj4KICAgICAgICA8dHQ+IzwvdHQ+PGJyPgogICAgICAgIDx0dD4jIEl0IGlzIGxvb2tpbmcg
bGlrZSBmcmVlaXBhLXNlYSB3YXMgY3JlYXRlZCBvbmUgb3IgdHdvCiAgICAgICAgICB5ZWFycyBh
Z28gYW5kIHVzZWQgdG8gaW5pdGlhbGl6ZWQgc2VhdHRsZW5mcy48L3R0Pjxicj4KICAgICAgICA8
dHQ+IyBCdXQgbGF0ZXIgZnJlZWlwYS1zZWEgd2FzIHJlY3JlYXRlZC48L3R0Pjxicj4KICAgICAg
PC9ibG9ja3F1b3RlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPHR0PlRoYXQncyBhYm91dCByaWdo
dC48L3R0Pjxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3
Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICA8YmxvY2txdW90ZT4gPHR0PiM8L3R0Pjxicj4K
ICAgICAgICA8dHQ+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAn
Y249ZGlyZWN0b3J5CiAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhv
YmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZm
ZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgIDx0dD5FbnRlciBMREFQIFBhc3N3b3Jk
OjwvdHQ+PGJyPgogICAgICAgIDx0dD5kbjogY249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFw
cGluZyB0cmVlLGNuPWNvbmZpZzwvdHQ+PGJyPgogICAgICAgIDx0dD5uc2RzNTBydXY6IHtyZXBs
aWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkwMDAwMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICA8dHQ+
bnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQi
CiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAg
ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j
a3M6Mzg5PC9hPn0KICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDAwIDU5OGExYzQwMDAwMTA0
MjkwMDAwPC90dD48YnI+CiAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBj
bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICBocmVmPSJsZGFwOi8vc2Vh
dHRsZW5mcy5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fTwvdHQ+PGJyPgogICAgICAgIDx0
dD5uc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAg
Y2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgaHJlZj0ibGRhcDovL2Zy
ZWVpcGEtc2VhLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1
ZSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgNTk4YTFj
MTY8L3R0Pjxicj4KICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGlj
YSAxMjkwIDxhCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAg
ICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAg
IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwv
YT59CiAgICAgICAgICAwMDAwMDAwMDwvdHQ+PGJyPgogICAgICAgIDxicj4KICAgICAgICA8dHQ+
W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkK
ICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5z
dG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZm
KSkiPC90dD48YnI+CiAgICAgICAgPHR0PmRuOiBjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1t
YXBwaW5nIHRyZWUsY249Y29uZmlnPC90dD48YnI+CiAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3Jl
cGxpY2FnZW5lcmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYwMDAwMDwvdHQ+PGJyPgogICAgICAgIDx0
dD5uc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4
dCIKICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiCiAg
ICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5y
b2NrczozODk8L2E+fQogICAgICAgICAgNTdiMTAzZDQwMDAwMDQyOTAwMDAgNTdiZTgwNDMwMDA3
MDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxh
IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9z
ZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1
ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59wqAKICAgICAgICAgIDU3YmU4
MDRjMDAwMDA1MGEwMDAwIDU4NzIzNjE1MDAwMDA1MGEwMDAwPC90dD48YnI+CiAgICAgICAgPHR0
Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICBj
bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICBocmVmPSJsZGFwOi8vc2Vh
dHRsZW5mcy5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgMDAwMDAwMDA8
L3R0Pjxicj4KICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAx
MDY1IDxhCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAg
ICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICBt
b3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9h
Pn0KICAgICAgICAgIDAwMDAwMDAwPC90dD48L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAgICAg
PGJyPgogICAgICBJbiBjb25jbHVzaW9uOjxicj4KICAgICAgwqDCoMKgIEZyb20gcmVwbGljYXRp
b24gcG92LCB0aGUgdHdvIGluc3RhbmNlcyBjYW4gbm90IGNvbW11bmljYXRlLjxicj4KICAgICAg
wqDCoMKgIE9uZSBzb2x1dGlvbiB3b3VsZCBiZSB0byBpZGVudGlmeSB3aGljaCBpbnN0YW5jZSBp
cyB0aGUgZ29vZAogICAgICBvbmUsIHlvdSB3YW50IHRvIGtlZXAuPGJyPgogICAgICDCoMKgwqAg
YW5kIHJlaW5pdCB0aGUgc2Vjb25kIG9uZSBmcm9tIHRoYXQgcmVmZXJlbmNlLjxicj4KICAgICAg
PGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgV2hhdCBleGFjdGx5IGRvZXMgcmVpbml0IG1lYW4/
wqAgSSBoYXZlIHJ1bjxicj4KICAgIDxicj4KICAgIGlwYS1yZXBsaWNhLW1hbmFnZSByZS1pbml0
aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5icHQucm9ja3M8YnI+CiAgICA8YnI+CiAgICBzZXZl
cmFsIHRpbWVzIG92ZXIgdGhlIHllYXJzIHdoZW4gcmVwbGljYXRpb24gaGFzIHN0b3BwZWQuwqAg
PGJyPgogICAgPGJyPgogICAgUmVwbGljYXRpb24gYWN0dWFsbHkgaXMgd29ya2luZywgYXMgZmFy
IGFzIHVzZXIgYW5kIG1hY2hpbmUgYWNjb3VudHMKICAgIGFuZCBhdHRyaWJ1dGVzIGFyZSBjb25j
ZXJuZWQgYW55d2F5LCBhbmQgaGFzIGJlZW4gZm9yIGEgd2hpbGUuPGJyPgogICAgPGJyPgogICAg
VGhlcmUgaXMgYSB6b21iaWUgc2VydmVyIGZyZWVpcGEtZGFsLmJwdC5yb2NrcyB0aGF0IEkgY2Fu
J3QgZ2V0IHJpZAogICAgb2YuLi4gaXQgc2hvd3MgdXAgaW4gdGhlIEdVSSBvbiB0aGUgVG9wb2xv
Z3kgcGFnZSBidXQgZ2VuZXJhdGVzIGEKICAgIFNlcnZlciBub3QgZm91bmQgZXJyb3IuwqAgSSBk
b24ndCBrbm93IGlmIHRoYXQncyByZWxhdGVkLjxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiIGNpdGU9Im1pZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20iPiA8YnI+CiAgICAgIDxk
aXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDgvMjAxNyAxMDozMyBQTSwgSWFuIEhh
cmRpbmcKICAgICAgICB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICAgIDwvZGl2Pgog
ICAgICA8YmxvY2txdW90ZQogICAgICAgIGNpdGU9Im1pZDoyZjYwYzRhZi02ODBjLTQzODItOTcw
NC00MWEyNGM4MTIxYTJAYnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICAgIHR5cGU9ImNpdGUi
PgogICAgICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9o
dG1sOwogICAgICAgICAgY2hhcnNldD11dGYtOCI+CiAgICAgICAgPHA+T24gOC83LzE3IDE6NDQg
QU0sIHRoaWVycnkgYm9yZGF6IHdyb3RlOjxicj4KICAgICAgICA8L3A+CiAgICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+
CiAgICAgICAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiCiAgICAg
ICAgICAgIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgICAgICAgICA8YnI+CiAgICAgICAg
ICA8YnI+CiAgICAgICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDA4LzA3LzIw
MTcgMDk6MjIgQU0sIEZsb3JlbmNlCiAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQ
QS11c2VycyB3cm90ZTo8YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDxibG9ja3F1b3Rl
CiAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUy
YzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0ZSI+T24gMDgvMDQvMjAxNyAxMTow
MiBQTSwgSWFuIEhhcmRpbmcgdmlhCiAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxi
cj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gOC80LzE3IDI6MTYgQU0s
IEZsb3JlbmNlCiAgICAgICAgICAgICAgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAz
LzIwMTcgMTE6MTMgUE0sIElhbgogICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11
c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+
T24gMDgvMDMvMjAxNyAxMjoyOCBBTSwgRmxvcmVuY2UKICAgICAgICAgICAgICAgICAgQmxhbmMt
UmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiPk9uIDA4LzAyLzIwMTcgMTE6NTEgUE0sIElhbgogICAgICAgICAgICAgICAgICAgIEhhcmRp
bmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICA8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDEyOjExIEFNLAogICAgICAgICAgICAg
ICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDAxOjQzIEFNLAog
ICAgICAgICAgICAgICAgICAgICAgICBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDEyOjAz
IFBNLAogICAgICAgICAgICAgICAgICAgICAgICAgIFJvYiBDcml0dGVuZGVuIHdyb3RlOiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFuIEhh
cmRpbmcgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3Rl
IHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcgMDc6MzkKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMDM6MTEgUE0sIElhbiBIYXJkaW5nIHdyb3Rl
OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i
Y2l0ZSI+T24gMDgvMDEvMjAxNwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMDE6
NDggQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZToKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgMDE6MzIgQU0sIElhbiBIYXJkaW5nIHZpYQogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIE9uIDA3LzMxLzIwMTcgMTE6MzQgQU0sIFJvYgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIENyaXR0ZW5kZW4gd3JvdGU6IDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5J
YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZy
ZWVJUEEtdXNlcnMgd3JvdGU6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90
ZSB0eXBlPSJjaXRlIj5JIGhhZCBhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICB1bmV4cGVjdGVkIHJlc3RhcnQgb2YgYW4gSVBBCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciB0aGF0IGhhZCBhcHBhcmVudGx5IGhhZAogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZXMgcnVuIGJ1dCBoYWQgbm90IGJlZW4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVzdGFydGVkLiBpcGFj
dGwgc2F5cwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktdG9t
Y2F0ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdvdWxk
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbm90IHN0YXJ0
LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3RyYW5nZWx5LCB0aGUgYWN0
dWFsIHNlcnZpY2UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXBw
ZWFycyB0byBiZSBydW5uaW5nOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwv
YmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyBpcyBhbiBhcHBs
aWNhdGlvbiB3aXRoaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRv
bWNhdCBzbyB0b21jYXQgY2FuIHJ1biB3aXRob3V0CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBkb2d0YWcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnVu
bmluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2UgbmVlZCB0byBzZWUgbW9y
ZSBvZiB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyBk
ZWJ1ZyBsb2cgdG8gc2VlIHdoYXQgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGdvaW5nIG9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJdCBsb29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0
aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJvYmxlbS4uLiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgpbMjgvSnVsLzIwMTc6
MTA6MDg6NDddW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IFNTTCBoYW5kc2hha2UgaGFwcGVuZWQg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENvdWxkIG5vdCBjb25u
ZWN0IHRvIExEQVAgc2VydmVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
aG9zdCBzZWF0dGxlbmZzLmJwdC5yb2NrcyBwb3J0IDYzNgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBFcnJvciBuZXRzY2FwZS5sZGFwLkxEQVBFeGNlcHRpb246CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgQXV0aGVudGljYXRpb24gZmFpbGVkICg0OSkgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIHN0b3JlcyBpdHMgaW50ZXJuYWwgZGF0YSBpbgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgTERBUCBzZXJ2ZXIgYW5kIG5l
ZWRzIHRvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXN0YWJsaXNo
IGEgc2VjdXJlIExEQVAgY29ubmVjdGlvbi4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgWW91IGNhbiBjaGVjayBob3cgdGhpcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGNvbm5lY3Rpb24gaXMgY29uZmlndXJlZCBpbgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2NhL0NTLmNmZywgbG9vawog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmb3IgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICB0aGUgbGluZXM6IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENs
aWVudEF1dGggPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj1jbj1EaXJlY3RvcnkgTWFu
YWdlciA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJy
PgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNl
cnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJu
YWxkYi5sZGFwY29ubi5ob3N0PXZtLS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGludGVybmFsZGIubGRhcGNvbm4ucG9ydD02MzYgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLnNlY3VyZUNvbm4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGF1dGh0eXBlIGNhbiBiZSBTc2xDbGllbnRBdXRoCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEgc3Ns
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydGlmaWNhdGUpIG9y
IEJhc2ljQXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0aGVudGlj
YXRpb24gd2l0aCBhIGJpbmQgRE4gYW5kIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgcGFzc3dvcmQgc3RvcmVkIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZikuCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZ
b3UgY2FuIHVzZSB0aGlzIGluZm9ybWF0aW9uIHRvCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIG1hbnVhbGx5IGNoZWNrIHRoZSBjcmVkZW50aWFscy4gRm9yCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaW5zdGFuY2Ugd2l0aCBzc2xjbGllbnRhdXRoOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgZXhwb3J0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNf
Q0FDRVJURElSPS9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBl
eHBvcnQgTERBUFRMU19DRVJUPSdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGRhcHNl
YXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNsYXNzPSJt
b3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtYiAiIiAtcyBiYXNlIC1ZIEVYVEVSTkFMIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKHByb3ZpZGUgdGhlIHBhc3N3
b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtp
LXRvbWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBJIGZvdW5kIHRoaXM6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xDbGllbnRBdXRoIDxicj4KaW50ZXJu
YWxkYi5sZGFwYXV0aC5iaW5kRE49dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+
CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5h
bGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNh
IDxicj4KaW50ZXJuYWxkYi5sZGFwY29ubi5jbG9uZVJlcGxpY2F0aW9uUG9ydD0zODkgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGFuZCB3aGVuIEkgdHJ5IHRoZSBsZGFwc2VhcmNoIEkgYW0KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IHRvIHByb3ZpZGUgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBwaW4vcGFzc3dvcmQgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkgdG9rZW4gJ2xkYXAoMCkn
OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBidXQgdGhlcmUgaXMgbm8gcGFzc3dvcmQgZmlsZS4uLiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBhcmUgcmlnaHQsIGluIDQuNC4gdGhlcmUg
aXMgbm8KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwd2RmaWxlLnR4dCBhbmQgdGhl
IHBhc3N3b3JkIGNhbiBiZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZm91
bmQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRv
bWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAo
d2l0aCB0aGUgdGFnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5h
bD0uLi4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgQ2FuIHlvdSBjaGVjayBpZiB0aGUgcGFzc3dvcmQgd2l0
aCB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0YWcgaW50ZXJuYWw9Li4uIGFs
bG93cyB0byByZWFkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUga2V5
cyBmcm9tIHRoZSBOU1MgZGI/IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBj
ZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChwcm92
aWRlIHBhc3N3b3JkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBUaGF0IHdvcmtzLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1k
IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9r
ZW4gIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQiIgaW4g
c2xvdCAiTlNTIFVzZXIgUHJpdmF0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IEtleSBhbmQgQ2VydGlmaWNhdGUgU2VydmljZXMiIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAmbHQ7IDAmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMy
N2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdjYTUzNjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAob3JwaGFuKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICZsdDsgMSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4MGM3YzY5
NmNmY2Q4YWVmYzk0MDVhN2E4NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IERCOmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAmbHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA4
ODFiNzI1NGM0MGZhNDBiYzUwNjgxYmNjOGQzN2JiM2ViNDk5MzdlCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGNhU2lnbmluZ0NlcnQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsg
MyZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZhOWEyNTVhMWQxNTU4NWFj
MjgwNjRjMGY0OTg2ZTQxNmJjNDg0MDPCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOm9j
c3BTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICZsdDsgNCZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDNmYjYwOWQw
ZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3ZjdlNWEwMWYKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgU2VydmVyLUNlcnQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0
LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgNSZndDsgcnNh
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDFlOTQ3OWE5NTU2YWY5MzM5YmI1ZTQ1NTJj
Y2JkMzgxZDNjMzg4NTbCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE5TUyBDZXJ0
aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3RlbUNl
cnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJ1dCB0aGlzIGRvZXNuJ3QgKHdpdGggdGhlIHNh
bWUgcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZnJvbSBwYXNzd29yZC5j
b25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIyBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBocmVmPSJsZGFwczovLyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5s
ZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAt
YiAiIiAtcyBiYXNlIC1ZIEVYVEVSTkFMIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MgcGhyYXNlCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGZvciBzZWN1cml0eSB0b2tlbiAnbGRhcCgwKSc6IDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgU0FTTC9FWFRFUk5BTCBhdXRoZW50aWNhdGlvbiBz
dGFydGVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGRhcF9zYXNsX2ludGVy
YWN0aXZlX2JpbmRfczogSW52YWxpZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjcmVk
ZW50aWFscyAoNDkpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29t
ZXdoZXJlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRob3VnaCwgc2luY2UgaWYgSSBw
dXQgaW4gYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vbnNlbnNlIG9yIGlu
Y29ycmVjdCBwYXNzd29yZCBpdCBqdXN0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBy
b21wdHMgb3ZlciBhbmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQgZnJv
bQogICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hhdCB0byB3aGF0PyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBUaGVyZSB3YXNuJ3QgbXVjaCBvZiBhIGNo
YW5nZS4uLiBJIGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAgICBhc3N1bWVkIHNvbWVvbmUg
cmFuIHl1bSB1cGdyYWRlIGFuZCBkaWRuJ3QKICAgICAgICAgICAgICAgICAgICAgICAgICByZXN0
YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MKICAgICAgICAgICAgICAgICAg
ICAgICAgICBsaWtlIG5vdCBtdWNoIG9mIGEgdmVyc2lvbiBjaGFuZ2UgdGhvdWdoLiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICMg
Z3JlcCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
SmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEt
Y29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gK
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
SmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgbGliaXBh
X2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDY6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBw
eXRob24tbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDggSW5zdGFsbGVkOgogICAgICAgICAgICAg
ICAgICAgICAgICAgIHB5dGhvbi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoKICAgICAg
ICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjEu
MS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg
ICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSmFu
IDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWlu
dG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0
YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAt
MTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRv
cy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAg
ICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgaXBhLWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMyBVcGRhdGVkOgogICAgICAg
ICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEueDg2
XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjcgVXBkYXRl
ZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcu
Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjM2IEluc3RhbGxlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5u
b2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBp
cGEtcHl0aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDIgVXBkYXRlZDoKICAgICAg
ICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9z
Ljcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg
ICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4
IDA5OjU1OjQzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFs
aWItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgSnVsIDI4IDA5OjU1OjQ0IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAg
cHl0aG9uMi1pcGFjbGllbnQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6
NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYXNlcnZl
ci00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NSBVcGRhdGVkOgog
ICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1hZG1pbnRvb2xzLTQuNC4wLTE0LmVsNy5jZW50
b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0
NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40LjAtMTQu
ZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4
IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci00
LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEt
c2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAjIGdyZXAgcGtpIC92YXIvbG9nL3l1bS5sb2cg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNSBVcGRhdGVkOgog
ICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2gg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowOSBVcGRhdGVkOgog
ICAgICAgICAgICAgICAgICAgICAgICAgIGtyYjUtcGtpbml0LTEuMTQuMS0yNy5lbDdfMy54ODZf
NjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoxOSBJbnN0YWxs
ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTQuZWw3
XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTkg
VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVs
N18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIx
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQu
ZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6
MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMuMy0xNC5l
bDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0Nzoy
MiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMtMTQuZWw3
XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTYg
VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3
XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcg
VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0x
OS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDox
MzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMt
MTkuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6
MTM6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMu
My0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx
MDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1rcmEtMTAuMy4z
LTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEw
OjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWNhLTEwLjMuMy0x
OS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFyZSB5
b3UgcnVubmluZyBpbiBTRUxpbnV4IGVuZm9yY2luZyBtb2RlPyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAjIGdldGVuZm9yY2UgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIEVuZm9yY2luZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBJZiBzbyBjYW4geW91IHJ1bjogPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
IyBhdXNlYXJjaCAtbSBBVkMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgIyBhdXNlYXJjaCAtbSBBVkMg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gdG8gbG9nX2Zv
cm1hdCBpcyBkZXByZWNhdGVkLgogICAgICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSB1c2Ug
dGhlIHdyaXRlX2xvZ3Mgb3B0aW9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgVGhl
IE5PTE9HIG9wdGlvbiBpcyBvdmVycmlkaW5nIHRoZSB3cml0ZV9sb2dzCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgY3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgdGltZS0mZ3Q7TW9uIE1hciAx
NCAxMDozOTowMSAyMDE2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NB
TEwgbXNnPWF1ZGl0KDE0NTc5NzcxNDEuNzY3OjE3NTM3KToKICAgICAgICAgICAgICAgICAgICAg
ICAgICBhcmNoPWMwMDAwMDNlIHN5c2NhbGw9MiBzdWNjZXNzPW5vIGV4aXQ9LTEzCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgYTA9N2ZiY2FiMDM4ZDEwIGExPTgwMCBhMj0xIGEzPTdmYmNhNjBm
NDJlMAogICAgICAgICAgICAgICAgICAgICAgICAgIGl0ZW1zPTAgcHBpZD0xNDA2IHBpZD0xMjk2
NSBhdWlkPTQyOTQ5NjcyOTUKICAgICAgICAgICAgICAgICAgICAgICAgICB1aWQ9MCBnaWQ9MCBl
dWlkPTU4MTQwMDAwMSBzdWlkPTAKICAgICAgICAgICAgICAgICAgICAgICAgICBmc3VpZD01ODE0
MDAwMDEgZWdpZD01ODE0MDAwMDEgc2dpZD0wCiAgICAgICAgICAgICAgICAgICAgICAgICAgZnNn
aWQ9NTgxNDAwMDAxIHR0eT0obm9uZSkgc2VzPTQyOTQ5NjcyOTUKICAgICAgICAgICAgICAgICAg
ICAgICAgICBjb21tPSJzc2hkIiBleGU9Ii91c3Ivc2Jpbi9zc2hkIgogICAgICAgICAgICAgICAg
ICAgICAgICAgIHN1Ymo9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAg
ICAgICAgICAgICAgICAgICAgICAgICAga2V5PShudWxsKSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgdHlwZT1BVkMgbXNnPWF1ZGl0KDE0NTc5NzcxNDEuNzY3OjE3NTM3KToKICAgICAg
ICAgICAgICAgICAgICAgICAgICBhdmM6wqAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUK
ICAgICAgICAgICAgICAgICAgICAgICAgICBjb21tPSJzc2hkIiBuYW1lPSJhdXRob3JpemVkX2tl
eXMiIGRldj0iZG0tMiIKICAgICAgICAgICAgICAgICAgICAgICAgICBpbm89MTE2MzkzNTE3CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90
OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgdGNvbnRleHQ9c3lzdGVt
X3U6b2JqZWN0X3I6dW5sYWJlbGVkX3Q6czAKICAgICAgICAgICAgICAgICAgICAgICAgICB0Y2xh
c3M9ZmlsZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj5JIHN1c3BlY3QgdGhhdCB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAg
IHN1YnN5c3RlbSBjZXJ0IHdhcyByZW5ld2VkIGFuZCBldmVyeXRoaW5nCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICB3YXNuJ3QgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgdXBk
YXRlZCBwcm9wZXJseS4gSWYgSSdtIHJpZ2h0IHRoaXMgaXMKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHVucmVsYXRlZCB0byB0aGUgdXBncmFkZSBpdCBqdXN0IDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIHNob25lIGEgc3BvdGxpZ2h0IG9uIGl0LiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBDYW4geW91
IHJ1biB0aGVzZSBjb21tYW5kczogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp
cmVjdG9yeSBtYW5hZ2VyJwogICAgICAgICAgICAgICAgICAgICAgICAgICAgLVcgLWIgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj
YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9u
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgIFRoaXMgcmV0dXJucyA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExM
IC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcKICAgICAgICAgICAgICAgICAgICAgICAgICAt
YiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgICAgTUlJ
RGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxD
CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
IC4uLiBzdHVmZiAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdqTlQ4
QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1D
ZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NL
UztDTj1DQQogICAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPmFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1k
IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1u
ICdzdWJzeXN0ZW1DZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtp
LWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2Vy
dHV0aWwgLUwgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcwogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgIFRoZXNlIGJvdGggcmV0dXJuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9w
a2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNl
cnQgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgICAg
ICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1
dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAgICAgICAgICAgICBTRUNf
RVJST1JfVU5SRUNPR05JWkVEX09JRDogVW5yZWNvZ25pemVkCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhc8KgIC1uCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4gIk5TUyBD
ZXJ0aWZpY2F0ZSBEQiIKICAgICAgICAgICAgICAgICAgICAgICAgICBpbiBzbG90ICJOU1MgVXNl
ciBQcml2YXRlIEtleSBhbmQgQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICBT
ZXJ2aWNlcyIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3b3JkIG9y
IFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgIERCIjog
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVtIGxpc3Rpbmcg
a2V5czoKICAgICAgICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09J
RDogVW5yZWNvZ25pemVkCiAgICAgICAgICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZp
ZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICB5b3UgbWFk
ZSBhIHR5cG8gYW5kIHJlcXVlc3RlZCB0aGUga2V5cyAoLUspCiAgICAgICAgICAgICAgICAgICAg
ICAgIGluc3RlYWQgb2YgdGhlIGNlcnRzICgtTCkuIFBsZWFzZSByZXRyeSB3aXRoIC1MCiAgICAg
ICAgICAgICAgICAgICAgICAgIGFuZCB5b3Ugc2hvdWxkIGJlIGFibGUgdG8gc2VlIHRoZSBjZXJ0
aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICBzZXJpYWwuIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRs
ZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAgICAgICAnY249
ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1
c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAg
ICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNz
d29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVv
cGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoK
ICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcw
QkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdq
TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAg
ICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUwog
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgU28gdGhlIHNlcmlhbCBpcyA0PyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhd
IyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNh
dC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2kt
Y2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqDCoMKgwqDCoMKg
wqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBXaGljaCBpcyBOT1QgNC4u
LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBb
cm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAg
ICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAg
ICAgICAgICAgICAgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAgICAgICAgICAgICAgIC0t
LS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLSA8YnI+Ck1JSURiakNDQWxhZ0F3SUJBZ0lFVC9rQURU
QU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHNqZWlGYlVGdG9NbmZtSExJ
WXBlNVFBUiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0t
LS0tIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
IEFuZCB0aGlzIGNlcnQgaXMgTk9UIHRoZSBzYW1lLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg
ICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
IHdoZW4gY2VydG1vbmdlciByZW5ld3MgYSBjZXJ0aWZpY2F0ZSwgaXQgcnVucwogICAgICAgICAg
ICAgICAgICAgIHByZS1zYXZlIGFuZCBwb3N0LXNhdmUgY29tbWFuZHMgKHdoaWNoIHlvdSBjYW4g
c2VlCiAgICAgICAgICAgICAgICAgICAgaW4gdGhlIG91dHB1dCBvZiBnZXRjZXJ0IGxpc3QpLiBJ
biB5b3VyIGNhc2UsIHRoZQogICAgICAgICAgICAgICAgICAgIHBvc3Qtc2F2ZSBjb21tYW5kIGZv
ciBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAgICAgcHJvYmFibHkg
ZmFpbGVkLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
IFRoaXMgY29tbWFuZCAob24gdGhlIHJlbmV3YWwgbWFzdGVyKSBpcyByZXNwb25zaWJsZQogICAg
ICAgICAgICAgICAgICAgIGZvciBjb3B5aW5nIHRoZSBuZXcgY2VydCBmcm9tIHRoZSBOU1MgZGIg
dG8gdGhlIExEQVAKICAgICAgICAgICAgICAgICAgICBzZXJ2ZXIuIFlvdSBuZWVkIGZpcnN0IHRv
IGNoZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMKICAgICAgICAgICAgICAgICAgICB0aGUgcmVuZXdh
bCBtYXN0ZXIgKGFzIHRoZSBzZXJpYWwgbnVtYmVycyBhcmUgaW4gYQogICAgICAgICAgICAgICAg
ICAgIGNvbXBsZXRlbHkgZGlmZmVyZW50IHJhbmdlLCBJIGFzc3VtZSB0aGF0IHlvdSBoYXZlCiAg
ICAgICAgICAgICAgICAgICAgbXVsdGlwbGUgSVBBIHNlcnZlcnMgY29uZmlndXJlZCB3aXRoIGEg
Q0EgaW5zdGFuY2UpOgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgJCBleHBvcnQgQkFTRUROPWBncmVwIGJhc2VkbiAv
ZXRjL2lwYS9kZWZhdWx0LmNvbmYgfAogICAgICAgICAgICAgICAgICAgIGN1dCAtZD0gLWYyLWAg
PGJyPgogICAgICAgICAgICAgICAgICAgICQga2luaXQgYWRtaW4gPGJyPgogICAgICAgICAgICAg
ICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQ
SQogICAgICAgICAgICAgICAgICAgIC1iICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VE
TiIKICAgICAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FS
ZW5ld2FsTWFzdGVyKSknIGRuCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgIGRuOgpjbj1DQSxjbj12bS1pcGFzZXJ2ZXIuaXBhZG9tYWluLmNvbSxjbj1tYXN0ZXJz
LGNuPWlwYSxjbj1ldGMsZGM9aXBhZG9tYWluLGRjPWNvbQogICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSW4gdGhpcyBl
eGFtcGxlIHRoZSByZW5ld2FsIG1hc3RlciBpcyB2bS1pcGFzZXJ2ZXIuCiAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIEkgZ2V0
IHRoaXMgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICQgbGRh
cHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQSSAtYgogICAgICAg
ICAgICAgICAgICAiY249bWFzdGVycyxjbj1pcGEsY249ZXRjLCRCQVNFRE4iCiAgICAgICAgICAg
ICAgICAgICcoJmFtcDsoY249Q0EpKGlwYUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScg
ZG4gPGJyPgogICAgICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgICAgY249Q0EsY249
ZnJlZWlwYS1zZWEuYnB0LnJvY2tzLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0YyxkYz1icHQsZGM9
cm9ja3MKICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgIFdoaWNoIGlzIHRoZSBvdGhlciBGcmVlSVBBIHNlcnZlci4gPGJyPgogICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg
ICAgICAgICBIaSBJYW4sIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
IGl0J3MgZ2V0dGluZyBkaWZmaWN1bHQgdG8gZm9sbG93IHRoaXMgdGhyZWFkLCBzbyBjb3VsZAog
ICAgICAgICAgICAgICAgd2Ugc3RlcCBiYWNrIGFuZCBzdW1tYXJpemU/IDxicj4KICAgICAgICAg
ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgWWVzLCBpdCBpcy7CoCBTb3JyeS4gPGJy
PgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAg
ICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlIENBCiAg
ICAgICAgICAgICAgICBjb21wb25lbnQgaXMgaW5zdGFsbGVkIGFuZCAnc3Vic3lzdGVtQ2VydCBj
ZXJ0LXBraS1jYScKICAgICAgICAgICAgICAgIGhhcyBTZXJpYWwgbnVtYmVyIDQgaW4gdGhlIE5T
U0RCCiAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgTm8/IDxicj4KICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGNlcnR1dGlsIC1M
IC1kCiAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVt
Q2VydCBjZXJ0LXBraS1jYScgfAogICAgICAgICAgICAgIGdyZXAgU2VyaWFsIDxicj4KICAgICAg
ICAgICAgICDCoMKgwqDCoMKgwqDCoMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZm
OTAwMGQpIDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4tIE9uIHNl
cnZlciBzZWF0dGxlbmZzICh3aGVyZSBQS0kKICAgICAgICAgICAgICAgIGZhaWxzIHRvIHJlc3Rh
cnQpLCB0aGUgQ0EgY29tcG9uZW50IGlzIGluc3RhbGxlZCBhbmQKICAgICAgICAgICAgICAgICdz
dWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyBoYXMgU2VyaWFsIG51bWJlciAxMzQxNzE4NTQxCiAg
ICAgICAgICAgICAgICBpbiB0aGUgTlNTREIgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcy4gPGJy
PgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICBZZXMgPGJyPgogICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0
dXRpbCAtTCAtZAogICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1
YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIHwKICAgICAgICAgICAgICBncmVwIFNlcmlhbCA8YnI+
CiAgICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx
ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAtIEluIHRoZSBMREFQIHNl
cnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUgZW50cnkKICAgICAgICAgICAgICAgIHVp
ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2Egd2l0aCBTZXJpYWwgbnVtYmVyIDQKICAgICAg
ICAgICAgICAgIChpLmUuIGl0IGlzIHRoZSBjZXJ0IGZyb20gZnJlZWlwYS1zZWEpLiA8YnI+CiAg
ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIFRoaXMgaXMgd2hlcmUgdGhl
IGRpZmZlcmVuY2UgaXMuwqAgVGhlcmUgYXJlIHR3bwogICAgICAgICAgICAgIGNlcnRpZmljYXRl
cyBvbiB0aGUgbWFzdGVyIGFuZCBvbmx5IG9uZSBvbiB0aGUgb3RoZXIuwqAgSQogICAgICAgICAg
ICAgIHdvbmRlciBpZiB0aGlzIGlzIGEgcmVzdWx0IG9mIHRoZSBzbG93IG1vdGlvbiByZXBsaWNh
dGlvbgogICAgICAgICAgICAgIHRyYWlud3JlY2sgSSBoYXZlIGdvaW5nIG9uIGR1ZSB0byBhIHpv
bWJpZSByZXBsaWNhIGluIHRoZQogICAgICAgICAgICAgIGxkYXAgZGF0YWJhc2UgdGhhdCBubyBs
b25nZXIgZXhpc3RzIGluIHRoZSByZWFsIHdvcmxkIGFuZAogICAgICAgICAgICAgIEkgY2FuJ3Qg
c2VlbSB0byBnZXQgcmlkIG9mLiA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgdGhlIHJlbWFpbmluZyBpc3N1ZSBpcyBhIHJlcGxpY2F0aW9uIHByb2JsZW0uIFRoZXJl
IGlzIGEKICAgICAgICAgICAgIlRyb3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBb
MV0gaW4gSWRNIEFkbWluIGd1aWRlCiAgICAgICAgICAgIHRoYXQgbWF5IGhlbHAgeW91LiA8YnI+
CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxp
Y2EsIHdoaWNoIGNvbW1hbmRzIGRpZCB5b3UgdXNlIHRvCiAgICAgICAgICAgIHRyeSB0byByZW1v
dmUgaXQsIGFuZCB3aGF0IHdhcyB0aGUgb3V0cHV0PyA8YnI+CiAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMV0gPGEgY2xh
c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKaHJlZj0iaHR0cHM6Ly9hY2Nlc3MucmVkaGF0LmNv
bS9kb2N1bWVudGF0aW9uL2VuLVVTL1JlZF9IYXRfRW50ZXJwcmlzZV9MaW51eC83L2h0bWwvTGlu
dXhfRG9tYWluX0lkZW50aXR5X0F1dGhlbnRpY2F0aW9uX2FuZF9Qb2xpY3lfR3VpZGUvdHJvdWJs
ZS1nZW4tcmVwbGljYXRpb24uaHRtbCIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRy
dWUiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0
X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNh
dGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJy
PgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+
CiAgICAgICAgICBIaSw8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBUbyBkZWJ1ZyByZXBs
aWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZCBzZXZlcmFsCiAgICAgICAg
ICBpbmZvIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRzIG9mIHRoZSBmb2xsb3dpbmcgY29t
bWFuZHM8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5o
XSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgIG1hbmFnZXInIC1X
IC1iICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAg
ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFw
c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9
cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgRW50
ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3Bs
ZSxvPWlwYWNhPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9
cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgIGVudHJ5dXNu
O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1Ogog
ICAgICAgIDxicj4KICAgICAgICDCoDc1Mjc0ODk3PGJyPgogICAgICAgIG5zY3BlbnRyeXdzaToK
ICAgICAgICBtb2RpZnlUaW1lc3RhbXA7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDQ7dnVjc24t
NTkzOGU2ODgwMDAxMDQyPGJyPgogICAgICAgIMKgOTAwMDQ6IDIwMTcwNjA4MDU1MzM0Wjxicj4K
ICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgbW9kaWZpZXJzTmFtZTthZGNzbi01OTM4ZTY4
ODAwMDEwNDI5MDAwMzt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDxicj4KICAgICAgICDCoDAwMzog
Y249RGlyZWN0b3J5IE1hbmFnZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlk
OiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgICAgICBuc2NwZW50
cnl3c2k6IGNuOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l
c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3Jz
TmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBkZXNj
cmlwdGlvbjt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMToKICAgICAgICAyOzEzNDE3MTg1NDE7
Q049Q2VydGlmaWM8YnI+CiAgICAgICAgwqBhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNB
IFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0
aW9uO3ZkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAyO2RlbGV0ZWQ6CiAgICAgICAgMjs0O0NOPUNl
cnRpZmljYTxicj4KICAgICAgICDCoHRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJz
eXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAg
ICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAgICAgbnNjcGVudHJ5
d3NpOiBvYmplY3RDbGFzczogcGVyc29uPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0
Q2xhc3M6IG9yZ2FuaXphdGlvbmFsUGVyc29uPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2Jq
ZWN0Q2xhc3M6IGluZXRPcmdQZXJzb248YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RD
bGFzczogY21zdXNlcjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHNlZUFsc286IENOPUNBIFN1
YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lkYnVz
ZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgICBu
c2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFn
SUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUjxicj4KICAgICAgICAmbHQ7c25pcCZndDs8YnI+
CiAgICAgICAgwqBjQmQ0bk9WNG05QStxUlpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThY
RW84ZGZBUFhNSm9GYz08YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU7
dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDA6OgogICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8
YnI+CiAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgIMKgQVI8YnI+CiAgICAgICAgbnNj
cGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgbnNjcGVu
dHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTog
YWdlbnRUeXBlPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICAg
ICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBl
PSJjaXRlIiBjaXRlPSJtaWQ6NTk4ODI4NzEuMTAwMDEwNkByZWRoYXQuY29tIj4KICAgICAgICAg
IGFuZDxicj4KICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxM
TCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2Vy
LG91PXBlb3BsZSxvPWlwYWNhIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+
CiAgICAgICAgPGJyPgogICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2gg
LUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNl
cixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgRW50ZXIgTERBUCBQ
YXNzd29yZDogPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh
PGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89
aXBhY2E8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNvOiBDTj1DQSBTdWJzeXN0ZW0s
Tz1CUFQuUk9DS1M8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU6Ogog
ICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+
CiAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgIMKgY0JkNG5PVjRtOUErcVJaTm80ZVg3
ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9PGJyPgogICAgICAgIG5zY3Bl
bnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgIEF1dGhvcml0
eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzPGJyPgogICAgICAgIMKgeXN0ZW0sTz1CUFQuUk9DS1M8
YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAgICAgICBuc2NwZW50
cnl3c2k6IHBhcmVudGlkOiAyPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogbW9kaWZ5VGltZXN0
YW1wOiAyMDE1MDcxNjEyNTE0Nlo8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l
c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IG1vZGlmaWVy
c05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogY3Jl
YXRvcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6
IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHVz
ZXJzdGF0ZTogMTxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJ0eXBlOiBhZ2VudFR5cGU8
YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6
IGNuOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJy
PgogICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgbnNjcGVu
dHJ5d3NpOiBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0
Q2xhc3M6IHBlcnNvbjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdh
bml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBp
bmV0T3JnUGVyc29uPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGNtc3Vz
ZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFl
NS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IGVudHJ5dXNuOiA4
Njxicj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk4ODI4NzEu
MTAwMDEwNkByZWRoYXQuY29tIj4KICAgICAgICAgIDxicj4KICAgICAgICAgIEZyb20gdGhlIG91
dHB1dCB5b3UgbWF5IG9ubHkgY29weS9wYXN0IHRoZSBvbmVzIHJlbGF0ZWQgdG8KICAgICAgICAg
IHVzZXJDZXJ0aWZpY2F0ZTxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAg
ICAgIEFsc28gdG8gZHVtcCB0aGUgY3VycmVudCByZXBsaWNhdGlvbiBzdGF0dXMsIHNlbmQgdGhl
IHJlc3VsdMKgCiAgICAgICAgICBvZjxicj4KICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlh
bmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicg
LVcgLWIgIm89aXBhY2EiPGZvbnQgc2l6ZT0iLTEiPjxpPiA8L2k+IigmYW1wOyhvYmplY3RjbGFz
cz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZm
ZmZmZikpIjxicj4KICAgICAgICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAgICAgW3Jvb3RA
ZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAg
ICAgbWFuYWdlcicgLVcgLWIgIm89aXBhY2EiCiIoJmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3Rv
bmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+
CiAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgIGRuOiBjbj1yZXBsaWNh
LGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgIGNuOiBy
ZXBsaWNhPGJyPgogICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgICAgbnNEUzVSZXBsaWNh
QmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgICAgY2xvbmVBZ3JlZW1lbnQxLWZy
ZWVpcGEtc2VhLmJwdC5yb2M8YnI+CiAgICAgICAgwqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMs
Y249Y29uZmlnPGJyPgogICAgICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24g
TWFuYWdlcgogICAgICAgIG1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9jPGJyPgog
ICAgICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICBu
c0RTNVJlcGxpY2FJZDogMTA2NTxicj4KICAgICAgICBuc0RTNVJlcGxpY2FOYW1lOiBiMjFhMWYx
ZS02Mjc5MTFlNi05M2U2ZWY0Yi02OWRjYzJkMTxicj4KICAgICAgICBuc0RTNVJlcGxpY2FSb290
OiBvPWlwYWNhPGJyPgogICAgICAgIG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICAgICAgbnNT
dGF0ZTo6CiAgICAgICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFB
QUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJl
cGxpY2F0aW9uCiAgICAgICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8
YnI+CiAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91
cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgIG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAg
ICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICBvYmplY3RDbGFzczogZXh0
ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0g
NTdjMjkxZDkwMDAwMDQyOTAwMDA8YnI+CiAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1
IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmst
ZnJlZXRleHQiCiAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4
OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgIDU3Zjg0MGJm
MDAwMDA0MjkwMDA8YnI+CiAgICAgICAgwqAwIDU5OGExYzQwMDAwMTA0MjkwMDAwPGJyPgogICAg
ICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAg
ICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgaHJlZj0ibGRh
cDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tz
OjM4OTwvYT59PGJyPgogICAgICAgIG5zZHM1YWdtdG1heGNzbjoKICAgICAgICBvPWlwYWNhO2Ns
b25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdDtzZWF0PGJyPgog
ICAgICAgIMKgdGxlbmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICAgICAgbnNk
czVhZ210bWF4Y3NuOgogICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZz
LmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgwqB0bGVuZnMuYnB0LnJvY2tz
OzM4OTt1bmF2YWlsYWJsZTxicj4KICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHty
ZXBsaWNhIDEwNjUgPGEKICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1v
ei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5i
cHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAg
ICAgNTk4YTxicj4KICAgICAgICDCoDFjMTY8YnI+CiAgICAgICAgbnNydXZSZXBsaWNhTGFzdE1v
ZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICBocmVmPSJsZGFwOi8vc2Vh
dHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9h
Pn0KICAgICAgICAwMDAwMDxicj4KICAgICAgICDCoDAwMDxicj4KICAgICAgICBuc2RzNVJlcGxp
Y2FDaGFuZ2VDb3VudDogODg1PGJyPgogICAgICAgIG5zZHM1cmVwbGljYXJlYXBhY3RpdmU6IDA8
YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEw
MDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAgICAgICAgICAgc2l6ZT0iLTEiPiBhbmQ8YnI+CiAg
ICAgICAgICA8L2ZvbnQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1E
CiAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250IHNp
emU9Ii0xIj48aT4gPC9pPiIoJmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVl
SWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICA8
L2ZvbnQ+PC9ibG9ja3F1b3RlPgogICAgICAgIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3Jv
b3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAg
ICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJz
dG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxi
cj4KICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgZG46IGNuPXJlcGxp
Y2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgY246
IHJlcGxpY2E8YnI+CiAgICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgICBuc0RTNVJlcGxp
Y2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgICBjbG9uZUFncmVlbWVudDEt
c2VhdHRsZW5mcy5icHQucm9jazxicj4KICAgICAgICDCoHMtcGtpLXRvbWNhdCxvdT1jc3VzZXJz
LGNuPWNvbmZpZzxicj4KICAgICAgICBuc0RTNVJlcGxpY2FJZDogMTI5MDxicj4KICAgICAgICBu
c0RTNVJlcGxpY2FOYW1lOiA4NzA2YWIxZS02YTgzMTFlNi1hOWJmZGJiZi03NGRjNzMyMzxicj4K
ICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgIG5zRFM1UmVwbGlj
YVR5cGU6IDM8YnI+CiAgICAgICAgbnNTdGF0ZTo6CiAgICAgICAgQ2dVQUFBQUFBQUFLRllwWkFB
QUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAgbnNkczVy
ZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAgICAgICAgbWFuYWdlcnMsY249c3lz
YWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAg
ICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgIG9i
amVjdENsYXNzOiB0b3A8YnI+CiAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4K
ICAgICAgICBvYmplY3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICBuc2RzNTBy
dXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAwMDA8YnI+CiAgICAgICAg
bnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAg
ICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICBocmVmPSJsZGFwOi8v
c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5
PC9hPn0KICAgICAgICA1N2JlODA0YzAwMDAwNTBhMDAwMDxicj4KICAgICAgICDCoCA1ODcyMzYx
NTAwMDAwNTBhMDAwMDxicj4KICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgbW96
LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4
dCIKICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFw
Oi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgNTdiMTAzZDQwMDAwMDQy
OTAwMDxicj4KICAgICAgICDCoDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAgICAgICAgbnNk
czVhZ210bWF4Y3NuOgogICAgICAgIG89aXBhY2E7Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMu
YnB0LnJvY2tzLXBraS10b21jYXQ7ZnJlZWk8YnI+CiAgICAgICAgwqBwYS1zZWEuYnB0LnJvY2tz
OzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAwPGJyPgogICAgICAgIG5zcnV2UmVwbGljYUxh
c3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0
cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgaHJlZj0ibGRhcDov
L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4
OTwvYT59CiAgICAgICAgMDAwMDA8YnI+CiAgICAgICAgwqAwMDA8YnI+CiAgICAgICAgbnNydXZS
ZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICBtb3otZG8tbm90
LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICBocmVm
PSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJw
dC5yb2NrczozODk8L2E+fQogICAgICAgIDAwMDA8YnI+CiAgICAgICAgwqAwMDAwPGJyPgogICAg
ICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiAzPGJyPgogICAgICAgIG5zZHM1cmVwbGljYXJl
YXBhY3RpdmU6IDA8YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlk
OjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAgICAgICAgICAgc2l6ZT0iLTEi
PiA8YnI+CiAgICAgICAgICAgIFJlZ2FyZHM8YnI+CiAgICAgICAgICAgIHRoaWVycnk8YnI+CiAg
ICAgICAgICA8L2ZvbnQ+CiAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgICBjaXRlPSJt
aWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAg
ICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5b
cm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaAogICAgICAgICAgICAgIC1MTEwgLUQg
J2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIs
b3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgZGVzY3JpcHRp
b24gPGJyPgogICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAg
ICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAg
ICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJE
QU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsgPGJyPgogICAgICAgICAgICAgIMKg
IFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAg
ICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJ
QkFnSUVUL2tBRFRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLCiAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICZsdDt0cnVuY2F0ZWQmZ3Q7IGZ1UVFabVAxWHJLa3Jmc2pl
aUZiVUZ0b01uZm1ITElZcGU1UUFSIDxicj4KICAgICAgICAgICAgICBkZXNjcmlwdGlvbjogMjsx
MzQxNzE4NTQxO0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJP
Q0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+CiAgICAgICAgICAgICAgwqAgLE89QlBULlJPQ0tTIDxi
cj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIFty
b290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAg
ICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj
YQogICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAg
ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgIGRuOiB1aWQ9cGtp
ZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNh
dGU6OgogICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFR
c0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICDC
oCAmbHQ7dHJ1bmNhdGVkJmd0OyA8YnI+CiAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIz
Z0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgZGVzY3Jp
cHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5S
T0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk8gPGJyPgogICAgICAgICAgICAgIMKgIENLUyA8
YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiPklmIHlvdSBjaGVjayB0aGUgY2VydGlmaWNhdGVzCiAgICAgICAgICAgICAgICBkYXRlcywg
SSBndWVzcyB0aGF0IHRoZSBtb3N0IHJlY2VudCBvbmUgaXMgb24gc2VydmVyCiAgICAgICAgICAg
ICAgICBzZWF0dGxlbmZzIChiZWNhdXNlIG9mIHNlcmlhbCBudW1iZXJzKS4gQ2FuIHlvdSBjb25m
aXJtCiAgICAgICAgICAgICAgICB0aGlzIChiZWNhdXNlIG91ciBnb2FsIGlzIHRvIGhhdmUgdGhl
IG1vc3QgcmVjZW50IGNlcnQKICAgICAgICAgICAgICAgIHN0b3JlZCBpbiBhbGwgdGhlIE5TU0RC
cyBhbmQgaW4gTERBUCk/IDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
IFRoYW5rcywgPGJyPgogICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9
ImNpdGUiPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3Vy
IHJlbmV3YWwgbWFzdGVyIGlzIHRoZQogICAgICAgICAgICAgICAgICAgIG1hY2hpbmUgb24gd2hp
Y2ggdGhlIE5TUyBEQgogICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxp
YXMgY29udGFpbnMgdGhlIG5ld2VyIGNlcnQsCiAgICAgICAgICAgICAgICAgICAgdGhlbiB5b3Ug
Y2FuIG1hbnVhbGx5IHJ1biB0aGUgc2NyaXB0czogPGJyPgogICAgICAgICAgICAgICAgICA8L2Js
b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgSWYgSSdt
IGludGVycHJldGluZyB0aGlzIGNvcnJlY3RseSwgdGhlbiBpdCBpcy4uLiBzbyBJCiAgICAgICAg
ICAgICAgICAgIHJhbiB0aGlzIG9uIHRoZSBicm9rZW4gbWFjaGluZSAoc2VhdHRsZW5mcykgPGJy
PgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5
cGU9ImNpdGUiPiQgc3VkbwogICAgICAgICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2Vy
dG1vbmdlci9zdG9wX3BraWNhZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgJCBzdWRvIC91c3Iv
bGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAg
InN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICBJIHJhbiB0aGlzLCBpdCB0b29rIGEgd2hpbGUsIHRoZW4gSSByZS1j
aGVja2VkIGFuZCB0aGUKICAgICAgICAgICAgICAgICAgc2VyaWFsIHN0aWxsIHNlZW1zIHRvIGJl
IDQgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICQgbGRhcHNl
YXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAg
ICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNhdGUKICAgICAg
ICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICBFbnRlciBMREFQ
IFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBl
b3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAg
ICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFE
QTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZh
MVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9u
OiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJP
Q0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgSGVyZSdzIHdoYXQgd2FzIGluIC92YXIvbG9nL3BraS9wa2kt
dG9tY2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg
ICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
IDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOiA9PT09PcKgCiAgICAgICAgICAgICAgICAgIERFQlVHIFNVQlNZU1RFTSBJ
TklUSUFMSVpFRMKgwqAgPT09PT09PSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgPT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0gPGJyPgogICAgICAgICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg
ICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNl
IDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGF1dG9TaHV0ZG93biBj
cnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0
L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBD
TVNFbmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yIGF1dG8tc2h1dGRvd24KICAgICAg
ICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAg
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5n
Q2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5l
OiBkb25lIGluaXQgaWQ9ZGVidWcgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6
MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0Vu
Z2luZTogaW5pdGlhbGl6ZWQgZGVidWcgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENN
U0VuZ2luZTogaW5pdFN1YnN5c3RlbSBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAg
ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAg
ICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIv
bGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvY2Evc2lnbmVkQXVkaXQvY2FfYXVkaXQpCiAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAg
ICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2Nh
L3N5c3RlbSkKICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
IENyZWF0aW5nCiAgICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9w
a2ktdG9tY2F0L2xvZ3MvY2EvdHJhbnNhY3Rpb25zKQogICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93
bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1No
dXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3Br
aS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1bWIgPGJyPgogICAgICAgICAgICAgICAgICBb
MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg
ICAgICAgIENNU0VuZ2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93
bgogICAgICAgICAgICAgICAgICBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2Eg
PGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZm91bmQgY2VydDphdWRp
dFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBD
TVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
IENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgbG9nIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg
ICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg
ICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9anNzIDxicj4KICAgICAgICAgICAg
ICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAg
ICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8
YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0
YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1
bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9s
b2dzL2F1dG9TaHV0ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01T
RW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNodXRkb3duCiAgICAgICAg
ICAgICAgICAgIHN1cHBvcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmluZ0Nl
cnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6
NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog
ZG9uZSBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5l
OiBpbml0aWFsaXplZCBqc3MgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2lu
ZTogaW5pdFN1YnN5c3RlbSBpZD1kYnMgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENN
U0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1kYnMgPGJyPgogICAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICAgIERCU3Vic3lzdGVtOiBpbml0KCkgbUVuYWJsZVNlcmlhbE1nbXQ9dHJ1ZSA8YnI+CiAgICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcgTGRhcEJvdW5kQ29ubkZhY3RvcihEQlN1YnN5
c3RlbSkgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs
aG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3J5
OiBpbml0IDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9y
eTpkb0Nsb25pbmcgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgTGRhcEF1dGhJ
bmZvOiBpbml0KCkgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd
W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIExkYXBBdXRoSW5mbzog
aW5pdCBiZWdpbnMgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd
W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIExkYXBBdXRoSW5mbzog
aW5pdCBlbmRzIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBpbml0OgogICAgICAgICAgICAgICAgICBiZWZvcmUgbWFr
ZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgIFsw
My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAg
ICAgICAgbWFrZUNvbm5lY3Rpb246IGVycm9ySWZEb3duIHRydWUgPGJyPgogICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IFRDUAog
ICAgICAgICAgICAgICAgICBLZWVwLUFsaXZlOiB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg
ICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nIGRlc2lyZWQg
Y2VydAogICAgICAgICAgICAgICAgICBuaWNrbmFtZSB0bzogc3Vic3lzdGVtQ2VydCBjZXJ0LXBr
aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgTGRhcEpzc1NTTFNvY2tldDogc2V0
IGNsaWVudCBhdXRoIGNlcnQgbmlja25hbWUKICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtQ2Vy
dCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2Vy
dGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRlcmluZyEgPGJyPgogICAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICAgIENhbmRpZGF0ZSBjZXJ0OiBvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgICAgIENhbmRpZGF0ZSBjZXJ0OiBzdWJzeXN0ZW1DZXJ0IGNlcnQt
cGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0
ZVNlbGVjdGlvbkNCOiBkZXNpcmVkIGNlcnQgZm91bmQgaW4KICAgICAgICAgICAgICAgICAgbGlz
dDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
ICAgU1NMQ2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJuaW5nOgogICAgICAgICAg
ICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBTU0wKICAgICAg
ICAgICAgICAgICAgaGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICBDTVNFbmdpbmUuc2h1dGRvd24oKSA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBJIHJlYWxseSBhcHByZWNpYXRl
IHlvdSBzdGlja2luZyB3aXRoIG1lIHRocm91Z2gKICAgICAgICAgICAgICAgICAgdGhpcy7CoCBJ
IG93ZSB5b3UuIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAt
IElhbiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSI+QWZ0ZXIgdGhhdCwgY2hlY2sgdGhhdCB0aGUKICAgICAgICAgICAg
ICAgICAgICBMREFQIGVudHJ5IGhhcyBiZWVuIHVwZGF0ZWQuIElmIGl0IGlzIHRoZSBjYXNlLCB5
b3UKICAgICAgICAgICAgICAgICAgICBzaG91bGQgYmUgYWJsZSB0byByZXN0YXJ0IHBraS4gPGJy
PgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBGbG8gPGJyPgog
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj5UaGFuayB5b3UgYWdhaW4gZm9yIHlvdXIKICAgICAgICAgICAgICAgICAgICAg
IHRpbWUhIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgIElhbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICB3aGljaCBzZWVtcyB3ZWlyZC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5UaGUg
ZGVzY3JpcHRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGF0dHJpYnV0ZSBpbiB0aGUg
bGRhcHNlYXJjaCBvdXRwdXQgaXMgb2YgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBm
b3JtIDI7IztETjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBUaGUgIyBzaG91bGQgbWF0Y2ggdGhlIHNlcmlhbCBudW1i
ZXIgaW4gdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBmaXJzdCBjZXJ0dXRpbCBvdXRw
dXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgVGhlIEFTQ0lJIGJsb2IgKG1pbnVzIHRoZSBCRUdJTi9FTkQgaGVhZGVycykK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBhdHRyaWJ1dGVzLiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg
ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyA8YnI+CiAg
ICAgICAgICAgICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAg
ICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAgICAgICBocmVm
PSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAg
ICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhv
c3RlZC5vcmc8L2E+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIFRvIHVuc3Vic2Ny
aWJlIHNlbmQgYW4gZW1haWwgdG8gPGEKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxp
bmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vy
cy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICAgICAgbW96LWRvLW5v
dC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8
L2E+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg
ICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4K
ICAgICAgICAgICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAg
ICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgIGhyZWY9Im1h
aWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAg
bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5v
cmc8L2E+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBh
biBlbWFpbCB0byA8YQogICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0
ZWQiCiAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMu
ZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZy
ZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgICAg
PGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxv
Y2txdW90ZT4KICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIDxmaWVsZHNldCBjbGFz
cz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgICAgPGJyPgogICAgICAg
IDxwcmUgd3JhcD0iIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fXwpGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YSBjbGFzcz0ibW96LXR4dC1saW5r
LWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0
ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3Jh
aG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0i
bW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2
ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEt
dXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPC9wcmU+CiAgICAgIDwvYmxv
Y2txdW90ZT4KICAgICAgPGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4K
PC9odG1sPgo=
--===============4767585338843903604==--
From tbordaz at redhat.com Thu Aug 10 09:46:33 2017
Content-Type: multipart/mixed; boundary="===============0674695975783376051=="
MIME-Version: 1.0
From: thierry bordaz
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Thu, 10 Aug 2017 11:45:51 +0200
Message-ID: <598C2B4F.2000202@redhat.com>
In-Reply-To: fe5259f3-ae4a-8389-5425-9b84b11b71d5@brownpapertickets.com
--===============0674695975783376051==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 08/09/2017 09:30 PM, Ian Harding via FreeIPA-users wrote:
>
> On 8/9/17 3:05 AM, thierry bordaz wrote:
>
>> Hi Ian,
>>
>> Thanks for having gather those data.
>>
>> #
>> # So pkidbuser entries have a same (old) userCertificate likely
>> generated during install
>> # But only freeipa-sea has a new one created on freeipa-sea
>> around Jun 8th 2017 05:54:16
>> # This recent certificate is identified by 5938e688000104290000
>> #
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory
>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> ...
>> nscpentrywsi: userCertificate::
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000::
>> MIIDbjCCAlagAwIBAgI
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>> nscpentrywsi: userCertificate::
>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>
>>
>>
>> #
>> # why 5938e688000104290000 value was not propagated to seattlenfs ?
>> # The most recent update (from freeipa-sea) that was replicated
>> to seattlenfs
>> # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07).
>> # In addition seattlenfs received direct update (last one was in
>> Jan 1017) that were not
>> # replicated to freeipa-sea
>> #
>> # The two servers have diverged because they can not replicate to
>> eachother because
>> # they were not correctly initialize.
>> # They have different "replicageneration" (57c291d9000004290000
>> vs 55c8f3ae000000600000)
>> #
>> # It is looking like freeipa-sea was created one or two years ago
>> and used to initialized seattlenfs.
>> # But later freeipa-sea was recreated.
>>
> That's about right.
>>
>> #
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory
>> manager' -W -b "o=3Dipaca"
>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff=
ff-ffffffff))"
>> Enter LDAP Password:
>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>> nsds50ruv: {replicageneration} 57c291d9000004290000
>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
>> 57f840bf000004290000 598a1c40000104290000
>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>> nsruvReplicaLastModified: {replica 1065
>> ldap://freeipa-sea.bpt.rocks:389} 598a1c16
>> nsruvReplicaLastModified: {replica 1290
>> ldap://seattlenfs.bpt.rocks:389} 00000000
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager'
>> -W -b "o=3Dipaca"
>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff=
ff-ffffffff))"
>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
>> 57b103d4000004290000 57be8043000704290000
>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>> 57be804c0000050a0000 587236150000050a0000
>> nsruvReplicaLastModified: {replica 1290
>> ldap://seattlenfs.bpt.rocks:389} 00000000
>> nsruvReplicaLastModified: {replica 1065
>> ldap://freeipa-sea.bpt.rocks:389} 00000000
>>
>>
>>
>> In conclusion:
>> From replication pov, the two instances can not communicate.
>> One solution would be to identify which instance is the good one, =
>> you want to keep.
>> and reinit the second one from that reference.
>>
> What exactly does reinit mean? I have run
>
> ipa-replica-manage re-initialize --from freeipa-sea.bpt.rocks
This triggers the reinit of 'dc=3Dipadomain,dc=3Dcom' suffix but not for =
o=3Dipaca suffix. To reinit o=3Dipaca you may use
ipa-cs-replica-manager re-initialize --from freeipa-sea.bpt.rocks.
Note that it will overwrite all data of ipaca on seattlenfs with the =
data from freeipa-sea. This is why it is important to know which server =
is the valid one.
On freeipa-sea and seattlenfs you may check the ipaca replica agreements =
status before/after reinit. I would guess they are currently reporting =
failures between these two replicas.
ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
"cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
"objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
>
> several times over the years when replication has stopped.
>
> Replication actually is working, as far as user and machine accounts =
> and attributes are concerned anyway, and has been for a while.
>
> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid =
> of... it shows up in the GUI on the Topology page but generates a =
> Server not found error. I don't know if that's related.
Zombie servers have been discussed a lot on this mailing list. You may =
get rid of them with list-ruv/clean-ruv subcommand. Replication usually =
manage to work fine even if some zombie entries exist but it is a good =
practice to clean them.
regards
thierry
>>
>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote:
>>>
>>> On 8/7/17 1:44 AM, thierry bordaz wrote:
>>>
>>>>
>>>>
>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>>>>
>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users =
>>>>>>>>>>>>>>>>> wrote:
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that =
>>>>>>>>>>>>>>>>>>>> had apparently had
>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says =
>>>>>>>>>>>>>>>>>>>> pki-tomcatd
>>>>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can =
>>>>>>>>>>>>>>>>>>> run without
>>>>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see =
>>>>>>>>>>>>>>>>>>> what is going on.
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication =
>>>>>>>>>>>>>>>>>> failed (49)
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and =
>>>>>>>>>>>>>>>>> needs to
>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how =
>>>>>>>>>>>>>>>>> this
>>>>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind =
>>>>>>>>>>>>>>>>> DN and
>>>>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=
=3Dipaca
>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>>>>> ...
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a =
>>>>>>>>>>>>>>>> prompt to provide
>>>>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>>>>>> password can be
>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf =
>>>>>>>>>>>>>>> (with the tag
>>>>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... =
>>>>>>>>>>>>>>> allows to read
>>>>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>> (provide password)
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> That works...
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot =
>>>>>>>>>>>>>> "NSS User Private
>>>>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>>>>>>>>>> caSigningCert
>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f =
>>>>>>>>>>>>>> Server-Cert
>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> But this doesn't (with the same password from password.conf)
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> That password is getting me somewhere though, since if I =
>>>>>>>>>>>>>> put in a
>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and =
>>>>>>>>>>>>>> over.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>>>>
>>>>>>>>>>>> There wasn't much of a change... I just assumed someone ran =
>>>>>>>>>>>> yum upgrade and didn't restart, then the power outage... it =
>>>>>>>>>>>> looks like not much of a version change though.
>>>>>>>>>>>>
>>>>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>> Jan 08 04:46:08 Installed: =
>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>>>>> Jul 28 09:55:41 Updated: =
>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:46 Updated: =
>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>
>>>>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>>>>> Jan 08 04:47:19 Installed: =
>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>>>>
>>>>>>>>>>>> # getenforce
>>>>>>>>>>>> Enforcing
>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> If so can you run:
>>>>>>>>>>>>>
>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use =
>>>>>>>>>>>> the write_logs option.
>>>>>>>>>>>> The NOLOG option is overriding the write_logs current setting.
>>>>>>>>>>>> ----
>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc0000=
03e =
>>>>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800=
a2=3D1 =
>>>>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D429=
4967295 =
>>>>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 =
>>>>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) =
>>>>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { =
>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" =
>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 =
>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and =
>>>>>>>>>>>>> everything wasn't
>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>>>>> upgrade it just
>>>>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Can you run these commands:
>>>>>>>>>>>>>
>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descrip=
tion
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> This returns
>>>>>>>>>>>>
>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript=
ion
>>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>>> ... stuff ...
>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=
=3DCA =
>>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>>
>>>>>>>>>>>>> and
>>>>>>>>>>>>>
>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> These both return
>>>>>>>>>>>>
>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>>>> User Private Key and Certificate Services"
>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: =
>>>>>>>>>>>> Unrecognized Object Identifier.
>>>>>>>>>>>>
>>>>>>>>>>> Hi,
>>>>>>>>>>>
>>>>>>>>>>> you made a typo and requested the keys (-K) instead of the =
>>>>>>>>>>> certs (-L). Please retry with -L and you should be able to =
>>>>>>>>>>> see the certificate serial.
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca =
>>>>>>>>>> userCertificate description
>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>> userCertificate:: =
>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>> ...
>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC=
A =
>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>
>>>>>>>>>> So the serial is 4?
>>>>>>>>>>
>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>>> grep Serial
>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>>
>>>>>>>>>> Which is NOT 4...
>>>>>>>>>>
>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
>>>>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>> ...
>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>>>> -----END CERTIFICATE-----
>>>>>>>>>>
>>>>>>>>>> And this cert is NOT the same.
>>>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>>>>> post-save commands (which you can see in the output of getcert =
>>>>>>>>> list). In your case, the post-save command for subsystemCert =
>>>>>>>>> cert-pki-ca probably failed.
>>>>>>>>>
>>>>>>>>> This command (on the renewal master) is responsible for =
>>>>>>>>> copying the new cert from the NSS db to the LDAP server. You =
>>>>>>>>> need first to check which IPA server is the renewal master (as =
>>>>>>>>> the serial numbers are in a completely different range, I =
>>>>>>>>> assume that you have multiple IPA servers configured with a CA =
>>>>>>>>> instance):
>>>>>>>>>
>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D =
>>>>>>>>> -f2-`
>>>>>>>>> $ kinit admin
>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>> dn: =
>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=
=3Detc,dc=3Dipadomain,dc=3Dcom =
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>>>>
>>>>>>>>
>>>>>>>> I get this
>>>>>>>>
>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>> dn: =
>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,=
dc=3Dbpt,dc=3Drocks =
>>>>>>>>
>>>>>>>>
>>>>>>>> Which is the other FreeIPA server.
>>>>>>>>
>>>>>>> Hi Ian,
>>>>>>>
>>>>>>> it's getting difficult to follow this thread, so could we step =
>>>>>>> back and summarize?
>>>>>> Yes, it is. Sorry.
>>>>>>>
>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in =
>>>>>>> the NSSDB /etc/pki/pki-tomcat/alias
>>>>>> No?
>>>>>>
>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has =
>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>>>>> Yes
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>
>>>>>>>
>>>>>>> - In the LDAP servers, the cert is stored in the entry =
>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it=
is =
>>>>>>> the cert from freeipa-sea).
>>>>>> This is where the difference is. There are two certificates on =
>>>>>> the master and only one on the other. I wonder if this is a =
>>>>>> result of the slow motion replication trainwreck I have going on =
>>>>>> due to a zombie replica in the ldap database that no longer =
>>>>>> exists in the real world and I can't seem to get rid of.
>>>>>>
>>>>> Hi,
>>>>>
>>>>> the remaining issue is a replication problem. There is a =
>>>>> "Troubleshooting replication" section [1] in IdM Admin guide that =
>>>>> may help you.
>>>>>
>>>>> Regarding your zombie replica, which commands did you use to try =
>>>>> to remove it, and what was the output?
>>>>>
>>>>> Flo
>>>>>
>>>>> [1] =
>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linu=
x/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-=
replication.html
>>>>>
>>>>
>>>> Hi,
>>>>
>>>> To debug replication latency or problem we would need several info =
>>>> but starting with the results of the following commands
>>>>
>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> nscpentrywsi: =
>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
>>> 75274897
>>> nscpentrywsi: =
>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
>>> 90004: 20170608055334Z
>>> nscpentrywsi: =
>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
>>> 003: cn=3DDirectory Manager
>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>> nscpentrywsi: cn: pkidbuser
>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>> nscpentrywsi: description;vucsn-5938e688000104290001: =
>>> 2;1341718541;CN=3DCertific
>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
>>> 2;4;CN=3DCertifica
>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>> nscpentrywsi: mail:
>>> nscpentrywsi: objectClass: top
>>> nscpentrywsi: objectClass: person
>>> nscpentrywsi: objectClass: organizationalPerson
>>> nscpentrywsi: objectClass: inetOrgPerson
>>> nscpentrywsi: objectClass: cmsuser
>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>> nscpentrywsi: sn: pkidbuser
>>> nscpentrywsi: uid: pkidbuser
>>> nscpentrywsi: userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>
>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
>>> MIIDbjCCAlagAwIBAgI
>>>
>>> AR
>>> nscpentrywsi: userPassword::
>>> nscpentrywsi: userstate: 1
>>> nscpentrywsi: usertype: agentType
>>> nscpentrywsi: parentid: 2
>>> nscpentrywsi: entryid: 51
>>>> and
>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>> Enter LDAP Password:
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>> nscpentrywsi: userCertificate:: =
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>
>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>> nscpentrywsi: description: 2;4;CN=3DCertificate =
>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs
>>> ystem,O=3DBPT.ROCKS
>>> nscpentrywsi: entryid: 51
>>> nscpentrywsi: parentid: 2
>>> nscpentrywsi: modifyTimestamp: 20150716125146Z
>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager
>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>> nscpentrywsi: userPassword::
>>> nscpentrywsi: userstate: 1
>>> nscpentrywsi: usertype: agentType
>>> nscpentrywsi: mail:
>>> nscpentrywsi: cn: pkidbuser
>>> nscpentrywsi: sn: pkidbuser
>>> nscpentrywsi: uid: pkidbuser
>>> nscpentrywsi: objectClass: top
>>> nscpentrywsi: objectClass: person
>>> nscpentrywsi: objectClass: organizationalPerson
>>> nscpentrywsi: objectClass: inetOrgPerson
>>> nscpentrywsi: objectClass: cmsuser
>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>> nscpentrywsi: entryusn: 86
>>>>
>>>> From the output you may only copy/past the ones related to =
>>>> userCertificate
>>>>
>>>>
>>>> Also to dump the current replication status, send the result of
>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b =
>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffff=
ffff-ffffffff-ffffffff))"
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>> -W -b "o=3Dipaca" =
>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-=
ffffffff))"
>>> Enter LDAP Password:
>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>> cn: replica
>>> nsDS5Flags: 1
>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>> cloneAgreement1-freeipa-sea.bpt.roc
>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>> masterAgreement1-seattlenfs.bpt.roc
>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>> nsDS5ReplicaId: 1065
>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
>>> nsDS5ReplicaRoot: o=3Dipaca
>>> nsDS5ReplicaType: 3
>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
>>> nsds5replicabinddngroup: cn=3Dreplication =
>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>> dc=3Drocks
>>> nsds5replicabinddngroupcheckinterval: 60
>>> objectClass: top
>>> objectClass: nsDS5Replica
>>> objectClass: extensibleobject
>>> nsds50ruv: {replicageneration} 57c291d9000004290000
>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>> 57f840bf00000429000
>>> 0 598a1c40000104290000
>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>>> nsds5agmtmaxcsn: =
>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
>>> tlenfs.bpt.rocks;389;unavailable
>>> nsds5agmtmaxcsn: =
>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
>>> tlenfs.bpt.rocks;389;unavailable
>>> nsruvReplicaLastModified: {replica 1065 =
>>> ldap://freeipa-sea.bpt.rocks:389} 598a
>>> 1c16
>>> nsruvReplicaLastModified: {replica 1290 =
>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>> 000
>>> nsds5ReplicaChangeCount: 885
>>> nsds5replicareapactive: 0
>>>> and
>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b =
>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffff=
ffff-ffffffff-ffffffff))"
>>>
>>>
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>>> -b "o=3Dipaca" =
>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-=
ffffffff))"
>>> Enter LDAP Password:
>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>> cn: replica
>>> nsDS5Flags: 1
>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>> cloneAgreement1-seattlenfs.bpt.rock
>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>> nsDS5ReplicaId: 1290
>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
>>> nsDS5ReplicaRoot: o=3Dipaca
>>> nsDS5ReplicaType: 3
>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
>>> nsds5replicabinddngroup: cn=3Dreplication =
>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>> dc=3Drocks
>>> nsds5replicabinddngroupcheckinterval: 60
>>> objectClass: top
>>> objectClass: nsDS5Replica
>>> objectClass: extensibleobject
>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
>>> 57be804c0000050a0000
>>> 587236150000050a0000
>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>> 57b103d400000429000
>>> 0 57be8043000704290000
>>> nsds5agmtmaxcsn: =
>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000
>>> nsruvReplicaLastModified: {replica 1290 =
>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>> 000
>>> nsruvReplicaLastModified: {replica 1065 =
>>> ldap://freeipa-sea.bpt.rocks:389} 0000
>>> 0000
>>> nsds5ReplicaChangeCount: 3
>>> nsds5replicareapactive: 0
>>>>
>>>> Regards
>>>> thierry
>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate =
>>>>>> description
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>
>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> userCertificate:: =
>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>>>>> description: 2;1341718541;CN=3DCertificate =
>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem
>>>>>> ,O=3DBPT.ROCKS
>>>>>>
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript=
ion
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>
>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>> Subsystem,O=3DBPT.RO
>>>>>> CKS
>>>>>>
>>>>>>> If you check the certificates dates, I guess that the most =
>>>>>>> recent one is on server seattlenfs (because of serial numbers). =
>>>>>>> Can you confirm this (because our goal is to have the most =
>>>>>>> recent cert stored in all the NSSDBs and in LDAP)?
>>>>>>>
>>>>>>> Thanks,
>>>>>>> Flo
>>>>>>>
>>>>>>>
>>>>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you =
>>>>>>>>> can manually run the scripts:
>>>>>>>>
>>>>>>>> If I'm interpreting this correctly, then it is... so I ran this =
>>>>>>>> on the broken machine (seattlenfs)
>>>>>>>>
>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert =
>>>>>>>>> "subsystemCert cert-pki-ca"
>>>>>>>>>
>>>>>>>>
>>>>>>>> I ran this, it took a while, then I re-checked and the serial =
>>>>>>>> still seems to be 4
>>>>>>>>
>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>> Enter LDAP Password:
>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>> userCertificate:: =
>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>> ...
>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>
>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>>>>
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DE=
BUG =
>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> restart at autoShutdown? false
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> autoShutdown crumb file path? =
>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>>>> cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>>> init id=3Ddebug
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> initialized debug
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> initSubsystem id=3Dlog
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>>>> to init id=3Dlog
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audi=
t) =
>>>>>>>>
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> restart at autoShutdown? false
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> autoShutdown crumb file path? =
>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>>>> cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>>> init id=3Dlog
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> initialized log
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> initSubsystem id=3Djss
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>>>> to init id=3Djss
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> restart at autoShutdown? false
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> autoShutdown crumb file path? =
>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about =
>>>>>>>> to look for cert for auto-shutdown support:auditSigningCert =
>>>>>>>> cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found =
>>>>>>>> cert:auditSigningCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>>> init id=3Djss
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> initialized jss
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>> initSubsystem id=3Ddbs
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready =
>>>>>>>> to init id=3Ddbs
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: =
>>>>>>>> init() mEnableSerialMgmt=3Dtrue
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> LdapBoundConnFactory: init
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> LdapBoundConnFactory:doCloning true
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>> init()
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>> init begins
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>> init ends
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>>>>> makeConnection errorIfDown is true
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>>>>>>> errorIfDown true
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: =
>>>>>>>> true
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname =
>>>>>>>> to: subsystemCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> LdapJssSSLSocket: set client auth cert nickname subsystemCert =
>>>>>>>> cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>>>> ocspSigningCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert =
>>>>>>>> cert-pki-ca
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake =
>>>>>>>> happened
>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>> CMSEngine.shutdown()
>>>>>>>>
>>>>>>>>
>>>>>>>> I really appreciate you sticking with me through this. I owe you.
>>>>>>>>
>>>>>>>> - Ian
>>>>>>>>
>>>>>>>>> After that, check that the LDAP entry has been updated. If it =
>>>>>>>>> is the case, you should be able to restart pki.
>>>>>>>>>
>>>>>>>>> Flo
>>>>>>>>>
>>>>>>>>>> Thank you again for your time!
>>>>>>>>>>
>>>>>>>>>> Ian
>>>>>>>>>>
>>>>>>>>>>> Flo.
>>>>>>>>>>>>
>>>>>>>>>>>> which seems weird.
>>>>>>>>>>>>
>>>>>>>>>>>>> The description attribute in the ldapsearch output is of =
>>>>>>>>>>>>> the form 2;#;DN;DN
>>>>>>>>>>>>>
>>>>>>>>>>>>> The # should match the serial number in the first certutil =
>>>>>>>>>>>>> output
>>>>>>>>>>>>>
>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match =
>>>>>>>>>>>>> one of the
>>>>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>>>>
>>>>>>>>>>>>> rob
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>>> To unsubscribe send an email to =
>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>> To unsubscribe send an email to =
>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted=
.org
>>
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.=
org
--===============0674695975783376051==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm
LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPGJyPgogICAgPGJyPgogICAgPGRpdiBjbGFz
cz0ibW96LWNpdGUtcHJlZml4Ij5PbiAwOC8wOS8yMDE3IDA5OjMwIFBNLCBJYW4gSGFyZGluZyB2
aWEKICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1
b3RlCiAgICAgIGNpdGU9Im1pZDpmZTUyNTlmMy1hZTRhLTgzODktNTQyNS05Yjg0YjExYjcxZDVA
YnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPG1ldGEgaHR0
cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgi
PgogICAgICA8cD5PbiA4LzkvMTcgMzowNSBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6PGJyPgog
ICAgICA8L3A+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3
Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsg
Y2hhcnNldD11dGYtOCIKICAgICAgICAgIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgICAg
ICAgSGkgSWFuLDxicj4KICAgICAgICA8YnI+CiAgICAgICAgVGhhbmtzIGZvciBoYXZpbmcgZ2F0
aGVyIHRob3NlIGRhdGEuIDxicj4KICAgICAgICA8dHQ+PGJyPgogICAgICAgIDwvdHQ+CiAgICAg
ICAgPGJsb2NrcXVvdGU+PHR0PiM8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jIFNvIHBraWRidXNl
ciBlbnRyaWVzIGhhdmUgYSBzYW1lIChvbGQpIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAgICBs
aWtlbHkgZ2VuZXJhdGVkIGR1cmluZyBpbnN0YWxsPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBC
dXQgb25seSBmcmVlaXBhLXNlYSBoYXMgYSBuZXcgb25lIGNyZWF0ZWQgb24KICAgICAgICAgICAg
ZnJlZWlwYS1zZWEgYXJvdW5kIEp1biA4dGggMjAxNyAwNTo1NDoxNjwvdHQ+PGJyPgogICAgICAg
ICAgPHR0PiMgVGhpcyByZWNlbnQgY2VydGlmaWNhdGUgaXMgaWRlbnRpZmllZCBieQogICAgICAg
ICAgICA1OTM4ZTY4ODAwMDEwNDI5MDAwMCA8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jPC90dD48
YnI+CiAgICAgICAgICA8dHQ+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxM
TCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9cGtpZGJ1
c2VyLG91PXBlb3BsZSxvPWlwYWNhIgogICAgICAgICAgICBuc2NwZW50cnl3c2k8L3R0Pjxicj4K
ICAgICAgICAgIDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJy
PgogICAgICAgICAgPHR0Pi4uLjwvdHQ+PGJyPgogICAgICAgICAgPHR0Pm5zY3BlbnRyeXdzaTog
dXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdr
cWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgICAgIDx0dD5u
c2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMDo6
CiAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0kgJmx0O3NuaXAmZ3Q7PC90dD48YnI+CiAg
ICAgICAgICA8YnI+CiAgICAgICAgICA8dHQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNl
YXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlk
PXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8L3R0Pjxicj4KICAgICAg
ICAgIDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAg
ICAgICAgPHR0Pm5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgTUlJ
RGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8
L3R0Pjxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAg
ICAgICAgIDx0dD4jPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyB3aHkgNTkzOGU2ODgwMDAxMDQy
OTAwMDAgdmFsdWUgd2FzIG5vdCBwcm9wYWdhdGVkIHRvCiAgICAgICAgICAgIHNlYXR0bGVuZnMg
PzwvdHQ+PGJyPgogICAgICAgICAgPHR0PiMgVGhlIG1vc3QgcmVjZW50IHVwZGF0ZSAoZnJvbSBm
cmVlaXBhLXNlYSkgdGhhdCB3YXMKICAgICAgICAgICAgcmVwbGljYXRlZCB0byBzZWF0dGxlbmZz
PC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBpc8KgIDEgeWVhciBvbGQgKDU3YmU4MDQzMDAwNzA0
MjkwMDAwIC0gQXVnIDI1dGggMjAxNgogICAgICAgICAgICAwNToyMTowNykuPC90dD48YnI+CiAg
ICAgICAgICA8dHQ+IyBJbiBhZGRpdGlvbiBzZWF0dGxlbmZzIHJlY2VpdmVkIGRpcmVjdCB1cGRh
dGUgKGxhc3Qgb25lCiAgICAgICAgICAgIHdhcyBpbiBKYW4gMTAxNykgdGhhdCB3ZXJlIG5vdDwv
dHQ+PGJyPgogICAgICAgICAgPHR0PiMgcmVwbGljYXRlZCB0byBmcmVlaXBhLXNlYTwvdHQ+PGJy
PgogICAgICAgICAgPHR0PiMgPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBUaGUgdHdvIHNlcnZl
cnMgaGF2ZSBkaXZlcmdlZCBiZWNhdXNlIHRoZXkgY2FuIG5vdAogICAgICAgICAgICByZXBsaWNh
dGUgdG8gZWFjaG90aGVyIGJlY2F1c2U8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jIHRoZXkgd2Vy
ZSBub3QgY29ycmVjdGx5IGluaXRpYWxpemUuPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBUaGV5
IGhhdmUgZGlmZmVyZW50ICJyZXBsaWNhZ2VuZXJhdGlvbiIKICAgICAgICAgICAgKDU3YzI5MWQ5
MDAwMDA0MjkwMDAwIHZzIDU1YzhmM2FlMDAwMDAwNjAwMDAwKTwvdHQ+PGJyPgogICAgICAgICAg
PHR0PiM8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jIEl0IGlzIGxvb2tpbmcgbGlrZSBmcmVlaXBh
LXNlYSB3YXMgY3JlYXRlZCBvbmUgb3IgdHdvCiAgICAgICAgICAgIHllYXJzIGFnbyBhbmQgdXNl
ZCB0byBpbml0aWFsaXplZCBzZWF0dGxlbmZzLjwvdHQ+PGJyPgogICAgICAgICAgPHR0PiMgQnV0
IGxhdGVyIGZyZWVpcGEtc2VhIHdhcyByZWNyZWF0ZWQuPC90dD48YnI+CiAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDx0dD5UaGF0J3MgYWJvdXQgcmlnaHQu
PC90dD48YnI+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3
Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICAgIDxibG9ja3F1b3RlPiA8dHQ+IzwvdHQ+PGJy
PgogICAgICAgICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg
LUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigm
YW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZm
Zi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAgPHR0PkVudGVyIExEQVAg
UGFzc3dvcmQ6PC90dD48YnI+CiAgICAgICAgICA8dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlw
YWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8L3R0Pjxicj4KICAgICAgICAgIDx0dD5uc2Rz
NTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkwMDAwMDQyOTAwMDA8L3R0Pjxicj4K
ICAgICAgICAgIDx0dD5uc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgY2xhc3M9Im1vei10eHQt
bGluay1mcmVldGV4dCIKICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0
LnJvY2tzOjM4OSIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9m
cmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgNTdmODQwYmYwMDAwMDQy
OTAwMDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICAgIDx0dD5uc2RzNTBy
dXY6IHtyZXBsaWNhIDEyOTAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAg
ICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5IgogICAgICAgICAg
ICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4
OTwvYT59PC90dD48YnI+CiAgICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7
cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4
dCIKICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSIK
ICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxp
bmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFw
Oi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT48L2E+fQogICAgICAgICAgICA1OThhMWMx
NjwvdHQ+PGJyPgogICAgICAgICAgPHR0Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxp
Y2EgMTI5MCA8YQogICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAg
ICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAg
ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl
ZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0
dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjxi
cj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDx0dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBs
ZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICBtYW5hZ2VyJyAtVyAt
YiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1m
ZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAg
PHR0PmRuOiBjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmln
PC90dD48YnI+CiAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU1
YzhmM2FlMDAwMDAwNjAwMDAwPC90dD48YnI+CiAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVw
bGljYSAxMDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAg
aHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgbW96
LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59
CiAgICAgICAgICAgIDU3YjEwM2Q0MDAwMDA0MjkwMDAwIDU3YmU4MDQzMDAwNzA0MjkwMDAwPC90
dD48YnI+CiAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIGNsYXNzPSJt
b3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVu
ZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxk
YXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fcKgCgogICAgICAgICAgICA1N2JlODA0
YzAwMDAwNTBhMDAwMCA1ODcyMzYxNTAwMDAwNTBhMDAwMDwvdHQ+PGJyPgogICAgICAgICAgPHR0
Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICAg
IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgaHJlZj0ibGRhcDov
L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9
InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0
dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+
PC9hPn0KICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjxicj4KICAgICAgICAgIDx0dD5uc3J1dlJl
cGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgICBjbGFzcz0i
bW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBh
LXNlYS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+
PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh
LmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPjwvYT59
CiAgICAgICAgICAgIDAwMDAwMDAwPC90dD48L2Jsb2NrcXVvdGU+CiAgICAgICAgPGJyPgogICAg
ICAgIDxicj4KICAgICAgICBJbiBjb25jbHVzaW9uOjxicj4KICAgICAgICDCoMKgwqAgRnJvbSBy
ZXBsaWNhdGlvbiBwb3YsIHRoZSB0d28gaW5zdGFuY2VzIGNhbiBub3QgY29tbXVuaWNhdGUuPGJy
PgogICAgICAgIMKgwqDCoCBPbmUgc29sdXRpb24gd291bGQgYmUgdG8gaWRlbnRpZnkgd2hpY2gg
aW5zdGFuY2UgaXMgdGhlIGdvb2QKICAgICAgICBvbmUsIHlvdSB3YW50IHRvIGtlZXAuPGJyPgog
ICAgICAgIMKgwqDCoCBhbmQgcmVpbml0IHRoZSBzZWNvbmQgb25lIGZyb20gdGhhdCByZWZlcmVu
Y2UuPGJyPgogICAgICAgIDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBXaGF0IGV4YWN0
bHkgZG9lcyByZWluaXQgbWVhbj/CoCBJIGhhdmUgcnVuPGJyPgogICAgICA8YnI+CiAgICAgIGlw
YS1yZXBsaWNhLW1hbmFnZSByZS1pbml0aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5icHQucm9j
a3M8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBUaGlzIHRyaWdnZXJzIHRoZSBy
ZWluaXQgb2YgJ2RjPWlwYWRvbWFpbixkYz1jb20nIHN1ZmZpeCBidXQgbm90IGZvcgogICAgbz1p
cGFjYSBzdWZmaXguIFRvIHJlaW5pdCBvPWlwYWNhIHlvdSBtYXkgdXNlPGJyPgogICAgaXBhLWNz
LXJlcGxpY2EtbWFuYWdlciByZS1pbml0aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5icHQucm9j
a3MuPGJyPgogICAgTm90ZSB0aGF0IGl0IHdpbGwgb3ZlcndyaXRlIGFsbCBkYXRhIG9mIGlwYWNh
IG9uIHNlYXR0bGVuZnMgd2l0aCB0aGUKICAgIGRhdGEgZnJvbSBmcmVlaXBhLXNlYS4gVGhpcyBp
cyB3aHkgaXQgaXMgaW1wb3J0YW50IHRvIGtub3cgd2hpY2gKICAgIHNlcnZlciBpcyB0aGUgdmFs
aWQgb25lLjxicj4KICAgIDxicj4KICAgIE9uIGZyZWVpcGEtc2VhIGFuZCBzZWF0dGxlbmZzIHlv
dSBtYXkgY2hlY2sgdGhlIGlwYWNhIHJlcGxpY2EKICAgIGFncmVlbWVudHMgc3RhdHVzIGJlZm9y
ZS9hZnRlciByZWluaXQuIEkgd291bGQgZ3Vlc3MgdGhleSBhcmUKICAgIGN1cnJlbnRseSByZXBv
cnRpbmcgZmFpbHVyZXMgYmV0d2VlbiB0aGVzZSB0d28gcmVwbGljYXMuPGJyPgogICAgPGJyPgog
ICAgPHR0PmxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICI8
L3R0Pjx0dD5jbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgIHRyZWUsY249
Y29uZmlnIiAib2JqZWN0Q2xhc3M9bnNkczVyZXBsaWNhdGlvbmFncmVlbWVudCIKICAgICAgbnNk
czVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgPGJyPgogICAgPC90dD4KICAgIDxi
bG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDpmZTUyNTlmMy1hZTRhLTgzODktNTQyNS05Yjg0YjEx
YjcxZDVAYnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICB0eXBlPSJjaXRlIj4gPGJyPgogICAg
ICBzZXZlcmFsIHRpbWVzIG92ZXIgdGhlIHllYXJzIHdoZW4gcmVwbGljYXRpb24gaGFzIHN0b3Bw
ZWQuwqAgPGJyPgogICAgICA8YnI+CiAgICAgIFJlcGxpY2F0aW9uIGFjdHVhbGx5IGlzIHdvcmtp
bmcsIGFzIGZhciBhcyB1c2VyIGFuZCBtYWNoaW5lCiAgICAgIGFjY291bnRzIGFuZCBhdHRyaWJ1
dGVzIGFyZSBjb25jZXJuZWQgYW55d2F5LCBhbmQgaGFzIGJlZW4gZm9yIGEKICAgICAgd2hpbGUu
PGJyPgogICAgICA8YnI+CiAgICAgIFRoZXJlIGlzIGEgem9tYmllIHNlcnZlciBmcmVlaXBhLWRh
bC5icHQucm9ja3MgdGhhdCBJIGNhbid0IGdldAogICAgICByaWQgb2YuLi4gaXQgc2hvd3MgdXAg
aW4gdGhlIEdVSSBvbiB0aGUgVG9wb2xvZ3kgcGFnZSBidXQKICAgICAgZ2VuZXJhdGVzIGEgU2Vy
dmVyIG5vdCBmb3VuZCBlcnJvci7CoCBJIGRvbid0IGtub3cgaWYgdGhhdCdzCiAgICAgIHJlbGF0
ZWQuPGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgWm9tYmllIHNlcnZlcnMgaGF2
ZSBiZWVuIGRpc2N1c3NlZCBhIGxvdCBvbiB0aGlzIG1haWxpbmcgbGlzdC4gWW91CiAgICBtYXkg
Z2V0IHJpZCBvZiB0aGVtIHdpdGggbGlzdC1ydXYvY2xlYW4tcnV2IHN1YmNvbW1hbmQuIFJlcGxp
Y2F0aW9uCiAgICB1c3VhbGx5IG1hbmFnZSB0byB3b3JrIGZpbmUgZXZlbiBpZiBzb21lIHpvbWJp
ZSBlbnRyaWVzIGV4aXN0IGJ1dCBpdAogICAgaXMgYSBnb29kIHByYWN0aWNlIHRvIGNsZWFuIHRo
ZW0uPGJyPgogICAgPGJyPgogICAgcmVnYXJkczxicj4KICAgIHRoaWVycnk8YnI+CiAgICA8Ymxv
Y2txdW90ZQogICAgICBjaXRlPSJtaWQ6ZmU1MjU5ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3
MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20i
PiA8YnI+CiAgICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4Ij5PbiAwOC8wOC8yMDE3
IDEwOjMzIFBNLCBJYW4gSGFyZGluZwogICAgICAgICAgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6
PGJyPgogICAgICAgIDwvZGl2PgogICAgICAgIDxibG9ja3F1b3RlCiAgICAgICAgICBjaXRlPSJt
aWQ6MmY2MGM0YWYtNjgwYy00MzgyLTk3MDQtNDFhMjRjODEyMWEyQGJyb3ducGFwZXJ0aWNrZXRz
LmNvbSIKICAgICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgPG1ldGEgaHR0cC1lcXVpdj0i
Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7CiAgICAgICAgICAgIGNoYXJzZXQ9dXRm
LTgiPgogICAgICAgICAgPHA+T24gOC83LzE3IDE6NDQgQU0sIHRoaWVycnkgYm9yZGF6IHdyb3Rl
Ojxicj4KICAgICAgICAgIDwvcD4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNp
dGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPgogICAgICAgICAgICA8bWV0YSBj
b250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiCiAgICAgICAgICAgICAgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcvMjAxNyAwOToyMiBB
TSwKICAgICAgICAgICAgICBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgdmlhIEZyZWVJUEEtdXNlcnMg
d3JvdGU6PGJyPgogICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUKICAg
ICAgICAgICAgICBjaXRlPSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMz
QHJlZGhhdC5jb20iCiAgICAgICAgICAgICAgdHlwZT0iY2l0ZSI+T24gMDgvMDQvMjAxNyAxMTow
MiBQTSwgSWFuIEhhcmRpbmcgdmlhCiAgICAgICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTog
PGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDgvNC8xNyAyOjE2
IEFNLCBGbG9yZW5jZQogICAgICAgICAgICAgICAgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij5PbiAwOC8wMy8yMDE3IDExOjEzIFBNLCBJYW4KICAgICAgICAgICAgICAgICAgSGFyZGluZyB2
aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90
ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4IEFNLAogICAgICAgICAgICAgICAgICAg
IEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgIDxi
bG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMTE6NTEgUE0sIElhbgogICAgICAg
ICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAx
MjoxMSBBTSwKICAgICAgICAgICAgICAgICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdy
b3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
Pk9uIDA4LzAyLzIwMTcgMDE6NDMgQU0sCiAgICAgICAgICAgICAgICAgICAgICAgICAgSWFuIEhh
cmRpbmcgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDEyOjAzCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBQTSwgUm9iIENyaXR0ZW5kZW4gd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklhbiBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAx
LzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwNzozOSBBTSwgRmxvcmVuY2Ug
QmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNwogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgMDM6MTEgUE0sIElhbiBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8w
MS8yMDE3CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDAxOjQ4IEFNLCBGbG9y
ZW5jZSBCbGFuYy1SZW5hdWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Jv
dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg
dHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwOC8w
MS8yMDE3IDAxOjMyIEFNLCBJYW4gSGFyZGluZwogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHZpYSBGcmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIE9uIDA3LzMxLzIwMTcgMTE6MzQgQU0sIFJvYgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ3JpdHRlbmRlbiB3cm90ZTogPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i
Y2l0ZSI+SWFuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhhcmRp
bmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBoYWQKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBhbiB1bmV4cGVjdGVkIHJlc3RhcnQgb2YgYW4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJUEEgc2VydmVyIHRoYXQgaGFkCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXBwYXJlbnRseSBoYWQg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZXMg
cnVuIGJ1dCBoYWQgbm90IGJlZW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICByZXN0YXJ0ZWQuIGlwYWN0bCBzYXlzCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgcGtpLXRvbWNhdGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHdvdWxkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBub3Qgc3RhcnQuIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgU3RyYW5nZWx5LCB0aGUgYWN0dWFsCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgc2VydmljZSBhcHBlYXJzIHRvIGJlCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnVubmluZzogPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGRvZ3RhZyBpcyBhbiBhcHBsaWNhdGlvbgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICB3aXRoaW4gdG9tY2F0IHNvIHRvbWNhdCBjYW4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnVuIHdpdGhvdXQgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nLiA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgV2UgbmVlZCB0byBzZWUgbW9yZSBvZiB0aGUKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIGRlYnVnIGxvZyB0byBz
ZWUgd2hhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcyBnb2lu
ZyBvbi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBJdCBsb29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0aW9u
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcm9ibGVtLi4uIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFsyOC9KdWwvMjAxNzoxMDowODo0N11bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IFNTTCBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgQ291bGQgbm90IGNvbm5lY3QgdG8gTERBUCBzZXJ2ZXIKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhvc3Qgc2VhdHRsZW5mcy5icHQucm9ja3MgcG9y
dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgNjM2IDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBuZXRzY2FwZS5sZGFwLkxEQVBFeGNlcHRpb246CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRoZW50aWNhdGlvbiBmYWlsZWQg
KDQ5KSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcg
c3RvcmVzIGl0cyBpbnRlcm5hbCBkYXRhIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgdGhlIExEQVAgc2VydmVyIGFuZCBuZWVkcyB0byA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgZXN0YWJsaXNoIGEgc2VjdXJlIExEQVAKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25uZWN0aW9uLiBZb3UgY2FuIGNoZWNrIGhv
dyB0aGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rpb24gaXMgY29uZmlndXJlZCBp
bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21j
YXQvY2EvQ1MuY2ZnLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxvb2sg
Zm9yIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgbGluZXM6
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlw
ZT1Tc2xDbGllbnRBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGF1
dGguYmluZEROPWNuPURpcmVjdG9yeQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIE1hbmFnZXIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu
dGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lzdGVt
Q2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBj
b25uLmhvc3Q9dm0tLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBpbnRlcm5hbGRiLmxkYXBjb25uLnBvcnQ9NjM2IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLnNlY3VyZUNvbm4gPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBhdXRodHlwZSBjYW4gYmUgU3NsQ2xpZW50QXV0aAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEgc3Ns
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSkg
b3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKGF1dGhl
bnRpY2F0aW9uIHdpdGggYSBiaW5kIEROIGFuZAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNz
d29yZCBzdG9yZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFy
L2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYpLgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWW91IGNh
biB1c2UgdGhpcyBpbmZvcm1hdGlvbiB0bwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIG1hbnVhbGx5IGNoZWNrIHRoZSBjcmVkZW50aWFscy4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBGb3IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGluc3RhbmNlIHdpdGggc3NsY2xpZW50YXV0aDogPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBleHBvcnQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBM
REFQVExTX0NBQ0VSVERJUj0vZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGV4cG9ydCBMREFQVExTX0NFUlQ9J3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJt
b3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXBzOi8vIj5sZGFwczovLzwvYT48L2E+YGhv
c3RuYW1lYDo2MzYKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIg
LXMgYmFzZSAtWSBFWFRFUk5BTCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgKHByb3ZpZGUgdGhlIHBhc3N3b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzL3B3ZGZpbGUudHh0KQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJIGZvdW5kIHRoaXM6IDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVu
dEF1dGgKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj11aWQ9
cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxk
Yi5sZGFwYXV0aC5iaW5kUFdQcm9tcHQ9aW50ZXJuYWxkYgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu
dGVybmFsZGIubGRhcGF1dGguY2xpZW50Q2VydE5pY2tuYW1lPXN1YnN5c3RlbUNlcnQKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLmNsb25lUmVwbGlj
YXRpb25Qb3J0PTM4OQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgYW5kIHdoZW4gSSB0cnkgdGhlIGxkYXBzZWFyY2ggSSBhbQogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBwcmVzZW50ZWQgd2l0aCBhIHByb21wdCB0byBwcm92aWRlIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBwaW4vcGFzc3dvcmQgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSBlbnRlciBwaW4sIHBhc3N3b3JkLCBvciBwYXNz
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkg
dG9rZW4gJ2xkYXAoMCknOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgYnV0IHRoZXJlIGlzIG5vIHBhc3N3b3JkIGZpbGUuLi4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeW91IGFyZSByaWdodCwgaW4gNC40
LiB0aGVyZSBpcyBubwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHdkZmlsZS50
eHQgYW5kIHRoZSBwYXNzd29yZCBjYW4gYmUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgZm91bmQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIv
bGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgKHdpdGggdGhlIHRhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBpbnRlcm5hbD0uLi4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENhbiB5b3UgY2hl
Y2sgaWYgdGhlIHBhc3N3b3JkIHdpdGggdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICB0YWcgaW50ZXJuYWw9Li4uIGFsbG93cyB0byByZWFkIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHRoZSBrZXlzIGZyb20gdGhlIE5TUyBkYj8gPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWwgLUsgLWQKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgKHByb3ZpZGUgcGFzc3dvcmQpIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQg
d29ya3MuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IENoZWNraW5nIHRva2VuICJOU1MKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiIgaW4gc2xvdCAiTlNT
IFVzZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcml2YXRlIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGlu
IGZvciAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIi
OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAwJmd0OyByc2EKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdj
YTUzNjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChvcnBoYW4p
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDEmZ3Q7IHJzYQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4
NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTlNTIENlcnRp
ZmljYXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQjphdWRpdFNpZ25p
bmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAm
bHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDg4MWI3MjU0YzQw
ZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBj
ZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0
OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlhMjU1YTFkMTU1ODVhYzI4
MDY0YzBmNDk4NmU0MTZiYzQ4NDAzwqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREI6
b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDNm
YjYwOWQwZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3ZjdlNWEwMWYKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZs
dDsgNSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5NDc5YTk1NTZh
ZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIERCOnN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhp
cyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lIHBhc3N3b3JkCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgZnJvbSBwYXNzd29yZC5jb25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgbGRhcHNlYXJj
aCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQt
bGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imxk
YXBzOi8vIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl
ZXRleHQiIGhyZWY9ImxkYXBzOi8vIj5sZGFwczovLzwvYT48L2E+YGhvc3RuYW1lYDo2MzYKCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIgLXMgYmFzZSAtWSBFWFRFUk5BTCA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFz
c3dvcmQsIG9yIHBhc3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaHJhc2UgZm9y
IHNlY3VyaXR5IHRva2VuICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIFNBU0wvRVhURVJOQUwgYXV0aGVudGljYXRpb24gc3RhcnRlZCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgbGRhcF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczogSW52
YWxpZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRlbnRpYWxzICg0OSkgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29tZXdoZXJlCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhvdWdoLCBzaW5jZSBpZiBJIHB1dCBpbiBhIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBub25zZW5zZSBvciBpbmNvcnJlY3Qg
cGFzc3dvcmQgaXQganVzdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByb21wdHMg
b3ZlciBhbmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgZnJvbSB3aGF0IHRvIHdoYXQ/IDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZXJlIHdhc24ndCBtdWNo
IG9mIGEgY2hhbmdlLi4uIEkganVzdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgYXNzdW1l
ZCBzb21lb25lIHJhbiB5dW0gdXBncmFkZSBhbmQgZGlkbid0CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICByZXN0YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGxpa2Ugbm90IG11Y2ggb2YgYSB2ZXJzaW9uIGNoYW5nZSB0
aG91Z2guIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICMgZ3JlcCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDU6MzIgSW5zdGFsbGVkOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2Fy
Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3Rh
bGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4w
LTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBsaWJpcGFfaGJhYy0xLjE0LjAtNDMuZWw3XzMuNC54
ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA3IFVw
ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24tbGliaXBhX2hiYWMtMS4x
NC4wLTQzLmVsN18zLjQueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDggSW5zdGFsbGVkOgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uLWlwYWRkcmVzcy0xLjAuMTYtMi5lbDcubm9h
cmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNCBJbnN0
YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0x
NC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcu
Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBVcGRhdGVkOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEu
bm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDUgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDc6MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBK
YW4gMDggMDQ6NDc6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNzc2Qt
aXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDc6MTcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGlwYS1jbGllbnQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEueDg2XzY0IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMyBVcGRhdGVkOgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgaXBhLXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjI3IFVwZGF0ZWQ6
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcu
Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzozNiBJbnN0YWxsZWQ6CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9z
LjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo1MDowNyBFcmFzZWQ6CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBpcGEtcHl0aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NAog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgSnVsIDI4IDA5OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBp
cGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQyIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy
OCAwOTo1NTo0MyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1p
cGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ0IFVw
ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQu
MC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDUgVXBkYXRlZDoKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2VydmVyLTQuNC4wLTE0LmVsNy5j
ZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJj
aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgSnVsIDI4IDA5OjU1OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBpcGEtY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBpcGEtc2VydmVyLTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2Vu
dG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGlwYS1weXRob24tY29tcGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2Fy
Y2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgZ3JlcCBwa2kgL3Zhci9s
b2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6
MDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0x
NC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0
OjQ2OjA5IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBrcmI1LXBraW5pdC0x
LjE0LjEtMjcuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph
biAwOCAwNDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kt
YmFzZS1qYXZhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHBraS1zZXJ2ZXItMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIHBraS1rcmEtMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNiBVcGRhdGVkOgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEtMTAuMy4zLTE5LmVsN18zLm5v
YXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBk
YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTkuZWw3
XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoy
MSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMt
MTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx
MDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4z
LjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy
OCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWNhLTEw
LjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgQXJlIHlvdSBydW5uaW5nIGluIFNFTGludXggZW5mb3JjaW5nIG1vZGU/CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICMgZ2V0ZW5mb3JjZSA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBFbmZvcmNpbmcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWYgc28gY2FuIHlvdSBydW46IDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVz
ZWFyY2ggLW0gQVZDIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBv
cHRpb24gdG8gbG9nX2Zvcm1hdCBpcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVwcmVj
YXRlZC4gUGxlYXNlIHVzZSB0aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgb3B0aW9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0
aW9uIGlzIG92ZXJyaWRpbmcgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB3cml0ZV9s
b2dzIGN1cnJlbnQgc2V0dGluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0t
LSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aW1lLSZndDtNb24gTWFyIDE0IDEw
OjM5OjAxIDIwMTYgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgdHlwZT1TWVNDQUxM
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBtc2c9YXVkaXQoMTQ1Nzk3NzE0MS43Njc6MTc1
MzcpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgYXJjaD1jMDAwMDAzZSBzeXNjYWxsPTIg
c3VjY2Vzcz1ubyBleGl0PS0xMwogICAgICAgICAgICAgICAgICAgICAgICAgICAgYTA9N2ZiY2Fi
MDM4ZDEwIGExPTgwMCBhMj0xIGEzPTdmYmNhNjBmNDJlMAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgaXRlbXM9MCBwcGlkPTE0MDYgcGlkPTEyOTY1IGF1aWQ9NDI5NDk2NzI5NQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgdWlkPTAgZ2lkPTAgZXVpZD01ODE0MDAwMDEgc3VpZD0wCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBmc3VpZD01ODE0MDAwMDEgZWdpZD01ODE0MDAwMDEg
c2dpZD0wCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBmc2dpZD01ODE0MDAwMDEgdHR5PShu
b25lKSBzZXM9NDI5NDk2NzI5NQogICAgICAgICAgICAgICAgICAgICAgICAgICAgY29tbT0ic3No
ZCIgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN1Ymo9
c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBrZXk9KG51bGwpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIHR5
cGU9QVZDIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBhdmM6wqAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGNvbW09InNzaGQiIG5hbWU9ImF1dGhvcml6ZWRfa2V5cyIKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGRldj0iZG0tMiIgaW5vPTExNjM5MzUxNwogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMw
LXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0Y29udGV4dD1zeXN0ZW1f
dTpvYmplY3Rfcjp1bmxhYmVsZWRfdDpzMAogICAgICAgICAgICAgICAgICAgICAgICAgICAgdGNs
YXNzPWZpbGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSI+SSBzdXNwZWN0IHRoYXQgdGhlCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHN1YnN5c3RlbSBjZXJ0IHdhcyByZW5ld2VkIGFuZCBldmVyeXRoaW5nCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHdhc24ndCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHVwZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0aGlzIGlzCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHVucmVsYXRlZCB0byB0aGUgdXBncmFkZSBpdCBqdXN0IDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2hvbmUgYSBzcG90bGlnaHQgb24gaXQu
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBDYW4geW91IHJ1biB0aGVzZSBjb21tYW5kczogPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQg
bGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgbWFuYWdlcicgLVcgLWIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1
aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIFRoaXMgcmV0dXJucyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0
b3J5IG1hbmFnZXInCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAtVyAtYiB1aWQ9cGtpZGJ1
c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2Vy
dGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50
ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgZG46IHVp
ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1JSURj
ekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgLi4uIHN0dWZmIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBaTm80ZVg3
ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9CgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246
IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5
LE89QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdWJzeXN0ZW0s
Tz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+YW5kIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAjIGNlcnR1dGlsIC1MIC1kIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgLW4gJ3N1YnN5c3RlbUNlcnQgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgfCBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwgLWQgL2V0Yy9wa2kvcGtpLXRvbWNh
dC9hbGlhcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbiAnc3Vic3lzdGVtQ2VydCBj
ZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGVzZSBib3RoIHJl
dHVybiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNh
JyB8IGdyZXAgU2VyaWFsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9yICJOU1MgQ2VydGlm
aWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgU0VDX0VSUk9SX1VOUkVDT0dOSVpFRF9PSUQ6IFVucmVjb2duaXpl
ZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9w
a2kvcGtpLXRvbWNhdC9hbGlhc8KgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbiAnc3Vi
c3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgY2VydHV0aWw6IENoZWNraW5nIHRva2VuICJOU1MgQ2VydGlmaWNhdGUKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIERCIiBpbiBzbG90ICJOU1MgVXNlciBQcml2YXRlIEtleSBhbmQKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9yICJOU1MgQ2Vy
dGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgU0VDX0VSUk9SX1VOUkVDT0dOSVpFRF9PSUQ6IFVucmVjb2du
aXplZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgeW91IG1h
ZGUgYSB0eXBvIGFuZCByZXF1ZXN0ZWQgdGhlIGtleXMgKC1LKQogICAgICAgICAgICAgICAgICAg
ICAgICAgIGluc3RlYWQgb2YgdGhlIGNlcnRzICgtTCkuIFBsZWFzZSByZXRyeSB3aXRoCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgLUwgYW5kIHlvdSBzaG91bGQgYmUgYWJsZSB0byBzZWUgdGhl
CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydGlmaWNhdGUgc2VyaWFsLiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAg
ICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAg
ICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNhdGUK
ICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAgTUlJRGN6
Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlF
OFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9u
OiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89
QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5S
T0NLUyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgU28gdGhlIHNlcmlhbCBpcyA0PyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0
aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh
cyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScg
fCBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKg
wqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MSAoMHg0ZmY5MDAwZCkKICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0
dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2Fs
aWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNh
JyAtYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUt
LS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0lFVC9r
QURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICBzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBBbmQgdGhpcyBjZXJ0IGlzIE5P
VCB0aGUgc2FtZS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgd2hlbiBjZXJ0
bW9uZ2VyIHJlbmV3cyBhIGNlcnRpZmljYXRlLCBpdCBydW5zCiAgICAgICAgICAgICAgICAgICAg
ICBwcmUtc2F2ZSBhbmQgcG9zdC1zYXZlIGNvbW1hbmRzICh3aGljaCB5b3UgY2FuIHNlZQogICAg
ICAgICAgICAgICAgICAgICAgaW4gdGhlIG91dHB1dCBvZiBnZXRjZXJ0IGxpc3QpLiBJbiB5b3Vy
IGNhc2UsIHRoZQogICAgICAgICAgICAgICAgICAgICAgcG9zdC1zYXZlIGNvbW1hbmQgZm9yIHN1
YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgICAgICAgICAgIHByb2JhYmx5IGZh
aWxlZC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgVGhpcyBjb21tYW5kIChvbiB0aGUgcmVuZXdhbCBtYXN0ZXIpIGlzCiAgICAgICAgICAgICAg
ICAgICAgICByZXNwb25zaWJsZSBmb3IgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0aGUgTlNT
CiAgICAgICAgICAgICAgICAgICAgICBkYiB0byB0aGUgTERBUCBzZXJ2ZXIuIFlvdSBuZWVkIGZp
cnN0IHRvIGNoZWNrCiAgICAgICAgICAgICAgICAgICAgICB3aGljaCBJUEEgc2VydmVyIGlzIHRo
ZSByZW5ld2FsIG1hc3RlciAoYXMgdGhlCiAgICAgICAgICAgICAgICAgICAgICBzZXJpYWwgbnVt
YmVycyBhcmUgaW4gYSBjb21wbGV0ZWx5IGRpZmZlcmVudAogICAgICAgICAgICAgICAgICAgICAg
cmFuZ2UsIEkgYXNzdW1lIHRoYXQgeW91IGhhdmUgbXVsdGlwbGUgSVBBIHNlcnZlcnMKICAgICAg
ICAgICAgICAgICAgICAgIGNvbmZpZ3VyZWQgd2l0aCBhIENBIGluc3RhbmNlKTogPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgJCBleHBvcnQgQkFT
RUROPWBncmVwIGJhc2VkbiAvZXRjL2lwYS9kZWZhdWx0LmNvbmYKICAgICAgICAgICAgICAgICAg
ICAgIHwgY3V0IC1kPSAtZjItYCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAkIGtpbml0IGFk
bWluIDxicj4KICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBo
b3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICBHU1NBUEkgLWIgImNuPW1h
c3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICAgICAgICAgJygmYW1w
Oyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJwogICAgICAgICAgICAg
ICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46CiAgICAgICAgICAgICAg
ICAgICAgICBjbj1DQSxjbj12bS1pcGFzZXJ2ZXIuaXBhZG9tYWluLmNvbSxjbj1tYXN0ZXJzLGNu
PWlwYSxjbj1ldGMsZGM9aXBhZG9tYWluLGRjPWNvbQoKICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEluIHRo
aXMgZXhhbXBsZSB0aGUgcmVuZXdhbCBtYXN0ZXIgaXMKICAgICAgICAgICAgICAgICAgICAgIHZt
LWlwYXNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgSSBnZXQgdGhpcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1Z
IEdTU0FQSQogICAgICAgICAgICAgICAgICAgIC1iICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMs
JEJBU0VETiIKICAgICAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJp
bmc9Y2FSZW5ld2FsTWFzdGVyKSknIGRuCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgIGRuOgogICAgICAgICAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2Vh
LmJwdC5yb2Nrcyxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICBXaGljaCBpcyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuIDxicj4KICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg
ICAgICAgICAgSGkgSWFuLCA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgaXQncyBnZXR0aW5nIGRpZmZpY3VsdCB0byBmb2xsb3cgdGhpcyB0aHJlYWQsIHNvIGNv
dWxkCiAgICAgICAgICAgICAgICAgIHdlIHN0ZXAgYmFjayBhbmQgc3VtbWFyaXplPyA8YnI+CiAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICBZZXMsIGl0IGlzLsKg
IFNvcnJ5LiA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJy
PgogICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJlbmV3YWwgbWFz
dGVyKSwgdGhlIENBCiAgICAgICAgICAgICAgICAgIGNvbXBvbmVudCBpcyBpbnN0YWxsZWQgYW5k
ICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJwogICAgICAgICAgICAgICAgICBoYXMgU2VyaWFs
IG51bWJlciA0IGluIHRoZSBOU1NEQgogICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9t
Y2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg
ICAgIE5vPyA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBbcm9vdEBm
cmVlaXBhLXNlYSBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgIC9ldGMvcGtp
L3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnCiAgICAgICAg
ICAgICAgICB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKg
wqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MSAoMHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+LSBPbiBzZXJ2ZXIgc2VhdHRsZW5mcyAod2hl
cmUKICAgICAgICAgICAgICAgICAgUEtJIGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9u
ZW50IGlzIGluc3RhbGxlZAogICAgICAgICAgICAgICAgICBhbmQgJ3N1YnN5c3RlbUNlcnQgY2Vy
dC1wa2ktY2EnIGhhcyBTZXJpYWwgbnVtYmVyCiAgICAgICAgICAgICAgICAgIDEzNDE3MTg1NDEg
aW4gdGhlIE5TU0RCIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMuIDxicj4KICAgICAgICAgICAg
ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIFllcyA8YnI+CiAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAt
TCAtZAogICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lz
dGVtQ2VydCBjZXJ0LXBraS1jYScKICAgICAgICAgICAgICAgIHwgZ3JlcCBTZXJpYWwgPGJyPgog
ICAgICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx
ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8
YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAtIEluIHRoZSBM
REFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUgZW50cnkKICAgICAgICAgICAg
ICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB3aXRoIFNlcmlhbCBudW1iZXIg
NAogICAgICAgICAgICAgICAgICAoaS5lLiBpdCBpcyB0aGUgY2VydCBmcm9tIGZyZWVpcGEtc2Vh
KS4gPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgVGhp
cyBpcyB3aGVyZSB0aGUgZGlmZmVyZW5jZSBpcy7CoCBUaGVyZSBhcmUgdHdvCiAgICAgICAgICAg
ICAgICBjZXJ0aWZpY2F0ZXMgb24gdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24gdGhlIG90aGVy
LsKgIEkKICAgICAgICAgICAgICAgIHdvbmRlciBpZiB0aGlzIGlzIGEgcmVzdWx0IG9mIHRoZSBz
bG93IG1vdGlvbgogICAgICAgICAgICAgICAgcmVwbGljYXRpb24gdHJhaW53cmVjayBJIGhhdmUg
Z29pbmcgb24gZHVlIHRvIGEgem9tYmllCiAgICAgICAgICAgICAgICByZXBsaWNhIGluIHRoZSBs
ZGFwIGRhdGFiYXNlIHRoYXQgbm8gbG9uZ2VyIGV4aXN0cyBpbgogICAgICAgICAgICAgICAgdGhl
IHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qgc2VlbSB0byBnZXQgcmlkIG9mLiA8YnI+CiAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIEhp
LCA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIHRoZSByZW1haW5pbmcgaXNz
dWUgaXMgYSByZXBsaWNhdGlvbiBwcm9ibGVtLiBUaGVyZSBpcyBhCiAgICAgICAgICAgICAgIlRy
b3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBbMV0gaW4gSWRNIEFkbWluCiAgICAg
ICAgICAgICAgZ3VpZGUgdGhhdCBtYXkgaGVscCB5b3UuIDxicj4KICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1h
bmRzIGRpZCB5b3UgdXNlCiAgICAgICAgICAgICAgdG8gdHJ5IHRvIHJlbW92ZSBpdCwgYW5kIHdo
YXQgd2FzIHRoZSBvdXRwdXQ/IDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
RmxvIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgWzFdIDxhIGNsYXNzPSJt
b3otdHh0LWxpbmstZnJlZXRleHQiCmhyZWY9Imh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9j
dW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0Rv
bWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2Vu
LXJlcGxpY2F0aW9uLmh0bWwiCiAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
Pmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0Vu
dGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlv
bl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgog
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgIEhpLDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUbyBk
ZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAgICAg
ICAgICBzZXZlcmFsIGluZm8gYnV0IHN0YXJ0aW5nIHdpdGggdGhlIHJlc3VsdHMgb2YgdGhlIGZv
bGxvd2luZwogICAgICAgICAgICBjb21tYW5kczxicj4KICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJl
Y3RvcnkKICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl
LG89aXBhY2EiCiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg
LUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicgLVcgLWIgInVpZD1wa2lkYnVzZXIs
b3U9cGVvcGxlLG89aXBhY2EiIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICAgIEVudGVyIExEQVAg
UGFzc3dvcmQ6IDxicj4KICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlw
YWNhPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBkbjogdWlkPXBraWRidXNlcixvdT1wZW9w
bGUsbz1pcGFjYTxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaToKICAgICAgICAgIGVudHJ5dXNu
O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1Ogog
ICAgICAgICAgPGJyPgogICAgICAgICAgwqA3NTI3NDg5Nzxicj4KICAgICAgICAgIG5zY3BlbnRy
eXdzaToKICAgICAgICAgIG1vZGlmeVRpbWVzdGFtcDthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAw
NDt2dWNzbi01OTM4ZTY4ODAwMDEwNDI8YnI+CiAgICAgICAgICDCoDkwMDA0OiAyMDE3MDYwODA1
NTMzNFo8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgICBtb2RpZmllcnNOYW1l
O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAzO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwPGJyPgog
ICAgICAgICAgwqAwMDM6IGNuPURpcmVjdG9yeSBNYW5hZ2VyPGJyPgogICAgICAgICAgbnNjcGVu
dHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxi
cj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNlcjxicj4KICAgICAgICAgIG5z
Y3BlbnRyeXdzaTogY3JlYXRlVGltZXN0YW1wOiAyMDE1MDcxNjEyNTE0Nlo8YnI+CiAgICAgICAg
ICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAg
ICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0Mjkw
MDAxOgogICAgICAgICAgMjsxMzQxNzE4NTQxO0NOPUNlcnRpZmljPGJyPgogICAgICAgICAgwqBh
dGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4K
ICAgICAgICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQy
OTAwMDI7ZGVsZXRlZDoKICAgICAgICAgIDI7NDtDTj1DZXJ0aWZpY2E8YnI+CiAgICAgICAgICDC
oHRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+
CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgbnNjcGVudHJ5d3Np
OiBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFz
czogcGVyc29uPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogb3JnYW5p
emF0aW9uYWxQZXJzb248YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBp
bmV0T3JnUGVyc29uPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21z
dXNlcjxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVt
LE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJy
PgogICAgICAgICAgbnNjcGVudHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgICAgIG5z
Y3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB
Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICAgICAmbHQ7c25pcCZndDs8
YnI+CiAgICAgICAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4
bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRp
ZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAgICAgICAgIE1JSURiakNDQWxh
Z0F3SUJBZ0k8YnI+CiAgICAgICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgICDCoEFSPGJy
PgogICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+
CiAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJzdGF0ZTogMTxicj4KICAgICAgICAgIG5zY3Bl
bnRyeXdzaTogdXNlcnR5cGU6IGFnZW50VHlwZTxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTog
cGFyZW50aWQ6IDI8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IGVudHJ5aWQ6IDUxPGJyPgog
ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAx
MDZAcmVkaGF0LmNvbSI+CiAgICAgICAgICAgIGFuZDxicj4KICAgICAgICAgICAgW3Jvb3RAc2Vh
dHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAg
ICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50
cnl3c2k8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+CiAgICAgICAg
ICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9y
eQogICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj
YSBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAg
ICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4KICAgICAgICAg
IG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAg
ICAgICAgICBuc2NwZW50cnl3c2k6IHNlZUFsc286IENOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NL
Uzxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAg
IE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAg
ICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pO
VDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgIG5zY3Bl
bnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgQXV0aG9y
aXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnM8YnI+CiAgICAgICAgICDCoHlzdGVtLE89QlBULlJP
Q0tTPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAgICAgICAg
IG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG1v
ZGlmeVRpbWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3Np
OiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgIG5zY3BlbnRy
eXdzaTogbW9kaWZpZXJzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgICAgICBu
c2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAg
ICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgICAg
ICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3Np
OiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxi
cj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNlcjxicj4KICAgICAgICAgIG5z
Y3BlbnRyeXdzaTogc246IHBraWRidXNlcjxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlk
OiBwa2lkYnVzZXI8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8
YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICAg
ICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxicj4K
ICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGluZXRPcmdQZXJzb248YnI+CiAg
ICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1c2VyPGJyPgogICAgICAgICAg
bnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRk
ODA3NDxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogZW50cnl1c246IDg2PGJyPgogICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVk
aGF0LmNvbSI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgRnJvbSB0aGUgb3V0cHV0IHlv
dSBtYXkgb25seSBjb3B5L3Bhc3QgdGhlIG9uZXMgcmVsYXRlZCB0bwogICAgICAgICAgICB1c2Vy
Q2VydGlmaWNhdGU8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICBBbHNvIHRvIGR1bXAgdGhlIGN1cnJlbnQgcmVwbGljYXRpb24gc3RhdHVzLCBzZW5kIHRo
ZQogICAgICAgICAgICByZXN1bHTCoCBvZjxicj4KICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1z
ZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgIG1h
bmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250IHNpemU9Ii0xIj48aT4gPC9pPiIoJmFtcDsob2Jq
ZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm
ZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAg
ICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJl
Y3RvcnkKICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNs
YXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZm
ZmZmZmZmKSkiPGJyPgogICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAg
ICAgZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8
YnI+CiAgICAgICAgICBjbjogcmVwbGljYTxicj4KICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+
CiAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAg
ICAgICAgIGNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9jPGJyPgogICAgICAgICAg
wqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICAgICAgbnNEUzVS
ZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgICAgICBtYXN0ZXJBZ3Jl
ZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvYzxicj4KICAgICAgICAgIMKga3MtcGtpLXRvbWNhdCxv
dT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgIG5zRFM1UmVwbGljYUlkOiAxMDY1PGJy
PgogICAgICAgICAgbnNEUzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3OTExZTYtOTNlNmVmNGIt
NjlkY2MyZDE8YnI+CiAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAg
ICAgICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgICAgICAgIG5zU3RhdGU6OgogICAgICAg
ICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFB
PT08YnI+CiAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24K
ICAgICAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAg
ICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwY2hl
Y2tpbnRlcnZhbDogNjA8YnI+CiAgICAgICAgICBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAg
ICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgIG9iamVjdENsYXNzOiBl
eHRlbnNpYmxlb2JqZWN0PGJyPgogICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRp
b259IDU3YzI5MWQ5MDAwMDA0MjkwMDAwPGJyPgogICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGlj
YSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgY2xhc3M9Im1vei10
eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJw
dC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAg
ICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICAgICAgICDCoDAgNTk4YTFjNDAwMDAxMDQy
OTAwMDA8YnI+CiAgICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgbW96LWRvLW5v
dC1zZW5kPSJ0cnVlIgogICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0Igog
ICAgICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8v
c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn08YnI+CiAgICAgICAgICBuc2RzNWFnbXRtYXhj
c246CiAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9j
a3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgICAgICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1
bmF2YWlsYWJsZTxicj4KICAgICAgICAgIG5zZHM1YWdtdG1heGNzbjoKICAgICAgICAgIG89aXBh
Y2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8
YnI+CiAgICAgICAgICDCoHRsZW5mcy5icHQucm9ja3M7Mzg5O3VuYXZhaWxhYmxlPGJyPgogICAg
ICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAg
ICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIK
ICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPjxhIGNs
YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQu
cm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT48L2E+fQogICAg
ICAgICAgNTk4YTxicj4KICAgICAgICAgIMKgMWMxNjxicj4KICAgICAgICAgIG5zcnV2UmVwbGlj
YUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICBtb3otZG8tbm90LXNl
bmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgIGhyZWY9
ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmst
ZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9z
ZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgIDAwMDAwPGJyPgogICAg
ICAgICAgwqAwMDA8YnI+CiAgICAgICAgICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogODg1PGJy
PgogICAgICAgICAgbnNkczVyZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20i
Pjxmb250CiAgICAgICAgICAgICAgc2l6ZT0iLTEiPiBhbmQ8YnI+CiAgICAgICAgICAgIDwvZm9u
dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAg
J2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+
IDwvaT4iKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZm
LWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAgICAgICA8L2ZvbnQ+PC9i
bG9ja3F1b3RlPgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgW3Jvb3RA
c2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAg
ICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0
b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJy
PgogICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgZG46IGNuPXJl
cGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAg
ICBjbjogcmVwbGljYTxicj4KICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgICAgICBu
c0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgICAgIGNsb25l
QWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2NrPGJyPgogICAgICAgICAgwqBzLXBraS10b21j
YXQsb3U9Y3N1c2Vycyxjbj1jb25maWc8YnI+CiAgICAgICAgICBuc0RTNVJlcGxpY2FJZDogMTI5
MDxicj4KICAgICAgICAgIG5zRFM1UmVwbGljYU5hbWU6IDg3MDZhYjFlLTZhODMxMWU2LWE5YmZk
YmJmLTc0ZGM3MzIzPGJyPgogICAgICAgICAgbnNEUzVSZXBsaWNhUm9vdDogbz1pcGFjYTxicj4K
ICAgICAgICAgIG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICAgICAgICBuc1N0YXRlOjoKICAg
ICAgICAgIENnVUFBQUFBQUFBS0ZZcFpBQUFBQUFBQUFBQUFBQUFBS2dBQUFBQUFBQUFCQUFBQUFB
QUFBQT09PGJyPgogICAgICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0
aW9uCiAgICAgICAgICBtYW5hZ2Vycyxjbj1zeXNhY2NvdW50cyxjbj1ldGMsZGM9YnB0LDxicj4K
ICAgICAgICAgIMKgZGM9cm9ja3M8YnI+CiAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91
cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgICAgb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAg
ICAgICAgIG9iamVjdENsYXNzOiBuc0RTNVJlcGxpY2E8YnI+CiAgICAgICAgICBvYmplY3RDbGFz
czogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2FnZW5l
cmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYwMDAwMDxicj4KICAgICAgICAgIG5zZHM1MHJ1djoge3Jl
cGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgIGNsYXNzPSJt
b3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZz
LmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAg
ICAgICAgNTdiZTgwNGMwMDAwMDUwYTAwMDA8YnI+CiAgICAgICAgICDCoCA1ODcyMzYxNTAwMDAw
NTBhMDAwMDxicj4KICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTA2NSA8YSBtb3otZG8t
bm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQi
CiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFw
Oi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICA1N2IxMDNkNDAwMDAw
NDI5MDAwPGJyPgogICAgICAgICAgwqAwIDU3YmU4MDQzMDAwNzA0MjkwMDAwPGJyPgogICAgICAg
ICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAgICAgbz1pcGFjYTtjbG9uZUFncmVlbWVudDEtc2Vh
dHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdDtmcmVlaTxicj4KICAgICAgICAgIMKgcGEtc2Vh
LmJwdC5yb2NrczszODk7MTA2NTs1ODcyMzYxNTAwMDAwNTBhMDAwMDxicj4KICAgICAgICAgIG5z
cnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICBtb3ot
ZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAg
ICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPjxhIGNsYXNzPSJtb3ot
dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODki
PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgIDAwMDAw
PGJyPgogICAgICAgICAgwqAwMDA8YnI+CiAgICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZp
ZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBj
bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJl
ZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg
aHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNl
YS5icHQucm9ja3M6Mzg5PC9hPjwvYT59CiAgICAgICAgICAwMDAwPGJyPgogICAgICAgICAgwqAw
MDAwPGJyPgogICAgICAgICAgbnNkczVSZXBsaWNhQ2hhbmdlQ291bnQ6IDM8YnI+CiAgICAgICAg
ICBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICAgICAgPGJsb2NrcXVvdGUgdHlw
ZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAg
ICAgICAgICAgICBzaXplPSItMSI+IDxicj4KICAgICAgICAgICAgICBSZWdhcmRzPGJyPgogICAg
ICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICAgIDwvZm9udD4KICAgICAgICAgICAgPGJs
b2NrcXVvdGUKICAgICAgICAgICAgICBjaXRlPSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAt
NWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAg
ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0j
CiAgICAgICAgICAgICAgICBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2Vy
JyAtVyAtYgogICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1
c2VyQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAg
ICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgIGRuOiB1aWQ9
cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAgIHVzZXJDZXJ0
aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtp
Rzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgIMKgICZsdDt0cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgICAgICAgIMKgIFpO
bzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAg
ICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3
SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRSwogICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgJmx0O3RydW5jYXRlZCZndDsgZnVRUVptUDFYcktr
cmZzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgIGRlc2NyaXB0aW9uOiAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWNhdGUKICAgICAgICAg
ICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0gPGJyPgogICAgICAg
ICAgICAgICAgwqAgLE89QlBULlJPQ0tTIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxk
YXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgICAgICBtYW5hZ2VyJyAt
VyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICB1c2Vy
Q2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgRW50ZXIgTERBUCBQ
YXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl
LG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAg
ICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VB
WURWUVFLREFsQwogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgwqAgJmx0O3Ry
dW5jYXRlZCZndDsgPGJyPgogICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1
TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICBkZXNjcmlwdGlv
bjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9D
S1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPIDxicj4KICAgICAgICAgICAgICAgIMKgIENLUyA8
YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl
PSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlIGNlcnRpZmljYXRlcwogICAgICAgICAgICAgICAgICBk
YXRlcywgSSBndWVzcyB0aGF0IHRoZSBtb3N0IHJlY2VudCBvbmUgaXMgb24gc2VydmVyCiAgICAg
ICAgICAgICAgICAgIHNlYXR0bGVuZnMgKGJlY2F1c2Ugb2Ygc2VyaWFsIG51bWJlcnMpLiBDYW4g
eW91CiAgICAgICAgICAgICAgICAgIGNvbmZpcm0gdGhpcyAoYmVjYXVzZSBvdXIgZ29hbCBpcyB0
byBoYXZlIHRoZSBtb3N0CiAgICAgICAgICAgICAgICAgIHJlY2VudCBjZXJ0IHN0b3JlZCBpbiBh
bGwgdGhlIE5TU0RCcyBhbmQgaW4gTERBUCk/IDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICBUaGFua3MsIDxicj4KICAgICAgICAgICAgICAgICAgRmxvIDxicj4K
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiPklmIHlvdXIgcmVuZXdhbCBtYXN0ZXIgaXMKICAgICAgICAgICAg
ICAgICAgICAgIHRoZSBtYWNoaW5lIG9uIHdoaWNoIHRoZSBOU1MgREIKICAgICAgICAgICAgICAg
ICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgY29udGFpbnMgdGhlIG5ld2VyIGNlcnQs
CiAgICAgICAgICAgICAgICAgICAgICB0aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZSBzY3Jp
cHRzOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBJZiBJJ20gaW50ZXJwcmV0aW5nIHRoaXMg
Y29ycmVjdGx5LCB0aGVuIGl0IGlzLi4uIHNvCiAgICAgICAgICAgICAgICAgICAgSSByYW4gdGhp
cyBvbiB0aGUgYnJva2VuIG1hY2hpbmUgKHNlYXR0bGVuZnMpIDxicj4KICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBz
dWRvCiAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3Rv
cF9wa2ljYWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgJCBzdWRvIC91c3IvbGliZXhlYy9p
cGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAgICAic3Vic3lz
dGVtQ2VydCBjZXJ0LXBraS1jYSIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgSSByYW4gdGhpcywgaXQgdG9vayBhIHdoaWxlLCB0aGVuIEkgcmUt
Y2hlY2tlZCBhbmQKICAgICAgICAgICAgICAgICAgICB0aGUgc2VyaWFsIHN0aWxsIHNlZW1zIHRv
IGJlIDQgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAk
IGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAg
ICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNh
dGUKICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgIGRuOiB1aWQ9
cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAgICAgICB1c2Vy
Q2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRB
TkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgIMKg
IFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAg
ICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAg
ICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJP
Q0tTIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSGVy
ZSdzIHdoYXQgd2FzIGluIC92YXIvbG9nL3BraS9wa2ktdG9tY2F0L2NhL2RlYnVnCiAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg
ICAgICAgICAgICAgICAgPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0gPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICA9PT09PcKgIERFQlVHIFNVQlNZ
U1RFTSBJTklUSUFMSVpFRMKgwqAgPT09PT09PSA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09IDxicj4K
ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9T
aHV0ZG93bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdp
bmU6IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAgICAgICAgL3Zh
ci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1bWIgPGJyPgogICAgICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQg
Zm9yIGF1dG8tc2h1dGRvd24KICAgICAgICAgICAgICAgICAgICBzdXBwb3J0OmF1ZGl0U2lnbmlu
Z0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox
Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNF
bmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0IGlkPWRlYnVnIDxi
cj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0aWFsaXplZCBk
ZWJ1ZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdFN1
YnN5c3RlbSBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdp
bmU6IHJlYWR5IHRvIGluaXQgaWQ9bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
ICAgQ3JlYXRpbmcKICAgICAgICAgICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9w
a2kvcGtpLXRvbWNhdC9sb2dzL2NhL3NpZ25lZEF1ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcKICAgICAg
ICAgICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dz
L2NhL3N5c3RlbSkKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg
ICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zh
ci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS90cmFuc2FjdGlvbnMpCiAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j
YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlc3Rh
cnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg
ICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAg
ICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0ZG93bi5jcnVtYiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQgdG8gbG9v
ayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgICAgICAgIHN1cHBvcnQ6
YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgIENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh
IDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z
dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQg
aWQ9bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0
aWFsaXplZCBsb2cgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6
IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg
Q01TRW5naW5lOiByZWFkeSB0byBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg
ICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4K
ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1
bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0
L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
ICAgQ01TRW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNodXRkb3duCiAg
ICAgICAgICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxi
cj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1
ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
ICAgICBDTVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgICAgICAg
IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg
ICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGpzcyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAg
ICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdFN1YnN5c3RlbSBpZD1kYnMgPGJyPgogICAg
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9ZGJz
IDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z
dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgREJTdWJzeXN0ZW06IGluaXQoKSBt
RW5hYmxlU2VyaWFsTWdtdD10cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg
Q3JlYXRpbmcgTGRhcEJvdW5kQ29ubkZhY3RvcihEQlN1YnN5c3RlbSkgPGJyPgogICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3J5OmRvQ2xvbmluZyB0
cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs
aG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBpbml0
KCkgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBMZGFwQXV0aEluZm86IGluaXQg
YmVnaW5zIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBp
bml0IGVuZHMgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b
bG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogaW5pdDoKICAgICAgICAgICAgICAgICAgICBiZWZvcmUg
bWFrZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg
ICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVlIDxicj4KICAgICAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06IFRDUAogICAgICAgICAgICAgICAgICAgIEtlZXAtQWxpdmU6IHRydWUgPGJyPgogICAgICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBT
ZXR0aW5nIGRlc2lyZWQKICAgICAgICAgICAgICAgICAgICBjZXJ0IG5pY2tuYW1lIHRvOiBzdWJz
eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg
TGRhcEpzc1NTTFNvY2tldDogc2V0IGNsaWVudCBhdXRoIGNlcnQgbmlja25hbWUKICAgICAgICAg
ICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg
ICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRlcmluZyEg
PGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogb2NzcFNp
Z25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg
Q2FuZGlkYXRlIGNlcnQ6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBkZXNp
cmVkIGNlcnQgZm91bmQKICAgICAgICAgICAgICAgICAgICBpbiBsaXN0OiBzdWJzeXN0ZW1DZXJ0
IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6
NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgU1NMQ2xpZW50
Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJuaW5nOgogICAgICAgICAgICAgICAgICAgIHN1
YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogU1NMCiAgICAgICAgICAgICAg
ICAgICAgaGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
ICAgQ01TRW5naW5lLnNodXRkb3duKCkgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSSByZWFsbHkgYXBwcmVj
aWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoCiAgICAgICAgICAgICAgICAgICAgdGhp
cy7CoCBJIG93ZSB5b3UuIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgLSBJYW4gPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5BZnRlciB0aGF0LCBjaGVjayB0aGF0IHRo
ZQogICAgICAgICAgICAgICAgICAgICAgTERBUCBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBp
dCBpcyB0aGUgY2FzZSwKICAgICAgICAgICAgICAgICAgICAgIHlvdSBzaG91bGQgYmUgYWJsZSB0
byByZXN0YXJ0IHBraS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoYW5rIHlvdSBhZ2FpbiBmb3Ig
eW91cgogICAgICAgICAgICAgICAgICAgICAgICB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSWFuIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl
PSJjaXRlIj5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hpY2ggc2VlbXMg
d2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoZSBkZXNjcmlwdGlvbgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdHRyaWJ1dGUgaW4gdGhlIGxkYXBzZWFyY2gg
b3V0cHV0IGlzIG9mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBmb3JtIDI7IztE
TjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRoZSBzZXJpYWwgbnVtYmVyIGlu
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBmaXJzdCBjZXJ0dXRpbCBvdXRwdXQg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5ECiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGhlYWRlcnMpIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGF0dHJpYnV0
ZXMuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICBfX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICAgICAgICBGcmVl
SVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgICAgICAgICBjbGFzcz0ibW96
LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJl
ZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICAgICAgICBtb3ot
ZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhy
ZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEt
dXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48L2E+CiAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICBUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhCiAgICAg
ICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAg
ICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3Rl
ZC5vcmciCiAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9
Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVh
dmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRv
cmFob3N0ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX18gPGJyPgogICAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGlu
ZyBsaXN0IC0tIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlh
dGVkIgogICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVk
b3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEg
Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNl
cnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0
ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgVG8gdW5zdWJz
Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQt
bGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVz
ZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICBtb3otZG8t
bm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9
Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVp
cGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48L2E+CiAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAg
ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAg
IDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAg
ICAgICA8YnI+CiAgICAgICAgICA8cHJlIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEg
Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNl
cnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBh
LXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4g
ZW1haWwgdG8gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRv
OmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1z
ZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+
CjwvcHJlPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8YnI+CiAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0
dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPHByZSB3cmFwPSIi
Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZyZWVJUEEt
dXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi
IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVp
cGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJzY3JpYmUgc2VuZCBh
biBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWls
dG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5mcmVlaXBhLXVz
ZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgPC9ibG9ja3F1
b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo=
--===============0674695975783376051==--
From ianh at brownpapertickets.com Thu Aug 10 18:37:51 2017
Content-Type: multipart/mixed; boundary="===============5746937532678446188=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Thu, 10 Aug 2017 11:37:15 -0700
Message-ID: <7fc23432-e339-9b75-b9a6-ae4628f784e2@brownpapertickets.com>
In-Reply-To: 598C2B4F.2000202@redhat.com
--===============5746937532678446188==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 8/10/17 2:45 AM, thierry bordaz wrote:
>
>
> On 08/09/2017 09:30 PM, Ian Harding via FreeIPA-users wrote:
>>
>> On 8/9/17 3:05 AM, thierry bordaz wrote:
>>
>>> Hi Ian,
>>>
>>> Thanks for having gather those data.
>>>
>>> #
>>> # So pkidbuser entries have a same (old) userCertificate likely
>>> generated during install
>>> # But only freeipa-sea has a new one created on freeipa-sea
>>> around Jun 8th 2017 05:54:16
>>> # This recent certificate is identified by 5938e688000104290000
>>> #
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory
>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> ...
>>> nscpentrywsi: userCertificate::
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000::
>>> MIIDbjCCAlagAwIBAgI
>>>
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory
>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>> nscpentrywsi: userCertificate::
>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>
>>>
>>>
>>> #
>>> # why 5938e688000104290000 value was not propagated to seattlenfs ?
>>> # The most recent update (from freeipa-sea) that was replicated
>>> to seattlenfs
>>> # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07).
>>> # In addition seattlenfs received direct update (last one was in
>>> Jan 1017) that were not
>>> # replicated to freeipa-sea
>>> #
>>> # The two servers have diverged because they can not replicate
>>> to eachother because
>>> # they were not correctly initialize.
>>> # They have different "replicageneration" (57c291d9000004290000
>>> vs 55c8f3ae000000600000)
>>> #
>>> # It is looking like freeipa-sea was created one or two years
>>> ago and used to initialized seattlenfs.
>>> # But later freeipa-sea was recreated.
>>>
>> That's about right.
>>>
>>> #
>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory
>>> manager' -W -b "o=3Dipaca"
>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffff=
fff-ffffffff))"
>>> Enter LDAP Password:
>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>> nsds50ruv: {replicageneration} 57c291d9000004290000
>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
>>> 57f840bf000004290000 598a1c40000104290000
>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>>> nsruvReplicaLastModified: {replica 1065
>>> ldap://freeipa-sea.bpt.rocks:389} 598a1c16
>>> nsruvReplicaLastModified: {replica 1290
>>> ldap://seattlenfs.bpt.rocks:389} 00000000
>>>
>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory
>>> manager' -W -b "o=3Dipaca"
>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffff=
fff-ffffffff))"
>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389}
>>> 57b103d4000004290000 57be8043000704290000
>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>>> 57be804c0000050a0000 587236150000050a0000
>>> nsruvReplicaLastModified: {replica 1290
>>> ldap://seattlenfs.bpt.rocks:389} 00000000
>>> nsruvReplicaLastModified: {replica 1065
>>> ldap://freeipa-sea.bpt.rocks:389} 00000000
>>>
>>>
>>>
>>> In conclusion:
>>> From replication pov, the two instances can not communicate.
>>> One solution would be to identify which instance is the good =
>>> one, you want to keep.
>>> and reinit the second one from that reference.
>>>
>> What exactly does reinit mean? I have run
>>
>> ipa-replica-manage re-initialize --from freeipa-sea.bpt.rocks
>
> This triggers the reinit of 'dc=3Dipadomain,dc=3Dcom' suffix but not for =
> o=3Dipaca suffix. To reinit o=3Dipaca you may use
> ipa-cs-replica-manager re-initialize --from freeipa-sea.bpt.rocks.
> Note that it will overwrite all data of ipaca on seattlenfs with the =
> data from freeipa-sea. This is why it is important to know which =
> server is the valid one.
Hmm.. This looks odd.
[root(a)seattlenfs ianh]# ipa-csreplica-manage re-initialize --from =
freeipa-sea.bpt.rocks
Directory Manager password:
ipa: ERROR: Found multiple agreements for seattlenfs.bpt.rocks. Only =
initializing the first one returned: =
cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\=
=3Dipaca,cn=3Dmapping =
tree,cn=3Dconfig
Update in progress, 15 seconds elapsed
[freeipa-sea.bpt.rocks] reports: Update failed! Status: [32 - LDAP =
error: No such object]
> On freeipa-sea and seattlenfs you may check the ipaca replica =
> agreements status before/after reinit. I would guess they are =
> currently reporting failures between these two replicas.
>
> ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
> "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
>
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
"cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
"objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
Enter LDAP Password:
dn: =
cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3=
Dipac
a,cn=3Dmapping tree,cn=3Dconfig
nsds5replicaLastUpdateStatus: Error (32) Problem connecting to replica - =
LDAP
error: No such object (connection error)
dn: =
cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3=
Dipac
a,cn=3Dmapping tree,cn=3Dconfig
nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
replica:
Replica has different database generation ID, remote replica may need =
to be i
nitialized (RUV error)
and
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
"cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
"objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
Enter LDAP Password:
dn: =
cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3D=
ipaca
,cn=3Dmapping tree,cn=3Dconfig
nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
replica:
Replica has different database generation ID, remote replica may need =
to be i
nitialized (RUV error)
>>
>> several times over the years when replication has stopped.
>>
>> Replication actually is working, as far as user and machine accounts =
>> and attributes are concerned anyway, and has been for a while.
>>
>> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid =
>> of... it shows up in the GUI on the Topology page but generates a =
>> Server not found error. I don't know if that's related.
>
> Zombie servers have been discussed a lot on this mailing list. You may =
> get rid of them with list-ruv/clean-ruv subcommand. Replication =
> usually manage to work fine even if some zombie entries exist but it =
> is a good practice to clean them.
Yeah, I've been through every possible combination of =
list-ruv/clean-ruv. I have something odd going on in that no =
replication agreements show up anywhere for freeipa-dal.
>
> regards
> thierry
>>>
>>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote:
>>>>
>>>> On 8/7/17 1:44 AM, thierry bordaz wrote:
>>>>
>>>>>
>>>>>
>>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote:
>>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>>>>>
>>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users =
>>>>>>>>>>>>>>>>>> wrote:
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that =
>>>>>>>>>>>>>>>>>>>>> had apparently had
>>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl =
>>>>>>>>>>>>>>>>>>>>> says pki-tomcatd
>>>>>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat =
>>>>>>>>>>>>>>>>>>>> can run without
>>>>>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see =
>>>>>>>>>>>>>>>>>>>> what is going on.
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication =
>>>>>>>>>>>>>>>>>>> failed (49)
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server =
>>>>>>>>>>>>>>>>>> and needs to
>>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how =
>>>>>>>>>>>>>>>>>> this
>>>>>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl
>>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind =
>>>>>>>>>>>>>>>>>> DN and
>>>>>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,=
o=3Dipaca =
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>>>>>> ...
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a =
>>>>>>>>>>>>>>>>> prompt to provide
>>>>>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for =
>>>>>>>>>>>>>>>>> security token 'ldap(0)':
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>>>>>>> password can be
>>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf =
>>>>>>>>>>>>>>>> (with the tag
>>>>>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... =
>>>>>>>>>>>>>>>> allows to read
>>>>>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>> (provide password)
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> That works...
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot =
>>>>>>>>>>>>>>> "NSS User Private
>>>>>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>>>>>>>>>>> caSigningCert
>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f =
>>>>>>>>>>>>>>> Server-Cert
>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> But this doesn't (with the same password from =
>>>>>>>>>>>>>>> password.conf)
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> That password is getting me somewhere though, since if I =
>>>>>>>>>>>>>>> put in a
>>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and =
>>>>>>>>>>>>>>> over.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>>>>>
>>>>>>>>>>>>> There wasn't much of a change... I just assumed someone =
>>>>>>>>>>>>> ran yum upgrade and didn't restart, then the power =
>>>>>>>>>>>>> outage... it looks like not much of a version change though.
>>>>>>>>>>>>>
>>>>>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>> Jan 08 04:46:08 Installed: =
>>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>>>>>> Jul 28 09:55:41 Updated: =
>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:46 Updated: =
>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>
>>>>>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>>>>>> Jan 08 04:47:19 Installed: =
>>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>>>>>
>>>>>>>>>>>>> # getenforce
>>>>>>>>>>>>> Enforcing
>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> If so can you run:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use =
>>>>>>>>>>>>> the write_logs option.
>>>>>>>>>>>>> The NOLOG option is overriding the write_logs current =
>>>>>>>>>>>>> setting.
>>>>>>>>>>>>> ----
>>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): =
>>>>>>>>>>>>> arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-13 =
>>>>>>>>>>>>> a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0 items=3D0 =
>>>>>>>>>>>>> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 =
>>>>>>>>>>>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 =
>>>>>>>>>>>>> sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D4294967295 =
>>>>>>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { =
>>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" =
>>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 =
>>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and =
>>>>>>>>>>>>>> everything wasn't
>>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>>>>>> upgrade it just
>>>>>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Can you run these commands:
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descri=
ption
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> This returns
>>>>>>>>>>>>>
>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descrip=
tion
>>>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>>>> ... stuff ...
>>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>>>> description: 2;4;CN=3DCertificate =
>>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>>>
>>>>>>>>>>>>>> and
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert
>>>>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> These both return
>>>>>>>>>>>>>
>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>> certutil: problem listing keys: =
>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS =
>>>>>>>>>>>>> User Private Key and Certificate Services"
>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>> certutil: problem listing keys: =
>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.
>>>>>>>>>>>>>
>>>>>>>>>>>> Hi,
>>>>>>>>>>>>
>>>>>>>>>>>> you made a typo and requested the keys (-K) instead of the =
>>>>>>>>>>>> certs (-L). Please retry with -L and you should be able to =
>>>>>>>>>>>> see the certificate serial.
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca =
>>>>>>>>>>> userCertificate description
>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>> ...
>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D=
CA =
>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>
>>>>>>>>>>> So the serial is 4?
>>>>>>>>>>>
>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>>>> grep Serial
>>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>>>
>>>>>>>>>>> Which is NOT 4...
>>>>>>>>>>>
>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAl=
C =
>>>>>>>>>>>
>>>>>>>>>>> ...
>>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>>>>> -----END CERTIFICATE-----
>>>>>>>>>>>
>>>>>>>>>>> And this cert is NOT the same.
>>>>>>>>>>>
>>>>>>>>>> Hi,
>>>>>>>>>>
>>>>>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>>>>>> post-save commands (which you can see in the output of =
>>>>>>>>>> getcert list). In your case, the post-save command for =
>>>>>>>>>> subsystemCert cert-pki-ca probably failed.
>>>>>>>>>>
>>>>>>>>>> This command (on the renewal master) is responsible for =
>>>>>>>>>> copying the new cert from the NSS db to the LDAP server. You =
>>>>>>>>>> need first to check which IPA server is the renewal master =
>>>>>>>>>> (as the serial numbers are in a completely different range, I =
>>>>>>>>>> assume that you have multiple IPA servers configured with a =
>>>>>>>>>> CA instance):
>>>>>>>>>>
>>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D =
>>>>>>>>>> -f2-`
>>>>>>>>>> $ kinit admin
>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>>> dn: =
>>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=
=3Detc,dc=3Dipadomain,dc=3Dcom =
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> I get this
>>>>>>>>>
>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>> dn: =
>>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc=
,dc=3Dbpt,dc=3Drocks =
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Which is the other FreeIPA server.
>>>>>>>>>
>>>>>>>> Hi Ian,
>>>>>>>>
>>>>>>>> it's getting difficult to follow this thread, so could we step =
>>>>>>>> back and summarize?
>>>>>>> Yes, it is. Sorry.
>>>>>>>>
>>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 =
>>>>>>>> in the NSSDB /etc/pki/pki-tomcat/alias
>>>>>>> No?
>>>>>>>
>>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d =
>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep =
>>>>>>> Serial
>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has =
>>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>>>>>> Yes
>>>>>>>
>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias =
>>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial
>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>
>>>>>>>>
>>>>>>>> - In the LDAP servers, the cert is stored in the entry =
>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. i=
t =
>>>>>>>> is the cert from freeipa-sea).
>>>>>>> This is where the difference is. There are two certificates on =
>>>>>>> the master and only one on the other. I wonder if this is a =
>>>>>>> result of the slow motion replication trainwreck I have going on =
>>>>>>> due to a zombie replica in the ldap database that no longer =
>>>>>>> exists in the real world and I can't seem to get rid of.
>>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> the remaining issue is a replication problem. There is a =
>>>>>> "Troubleshooting replication" section [1] in IdM Admin guide that =
>>>>>> may help you.
>>>>>>
>>>>>> Regarding your zombie replica, which commands did you use to try =
>>>>>> to remove it, and what was the output?
>>>>>>
>>>>>> Flo
>>>>>>
>>>>>> [1] =
>>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Lin=
ux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen=
-replication.html
>>>>>>
>>>>>
>>>>> Hi,
>>>>>
>>>>> To debug replication latency or problem we would need several info =
>>>>> but starting with the results of the following commands
>>>>>
>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> nscpentrywsi: =
>>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
>>>> 75274897
>>>> nscpentrywsi: =
>>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
>>>> 90004: 20170608055334Z
>>>> nscpentrywsi: =
>>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
>>>> 003: cn=3DDirectory Manager
>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>>> nscpentrywsi: cn: pkidbuser
>>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>>> nscpentrywsi: description;vucsn-5938e688000104290001: =
>>>> 2;1341718541;CN=3DCertific
>>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
>>>> 2;4;CN=3DCertifica
>>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>> nscpentrywsi: mail:
>>>> nscpentrywsi: objectClass: top
>>>> nscpentrywsi: objectClass: person
>>>> nscpentrywsi: objectClass: organizationalPerson
>>>> nscpentrywsi: objectClass: inetOrgPerson
>>>> nscpentrywsi: objectClass: cmsuser
>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>> nscpentrywsi: sn: pkidbuser
>>>> nscpentrywsi: uid: pkidbuser
>>>> nscpentrywsi: userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>>
>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
>>>> MIIDbjCCAlagAwIBAgI
>>>>
>>>> AR
>>>> nscpentrywsi: userPassword::
>>>> nscpentrywsi: userstate: 1
>>>> nscpentrywsi: usertype: agentType
>>>> nscpentrywsi: parentid: 2
>>>> nscpentrywsi: entryid: 51
>>>>> and
>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>>
>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>> Enter LDAP Password:
>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>> nscpentrywsi: userCertificate:: =
>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>>
>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>> nscpentrywsi: description: 2;4;CN=3DCertificate =
>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs
>>>> ystem,O=3DBPT.ROCKS
>>>> nscpentrywsi: entryid: 51
>>>> nscpentrywsi: parentid: 2
>>>> nscpentrywsi: modifyTimestamp: 20150716125146Z
>>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager
>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>>> nscpentrywsi: userPassword::
>>>> nscpentrywsi: userstate: 1
>>>> nscpentrywsi: usertype: agentType
>>>> nscpentrywsi: mail:
>>>> nscpentrywsi: cn: pkidbuser
>>>> nscpentrywsi: sn: pkidbuser
>>>> nscpentrywsi: uid: pkidbuser
>>>> nscpentrywsi: objectClass: top
>>>> nscpentrywsi: objectClass: person
>>>> nscpentrywsi: objectClass: organizationalPerson
>>>> nscpentrywsi: objectClass: inetOrgPerson
>>>> nscpentrywsi: objectClass: cmsuser
>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>>> nscpentrywsi: entryusn: 86
>>>>>
>>>>> From the output you may only copy/past the ones related to =
>>>>> userCertificate
>>>>>
>>>>>
>>>>> Also to dump the current replication status, send the result of
>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>> -W -b =
>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fff=
fffff-ffffffff-ffffffff))"
>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b "o=3Dipaca" =
>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff=
-ffffffff))"
>>>> Enter LDAP Password:
>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>>> cn: replica
>>>> nsDS5Flags: 1
>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>> cloneAgreement1-freeipa-sea.bpt.roc
>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>> masterAgreement1-seattlenfs.bpt.roc
>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>> nsDS5ReplicaId: 1065
>>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
>>>> nsDS5ReplicaRoot: o=3Dipaca
>>>> nsDS5ReplicaType: 3
>>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
>>>> nsds5replicabinddngroup: cn=3Dreplication =
>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>>> dc=3Drocks
>>>> nsds5replicabinddngroupcheckinterval: 60
>>>> objectClass: top
>>>> objectClass: nsDS5Replica
>>>> objectClass: extensibleobject
>>>> nsds50ruv: {replicageneration} 57c291d9000004290000
>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>>> 57f840bf00000429000
>>>> 0 598a1c40000104290000
>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>>>> nsds5agmtmaxcsn: =
>>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
>>>> tlenfs.bpt.rocks;389;unavailable
>>>> nsds5agmtmaxcsn: =
>>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
>>>> tlenfs.bpt.rocks;389;unavailable
>>>> nsruvReplicaLastModified: {replica 1065 =
>>>> ldap://freeipa-sea.bpt.rocks:389} 598a
>>>> 1c16
>>>> nsruvReplicaLastModified: {replica 1290 =
>>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>>> 000
>>>> nsds5ReplicaChangeCount: 885
>>>> nsds5replicareapactive: 0
>>>>> and
>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>>> -W -b =
>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fff=
fffff-ffffffff-ffffffff))"
>>>>
>>>>
>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>> -W -b "o=3Dipaca" =
>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff=
-ffffffff))"
>>>> Enter LDAP Password:
>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>>> cn: replica
>>>> nsDS5Flags: 1
>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>> cloneAgreement1-seattlenfs.bpt.rock
>>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>> nsDS5ReplicaId: 1290
>>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
>>>> nsDS5ReplicaRoot: o=3Dipaca
>>>> nsDS5ReplicaType: 3
>>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D
>>>> nsds5replicabinddngroup: cn=3Dreplication =
>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>>> dc=3Drocks
>>>> nsds5replicabinddngroupcheckinterval: 60
>>>> objectClass: top
>>>> objectClass: nsDS5Replica
>>>> objectClass: extensibleobject
>>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
>>>> 57be804c0000050a0000
>>>> 587236150000050a0000
>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>>> 57b103d400000429000
>>>> 0 57be8043000704290000
>>>> nsds5agmtmaxcsn: =
>>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
>>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000
>>>> nsruvReplicaLastModified: {replica 1290 =
>>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>>> 000
>>>> nsruvReplicaLastModified: {replica 1065 =
>>>> ldap://freeipa-sea.bpt.rocks:389} 0000
>>>> 0000
>>>> nsds5ReplicaChangeCount: 3
>>>> nsds5replicareapactive: 0
>>>>>
>>>>> Regards
>>>>> thierry
>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificat=
e =
>>>>>>> description
>>>>>>> Enter LDAP Password:
>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>> userCertificate:: =
>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>
>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>> userCertificate:: =
>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>> description: 2;1341718541;CN=3DCertificate =
>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem
>>>>>>> ,O=3DBPT.ROCKS
>>>>>>>
>>>>>>>
>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificat=
e =
>>>>>>> description
>>>>>>> Enter LDAP Password:
>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>> userCertificate:: =
>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>
>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>> Subsystem,O=3DBPT.RO
>>>>>>> CKS
>>>>>>>
>>>>>>>> If you check the certificates dates, I guess that the most =
>>>>>>>> recent one is on server seattlenfs (because of serial numbers). =
>>>>>>>> Can you confirm this (because our goal is to have the most =
>>>>>>>> recent cert stored in all the NSSDBs and in LDAP)?
>>>>>>>>
>>>>>>>> Thanks,
>>>>>>>> Flo
>>>>>>>>
>>>>>>>>
>>>>>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you =
>>>>>>>>>> can manually run the scripts:
>>>>>>>>>
>>>>>>>>> If I'm interpreting this correctly, then it is... so I ran =
>>>>>>>>> this on the broken machine (seattlenfs)
>>>>>>>>>
>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert =
>>>>>>>>>> "subsystemCert cert-pki-ca"
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> I ran this, it took a while, then I re-checked and the serial =
>>>>>>>>> still seems to be 4
>>>>>>>>>
>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>> Enter LDAP Password:
>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>> userCertificate:: =
>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>> ...
>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>
>>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>>>>>
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D D=
EBUG =
>>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> restart at autoShutdown? false
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>>>> init id=3Ddebug
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> initialized debug
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> initSubsystem id=3Dlog
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> ready to init id=3Dlog
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_aud=
it) =
>>>>>>>>>
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> restart at autoShutdown? false
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>>>> init id=3Dlog
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> initialized log
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> initSubsystem id=3Djss
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> ready to init id=3Djss
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> restart at autoShutdown? false
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done =
>>>>>>>>> init id=3Djss
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> initialized jss
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> initSubsystem id=3Ddbs
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>> ready to init id=3Ddbs
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: =
>>>>>>>>> init() mEnableSerialMgmt=3Dtrue
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> LdapBoundConnFactory: init
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> LdapBoundConnFactory:doCloning true
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>> init()
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>> init begins
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>> init ends
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>>>>>> makeConnection errorIfDown is true
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: =
>>>>>>>>> errorIfDown true
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: =
>>>>>>>>> true
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname =
>>>>>>>>> to: subsystemCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> LdapJssSSLSocket: set client auth cert nickname subsystemCert =
>>>>>>>>> cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>>>>> ocspSigningCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: =
>>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert =
>>>>>>>>> cert-pki-ca
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake =
>>>>>>>>> happened
>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>> CMSEngine.shutdown()
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> I really appreciate you sticking with me through this. I owe =
>>>>>>>>> you.
>>>>>>>>>
>>>>>>>>> - Ian
>>>>>>>>>
>>>>>>>>>> After that, check that the LDAP entry has been updated. If it =
>>>>>>>>>> is the case, you should be able to restart pki.
>>>>>>>>>>
>>>>>>>>>> Flo
>>>>>>>>>>
>>>>>>>>>>> Thank you again for your time!
>>>>>>>>>>>
>>>>>>>>>>> Ian
>>>>>>>>>>>
>>>>>>>>>>>> Flo.
>>>>>>>>>>>>>
>>>>>>>>>>>>> which seems weird.
>>>>>>>>>>>>>
>>>>>>>>>>>>>> The description attribute in the ldapsearch output is of =
>>>>>>>>>>>>>> the form 2;#;DN;DN
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> The # should match the serial number in the first =
>>>>>>>>>>>>>> certutil output
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match =
>>>>>>>>>>>>>> one of the
>>>>>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> rob
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>>>> To unsubscribe send an email to =
>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>>> To unsubscribe send an email to =
>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahoste=
d.org
>>>
>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.=
org
>
--===============5746937532678446188==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl
bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9
IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPHA+T24gOC8xMC8xNyAyOjQ1IEFNLCB0aGll
cnJ5IGJvcmRheiB3cm90ZTo8YnI+CiAgICA8L3A+CiAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
IiBjaXRlPSJtaWQ6NTk4QzJCNEYuMjAwMDIwMkByZWRoYXQuY29tIj4KICAgICAgPG1ldGEgY29u
dGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IiBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUi
PgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4
Ij5PbiAwOC8wOS8yMDE3IDA5OjMwIFBNLCBJYW4gSGFyZGluZwogICAgICAgIHZpYSBGcmVlSVBB
LXVzZXJzIHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3RlCiAgICAgICAg
Y2l0ZT0ibWlkOmZlNTI1OWYzLWFlNGEtODM4OS01NDI1LTliODRiMTFiNzFkNUBicm93bnBhcGVy
dGlja2V0cy5jb20iCiAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgPG1ldGEgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7CiAgICAgICAgICBjaGFyc2V0PXV0
Zi04Ij4KICAgICAgICA8cD5PbiA4LzkvMTcgMzowNSBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6
PGJyPgogICAgICAgIDwvcD4KICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJt
aWQ6NTk4QURFN0YuMzA4MDMwOEByZWRoYXQuY29tIj4KICAgICAgICAgIDxtZXRhIGNvbnRlbnQ9
InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIKICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29udGVu
dC1UeXBlIj4KICAgICAgICAgIEhpIElhbiw8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBU
aGFua3MgZm9yIGhhdmluZyBnYXRoZXIgdGhvc2UgZGF0YS4gPGJyPgogICAgICAgICAgPHR0Pjxi
cj4KICAgICAgICAgIDwvdHQ+CiAgICAgICAgICA8YmxvY2txdW90ZT48dHQ+IzwvdHQ+PGJyPgog
ICAgICAgICAgICA8dHQ+IyBTbyBwa2lkYnVzZXIgZW50cmllcyBoYXZlIGEgc2FtZSAob2xkKSB1
c2VyQ2VydGlmaWNhdGUKICAgICAgICAgICAgICBsaWtlbHkgZ2VuZXJhdGVkIGR1cmluZyBpbnN0
YWxsPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4jIEJ1dCBvbmx5IGZyZWVpcGEtc2VhIGhhcyBh
IG5ldyBvbmUgY3JlYXRlZCBvbgogICAgICAgICAgICAgIGZyZWVpcGEtc2VhIGFyb3VuZCBKdW4g
OHRoIDIwMTcgMDU6NTQ6MTY8L3R0Pjxicj4KICAgICAgICAgICAgPHR0PiMgVGhpcyByZWNlbnQg
Y2VydGlmaWNhdGUgaXMgaWRlbnRpZmllZCBieQogICAgICAgICAgICAgIDU5MzhlNjg4MDAwMTA0
MjkwMDAwIDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IzwvdHQ+PGJyPgogICAgICAgICAgICA8
dHQ+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRAogICAgICAgICAg
ICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAidWlkPXBraWRi
dXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVudHJ5d3NpPC90dD48YnI+CiAgICAgICAgICAg
IDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAgICAg
ICAgICA8dHQ+Li4uPC90dD48YnI+CiAgICAgICAgICAgIDx0dD5uc2NwZW50cnl3c2k6IHVzZXJD
ZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhr
aUc5dzBCQVFzRkFEQTBNUgogICAgICAgICAgICAgICZsdDtzbmlwJmd0OzwvdHQ+PGJyPgogICAg
ICAgICAgICA8dHQ+bnNjcGVudHJ5d3NpOgogICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTt2
dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMDo6CiAgICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJ
QkFnSSAmbHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8
dHQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3Rv
cnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv
PWlwYWNhCiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpPC90dD48YnI+CiAgICAgICAgICAgIDx0
dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAgICAgICAg
ICA8dHQ+bnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgIE1JSURj
ekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVIKICAgICAgICAgICAgICAm
bHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPHR0PiM8L3R0Pjxicj4KICAgICAgICAgICAgPHR0
PiMgd2h5IDU5MzhlNjg4MDAwMTA0MjkwMDAwIHZhbHVlIHdhcyBub3QgcHJvcGFnYXRlZCB0bwog
ICAgICAgICAgICAgIHNlYXR0bGVuZnMgPzwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBUaGUg
bW9zdCByZWNlbnQgdXBkYXRlIChmcm9tIGZyZWVpcGEtc2VhKSB0aGF0IHdhcwogICAgICAgICAg
ICAgIHJlcGxpY2F0ZWQgdG8gc2VhdHRsZW5mczwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBp
c8KgIDEgeWVhciBvbGQgKDU3YmU4MDQzMDAwNzA0MjkwMDAwIC0gQXVnIDI1dGggMjAxNgogICAg
ICAgICAgICAgIDA1OjIxOjA3KS48L3R0Pjxicj4KICAgICAgICAgICAgPHR0PiMgSW4gYWRkaXRp
b24gc2VhdHRsZW5mcyByZWNlaXZlZCBkaXJlY3QgdXBkYXRlIChsYXN0CiAgICAgICAgICAgICAg
b25lIHdhcyBpbiBKYW4gMTAxNykgdGhhdCB3ZXJlIG5vdDwvdHQ+PGJyPgogICAgICAgICAgICA8
dHQ+IyByZXBsaWNhdGVkIHRvIGZyZWVpcGEtc2VhPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4j
IDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBUaGUgdHdvIHNlcnZlcnMgaGF2ZSBkaXZlcmdl
ZCBiZWNhdXNlIHRoZXkgY2FuIG5vdAogICAgICAgICAgICAgIHJlcGxpY2F0ZSB0byBlYWNob3Ro
ZXIgYmVjYXVzZTwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyB0aGV5IHdlcmUgbm90IGNvcnJl
Y3RseSBpbml0aWFsaXplLjwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBUaGV5IGhhdmUgZGlm
ZmVyZW50ICJyZXBsaWNhZ2VuZXJhdGlvbiIKICAgICAgICAgICAgICAoNTdjMjkxZDkwMDAwMDQy
OTAwMDAgdnMgNTVjOGYzYWUwMDAwMDA2MDAwMDApPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4j
PC90dD48YnI+CiAgICAgICAgICAgIDx0dD4jIEl0IGlzIGxvb2tpbmcgbGlrZSBmcmVlaXBhLXNl
YSB3YXMgY3JlYXRlZCBvbmUgb3IgdHdvCiAgICAgICAgICAgICAgeWVhcnMgYWdvIGFuZCB1c2Vk
IHRvIGluaXRpYWxpemVkIHNlYXR0bGVuZnMuPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4jIEJ1
dCBsYXRlciBmcmVlaXBhLXNlYSB3YXMgcmVjcmVhdGVkLjwvdHQ+PGJyPgogICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8dHQ+VGhhdCdzIGFib3V0
IHJpZ2h0LjwvdHQ+PGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1p
ZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICAgICAgPGJsb2NrcXVvdGU+IDx0
dD4jPC90dD48YnI+CiAgICAgICAgICAgIDx0dD5bcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRh
cHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAt
YiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1m
ZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAg
ICA8dHQ+RW50ZXIgTERBUCBQYXNzd29yZDo8L3R0Pjxicj4KICAgICAgICAgICAgPHR0PmRuOiBj
bj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPC90dD48YnI+
CiAgICAgICAgICAgIDx0dD5uc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkw
MDAwMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2Eg
MTA2NSA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAg
ICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAg
ICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0
LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgNTdmODQwYmYwMDAwMDQyOTAwMDAgNTk4YTFj
NDAwMDAxMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxp
Y2EgMTI5MCA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIK
ICAgICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAg
ICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9zZWF0dGxlbmZzLmJw
dC5yb2NrczozODk8L2E+fTwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFz
dE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4
dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh
LmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxk
YXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICA1OThhMWMx
NjwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVw
bGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0
IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIK
ICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMu
YnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjxicj4KICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICA8dHQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNl
YXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAi
bz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZm
ZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAgICA8
dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8
L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1
NWM4ZjNhZTAwMDAwMDYwMDAwMDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7
cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0
ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2Nrczoz
ODkiCiAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBh
LXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICA1N2IxMDNkNDAwMDAwNDI5MDAw
MCA1N2JlODA0MzAwMDcwNDI5MDAwMDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNkczUwcnV2
OiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZy
ZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tz
OjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0
bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59wqAKICAgICAgICAgICAgICA1N2JlODA0YzAwMDAwNTBh
MDAwMCA1ODcyMzYxNTAwMDAwNTBhMDAwMDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNydXZS
ZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFz
cz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3Nl
YXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0i
dHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAg
MDAwMDAwMDA8L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmll
ZDoge3JlcGxpY2EgMTA2NSA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1m
cmVldGV4dCIKICAgICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j
a3M6Mzg5IgogICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwOi8vZnJl
ZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjwv
YmxvY2txdW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIEluIGNv
bmNsdXNpb246PGJyPgogICAgICAgICAgwqDCoMKgIEZyb20gcmVwbGljYXRpb24gcG92LCB0aGUg
dHdvIGluc3RhbmNlcyBjYW4gbm90CiAgICAgICAgICBjb21tdW5pY2F0ZS48YnI+CiAgICAgICAg
ICDCoMKgwqAgT25lIHNvbHV0aW9uIHdvdWxkIGJlIHRvIGlkZW50aWZ5IHdoaWNoIGluc3RhbmNl
IGlzIHRoZQogICAgICAgICAgZ29vZCBvbmUsIHlvdSB3YW50IHRvIGtlZXAuPGJyPgogICAgICAg
ICAgwqDCoMKgIGFuZCByZWluaXQgdGhlIHNlY29uZCBvbmUgZnJvbSB0aGF0IHJlZmVyZW5jZS48
YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIFdoYXQgZXhh
Y3RseSBkb2VzIHJlaW5pdCBtZWFuP8KgIEkgaGF2ZSBydW48YnI+CiAgICAgICAgPGJyPgogICAg
ICAgIGlwYS1yZXBsaWNhLW1hbmFnZSByZS1pbml0aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5i
cHQucm9ja3M8YnI+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICBUaGlzIHRy
aWdnZXJzIHRoZSByZWluaXQgb2YgJ2RjPWlwYWRvbWFpbixkYz1jb20nIHN1ZmZpeCBidXQgbm90
CiAgICAgIGZvciBvPWlwYWNhIHN1ZmZpeC4gVG8gcmVpbml0IG89aXBhY2EgeW91IG1heSB1c2U8
YnI+CiAgICAgIGlwYS1jcy1yZXBsaWNhLW1hbmFnZXIgcmUtaW5pdGlhbGl6ZSAtLWZyb20gZnJl
ZWlwYS1zZWEuYnB0LnJvY2tzLjxicj4KICAgICAgTm90ZSB0aGF0IGl0IHdpbGwgb3ZlcndyaXRl
IGFsbCBkYXRhIG9mIGlwYWNhIG9uIHNlYXR0bGVuZnMgd2l0aAogICAgICB0aGUgZGF0YSBmcm9t
IGZyZWVpcGEtc2VhLiBUaGlzIGlzIHdoeSBpdCBpcyBpbXBvcnRhbnQgdG8ga25vdwogICAgICB3
aGljaCBzZXJ2ZXIgaXMgdGhlIHZhbGlkIG9uZS48YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8
YnI+CiAgICBIbW0uLiBUaGlzIGxvb2tzIG9kZC48YnI+CiAgICA8YnI+CiAgICBbcm9vdEBzZWF0
dGxlbmZzIGlhbmhdIyBpcGEtY3NyZXBsaWNhLW1hbmFnZSByZS1pbml0aWFsaXplIC0tZnJvbQog
ICAgZnJlZWlwYS1zZWEuYnB0LnJvY2tzPGJyPgogICAgRGlyZWN0b3J5IE1hbmFnZXIgcGFzc3dv
cmQ6IDxicj4KICAgIDxicj4KICAgIGlwYTogRVJST1I6IEZvdW5kIG11bHRpcGxlIGFncmVlbWVu
dHMgZm9yIHNlYXR0bGVuZnMuYnB0LnJvY2tzLiBPbmx5CiAgICBpbml0aWFsaXppbmcgdGhlIGZp
cnN0IG9uZSByZXR1cm5lZDoKY249Y2xvbmVBZ3JlZW1lbnQxLWZyZWVpcGEtc2VhLmJwdC5yb2Nr
cy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1w9aXBhY2EsY249bWFwcGluZwogICAgdHJlZSxj
bj1jb25maWc8YnI+CiAgICBVcGRhdGUgaW4gcHJvZ3Jlc3MsIDE1IHNlY29uZHMgZWxhcHNlZDxi
cj4KICAgIFtmcmVlaXBhLXNlYS5icHQucm9ja3NdIHJlcG9ydHM6IFVwZGF0ZSBmYWlsZWQhIFN0
YXR1czogWzMywqAgLSBMREFQCiAgICBlcnJvcjogTm8gc3VjaCBvYmplY3RdPGJyPgogICAgPGJy
PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJA
cmVkaGF0LmNvbSI+IE9uCiAgICAgIGZyZWVpcGEtc2VhIGFuZCBzZWF0dGxlbmZzIHlvdSBtYXkg
Y2hlY2sgdGhlIGlwYWNhIHJlcGxpY2EKICAgICAgYWdyZWVtZW50cyBzdGF0dXMgYmVmb3JlL2Fm
dGVyIHJlaW5pdC4gSSB3b3VsZCBndWVzcyB0aGV5IGFyZQogICAgICBjdXJyZW50bHkgcmVwb3J0
aW5nIGZhaWx1cmVzIGJldHdlZW4gdGhlc2UgdHdvIHJlcGxpY2FzLjxicj4KICAgICAgPGJyPgog
ICAgICA8dHQ+bGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIg
IjwvdHQ+PHR0PmNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcKICAgICAgICB0cmVl
LGNuPWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAgICAg
ICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgICA8YnI+CiAgICAgIDwv
dHQ+PC9ibG9ja3F1b3RlPgogICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2Vh
cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICBtYW5hZ2VyJyAtVyAtYiAiY249cmVwbGlj
YSxjbj1vXDNEaXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZyIKICAgICAgIm9iamVjdENs
YXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAgICAgIG5zZHM1cmVwbGljYUxhc3RVcGRh
dGVTdGF0dXM8YnI+CiAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgZG46CmNu
PWNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBs
aWNhLGNuPW9cM0RpcGFjPGJyPgogICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxi
cj4KICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czogRXJyb3IgKDMyKSBQcm9ibGVt
IGNvbm5lY3RpbmcgdG8KICAgICAgcmVwbGljYSAtIExEQVAgPGJyPgogICAgICDCoGVycm9yOiBO
byBzdWNoIG9iamVjdCAoY29ubmVjdGlvbiBlcnJvcik8YnI+CiAgICAgIDxicj4KICAgICAgZG46
CmNuPW1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1y
ZXBsaWNhLGNuPW9cM0RpcGFjPGJyPgogICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZp
Zzxicj4KICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBs
aWNhdGlvbiBlcnJvcgogICAgICBhY3F1aXJpbmcgcmVwbGljYTogPGJyPgogICAgICDCoFJlcGxp
Y2EgaGFzIGRpZmZlcmVudCBkYXRhYmFzZSBnZW5lcmF0aW9uIElELCByZW1vdGUgcmVwbGljYSBt
YXkKICAgICAgbmVlZCB0byBiZSBpPGJyPgogICAgICDCoG5pdGlhbGl6ZWQgKFJVViBlcnJvcik8
YnI+CiAgICAgIDxicj4KICAgICAgYW5kPGJyPgogICAgICA8YnI+CiAgICAgIFtyb290QHNlYXR0
bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInCiAg
ICAgIC1XIC1iICJjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29u
ZmlnIgogICAgICAib2JqZWN0Q2xhc3M9bnNkczVyZXBsaWNhdGlvbmFncmVlbWVudCIKICAgICAg
bnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgRW50ZXIgTERBUCBQYXNzd29y
ZDogPGJyPgogICAgICBkbjoKY249Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tz
LXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhY2E8YnI+CiAgICAgIMKgLGNuPW1hcHBp
bmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgIG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM6
IEVycm9yICgxOSkgUmVwbGljYXRpb24gZXJyb3IKICAgICAgYWNxdWlyaW5nIHJlcGxpY2E6IDxi
cj4KICAgICAgwqBSZXBsaWNhIGhhcyBkaWZmZXJlbnQgZGF0YWJhc2UgZ2VuZXJhdGlvbiBJRCwg
cmVtb3RlIHJlcGxpY2EgbWF5CiAgICAgIG5lZWQgdG8gYmUgaTxicj4KICAgICAgwqBuaXRpYWxp
emVkIChSVVYgZXJyb3IpPGJyPgogICAgICA8YnI+CiAgICA8L3R0Pjxicj4KICAgIDxibG9ja3F1
b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThDMkI0Ri4yMDAwMjAyQHJlZGhhdC5jb20iPjx0
dD4KICAgICAgPC90dD4KICAgICAgPGJsb2NrcXVvdGUKICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5
ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAg
ICAgICB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgIHNldmVyYWwgdGltZXMgb3ZlciB0aGUgeWVh
cnMgd2hlbiByZXBsaWNhdGlvbiBoYXMgc3RvcHBlZC7CoCA8YnI+CiAgICAgICAgPGJyPgogICAg
ICAgIFJlcGxpY2F0aW9uIGFjdHVhbGx5IGlzIHdvcmtpbmcsIGFzIGZhciBhcyB1c2VyIGFuZCBt
YWNoaW5lCiAgICAgICAgYWNjb3VudHMgYW5kIGF0dHJpYnV0ZXMgYXJlIGNvbmNlcm5lZCBhbnl3
YXksIGFuZCBoYXMgYmVlbiBmb3IgYQogICAgICAgIHdoaWxlLjxicj4KICAgICAgICA8YnI+CiAg
ICAgICAgVGhlcmUgaXMgYSB6b21iaWUgc2VydmVyIGZyZWVpcGEtZGFsLmJwdC5yb2NrcyB0aGF0
IEkgY2FuJ3QgZ2V0CiAgICAgICAgcmlkIG9mLi4uIGl0IHNob3dzIHVwIGluIHRoZSBHVUkgb24g
dGhlIFRvcG9sb2d5IHBhZ2UgYnV0CiAgICAgICAgZ2VuZXJhdGVzIGEgU2VydmVyIG5vdCBmb3Vu
ZCBlcnJvci7CoCBJIGRvbid0IGtub3cgaWYgdGhhdCdzCiAgICAgICAgcmVsYXRlZC48YnI+CiAg
ICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICBab21iaWUgc2VydmVycyBoYXZlIGJl
ZW4gZGlzY3Vzc2VkIGEgbG90IG9uIHRoaXMgbWFpbGluZyBsaXN0LiBZb3UKICAgICAgbWF5IGdl
dCByaWQgb2YgdGhlbSB3aXRoIGxpc3QtcnV2L2NsZWFuLXJ1diBzdWJjb21tYW5kLgogICAgICBS
ZXBsaWNhdGlvbiB1c3VhbGx5IG1hbmFnZSB0byB3b3JrIGZpbmUgZXZlbiBpZiBzb21lIHpvbWJp
ZQogICAgICBlbnRyaWVzIGV4aXN0IGJ1dCBpdCBpcyBhIGdvb2QgcHJhY3RpY2UgdG8gY2xlYW4g
dGhlbS48YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICBZZWFoLCBJJ3ZlIGJlZW4gdGhyb3VnaCBl
dmVyeSBwb3NzaWJsZSBjb21iaW5hdGlvbiBvZgogICAgbGlzdC1ydXYvY2xlYW4tcnV2LsKgIEkg
aGF2ZSBzb21ldGhpbmcgb2RkIGdvaW5nIG9uIGluIHRoYXQgbm8KICAgIHJlcGxpY2F0aW9uIGFn
cmVlbWVudHMgc2hvdyB1cCBhbnl3aGVyZSBmb3IgZnJlZWlwYS1kYWwuPGJyPgogICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJAcmVkaGF0LmNvbSI+
IDxicj4KICAgICAgcmVnYXJkczxicj4KICAgICAgdGhpZXJyeTxicj4KICAgICAgPGJsb2NrcXVv
dGUKICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3MWQ1
QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgICB0eXBlPSJjaXRlIj4KICAgICAgICA8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk4QURFN0YuMzA4MDMwOEByZWRoYXQuY29t
Ij4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+
T24gMDgvMDgvMjAxNyAxMDozMyBQTSwgSWFuCiAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJ
UEEtdXNlcnMgd3JvdGU6PGJyPgogICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8YmxvY2txdW90
ZQogICAgICAgICAgICBjaXRlPSJtaWQ6MmY2MGM0YWYtNjgwYy00MzgyLTk3MDQtNDFhMjRjODEy
MWEyQGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAg
ICAgICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1s
OwogICAgICAgICAgICAgIGNoYXJzZXQ9dXRmLTgiPgogICAgICAgICAgICA8cD5PbiA4LzcvMTcg
MTo0NCBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6PGJyPgogICAgICAgICAgICA8L3A+CiAgICAg
ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgY2l0ZT0ibWlkOjU5
ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+CiAgICAgICAgICAgICAgPG1ldGEgY29udGVudD0i
dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IgogICAgICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29u
dGVudC1UeXBlIj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcvMjAxNyAwOToyMiBB
TSwKICAgICAgICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQQS11c2Vy
cyB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJsb2NrcXVv
dGUKICAgICAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFh
OWI5MjUyYzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0
LzIwMTcgMTE6MDIgUE0sIElhbiBIYXJkaW5nIHZpYQogICAgICAgICAgICAgICAgRnJlZUlQQS11
c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+
T24gOC80LzE3IDI6MTYgQU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1
ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDxi
bG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6MTMgUE0sIElhbgogICAgICAg
ICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAg
ICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4
IEFNLAogICAgICAgICAgICAgICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8w
Mi8yMDE3IDExOjUxIFBNLAogICAgICAgICAgICAgICAgICAgICAgICBJYW4gSGFyZGluZyB2aWEg
RnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2tx
dW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDEyOjExIEFNLAogICAgICAgICAgICAgICAg
ICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMDE6NDMK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgv
MDEvMjAxNyAxMjowMwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQTSwgUm9iIENyaXR0
ZW5kZW4gd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv
dGUgdHlwZT0iY2l0ZSI+SWFuIEhhcmRpbmcgd3JvdGU6CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3Rl
IHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDA3OjM5IEFNLCBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDAzOjExIFBNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5P
bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDA4LzAxLzIwMTcgMDE6NDgg
QU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQmxhbmMt
UmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDA4LzAxLzIwMTcgMDE6MzIgQU0sIElhbiBIYXJkaW5nCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i
Y2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPbiAwNy8zMS8yMDE3
IDExOjM0IEFNLCBSb2IKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Q3JpdHRlbmRlbiB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JYW4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBIYXJkaW5nIHZpYSBGcmVlSVBBLXVzZXJzCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij5JCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoYWQgYW4g
dW5leHBlY3RlZCByZXN0YXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBvZiBhbiBJUEEgc2VydmVyIHRoYXQgaGFkCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBhcHBhcmVudGx5IGhhZCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1cGRhdGVzIHJ1biBidXQgaGFkIG5vdAog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmVlbiByZXN0YXJ0
ZWQuIGlwYWN0bAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
c2F5cyBwa2ktdG9tY2F0ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICB3b3VsZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBub3Qgc3RhcnQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIFN0cmFuZ2VseSwgdGhlIGFjdHVhbAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgc2VydmljZSBhcHBlYXJzIHRvIGJlCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nOiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBkb2d0YWcgaXMgYW4gYXBwbGljYXRpb24KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3aXRoaW4gdG9tY2F0IHNvIHRvbWNhdCBj
YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW4gd2l0aG91
dCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFn
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5n
LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdlIG5lZWQgdG8gc2Vl
IG1vcmUgb2YgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ZG9ndGFnIGRlYnVnIGxvZyB0byBzZWUgd2hhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGlzIGdvaW5nIG9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
SXQgbG9va3MgbGlrZSBhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBhdXRoZW50aWNhdGlvbiBwcm9ibGVtLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgPGJyPgpbMjgvSnVsLzIwMTc6MTA6MDg6NDddW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06IFNTTCBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBDb3VsZCBub3QgY29ubmVjdCB0byBMREFQCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciBob3N0CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlYXR0bGVuZnMuYnB0LnJvY2tzIHBv
cnQgNjM2CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRXJyb3IKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbmV0c2NhcGUubGRhcC5MREFQRXhjZXB0aW9u
OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRoZW50aWNhdGlv
biBmYWlsZWQgKDQ5KSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBkb2d0YWcgc3RvcmVzIGl0cyBpbnRlcm5hbCBkYXRhCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbiB0aGUgTERBUCBzZXJ2ZXIgYW5kIG5lZWRz
IHRvCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlc3RhYmxpc2ggYSBzZWN1cmUgTERBUAog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29ubmVjdGlvbi4gWW91IGNh
biBjaGVjayBob3cKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoaXMg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29ubmVjdGlvbiBp
cyBjb25maWd1cmVkIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAv
ZXRjL3BraS9wa2ktdG9tY2F0L2NhL0NTLmNmZywKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGxvb2sgZm9yIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHRoZSBsaW5lczogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVudEF1dGgg
PGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj1jbj1EaXJlY3RvcnkgTWFuYWdlciA8YnI+
CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5h
bGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNh
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIu
bGRhcGNvbm4uaG9zdD12bS0uLi4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFs
ZGIubGRhcGNvbm4ucG9ydD02MzYgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5zZWN1cmVDb25uIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGF1dGh0eXBlIGNhbiBiZSBTc2xDbGllbnRBdXRoCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0aGVudGljYXRpb24gd2l0aCBhIHNzbCA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSkg
b3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0
aGVudGljYXRpb24gd2l0aCBhIGJpbmQgRE4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBwYXNzd29yZCBzdG9yZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZikuCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBZb3UgY2FuIHVzZSB0aGlzIGluZm9ybWF0aW9uIHRvCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBtYW51YWxseSBjaGVjayB0aGUgY3JlZGVudGlhbHMuCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGb3IgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW5zdGFuY2Ugd2l0aCBzc2xjbGllbnRhdXRo
OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBleHBvcnQKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNfQ0FDRVJURElSPS9ldGMvcGtpL3BraS10
b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTERBUFRMU19DRVJUPSdzdWJzeXN0ZW1DZXJ0
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0
ZXh0IgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJsZGFw
czovLyIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5v
dC1zZW5kPSJ0cnVlIj5sZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIgLXMgYmFzZSAtWSBFWFRFUk5BTCA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlkZSB0aGUgcGFzc3dv
cmQgZnJvbQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kv
cGtpLXRvbWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczogPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlw
ZT1Tc2xDbGllbnRBdXRoIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49dWlkPXBraWRi
dXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJv
bXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFt
ZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KaW50ZXJuYWxkYi5sZGFwY29ubi5jbG9u
ZVJlcGxpY2F0aW9uUG9ydD0zODkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFuZCB3aGVuIEkgdHJ5IHRo
ZSBsZGFwc2VhcmNoIEkgYW0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBw
cmVzZW50ZWQgd2l0aCBhIHByb21wdCB0byBwcm92aWRlCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGEgcGluL3Bhc3N3b3JkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVy
IHBpbiwgcGFzc3dvcmQsIG9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
cGFzcyBwaHJhc2UgZm9yIHNlY3VyaXR5IHRva2VuCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgJ2xkYXAoMCknOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJ1dCB0
aGVyZSBpcyBubyBwYXNzd29yZCBmaWxlLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwv
YmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICB5b3UgYXJlIHJpZ2h0LCBpbiA0LjQuIHRoZXJlIGlzIG5vCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB3ZGZpbGUudHh0IGFuZCB0aGUgcGFz
c3dvcmQgY2FuIGJlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZm91bmQgaW4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29y
ZC5jb25mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICh3aXRoIHRoZSB0YWcg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4pIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSB0YWcgaW50ZXJuYWw9Li4u
IGFsbG93cyB0byByZWFkCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNT
IGRiPyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsIC1L
IC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21j
YXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlk
ZSBwYXNzd29yZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgVGhhdCB3b3Jrcy4uLiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj
L3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiIgaW4gc2xvdCAiTlNTIFVzZXIKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIFByaXZhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgS2V5IGFuZCBDZXJ0aWZpY2F0ZSBTZXJ2aWNlcyIgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgMCZndDsgcnNhCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdjYTUzNjdj
NTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKG9ycGhhbikgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAxJmd0OyByc2EKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4
NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1MgQ2Vy
dGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREI6YXVkaXRT
aWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAmbHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgODgx
YjcyNTRjNDBmYTQwYmM1MDY4MWJjYzhkMzdiYjNlYjQ5OTM3ZQogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgY2FTaWduaW5nQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAmbHQ7IDMmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmE5
YTI1NWExZDE1NTg1YWMyODA2NGMwZjQ5ODZlNDE2YmM0ODQwM8KgwqAKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBEQjpvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyA0Jmd0OyByc2EKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDNmYjYwOWQwZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3Zjdl
NWEwMWYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNlcnZlci1DZXJ0IDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgNSZndDsgcnNhCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAxZTk0NzlhOTU1NmFmOTMzOWJiNWU0NTUyY2NiZDM4MWQzYzM4
ODU2wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTlNTIENlcnRpZmljYXRl
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3RlbUNlcnQg
Y2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQnV0IHRoaXMgZG9lc24ndCAod2l0aCB0
aGUgc2FtZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFzc3dvcmQgZnJvbSBw
YXNzd29yZC5jb25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGxkYXBzZWFyY2ggLUggPGEKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVl
dGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8i
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1
ZSI+bGRhcHM6Ly88L2E+YGhvc3RuYW1lYDo2MzYKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkgdG9rZW4gJ2xk
YXAoMCknOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTQVNML0VYVEVS
TkFMIGF1dGhlbnRpY2F0aW9uIHN0YXJ0ZWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgbGRhcF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczogSW52YWxpZAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgY3JlZGVudGlhbHMgKDQ5KSA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29tZXdoZXJlCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICB0aG91Z2gsIHNpbmNlIGlmIEkgcHV0IGluIGEgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbm9uc2Vuc2Ugb3IgaW5jb3JyZWN0IHBhc3N3
b3JkIGl0IGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByb21wdHMgb3Zl
ciBhbmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmcm9tIHdoYXQgdG8gd2hhdD8gPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlcmUg
d2Fzbid0IG11Y2ggb2YgYSBjaGFuZ2UuLi4gSSBqdXN0CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGFzc3VtZWQgc29tZW9uZSByYW4geXVtIHVwZ3JhZGUgYW5kIGRpZG4ndAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICByZXN0YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2UuLi4g
aXQgbG9va3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGlrZSBub3QgbXVjaCBvZiBh
IHZlcnNpb24gY2hhbmdlIHRob3VnaC4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICMgZ3JlcCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaXBhLWNsaWVudC1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGxpYmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNyBVcGRhdGVkOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBweXRob24tbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQu
eDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA4IEluc3RhbGxlZDoKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgcHl0aG9uLWlwYWRkcmVzcy0xLjAuMTYtMi5lbDcubm9hcmNoIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3
LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxlZDoKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFjbGllbnQtNC40LjAtMTQuZWw3
LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1hZG1pbnRvb2xzLTQuNC4wLTE0LmVsNy5jZW50
b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50
b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2VydmVyLTQuNC4wLTE0LmVsNy5jZW50
b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBzc3NkLWlwYS0xLjE0LjAtNDMuZWw3XzMuNC54ODZfNjQgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTcgVXBkYXRlZDoK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC00LjQuMC0xNC5lbDcuY2Vu
dG9zLjEuMS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjMgVXBkYXRlZDoKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54
ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjQ3OjM2IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgaXBhLXB5dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgaXBhLXB5dGhvbi00LjIuMC0xNS4wLjEuZWw3LmNlbnRvcy4xOS54ODZfNjQKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
aXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQyIFVwZGF0ZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5u
b2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJj
aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgSnVsIDI4IDA5OjU1OjQ0IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IHB5dGhvbjItaXBhY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBK
dWwgMjggMDk6NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0
aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy
OCAwOTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtYWRt
aW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1
OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40
LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBpcGEtc2VydmVyLTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5v
YXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNo
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGdyZXAgcGtpIC92
YXIvbG9nL3l1bS5sb2cgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg
MDQ6NDY6MDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2Ut
MTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IEphbiAwOCAwNDo0NjowOSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBr
cmI1LXBraW5pdC0xLjE0LjEtMjcuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVwZGF0ZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTQuZWw3XzMueDg2XzY0
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIxIFVwZGF0
ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1zZXJ2ZXItMTAuMy4zLTE0LmVs
N18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0
NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMu
My0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4g
MDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWNh
LTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBKdWwgMjggMTA6MTM6MTYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
cGtpLWJhc2UtMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgcGtpLXRvb2xzLTEwLjMuMy0xOS5lbDdfMy54ODZfNjQgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MjEgVXBkYXRlZDoK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTkuZWw3XzMu
bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIx
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1rcmEtMTAuMy4zLTE5
LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx
MDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktY2EtMTAu
My4zLTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEFyZSB5b3UgcnVubmluZyBpbiBTRUxpbnV4IGVuZm9yY2luZwogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1vZGU/IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgZ2V0ZW5mb3JjZSA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEVuZm9yY2luZyA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv
dGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJZiBz
byBjYW4geW91IHJ1bjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBhdXNlYXJjaCAtbSBBVkMgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0aW9uIHRvIGxvZ19mb3JtYXQg
aXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVwcmVjYXRlZC4gUGxlYXNlIHVzZSB0
aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvcHRpb24uIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlIE5PTE9HIG9wdGlvbiBpcyBvdmVycmlk
aW5nIHRoZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3cml0ZV9sb2dzIGN1cnJlbnQg
c2V0dGluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLS0tIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGltZS0mZ3Q7TW9uIE1hciAxNCAxMDozOTowMSAy
MDE2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdHlwZT1TWVNDQUxMCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0yIHN1
Y2Nlc3M9bm8KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhpdD0tMTMgYTA9N2ZiY2Fi
MDM4ZDEwIGExPTgwMCBhMj0xCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEzPTdmYmNh
NjBmNDJlMCBpdGVtcz0wIHBwaWQ9MTQwNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBw
aWQ9MTI5NjUgYXVpZD00Mjk0OTY3Mjk1IHVpZD0wIGdpZD0wCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGV1aWQ9NTgxNDAwMDAxIHN1aWQ9MCBmc3VpZD01ODE0MDAwMDEKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgZWdpZD01ODE0MDAwMDEgc2dpZD0wIGZzZ2lkPTU4MTQwMDAw
MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0dHk9KG5vbmUpIHNlcz00Mjk0OTY3Mjk1
IGNvbW09InNzaGQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4ZT0iL3Vzci9zYmlu
L3NzaGQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN1Ymo9c3lzdGVtX3U6c3lzdGVt
X3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtl
eT0obnVsbCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPUFWQyBtc2c9
YXVkaXQoMTQ1Nzk3NzE0MS43Njc6MTc1MzcpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBhdmM6wqAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgY29tbT0ic3NoZCIgbmFtZT0iYXV0aG9yaXplZF9rZXlzIgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBkZXY9ImRtLTIiIGlubz0xMTYzOTM1MTcKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMw
OmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRjb250ZXh0PXN5c3RlbV91
Om9iamVjdF9yOnVubGFiZWxlZF90OnMwCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRj
bGFzcz1maWxlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkkgc3VzcGVjdCB0aGF0IHRoZQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHN1YnN5c3RlbSBjZXJ0IHdhcyByZW5ld2VkIGFuZAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGV2ZXJ5dGhpbmcgd2Fzbid0IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICB1cGRhdGVkIHByb3Blcmx5LiBJZiBJJ20gcmlnaHQgdGhp
cyBpcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVucmVsYXRlZCB0byB0aGUgdXBn
cmFkZSBpdCBqdXN0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBh
IHNwb3RsaWdodCBvbiBpdC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDYW4geW91IHJ1biB0aGVzZSBjb21t
YW5kczogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBh
Y2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUgZGVzY3Jp
cHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoaXMgcmV0dXJucyA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3
MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gc3R1ZmYgLi4uIDxicj4KWk5v
NGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+YW5kIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBjZXJ0
dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10
b21jYXQvYWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVt
Q2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwg
Z3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0
aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9t
Y2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNl
cnQgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBU
aGVzZSBib3RoIHJldHVybiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9w
a2ktdG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uICdzdWJzeXN0
ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8IGdyZXAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
U2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQg
b3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogcHJvYmxl
bSBsaXN0aW5nIGtleXM6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9V
TlJFQ09HTklaRURfT0lEOiBVbnJlY29nbml6ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhc8KgIC1uCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTIENlcnRpZmljYXRl
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCIiBpbiBzbG90ICJOU1MgVXNlciBQcml2
YXRlIEtleSBhbmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgU2Vy
dmljZXMiIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQg
b3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogcHJvYmxl
bSBsaXN0aW5nIGtleXM6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9V
TlJFQ09HTklaRURfT0lEOiBVbnJlY29nbml6ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBtYWRlIGEgdHlwbyBhbmQgcmVxdWVz
dGVkIHRoZSBrZXlzICgtSykKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGluc3RlYWQgb2Yg
dGhlIGNlcnRzICgtTCkuIFBsZWFzZSByZXRyeSB3aXRoCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAtTCBhbmQgeW91IHNob3VsZCBiZSBhYmxlIHRvIHNlZSB0aGUKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGNlcnRpZmljYXRlIHNlcmlhbC4gPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jv
b3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAg
ICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICAg
ICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAg
ICAgICAgICB1c2VyQ2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAg
ICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFR
S0RBbEMKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBaTm80ZVg3ak5UOEFhMjNn
RGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9CiAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlm
aWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049
Q0EKICAgICAgICAgICAgICAgICAgICAgICAgICBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBT
byB0aGUgc2VyaWFsIGlzIDQ/IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwg
LUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz
IC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2En
IHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDC
oMKgwqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MQogICAgICAgICAgICAgICAgICAgICAgICAg
ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5m
cyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3Br
aS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAtLS0t
LUJFR0lOIENFUlRJRklDQVRFLS0tLS0gPGJyPgpNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFO
QmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIHNqZWlGYlVGdG9N
bmZtSExJWXBlNVFBUiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgLS0tLS1FTkQgQ0VS
VElGSUNBVEUtLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgIEFuZCB0aGlzIGNlcnQgaXMgTk9UIHRoZSBzYW1lLiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Js
b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgd2hlbiBjZXJ0bW9uZ2VyIHJl
bmV3cyBhIGNlcnRpZmljYXRlLCBpdCBydW5zCiAgICAgICAgICAgICAgICAgICAgICAgIHByZS1z
YXZlIGFuZCBwb3N0LXNhdmUgY29tbWFuZHMgKHdoaWNoIHlvdSBjYW4KICAgICAgICAgICAgICAg
ICAgICAgICAgc2VlIGluIHRoZSBvdXRwdXQgb2YgZ2V0Y2VydCBsaXN0KS4gSW4geW91cgogICAg
ICAgICAgICAgICAgICAgICAgICBjYXNlLCB0aGUgcG9zdC1zYXZlIGNvbW1hbmQgZm9yIHN1YnN5
c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgcHJvYmFibHkgZmFp
bGVkLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgVGhpcyBjb21tYW5kIChvbiB0aGUgcmVuZXdhbCBtYXN0ZXIpIGlzCiAgICAgICAgICAg
ICAgICAgICAgICAgIHJlc3BvbnNpYmxlIGZvciBjb3B5aW5nIHRoZSBuZXcgY2VydCBmcm9tIHRo
ZQogICAgICAgICAgICAgICAgICAgICAgICBOU1MgZGIgdG8gdGhlIExEQVAgc2VydmVyLiBZb3Ug
bmVlZCBmaXJzdCB0bwogICAgICAgICAgICAgICAgICAgICAgICBjaGVjayB3aGljaCBJUEEgc2Vy
dmVyIGlzIHRoZSByZW5ld2FsIG1hc3RlciAoYXMKICAgICAgICAgICAgICAgICAgICAgICAgdGhl
IHNlcmlhbCBudW1iZXJzIGFyZSBpbiBhIGNvbXBsZXRlbHkgZGlmZmVyZW50CiAgICAgICAgICAg
ICAgICAgICAgICAgIHJhbmdlLCBJIGFzc3VtZSB0aGF0IHlvdSBoYXZlIG11bHRpcGxlIElQQQog
ICAgICAgICAgICAgICAgICAgICAgICBzZXJ2ZXJzIGNvbmZpZ3VyZWQgd2l0aCBhIENBIGluc3Rh
bmNlKTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICQgZXhwb3J0IEJBU0VETj1gZ3JlcCBiYXNlZG4KICAgICAgICAgICAgICAgICAgICAg
ICAgL2V0Yy9pcGEvZGVmYXVsdC5jb25mIHwgY3V0IC1kPSAtZjItYCA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICQga2luaXQgYWRtaW4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAk
IGxkYXBzZWFyY2ggLUxMTCAtUSAtaCBgaG9zdG5hbWVgIC1wIDM4OSAtWQogICAgICAgICAgICAg
ICAgICAgICAgICBHU1NBUEkgLWIgImNuPW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgog
ICAgICAgICAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FS
ZW5ld2FsTWFzdGVyKSknCiAgICAgICAgICAgICAgICAgICAgICAgIGRuIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgZG46CmNuPUNBLGNuPXZtLWlwYXNlcnZlci5pcGFkb21haW4uY29tLGNu
PW1hc3RlcnMsY249aXBhLGNuPWV0YyxkYz1pcGFkb21haW4sZGM9Y29tCiAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICBJbiB0aGlzIGV4YW1wbGUgdGhlIHJlbmV3YWwgbWFzdGVyIGlzCiAgICAgICAg
ICAgICAgICAgICAgICAgIHZtLWlwYXNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBJIGdldCB0aGlzIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAt
TExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICBHU1NB
UEkgLWIgImNuPW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICAg
ICAgICAgJygmYW1wOyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJwog
ICAgICAgICAgICAgICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46CiAg
ICAgICAgICAgICAgICAgICAgICBjbj1DQSxjbj1mcmVlaXBhLXNlYS5icHQucm9ja3MsY249bWFz
dGVycyxjbj1pcGEsY249ZXRjLGRjPWJwdCxkYz1yb2NrcwogICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgV2hp
Y2ggaXMgdGhlIG90aGVyIEZyZWVJUEEgc2VydmVyLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg
ICAgIEhpIElhbiwgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICBpdCdzIGdldHRpbmcgZGlmZmljdWx0IHRvIGZvbGxvdyB0aGlzIHRocmVhZCwgc28KICAg
ICAgICAgICAgICAgICAgICBjb3VsZCB3ZSBzdGVwIGJhY2sgYW5kIHN1bW1hcml6ZT8gPGJyPgog
ICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIFllcywgaXQg
aXMuwqAgU29ycnkuIDxicj4KICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0
ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJl
bmV3YWwgbWFzdGVyKSwgdGhlIENBCiAgICAgICAgICAgICAgICAgICAgY29tcG9uZW50IGlzIGlu
c3RhbGxlZCBhbmQgJ3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1j
YScgaGFzIFNlcmlhbCBudW1iZXIgNCBpbiB0aGUgTlNTREIKICAgICAgICAgICAgICAgICAgICAv
ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgICAgICAgICAgICBObz8gPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAog
ICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1D
ZXJ0CiAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAg
ICAgICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx
ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiPi0gT24gc2VydmVyIHNlYXR0bGVuZnMgKHdoZXJlCiAgICAgICAgICAgICAgICAgICAgUEtJ
IGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50IGlzIGluc3RhbGxlZAogICAgICAg
ICAgICAgICAgICAgIGFuZCAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgaGFzIFNlcmlhbCBu
dW1iZXIKICAgICAgICAgICAgICAgICAgICAxMzQxNzE4NTQxIGluIHRoZSBOU1NEQiAvZXRjL3Br
aS9wa2ktdG9tY2F0L2FsaWFzLiA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgWWVzIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAg
ICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAg
ICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAg
ICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRm
ZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAtIEluIHRoZSBM
REFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUKICAgICAgICAgICAgICAgICAg
ICBlbnRyeSB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHdpdGggU2VyaWFsCiAgICAg
ICAgICAgICAgICAgICAgbnVtYmVyIDQgKGkuZS4gaXQgaXMgdGhlIGNlcnQgZnJvbSBmcmVlaXBh
LXNlYSkuIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg
ICAgICBUaGlzIGlzIHdoZXJlIHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28KICAg
ICAgICAgICAgICAgICAgY2VydGlmaWNhdGVzIG9uIHRoZSBtYXN0ZXIgYW5kIG9ubHkgb25lIG9u
IHRoZSBvdGhlci7CoAogICAgICAgICAgICAgICAgICBJIHdvbmRlciBpZiB0aGlzIGlzIGEgcmVz
dWx0IG9mIHRoZSBzbG93IG1vdGlvbgogICAgICAgICAgICAgICAgICByZXBsaWNhdGlvbiB0cmFp
bndyZWNrIEkgaGF2ZSBnb2luZyBvbiBkdWUgdG8gYSB6b21iaWUKICAgICAgICAgICAgICAgICAg
cmVwbGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0IG5vIGxvbmdlciBleGlzdHMgaW4KICAg
ICAgICAgICAgICAgICAgdGhlIHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qgc2VlbSB0byBnZXQgcmlk
IG9mLiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICB0aGUgcmVtYWluaW5nIGlzc3VlIGlzIGEgcmVwbGljYXRpb24gcHJvYmxlbS4g
VGhlcmUgaXMgYQogICAgICAgICAgICAgICAgIlRyb3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIg
c2VjdGlvbiBbMV0gaW4gSWRNIEFkbWluCiAgICAgICAgICAgICAgICBndWlkZSB0aGF0IG1heSBo
ZWxwIHlvdS4gPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgUmVnYXJk
aW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1hbmRzIGRpZCB5b3UKICAgICAgICAg
ICAgICAgIHVzZSB0byB0cnkgdG8gcmVtb3ZlIGl0LCBhbmQgd2hhdCB3YXMgdGhlIG91dHB1dD8g
PGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIFsxXSA8YSBjbGFzcz0ibW96LXR4dC1saW5r
LWZyZWV0ZXh0IgpocmVmPSJodHRwczovL2FjY2Vzcy5yZWRoYXQuY29tL2RvY3VtZW50YXRpb24v
ZW4tVVMvUmVkX0hhdF9FbnRlcnByaXNlX0xpbnV4LzcvaHRtbC9MaW51eF9Eb21haW5fSWRlbnRp
dHlfQXV0aGVudGljYXRpb25fYW5kX1BvbGljeV9HdWlkZS90cm91YmxlLWdlbi1yZXBsaWNhdGlv
bi5odG1sIgogICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8v
YWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2Vf
TGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9s
aWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgSGksPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBU
byBkZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAg
ICAgICAgICAgIHNldmVyYWwgaW5mbyBidXQgc3RhcnRpbmcgd2l0aCB0aGUgcmVzdWx0cyBvZiB0
aGUKICAgICAgICAgICAgICBmb2xsb3dpbmcgY29tbWFuZHM8YnI+CiAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg
LUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9cGtpZGJ1
c2VyLG91PXBlb3BsZSxvPWlwYWNhIgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTxicj4KICAg
ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5o
XSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgbWFuYWdlcicg
LVcgLWIgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiCiAgICAgICAgICAgIG5zY3Bl
bnRyeXdzaTxicj4KICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAg
ICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4KICAgICAgICAgICAg
bnNjcGVudHJ5d3NpOiBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4KICAg
ICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICBlbnRyeXVzbjthZGNzbi01OTM4ZTY4
ODAwMDEwNDI5MDAwNTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNToKICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICDCoDc1Mjc0ODk3PGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAg
ICAgICAgICAgIG1vZGlmeVRpbWVzdGFtcDthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNDt2dWNz
bi01OTM4ZTY4ODAwMDEwNDI8YnI+CiAgICAgICAgICAgIMKgOTAwMDQ6IDIwMTcwNjA4MDU1MzM0
Wjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICBtb2RpZmllcnNOYW1l
O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAzO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwPGJyPgog
ICAgICAgICAgICDCoDAwMzogY249RGlyZWN0b3J5IE1hbmFnZXI8YnI+CiAgICAgICAgICAgIG5z
Y3BlbnRyeXdzaTogbnNVbmlxdWVJZDoKICAgICAgICAgICAgNDg4MDliNDAtMmJiOTExZTUtOTZh
MGI4YjgtMWZkZDgwNzQ8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNl
cjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2
MTI1MTQ2Wjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRp
cmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9u
O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAxOgogICAgICAgICAgICAyOzEzNDE3MTg1NDE7Q049
Q2VydGlmaWM8YnI+CiAgICAgICAgICAgIMKgYXRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1D
QSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaToKICAg
ICAgICAgICAgZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVsZXRlZDoK
ICAgICAgICAgICAgMjs0O0NOPUNlcnRpZmljYTxicj4KICAgICAgICAgICAgwqB0ZSBBdXRob3Jp
dHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAg
ICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVj
dENsYXNzOiB0b3A8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHBl
cnNvbjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogb3JnYW5pemF0
aW9uYWxQZXJzb248YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGlu
ZXRPcmdQZXJzb248YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGNt
c3VzZXI8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lz
dGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lkYnVz
ZXI8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAg
ICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgTUlJRGN6
Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUjxicj4KICAgICAgICAgICAg
Jmx0O3NuaXAmZ3Q7PGJyPgrCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZh
MVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vy
Q2VydGlmaWNhdGU7dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDA6OgogICAgICAgICAgICBNSUlE
YmpDQ0FsYWdBd0lCQWdJPGJyPgogICAgICAgICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAg
ICAgIMKgQVI8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlclBhc3N3b3JkOjogJmx0
O3NuaXAmZ3Q7PGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJzdGF0ZTogMTxicj4K
ICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAg
ICAgICBuc2NwZW50cnl3c2k6IHBhcmVudGlkOiAyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3
c2k6IGVudHJ5aWQ6IDUxPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgog
ICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPiBhbmQ8
YnI+CiAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExM
IC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1
c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpPGJyPgogICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgW3Jvb3RA
c2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAg
ICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2Nw
ZW50cnl3c2k8YnI+CiAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAg
ICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAg
IG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAg
ICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJP
Q0tTPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAg
ICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+
CiAgICAgICAgICAgICZsdDtzbmlwJmd0Ozxicj4KwqBjQmQ0bk9WNG05QStxUlpObzRlWDdqTlQ4
QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz08YnI+CiAgICAgICAgICAgIG5zY3Bl
bnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICBBdXRo
b3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Viczxicj4KICAgICAgICAgICAgwqB5c3RlbSxPPUJQ
VC5ST0NLUzxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAg
ICAgICAgICAgbnNjcGVudHJ5d3NpOiBwYXJlbnRpZDogMjxicj4KICAgICAgICAgICAgbnNjcGVu
dHJ5d3NpOiBtb2RpZnlUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgICAg
bnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAg
ICAgICAgbnNjcGVudHJ5d3NpOiBtb2RpZmllcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxi
cj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBt
YW5hZ2VyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtz
bmlwJmd0Ozxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAg
ICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnR5cGU6IGFnZW50VHlwZTxicj4KICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjbjog
cGtpZGJ1c2VyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lkYnVzZXI8YnI+
CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgICAg
IG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiBvYmplY3RDbGFzczogcGVyc29uPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9i
amVjdENsYXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiBvYmplY3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiBvYmplY3RDbGFzczogY21zdXNlcjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBu
c1VuaXF1ZUlkOgogICAgICAgICAgICA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3
NDxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeXVzbjogODY8YnI+CiAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgy
ODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IDxicj4KICAgICAgICAgICAgICBGcm9tIHRoZSBvdXRw
dXQgeW91IG1heSBvbmx5IGNvcHkvcGFzdCB0aGUgb25lcyByZWxhdGVkIHRvCiAgICAgICAgICAg
ICAgdXNlckNlcnRpZmljYXRlPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgQWxzbyB0byBkdW1wIHRoZSBjdXJyZW50IHJlcGxpY2F0aW9uIHN0
YXR1cywgc2VuZCB0aGUKICAgICAgICAgICAgICByZXN1bHTCoCBvZjxicj4KICAgICAgICAgICAg
ICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3Rv
cnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+
PGk+IDwvaT4iKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZm
ZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAgICAgICAgIDwvZm9u
dD48L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFw
c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAi
bz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZm
ZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAgICAgICAgICAgRW50ZXIg
TERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICBkbjogY249cmVwbGljYSxjbj1vXDNEaXBh
Y2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgY246IHJlcGxpY2E8
YnI+CiAgICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgICAgICAgIG5zRFM1UmVwbGlj
YUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICAgICAgICBjbG9uZUFncmVlbWVu
dDEtZnJlZWlwYS1zZWEuYnB0LnJvYzxicj4KICAgICAgICAgICAgwqBrcy1wa2ktdG9tY2F0LG91
PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNu
PVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgICAgICAgbWFzdGVyQWdyZWVtZW50MS1zZWF0dGxl
bmZzLmJwdC5yb2M8YnI+CiAgICAgICAgICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNu
PWNvbmZpZzxicj4KICAgICAgICAgICAgbnNEUzVSZXBsaWNhSWQ6IDEwNjU8YnI+CiAgICAgICAg
ICAgIG5zRFM1UmVwbGljYU5hbWU6IGIyMWExZjFlLTYyNzkxMWU2LTkzZTZlZjRiLTY5ZGNjMmQx
PGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAg
ICBuc0RTNVJlcGxpY2FUeXBlOiAzPGJyPgogICAgICAgICAgICBuc1N0YXRlOjoKICAgICAgICAg
ICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFB
PT08YnI+CiAgICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwOiBjbj1yZXBsaWNhdGlv
bgogICAgICAgICAgICBtYW5hZ2Vycyxjbj1zeXNhY2NvdW50cyxjbj1ldGMsZGM9YnB0LDxicj4K
ICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgbnNkczVyZXBsaWNhYmluZGRu
Z3JvdXBjaGVja2ludGVydmFsOiA2MDxicj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IHRvcDxi
cj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgICAg
b2JqZWN0Q2xhc3M6IGV4dGVuc2libGVvYmplY3Q8YnI+CiAgICAgICAgICAgIG5zZHM1MHJ1djog
e3JlcGxpY2FnZW5lcmF0aW9ufSA1N2MyOTFkOTAwMDAwNDI5MDAwMDxicj4KICAgICAgICAgICAg
bnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAg
ICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9
ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0
LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICAg
ICAgICAgIMKgMCA1OThhMWM0MDAwMDEwNDI5MDAwMDxicj4KICAgICAgICAgICAgbnNkczUwcnV2
OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICBj
bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9z
ZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8
L2E+fTxicj4KICAgICAgICAgICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAgICAgICBvPWlwYWNh
O2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdDtzZWF0PGJy
PgogICAgICAgICAgICDCoHRsZW5mcy5icHQucm9ja3M7Mzg5O3VuYXZhaWxhYmxlPGJyPgogICAg
ICAgICAgICBuc2RzNWFnbXRtYXhjc246CiAgICAgICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVt
ZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgICAg
IMKgdGxlbmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICAgICAgICAgIG5zcnV2
UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NSA8YQogICAgICAgICAgICAgIGNsYXNz
PSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVp
cGEtc2VhLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVl
Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgIDU5OGE8
YnI+CiAgICAgICAgICAgIMKgMWMxNjxicj4KICAgICAgICAgICAgbnNydXZSZXBsaWNhTGFzdE1v
ZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGlu
ay1mcmVldGV4dCIKICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9j
a3M6Mzg5IgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0
bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgIDAwMDAwPGJyPgogICAgICAgICAg
ICDCoDAwMDxicj4KICAgICAgICAgICAgbnNkczVSZXBsaWNhQ2hhbmdlQ291bnQ6IDg4NTxicj4K
ICAgICAgICAgICAgbnNkczVyZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAgICAgICAgICBjaXRlPSJtaWQ6NTk4ODI4NzEuMTAw
MDEwNkByZWRoYXQuY29tIj48Zm9udCBzaXplPSItMSI+CiAgICAgICAgICAgICAgICBhbmQ8YnI+
CiAgICAgICAgICAgICAgPC9mb250Pltyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2gg
LUxMTCAtRAogICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIgIm89aXBh
Y2EiPGZvbnQgc2l6ZT0iLTEiPjxpPgogICAgICAgICAgICAgICAgPC9pPiIoJmFtcDsob2JqZWN0
Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYt
ZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgPC9mb250PjwvYmxvY2txdW90ZT4KICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMg
aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgIG1hbmFn
ZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1Vu
aXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAg
ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgIGRuOiBjbj1yZXBsaWNh
LGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgICAgICBj
bjogcmVwbGljYTxicj4KICAgICAgICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgICAgICAg
bnNEUzVSZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgICAgICAgIGNs
b25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2NrPGJyPgogICAgICAgICAgICDCoHMtcGtp
LXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgbnNEUzVSZXBsaWNh
SWQ6IDEyOTA8YnI+CiAgICAgICAgICAgIG5zRFM1UmVwbGljYU5hbWU6IDg3MDZhYjFlLTZhODMx
MWU2LWE5YmZkYmJmLTc0ZGM3MzIzPGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBv
PWlwYWNhPGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FUeXBlOiAzPGJyPgogICAgICAgICAg
ICBuc1N0YXRlOjoKICAgICAgICAgICAgQ2dVQUFBQUFBQUFLRllwWkFBQUFBQUFBQUFBQUFBQUFL
Z0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRk
bmdyb3VwOiBjbj1yZXBsaWNhdGlvbgogICAgICAgICAgICBtYW5hZ2Vycyxjbj1zeXNhY2NvdW50
cyxjbj1ldGMsZGM9YnB0LDxicj4KICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAg
ICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXBjaGVja2ludGVydmFsOiA2MDxicj4KICAgICAgICAg
ICAgb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVw
bGljYTxicj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IGV4dGVuc2libGVvYmplY3Q8YnI+CiAg
ICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYw
MDAwMDxicj4KICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1u
b3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0
IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxk
YXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICA1N2JlODA0YzAw
MDAwNTBhMDAwMDxicj4KICAgICAgICAgICAgwqAgNTg3MjM2MTUwMDAwMDUwYTAwMDA8YnI+CiAg
ICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTA2NSA8YSBtb3otZG8tbm90LXNlbmQ9InRy
dWUiCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAg
ICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVp
cGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICA1N2IxMDNkNDAwMDAwNDI5MDAw
PGJyPgogICAgICAgICAgICDCoDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAgICAgICAgICAg
IG5zZHM1YWdtdG1heGNzbjoKICAgICAgICAgICAgbz1pcGFjYTtjbG9uZUFncmVlbWVudDEtc2Vh
dHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdDtmcmVlaTxicj4KICAgICAgICAgICAgwqBwYS1z
ZWEuYnB0LnJvY2tzOzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAwPGJyPgogICAgICAgICAg
ICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAgPGEKICAgICAgICAgICAg
ICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6
Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5k
PSJ0cnVlIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAg
MDAwMDA8YnI+CiAgICAgICAgICAgIMKgMDAwPGJyPgogICAgICAgICAgICBuc3J1dlJlcGxpY2FM
YXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4
dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5i
cHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDov
L2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICAwMDAwPGJyPgogICAg
ICAgICAgICDCoDAwMDA8YnI+CiAgICAgICAgICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiAz
PGJyPgogICAgICAgICAgICBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICAgICAg
ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3
MS4xMDAwMTA2QHJlZGhhdC5jb20iPjxmb250IHNpemU9Ii0xIj4gPGJyPgogICAgICAgICAgICAg
ICAgUmVnYXJkczxicj4KICAgICAgICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICAgICAg
PC9mb250PgogICAgICAgICAgICAgIDxibG9ja3F1b3RlCiAgICAgICAgICAgICAgICBjaXRlPSJt
aWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAg
ICAgICAgICAgICB0eXBlPSJjaXRlIj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9
ImNpdGUiPltyb290QGZyZWVpcGEtc2VhIGlhbmhdIwogICAgICAgICAgICAgICAgICBsZGFwc2Vh
cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAg
ICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAg
ICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAg
UGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVv
cGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAg
ICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURB
ME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICDCoCAmbHQ7dHJ1bmNhdGVkJmd0OyA8YnI+CiAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdq
TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAg
ICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICBNSUlEYmpDQ0FsYWdBd0lC
QWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUsKICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAmbHQ7dHJ1bmNhdGVkJmd0OwogICAgICAgICAg
ICAgICAgICBmdVFRWm1QMVhyS2tyZnNqZWlGYlVGdG9NbmZtSExJWXBlNVFBUiA8YnI+CiAgICAg
ICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWNhdGUKICAg
ICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+
CiAgICAgICAgICAgICAgICAgIMKgICxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBbcm9vdEBzZWF0
dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICAgJ2NuPWRp
cmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91
PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICBkZXNjcmlw
dGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAg
ICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgog
ICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICBNSUlE
Y3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMK
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICDCoCAmbHQ7dHJ1bmNhdGVk
Jmd0OyA8YnI+CiAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFT
eGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbjog
Mjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NL
UztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk8gPGJyPgogICAgICAgICAgICAgICAgICDCoCBDS1Mg
PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3Rl
IHR5cGU9ImNpdGUiPklmIHlvdSBjaGVjayB0aGUgY2VydGlmaWNhdGVzCiAgICAgICAgICAgICAg
ICAgICAgZGF0ZXMsIEkgZ3Vlc3MgdGhhdCB0aGUgbW9zdCByZWNlbnQgb25lIGlzIG9uIHNlcnZl
cgogICAgICAgICAgICAgICAgICAgIHNlYXR0bGVuZnMgKGJlY2F1c2Ugb2Ygc2VyaWFsIG51bWJl
cnMpLiBDYW4geW91CiAgICAgICAgICAgICAgICAgICAgY29uZmlybSB0aGlzIChiZWNhdXNlIG91
ciBnb2FsIGlzIHRvIGhhdmUgdGhlIG1vc3QKICAgICAgICAgICAgICAgICAgICByZWNlbnQgY2Vy
dCBzdG9yZWQgaW4gYWxsIHRoZSBOU1NEQnMgYW5kIGluIExEQVApPyA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFRoYW5rcywgPGJyPgogICAgICAgICAg
ICAgICAgICAgIEZsbyA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4K
ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklmIHlvdXIgcmVu
ZXdhbCBtYXN0ZXIgaXMKICAgICAgICAgICAgICAgICAgICAgICAgdGhlIG1hY2hpbmUgb24gd2hp
Y2ggdGhlIE5TUyBEQgogICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0
L2FsaWFzIGNvbnRhaW5zIHRoZSBuZXdlcgogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LCB0
aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZSBzY3JpcHRzOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICBJZiBJJ20gaW50ZXJwcmV0aW5nIHRoaXMgY29ycmVjdGx5LCB0aGVuIGl0
IGlzLi4uCiAgICAgICAgICAgICAgICAgICAgICBzbyBJIHJhbiB0aGlzIG9uIHRoZSBicm9rZW4g
bWFjaGluZSAoc2VhdHRsZW5mcykgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBzdWRvCiAgICAgICAg
ICAgICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9zdG9wX3BraWNhZCA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICQgc3VkbyAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRt
b25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAgICAgICAgICAic3Vic3lzdGVtQ2Vy
dCBjZXJ0LXBraS1jYSIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICBJIHJhbiB0aGlzLCBpdCB0b29rIGEgd2hpbGUsIHRoZW4gSSBy
ZS1jaGVja2VkIGFuZAogICAgICAgICAgICAgICAgICAgICAgdGhlIHNlcmlhbCBzdGlsbCBzZWVt
cyB0byBiZSA0IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIK
ICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNl
ckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgICAgTUlJ
RGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxD
CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlF
OFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbjog
Mjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQu
Uk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTCiAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBIZXJl
J3Mgd2hhdCB3YXMgaW4KICAgICAgICAgICAgICAgICAgICAgIC92YXIvbG9nL3BraS9wa2ktdG9t
Y2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09IDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgID09PT09wqAg
REVCVUcgU1VCU1lTVEVNIElOSVRJQUxJWkVEwqDCoCA9PT09PT09IDxicj4KICAgICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09IDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2lu
ZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8K
ICAgICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1No
dXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0Vu
Z2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IKICAgICAgICAgICAgICAgICAgICAgIGF1
dG8tc2h1dGRvd24gc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNF
bmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUy
OjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5n
aW5lOiBkb25lIGluaXQgaWQ9ZGVidWcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg
ICAgICAgQ01TRW5naW5lOiBpbml0aWFsaXplZCBkZWJ1ZyA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg
ICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9bG9nIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0
U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBp
ZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcKICAg
ICAgICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9wa2ktdG9tY2F0
L2xvZ3MvY2Evc2lnbmVkQXVkaXQvY2FfYXVkaXQpCiAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAg
ICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9z
eXN0ZW0pCiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBb
MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg
ICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUo
L3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS90cmFuc2FjdGlvbnMpCiAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6
NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdp
bmU6IHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg
ICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/
CiAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9T
aHV0ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNF
bmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yCiAgICAgICAgICAgICAgICAgICAgICBh
dXRvLXNodXRkb3duIHN1cHBvcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01T
RW5naW5lOiBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0Vu
Z2luZTogZG9uZSBpbml0IGlkPWxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
ICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAg
ICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1q
c3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0
YXJ0IGF0IGF1dG9TaHV0ZG93bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwogICAgICAg
ICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24u
Y3J1bWIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBh
Ym91dCB0byBsb29rIGZvciBjZXJ0IGZvcgogICAgICAgICAgICAgICAgICAgICAgYXV0by1zaHV0
ZG93biBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b
bG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog
Zm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGRv
bmUgaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01T
RW5naW5lOiBpbml0aWFsaXplZCBqc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg
ICAgICAgQ01TRW5naW5lOiBpbml0U3Vic3lzdGVtIGlkPWRicyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg
ICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9ZGJzIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0
YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIERCU3Vic3lzdGVtOiBpbml0KCkgbUVu
YWJsZVNlcmlhbE1nbXQ9dHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg
ICBDcmVhdGluZyBMZGFwQm91bmRDb25uRmFjdG9yKERCU3Vic3lzdGVtKSA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdCA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTpk
b0Nsb25pbmcgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFw
QXV0aEluZm86IGluaXQoKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6
MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBM
ZGFwQXV0aEluZm86IGluaXQgYmVnaW5zIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
ICAgICAgIExkYXBBdXRoSW5mbzogaW5pdCBlbmRzIDxicj4KICAgICAgICAgICAgICAgICAgICAg
IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg
ICAgICAgICAgICAgIGluaXQ6IGJlZm9yZSBtYWtlQ29ubmVjdGlvbiBlcnJvcklmRG93biBpcyB0
cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j
YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9u
OiBlcnJvcklmRG93biB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogVENQCiAgICAgICAgICAgICAgICAg
ICAgICBLZWVwLUFsaXZlOiB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAg
ICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6IFNldHRpbmcgZGVzaXJlZAogICAg
ICAgICAgICAgICAgICAgICAgY2VydCBuaWNrbmFtZSB0bzogc3Vic3lzdGVtQ2VydCBjZXJ0LXBr
aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFwSnNzU1NMU29j
a2V0OiBzZXQgY2xpZW50IGF1dGggY2VydCBuaWNrbmFtZQogICAgICAgICAgICAgICAgICAgICAg
c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0U2VsZWN0aW9uQ0I6IEVudGVyaW5nISA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogb2NzcFNpZ25p
bmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAg
IENhbmRpZGF0ZSBjZXJ0OiBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6
IGRlc2lyZWQgY2VydAogICAgICAgICAgICAgICAgICAgICAgZm91bmQgaW4gbGlzdDogc3Vic3lz
dGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw
MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg
ICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiByZXR1cm5pbmc6CiAgICAgICAgICAg
ICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogU1NM
CiAgICAgICAgICAgICAgICAgICAgICBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd
OgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lLnNodXRkb3duKCkgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgSSByZWFsbHkgYXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJv
dWdoCiAgICAgICAgICAgICAgICAgICAgICB0aGlzLsKgIEkgb3dlIHlvdS4gPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgLSBJYW4gPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg
dHlwZT0iY2l0ZSI+QWZ0ZXIgdGhhdCwgY2hlY2sgdGhhdCB0aGUKICAgICAgICAgICAgICAgICAg
ICAgICAgTERBUCBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUgY2FzZSwKICAg
ICAgICAgICAgICAgICAgICAgICAgeW91IHNob3VsZCBiZSBhYmxlIHRvIHJlc3RhcnQgcGtpLiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
RmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5UaGFuayB5b3UgYWdhaW4gZm9yIHlvdXIKICAg
ICAgICAgICAgICAgICAgICAgICAgICB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIElhbiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5
cGU9ImNpdGUiPkZsby4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv
dGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hpY2gg
c2VlbXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5UaGUgZGVz
Y3JpcHRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdHRyaWJ1dGUgaW4gdGhl
IGxkYXBzZWFyY2ggb3V0cHV0IGlzIG9mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
dGhlIGZvcm0gMjsjO0ROO0ROIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRo
ZSBzZXJpYWwgbnVtYmVyIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGZp
cnN0IGNlcnR1dGlsIG91dHB1dCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51
cyB0aGUgQkVHSU4vRU5ECiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaGVhZGVycykg
c2hvdWxkIG1hdGNoIG9uZSBvZiB0aGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIHVzZXJDZXJ0aWZpY2F0ZSBhdHRyaWJ1dGVzLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJvYiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv
dGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIF9fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4KICAgICAgICAgICAgICAg
ICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAgICAgICAgICBj
bGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICAgIGhyZWY9
Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAg
ICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9y
YWhvc3RlZC5vcmc8L2E+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
VG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgICAgICAgICAgIGNs
YXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAgICAgICAgICAgaHJlZj0i
bWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAg
ICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVA
bGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX18gPGJyPgogICAgICAgICAgICAgICAgRnJlZUlQ
QS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10
eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVp
cGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICAgICAgbW96LWRv
LW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+
CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBUbyB1bnN1YnNjcmliZSBzZW5k
IGFuIGVtYWlsIHRvIDxhCiAgICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJi
cmV2aWF0ZWQiCiAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxl
YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qt
c2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h
PgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1l
bnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPHByZSB3
cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZy
ZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2
aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmci
IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQu
b3JnPC9hPgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0
LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3Rz
LmZlZG9yYWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1s
ZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgPGJyPgog
ICAgICAgIDxicj4KICAgICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVy
Ij48L2ZpZWxkc2V0PgogICAgICAgIDxicj4KICAgICAgICA8cHJlIHdyYXA9IiI+X19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWls
aW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFp
bHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5k
PSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ClRvIHVuc3Vi
c2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRl
ZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y
ZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9y
YWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAg
IDwvYmxvY2txdW90ZT4KICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K
--===============5746937532678446188==--
From ianh at brownpapertickets.com Tue Aug 15 15:58:11 2017
Content-Type: multipart/mixed; boundary="===============8211899678962370089=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Tue, 15 Aug 2017 08:57:27 -0700
Message-ID: <1aff2b26-b84a-fa2b-b970-84919bbfa2eb@brownpapertickets.com>
In-Reply-To: 7fc23432-e339-9b75-b9a6-ae4628f784e2@brownpapertickets.com
--===============8211899678962370089==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 8/10/17 11:37 AM, Ian Harding via FreeIPA-users wrote:
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
> Enter LDAP Password:
> dn: =
> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do=
\3Dipac
> a,cn=3Dmapping tree,cn=3Dconfig
> nsds5replicaLastUpdateStatus: Error (32) Problem connecting to replica =
> - LDAP
> error: No such object (connection error)
>
> dn: =
> cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do=
\3Dipac
> a,cn=3Dmapping tree,cn=3Dconfig
> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
> replica:
> Replica has different database generation ID, remote replica may need =
> to be i
> nitialized (RUV error)
>
> and
>
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
> Enter LDAP Password:
> dn: =
> cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\=
3Dipaca
> ,cn=3Dmapping tree,cn=3Dconfig
> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
> replica:
> Replica has different database generation ID, remote replica may need =
> to be i
> nitialized (RUV error)
So I know I need to ipa-csreplica-manage re-initialize --from =
freeipa-sea.bpt.rocks on seattlenfs, but also that it fails because of =
the above.
I think this is the root of the problem where the certificate is not =
replicated.
Anyone know how I can clean it up? I'm really sorry I've taken up so =
much of your time. I really appreciate it.
The freeipa-dal problem may or may not be related...
[root(a)freeipa-sea ianh]# ipa-csreplica-manage list
Directory Manager password:
seattlenfs.bpt.rocks: master
freeipa-dal.bpt.rocks: CA not configured
freeipa-sea.bpt.rocks: master
[root(a)freeipa-sea ianh]# ipa-csreplica-manage del freeipa-dal.bpt.rocks
Directory Manager password:
'freeipa-sea.bpt.rocks' has no replication agreement for =
'freeipa-dal.bpt.rocks'
[root(a)seattlenfs ~]# ipa-csreplica-manage list
Directory Manager password:
seattlenfs.bpt.rocks: master
freeipa-dal.bpt.rocks: CA not configured
freeipa-sea.bpt.rocks: master
[root(a)seattlenfs ~]# ipa-csreplica-manage del freeipa-dal.bpt.rocks
Directory Manager password:
'seattlenfs.bpt.rocks' has no replication agreement for =
'freeipa-dal.bpt.rocks'
[root(a)seattlenfs ~]# ipa-replica-manage list-ruv
Directory Manager password:
Replica Update Vectors:
seattlenfs.bpt.rocks:389: 21
freeipa-sea.bpt.rocks:389: 20
Certificate Server Replica Update Vectors:
seattlenfs.bpt.rocks:389: 1290
freeipa-sea.bpt.rocks:389: 1065
--===============8211899678962370089==--
From tbordaz at redhat.com Wed Aug 16 12:25:16 2017
Content-Type: multipart/mixed; boundary="===============5165044645924626980=="
MIME-Version: 1.0
From: thierry bordaz
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Wed, 16 Aug 2017 14:24:30 +0200
Message-ID: <5994397E.20408@redhat.com>
In-Reply-To: 7fc23432-e339-9b75-b9a6-ae4628f784e2@brownpapertickets.com
--===============5165044645924626980==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Hi Ian
> Hmm.. This looks odd.
>
> [root(a)seattlenfs ianh]# ipa-csreplica-manage re-initialize --from =
> freeipa-sea.bpt.rocks
> Directory Manager password:
>
> ipa: ERROR: Found multiple agreements for seattlenfs.bpt.rocks. Only =
> initializing the first one returned: =
> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do=
\=3Dipaca,cn=3Dmapping =
> tree,cn=3Dconfig
> Update in progress, 15 seconds elapsed
> [freeipa-sea.bpt.rocks] reports: Update failed! Status: [32 - LDAP =
> error: No such object]
Here there are several replica agreement from freeipa-sea.bpt.rocks-> =
seattlenfs (for o=3Dipaca suffix).
I am not sure how this can happen.
It could be some remaining entries from previous install/uninstall or =
multiple initialization from different sources.
Looking at the error below, I wonder if there were actually 2 replica =
agreements freeipa-sea->seattlenfs that are
* cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat
* masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat
Would you dump (on all servers freeipa-sea, seattlenfs and freeipa-dal):
ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
"cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi
best regards
thierry
>
>> On freeipa-sea and seattlenfs you may check the ipaca replica =
>> agreements status before/after reinit. I would guess they are =
>> currently reporting failures between these two replicas.
>>
>> ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>> "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
>> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
>>
> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
> Enter LDAP Password:
> dn: =
> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do=
\3Dipac
> a,cn=3Dmapping tree,cn=3Dconfig
> nsds5replicaLastUpdateStatus: Error (32) Problem connecting to replica =
> - LDAP
> error: No such object (connection error)
>
> dn: =
> cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do=
\3Dipac
> a,cn=3Dmapping tree,cn=3Dconfig
> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
> replica:
> Replica has different database generation ID, remote replica may need =
> to be i
> nitialized (RUV error)
>
> and
>
> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
> Enter LDAP Password:
> dn: =
> cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\=
3Dipaca
> ,cn=3Dmapping tree,cn=3Dconfig
> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
> replica:
> Replica has different database generation ID, remote replica may need =
> to be i
> nitialized (RUV error)
>
>
>>>
>>> several times over the years when replication has stopped.
>>>
>>> Replication actually is working, as far as user and machine accounts =
>>> and attributes are concerned anyway, and has been for a while.
>>>
>>> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid =
>>> of... it shows up in the GUI on the Topology page but generates a =
>>> Server not found error. I don't know if that's related.
>>
>> Zombie servers have been discussed a lot on this mailing list. You =
>> may get rid of them with list-ruv/clean-ruv subcommand. Replication =
>> usually manage to work fine even if some zombie entries exist but it =
>> is a good practice to clean them.
> Yeah, I've been through every possible combination of =
> list-ruv/clean-ruv. I have something odd going on in that no =
> replication agreements show up anywhere for freeipa-dal.
>>
>> regards
>> thierry
>>>>
>>>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote:
>>>>>
>>>>> On 8/7/17 1:44 AM, thierry bordaz wrote:
>>>>>
>>>>>>
>>>>>>
>>>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users =
>>>>>> wrote:
>>>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>>>>>>
>>>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via =
>>>>>>>>>>>>>>>>>>> FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that =
>>>>>>>>>>>>>>>>>>>>>> had apparently had
>>>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl =
>>>>>>>>>>>>>>>>>>>>>> says pki-tomcatd
>>>>>>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running:
>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat =
>>>>>>>>>>>>>>>>>>>>> can run without
>>>>>>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see =
>>>>>>>>>>>>>>>>>>>>> what is going on.
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication =
>>>>>>>>>>>>>>>>>>>> failed (49)
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server =
>>>>>>>>>>>>>>>>>>> and needs to
>>>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check =
>>>>>>>>>>>>>>>>>>> how this
>>>>>>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a =
>>>>>>>>>>>>>>>>>>> ssl
>>>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a =
>>>>>>>>>>>>>>>>>>> bind DN and
>>>>>>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base =
>>>>>>>>>>>>>>>>>>> -Y EXTERNAL
>>>>>>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople=
,o=3Dipaca =
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>>>>>>> ...
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a =
>>>>>>>>>>>>>>>>>> prompt to provide
>>>>>>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for =
>>>>>>>>>>>>>>>>>> security token 'ldap(0)':
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the =
>>>>>>>>>>>>>>>>> password can be
>>>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf =
>>>>>>>>>>>>>>>>> (with the tag
>>>>>>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> Can you check if the password with the tag =
>>>>>>>>>>>>>>>>> internal=3D... allows to read
>>>>>>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>> (provide password)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> That works...
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot =
>>>>>>>>>>>>>>>> "NSS User Private
>>>>>>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan)
>>>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>>>>>>>>>>>> caSigningCert
>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f =
>>>>>>>>>>>>>>>> Server-Cert
>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> But this doesn't (with the same password from =
>>>>>>>>>>>>>>>> password.conf)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y =
>>>>>>>>>>>>>>>> EXTERNAL
>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security =
>>>>>>>>>>>>>>>> token 'ldap(0)':
>>>>>>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> That password is getting me somewhere though, since if =
>>>>>>>>>>>>>>>> I put in a
>>>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and =
>>>>>>>>>>>>>>>> over.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> There wasn't much of a change... I just assumed someone =
>>>>>>>>>>>>>> ran yum upgrade and didn't restart, then the power =
>>>>>>>>>>>>>> outage... it looks like not much of a version change though.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:46:06 Updated: =
>>>>>>>>>>>>>> libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>>> Jan 08 04:46:08 Installed: =
>>>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>>>>>>> Jul 28 09:55:41 Updated: =
>>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:46 Updated: =
>>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>>>>>>> Jan 08 04:47:19 Installed: =
>>>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>> Jul 28 10:13:17 Updated: =
>>>>>>>>>>>>>> pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # getenforce
>>>>>>>>>>>>>> Enforcing
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> If so can you run:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use =
>>>>>>>>>>>>>> the write_logs option.
>>>>>>>>>>>>>> The NOLOG option is overriding the write_logs current =
>>>>>>>>>>>>>> setting.
>>>>>>>>>>>>>> ----
>>>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): =
>>>>>>>>>>>>>> arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-13 =
>>>>>>>>>>>>>> a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0 items=3D=
0 =
>>>>>>>>>>>>>> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 =
>>>>>>>>>>>>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 =
>>>>>>>>>>>>>> sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D4294967295 =
>>>>>>>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { =
>>>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys=
" =
>>>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 =
>>>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and =
>>>>>>>>>>>>>>> everything wasn't
>>>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>>>>>>> upgrade it just
>>>>>>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> Can you run these commands:
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descr=
iption
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> This returns
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descri=
ption
>>>>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>>>>> ... stuff ...
>>>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>>>>> description: 2;4;CN=3DCertificate =
>>>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> and
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>>> 'subsystemCert
>>>>>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> These both return
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>> certutil: problem listing keys: =
>>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot =
>>>>>>>>>>>>>> "NSS User Private Key and Certificate Services"
>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>> certutil: problem listing keys: =
>>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.
>>>>>>>>>>>>>>
>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>
>>>>>>>>>>>>> you made a typo and requested the keys (-K) instead of the =
>>>>>>>>>>>>> certs (-L). Please retry with -L and you should be able to =
>>>>>>>>>>>>> see the certificate serial.
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca =
>>>>>>>>>>>> userCertificate description
>>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>>> ...
>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=
=3DCA =
>>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>>
>>>>>>>>>>>> So the serial is 4?
>>>>>>>>>>>>
>>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>>>>> grep Serial
>>>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>>>>
>>>>>>>>>>>> Which is NOT 4...
>>>>>>>>>>>>
>>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDA=
lC =
>>>>>>>>>>>>
>>>>>>>>>>>> ...
>>>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>>>>>> -----END CERTIFICATE-----
>>>>>>>>>>>>
>>>>>>>>>>>> And this cert is NOT the same.
>>>>>>>>>>>>
>>>>>>>>>>> Hi,
>>>>>>>>>>>
>>>>>>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>>>>>>> post-save commands (which you can see in the output of =
>>>>>>>>>>> getcert list). In your case, the post-save command for =
>>>>>>>>>>> subsystemCert cert-pki-ca probably failed.
>>>>>>>>>>>
>>>>>>>>>>> This command (on the renewal master) is responsible for =
>>>>>>>>>>> copying the new cert from the NSS db to the LDAP server. You =
>>>>>>>>>>> need first to check which IPA server is the renewal master =
>>>>>>>>>>> (as the serial numbers are in a completely different range, =
>>>>>>>>>>> I assume that you have multiple IPA servers configured with =
>>>>>>>>>>> a CA instance):
>>>>>>>>>>>
>>>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=
=3D =
>>>>>>>>>>> -f2-`
>>>>>>>>>>> $ kinit admin
>>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>>>> dn: =
>>>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,c=
n=3Detc,dc=3Dipadomain,dc=3Dcom =
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> I get this
>>>>>>>>>>
>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>>> dn: =
>>>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Det=
c,dc=3Dbpt,dc=3Drocks =
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> Which is the other FreeIPA server.
>>>>>>>>>>
>>>>>>>>> Hi Ian,
>>>>>>>>>
>>>>>>>>> it's getting difficult to follow this thread, so could we step =
>>>>>>>>> back and summarize?
>>>>>>>> Yes, it is. Sorry.
>>>>>>>>>
>>>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is =
>>>>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 =
>>>>>>>>> in the NSSDB /etc/pki/pki-tomcat/alias
>>>>>>>> No?
>>>>>>>>
>>>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d =
>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep =
>>>>>>>> Serial
>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has =
>>>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>>>>>>> Yes
>>>>>>>>
>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep =
>>>>>>>> Serial
>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>
>>>>>>>>>
>>>>>>>>> - In the LDAP servers, the cert is stored in the entry =
>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. =
it =
>>>>>>>>> is the cert from freeipa-sea).
>>>>>>>> This is where the difference is. There are two certificates on =
>>>>>>>> the master and only one on the other. I wonder if this is a =
>>>>>>>> result of the slow motion replication trainwreck I have going =
>>>>>>>> on due to a zombie replica in the ldap database that no longer =
>>>>>>>> exists in the real world and I can't seem to get rid of.
>>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> the remaining issue is a replication problem. There is a =
>>>>>>> "Troubleshooting replication" section [1] in IdM Admin guide =
>>>>>>> that may help you.
>>>>>>>
>>>>>>> Regarding your zombie replica, which commands did you use to try =
>>>>>>> to remove it, and what was the output?
>>>>>>>
>>>>>>> Flo
>>>>>>>
>>>>>>> [1] =
>>>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Li=
nux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-ge=
n-replication.html
>>>>>>>
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> To debug replication latency or problem we would need several =
>>>>>> info but starting with the results of the following commands
>>>>>>
>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> nscpentrywsi: =
>>>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
>>>>> 75274897
>>>>> nscpentrywsi: =
>>>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
>>>>> 90004: 20170608055334Z
>>>>> nscpentrywsi: =
>>>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
>>>>> 003: cn=3DDirectory Manager
>>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>>>> nscpentrywsi: cn: pkidbuser
>>>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>>>> nscpentrywsi: description;vucsn-5938e688000104290001: =
>>>>> 2;1341718541;CN=3DCertific
>>>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
>>>>> 2;4;CN=3DCertifica
>>>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>> nscpentrywsi: mail:
>>>>> nscpentrywsi: objectClass: top
>>>>> nscpentrywsi: objectClass: person
>>>>> nscpentrywsi: objectClass: organizationalPerson
>>>>> nscpentrywsi: objectClass: inetOrgPerson
>>>>> nscpentrywsi: objectClass: cmsuser
>>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>> nscpentrywsi: sn: pkidbuser
>>>>> nscpentrywsi: uid: pkidbuser
>>>>> nscpentrywsi: userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>>>
>>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
>>>>> MIIDbjCCAlagAwIBAgI
>>>>>
>>>>> AR
>>>>> nscpentrywsi: userPassword::
>>>>> nscpentrywsi: userstate: 1
>>>>> nscpentrywsi: usertype: agentType
>>>>> nscpentrywsi: parentid: 2
>>>>> nscpentrywsi: entryid: 51
>>>>>> and
>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>>>
>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>>> Enter LDAP Password:
>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>> nscpentrywsi: userCertificate:: =
>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>>>
>>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>> nscpentrywsi: description: 2;4;CN=3DCertificate =
>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs
>>>>> ystem,O=3DBPT.ROCKS
>>>>> nscpentrywsi: entryid: 51
>>>>> nscpentrywsi: parentid: 2
>>>>> nscpentrywsi: modifyTimestamp: 20150716125146Z
>>>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager
>>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>>>> nscpentrywsi: userPassword::
>>>>> nscpentrywsi: userstate: 1
>>>>> nscpentrywsi: usertype: agentType
>>>>> nscpentrywsi: mail:
>>>>> nscpentrywsi: cn: pkidbuser
>>>>> nscpentrywsi: sn: pkidbuser
>>>>> nscpentrywsi: uid: pkidbuser
>>>>> nscpentrywsi: objectClass: top
>>>>> nscpentrywsi: objectClass: person
>>>>> nscpentrywsi: objectClass: organizationalPerson
>>>>> nscpentrywsi: objectClass: inetOrgPerson
>>>>> nscpentrywsi: objectClass: cmsuser
>>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>>>> nscpentrywsi: entryusn: 86
>>>>>>
>>>>>> From the output you may only copy/past the ones related to =
>>>>>> userCertificate
>>>>>>
>>>>>>
>>>>>> Also to dump the current replication status, send the result of
>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>> manager' -W -b =
>>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ff=
ffffff-ffffffff-ffffffff))"
>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>> -W -b "o=3Dipaca" =
>>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff=
f-ffffffff))"
>>>>> Enter LDAP Password:
>>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>>>> cn: replica
>>>>> nsDS5Flags: 1
>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>>> cloneAgreement1-freeipa-sea.bpt.roc
>>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>>> masterAgreement1-seattlenfs.bpt.roc
>>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>>> nsDS5ReplicaId: 1065
>>>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
>>>>> nsDS5ReplicaRoot: o=3Dipaca
>>>>> nsDS5ReplicaType: 3
>>>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=
=3D
>>>>> nsds5replicabinddngroup: cn=3Dreplication =
>>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>>>> dc=3Drocks
>>>>> nsds5replicabinddngroupcheckinterval: 60
>>>>> objectClass: top
>>>>> objectClass: nsDS5Replica
>>>>> objectClass: extensibleobject
>>>>> nsds50ruv: {replicageneration} 57c291d9000004290000
>>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>>>> 57f840bf00000429000
>>>>> 0 598a1c40000104290000
>>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>>>>> nsds5agmtmaxcsn: =
>>>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
>>>>> tlenfs.bpt.rocks;389;unavailable
>>>>> nsds5agmtmaxcsn: =
>>>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
>>>>> tlenfs.bpt.rocks;389;unavailable
>>>>> nsruvReplicaLastModified: {replica 1065 =
>>>>> ldap://freeipa-sea.bpt.rocks:389} 598a
>>>>> 1c16
>>>>> nsruvReplicaLastModified: {replica 1290 =
>>>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>>>> 000
>>>>> nsds5ReplicaChangeCount: 885
>>>>> nsds5replicareapactive: 0
>>>>>> and
>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>>> -W -b =
>>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ff=
ffffff-ffffffff-ffffffff))"
>>>>>
>>>>>
>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' =
>>>>> -W -b "o=3Dipaca" =
>>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff=
f-ffffffff))"
>>>>> Enter LDAP Password:
>>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>>>> cn: replica
>>>>> nsDS5Flags: 1
>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>>> cloneAgreement1-seattlenfs.bpt.rock
>>>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>>> nsDS5ReplicaId: 1290
>>>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
>>>>> nsDS5ReplicaRoot: o=3Dipaca
>>>>> nsDS5ReplicaType: 3
>>>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=
=3D
>>>>> nsds5replicabinddngroup: cn=3Dreplication =
>>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>>>> dc=3Drocks
>>>>> nsds5replicabinddngroupcheckinterval: 60
>>>>> objectClass: top
>>>>> objectClass: nsDS5Replica
>>>>> objectClass: extensibleobject
>>>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
>>>>> 57be804c0000050a0000
>>>>> 587236150000050a0000
>>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>>>> 57b103d400000429000
>>>>> 0 57be8043000704290000
>>>>> nsds5agmtmaxcsn: =
>>>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
>>>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000
>>>>> nsruvReplicaLastModified: {replica 1290 =
>>>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>>>> 000
>>>>> nsruvReplicaLastModified: {replica 1065 =
>>>>> ldap://freeipa-sea.bpt.rocks:389} 0000
>>>>> 0000
>>>>> nsds5ReplicaChangeCount: 3
>>>>> nsds5replicareapactive: 0
>>>>>>
>>>>>> Regards
>>>>>> thierry
>>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertifica=
te =
>>>>>>>> description
>>>>>>>> Enter LDAP Password:
>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>> userCertificate:: =
>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>
>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>> userCertificate:: =
>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>> description: 2;1341718541;CN=3DCertificate =
>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem
>>>>>>>> ,O=3DBPT.ROCKS
>>>>>>>>
>>>>>>>>
>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertifica=
te =
>>>>>>>> description
>>>>>>>> Enter LDAP Password:
>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>> userCertificate:: =
>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>
>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>> Subsystem,O=3DBPT.RO
>>>>>>>> CKS
>>>>>>>>
>>>>>>>>> If you check the certificates dates, I guess that the most =
>>>>>>>>> recent one is on server seattlenfs (because of serial =
>>>>>>>>> numbers). Can you confirm this (because our goal is to have =
>>>>>>>>> the most recent cert stored in all the NSSDBs and in LDAP)?
>>>>>>>>>
>>>>>>>>> Thanks,
>>>>>>>>> Flo
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you =
>>>>>>>>>>> can manually run the scripts:
>>>>>>>>>>
>>>>>>>>>> If I'm interpreting this correctly, then it is... so I ran =
>>>>>>>>>> this on the broken machine (seattlenfs)
>>>>>>>>>>
>>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert =
>>>>>>>>>>> "subsystemCert cert-pki-ca"
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> I ran this, it took a while, then I re-checked and the serial =
>>>>>>>>>> still seems to be 4
>>>>>>>>>>
>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description
>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>> userCertificate:: =
>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>> ...
>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC=
A =
>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>
>>>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>>>>>>
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D =
DEBUG =
>>>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> restart at autoShutdown? false
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> done init id=3Ddebug
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> initialized debug
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> initSubsystem id=3Dlog
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> ready to init id=3Dlog
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_au=
dit) =
>>>>>>>>>>
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> restart at autoShutdown? false
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> done init id=3Dlog
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> initialized log
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> initSubsystem id=3Djss
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> ready to init id=3Djss
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> restart at autoShutdown? false
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> done init id=3Djss
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> initialized jss
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> initSubsystem id=3Ddbs
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>> ready to init id=3Ddbs
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: =
>>>>>>>>>> init() mEnableSerialMgmt=3Dtrue
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> LdapBoundConnFactory: init
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> LdapBoundConnFactory:doCloning true
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>>> init()
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>>> init begins
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>>> init ends
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>>>>>>> makeConnection errorIfDown is true
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> makeConnection: errorIfDown true
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP =
>>>>>>>>>> Keep-Alive: true
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert =
>>>>>>>>>> nickname to: subsystemCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> LdapJssSSLSocket: set client auth cert nickname subsystemCert =
>>>>>>>>>> cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate =
>>>>>>>>>> cert: ocspSigningCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate =
>>>>>>>>>> cert: subsystemCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert =
>>>>>>>>>> cert-pki-ca
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake =
>>>>>>>>>> happened
>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>> CMSEngine.shutdown()
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> I really appreciate you sticking with me through this. I owe =
>>>>>>>>>> you.
>>>>>>>>>>
>>>>>>>>>> - Ian
>>>>>>>>>>
>>>>>>>>>>> After that, check that the LDAP entry has been updated. If =
>>>>>>>>>>> it is the case, you should be able to restart pki.
>>>>>>>>>>>
>>>>>>>>>>> Flo
>>>>>>>>>>>
>>>>>>>>>>>> Thank you again for your time!
>>>>>>>>>>>>
>>>>>>>>>>>> Ian
>>>>>>>>>>>>
>>>>>>>>>>>>> Flo.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> which seems weird.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> The description attribute in the ldapsearch output is of =
>>>>>>>>>>>>>>> the form 2;#;DN;DN
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> The # should match the serial number in the first =
>>>>>>>>>>>>>>> certutil output
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should =
>>>>>>>>>>>>>>> match one of the
>>>>>>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> rob
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.o=
rg
>>>>>>>> To unsubscribe send an email to =
>>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>> _______________________________________________
>>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>>>> To unsubscribe send an email to =
>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahost=
ed.org
>>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted=
.org
>>
>
--===============5165044645924626980==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm
LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgSGkgSWFuPGJyPgogICAgPGJyPgogICAgPGJs
b2NrcXVvdGUKICAgICAgY2l0ZT0ibWlkOjdmYzIzNDMyLWUzMzktOWI3NS1iOWE2LWFlNDYyOGY3
ODRlMkBicm93bnBhcGVydGlja2V0cy5jb20iCiAgICAgIHR5cGU9ImNpdGUiPiBIbW0uLiBUaGlz
IGxvb2tzIG9kZC48YnI+CiAgICAgIDxicj4KICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMg
aXBhLWNzcmVwbGljYS1tYW5hZ2UgcmUtaW5pdGlhbGl6ZSAtLWZyb20KICAgICAgZnJlZWlwYS1z
ZWEuYnB0LnJvY2tzPGJyPgogICAgICBEaXJlY3RvcnkgTWFuYWdlciBwYXNzd29yZDogPGJyPgog
ICAgICA8YnI+CiAgICAgIGlwYTogRVJST1I6IEZvdW5kIG11bHRpcGxlIGFncmVlbWVudHMgZm9y
IHNlYXR0bGVuZnMuYnB0LnJvY2tzLgogICAgICBPbmx5IGluaXRpYWxpemluZyB0aGUgZmlyc3Qg
b25lIHJldHVybmVkOgogICAgICBjbj1jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0LnJv
Y2tzLXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXD1pcGFjYSxjbj1tYXBwaW5nCgogICAgICB0
cmVlLGNuPWNvbmZpZzxicj4KICAgICAgVXBkYXRlIGluIHByb2dyZXNzLCAxNSBzZWNvbmRzIGVs
YXBzZWQ8YnI+CiAgICAgIFtmcmVlaXBhLXNlYS5icHQucm9ja3NdIHJlcG9ydHM6IFVwZGF0ZSBm
YWlsZWQhIFN0YXR1czogWzMywqAgLQogICAgICBMREFQIGVycm9yOiBObyBzdWNoIG9iamVjdF08
YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBIZXJlIHRoZXJlIGFyZSBzZXZlcmFs
IHJlcGxpY2EgYWdyZWVtZW50IGZyb20KICAgIGZyZWVpcGEtc2VhLmJwdC5yb2Nrcy0mZ3Q7IHNl
YXR0bGVuZnMgKGZvciBvPWlwYWNhIHN1ZmZpeCkuPGJyPgogICAgSSBhbSBub3Qgc3VyZSBob3cg
dGhpcyBjYW4gaGFwcGVuLiA8YnI+CiAgICBJdCBjb3VsZCBiZSBzb21lIHJlbWFpbmluZyBlbnRy
aWVzIGZyb20gcHJldmlvdXMgaW5zdGFsbC91bmluc3RhbGwKICAgIG9yIG11bHRpcGxlIGluaXRp
YWxpemF0aW9uIGZyb20gZGlmZmVyZW50IHNvdXJjZXMuPGJyPgogICAgPGJyPgogICAgTG9va2lu
ZyBhdCB0aGUgZXJyb3IgYmVsb3csIEkgd29uZGVyIGlmIHRoZXJlIHdlcmUgYWN0dWFsbHkgMgog
ICAgcmVwbGljYSBhZ3JlZW1lbnRzIGZyZWVpcGEtc2VhLSZndDtzZWF0dGxlbmZzIHRoYXQgYXJl
IDxicj4KICAgIDx1bD4KICAgICAgPGxpPjx0dD5jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEu
YnB0LnJvY2tzLXBraS10b21jYXQ8L3R0PjwvbGk+CiAgICAgIDxsaT48dHQ+bWFzdGVyQWdyZWVt
ZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0PC90dD48L2xpPgogICAgPC91bD4K
ICAgIDxwPldvdWxkIHlvdSBkdW1wIChvbiBhbGwgc2VydmVycyBmcmVlaXBhLXNlYSwgc2VhdHRs
ZW5mcyBhbmQKICAgICAgZnJlZWlwYS1kYWwpOjxicj4KICAgIDwvcD4KICAgIDxwPjx0dD5sZGFw
c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICJjbj1y
ZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnIiBuc2NwZW50cnl3
c2k8YnI+CiAgICAgIDwvdHQ+PC9wPgogICAgPHA+PHR0Pjxicj4KICAgICAgICBiZXN0IHJlZ2Fy
ZHM8YnI+CiAgICAgICAgdGhpZXJyeTxicj4KICAgICAgPC90dD48L3A+CiAgICA8YmxvY2txdW90
ZQogICAgICBjaXRlPSJtaWQ6N2ZjMjM0MzItZTMzOS05Yjc1LWI5YTYtYWU0NjI4Zjc4NGUyQGJy
b3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJAcmVkaGF0LmNvbSI+
IE9uCiAgICAgICAgZnJlZWlwYS1zZWEgYW5kIHNlYXR0bGVuZnMgeW91IG1heSBjaGVjayB0aGUg
aXBhY2EgcmVwbGljYQogICAgICAgIGFncmVlbWVudHMgc3RhdHVzIGJlZm9yZS9hZnRlciByZWlu
aXQuIEkgd291bGQgZ3Vlc3MgdGhleSBhcmUKICAgICAgICBjdXJyZW50bHkgcmVwb3J0aW5nIGZh
aWx1cmVzIGJldHdlZW4gdGhlc2UgdHdvIHJlcGxpY2FzLjxicj4KICAgICAgICA8YnI+CiAgICAg
ICAgPHR0PmxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICI8
L3R0Pjx0dD5jbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCgogICAgICAgICAgdHJl
ZSxjbj1jb25maWciICJvYmplY3RDbGFzcz1uc2RzNXJlcGxpY2F0aW9uYWdyZWVtZW50IgogICAg
ICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgICAgIDxicj4KICAg
ICAgICA8L3R0PjwvYmxvY2txdW90ZT4KICAgICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhd
IyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1i
ICJjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgICAgdHJlZSxjbj1jb25m
aWciICJvYmplY3RDbGFzcz1uc2RzNXJlcGxpY2F0aW9uYWdyZWVtZW50IgogICAgICAgIG5zZHM1
cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM8YnI+CiAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDog
PGJyPgogICAgICAgIGRuOgpjbj1jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0LnJvY2tz
LXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhYzxicj4KICAgICAgICDCoGEsY249bWFw
cGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICBuc2RzNXJlcGxpY2FMYXN0VXBkYXRlU3Rh
dHVzOiBFcnJvciAoMzIpIFByb2JsZW0gY29ubmVjdGluZyB0bwogICAgICAgIHJlcGxpY2EgLSBM
REFQIDxicj4KICAgICAgICDCoGVycm9yOiBObyBzdWNoIG9iamVjdCAoY29ubmVjdGlvbiBlcnJv
cik8YnI+CiAgICAgICAgPGJyPgogICAgICAgIGRuOgpjbj1tYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0
bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhYzxicj4KICAg
ICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICBuc2RzNXJlcGxp
Y2FMYXN0VXBkYXRlU3RhdHVzOiBFcnJvciAoMTkpIFJlcGxpY2F0aW9uIGVycm9yCiAgICAgICAg
YWNxdWlyaW5nIHJlcGxpY2E6IDxicj4KICAgICAgICDCoFJlcGxpY2EgaGFzIGRpZmZlcmVudCBk
YXRhYmFzZSBnZW5lcmF0aW9uIElELCByZW1vdGUgcmVwbGljYQogICAgICAgIG1heSBuZWVkIHRv
IGJlIGk8YnI+CiAgICAgICAgwqBuaXRpYWxpemVkIChSVVYgZXJyb3IpPGJyPgogICAgICAgIDxi
cj4KICAgICAgICBhbmQ8YnI+CiAgICAgICAgPGJyPgogICAgICAgIFtyb290QHNlYXR0bGVuZnMg
aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgbWFuYWdlcicg
LVcgLWIgImNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcKICAgICAgICB0cmVlLGNu
PWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAgICAgICAg
bnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgICBFbnRlciBMREFQIFBhc3N3
b3JkOiA8YnI+CiAgICAgICAgZG46CmNuPWNsb25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5y
b2Nrcy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1wzRGlwYWNhPGJyPgogICAgICAgIMKgLGNu
PW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0
ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBsaWNhdGlvbiBlcnJvcgogICAgICAgIGFjcXVpcmluZyBy
ZXBsaWNhOiA8YnI+CiAgICAgICAgwqBSZXBsaWNhIGhhcyBkaWZmZXJlbnQgZGF0YWJhc2UgZ2Vu
ZXJhdGlvbiBJRCwgcmVtb3RlIHJlcGxpY2EKICAgICAgICBtYXkgbmVlZCB0byBiZSBpPGJyPgog
ICAgICAgIMKgbml0aWFsaXplZCAoUlVWIGVycm9yKTxicj4KICAgICAgICA8YnI+CiAgICAgIDwv
dHQ+PGJyPgogICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk4QzJCNEYu
MjAwMDIwMkByZWRoYXQuY29tIj48dHQ+CiAgICAgICAgPC90dD4KICAgICAgICA8YmxvY2txdW90
ZQogICAgICAgICAgY2l0ZT0ibWlkOmZlNTI1OWYzLWFlNGEtODM4OS01NDI1LTliODRiMTFiNzFk
NUBicm93bnBhcGVydGlja2V0cy5jb20iCiAgICAgICAgICB0eXBlPSJjaXRlIj4gPGJyPgogICAg
ICAgICAgc2V2ZXJhbCB0aW1lcyBvdmVyIHRoZSB5ZWFycyB3aGVuIHJlcGxpY2F0aW9uIGhhcyBz
dG9wcGVkLsKgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIFJlcGxpY2F0aW9uIGFjdHVh
bGx5IGlzIHdvcmtpbmcsIGFzIGZhciBhcyB1c2VyIGFuZCBtYWNoaW5lCiAgICAgICAgICBhY2Nv
dW50cyBhbmQgYXR0cmlidXRlcyBhcmUgY29uY2VybmVkIGFueXdheSwgYW5kIGhhcyBiZWVuIGZv
cgogICAgICAgICAgYSB3aGlsZS48YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBUaGVyZSBp
cyBhIHpvbWJpZSBzZXJ2ZXIgZnJlZWlwYS1kYWwuYnB0LnJvY2tzIHRoYXQgSSBjYW4ndAogICAg
ICAgICAgZ2V0IHJpZCBvZi4uLiBpdCBzaG93cyB1cCBpbiB0aGUgR1VJIG9uIHRoZSBUb3BvbG9n
eSBwYWdlIGJ1dAogICAgICAgICAgZ2VuZXJhdGVzIGEgU2VydmVyIG5vdCBmb3VuZCBlcnJvci7C
oCBJIGRvbid0IGtub3cgaWYgdGhhdCdzCiAgICAgICAgICByZWxhdGVkLjxicj4KICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgPGJyPgogICAgICAgIFpvbWJpZSBzZXJ2ZXJzIGhhdmUgYmVl
biBkaXNjdXNzZWQgYSBsb3Qgb24gdGhpcyBtYWlsaW5nIGxpc3QuCiAgICAgICAgWW91IG1heSBn
ZXQgcmlkIG9mIHRoZW0gd2l0aCBsaXN0LXJ1di9jbGVhbi1ydXYgc3ViY29tbWFuZC4KICAgICAg
ICBSZXBsaWNhdGlvbiB1c3VhbGx5IG1hbmFnZSB0byB3b3JrIGZpbmUgZXZlbiBpZiBzb21lIHpv
bWJpZQogICAgICAgIGVudHJpZXMgZXhpc3QgYnV0IGl0IGlzIGEgZ29vZCBwcmFjdGljZSB0byBj
bGVhbiB0aGVtLjxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBZZWFoLCBJJ3ZlIGJlZW4g
dGhyb3VnaCBldmVyeSBwb3NzaWJsZSBjb21iaW5hdGlvbiBvZgogICAgICBsaXN0LXJ1di9jbGVh
bi1ydXYuwqAgSSBoYXZlIHNvbWV0aGluZyBvZGQgZ29pbmcgb24gaW4gdGhhdCBubwogICAgICBy
ZXBsaWNhdGlvbiBhZ3JlZW1lbnRzIHNob3cgdXAgYW55d2hlcmUgZm9yIGZyZWVpcGEtZGFsLjxi
cj4KICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAy
MDJAcmVkaGF0LmNvbSI+IDxicj4KICAgICAgICByZWdhcmRzPGJyPgogICAgICAgIHRoaWVycnk8
YnI+CiAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgIGNpdGU9Im1pZDpmZTUyNTlmMy1hZTRh
LTgzODktNTQyNS05Yjg0YjExYjcxZDVAYnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICAgICAg
dHlwZT0iY2l0ZSI+CiAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6
NTk4QURFN0YuMzA4MDMwOEByZWRoYXQuY29tIj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDA4LzA4LzIwMTcgMTA6MzMgUE0sIElh
bgogICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6PGJyPgogICAg
ICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgICAgICBjaXRl
PSJtaWQ6MmY2MGM0YWYtNjgwYy00MzgyLTk3MDQtNDFhMjRjODEyMWEyQGJyb3ducGFwZXJ0aWNr
ZXRzLmNvbSIKICAgICAgICAgICAgICB0eXBlPSJjaXRlIj4KICAgICAgICAgICAgICA8bWV0YSBo
dHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsKICAgICAgICAgICAg
ICAgIGNoYXJzZXQ9dXRmLTgiPgogICAgICAgICAgICAgIDxwPk9uIDgvNy8xNyAxOjQ0IEFNLCB0
aGllcnJ5IGJvcmRheiB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPC9wPgogICAgICAgICAgICAg
IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgICBjaXRlPSJtaWQ6NTk4ODI4
NzEuMTAwMDEwNkByZWRoYXQuY29tIj4KICAgICAgICAgICAgICAgIDxtZXRhIGNvbnRlbnQ9InRl
eHQvaHRtbDsgY2hhcnNldD11dGYtOCIKICAgICAgICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29u
dGVudC1UeXBlIj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcvMjAxNyAw
OToyMiBBTSwKICAgICAgICAgICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHZpYSBGcmVl
SVBBLXVzZXJzIHdyb3RlOjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUKICAgICAgICAgICAgICAgICAgY2l0ZT0ibWlkOjMzMWVmYjY3LWRkM2It
MjM1MC0zNDcwLTVkMWE5YjkyNTJjM0ByZWRoYXQuY29tIgogICAgICAgICAgICAgICAgICB0eXBl
PSJjaXRlIj5PbiAwOC8wNC8yMDE3IDExOjAyIFBNLCBJYW4gSGFyZGluZyB2aWEKICAgICAgICAg
ICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICA8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIj5PbiA4LzQvMTcgMjoxNiBBTSwgRmxvcmVuY2UKICAgICAgICAg
ICAgICAgICAgICBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDMv
MjAxNyAxMToxMyBQTSwgSWFuCiAgICAgICAgICAgICAgICAgICAgICBIYXJkaW5nIHZpYSBGcmVl
SVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4IEFNLAogICAgICAgICAgICAgICAgICAgICAg
ICBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAxMTo1MSBQTSwKICAgICAg
ICAgICAgICAgICAgICAgICAgICBJYW4gSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTog
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9u
IDA4LzAyLzIwMTcgMTI6MTEKICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFNLCBGbG9yZW5j
ZSBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
bG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMDE6NDMKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgQU0sIElhbiBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAxMjowMyBQTSwgUm9iIENyaXR0ZW5kZW4gd3Jv
dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl
PSJjaXRlIj5JYW4gSGFyZGluZwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Jv
dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5
cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgMDc6MzkgQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDA4LzAxLzIwMTcgMDM6MTEgUE0sIElhbiBIYXJkaW5nCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMDgvMDEvMjAxNyAwMTo0OCBBTSwgRmxvcmVu
Y2UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3
cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2Nr
cXVvdGUgdHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgMDgvMDEvMjAxNyAwMTozMiBBTSwgSWFuCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT24gMDcvMzEvMjAxNyAxMTozNCBBTSwg
Um9iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ3JpdHRlbmRl
biB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycwogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
PkkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaGFkIGFu
IHVuZXhwZWN0ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgcmVzdGFydCBvZiBhbiBJUEEgc2VydmVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHRoYXQgaGFkIGFwcGFyZW50bHkgaGFkCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXBkYXRlcyBydW4gYnV0IGhhZCBub3QKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmVlbiByZXN0YXJ0
ZWQuIGlwYWN0bAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBzYXlzIHBraS10b21jYXRkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgd291bGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBub3Qgc3RhcnQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBTdHJhbmdlbHksIHRoZSBhY3R1YWwKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2VydmljZSBhcHBlYXJzIHRvIGJlCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ1bm5pbmc6IDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIGlzIGFuIGFw
cGxpY2F0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3
aXRoaW4gdG9tY2F0IHNvIHRvbWNhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgY2FuIHJ1biB3aXRob3V0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBXZSBuZWVkIHRvIHNlZSBtb3JlIG9mIHRoZQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIGRlYnVnIGxvZyB0byBz
ZWUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdoYXQgaXMg
Z29pbmcgb24uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Js
b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEl0IGxvb2tzIGxp
a2UgYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRoZW50
aWNhdGlvbiBwcm9ibGVtLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNTTCBoYW5kc2hha2UgaGFwcGVu
ZWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENvdWxk
IG5vdCBjb25uZWN0IHRvIExEQVAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBzZXJ2ZXIgaG9zdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHNlYXR0bGVuZnMuYnB0LnJvY2tzIHBvcnQKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA2MzYgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEVycm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgbmV0c2NhcGUubGRhcC5MREFQRXhjZXB0aW9uOgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhlbnRpY2F0aW9uIGZhaWxlZCAoNDkpIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGRvZ3RhZyBzdG9yZXMgaXRzIGludGVybmFsCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGRhdGEgaW4gdGhlIExEQVAgc2VydmVyIGFuZAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuZWVkcyB0byA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVzdGFibGlzaCBhIHNlY3VyZSBMREFQCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rpb24uIFlvdSBj
YW4gY2hlY2sgaG93CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRo
aXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25uZWN0
aW9uIGlzIGNvbmZpZ3VyZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9jYS9DUy5jZmcsCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGxvb2sgZm9yIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOiA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xDbGllbnRBdXRoCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49
Y249RGlyZWN0b3J5CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1h
bmFnZXIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRl
cm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5hbGRiCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vi
c3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0
LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu
dGVybmFsZGIubGRhcGNvbm4uaG9zdD12bS0uLi4KCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5wb3J0PTYzNiA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGNvbm4uc2VjdXJlQ29ubgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgYXV0aHR5cGUgY2FuIGJlIFNzbENsaWVudEF1dGgKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGgg
YSBzc2wgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0
aWZpY2F0ZSkgb3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEgYmluZCBETgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBhbmQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBwYXNzd29yZCBzdG9yZWQgaW4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29y
ZC5jb25mKS4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlvdSBjYW4gdXNlIHRoaXMgaW5mb3JtYXRp
b24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdG8gbWFudWFsbHkg
Y2hlY2sgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRl
bnRpYWxzLiBGb3IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBpbnN0YW5jZSB3aXRoIHNzbGNsaWVudGF1dGg6IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBleHBvcnQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgTERBUFRMU19DQUNFUlRESVI9L2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcwogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBMREFQVExTX0NFUlQ9J3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJsZGFwczovLyIK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNl
bmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXBzOi8v
Ij5sZGFwczovLzwvYT48L2E+YGhvc3RuYW1lYDo2MzYKCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlkZSB0aGUgcGFzc3dvcmQg
ZnJvbQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9w
a2ktdG9tY2F0L2FsaWFzL3B3ZGZpbGUudHh0KQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczogPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xD
bGllbnRBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRo
LmJpbmRETj11aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5hbGRiCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnRO
aWNrbmFtZT1zdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLmNsb25lUmVwbGljYXRpb25Qb3J0PTM4OQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGFuZCB3aGVuIEkgdHJ5IHRoZSBsZGFwc2VhcmNoIEkKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGFtIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IHRvCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcm92aWRlIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGEgcGluL3Bhc3N3b3JkIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIFBsZWFzZSBlbnRlciBwaW4sIHBhc3N3b3JkLCBvcgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFzcyBwaHJhc2UgZm9yIHNlY3VyaXR5IHRv
a2VuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnbGRhcCgwKSc6IDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZCBm
aWxlLi4uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBhcmUg
cmlnaHQsIGluIDQuNC4gdGhlcmUgaXMgbm8KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBwd2RmaWxlLnR4dCBhbmQgdGhlIHBhc3N3b3JkIGNhbgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGJlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBmb3VuZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICh3aXRoIHRoZSB0YWcgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsPS4uLikgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRoCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIHRhZyBpbnRlcm5hbD0uLi4gYWxsb3dzIHRv
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVhZCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPyA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWwgLUsgLWQK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0
L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlk
ZSBwYXNzd29yZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Js
b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhhdCB3b3Jrcy4uLiA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IENoZWNraW5nIHRva2VuICJOU1MKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIHNsb3QgIk5TUyBV
c2VyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFByaXZhdGUgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZp
Y2VzIiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3
b3JkIG9yIFBpbiBmb3IgIk5TUwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBD
ZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Jmx0OyAwJmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMGYzMjdl
NzYwYTdlZWNkY2Y2OTczZjVkYzU3Y2E1MzY3YzU5MmQ2NMKgwqAKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgKG9ycGhhbikgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAmbHQ7IDEmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBiMTI1ODBjN2M2OTZjZmNkOGFlZmM5NDA1YTdhODcwYjI0YjdiOTZhwqDCoAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQjphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtp
LWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAyJmd0OyBy
c2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgODgxYjcyNTRjNDBmYTQwYmM1
MDY4MWJjYzhkMzdiYjNlYjQ5OTM3ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Y2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7
IDMmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlhMjU1YTFk
MTU1ODVhYzI4MDY0YzBmNDk4NmU0MTZiYzQ4NDAzwqDCoAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBEQjpvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAzZmI2MDlkMGY3ZDcyYzJkMzI1ZDZhMmRjMTY1NzdhN2Y3
ZTVhMDFmCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNlcnZlci1DZXJ0IDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDUmZ3Q7IHJzYQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAxZTk0NzlhOTU1NmFmOTMzOWJiNWU0NTUyY2Ni
ZDM4MWQzYzM4ODU2wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1Mg
Q2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQjpz
dWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhp
cyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIHBhc3N3b3JkIGZyb20gcGFzc3dvcmQuY29uZikgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICMgbGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWZy
ZWV0ZXh0IiBocmVmPSJsZGFwczovLyI+bGRhcHM6Ly88L2E+PC9hPmBob3N0bmFtZWA6NjM2Cgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtYiAiIiAtcyBiYXNlIC1ZIEVYVEVS
TkFMIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVy
IHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgcGhyYXNlIGZvciBzZWN1cml0eSB0b2tlbiAnbGRhcCgwKSc6CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgU0FTTC9FWFRFUk5BTCBhdXRoZW50aWNhdGlvbiBzdGFydGVkCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgbGRhcF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczoKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgSW52YWxpZCBjcmVkZW50aWFscyAoNDkpIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgc29tZXdoZXJlIHRob3VnaCwgc2luY2UgaWYgSSBwdXQgaW4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIG5vbnNlbnNlIG9yIGluY29ycmVjdCBwYXNzd29yZCBpdAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBqdXN0IHByb21wdHMgb3ZlciBhbmQgb3Zlci4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGZyb20gd2hhdCB0byB3aGF0PyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGVyZSB3
YXNuJ3QgbXVjaCBvZiBhIGNoYW5nZS4uLiBJIGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBhc3N1bWVkIHNvbWVvbmUgcmFuIHl1bSB1cGdyYWRlIGFuZAogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIGRpZG4ndCByZXN0YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2Uu
Li4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdCBsb29rcyBsaWtlIG5vdCBtdWNo
IG9mIGEgdmVyc2lvbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNoYW5nZSB0aG91
Z2guIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIyBncmVwIGlwYSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDU6MzIgSW5zdGFsbGVkOgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNl
bnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC1jb21tb24tNC40LjAtMTQu
ZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNiBVcGRhdGVk
OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxpYmlwYV9oYmFjLTEuMTQuMC00My5l
bDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4
IDA0OjQ2OjA3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9u
LWxpYmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NAogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg
MDQ6NDY6MDggSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhv
bi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2Fy
Y2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxlZDoKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEu
MS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4x
LjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNl
bnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQu
ZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVk
OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdf
My40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0
OjQ3OjE3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVu
dC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3
OjIzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci00
LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjI3
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMt
NC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0Nzoz
NiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXB5dGhvbi1j
b21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw
NDo1MDowNyBFcmFzZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXB5dGhv
bi00LjIuMC0xNS4wLjEuZWw3LmNlbnRvcy4xOS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5
OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNvbW1v
bi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0
MiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29t
bW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1
OjQzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1j
b21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6
NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlw
YWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1
NTo0NCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBh
Y2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5
OjU1OjQ1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1p
cGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjgg
MDk6NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtYWRt
aW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAw
OTo1NTo0NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGll
bnQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6
NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLTQu
NC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVw
ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMtNC40
LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBk
YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00
LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAjIGdyZXAgcGtpIC92YXIvbG9nL3l1bS5sb2cgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNSBVcGRhdGVkOgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xNC5lbDdfMy5ub2Fy
Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowOSBV
cGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtyYjUtcGtpbml0LTEuMTQu
MS0yNy5lbDdfMy54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph
biAwOCAwNDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
cGtpLWJhc2UtamF2YS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTkgVXBkYXRlZDoKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIxIFVwZGF0ZWQ6CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQuZWw3XzMu
bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6
MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMu
My0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph
biAwOCAwNDo0NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBr
aS1jYS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBKdWwgMjggMTA6MTM6MTYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2gg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRh
dGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTku
ZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjgg
MTA6MTM6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktc2Vy
dmVyLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHBraS1rcmEtMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgcGtpLWNhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg
dHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFyZSB5
b3UgcnVubmluZyBpbiBTRUxpbnV4IGVuZm9yY2luZwogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgbW9kZT8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxv
Y2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIyBnZXRlbmZvcmNlIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBFbmZvcmNpbmcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl
PSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWYgc28gY2Fu
IHlvdSBydW46IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0gQVZDIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0gQVZDIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0aW9uIHRvIGxv
Z19mb3JtYXQgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXByZWNhdGVkLiBQ
bGVhc2UgdXNlIHRoZSB3cml0ZV9sb2dzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
b3B0aW9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlIE5PTE9HIG9w
dGlvbiBpcyBvdmVycmlkaW5nIHRoZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdy
aXRlX2xvZ3MgY3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGltZS0mZ3Q7
TW9uIE1hciAxNCAxMDozOTowMSAyMDE2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICB0eXBlPVNZU0NBTEwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtc2c9YXVk
aXQoMTQ1Nzk3NzE0MS43Njc6MTc1MzcpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0yIHN1Y2Nlc3M9bm8KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBleGl0PS0xMyBhMD03ZmJjYWIwMzhkMTAgYTE9ODAwIGEyPTEKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBhMz03ZmJjYTYwZjQyZTAgaXRlbXM9MCBwcGlkPTE0MDYK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaWQ9MTI5NjUgYXVpZD00Mjk0OTY3Mjk1
IHVpZD0wIGdpZD0wCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXVpZD01ODE0MDAw
MDEgc3VpZD0wIGZzdWlkPTU4MTQwMDAwMQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGVnaWQ9NTgxNDAwMDAxIHNnaWQ9MCBmc2dpZD01ODE0MDAwMDEKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICB0dHk9KG5vbmUpIHNlcz00Mjk0OTY3Mjk1IGNvbW09InNzaGQiCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBzdWJqPXN5c3RlbV91OnN5c3RlbV9yOnNzaGRfdDpzMC1z
MDpjMC5jMTAyMwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtleT0obnVsbCkgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgbXNnPWF1ZGl0KDE0NTc5NzcxNDEuNzY3OjE3NTM3KTogYXZjOsKg
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9
MTI5NjUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb21tPSJzc2hkIiBuYW1lPSJh
dXRob3JpemVkX2tleXMiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGV2PSJkbS0y
IiBpbm89MTE2MzkzNTE3CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9
c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgdGNvbnRleHQ9c3lzdGVtX3U6b2JqZWN0X3I6dW5sYWJlbGVkX3Q6czAK
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGNsYXNzPWZpbGUgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlw
ZT0iY2l0ZSI+SSBzdXNwZWN0IHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IHRoZSBzdWJzeXN0ZW0gY2VydCB3YXMgcmVuZXdlZCBhbmQKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGV2ZXJ5dGhpbmcgd2Fzbid0IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHVwZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0aGlzIGlzCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1bnJlbGF0ZWQgdG8gdGhlIHVwZ3JhZGUgaXQg
anVzdCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBhIHNwb3Rs
aWdodCBvbiBpdC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2FuIHlvdSBydW4gdGhlc2UgY29tbWFu
ZHM6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3Rv
cnkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl
LG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0
ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBUaGlzIHJldHVybnMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249
ZGlyZWN0b3J5CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv
PWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRl
c2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQ
IFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG46IHVpZD1w
a2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
TUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtE
QWxDCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIC4uLiBzdHVmZiAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPmFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNl
cnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9w
a2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vi
c3lzdGVtQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBr
aS1jYScgfCBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAjIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj
L3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxv
Y2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgVGhlc2UgYm90aCByZXR1cm4gPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAj
IGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kv
cGtpLXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdzdWJz
eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8IGdyZXAKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBh
c3N3b3JkIG9yIFBpbiBmb3IgIk5TUwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENl
cnRpZmljYXRlIERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1
dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09JRDogVW5yZWNvZ25pemVkCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzwqAgLW4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j
YScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBDaGVj
a2luZyB0b2tlbiAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNh
dGUgREIiIGluIHNsb3QgIk5TUyBVc2VyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
UHJpdmF0ZSBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiOiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lEOiBV
bnJlY29nbml6ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPYmplY3QgSWRlbnRp
Zmllci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBtYWRlIGEgdHlwbyBhbmQgcmVxdWVzdGVkIHRo
ZSBrZXlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICgtSykgaW5zdGVhZCBvZiB0aGUg
Y2VydHMgKC1MKS4gUGxlYXNlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHJ5IHdp
dGggLUwgYW5kIHlvdSBzaG91bGQgYmUgYWJsZSB0bwogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBzZWUgdGhlIGNlcnRpZmljYXRlIHNlcmlhbC4gPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj
YSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5
dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0Zj
PQoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgU3Vic3lzdGVtLE89QlBULlJPQ0tTIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNvIHRoZSBzZXJpYWwgaXMg
ND8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5
c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAg
U2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAg
U2VyaWFsIE51bWJlcjogMTM0MTcxODU0MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgKDB4
NGZmOTAwMGQpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0
bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAv
ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURB
ME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBBbmQgdGhpcyBjZXJ0IGlzIE5P
VCB0aGUgc2FtZS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAg
ICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICB3aGVuIGNlcnRtb25nZXIgcmVuZXdzIGEgY2VydGlmaWNhdGUsIGl0IHJ1bnMK
ICAgICAgICAgICAgICAgICAgICAgICAgICBwcmUtc2F2ZSBhbmQgcG9zdC1zYXZlIGNvbW1hbmRz
ICh3aGljaCB5b3UgY2FuCiAgICAgICAgICAgICAgICAgICAgICAgICAgc2VlIGluIHRoZSBvdXRw
dXQgb2YgZ2V0Y2VydCBsaXN0KS4gSW4geW91cgogICAgICAgICAgICAgICAgICAgICAgICAgIGNh
c2UsIHRoZSBwb3N0LXNhdmUgY29tbWFuZCBmb3Igc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAg
ICAgICAgICAgICAgIGNlcnQtcGtpLWNhIHByb2JhYmx5IGZhaWxlZC4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBUaGlzIGNvbW1h
bmQgKG9uIHRoZSByZW5ld2FsIG1hc3RlcikgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICBy
ZXNwb25zaWJsZSBmb3IgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0aGUKICAgICAgICAgICAg
ICAgICAgICAgICAgICBOU1MgZGIgdG8gdGhlIExEQVAgc2VydmVyLiBZb3UgbmVlZCBmaXJzdCB0
bwogICAgICAgICAgICAgICAgICAgICAgICAgIGNoZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMgdGhl
IHJlbmV3YWwgbWFzdGVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgKGFzIHRoZSBzZXJpYWwg
bnVtYmVycyBhcmUgaW4gYSBjb21wbGV0ZWx5CiAgICAgICAgICAgICAgICAgICAgICAgICAgZGlm
ZmVyZW50IHJhbmdlLCBJIGFzc3VtZSB0aGF0IHlvdSBoYXZlCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgbXVsdGlwbGUgSVBBIHNlcnZlcnMgY29uZmlndXJlZCB3aXRoIGEgQ0EKICAgICAgICAg
ICAgICAgICAgICAgICAgICBpbnN0YW5jZSk6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgJCBleHBvcnQgQkFTRUROPWBncmVwIGJh
c2VkbgogICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvaXBhL2RlZmF1bHQuY29uZiB8IGN1
dCAtZD0gLWYyLWAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQga2luaXQgYWRtaW4g
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBo
b3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICAgICAgR1NTQVBJIC1iICJj
bj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VETiIKICAgICAgICAgICAgICAgICAgICAgICAg
ICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FSZW5ld2FsTWFzdGVyKSknCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGRu
OgogICAgICAgICAgICAgICAgICAgICAgICAgIGNuPUNBLGNuPXZtLWlwYXNlcnZlci5pcGFkb21h
aW4uY29tLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0YyxkYz1pcGFkb21haW4sZGM9Y29tCgogICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgSW4gdGhpcyBleGFtcGxlIHRoZSByZW5ld2FsIG1h
c3RlciBpcwogICAgICAgICAgICAgICAgICAgICAgICAgIHZtLWlwYXNlcnZlci4gPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9j
a3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgIEkgZ2V0IHRoaXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5
IC1ZCiAgICAgICAgICAgICAgICAgICAgICAgIEdTU0FQSSAtYiAiY249bWFzdGVycyxjbj1pcGEs
Y249ZXRjLCRCQVNFRE4iCiAgICAgICAgICAgICAgICAgICAgICAgICcoJmFtcDsoY249Q0EpKGlw
YUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScKICAgICAgICAgICAgICAgICAgICAgICAg
ZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgICAgICAg
ICAgY249Q0EsY249ZnJlZWlwYS1zZWEuYnB0LnJvY2tzLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0
YyxkYz1icHQsZGM9cm9ja3MKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIHRoZSBv
dGhlciBGcmVlSVBBIHNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICBI
aSBJYW4sIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgIGl0J3MgZ2V0dGluZyBkaWZmaWN1bHQgdG8gZm9sbG93IHRoaXMgdGhyZWFkLCBzbwogICAg
ICAgICAgICAgICAgICAgICAgY291bGQgd2Ugc3RlcCBiYWNrIGFuZCBzdW1tYXJpemU/IDxicj4K
ICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgWWVz
LCBpdCBpcy7CoCBTb3JyeS4gPGJyPgogICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5
cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBh
LXNlYSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlIENBCiAgICAgICAgICAgICAgICAgICAgICBjb21w
b25lbnQgaXMgaW5zdGFsbGVkIGFuZCAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAg
ICAgY2VydC1wa2ktY2EnIGhhcyBTZXJpYWwgbnVtYmVyIDQgaW4gdGhlIE5TU0RCCiAgICAgICAg
ICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgTm8/IDxicj4KICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEg
aWFuaF0jIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRv
bWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgIGNlcnQtcGtp
LWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDC
oMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpIDxicj4KICAgICAgICAg
ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4tIE9uIHNlcnZlciBzZWF0dGxlbmZz
CiAgICAgICAgICAgICAgICAgICAgICAod2hlcmUgUEtJIGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUg
Q0EgY29tcG9uZW50IGlzCiAgICAgICAgICAgICAgICAgICAgICBpbnN0YWxsZWQgYW5kICdzdWJz
eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyBoYXMKICAgICAgICAgICAgICAgICAgICAgIFNlcmlhbCBu
dW1iZXIgMTM0MTcxODU0MSBpbiB0aGUgTlNTREIKICAgICAgICAgICAgICAgICAgICAgIC9ldGMv
cGtpL3BraS10b21jYXQvYWxpYXMuIDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv
dGU+CiAgICAgICAgICAgICAgICAgICAgWWVzIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwg
LWQKICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJz
eXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwg
PGJyPgogICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAgU2VyaWFsIE51bWJlcjog
MTM0MTcxODU0MSAoMHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgLSBJbiB0aGUgTERBUCBzZXJ2ZXJzLCB0aGUgY2VydCBpcyBzdG9yZWQgaW4g
dGhlCiAgICAgICAgICAgICAgICAgICAgICBlbnRyeSB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv
PWlwYWNhIHdpdGggU2VyaWFsCiAgICAgICAgICAgICAgICAgICAgICBudW1iZXIgNCAoaS5lLiBp
dCBpcyB0aGUgY2VydCBmcm9tIGZyZWVpcGEtc2VhKS4gPGJyPgogICAgICAgICAgICAgICAgICAg
IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICBUaGlzIGlzIHdoZXJlIHRoZSBkaWZm
ZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28KICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0
ZXMgb24gdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24gdGhlCiAgICAgICAgICAgICAgICAgICAg
b3RoZXIuwqAgSSB3b25kZXIgaWYgdGhpcyBpcyBhIHJlc3VsdCBvZiB0aGUgc2xvdwogICAgICAg
ICAgICAgICAgICAgIG1vdGlvbiByZXBsaWNhdGlvbiB0cmFpbndyZWNrIEkgaGF2ZSBnb2luZyBv
biBkdWUgdG8KICAgICAgICAgICAgICAgICAgICBhIHpvbWJpZSByZXBsaWNhIGluIHRoZSBsZGFw
IGRhdGFiYXNlIHRoYXQgbm8gbG9uZ2VyCiAgICAgICAgICAgICAgICAgICAgZXhpc3RzIGluIHRo
ZSByZWFsIHdvcmxkIGFuZCBJIGNhbid0IHNlZW0gdG8gZ2V0IHJpZAogICAgICAgICAgICAgICAg
ICAgIG9mLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgdGhlIHJlbWFpbmluZyBpc3N1ZSBpcyBhIHJlcGxpY2F0
aW9uIHByb2JsZW0uIFRoZXJlIGlzCiAgICAgICAgICAgICAgICAgIGEgIlRyb3VibGVzaG9vdGlu
ZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBbMV0gaW4gSWRNCiAgICAgICAgICAgICAgICAgIEFkbWlu
IGd1aWRlIHRoYXQgbWF5IGhlbHAgeW91LiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1h
bmRzIGRpZCB5b3UKICAgICAgICAgICAgICAgICAgdXNlIHRvIHRyeSB0byByZW1vdmUgaXQsIGFu
ZCB3aGF0IHdhcyB0aGUgb3V0cHV0PyA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICBbMV0gPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKaHJlZj0iaHR0cHM6Ly9h
Y2Nlc3MucmVkaGF0LmNvbS9kb2N1bWVudGF0aW9uL2VuLVVTL1JlZF9IYXRfRW50ZXJwcmlzZV9M
aW51eC83L2h0bWwvTGludXhfRG9tYWluX0lkZW50aXR5X0F1dGhlbnRpY2F0aW9uX2FuZF9Qb2xp
Y3lfR3VpZGUvdHJvdWJsZS1nZW4tcmVwbGljYXRpb24uaHRtbCIKICAgICAgICAgICAgICAgICAg
ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1l
bnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFp
bl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJl
cGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBI
aSw8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBUbyBkZWJ1ZyByZXBs
aWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAgICAgICAgICAgICAg
c2V2ZXJhbCBpbmZvIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRzIG9mIHRoZQogICAgICAg
ICAgICAgICAgZm9sbG93aW5nIGNvbW1hbmRzPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRAog
ICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAg
ICAgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiIG5zY3BlbnRyeXdzaTxicj4KICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEg
aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgICAgbWFu
YWdlcicgLVcgLWIgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiCiAgICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpPGJyPgogICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxi
cj4KICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4K
ICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv
PWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaToKICAgICAgICAgICAgICBlbnRy
eXVzbjthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAw
NToKICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgwqA3NTI3NDg5Nzxicj4KICAgICAg
ICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgICAgICAgbW9kaWZ5VGltZXN0YW1wO2FkY3Nu
LTU5MzhlNjg4MDAwMTA0MjkwMDA0O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0Mjxicj4KICAgICAgICAg
ICAgICDCoDkwMDA0OiAyMDE3MDYwODA1NTMzNFo8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOgogICAgICAgICAgICAgIG1vZGlmaWVyc05hbWU7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAw
MDM7dnVjc24tNTkzOGU2ODgwMDAxMDQyOTA8YnI+CiAgICAgICAgICAgICAgwqAwMDM6IGNuPURp
cmVjdG9yeSBNYW5hZ2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogbnNVbmlxdWVJ
ZDoKICAgICAgICAgICAgICA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4K
ICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGNuOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAg
ICAgICAgICAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFn
ZXI8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBkZXNjcmlwdGlvbjt2dWNzbi01OTM4
ZTY4ODAwMDEwNDI5MDAwMToKICAgICAgICAgICAgICAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWM8
YnI+CiAgICAgICAgICAgICAgwqBhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5
c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAg
ICAgICAgZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVsZXRlZDoKICAg
ICAgICAgICAgICAyOzQ7Q049Q2VydGlmaWNhPGJyPgogICAgICAgICAgICAgIMKgdGUgQXV0aG9y
aXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICAg
ICAgICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog
b2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENs
YXNzOiBwZXJzb248YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczog
b3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmpl
Y3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9i
amVjdENsYXNzOiBjbXN1c2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxz
bzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRy
eXdzaTogc246IHBraWRidXNlcjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVpZDog
cGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRl
OjoKICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNG
QURBME1SPGJyPgogICAgICAgICAgICAgICZsdDtzbmlwJmd0Ozxicj4KwqBjQmQ0bk9WNG05QStx
UlpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz08YnI+CiAgICAg
ICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU7dnVjc24tNTkzOGU2ODgwMDAx
MDQyOTAwMDA6OgogICAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8YnI+CiAgICAgICAg
ICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgICAgICAgIMKgQVI8YnI+CiAgICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAg
ICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAgICAgICAgICAgbnNjcGVu
dHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdz
aTogcGFyZW50aWQ6IDI8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1
MTxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAgICAgICAgICAg
ICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IGFuZDxicj4KICAgICAg
ICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249
ZGlyZWN0b3J5CiAgICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2VyLG91
PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAg
ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBbcm9v
dEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAg
ICAgICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EK
ICAgICAgICAgICAgICBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgICAgICAgRW50ZXIgTERBUCBQ
YXNzd29yZDogPGJyPgogICAgICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv
PWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIs
b3U9cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNv
OiBDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lC
QkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICAgICAgICAgJmx0O3NuaXAmZ3Q7
PGJyPgrCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhk
ZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uOiAy
OzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049
Q0EgU3Viczxicj4KICAgICAgICAgICAgICDCoHlzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAg
ICAgICAgIG5zY3BlbnRyeXdzaTogZW50cnlpZDogNTE8YnI+CiAgICAgICAgICAgICAgbnNjcGVu
dHJ5d3NpOiBwYXJlbnRpZDogMjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG1vZGlm
eVRpbWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdz
aTogY3JlYXRlVGltZXN0YW1wOiAyMDE1MDcxNjEyNTE0Nlo8YnI+CiAgICAgICAgICAgICAgbnNj
cGVudHJ5d3NpOiBtb2RpZmllcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAgICAg
ICAgICAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8
YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZn
dDs8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAg
ICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAg
ICAgIG5zY3BlbnRyeXdzaTogbWFpbDo8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBj
bjogcGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc246IHBraWRidXNl
cjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVpZDogcGtpZGJ1c2VyPGJyPgogICAg
ICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAg
ICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICAgICAgICAgICAgbnNj
cGVudHJ5d3NpOiBvYmplY3RDbGFzczogb3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICAgICAg
ICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj4KICAgICAg
ICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1c2VyPGJyPgogICAgICAgICAg
ICAgIG5zY3BlbnRyeXdzaTogbnNVbmlxdWVJZDoKICAgICAgICAgICAgICA0ODgwOWI0MC0yYmI5
MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGVu
dHJ5dXNuOiA4Njxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAg
ICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IDxicj4K
ICAgICAgICAgICAgICAgIEZyb20gdGhlIG91dHB1dCB5b3UgbWF5IG9ubHkgY29weS9wYXN0IHRo
ZSBvbmVzIHJlbGF0ZWQKICAgICAgICAgICAgICAgIHRvIHVzZXJDZXJ0aWZpY2F0ZTxicj4KICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIEFs
c28gdG8gZHVtcCB0aGUgY3VycmVudCByZXBsaWNhdGlvbiBzdGF0dXMsIHNlbmQgdGhlCiAgICAg
ICAgICAgICAgICByZXN1bHTCoCBvZjxicj4KICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEt
c2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICdjbj1kaXJlY3Rv
cnkgbWFuYWdlcicgLVcgLWIgIm89aXBhY2EiPGZvbnQgc2l6ZT0iLTEiPjxpPgogICAgICAgICAg
ICAgICAgICA8L2k+IigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1m
ZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAgICAgICAgICAgICAg
IDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFu
aF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgICAgbWFuYWdl
cicgLVcgLWIgIm89aXBhY2EiCiIoJmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5p
cXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAg
ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgIGRuOiBjbj1yZXBs
aWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgICAg
ICAgIGNuOiByZXBsaWNhPGJyPgogICAgICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAg
ICAgICAgICAgbnNEUzVSZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAg
ICAgICAgICAgY2xvbmVBZ3JlZW1lbnQxLWZyZWVpcGEtc2VhLmJwdC5yb2M8YnI+CiAgICAgICAg
ICAgICAgwqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICAgICAg
ICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICAgICAg
ICAgIG1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9jPGJyPgogICAgICAgICAgICAg
IMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgICBu
c0RTNVJlcGxpY2FJZDogMTA2NTxicj4KICAgICAgICAgICAgICBuc0RTNVJlcGxpY2FOYW1lOiBi
MjFhMWYxZS02Mjc5MTFlNi05M2U2ZWY0Yi02OWRjYzJkMTxicj4KICAgICAgICAgICAgICBuc0RT
NVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zRFM1UmVwbGljYVR5cGU6
IDM8YnI+CiAgICAgICAgICAgICAgbnNTdGF0ZTo6CiAgICAgICAgICAgICAgS1FRQUFBQUFBQUFo
SElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAg
ICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAgICAgICAgICAg
ICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICAgICAgICAg
ICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cGNo
ZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgICAgICAgIG9iamVjdENsYXNzOiB0b3A8YnI+CiAg
ICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgICAgICBv
YmplY3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICAgICAgICBuc2RzNTBydXY6
IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkwMDAwMDQyOTAwMDA8YnI+CiAgICAgICAgICAg
ICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAg
ICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAg
ICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEt
c2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8
YnI+CiAgICAgICAgICAgICAgwqAwIDU5OGExYzQwMDAwMTA0MjkwMDAwPGJyPgogICAgICAgICAg
ICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAg
ICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAg
ICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVu
ZnMuYnB0LnJvY2tzOjM4OTwvYT59PGJyPgogICAgICAgICAgICAgIG5zZHM1YWdtdG1heGNzbjoK
ICAgICAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9j
a3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgICAgICAgICAgIMKgdGxlbmZzLmJwdC5yb2Nrczsz
ODk7dW5hdmFpbGFibGU8YnI+CiAgICAgICAgICAgICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAg
ICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2kt
dG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgICAgICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1bmF2
YWlsYWJsZTxicj4KICAgICAgICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBs
aWNhIDEwNjUgPGEKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQi
CiAgICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSIK
ICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9Im1vei10eHQt
bGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxk
YXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPjwvYT59CiAgICAgICAgICAgICAgNTk4
YTxicj4KICAgICAgICAgICAgICDCoDFjMTY8YnI+CiAgICAgICAgICAgICAgbnNydXZSZXBsaWNh
TGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96
LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVu
ZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+
PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMu
YnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT48L2E+fQog
ICAgICAgICAgICAgIDAwMDAwPGJyPgogICAgICAgICAgICAgIMKgMDAwPGJyPgogICAgICAgICAg
ICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiA4ODU8YnI+CiAgICAgICAgICAgICAgbnNkczVy
ZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj
aXRlIgogICAgICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNv
bSI+PGZvbnQgc2l6ZT0iLTEiPgogICAgICAgICAgICAgICAgICBhbmQ8YnI+CiAgICAgICAgICAg
ICAgICA8L2ZvbnQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAg
ICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250
IHNpemU9Ii0xIj48aT4KICAgICAgICAgICAgICAgICAgPC9pPiIoJmFtcDsob2JqZWN0Y2xhc3M9
bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm
ZmYpKSI8YnI+CiAgICAgICAgICAgICAgICA8L2ZvbnQ+PC9ibG9ja3F1b3RlPgogICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5m
cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICBt
YW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSko
bnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAg
ICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgZG46IGNu
PXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAg
ICAgICAgICAgY246IHJlcGxpY2E8YnI+CiAgICAgICAgICAgICAgbnNEUzVGbGFnczogMTxicj4K
ICAgICAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIK
ICAgICAgICAgICAgICBjbG9uZUFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9jazxicj4KICAg
ICAgICAgICAgICDCoHMtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAg
ICAgICAgICBuc0RTNVJlcGxpY2FJZDogMTI5MDxicj4KICAgICAgICAgICAgICBuc0RTNVJlcGxp
Y2FOYW1lOiA4NzA2YWIxZS02YTgzMTFlNi1hOWJmZGJiZi03NGRjNzMyMzxicj4KICAgICAgICAg
ICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zRFM1UmVw
bGljYVR5cGU6IDM8YnI+CiAgICAgICAgICAgICAgbnNTdGF0ZTo6CiAgICAgICAgICAgICAgQ2dV
QUFBQUFBQUFLRllwWkFBQUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+
CiAgICAgICAgICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAg
ICAgICAgICAgICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAg
ICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5k
ZG5ncm91cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgICAgICAgIG9iamVjdENsYXNzOiB0
b3A8YnI+CiAgICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAg
ICAgICAgICBvYmplY3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICAgICAgICBu
c2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAwMDA8YnI+CiAg
ICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1ub3Qtc2VuZD0i
dHJ1ZSIKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAg
ICAgICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8v
c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICA1N2JlODA0YzAwMDAw
NTBhMDAwMDxicj4KICAgICAgICAgICAgICDCoCA1ODcyMzYxNTAwMDAwNTBhMDAwMDxicj4KICAg
ICAgICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgbW96LWRvLW5vdC1zZW5kPSJ0
cnVlIgogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAg
ICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8v
ZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgNTdiMTAzZDQwMDAw
MDQyOTAwMDxicj4KICAgICAgICAgICAgICDCoDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAg
ICAgICAgICAgICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAgICAgICAgIG89aXBhY2E7Y2xvbmVB
Z3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ7ZnJlZWk8YnI+CiAgICAg
ICAgICAgICAgwqBwYS1zZWEuYnB0LnJvY2tzOzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAw
PGJyPgogICAgICAgICAgICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5
MCA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAg
ICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAg
ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl
ZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0
dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgICAgICAwMDAwMDxicj4KICAg
ICAgICAgICAgICDCoDAwMDxicj4KICAgICAgICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZp
ZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmst
ZnJlZXRleHQiCiAgICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJv
Y2tzOjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9
Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2Nr
czozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPjwvYT59CiAgICAgICAg
ICAgICAgMDAwMDxicj4KICAgICAgICAgICAgICDCoDAwMDA8YnI+CiAgICAgICAgICAgICAgbnNk
czVSZXBsaWNhQ2hhbmdlQ291bnQ6IDM8YnI+CiAgICAgICAgICAgICAgbnNkczVyZXBsaWNhcmVh
cGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAg
ICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQg
c2l6ZT0iLTEiPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFJlZ2Fy
ZHM8YnI+CiAgICAgICAgICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICAgICAgICA8L2Zv
bnQ+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgICAgICAgICBjaXRlPSJt
aWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAg
ICAgICAgICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj5bcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMKICAgICAgICAgICAgICAgICAgICBs
ZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAg
ICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl
CiAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAg
IEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBr
aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgdXNlckNl
cnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5C
Z2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsgPGJyPgogICAgICAg
ICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhN
Sm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAg
ICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJQkFnSUVUL2tBRFRBTkJna3Foa2lHOXcwQkFRc0ZB
REEwTVJJd0VBWURWUVFLCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICZsdDt0cnVuY2F0ZWQmZ3Q7CiAgICAgICAgICAgICAgICAgICAgZnVRUVptUDFYcktrcmZz
amVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0
aW9uOiAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICBBdXRo
b3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtIDxicj4KICAgICAgICAgICAgICAgICAg
ICDCoCAsTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5o
XSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBt
YW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl
LG89aXBhY2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24g
PGJyPgogICAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAg
ICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICBN
SUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RB
bEMKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3Ry
dW5jYXRlZCZndDsgPGJyPgogICAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dE
bDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICAgIGRl
c2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICBBdXRob3Jp
dHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPIDxicj4KICAgICAgICAgICAg
ICAgICAgICDCoCBDS1MgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlCiAgICAgICAg
ICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZXMgZGF0ZXMsIEkgZ3Vlc3MgdGhhdCB0aGUgbW9zdCBy
ZWNlbnQKICAgICAgICAgICAgICAgICAgICAgIG9uZSBpcyBvbiBzZXJ2ZXIgc2VhdHRsZW5mcyAo
YmVjYXVzZSBvZiBzZXJpYWwKICAgICAgICAgICAgICAgICAgICAgIG51bWJlcnMpLiBDYW4geW91
IGNvbmZpcm0gdGhpcyAoYmVjYXVzZSBvdXIgZ29hbAogICAgICAgICAgICAgICAgICAgICAgaXMg
dG8gaGF2ZSB0aGUgbW9zdCByZWNlbnQgY2VydCBzdG9yZWQgaW4gYWxsIHRoZQogICAgICAgICAg
ICAgICAgICAgICAgTlNTREJzIGFuZCBpbiBMREFQKT8gPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgVGhhbmtzLCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICBGbG8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0
ZSI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklmIHlv
dXIgcmVuZXdhbCBtYXN0ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICBpcyB0aGUgbWFjaGlu
ZSBvbiB3aGljaCB0aGUgTlNTIERCCiAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kv
cGtpLXRvbWNhdC9hbGlhcyBjb250YWlucyB0aGUgbmV3ZXIKICAgICAgICAgICAgICAgICAgICAg
ICAgICBjZXJ0LCB0aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZSBzY3JpcHRzOiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBJZiBJJ20gaW50ZXJwcmV0aW5nIHRoaXMg
Y29ycmVjdGx5LCB0aGVuIGl0CiAgICAgICAgICAgICAgICAgICAgICAgIGlzLi4uIHNvIEkgcmFu
IHRoaXMgb24gdGhlIGJyb2tlbiBtYWNoaW5lCiAgICAgICAgICAgICAgICAgICAgICAgIChzZWF0
dGxlbmZzKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBzdWRvCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3N0b3BfcGtpY2FkIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAkIHN1ZG8KICAgICAgICAgICAgICAgICAgICAgICAgICAv
dXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAg
ICAgICAgICAgICJzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSSByYW4g
dGhpcywgaXQgdG9vayBhIHdoaWxlLCB0aGVuIEkgcmUtY2hlY2tlZAogICAgICAgICAgICAgICAg
ICAgICAgICBhbmQgdGhlIHNlcmlhbCBzdGlsbCBzZWVtcyB0byBiZSA0IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2gg
LUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XCiAgICAgICAgICAgICAgICAgICAgICAg
IC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAg
ICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBkbjog
dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1
Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThY
RW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAg
ICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAgICAgICAgICAg
ICAgICBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEhlcmUncyB3aGF0IHdhcyBpbgogICAgICAgICAg
ICAgICAgICAgICAgICAvdmFyL2xvZy9wa2kvcGtpLXRvbWNhdC9jYS9kZWJ1ZyA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAg
ICAgICA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PSA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0
YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgPT09PT3CoCBERUJVRyBTVUJTWVNU
RU0gSU5JVElBTElaRUTCoMKgID09PT09PT0gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBb
MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg
ICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJl
c3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg
ICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwog
ICAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9T
aHV0ZG93bi5jcnVtYgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0
IGZvcgogICAgICAgICAgICAgICAgICAgICAgICBhdXRvLXNodXRkb3duIHN1cHBvcnQ6YXVkaXRT
aWduaW5nQ2VydAogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0
U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1
ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z
dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0
IGlkPWRlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUy
OjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNF
bmdpbmU6IGluaXRpYWxpemVkIGRlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9bG9nIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9
bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwog
ICAgICAgICAgICAgICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRv
bWNhdC9sb2dzL2NhL3NpZ25lZEF1ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j
YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcKICAg
ICAgICAgICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21j
YXQvbG9ncy9jYS9zeXN0ZW0pCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAgICAgICAg
ICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2NhL3RyYW5z
YWN0aW9ucykKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg
ICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZh
bHNlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6
IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAgICAgICAgICAgIC92
YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iCiAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBD
TVNFbmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yCiAgICAgICAgICAgICAgICAgICAg
ICAgIGF1dG8tc2h1dGRvd24gc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAg
ICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1
Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg
ICAgICAgICBDTVNFbmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2VydAogICAgICAgICAg
ICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFsw
My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAg
ICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQgaWQ9bG9nIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd
OgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGxvZyA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0U3Vi
c3lzdGVtIGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox
Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAg
Q01TRW5naW5lOiByZWFkeSB0byBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93bj8gZmFs
c2UgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog
YXV0b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgICAgICAgICAgICAgL3Zh
ci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1bWIKICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENN
U0VuZ2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IKICAgICAgICAgICAgICAgICAgICAg
ICAgYXV0by1zaHV0ZG93biBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAg
ICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
ICAgICAgIENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAg
ICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgICAgICBDTVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
CiAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQganNzIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJz
eXN0ZW0gaWQ9ZGJzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz
OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBD
TVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9ZGJzIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg
ICAgICAgICAgICAgICAgICBEQlN1YnN5c3RlbTogaW5pdCgpIG1FbmFibGVTZXJpYWxNZ210PXRy
dWUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nIExk
YXBCb3VuZENvbm5GYWN0b3IoREJTdWJzeXN0ZW0pIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg
ICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdCA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv
cC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgTGRhcEJvdW5kQ29ubkZhY3Rvcnk6ZG9DbG9u
aW5nIHRydWUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6
NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIExkYXBB
dXRoSW5mbzogaW5pdCgpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3
OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAg
ICBMZGFwQXV0aEluZm86IGluaXQgYmVnaW5zIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg
ICAgICAgICAgICAgICBMZGFwQXV0aEluZm86IGluaXQgZW5kcyA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICAgICAgaW5pdDogYmVmb3JlIG1ha2VDb25uZWN0aW9uIGVycm9y
SWZEb3duIGlzIHRydWUKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
CiAgICAgICAgICAgICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVl
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBUQ1AgS2VlcC1BbGl2
ZTogdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1
MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgU1NMQ2xp
ZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogU2V0dGluZyBkZXNpcmVkCiAgICAgICAgICAgICAg
ICAgICAgICAgIGNlcnQgbmlja25hbWUgdG86IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z
dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIExkYXBKc3NTU0xTb2NrZXQ6
IHNldCBjbGllbnQgYXV0aCBjZXJ0IG5pY2tuYW1lCiAgICAgICAgICAgICAgICAgICAgICAgIHN1
YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMv
QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg
ICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRTZWxlY3Rpb25DQjogRW50ZXJpbmchIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt
c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogb2Nz
cFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNh
dGVTZWxlY3Rpb25DQjogZGVzaXJlZCBjZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgIGZvdW5k
IGluIGxpc3Q6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg
ICAgICAgICAgICAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6IHJl
dHVybmluZzoKICAgICAgICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j
YSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j
YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgU1NMIGhhbmRzaGFr
ZSBoYXBwZW5lZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1
Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ01T
RW5naW5lLnNodXRkb3duKCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSSByZWFsbHkg
YXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoCiAgICAgICAgICAgICAgICAg
ICAgICAgIHRoaXMuwqAgSSBvd2UgeW91LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgLSBJYW4gPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
PkFmdGVyIHRoYXQsIGNoZWNrIHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgTERB
UCBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUKICAgICAgICAgICAgICAgICAg
ICAgICAgICBjYXNlLCB5b3Ugc2hvdWxkIGJlIGFibGUgdG8gcmVzdGFydCBwa2kuIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgRmxv
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+VGhhbmsgeW91IGFnYWluIGZvcgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgeW91ciB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBJYW4gPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJs
b2NrcXVvdGUgdHlwZT0iY2l0ZSI+RmxvLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgd2hpY2ggc2VlbXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg
dHlwZT0iY2l0ZSI+VGhlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBhdHRyaWJ1dGUgaW4gdGhlIGxkYXBzZWFyY2ggb3V0cHV0IGlzCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBvZiB0aGUgZm9ybSAyOyM7RE47RE4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRoZSBzZXJpYWwgbnVtYmVyCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBpbiB0aGUgZmlyc3QgY2VydHV0aWwgb3V0cHV0IDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5ECiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBoZWFkZXJzKSBzaG91bGQgbWF0Y2ggb25lIG9mIHRo
ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUg
YXR0cmlidXRlcy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcm9iIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg
ICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gPGJyPgog
ICAgICAgICAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhCiAgICAg
ICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAg
ICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9z
dGVkLm9yZyIKICAgICAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEg
Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNl
cnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0
ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgICAgICAgICAg
ICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgICAgICAg
IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmci
CiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJt
b3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZl
QGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3Jh
aG9zdGVkLm9yZzwvYT48L2E+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIF9fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4KICAgICAgICAgICAgICAgICAgRnJlZUlQ
QS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96
LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpm
cmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAg
bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk
IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5mcmVl
aXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9hPgogICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgIFRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8g
PGEKICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgog
ICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3Rz
LmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0
cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJl
ZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5mcmVlaXBhLXVzZXJzLWxl
YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9hPgogICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+
PC9maWVsZHNldD4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPHByZSB3cmFwPSIi
Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZyZWVJUEEt
dXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi
IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIG1vei1k
by1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h
PgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst
YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9y
YWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBs
aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICAgICAgPC9ibG9ja3F1b3Rl
PgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+
CiAgICAgICAgICA8YnI+CiAgICAgICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50
SGVhZGVyIj48L2ZpZWxkc2V0PgogICAgICAgICAgPGJyPgogICAgICAgICAgPHByZSB3cmFwPSIi
Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZyZWVJUEEt
dXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi
IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIG1vei1k
by1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h
PgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst
YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9y
YWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBs
aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg
ICAgICAgPGJyPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAgIDwvYmxvY2txdW90
ZT4KICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K
--===============5165044645924626980==--
From ianh at brownpapertickets.com Wed Aug 16 14:37:31 2017
Content-Type: multipart/mixed; boundary="===============3500582530928333893=="
MIME-Version: 1.0
From: Ian Harding
To: freeipa-users at lists.fedorahosted.org
Subject: [Freeipa-users] Re: Failed Upgrade?
Date: Wed, 16 Aug 2017 07:36:31 -0700
Message-ID: <18ba2786-b6c1-4532-676d-790ef7b07701@brownpapertickets.com>
In-Reply-To: 5994397E.20408@redhat.com
--===============3500582530928333893==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
On 8/16/17 5:24 AM, thierry bordaz via FreeIPA-users wrote:
> Hi Ian
>
>> Hmm.. This looks odd.
>>
>> [root(a)seattlenfs ianh]# ipa-csreplica-manage re-initialize --from =
>> freeipa-sea.bpt.rocks
>> Directory Manager password:
>>
>> ipa: ERROR: Found multiple agreements for seattlenfs.bpt.rocks. Only =
>> initializing the first one returned: =
>> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3D=
o\=3Dipaca,cn=3Dmapping =
>> tree,cn=3Dconfig
>> Update in progress, 15 seconds elapsed
>> [freeipa-sea.bpt.rocks] reports: Update failed! Status: [32 - LDAP =
>> error: No such object]
>
> Here there are several replica agreement from freeipa-sea.bpt.rocks-> =
> seattlenfs (for o=3Dipaca suffix).
> I am not sure how this can happen.
> It could be some remaining entries from previous install/uninstall or =
> multiple initialization from different sources.
If it's possible to do something wrong I am sure I have done it. I have =
tried the various clean-ruv commands for the apparently existing =
agreements with nonexistent servers many times but it seems ot have no =
effect.
>
> Looking at the error below, I wonder if there were actually 2 replica =
> agreements freeipa-sea->seattlenfs that are
>
> * cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat
> * masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat
>
> Would you dump (on all servers freeipa-sea, seattlenfs and freeipa-dal):
>
> ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
> "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi
>
>
freeipa-dal no longer exists. Also, since they also appear below... =
neither do edinburghnfs, fremontnis, bellevuenfs or bpt-nyc1-nfs. The =
one causing me the most obvious headaches is freeipa-dal.
[root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -=
b =
"cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi
Enter LDAP Password:
dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: cn: replica
nscpentrywsi: createTimestamp: 20160814234939Z
nscpentrywsi: creatorsName: cn=3Ddirectory manager
nscpentrywsi: modifiersName: cn=3DMultimaster Replication =
Plugin,cn=3Dplugins,cn=3Dc
onfig
nscpentrywsi: modifyTimestamp: 20170816141634Z
nscpentrywsi: nsDS5Flags: 1
nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager =
cloneAgreement1-freei
pa-sea.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager =
masterAgreement1-seat
tlenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nscpentrywsi: nsDS5ReplicaId: 1065
nscpentrywsi: nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca
nscpentrywsi: nsDS5ReplicaType: 3
nscpentrywsi: nsState:: =
KQQAAAAAAADAU5RZAAAAAAAAAAAAAAAAKgAAAAAAAAAAAAAAAAAAAA
=3D=3D
nscpentrywsi: nsds5replicabinddngroup: cn=3Dreplication =
managers,cn=3Dsysaccounts,
cn=3Detc,dc=3Dbpt,dc=3Drocks
nscpentrywsi: nsds5replicabinddngroupcheckinterval: 60
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: nsDS5Replica
nscpentrywsi: objectClass: extensibleobject
nscpentrywsi: numSubordinates: 2
nscpentrywsi: nsds5ReplicaChangeCount: 961
nscpentrywsi: nsds5replicareapactive: 0
dn: =
cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3=
Dipac
a,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: dn: =
cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Drepli
ca,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: cn: cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat
nscpentrywsi: createTimestamp: 20160814234940Z
nscpentrywsi: creatorsName: cn=3Ddirectory manager
nscpentrywsi: description: cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat
nscpentrywsi: modifiersName: cn=3DMultimaster Replication =
Plugin,cn=3Dplugins,cn=3Dc
onfig
nscpentrywsi: modifyTimestamp: 20170810183437Z
nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager =
masterAgreement1-free
ipa-sea.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nscpentrywsi: nsDS5ReplicaBindMethod: Simple
nscpentrywsi: nsDS5ReplicaCredentials: =
{AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1
NxR1NJYjNEUUVGRERBNEJDUXhNemsyTlRka05TMHhZMlE1TTJKbA0KT1MwNU1HTm1PV0V6T1M=
wMk5
qazNNV0V3TndBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJC=
Q0da
bE1zY2Nod0FQeFlXMkF0Y3RhTA=3D=3D}AIuTmb+o3/MWgo0mc8r8fw=3D=3D
nscpentrywsi: nsDS5ReplicaHost: seattlenfs.bpt.rocks
nscpentrywsi: nsDS5ReplicaPort: 389
nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca
nscpentrywsi: nsDS5ReplicaTransportInfo: TLS
nscpentrywsi: nsds50ruv: {replicageneration} 55c8f3ae000000600000
nscpentrywsi: nsds50ruv: {replica 81 ldap://seattlenfs.bpt.rocks:389} =
568ac431
000000510000 57b103ce000500510000
nscpentrywsi: nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
57b10
3d4000004290000 57b254df000004290000
nscpentrywsi: nsds50ruv: {replica 1095 ldap://freeipa-sea.bpt.rocks:389} =
579a9
63c000004470000 57a42389000104470000
nscpentrywsi: nsds50ruv: {replica 96 ldap://freeipa-sea.bpt.rocks:389} =
55c8f3b
d000000600000 5799a02e000000600000
nscpentrywsi: nsds5ReplicaEnabled: on
nscpentrywsi: nsruvReplicaLastModified: {replica 81 =
ldap://seattlenfs.bpt.rock
s:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1065 =
ldap://freeipa-sea.bpt.r
ocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1095 =
ldap://freeipa-sea.bpt.r
ocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 96 =
ldap://freeipa-sea.bpt.roc
ks:389} 00000000
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: nsds5replicationagreement
nscpentrywsi: nsds5replicareapactive: 0
nscpentrywsi: nsds5replicaLastUpdateStart: 19700101000000Z
nscpentrywsi: nsds5replicaLastUpdateEnd: 19700101000000Z
nscpentrywsi: nsds5replicaChangesSentSinceStartup:
nscpentrywsi: nsds5replicaLastUpdateStatus: Error (32) Problem =
connecting to r
eplica - LDAP error: No such object (connection error)
nscpentrywsi: nsds5replicaUpdateInProgress: FALSE
nscpentrywsi: nsds5replicaLastInitStart: 19700101000000Z
nscpentrywsi: nsds5replicaLastInitEnd: 19700101000000Z
dn: =
cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3=
Dipac
a,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: dn: =
cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Drepli
ca,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: cn: masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat
nscpentrywsi: createTimestamp: 20160825052011Z
nscpentrywsi: creatorsName: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
nscpentrywsi: description: masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat
nscpentrywsi: modifiersName: cn=3DMultimaster Replication =
Plugin,cn=3Dplugins,cn=3Dc
onfig
nscpentrywsi: modifyTimestamp: 20170706211220Z
nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager =
cloneAgreement1-seatt
lenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nscpentrywsi: nsDS5ReplicaBindMethod: Simple
nscpentrywsi: nsDS5ReplicaCredentials: =
{AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1
NxR1NJYjNEUUVGRERBNEJDUXhNemsyTlRka05TMHhZMlE1TTJKbA0KT1MwNU1HTm1PV0V6T1M=
wMk5
qazNNV0V3TndBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJC=
QnZ6
Z2tGUzErSjlvdEVYRlFJaVQyMA=3D=3D}yhEAKKElqudqql31/kWsUw=3D=3D
nscpentrywsi: nsDS5ReplicaHost: seattlenfs.bpt.rocks
nscpentrywsi: nsDS5ReplicaPort: 389
nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca
nscpentrywsi: nsDS5ReplicaTransportInfo: TLS
nscpentrywsi: nsds50ruv: {replicageneration} 55c8f3ae000000600000
nscpentrywsi: nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
57be80
4c0000050a0000 587236150000050a0000
nscpentrywsi: nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
57b10
3d4000004290000 57be8043000704290000
nscpentrywsi: nsds50ruv: {replica 1070 ldap://bellevuenfs.bpt.rocks:389} =
57a4f
2700000042e0000 57a4f2700007042e0000
nscpentrywsi: nsds50ruv: {replica 1075 =
ldap://bpt-nyc1-nfs.bpt.rocks:389} 57a4
7865000004330000 57b111c8000404330000
nscpentrywsi: nsds50ruv: {replica 1085 ldap://fremontnis.bpt.rocks:389} =
57a403
e60000043d0000 57a643ea0000043d0000
nscpentrywsi: nsds50ruv: {replica 1090 ldap://freeipa-dal.bpt.rocks:389} =
57a2d
d35000004420000 57a2dd35000404420000
nscpentrywsi: nsds50ruv: {replica 1195 =
ldap://edinburghnfs.bpt.rocks:389} 57a4
2390000004ab0000 57a42390000404ab0000
nscpentrywsi: nsruvReplicaLastModified: {replica 1290 =
ldap://seattlenfs.bpt.ro
cks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1065 =
ldap://freeipa-sea.bpt.r
ocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1070 =
ldap://bellevuenfs.bpt.r
ocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1075 =
ldap://bpt-nyc1-nfs.bpt.
rocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1085 =
ldap://fremontnis.bpt.ro
cks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1090 =
ldap://freeipa-dal.bpt.r
ocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1195 =
ldap://edinburghnfs.bpt.
rocks:389} 00000000
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: nsds5replicationagreement
nscpentrywsi: nsds5replicareapactive: 0
nscpentrywsi: nsds5replicaLastUpdateStart: 19700101000000Z
nscpentrywsi: nsds5replicaLastUpdateEnd: 19700101000000Z
nscpentrywsi: nsds5replicaChangesSentSinceStartup:
nscpentrywsi: nsds5replicaLastUpdateStatus: Error (19) Replication error =
acqui
ring replica: Replica has different database generation ID, remote =
replica ma
y need to be initialized (RUV error)
nscpentrywsi: nsds5replicaUpdateInProgress: FALSE
nscpentrywsi: nsds5replicaLastInitStart: 19700101000000Z
nscpentrywsi: nsds5replicaLastInitEnd: 19700101000000Z
##################
[root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
"cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi
Enter LDAP Password:
dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: cn: replica
nscpentrywsi: createTimestamp: 20160825052011Z
nscpentrywsi: creatorsName: cn=3Ddirectory manager
nscpentrywsi: modifiersName: cn=3DMultimaster Replication =
Plugin,cn=3Dplugins,cn=3Dc
onfig
nscpentrywsi: modifyTimestamp: 20170810182749Z
nscpentrywsi: nsDS5Flags: 1
nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager =
cloneAgreement1-seatt
lenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nscpentrywsi: nsDS5ReplicaId: 1290
nscpentrywsi: nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca
nscpentrywsi: nsDS5ReplicaType: 3
nscpentrywsi: nsState:: =
CgUAAAAAAACkpYxZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA
=3D=3D
nscpentrywsi: nsds5replicabinddngroup: cn=3Dreplication =
managers,cn=3Dsysaccounts,
cn=3Detc,dc=3Dbpt,dc=3Drocks
nscpentrywsi: nsds5replicabinddngroupcheckinterval: 60
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: nsDS5Replica
nscpentrywsi: objectClass: extensibleobject
nscpentrywsi: numSubordinates: 1
nscpentrywsi: nsds5ReplicaChangeCount: 3
nscpentrywsi: nsds5replicareapactive: 0
dn: =
cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3D=
ipaca
,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: dn: =
cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplic
a,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
nscpentrywsi: cn: cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat
nscpentrywsi: createTimestamp: 20160825052011Z
nscpentrywsi: creatorsName: cn=3Ddirectory manager
nscpentrywsi: description: cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat
nscpentrywsi: modifiersName: cn=3Ddirectory manager
nscpentrywsi: modifyTimestamp: 20170810183422Z
nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager =
masterAgreement1-seat
tlenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
nscpentrywsi: nsDS5ReplicaBindMethod: Simple
nscpentrywsi: nsDS5ReplicaCredentials: =
{AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1
NxR1NJYjNEUUVGRERBNEJDUXhNemsyTlRka05TMHhZMlE1TTJKbA0KT1MwNU1HTm1PV0V6T1M=
wMk5
qazNNV0V3TndBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJC=
QzZI
d20zcHNMYTZKT3dQVDg4RW9XRA=3D=3D}PpeZp0WYyNiA7DWqrsJfBw=3D=3D
nscpentrywsi: nsDS5ReplicaHost: freeipa-sea.bpt.rocks
nscpentrywsi: nsDS5ReplicaPort: 389
nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca
nscpentrywsi: nsDS5ReplicaTransportInfo: TLS
nscpentrywsi: nsds50ruv: {replicageneration} 57c291d9000004290000
nscpentrywsi: nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
57f84
0bf000004290000 598ca31f000104290000
nscpentrywsi: nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
nscpentrywsi: nsruvReplicaLastModified: {replica 1065 =
ldap://freeipa-sea.bpt.r
ocks:389} 00000000
nscpentrywsi: nsruvReplicaLastModified: {replica 1290 =
ldap://seattlenfs.bpt.ro
cks:389} 00000000
nscpentrywsi: objectClass: top
nscpentrywsi: objectClass: nsds5replicationagreement
nscpentrywsi: nsds5ReplicaEnabled: on
nscpentrywsi: nsds5replicareapactive: 0
nscpentrywsi: nsds5replicaLastUpdateStart: 19700101000000Z
nscpentrywsi: nsds5replicaLastUpdateEnd: 19700101000000Z
nscpentrywsi: nsds5replicaChangesSentSinceStartup:
nscpentrywsi: nsds5replicaLastUpdateStatus: Error (19) Replication error =
acqui
ring replica: Replica has different database generation ID, remote =
replica ma
y need to be initialized (RUV error)
nscpentrywsi: nsds5replicaUpdateInProgress: FALSE
nscpentrywsi: nsds5replicaLastInitStart: 19700101000000Z
nscpentrywsi: nsds5replicaLastInitEnd: 19700101000000Z
> best regards
> thierry
>
>>
>>> On freeipa-sea and seattlenfs you may check the ipaca replica =
>>> agreements status before/after reinit. I would guess they are =
>>> currently reporting failures between these two replicas.
>>>
>>> ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>> "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
>>> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
>>>
>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -=
W =
>> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
>> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
>> Enter LDAP Password:
>> dn: =
>> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3D=
o\3Dipac
>> a,cn=3Dmapping tree,cn=3Dconfig
>> nsds5replicaLastUpdateStatus: Error (32) Problem connecting to =
>> replica - LDAP
>> error: No such object (connection error)
>>
>> dn: =
>> cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3D=
o\3Dipac
>> a,cn=3Dmapping tree,cn=3Dconfig
>> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
>> replica:
>> Replica has different database generation ID, remote replica may =
>> need to be i
>> nitialized (RUV error)
>>
>> and
>>
>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W =
>> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" =
>> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus
>> Enter LDAP Password:
>> dn: =
>> cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do=
\3Dipaca
>> ,cn=3Dmapping tree,cn=3Dconfig
>> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring =
>> replica:
>> Replica has different database generation ID, remote replica may =
>> need to be i
>> nitialized (RUV error)
>>
>>
>>>>
>>>> several times over the years when replication has stopped.
>>>>
>>>> Replication actually is working, as far as user and machine =
>>>> accounts and attributes are concerned anyway, and has been for a while.
>>>>
>>>> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid =
>>>> of... it shows up in the GUI on the Topology page but generates a =
>>>> Server not found error. I don't know if that's related.
>>>
>>> Zombie servers have been discussed a lot on this mailing list. You =
>>> may get rid of them with list-ruv/clean-ruv subcommand. Replication =
>>> usually manage to work fine even if some zombie entries exist but it =
>>> is a good practice to clean them.
>> Yeah, I've been through every possible combination of =
>> list-ruv/clean-ruv. I have something odd going on in that no =
>> replication agreements show up anywhere for freeipa-dal.
>>>
>>> regards
>>> thierry
>>>>>
>>>>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>
>>>>>> On 8/7/17 1:44 AM, thierry bordaz wrote:
>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users =
>>>>>>> wrote:
>>>>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>
>>>>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote:
>>>>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>> Ian Harding wrote:
>>>>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote:
>>>>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote:
>>>>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via =
>>>>>>>>>>>>>>>>>>>> FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote:
>>>>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote:
>>>>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server =
>>>>>>>>>>>>>>>>>>>>>>> that had apparently had
>>>>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl =
>>>>>>>>>>>>>>>>>>>>>>> says pki-tomcatd
>>>>>>>>>>>>>>>>>>>>>>> would
>>>>>>>>>>>>>>>>>>>>>>> not start.
>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be =
>>>>>>>>>>>>>>>>>>>>>>> running:
>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat =
>>>>>>>>>>>>>>>>>>>>>> can run without
>>>>>>>>>>>>>>>>>>>>>> dogtag
>>>>>>>>>>>>>>>>>>>>>> running.
>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to =
>>>>>>>>>>>>>>>>>>>>>> see what is going on.
>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>> It looks like an authentication problem...
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL =
>>>>>>>>>>>>>>>>>>>>> handshake happened
>>>>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host =
>>>>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636
>>>>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication =
>>>>>>>>>>>>>>>>>>>>> failed (49)
>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server =
>>>>>>>>>>>>>>>>>>>> and needs to
>>>>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check =
>>>>>>>>>>>>>>>>>>>> how this
>>>>>>>>>>>>>>>>>>>> connection is configured in =
>>>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for
>>>>>>>>>>>>>>>>>>>> the lines:
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager
>>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-...
>>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636
>>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with =
>>>>>>>>>>>>>>>>>>>> a ssl
>>>>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a =
>>>>>>>>>>>>>>>>>>>> bind DN and
>>>>>>>>>>>>>>>>>>>> password stored in =
>>>>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf).
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> You can use this information to manually check the =
>>>>>>>>>>>>>>>>>>>> credentials. For
>>>>>>>>>>>>>>>>>>>> instance with sslclientauth:
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca'
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base =
>>>>>>>>>>>>>>>>>>>> -Y EXTERNAL
>>>>>>>>>>>>>>>>>>>> (provide the password from =
>>>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt)
>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> I found this:
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeopl=
e,o=3Dipaca =
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb
>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert =
>>>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389
>>>>>>>>>>>>>>>>>>> ...
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a =
>>>>>>>>>>>>>>>>>>> prompt to provide
>>>>>>>>>>>>>>>>>>> a pin/password
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for =
>>>>>>>>>>>>>>>>>>> security token 'ldap(0)':
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>> but there is no password file...
>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and =
>>>>>>>>>>>>>>>>>> the password can be
>>>>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf =
>>>>>>>>>>>>>>>>>> (with the tag
>>>>>>>>>>>>>>>>>> internal=3D...)
>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>> Can you check if the password with the tag =
>>>>>>>>>>>>>>>>>> internal=3D... allows to read
>>>>>>>>>>>>>>>>>> the keys from the NSS db?
>>>>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>>> (provide password)
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> That works...
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias
>>>>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot =
>>>>>>>>>>>>>>>>> "NSS User Private
>>>>>>>>>>>>>>>>> Key and Certificate Services"
>>>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 =
>>>>>>>>>>>>>>>>> (orphan)
>>>>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS =
>>>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca
>>>>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e =
>>>>>>>>>>>>>>>>> caSigningCert
>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS =
>>>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca
>>>>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f =
>>>>>>>>>>>>>>>>> Server-Cert
>>>>>>>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS =
>>>>>>>>>>>>>>>>> Certificate
>>>>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> But this doesn't (with the same password from =
>>>>>>>>>>>>>>>>> password.conf)
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base =
>>>>>>>>>>>>>>>>> -Y EXTERNAL
>>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for =
>>>>>>>>>>>>>>>>> security token 'ldap(0)':
>>>>>>>>>>>>>>>>> SASL/EXTERNAL authentication started
>>>>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>> That password is getting me somewhere though, since if =
>>>>>>>>>>>>>>>>> I put in a
>>>>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over =
>>>>>>>>>>>>>>>>> and over.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what?
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> There wasn't much of a change... I just assumed someone =
>>>>>>>>>>>>>>> ran yum upgrade and didn't restart, then the power =
>>>>>>>>>>>>>>> outage... it looks like not much of a version change =
>>>>>>>>>>>>>>> though.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # grep ipa /var/log/yum.log
>>>>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:45:32 Installed: =
>>>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:46:06 Updated: =
>>>>>>>>>>>>>>> libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>>>> Jan 08 04:46:07 Updated: =
>>>>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>>>> Jan 08 04:46:08 Installed: =
>>>>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:04 Installed: =
>>>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:05 Updated: =
>>>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:05 Installed: =
>>>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:06 Installed: =
>>>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64
>>>>>>>>>>>>>>> Jan 08 04:47:17 Updated: =
>>>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>>>>> Jan 08 04:47:23 Updated: =
>>>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64
>>>>>>>>>>>>>>> Jan 08 04:47:27 Updated: =
>>>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:36 Installed: =
>>>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch
>>>>>>>>>>>>>>> Jan 08 04:50:07 Erased: =
>>>>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64
>>>>>>>>>>>>>>> Jul 28 09:55:41 Updated: =
>>>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:42 Updated: =
>>>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:43 Updated: =
>>>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:44 Updated: =
>>>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:45 Updated: =
>>>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:46 Updated: =
>>>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64
>>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: =
>>>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # grep pki /var/log/yum.log
>>>>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64
>>>>>>>>>>>>>>> Jan 08 04:47:19 Installed: =
>>>>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64
>>>>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch
>>>>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>>> Jul 28 10:13:17 Updated: =
>>>>>>>>>>>>>>> pki-base-java-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64
>>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Are you running in SELinux enforcing mode?
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # getenforce
>>>>>>>>>>>>>>> Enforcing
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> If so can you run:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # ausearch -m AVC
>>>>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use =
>>>>>>>>>>>>>>> the write_logs option.
>>>>>>>>>>>>>>> The NOLOG option is overriding the write_logs current =
>>>>>>>>>>>>>>> setting.
>>>>>>>>>>>>>>> ----
>>>>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016
>>>>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): =
>>>>>>>>>>>>>>> arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-13 =
>>>>>>>>>>>>>>> a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0 items=
=3D0 =
>>>>>>>>>>>>>>> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 =
>>>>>>>>>>>>>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D58140000=
1 =
>>>>>>>>>>>>>>> sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D4294967295 =
>>>>>>>>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" =
>>>>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null)
>>>>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { =
>>>>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_key=
s" =
>>>>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 =
>>>>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 =
>>>>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and =
>>>>>>>>>>>>>>>> everything wasn't
>>>>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the =
>>>>>>>>>>>>>>>> upgrade it just
>>>>>>>>>>>>>>>> shone a spotlight on it.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> Can you run these commands:
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b
>>>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate =
>>>>>>>>>>>>>>>> description
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> This returns
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descr=
iption
>>>>>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAl=
C =
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> ... stuff ...
>>>>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>>>>>> description: 2;4;CN=3DCertificate =
>>>>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> and
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>>>> 'subsystemCert
>>>>>>>>>>>>>>>> cert-pki-ca' | grep Serial
>>>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> These both return
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial
>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>>> certutil: problem listing keys: =
>>>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n =
>>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot =
>>>>>>>>>>>>>>> "NSS User Private Key and Certificate Services"
>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB":
>>>>>>>>>>>>>>> certutil: problem listing keys: =
>>>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>> Hi,
>>>>>>>>>>>>>>
>>>>>>>>>>>>>> you made a typo and requested the keys (-K) instead of =
>>>>>>>>>>>>>> the certs (-L). Please retry with -L and you should be =
>>>>>>>>>>>>>> able to see the certificate serial.
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca =
>>>>>>>>>>>>> userCertificate description
>>>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>>>> ...
>>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>>>> description: 2;4;CN=3DCertificate =
>>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>>>
>>>>>>>>>>>>> So the serial is 4?
>>>>>>>>>>>>>
>>>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>>>>>> grep Serial
>>>>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>>>>>
>>>>>>>>>>>>> Which is NOT 4...
>>>>>>>>>>>>>
>>>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
>>>>>>>>>>>>> -----BEGIN CERTIFICATE-----
>>>>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKD=
AlC =
>>>>>>>>>>>>>
>>>>>>>>>>>>> ...
>>>>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>>>>>>> -----END CERTIFICATE-----
>>>>>>>>>>>>>
>>>>>>>>>>>>> And this cert is NOT the same.
>>>>>>>>>>>>>
>>>>>>>>>>>> Hi,
>>>>>>>>>>>>
>>>>>>>>>>>> when certmonger renews a certificate, it runs pre-save and =
>>>>>>>>>>>> post-save commands (which you can see in the output of =
>>>>>>>>>>>> getcert list). In your case, the post-save command for =
>>>>>>>>>>>> subsystemCert cert-pki-ca probably failed.
>>>>>>>>>>>>
>>>>>>>>>>>> This command (on the renewal master) is responsible for =
>>>>>>>>>>>> copying the new cert from the NSS db to the LDAP server. =
>>>>>>>>>>>> You need first to check which IPA server is the renewal =
>>>>>>>>>>>> master (as the serial numbers are in a completely different =
>>>>>>>>>>>> range, I assume that you have multiple IPA servers =
>>>>>>>>>>>> configured with a CA instance):
>>>>>>>>>>>>
>>>>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut =
>>>>>>>>>>>> -d=3D -f2-`
>>>>>>>>>>>> $ kinit admin
>>>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>>>>> dn: =
>>>>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,=
cn=3Detc,dc=3Dipadomain,dc=3Dcom =
>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>> In this example the renewal master is vm-ipaserver.
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> I get this
>>>>>>>>>>>
>>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b =
>>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" =
>>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn
>>>>>>>>>>> dn: =
>>>>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3De=
tc,dc=3Dbpt,dc=3Drocks =
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> Which is the other FreeIPA server.
>>>>>>>>>>>
>>>>>>>>>> Hi Ian,
>>>>>>>>>>
>>>>>>>>>> it's getting difficult to follow this thread, so could we =
>>>>>>>>>> step back and summarize?
>>>>>>>>> Yes, it is. Sorry.
>>>>>>>>>>
>>>>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component =
>>>>>>>>>> is installed and 'subsystemCert cert-pki-ca' has Serial =
>>>>>>>>>> number 4 in the NSSDB /etc/pki/pki-tomcat/alias
>>>>>>>>> No?
>>>>>>>>>
>>>>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d =
>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>> grep Serial
>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA =
>>>>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has =
>>>>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias.
>>>>>>>>> Yes
>>>>>>>>>
>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d =
>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | =
>>>>>>>>> grep Serial
>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d)
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> - In the LDAP servers, the cert is stored in the entry =
>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e.=
it =
>>>>>>>>>> is the cert from freeipa-sea).
>>>>>>>>> This is where the difference is. There are two certificates =
>>>>>>>>> on the master and only one on the other. I wonder if this is =
>>>>>>>>> a result of the slow motion replication trainwreck I have =
>>>>>>>>> going on due to a zombie replica in the ldap database that no =
>>>>>>>>> longer exists in the real world and I can't seem to get rid of.
>>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> the remaining issue is a replication problem. There is a =
>>>>>>>> "Troubleshooting replication" section [1] in IdM Admin guide =
>>>>>>>> that may help you.
>>>>>>>>
>>>>>>>> Regarding your zombie replica, which commands did you use to =
>>>>>>>> try to remove it, and what was the output?
>>>>>>>>
>>>>>>>> Flo
>>>>>>>>
>>>>>>>> [1] =
>>>>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_L=
inux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-g=
en-replication.html
>>>>>>>>
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> To debug replication latency or problem we would need several =
>>>>>>> info but starting with the results of the following commands
>>>>>>>
>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> nscpentrywsi: =
>>>>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005:
>>>>>> 75274897
>>>>>> nscpentrywsi: =
>>>>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042
>>>>>> 90004: 20170608055334Z
>>>>>> nscpentrywsi: =
>>>>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290
>>>>>> 003: cn=3DDirectory Manager
>>>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>>>>> nscpentrywsi: cn: pkidbuser
>>>>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>>>>> nscpentrywsi: description;vucsn-5938e688000104290001: =
>>>>>> 2;1341718541;CN=3DCertific
>>>>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: =
>>>>>> 2;4;CN=3DCertifica
>>>>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>> nscpentrywsi: mail:
>>>>>> nscpentrywsi: objectClass: top
>>>>>> nscpentrywsi: objectClass: person
>>>>>> nscpentrywsi: objectClass: organizationalPerson
>>>>>> nscpentrywsi: objectClass: inetOrgPerson
>>>>>> nscpentrywsi: objectClass: cmsuser
>>>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>> nscpentrywsi: sn: pkidbuser
>>>>>> nscpentrywsi: uid: pkidbuser
>>>>>> nscpentrywsi: userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>>>>
>>>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: =
>>>>>> MIIDbjCCAlagAwIBAgI
>>>>>>
>>>>>> AR
>>>>>> nscpentrywsi: userPassword::
>>>>>> nscpentrywsi: userstate: 1
>>>>>> nscpentrywsi: usertype: agentType
>>>>>> nscpentrywsi: parentid: 2
>>>>>> nscpentrywsi: entryid: 51
>>>>>>> and
>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi
>>>>>> Enter LDAP Password:
>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS
>>>>>> nscpentrywsi: userCertificate:: =
>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR
>>>>>>
>>>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>> nscpentrywsi: description: 2;4;CN=3DCertificate =
>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs
>>>>>> ystem,O=3DBPT.ROCKS
>>>>>> nscpentrywsi: entryid: 51
>>>>>> nscpentrywsi: parentid: 2
>>>>>> nscpentrywsi: modifyTimestamp: 20150716125146Z
>>>>>> nscpentrywsi: createTimestamp: 20150716125146Z
>>>>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager
>>>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager
>>>>>> nscpentrywsi: userPassword::
>>>>>> nscpentrywsi: userstate: 1
>>>>>> nscpentrywsi: usertype: agentType
>>>>>> nscpentrywsi: mail:
>>>>>> nscpentrywsi: cn: pkidbuser
>>>>>> nscpentrywsi: sn: pkidbuser
>>>>>> nscpentrywsi: uid: pkidbuser
>>>>>> nscpentrywsi: objectClass: top
>>>>>> nscpentrywsi: objectClass: person
>>>>>> nscpentrywsi: objectClass: organizationalPerson
>>>>>> nscpentrywsi: objectClass: inetOrgPerson
>>>>>> nscpentrywsi: objectClass: cmsuser
>>>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074
>>>>>> nscpentrywsi: entryusn: 86
>>>>>>>
>>>>>>> From the output you may only copy/past the ones related to =
>>>>>>> userCertificate
>>>>>>>
>>>>>>>
>>>>>>> Also to dump the current replication status, send the result of
>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b =
>>>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-f=
fffffff-ffffffff-ffffffff))"
>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>> manager' -W -b "o=3Dipaca" =
>>>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff=
ff-ffffffff))"
>>>>>> Enter LDAP Password:
>>>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>>>>> cn: replica
>>>>>> nsDS5Flags: 1
>>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>>>> cloneAgreement1-freeipa-sea.bpt.roc
>>>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>>>> masterAgreement1-seattlenfs.bpt.roc
>>>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>>>> nsDS5ReplicaId: 1065
>>>>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1
>>>>>> nsDS5ReplicaRoot: o=3Dipaca
>>>>>> nsDS5ReplicaType: 3
>>>>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=
=3D
>>>>>> nsds5replicabinddngroup: cn=3Dreplication =
>>>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>>>>> dc=3Drocks
>>>>>> nsds5replicabinddngroupcheckinterval: 60
>>>>>> objectClass: top
>>>>>> objectClass: nsDS5Replica
>>>>>> objectClass: extensibleobject
>>>>>> nsds50ruv: {replicageneration} 57c291d9000004290000
>>>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>>>>> 57f840bf00000429000
>>>>>> 0 598a1c40000104290000
>>>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389}
>>>>>> nsds5agmtmaxcsn: =
>>>>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat
>>>>>> tlenfs.bpt.rocks;389;unavailable
>>>>>> nsds5agmtmaxcsn: =
>>>>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat
>>>>>> tlenfs.bpt.rocks;389;unavailable
>>>>>> nsruvReplicaLastModified: {replica 1065 =
>>>>>> ldap://freeipa-sea.bpt.rocks:389} 598a
>>>>>> 1c16
>>>>>> nsruvReplicaLastModified: {replica 1290 =
>>>>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>>>>> 000
>>>>>> nsds5ReplicaChangeCount: 885
>>>>>> nsds5replicareapactive: 0
>>>>>>> and
>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>> manager' -W -b =
>>>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-f=
fffffff-ffffffff-ffffffff))"
>>>>>>
>>>>>>
>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager=
' =
>>>>>> -W -b "o=3Dipaca" =
>>>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff=
ff-ffffffff))"
>>>>>> Enter LDAP Password:
>>>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig
>>>>>> cn: replica
>>>>>> nsDS5Flags: 1
>>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager =
>>>>>> cloneAgreement1-seattlenfs.bpt.rock
>>>>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig
>>>>>> nsDS5ReplicaId: 1290
>>>>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323
>>>>>> nsDS5ReplicaRoot: o=3Dipaca
>>>>>> nsDS5ReplicaType: 3
>>>>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=
=3D
>>>>>> nsds5replicabinddngroup: cn=3Dreplication =
>>>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt,
>>>>>> dc=3Drocks
>>>>>> nsds5replicabinddngroupcheckinterval: 60
>>>>>> objectClass: top
>>>>>> objectClass: nsDS5Replica
>>>>>> objectClass: extensibleobject
>>>>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000
>>>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} =
>>>>>> 57be804c0000050a0000
>>>>>> 587236150000050a0000
>>>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} =
>>>>>> 57b103d400000429000
>>>>>> 0 57be8043000704290000
>>>>>> nsds5agmtmaxcsn: =
>>>>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei
>>>>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000
>>>>>> nsruvReplicaLastModified: {replica 1290 =
>>>>>> ldap://seattlenfs.bpt.rocks:389} 00000
>>>>>> 000
>>>>>> nsruvReplicaLastModified: {replica 1065 =
>>>>>> ldap://freeipa-sea.bpt.rocks:389} 0000
>>>>>> 0000
>>>>>> nsds5ReplicaChangeCount: 3
>>>>>> nsds5replicareapactive: 0
>>>>>>>
>>>>>>> Regards
>>>>>>> thierry
>>>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertific=
ate =
>>>>>>>>> description
>>>>>>>>> Enter LDAP Password:
>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>> userCertificate:: =
>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>
>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>> userCertificate:: =
>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK
>>>>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR
>>>>>>>>> description: 2;1341718541;CN=3DCertificate =
>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem
>>>>>>>>> ,O=3DBPT.ROCKS
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory =
>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertific=
ate =
>>>>>>>>> description
>>>>>>>>> Enter LDAP Password:
>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>> userCertificate:: =
>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>
>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA =
>>>>>>>>> Subsystem,O=3DBPT.RO
>>>>>>>>> CKS
>>>>>>>>>
>>>>>>>>>> If you check the certificates dates, I guess that the most =
>>>>>>>>>> recent one is on server seattlenfs (because of serial =
>>>>>>>>>> numbers). Can you confirm this (because our goal is to have =
>>>>>>>>>> the most recent cert stored in all the NSSDBs and in LDAP)?
>>>>>>>>>>
>>>>>>>>>> Thanks,
>>>>>>>>>> Flo
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>>> If your renewal master is the machine on which the NSS DB =
>>>>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you =
>>>>>>>>>>>> can manually run the scripts:
>>>>>>>>>>>
>>>>>>>>>>> If I'm interpreting this correctly, then it is... so I ran =
>>>>>>>>>>> this on the broken machine (seattlenfs)
>>>>>>>>>>>
>>>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad
>>>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert =
>>>>>>>>>>>> "subsystemCert cert-pki-ca"
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> I ran this, it took a while, then I re-checked and the =
>>>>>>>>>>> serial still seems to be 4
>>>>>>>>>>>
>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b =
>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti=
on
>>>>>>>>>>> Enter LDAP Password:
>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca
>>>>>>>>>>> userCertificate:: =
>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC
>>>>>>>>>>> ...
>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D
>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D=
CA =
>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS
>>>>>>>>>>>
>>>>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug
>>>>>>>>>>>
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D =
DEBUG =
>>>>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> restart at autoShutdown? false
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> done init id=3Ddebug
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> initialized debug
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> initSubsystem id=3Dlog
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> ready to init id=3Dlog
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_a=
udit) =
>>>>>>>>>>>
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system)
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions)
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> restart at autoShutdown? false
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> done init id=3Dlog
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> initialized log
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> initSubsystem id=3Djss
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> ready to init id=3Djss
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> restart at autoShutdown? false
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> autoShutdown crumb file path? =
>>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> about to look for cert for auto-shutdown =
>>>>>>>>>>> support:auditSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> found cert:auditSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> done init id=3Djss
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> initialized jss
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> initSubsystem id=3Ddbs
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: =
>>>>>>>>>>> ready to init id=3Ddbs
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: =
>>>>>>>>>>> init() mEnableSerialMgmt=3Dtrue
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating =
>>>>>>>>>>> LdapBoundConnFactor(DBSubsystem)
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> LdapBoundConnFactory: init
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> LdapBoundConnFactory:doCloning true
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>>>> init()
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>>>> init begins
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: =
>>>>>>>>>>> init ends
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before =
>>>>>>>>>>> makeConnection errorIfDown is true
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> makeConnection: errorIfDown true
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP =
>>>>>>>>>>> Keep-Alive: true
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert =
>>>>>>>>>>> nickname to: subsystemCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> LdapJssSSLSocket: set client auth cert nickname =
>>>>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> SSLClientCertificatSelectionCB: Entering!
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate =
>>>>>>>>>>> cert: ocspSigningCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate =
>>>>>>>>>>> cert: subsystemCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: =
>>>>>>>>>>> subsystemCert cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert =
>>>>>>>>>>> cert-pki-ca
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake =
>>>>>>>>>>> happened
>>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =
>>>>>>>>>>> CMSEngine.shutdown()
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> I really appreciate you sticking with me through this. I =
>>>>>>>>>>> owe you.
>>>>>>>>>>>
>>>>>>>>>>> - Ian
>>>>>>>>>>>
>>>>>>>>>>>> After that, check that the LDAP entry has been updated. If =
>>>>>>>>>>>> it is the case, you should be able to restart pki.
>>>>>>>>>>>>
>>>>>>>>>>>> Flo
>>>>>>>>>>>>
>>>>>>>>>>>>> Thank you again for your time!
>>>>>>>>>>>>>
>>>>>>>>>>>>> Ian
>>>>>>>>>>>>>
>>>>>>>>>>>>>> Flo.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>> which seems weird.
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> The description attribute in the ldapsearch output is =
>>>>>>>>>>>>>>>> of the form 2;#;DN;DN
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> The # should match the serial number in the first =
>>>>>>>>>>>>>>>> certutil output
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should =
>>>>>>>>>>>>>>>> match one of the
>>>>>>>>>>>>>>>> userCertificate attributes.
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>> rob
>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>> _______________________________________________
>>>>>>>>> FreeIPA-users mailing list -- =
>>>>>>>>> freeipa-users(a)lists.fedorahosted.org
>>>>>>>>> To unsubscribe send an email to =
>>>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>> _______________________________________________
>>>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.o=
rg
>>>>>>>> To unsubscribe send an email to =
>>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>>>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahos=
ted.org
>>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahoste=
d.org
>>>
>>
>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.=
org
--===============3500582530928333893==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl
bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9
IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPHA+T24gOC8xNi8xNyA1OjI0IEFNLCB0aGll
cnJ5IGJvcmRheiB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICA8L3A+CiAgICA8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk5NDM5N0UuMjA0MDhAcmVkaGF0LmNvbSI+
CiAgICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIj4KICAgICAgSGkgSWFuPGJyPgogICAgICA8YnI+CiAgICAgIDxibG9j
a3F1b3RlCiAgICAgICAgY2l0ZT0ibWlkOjdmYzIzNDMyLWUzMzktOWI3NS1iOWE2LWFlNDYyOGY3
ODRlMkBicm93bnBhcGVydGlja2V0cy5jb20iCiAgICAgICAgdHlwZT0iY2l0ZSI+IEhtbS4uIFRo
aXMgbG9va3Mgb2RkLjxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBp
YW5oXSMgaXBhLWNzcmVwbGljYS1tYW5hZ2UgcmUtaW5pdGlhbGl6ZQogICAgICAgIC0tZnJvbSBm
cmVlaXBhLXNlYS5icHQucm9ja3M8YnI+CiAgICAgICAgRGlyZWN0b3J5IE1hbmFnZXIgcGFzc3dv
cmQ6IDxicj4KICAgICAgICA8YnI+CiAgICAgICAgaXBhOiBFUlJPUjogRm91bmQgbXVsdGlwbGUg
YWdyZWVtZW50cyBmb3Igc2VhdHRsZW5mcy5icHQucm9ja3MuCiAgICAgICAgT25seSBpbml0aWFs
aXppbmcgdGhlIGZpcnN0IG9uZSByZXR1cm5lZDoKY249Y2xvbmVBZ3JlZW1lbnQxLWZyZWVpcGEt
c2VhLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1w9aXBhY2EsY249bWFwcGlu
ZwogICAgICAgIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgIFVwZGF0ZSBpbiBwcm9ncmVzcywg
MTUgc2Vjb25kcyBlbGFwc2VkPGJyPgogICAgICAgIFtmcmVlaXBhLXNlYS5icHQucm9ja3NdIHJl
cG9ydHM6IFVwZGF0ZSBmYWlsZWQhIFN0YXR1czogWzMywqAgLQogICAgICAgIExEQVAgZXJyb3I6
IE5vIHN1Y2ggb2JqZWN0XTxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICA8YnI+CiAgICAg
IEhlcmUgdGhlcmUgYXJlIHNldmVyYWwgcmVwbGljYSBhZ3JlZW1lbnQgZnJvbQogICAgICBmcmVl
aXBhLXNlYS5icHQucm9ja3MtJmd0OyBzZWF0dGxlbmZzIChmb3Igbz1pcGFjYSBzdWZmaXgpLjxi
cj4KICAgICAgSSBhbSBub3Qgc3VyZSBob3cgdGhpcyBjYW4gaGFwcGVuLiA8YnI+CiAgICAgIEl0
IGNvdWxkIGJlIHNvbWUgcmVtYWluaW5nIGVudHJpZXMgZnJvbSBwcmV2aW91cyBpbnN0YWxsL3Vu
aW5zdGFsbAogICAgICBvciBtdWx0aXBsZSBpbml0aWFsaXphdGlvbiBmcm9tIGRpZmZlcmVudCBz
b3VyY2VzLjxicj4KICAgIDwvYmxvY2txdW90ZT4KICAgIElmIGl0J3MgcG9zc2libGUgdG8gZG8g
c29tZXRoaW5nIHdyb25nIEkgYW0gc3VyZSBJIGhhdmUgZG9uZSBpdC7CoCBJCiAgICBoYXZlIHRy
aWVkIHRoZSB2YXJpb3VzIGNsZWFuLXJ1diBjb21tYW5kcyBmb3IgdGhlIGFwcGFyZW50bHkKICAg
IGV4aXN0aW5nIGFncmVlbWVudHMgd2l0aCBub25leGlzdGVudCBzZXJ2ZXJzIG1hbnkgdGltZXMg
YnV0IGl0IHNlZW1zCiAgICBvdCBoYXZlIG5vIGVmZmVjdC48YnI+CiAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk5NDM5N0UuMjA0MDhAcmVkaGF0LmNvbSI+IDxicj4KICAg
ICAgTG9va2luZyBhdCB0aGUgZXJyb3IgYmVsb3csIEkgd29uZGVyIGlmIHRoZXJlIHdlcmUgYWN0
dWFsbHkgMgogICAgICByZXBsaWNhIGFncmVlbWVudHMgZnJlZWlwYS1zZWEtJmd0O3NlYXR0bGVu
ZnMgdGhhdCBhcmUgPGJyPgogICAgICA8dWw+CiAgICAgICAgPGxpPjx0dD5jbG9uZUFncmVlbWVu
dDEtZnJlZWlwYS1zZWEuYnB0LnJvY2tzLXBraS10b21jYXQ8L3R0PjwvbGk+CiAgICAgICAgPGxp
Pjx0dD5tYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ8L3R0
PjwvbGk+CiAgICAgIDwvdWw+CiAgICAgIDxwPldvdWxkIHlvdSBkdW1wIChvbiBhbGwgc2VydmVy
cyBmcmVlaXBhLXNlYSwgc2VhdHRsZW5mcyBhbmQKICAgICAgICBmcmVlaXBhLWRhbCk6PGJyPgog
ICAgICA8L3A+CiAgICAgIDxwPjx0dD5sZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBt
YW5hZ2VyJyAtVyAtYgogICAgICAgICAgImNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBp
bmcgdHJlZSxjbj1jb25maWciCiAgICAgICAgICBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgPC90
dD48L3A+CiAgICAgIDxwPjx0dD48YnI+CiAgICAgICAgPC90dD48L3A+CiAgICA8L2Jsb2NrcXVv
dGU+CiAgICA8dHQ+ZnJlZWlwYS1kYWwgbm8gbG9uZ2VyIGV4aXN0cy7CoCBBbHNvLCBzaW5jZSB0
aGV5IGFsc28gYXBwZWFyCiAgICAgIGJlbG93Li4uIG5laXRoZXIgZG8gZWRpbmJ1cmdobmZzLCBm
cmVtb250bmlzLCBiZWxsZXZ1ZW5mcyBvcgogICAgICBicHQtbnljMS1uZnMuwqAgVGhlIG9uZSBj
YXVzaW5nIG1lIHRoZSBtb3N0IG9idmlvdXMgaGVhZGFjaGVzIGlzCiAgICAgIGZyZWVpcGEtZGFs
Ljxicj4KICAgICAgPGJyPgogICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJj
aCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgICAgLVcgLWIgImNuPXJlcGxpY2Es
Y249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWciCiAgICAgIG5zY3BlbnRyeXdz
aTxicj4KICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICBkbjogY249cmVwbGlj
YSxjbj1vXDNEaXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBkbjogY249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFwcGluZwogICAgICB0cmVl
LGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBjbjogcmVwbGljYTxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTYwODE0MjM0OTM5Wjxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAg
ICBuc2NwZW50cnl3c2k6IG1vZGlmaWVyc05hbWU6IGNuPU11bHRpbWFzdGVyIFJlcGxpY2F0aW9u
CiAgICAgIFBsdWdpbixjbj1wbHVnaW5zLGNuPWM8YnI+CiAgICAgIMKgb25maWc8YnI+CiAgICAg
IG5zY3BlbnRyeXdzaTogbW9kaWZ5VGltZXN0YW1wOiAyMDE3MDgxNjE0MTYzNFo8YnI+CiAgICAg
IG5zY3BlbnRyeXdzaTogbnNEUzVGbGFnczogMTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RT
NVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgY2xvbmVBZ3JlZW1l
bnQxLWZyZWVpPGJyPgogICAgICDCoHBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdCxvdT1jc3Vz
ZXJzLGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FCaW5kRE46
IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgbWFzdGVyQWdyZWVtZW50MS1zZWF0PGJyPgog
ICAgICDCoHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxi
cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FJZDogMTA2NTxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FOYW1lOgogICAgICBiMjFhMWYxZS02Mjc5MTFlNi05M2U2
ZWY0Yi02OWRjYzJkMTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FSb290OiBv
PWlwYWNhPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogbnNTdGF0ZTo6CiAgICAgIEtRUUFBQUFBQUFEQVU1UlpBQUFBQUFB
QUFBQUFBQUFBS2dBQUFBQUFBQUFBQUFBQUFBQUFBQTxicj4KICAgICAgwqA9PTxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAg
ICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsPGJyPgogICAgICDCoGNuPWV0YyxkYz1icHQsZGM9
cm9ja3M8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhYmluZGRuZ3JvdXBjaGVj
a2ludGVydmFsOiA2MDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogdG9wPGJy
PgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBuc0RTNVJlcGxpY2E8YnI+CiAgICAg
IG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGV4dGVuc2libGVvYmplY3Q8YnI+CiAgICAgIG5z
Y3BlbnRyeXdzaTogbnVtU3Vib3JkaW5hdGVzOiAyPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5z
ZHM1UmVwbGljYUNoYW5nZUNvdW50OiA5NjE8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVy
ZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgPGJyPgogICAgICBkbjoKY249Y2xvbmVBZ3Jl
ZW1lbnQxLWZyZWVpcGEtc2VhLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1wz
RGlwYWM8YnI+CiAgICAgIMKgYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBu
c2NwZW50cnl3c2k6IGRuOgogICAgICBjbj1jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0
LnJvY2tzLXBraS10b21jYXQsY249cmVwbGk8YnI+CiAgICAgIMKgY2EsY249b1wzRGlwYWNhLGNu
PW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogY246IGNsb25l
QWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdDxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTYwODE0MjM0OTQwWjxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICBu
c2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uOgogICAgICBjbG9uZUFncmVlbWVudDEtZnJlZWlwYS1z
ZWEuYnB0LnJvY2tzLXBraS10b21jYXQ8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbW9kaWZpZXJz
TmFtZTogY249TXVsdGltYXN0ZXIgUmVwbGljYXRpb24KICAgICAgUGx1Z2luLGNuPXBsdWdpbnMs
Y249Yzxicj4KICAgICAgwqBvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBtb2RpZnlUaW1l
c3RhbXA6IDIwMTcwODEwMTgzNDM3Wjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxp
Y2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgbWFzdGVyQWdyZWVtZW50MS1m
cmVlPGJyPgogICAgICDCoGlwYS1zZWEuYnB0LnJvY2tzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxj
bj1jb25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhQmluZE1ldGhvZDog
U2ltcGxlPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUNyZWRlbnRpYWxzOgog
ICAgICB7QUVTLVRVaE5SME5UY1VkVFNXSXpSRkZGUmtSVVFtMU5SVlZIUTE8YnI+CsKgTnhSMU5K
WWpORVVVVkdSRVJCTkVKRFVYaE5lbXN5VGxSa2EwNVRNSGhaTWxFMVRUSktiQTBLVDFNd05VMUhU
bTFQVjBWNlQxTXdNazU8YnI+CsKgcWF6Tk5WMFYzVG5kQlEwRlJTVU5CVTBGM1EyZFpTVXR2V2ts
b2RtTk9RV2RqZDBoUldVcFpTVnBKUVZkVlJBMEtRa0ZGY1VKQ1EwZGE8YnI+CiAgICAgIMKgYkUx
elkyTm9kMEZRZUZsWE1rRjBZM1JoVEE9PX1BSXVUbWIrbzMvTVdnbzBtYzhyOGZ3PT08YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhSG9zdDogc2VhdHRsZW5mcy5icHQucm9ja3M8
YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhUG9ydDogMzg5PGJyPgogICAgICBu
c2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYVJvb3Q6IG89aXBhY2E8YnI+CiAgICAgIG5zY3BlbnRy
eXdzaTogbnNEUzVSZXBsaWNhVHJhbnNwb3J0SW5mbzogVExTPGJyPgogICAgICBuc2NwZW50cnl3
c2k6IG5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYwMDAwMDxi
cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhIDgxCiAgICAgIDxhIGNs
YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y
b2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fSA1NjhhYzQzMTxi
cj4KICAgICAgwqAwMDAwMDA1MTAwMDAgNTdiMTAzY2UwMDA1MDA1MTAwMDA8YnI+CiAgICAgIG5z
Y3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1CiAgICAgIDxhIGNsYXNzPSJtb3ot
dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5
Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDU3YjEwPGJyPgogICAgICDC
oDNkNDAwMDAwNDI5MDAwMCA1N2IyNTRkZjAwMDAwNDI5MDAwMDxicj4KICAgICAgbnNjcGVudHJ5
d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhIDEwOTUKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGlu
ay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6
Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0gNTc5YTk8YnI+CiAgICAgIMKgNjNjMDAw
MDA0NDcwMDAwIDU3YTQyMzg5MDAwMTA0NDcwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5z
ZHM1MHJ1djoge3JlcGxpY2EgOTYKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4
dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBh
LXNlYS5icHQucm9ja3M6Mzg5PC9hPn0gNTVjOGYzYjxicj4KICAgICAgwqBkMDAwMDAwNjAwMDAw
IDU3OTlhMDJlMDAwMDAwNjAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1UmVwbGlj
YUVuYWJsZWQ6IG9uPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zcnV2UmVwbGljYUxhc3RNb2Rp
ZmllZDoge3JlcGxpY2EgODEKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg
aHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2siPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y
b2NrPC9hPjxicj4KICAgICAgwqBzOjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdz
aTogbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1CiAgICAgIDxhIGNsYXNz
PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQuciI+
bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yPC9hPjxicj4KICAgICAgwqBvY2tzOjM4OX0gMDAwMDAw
MDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVw
bGljYSAxMDk1CiAgICAgIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imxk
YXA6Ly9mcmVlaXBhLXNlYS5icHQuciI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yPC9hPjxicj4K
ICAgICAgwqBvY2tzOjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNydXZS
ZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSA5NgogICAgICA8YSBjbGFzcz0ibW96LXR4dC1s
aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvYyI+bGRhcDovL2Zy
ZWVpcGEtc2VhLmJwdC5yb2M8L2E+PGJyPgogICAgICDCoGtzOjM4OX0gMDAwMDAwMDA8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3Np
OiBvYmplY3RDbGFzczogbnNkczVyZXBsaWNhdGlvbmFncmVlbWVudDxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6
IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGFydDogMTk3MDAxMDEwMDAwMDBaPGJyPgogICAgICBu
c2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVFbmQ6IDE5NzAwMTAxMDAwMDAwWjxi
cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FDaGFuZ2VzU2VudFNpbmNlU3RhcnR1
cDo8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czog
RXJyb3IgKDMyKSBQcm9ibGVtCiAgICAgIGNvbm5lY3RpbmcgdG8gcjxicj4KICAgICAgwqBlcGxp
Y2EgLSBMREFQIGVycm9yOiBObyBzdWNoIG9iamVjdCAoY29ubmVjdGlvbiBlcnJvcik8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhVXBkYXRlSW5Qcm9ncmVzczogRkFMU0U8YnI+
CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhTGFzdEluaXRTdGFydDogMTk3MDAxMDEw
MDAwMDBaPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RJbml0RW5kOiAx
OTcwMDEwMTAwMDAwMFo8YnI+CiAgICAgIDxicj4KICAgICAgZG46CmNuPW1hc3RlckFncmVlbWVu
dDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBsaWNhLGNuPW9cM0RpcGFj
PGJyPgogICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBkbjoKICAgICAgY249bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nr
cy1wa2ktdG9tY2F0LGNuPXJlcGxpPGJyPgogICAgICDCoGNhLGNuPW9cM0RpcGFjYSxjbj1tYXBw
aW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IGNuOiBtYXN0ZXJBZ3Jl
ZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ8YnI+CiAgICAgIG5zY3BlbnRy
eXdzaTogY3JlYXRlVGltZXN0YW1wOiAyMDE2MDgyNTA1MjAxMVo8YnI+CiAgICAgIG5zY3BlbnRy
eXdzaTogY3JlYXRvcnNOYW1lOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhPGJyPgog
ICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uOgogICAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNl
YXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbW9k
aWZpZXJzTmFtZTogY249TXVsdGltYXN0ZXIgUmVwbGljYXRpb24KICAgICAgUGx1Z2luLGNuPXBs
dWdpbnMsY249Yzxicj4KICAgICAgwqBvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBtb2Rp
ZnlUaW1lc3RhbXA6IDIwMTcwNzA2MjExMjIwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RT
NVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgY2xvbmVBZ3JlZW1l
bnQxLXNlYXR0PGJyPgogICAgICDCoGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LG91PWNzdXNl
cnMsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUJpbmRNZXRo
b2Q6IFNpbXBsZTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FDcmVkZW50aWFs
czoKICAgICAge0FFUy1UVWhOUjBOVGNVZFRTV0l6UkZGRlJrUlVRbTFOUlZWSFExPGJyPgrCoE54
UjFOSllqTkVVVVZHUkVSQk5FSkRVWGhOZW1zeVRsUmthMDVUTUhoWk1sRTFUVEpLYkEwS1QxTXdO
VTFIVG0xUFYwVjZUMU13TWs1PGJyPgrCoHFhek5OVjBWM1RuZEJRMEZSU1VOQlUwRjNRMmRaU1V0
dldrbG9kbU5PUVdkamQwaFJXVXBaU1ZwSlFWZFZSQTBLUWtGRmNVSkNRblo2PGJyPgogICAgICDC
oFoydEdVekVyU2psdmRFVllSbEZKYVZReU1BPT19eWhFQUtLRWxxdWRxcWwzMS9rV3NVdz09PGJy
PgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUhvc3Q6IHNlYXR0bGVuZnMuYnB0LnJv
Y2tzPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYVBvcnQ6IDM4OTxicj4KICAg
ICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICBuc2Nw
ZW50cnl3c2k6IG5zRFM1UmVwbGljYVRyYW5zcG9ydEluZm86IFRMUzxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAw
MDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwCiAgICAg
IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZz
LmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fSA1N2Jl
ODA8YnI+CiAgICAgIMKgNGMwMDAwMDUwYTAwMDAgNTg3MjM2MTUwMDAwMDUwYTAwMDA8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1CiAgICAgIDxhIGNsYXNz
PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j
a3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDU3YjEwPGJyPgog
ICAgICDCoDNkNDAwMDAwNDI5MDAwMCA1N2JlODA0MzAwMDcwNDI5MDAwMDxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNzAKICAgICAgPGEgY2xhc3M9Im1vei10
eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2JlbGxldnVlbmZzLmJwdC5yb2NrczozODki
PmxkYXA6Ly9iZWxsZXZ1ZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0gNTdhNGY8YnI+CiAgICAgIMKg
MjcwMDAwMDA0MmUwMDAwIDU3YTRmMjcwMDAwNzA0MmUwMDAwPGJyPgogICAgICBuc2NwZW50cnl3
c2k6IG5zZHM1MHJ1djoge3JlcGxpY2EgMTA3NQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5r
LWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vYnB0LW55YzEtbmZzLmJwdC5yb2NrczozODkiPmxkYXA6
Ly9icHQtbnljMS1uZnMuYnB0LnJvY2tzOjM4OTwvYT59IDU3YTQ8YnI+CiAgICAgIMKgNzg2NTAw
MDAwNDMzMDAwMCA1N2IxMTFjODAwMDQwNDMzMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBu
c2RzNTBydXY6IHtyZXBsaWNhIDEwODUKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVl
dGV4dCIgaHJlZj0ibGRhcDovL2ZyZW1vbnRuaXMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZW1v
bnRuaXMuYnB0LnJvY2tzOjM4OTwvYT59IDU3YTQwMzxicj4KICAgICAgwqBlNjAwMDAwNDNkMDAw
MCA1N2E2NDNlYTAwMDAwNDNkMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNTBydXY6
IHtyZXBsaWNhIDEwOTAKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJl
Zj0ibGRhcDovL2ZyZWVpcGEtZGFsLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLWRhbC5i
cHQucm9ja3M6Mzg5PC9hPn0gNTdhMmQ8YnI+CiAgICAgIMKgZDM1MDAwMDA0NDIwMDAwIDU3YTJk
ZDM1MDAwNDA0NDIwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1MHJ1djoge3JlcGxp
Y2EgMTE5NQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFw
Oi8vZWRpbmJ1cmdobmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9lZGluYnVyZ2huZnMuYnB0LnJv
Y2tzOjM4OTwvYT59IDU3YTQ8YnI+CiAgICAgIMKgMjM5MDAwMDAwNGFiMDAwMCA1N2E0MjM5MDAw
MDQwNGFiMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc3J1dlJlcGxpY2FMYXN0TW9kaWZp
ZWQ6IHtyZXBsaWNhIDEyOTAKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg
aHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm88
L2E+PGJyPgogICAgICDCoGNrczozODl9IDAwMDAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6
IG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAgICA8YSBjbGFzcz0i
bW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnIiPmxk
YXA6Ly9mcmVlaXBhLXNlYS5icHQucjwvYT48YnI+CiAgICAgIMKgb2NrczozODl9IDAwMDAwMDAw
PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxp
Y2EgMTA3MAogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFw
Oi8vYmVsbGV2dWVuZnMuYnB0LnIiPmxkYXA6Ly9iZWxsZXZ1ZW5mcy5icHQucjwvYT48YnI+CiAg
ICAgIMKgb2NrczozODl9IDAwMDAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zcnV2UmVw
bGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA3NQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1s
aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vYnB0LW55YzEtbmZzLmJwdCI+bGRhcDovL2JwdC1u
eWMxLW5mcy5icHQ8L2E+Ljxicj4KICAgICAgwqByb2NrczozODl9IDAwMDAwMDAwPGJyPgogICAg
ICBuc2NwZW50cnl3c2k6IG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA4NQog
ICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlbW9u
dG5pcy5icHQucm8iPmxkYXA6Ly9mcmVtb250bmlzLmJwdC5ybzwvYT48YnI+CiAgICAgIMKgY2tz
OjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNydXZSZXBsaWNhTGFzdE1v
ZGlmaWVkOiB7cmVwbGljYSAxMDkwCiAgICAgIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl
eHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLWRhbC5icHQuciI+bGRhcDovL2ZyZWVpcGEtZGFsLmJw
dC5yPC9hPjxicj4KICAgICAgwqBvY2tzOjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRy
eXdzaTogbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMTk1CiAgICAgIDxhIGNs
YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9lZGluYnVyZ2huZnMuYnB0
Ij5sZGFwOi8vZWRpbmJ1cmdobmZzLmJwdDwvYT4uPGJyPgogICAgICDCoHJvY2tzOjM4OX0gMDAw
MDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogbnNkczVyZXBsaWNhdGlvbmFncmVlbWVudDxicj4K
ICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICBu
c2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGFydDogMTk3MDAxMDEwMDAwMDBa
PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVFbmQ6IDE5NzAw
MTAxMDAwMDAwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FDaGFuZ2VzU2Vu
dFNpbmNlU3RhcnR1cDo8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhTGFzdFVw
ZGF0ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBsaWNhdGlvbgogICAgICBlcnJvciBhY3F1aTxicj4K
ICAgICAgwqByaW5nIHJlcGxpY2E6IFJlcGxpY2EgaGFzIGRpZmZlcmVudCBkYXRhYmFzZSBnZW5l
cmF0aW9uIElELAogICAgICByZW1vdGUgcmVwbGljYSBtYTxicj4KICAgICAgwqB5IG5lZWQgdG8g
YmUgaW5pdGlhbGl6ZWQgKFJVViBlcnJvcik8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVy
ZXBsaWNhVXBkYXRlSW5Qcm9ncmVzczogRkFMU0U8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNk
czVyZXBsaWNhTGFzdEluaXRTdGFydDogMTk3MDAxMDEwMDAwMDBaPGJyPgogICAgICBuc2NwZW50
cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RJbml0RW5kOiAxOTcwMDEwMTAwMDAwMFo8YnI+CiAgICAg
IDxicj4KICAgICAgPGJyPgogICAgICAjIyMjIyMjIyMjIyMjIyMjIyM8YnI+CiAgICAgIDxicj4K
ICAgICAgPGJyPgogICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg
LUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJwogICAgICAtVyAtYiAiY249cmVwbGljYSxjbj1vXDNE
aXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZyIKICAgICAgbnNjcGVudHJ5d3NpPGJyPgog
ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgIGRuOiBjbj1yZXBsaWNhLGNuPW9c
M0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6
IGRuOiBjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgIHRyZWUsY249Y29u
ZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IGNuOiByZXBsaWNhPGJyPgogICAgICBuc2NwZW50
cnl3c2k6IGNyZWF0ZVRpbWVzdGFtcDogMjAxNjA4MjUwNTIwMTFaPGJyPgogICAgICBuc2NwZW50
cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgIG5zY3Bl
bnRyeXdzaTogbW9kaWZpZXJzTmFtZTogY249TXVsdGltYXN0ZXIgUmVwbGljYXRpb24KICAgICAg
UGx1Z2luLGNuPXBsdWdpbnMsY249Yzxicj4KICAgICAgwqBvbmZpZzxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBtb2RpZnlUaW1lc3RhbXA6IDIwMTcwODEwMTgyNzQ5Wjxicj4KICAgICAgbnNjcGVu
dHJ5d3NpOiBuc0RTNUZsYWdzOiAxPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGlj
YUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICBjbG9uZUFncmVlbWVudDEtc2Vh
dHQ8YnI+CiAgICAgIMKgbGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1j
b25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhSWQ6IDEyOTA8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhTmFtZToKICAgICAgODcwNmFiMWUtNmE4MzEx
ZTYtYTliZmRiYmYtNzRkYzczMjM8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNh
Um9vdDogbz1pcGFjYTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FUeXBlOiAz
PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zU3RhdGU6OgogICAgICBDZ1VBQUFBQUFBQ2twWXha
QUFBQUFBQUFBQUFBQUFBQUtnQUFBQUFBQUFBQkFBQUFBQUFBQUE8YnI+CiAgICAgIMKgPT08YnI+
CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0
aW9uCiAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLDxicj4KICAgICAgwqBjbj1ldGMsZGM9
YnB0LGRjPXJvY2tzPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYWJpbmRkbmdy
b3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6
IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogbnNEUzVSZXBsaWNhPGJy
PgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBleHRlbnNpYmxlb2JqZWN0PGJyPgog
ICAgICBuc2NwZW50cnl3c2k6IG51bVN1Ym9yZGluYXRlczogMTxicj4KICAgICAgbnNjcGVudHJ5
d3NpOiBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogMzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBu
c2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICA8YnI+CiAgICAgIGRuOgpjbj1jbG9u
ZUFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBsaWNhLGNu
PW9cM0RpcGFjYTxicj4KICAgICAgwqAsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAg
ICAgbnNjcGVudHJ5d3NpOiBkbjoKICAgICAgY249Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMu
YnB0LnJvY2tzLXBraS10b21jYXQsY249cmVwbGljPGJyPgogICAgICDCoGEsY249b1wzRGlwYWNh
LGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogY246IGNs
b25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0PGJyPgogICAgICBu
c2NwZW50cnl3c2k6IGNyZWF0ZVRpbWVzdGFtcDogMjAxNjA4MjUwNTIwMTFaPGJyPgogICAgICBu
c2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAg
IG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246CiAgICAgIGNsb25lQWdyZWVtZW50MS1zZWF0dGxl
bmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG1vZGlmaWVy
c05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG1vZGlm
eVRpbWVzdGFtcDogMjAxNzA4MTAxODM0MjJaPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1
UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICBtYXN0ZXJBZ3JlZW1l
bnQxLXNlYXQ8YnI+CiAgICAgIMKgdGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LG91PWNzdXNl
cnMsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUJpbmRNZXRo
b2Q6IFNpbXBsZTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FDcmVkZW50aWFs
czoKICAgICAge0FFUy1UVWhOUjBOVGNVZFRTV0l6UkZGRlJrUlVRbTFOUlZWSFExPGJyPgrCoE54
UjFOSllqTkVVVVZHUkVSQk5FSkRVWGhOZW1zeVRsUmthMDVUTUhoWk1sRTFUVEpLYkEwS1QxTXdO
VTFIVG0xUFYwVjZUMU13TWs1PGJyPgrCoHFhek5OVjBWM1RuZEJRMEZSU1VOQlUwRjNRMmRaU1V0
dldrbG9kbU5PUVdkamQwaFJXVXBaU1ZwSlFWZFZSQTBLUWtGRmNVSkNRelpJPGJyPgogICAgICDC
oGQyMHpjSE5NWVRaS1QzZFFWRGc0Ulc5WFJBPT19UHBlWnAwV1l5TmlBN0RXcXJzSmZCdz09PGJy
PgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUhvc3Q6IGZyZWVpcGEtc2VhLmJwdC5y
b2Nrczxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FQb3J0OiAzODk8YnI+CiAg
ICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhUm9vdDogbz1pcGFjYTxicj4KICAgICAgbnNj
cGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FUcmFuc3BvcnRJbmZvOiBUTFM8YnI+CiAgICAgIG5zY3Bl
bnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU3YzI5MWQ5MDAwMDA0Mjkw
MDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1MHJ1djoge3JlcGxpY2EgMTA2NQogICAg
ICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1z
ZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fSA1
N2Y4NDxicj4KICAgICAgwqAwYmYwMDAwMDQyOTAwMDAgNTk4Y2EzMWYwMDAxMDQyOTAwMDA8YnI+
CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwCiAgICAgIDxhIGNs
YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y
b2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fTxicj4KICAgICAg
bnNjcGVudHJ5d3NpOiBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUKICAg
ICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEt
c2VhLmJwdC5yIj5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnI8L2E+PGJyPgogICAgICDCoG9ja3M6
Mzg5fSAwMDAwMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc3J1dlJlcGxpY2FMYXN0TW9k
aWZpZWQ6IHtyZXBsaWNhIDEyOTAKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4
dCIgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQu
cm88L2E+PGJyPgogICAgICDCoGNrczozODl9IDAwMDAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3
c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6
IG5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQ8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVS
ZXBsaWNhRW5hYmxlZDogb248YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhcmVh
cGFjdGl2ZTogMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FMYXN0VXBkYXRl
U3RhcnQ6IDE5NzAwMTAxMDAwMDAwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxp
Y2FMYXN0VXBkYXRlRW5kOiAxOTcwMDEwMTAwMDAwMFo8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTog
bnNkczVyZXBsaWNhQ2hhbmdlc1NlbnRTaW5jZVN0YXJ0dXA6PGJyPgogICAgICBuc2NwZW50cnl3
c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM6IEVycm9yICgxOSkgUmVwbGljYXRpb24K
ICAgICAgZXJyb3IgYWNxdWk8YnI+CiAgICAgIMKgcmluZyByZXBsaWNhOiBSZXBsaWNhIGhhcyBk
aWZmZXJlbnQgZGF0YWJhc2UgZ2VuZXJhdGlvbiBJRCwKICAgICAgcmVtb3RlIHJlcGxpY2EgbWE8
YnI+CiAgICAgIMKgeSBuZWVkIHRvIGJlIGluaXRpYWxpemVkIChSVVYgZXJyb3IpPGJyPgogICAg
ICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYVVwZGF0ZUluUHJvZ3Jlc3M6IEZBTFNFPGJyPgog
ICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RJbml0U3RhcnQ6IDE5NzAwMTAxMDAw
MDAwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FMYXN0SW5pdEVuZDogMTk3
MDAxMDEwMDAwMDBaPGJyPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgPC90
dD4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTk0Mzk3RS4yMDQwOEBy
ZWRoYXQuY29tIj4KICAgICAgPHA+PHR0PiBiZXN0IHJlZ2FyZHM8YnI+CiAgICAgICAgICB0aGll
cnJ5PGJyPgogICAgICAgIDwvdHQ+PC9wPgogICAgICA8YmxvY2txdW90ZQogICAgICAgIGNpdGU9
Im1pZDo3ZmMyMzQzMi1lMzM5LTliNzUtYjlhNi1hZTQ2MjhmNzg0ZTJAYnJvd25wYXBlcnRpY2tl
dHMuY29tIgogICAgICAgIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlw
ZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJAcmVkaGF0LmNvbSI+CiAgICAgICAg
ICBPbiBmcmVlaXBhLXNlYSBhbmQgc2VhdHRsZW5mcyB5b3UgbWF5IGNoZWNrIHRoZSBpcGFjYSBy
ZXBsaWNhCiAgICAgICAgICBhZ3JlZW1lbnRzIHN0YXR1cyBiZWZvcmUvYWZ0ZXIgcmVpbml0LiBJ
IHdvdWxkIGd1ZXNzIHRoZXkgYXJlCiAgICAgICAgICBjdXJyZW50bHkgcmVwb3J0aW5nIGZhaWx1
cmVzIGJldHdlZW4gdGhlc2UgdHdvIHJlcGxpY2FzLjxicj4KICAgICAgICAgIDxicj4KICAgICAg
ICAgIDx0dD5sZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYiAi
PC90dD48dHQ+Y249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFwcGluZwogICAgICAgICAgICB0
cmVlLGNuPWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAg
ICAgICAgICAgIG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM8YnI+CiAgICAgICAgICAgIDxi
cj4KICAgICAgICAgIDwvdHQ+PC9ibG9ja3F1b3RlPgogICAgICAgIDx0dD5bcm9vdEBmcmVlaXBh
LXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgIG1h
bmFnZXInIC1XIC1iICJjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgICAg
ICB0cmVlLGNuPWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQi
CiAgICAgICAgICBuc2RzNXJlcGxpY2FMYXN0VXBkYXRlU3RhdHVzPGJyPgogICAgICAgICAgRW50
ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgZG46CmNuPWNsb25lQWdyZWVtZW50MS1m
cmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBsaWNhLGNuPW9cM0RpcGFjPGJy
PgogICAgICAgICAgwqBhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgICBu
c2RzNXJlcGxpY2FMYXN0VXBkYXRlU3RhdHVzOiBFcnJvciAoMzIpIFByb2JsZW0gY29ubmVjdGlu
ZyB0bwogICAgICAgICAgcmVwbGljYSAtIExEQVAgPGJyPgogICAgICAgICAgwqBlcnJvcjogTm8g
c3VjaCBvYmplY3QgKGNvbm5lY3Rpb24gZXJyb3IpPGJyPgogICAgICAgICAgPGJyPgogICAgICAg
ICAgZG46CmNuPW1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNh
dCxjbj1yZXBsaWNhLGNuPW9cM0RpcGFjPGJyPgogICAgICAgICAgwqBhLGNuPW1hcHBpbmcgdHJl
ZSxjbj1jb25maWc8YnI+CiAgICAgICAgICBuc2RzNXJlcGxpY2FMYXN0VXBkYXRlU3RhdHVzOiBF
cnJvciAoMTkpIFJlcGxpY2F0aW9uIGVycm9yCiAgICAgICAgICBhY3F1aXJpbmcgcmVwbGljYTog
PGJyPgogICAgICAgICAgwqBSZXBsaWNhIGhhcyBkaWZmZXJlbnQgZGF0YWJhc2UgZ2VuZXJhdGlv
biBJRCwgcmVtb3RlIHJlcGxpY2EKICAgICAgICAgIG1heSBuZWVkIHRvIGJlIGk8YnI+CiAgICAg
ICAgICDCoG5pdGlhbGl6ZWQgKFJVViBlcnJvcik8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAg
ICBhbmQ8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhd
IyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicgLVcg
LWIgImNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcKICAgICAgICAgIHRyZWUsY249
Y29uZmlnIiAib2JqZWN0Q2xhc3M9bnNkczVyZXBsaWNhdGlvbmFncmVlbWVudCIKICAgICAgICAg
IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM8YnI+CiAgICAgICAgICBFbnRlciBMREFQIFBh
c3N3b3JkOiA8YnI+CiAgICAgICAgICBkbjoKY249Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMu
YnB0LnJvY2tzLXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhY2E8YnI+CiAgICAgICAg
ICDCoCxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgICAgbnNkczVyZXBsaWNh
TGFzdFVwZGF0ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBsaWNhdGlvbiBlcnJvcgogICAgICAgICAg
YWNxdWlyaW5nIHJlcGxpY2E6IDxicj4KICAgICAgICAgIMKgUmVwbGljYSBoYXMgZGlmZmVyZW50
IGRhdGFiYXNlIGdlbmVyYXRpb24gSUQsIHJlbW90ZSByZXBsaWNhCiAgICAgICAgICBtYXkgbmVl
ZCB0byBiZSBpPGJyPgogICAgICAgICAgwqBuaXRpYWxpemVkIChSVVYgZXJyb3IpPGJyPgogICAg
ICAgICAgPGJyPgogICAgICAgIDwvdHQ+PGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiIGNpdGU9Im1pZDo1OThDMkI0Ri4yMDAwMjAyQHJlZGhhdC5jb20iPjx0dD4KICAgICAgICAg
IDwvdHQ+CiAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5
ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAg
ICAgICAgICAgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgc2V2ZXJhbCB0aW1lcyBvdmVy
IHRoZSB5ZWFycyB3aGVuIHJlcGxpY2F0aW9uIGhhcyBzdG9wcGVkLsKgCiAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBSZXBsaWNhdGlvbiBhY3R1YWxseSBpcyB3
b3JraW5nLCBhcyBmYXIgYXMgdXNlciBhbmQgbWFjaGluZQogICAgICAgICAgICBhY2NvdW50cyBh
bmQgYXR0cmlidXRlcyBhcmUgY29uY2VybmVkIGFueXdheSwgYW5kIGhhcyBiZWVuCiAgICAgICAg
ICAgIGZvciBhIHdoaWxlLjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUaGVyZSBp
cyBhIHpvbWJpZSBzZXJ2ZXIgZnJlZWlwYS1kYWwuYnB0LnJvY2tzIHRoYXQgSSBjYW4ndAogICAg
ICAgICAgICBnZXQgcmlkIG9mLi4uIGl0IHNob3dzIHVwIGluIHRoZSBHVUkgb24gdGhlIFRvcG9s
b2d5IHBhZ2UKICAgICAgICAgICAgYnV0IGdlbmVyYXRlcyBhIFNlcnZlciBub3QgZm91bmQgZXJy
b3IuwqAgSSBkb24ndCBrbm93IGlmCiAgICAgICAgICAgIHRoYXQncyByZWxhdGVkLjxicj4KICAg
ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICAgIFpvbWJpZSBzZXJ2
ZXJzIGhhdmUgYmVlbiBkaXNjdXNzZWQgYSBsb3Qgb24gdGhpcyBtYWlsaW5nIGxpc3QuCiAgICAg
ICAgICBZb3UgbWF5IGdldCByaWQgb2YgdGhlbSB3aXRoIGxpc3QtcnV2L2NsZWFuLXJ1diBzdWJj
b21tYW5kLgogICAgICAgICAgUmVwbGljYXRpb24gdXN1YWxseSBtYW5hZ2UgdG8gd29yayBmaW5l
IGV2ZW4gaWYgc29tZSB6b21iaWUKICAgICAgICAgIGVudHJpZXMgZXhpc3QgYnV0IGl0IGlzIGEg
Z29vZCBwcmFjdGljZSB0byBjbGVhbiB0aGVtLjxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg
ICAgICAgWWVhaCwgSSd2ZSBiZWVuIHRocm91Z2ggZXZlcnkgcG9zc2libGUgY29tYmluYXRpb24g
b2YKICAgICAgICBsaXN0LXJ1di9jbGVhbi1ydXYuwqAgSSBoYXZlIHNvbWV0aGluZyBvZGQgZ29p
bmcgb24gaW4gdGhhdCBubwogICAgICAgIHJlcGxpY2F0aW9uIGFncmVlbWVudHMgc2hvdyB1cCBh
bnl3aGVyZSBmb3IgZnJlZWlwYS1kYWwuPGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiIGNpdGU9Im1pZDo1OThDMkI0Ri4yMDAwMjAyQHJlZGhhdC5jb20iPgogICAgICAgICAgPGJy
PgogICAgICAgICAgcmVnYXJkczxicj4KICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICA8
YmxvY2txdW90ZQogICAgICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5ZjMtYWU0YS04Mzg5LTU0MjUt
OWI4NGIxMWI3MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0
ZSI+CiAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgY2l0
ZT0ibWlkOjU5OEFERTdGLjMwODAzMDhAcmVkaGF0LmNvbSI+IDxicj4KICAgICAgICAgICAgICA8
ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDA4LzA4LzIwMTcgMTA6MzMgUE0sIElhbgog
ICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICAg
ICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgICAgICAg
IGNpdGU9Im1pZDoyZjYwYzRhZi02ODBjLTQzODItOTcwNC00MWEyNGM4MTIxYTJAYnJvd25wYXBl
cnRpY2tldHMuY29tIgogICAgICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAg
ICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsKICAg
ICAgICAgICAgICAgICAgY2hhcnNldD11dGYtOCI+CiAgICAgICAgICAgICAgICA8cD5PbiA4Lzcv
MTcgMTo0NCBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6PGJyPgogICAgICAgICAgICAgICAgPC9w
PgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAgICAgICAgICAg
ICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+CiAgICAgICAgICAgICAg
ICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIKICAgICAgICAgICAg
ICAgICAgICBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiPgogICAgICAgICAgICAgICAgICA8YnI+
CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0ibW96
LWNpdGUtcHJlZml4Ij5PbiAwOC8wNy8yMDE3IDA5OjIyIEFNLAogICAgICAgICAgICAgICAgICAg
IEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICAg
ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAg
ICAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUy
YzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgICAgICAgICB0eXBlPSJjaXRlIj5PbiAwOC8wNC8y
MDE3IDExOjAyIFBNLCBJYW4gSGFyZGluZyB2aWEKICAgICAgICAgICAgICAgICAgICBGcmVlSVBB
LXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i
Y2l0ZSI+T24gOC80LzE3IDI6MTYgQU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgICAgICBC
bGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6
MTMgUE0sCiAgICAgICAgICAgICAgICAgICAgICAgIElhbiBIYXJkaW5nIHZpYSBGcmVlSVBBLXVz
ZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9
ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTI6MjggQU0sCiAgICAgICAgICAgICAgICAgICAgICAgICAg
RmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAxMTo1MQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgUE0sIElhbiBIYXJkaW5nIHZpYSBGcmVlSVBBLXVzZXJzIHdyb3Rl
OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij5PbiAwOC8wMi8yMDE3IDEyOjExCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFNLCBG
bG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNwogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDAxOjQzIEFNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4
LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEyOjAzIFBNLCBSb2Ig
Q3JpdHRlbmRlbiB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFuIEhhcmRpbmcKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAwOC8wMS8yMDE3IDA3OjM5IEFNLCBGbG9yZW5jZQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9u
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwOC8wMS8yMDE3IDAzOjEx
IFBNLCBJYW4gSGFyZGluZwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
d3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiPk9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDA4LzAxLzIwMTcgMDE6NDggQU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5P
bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDA4LzAxLzIwMTcg
MDE6MzIgQU0sIElhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBPbiAwNy8zMS8yMDE3IDExOjM0IEFNLAogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUm9iIENyaXR0ZW5kZW4gd3Jv
dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
bG9ja3F1b3RlIHR5cGU9ImNpdGUiPklhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBIYXJkaW5nIHZpYQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp
dGUiPkkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBo
YWQgYW4gdW5leHBlY3RlZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHJlc3RhcnQgb2YgYW4gSVBBCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgc2VydmVyIHRoYXQgaGFkCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXBwYXJlbnRseSBoYWQgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZXMgcnVuIGJ1
dCBoYWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBu
b3QgYmVlbiByZXN0YXJ0ZWQuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgaXBhY3RsIHNheXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBwa2ktdG9tY2F0ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgd291bGQgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vdCBzdGFydC4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdHJhbmdlbHksIHRoZSBhY3R1
YWwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzZXJ2
aWNlIGFwcGVhcnMgdG8gYmUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBydW5uaW5nOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgZG9ndGFnIGlzIGFuIGFwcGxpY2F0aW9uCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGhpbiB0b21jYXQgc28gdG9tY2F0CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNhbiBydW4gd2l0
aG91dCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGRvZ3RhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIHJ1bm5pbmcuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBXZSBuZWVkIHRvIHNlZSBtb3JlIG9mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHRoZSBkb2d0YWcgZGVidWcgbG9nIHRvCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlZSB3aGF0IGlzIGdvaW5nIG9uLiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90
ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEl0IGxvb2tzIGxpa2Ug
YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGF1dGhlbnRp
Y2F0aW9uIHByb2JsZW0uLi4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBTU0wg
aGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIENvdWxkIG5vdCBjb25uZWN0IHRvIExEQVAKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciBob3N0CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzZWF0dGxlbmZzLmJwdC5yb2NrcyBwb3J0CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA2MzYgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRXJyb3IKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5ldHNjYXBlLmxkYXAuTERBUEV4
Y2VwdGlvbjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF1
dGhlbnRpY2F0aW9uIGZhaWxlZCAoNDkpCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgc3RvcmVzIGl0cyBp
bnRlcm5hbAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRhdGEg
aW4gdGhlIExEQVAgc2VydmVyIGFuZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIG5lZWRzIHRvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBlc3RhYmxpc2ggYSBzZWN1cmUgTERBUAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rpb24uIFlvdSBjYW4gY2hlY2sKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBob3cgdGhpcyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29ubmVjdGlvbiBpcyBjb25maWd1
cmVkIGluCi9ldGMvcGtpL3BraS10b21jYXQvY2EvQ1MuY2ZnLCBsb29rIGZvciA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgppbnRlcm5hbGRi
LmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVudEF1dGggPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRo
LmJpbmRETj1jbj1EaXJlY3RvcnkgTWFuYWdlciA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmlu
ZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnRO
aWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KaW50ZXJuYWxkYi5sZGFwY29u
bi5ob3N0PXZtLS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5wb3J0PTYzNgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KaW50ZXJuYWxkYi5sZGFwY29ubi5zZWN1cmVDb25u
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXV0aHR5cGUgY2FuIGJl
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3NsQ2xpZW50QXV0
aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNh
dGlvbiB3aXRoIGEgc3NsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBjZXJ0aWZpY2F0ZSkgb3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGggYSBiaW5kCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE4gYW5kIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNzd29yZCBzdG9yZWQgaW4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtp
LXRvbWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYpLgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
WW91IGNhbiB1c2UgdGhpcyBpbmZvcm1hdGlvbgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIHRvIG1hbnVhbGx5IGNoZWNrIHRoZQogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRlbnRpYWxzLiBGb3IgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGluc3RhbmNlIHdpdGggc3NsY2xpZW50
YXV0aDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNfQ0FDRVJURElSPS9ldGMvcGtpL3Br
aS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhwb3J0
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTERBUFRMU19DRVJU
PSdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgY2VydC1wa2ktY2EnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
bGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9ImxkYXBzOi8vIgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFw
czovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIChwcm92aWRlIHRoZSBwYXNzd29yZCBmcm9tCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRv
bWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSSBmb3VuZCB0aGlzOiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KaW50ZXJuYWxk
Yi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xDbGllbnRBdXRoIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0
aC5iaW5kRE49dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CmludGVybmFsZGIu
bGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRo
LmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KaW50ZXJu
YWxkYi5sZGFwY29ubi5jbG9uZVJlcGxpY2F0aW9uUG9ydD0zODkgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGFuZCB3aGVuIEkgdHJ5IHRoZSBsZGFwc2VhcmNoCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEkgYW0gcHJlc2VudGVkIHdpdGggYSBwcm9tcHQK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdG8gcHJvdmlkZSA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEgcGluL3Bhc3N3b3Jk
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgZW50ZXIgcGluLCBw
YXNzd29yZCwgb3IKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFz
cyBwaHJhc2UgZm9yIHNlY3VyaXR5IHRva2VuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZAogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBmaWxlLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGks
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBhcmUgcmlnaHQsIGluIDQuNC4g
dGhlcmUgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vIHB3ZGZp
bGUudHh0IGFuZCB0aGUgcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGNhbiBiZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBmb3VuZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9s
aWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29yZC5jb25mCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAod2l0aCB0aGUgdGFnIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsPS4uLikgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgQ2FuIHlvdSBjaGVjayBpZiB0aGUgcGFzc3dvcmQKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGggdGhlIHRhZyBpbnRlcm5hbD0uLi4gYWxsb3dz
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0byByZWFkIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBrZXlzIGZyb20gdGhlIE5T
UyBkYj8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0
aWwgLUsgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtp
L3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgKHByb3ZpZGUgcGFzc3dvcmQpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQgd29y
a3MuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh
cyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IENo
ZWNraW5nIHRva2VuICJOU1MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBD
ZXJ0aWZpY2F0ZSBEQiIgaW4gc2xvdCAiTlNTIFVzZXIKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBQcml2YXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiOiA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAwJmd0OyByc2EKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNm
NWRjNTdjYTUzNjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIChvcnBoYW4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAm
bHQ7IDEmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4
MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgTlNTIENlcnRpZmljYXRlIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBEQjphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDImZ3Q7IHJzYQog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDg4MWI3MjU0YzQwZmE0MGJjNTA2
ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Jmx0OyAzJmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlh
MjU1YTFkMTU1ODVhYzI4MDY0YzBmNDk4NmU0MTZiYzQ4NDAzwqDCoAogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDNmYjYwOWQwZjdkNzJjMmQzMjVk
NmEyZGMxNjU3N2E3ZjdlNWEwMWYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
Y2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZs
dDsgNSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5NDc5
YTk1NTZhZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhpcyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFzc3dvcmQgZnJvbSBwYXNzd29y
ZC5jb25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgbGRhcHNlYXJjaCAtSCA8YQog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGlu
ay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9
ImxkYXBzOi8vIgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRv
LW5vdC1zZW5kPSJ0cnVlIj5sZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSBlbnRlciBwaW4sIHBh
c3N3b3JkLCBvcgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBhc3MgcGhy
YXNlIGZvciBzZWN1cml0eSB0b2tlbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IFNBU0wvRVhURVJOQUwgYXV0aGVudGljYXRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBzdGFydGVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBsZGFwX3Nhc2xfaW50ZXJhY3RpdmVfYmluZF9zOgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEludmFsaWQgY3JlZGVudGlhbHMgKDQ5KSA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIFRoYXQgcGFzc3dvcmQgaXMgZ2V0dGluZyBtZQogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHNvbWV3aGVyZSB0aG91Z2gsIHNpbmNlIGlmIEkgcHV0CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW4gYSA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgbm9uc2Vuc2Ugb3IgaW5jb3JyZWN0IHBhc3N3b3Jk
IGl0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAganVzdCBwcm9tcHRzIG92
ZXIgYW5kIG92ZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9i
bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExldCdzIHN0ZXAgYmFjayBhIHNlY29uZC4g
WW91CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZ3JhZGVkIGZyb20gd2hh
dCB0byB3aGF0PyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBUaGVyZSB3YXNuJ3QgbXVjaCBvZiBhIGNoYW5nZS4uLiBJ
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqdXN0IGFzc3VtZWQgc29tZW9uZSBy
YW4geXVtIHVwZ3JhZGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFuZCBkaWRu
J3QgcmVzdGFydCwgdGhlbiB0aGUgcG93ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIG91dGFnZS4uLiBpdCBsb29rcyBsaWtlIG5vdCBtdWNoIG9mIGEKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIHZlcnNpb24gY2hhbmdlIHRob3VnaC4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIyBncmVwIGlwYSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBpcGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5v
YXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5j
ZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsaWJpcGFfaGJhYy0xLjE0LjAtNDMu
ZWw3XzMuNC54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFu
IDA4IDA0OjQ2OjA3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBw
eXRob24tbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICBKYW4gMDggMDQ6NDY6MDggSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgcHl0aG9uLWlwYWRkcmVzcy0xLjAuMTYtMi5lbDcubm9hcmNoIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNCBJbnN0YWxsZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcu
Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxs
ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00
LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0
NzowNSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWlu
dG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4g
MDggMDQ6NDc6MDUgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
aXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBKYW4gMDggMDQ6NDc6MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9h
cmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDcgVXBkYXRlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTcgVXBk
YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40LjAt
MTQuZWw3LmNlbnRvcy4xLjEueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjMg
VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40
LjAtMTQuZWw3LmNlbnRvcy4xLjEueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6
MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXIt
ZG5zLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4
IDA0OjQ3OjM2IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlw
YS1weXRob24tY29tcGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIGlwYS1weXRob24tNC4yLjAtMTUuMC4xLmVsNy5jZW50b3MuMTkueDg2XzY0CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQyIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9h
cmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50
b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3
LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ0IFVwZGF0ZWQ6
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQu
MC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDUg
VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2Vy
dmVyLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAw
OTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFk
bWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVs
IDI4IDA5OjU1OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBp
cGEtY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1
bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
aXBhLXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBK
dWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IGlwYS1zZXJ2ZXItZG5zLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgaXBhLXB5dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBncmVw
IHBraSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIEphbiAwOCAwNDo0NjowNSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgcGtpLWJhc2UtMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDkgVXBkYXRlZDoKICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGtyYjUtcGtpbml0LTEuMTQuMS0yNy5lbDdfMy54ODZfNjQg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IElu
c3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEt
MTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBKYW4gMDggMDQ6NDc6MTkgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHBraS10b29scy0xMC4zLjMtMTQuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMSBVcGRhdGVkOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQuZWw3XzMubm9hcmNo
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMiBV
cGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4zLjMt
MTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph
biAwOCAwNDo0NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
cGtpLWNhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjE2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRhdGVkOgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTkuZWw3
XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx
MDoxMzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXRv
b2xzLTEwLjMuMy0xOS5lbDdfMy54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMuMy0xOS5lbDdfMy5ub2Fy
Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIx
IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktY2EtMTAuMy4z
LTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBcmUgeW91IHJ1bm5pbmcgaW4gU0VMaW51eCBl
bmZvcmNpbmcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW9kZT8gPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIyBnZXRlbmZvcmNlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IEVuZm9yY2luZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4g
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJZiBzbyBjYW4geW91IHJ1
bjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0gQVZDIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBhdXNlYXJjaCAtbSBB
VkMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlIE5PTE9HIG9wdGlv
biB0byBsb2dfZm9ybWF0IGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXBy
ZWNhdGVkLiBQbGVhc2UgdXNlIHRoZSB3cml0ZV9sb2dzCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBvcHRpb24uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IFRoZSBOT0xPRyBvcHRpb24gaXMgb3ZlcnJpZGluZyB0aGUKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHdyaXRlX2xvZ3MgY3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAtLS0tIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHRpbWUtJmd0O01vbiBNYXIgMTQgMTA6Mzk6MDEgMjAxNiA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NBTEwKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBhcmNoPWMwMDAwMDNlIHN5c2NhbGw9MiBzdWNjZXNz
PW5vCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBleGl0PS0xMyBhMD03ZmJjYWIw
MzhkMTAgYTE9ODAwIGEyPTEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEzPTdm
YmNhNjBmNDJlMCBpdGVtcz0wIHBwaWQ9MTQwNgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgcGlkPTEyOTY1IGF1aWQ9NDI5NDk2NzI5NSB1aWQ9MCBnaWQ9MAogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgZXVpZD01ODE0MDAwMDEgc3VpZD0wIGZzdWlkPTU4MTQwMDAw
MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZWdpZD01ODE0MDAwMDEgc2dpZD0w
IGZzZ2lkPTU4MTQwMDAwMQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdHR5PShu
b25lKSBzZXM9NDI5NDk2NzI5NSBjb21tPSJzc2hkIgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHN1Ymo9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrZXk9KG51bGwpIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBtc2c9YXVkaXQoMTQ1Nzk3NzE0MS43Njc6MTc1MzcpOiBhdmM6wqAKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIGRlbmllZCB7IHJlYWQgfSBmb3IgcGlkPTEyOTY1CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb21tPSJzc2hkIiBuYW1lPSJhdXRob3Jp
emVkX2tleXMiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXY9ImRtLTIiIGlu
bz0xMTYzOTM1MTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNjb250ZXh0PXN5
c3RlbV91OnN5c3RlbV9yOnNzaGRfdDpzMC1zMDpjMC5jMTAyMwp0Y29udGV4dD1zeXN0ZW1fdTpv
YmplY3Rfcjp1bmxhYmVsZWRfdDpzMCB0Y2xhc3M9ZmlsZSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj
aXRlIj5JIHN1c3BlY3QgdGhhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0
aGUgc3Vic3lzdGVtIGNlcnQgd2FzIHJlbmV3ZWQgYW5kCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGV2ZXJ5dGhpbmcgd2Fzbid0IDxicj4KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgdXBkYXRlZCBwcm9wZXJseS4gSWYgSSdtIHJpZ2h0IHRoaXMKICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXMgdW5yZWxhdGVkIHRvIHRoZSB1cGdyYWRl
IGl0IGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBhIHNwb3RsaWdodCBvbiBpdC4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIENhbiB5b3UgcnVuIHRoZXNlIGNvbW1hbmRzOiA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89
aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRl
IGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgVGhpcyByZXR1cm5zIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAt
TExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1h
bmFnZXInIC1XIC1iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1
c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1
c2VyQ2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lH
OXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIHN0dWZmIC4u
LiA8YnI+ClpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1D
ZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89
QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdWJzeXN0
ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0
ZSI+YW5kIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1kCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgfCBncmVwIFNl
cmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwg
LUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRv
bWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lz
dGVtQ2VydCBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv
dGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBUaGVzZSBib3RoIHJldHVybiA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj
L3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgfCBncmVwCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lEOgogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgVW5yZWNvZ25pemVkIE9iamVjdCBJZGVudGlmaWVyLiA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj
L3BraS9wa2ktdG9tY2F0L2FsaWFzwqAgLW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4gIk5TUwogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIHNsb3QgIk5TUyBVc2Vy
CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcml2YXRlIEtleSBhbmQgQ2VydGlm
aWNhdGUgU2VydmljZXMiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9y
ICJOU1MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlIERCIjog
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0g
bGlzdGluZyBrZXlzOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU0VDX0VSUk9S
X1VOUkVDT0dOSVpFRF9PSUQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVbnJl
Y29nbml6ZWQgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv
dGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
eW91IG1hZGUgYSB0eXBvIGFuZCByZXF1ZXN0ZWQgdGhlIGtleXMKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAoLUspIGluc3RlYWQgb2YgdGhlIGNlcnRzICgtTCkuIFBsZWFzZQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHJ5IHdpdGggLUwgYW5kIHlvdSBzaG91bGQg
YmUgYWJsZSB0bwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlZSB0aGUgY2VydGlm
aWNhdGUgc2VyaWFsLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RA
c2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhr
aUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KWk5vNGVYN2pO
VDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
U28gdGhlIHNlcmlhbCBpcyA0PyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMg
Y2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtp
LXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVt
Q2VydCBjZXJ0LXBraS1jYScgfCBncmVwIFNlcmlhbAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAg
U2VyaWFsIE51bWJlcjogMTM0MTcxODU0MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAo
MHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBb
cm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLSA8YnI+Ck1J
SURiakNDQWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFR
S0RBbEMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICBBbmQgdGhpcyBjZXJ0IGlzIE5PVCB0aGUgc2FtZS4gPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hlbiBjZXJ0
bW9uZ2VyIHJlbmV3cyBhIGNlcnRpZmljYXRlLCBpdAogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgcnVucyBwcmUtc2F2ZSBhbmQgcG9zdC1zYXZlIGNvbW1hbmRzICh3aGljaAogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgeW91IGNhbiBzZWUgaW4gdGhlIG91dHB1dCBvZiBnZXRjZXJ0IGxp
c3QpLgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSW4geW91ciBjYXNlLCB0aGUgcG9zdC1z
YXZlIGNvbW1hbmQgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0
IGNlcnQtcGtpLWNhIHByb2JhYmx5IGZhaWxlZC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhpcyBjb21tYW5kIChvbiB0
aGUgcmVuZXdhbCBtYXN0ZXIpIGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICByZXNwb25z
aWJsZSBmb3IgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbQogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgdGhlIE5TUyBkYiB0byB0aGUgTERBUCBzZXJ2ZXIuIFlvdSBuZWVkCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBmaXJzdCB0byBjaGVjayB3aGljaCBJUEEgc2VydmVyIGlzIHRoZQog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVuZXdhbCBtYXN0ZXIgKGFzIHRoZSBzZXJpYWwg
bnVtYmVycyBhcmUgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEgY29tcGxldGVseSBk
aWZmZXJlbnQgcmFuZ2UsIEkgYXNzdW1lIHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICAg
IHlvdSBoYXZlIG11bHRpcGxlIElQQSBzZXJ2ZXJzIGNvbmZpZ3VyZWQKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIHdpdGggYSBDQSBpbnN0YW5jZSk6IDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICQgZXhwb3J0IEJBU0VE
Tj1gZ3JlcCBiYXNlZG4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvaXBhL2RlZmF1
bHQuY29uZiB8IGN1dCAtZD0gLWYyLWAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg
JCBraW5pdCBhZG1pbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFy
Y2ggLUxMTCAtUSAtaCBgaG9zdG5hbWVgIC1wIDM4OSAtWQogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgR1NTQVBJIC1iICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VETiIKJygmYW1w
Oyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJyBkbiA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICBkbjoKY249Q0EsY249dm0taXBhc2VydmVyLmlwYWRvbWFp
bi5jb20sY249bWFzdGVycyxjbj1pcGEsY249ZXRjLGRjPWlwYWRvbWFpbixkYz1jb20KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEluIHRoaXMgZXhhbXBsZSB0aGUgcmVuZXdh
bCBtYXN0ZXIgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZtLWlwYXNlcnZlci4gPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgSSBnZXQgdGhpcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1o
IGBob3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICAgICAgR1NTQVBJIC1i
ICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VETiIKICAgICAgICAgICAgICAgICAgICAg
ICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FSZW5ld2FsTWFzdGVyKSknCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
IGRuOgogICAgICAgICAgICAgICAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2VhLmJwdC5y
b2Nrcyxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICBXaGljaCBpcyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgSGkgSWFuLCA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgaXQncyBnZXR0
aW5nIGRpZmZpY3VsdCB0byBmb2xsb3cgdGhpcyB0aHJlYWQsIHNvCiAgICAgICAgICAgICAgICAg
ICAgICAgIGNvdWxkIHdlIHN0ZXAgYmFjayBhbmQgc3VtbWFyaXplPyA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICBZZXMsIGl0IGlz
LsKgIFNvcnJ5LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj
aXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNl
YSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgIENBIGNvbXBv
bmVudCBpcyBpbnN0YWxsZWQgYW5kICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAg
ICAgIGNlcnQtcGtpLWNhJyBoYXMgU2VyaWFsIG51bWJlciA0IGluIHRoZSBOU1NEQgogICAgICAg
ICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIE5vPyA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbcm9vdEBm
cmVlaXBhLXNlYSBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgIC9l
dGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAg
ICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgIMKgwqDCoMKgwqDCoMKgwqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MSAoMHg0ZmY5MDAw
ZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+LSBP
biBzZXJ2ZXIgc2VhdHRsZW5mcwogICAgICAgICAgICAgICAgICAgICAgICAod2hlcmUgUEtJIGZh
aWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50CiAgICAgICAgICAgICAgICAgICAgICAg
IGlzIGluc3RhbGxlZCBhbmQgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIGhhcwogICAgICAg
ICAgICAgICAgICAgICAgICBTZXJpYWwgbnVtYmVyIDEzNDE3MTg1NDEgaW4gdGhlIE5TU0RCCiAg
ICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMuIDxicj4KICAg
ICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIFll
cyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBb
cm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAg
ICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAg
ICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRm
ZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAtIEluIHRoZSBMREFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUKICAgICAg
ICAgICAgICAgICAgICAgICAgZW50cnkgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB3
aXRoCiAgICAgICAgICAgICAgICAgICAgICAgIFNlcmlhbCBudW1iZXIgNCAoaS5lLiBpdCBpcyB0
aGUgY2VydCBmcm9tCiAgICAgICAgICAgICAgICAgICAgICAgIGZyZWVpcGEtc2VhKS4gPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg
VGhpcyBpcyB3aGVyZSB0aGUgZGlmZmVyZW5jZSBpcy7CoCBUaGVyZSBhcmUgdHdvCiAgICAgICAg
ICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZXMgb24gdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24g
dGhlCiAgICAgICAgICAgICAgICAgICAgICBvdGhlci7CoCBJIHdvbmRlciBpZiB0aGlzIGlzIGEg
cmVzdWx0IG9mIHRoZSBzbG93CiAgICAgICAgICAgICAgICAgICAgICBtb3Rpb24gcmVwbGljYXRp
b24gdHJhaW53cmVjayBJIGhhdmUgZ29pbmcgb24gZHVlCiAgICAgICAgICAgICAgICAgICAgICB0
byBhIHpvbWJpZSByZXBsaWNhIGluIHRoZSBsZGFwIGRhdGFiYXNlIHRoYXQgbm8KICAgICAgICAg
ICAgICAgICAgICAgIGxvbmdlciBleGlzdHMgaW4gdGhlIHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qg
c2VlbQogICAgICAgICAgICAgICAgICAgICAgdG8gZ2V0IHJpZCBvZi4gPGJyPgogICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAg
ICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg
ICAgICAgICAgICB0aGUgcmVtYWluaW5nIGlzc3VlIGlzIGEgcmVwbGljYXRpb24gcHJvYmxlbS4g
VGhlcmUKICAgICAgICAgICAgICAgICAgICBpcyBhICJUcm91Ymxlc2hvb3RpbmcgcmVwbGljYXRp
b24iIHNlY3Rpb24gWzFdIGluCiAgICAgICAgICAgICAgICAgICAgSWRNIEFkbWluIGd1aWRlIHRo
YXQgbWF5IGhlbHAgeW91LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICAgICAgIFJlZ2FyZGluZyB5b3VyIHpvbWJpZSByZXBsaWNhLCB3aGljaCBjb21tYW5kcyBk
aWQKICAgICAgICAgICAgICAgICAgICB5b3UgdXNlIHRvIHRyeSB0byByZW1vdmUgaXQsIGFuZCB3
aGF0IHdhcyB0aGUKICAgICAgICAgICAgICAgICAgICBvdXRwdXQ/IDxicj4KICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzFdIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst
ZnJlZXRleHQiCmhyZWY9Imh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9l
bi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0
eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9u
Lmh0bWwiCiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBz
Oi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJp
c2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRf
UG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIEhpLDxicj4KICAgICAgICAgICAgICAg
ICAgPGJyPgogICAgICAgICAgICAgICAgICBUbyBkZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9y
IHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAgICAgICAgICAgICAgICBzZXZlcmFsIGluZm8gYnV0
IHN0YXJ0aW5nIHdpdGggdGhlIHJlc3VsdHMgb2YgdGhlCiAgICAgICAgICAgICAgICAgIGZvbGxv
d2luZyBjb21tYW5kczxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAg
ICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAgICAgInVp
ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICAg
ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlh
bmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFu
YWdlcicgLVcgLWIKICAgICAgICAgICAgICAgICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlw
YWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3Jk
OiA8YnI+CiAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj
YTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9
cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAg
ICAgICAgICBlbnRyeXVzbjthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNTt2dWNzbi01OTM4ZTY4
ODAwMDEwNDI5MDAwNToKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIMKgNzUy
NzQ4OTc8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgICAgICAgICBt
b2RpZnlUaW1lc3RhbXA7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDQ7dnVjc24tNTkzOGU2ODgw
MDAxMDQyPGJyPgogICAgICAgICAgICAgICAgwqA5MDAwNDogMjAxNzA2MDgwNTUzMzRaPGJyPgog
ICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICAgICAgbW9kaWZpZXJzTmFt
ZTthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMzt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDxicj4K
ICAgICAgICAgICAgICAgIMKgMDAzOiBjbj1EaXJlY3RvcnkgTWFuYWdlcjxicj4KICAgICAgICAg
ICAgICAgIG5zY3BlbnRyeXdzaTogbnNVbmlxdWVJZDoKICAgICAgICAgICAgICAgIDQ4ODA5YjQw
LTJiYjkxMWU1LTk2YTBiOGI4LTFmZGQ4MDc0PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiBjbjogcGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVh
dGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRy
eXdzaTogY3JlYXRvcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAgICAgICAgICAg
ICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb247dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDE6
CiAgICAgICAgICAgICAgICAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWM8YnI+CiAgICAgICAgICAg
ICAgICDCoGF0ZSBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJP
Q0tTPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICAgICAgZGVz
Y3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVsZXRlZDoKICAgICAgICAgICAg
ICAgIDI7NDtDTj1DZXJ0aWZpY2E8YnI+CiAgICAgICAgICAgICAgICDCoHRlIEF1dGhvcml0eSxP
PUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgICAgICAg
ICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBv
YmplY3RDbGFzczogdG9wPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RD
bGFzczogcGVyc29uPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFz
czogb3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6
IG9iamVjdENsYXNzOiBpbmV0T3JnUGVyc29uPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiBvYmplY3RDbGFzczogY21zdXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdz
aTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgICAgbnNjcGVu
dHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog
dXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRB
TkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICAgICAgICAgICAmbHQ7c25pcCZndDs8
YnI+CsKgY0JkNG5PVjRtOUErcVJaTm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRm
QVBYTUpvRmM9PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICAg
ICAgdXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAgICAgICAg
ICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8YnI+CiAgICAgICAgICAgICAgICAmbHQ7c25pcCZn
dDs8YnI+CiAgICAgICAgICAgICAgICDCoEFSPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5
d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgICAgICAgICBuc2Nw
ZW50cnl3c2k6IHVzZXJzdGF0ZTogMTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog
dXNlcnR5cGU6IGFnZW50VHlwZTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogcGFy
ZW50aWQ6IDI8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGVudHJ5aWQ6IDUxPGJy
PgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAgICAgICAgICAg
ICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IGFuZDxicj4KICAgICAg
ICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAg
ICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAg
ICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAg
ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp
cmVjdG9yeQogICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1w
ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpPGJyPgogICAgICAgICAg
ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgZG46IHVpZD1w
a2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3
c2k6IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhPGJyPgogICAgICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNvOiBDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+
CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAg
ICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SPGJy
PgogICAgICAgICAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgrCoGNCZDRuT1Y0bTlBK3FSWk5vNGVY
N2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgICAg
ICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAg
ICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnM8YnI+CiAgICAgICAgICAg
ICAgICDCoHlzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3Np
OiBlbnRyeWlkOiA1MTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6
IDI8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG1vZGlmeVRpbWVzdGFtcDogMjAx
NTA3MTYxMjUxNDZaPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l
c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog
bW9kaWZpZXJzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgICAgICAgICAgICBu
c2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAg
ICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4K
ICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgogICAgICAgICAg
ICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAgICAg
ICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog
Y246IHBraWRidXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc246IHBraWRi
dXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+
CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAg
ICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICAgICAg
ICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxi
cj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGluZXRPcmdQZXJz
b248YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1c2Vy
PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOgogICAgICAgICAg
ICAgICAgNDg4MDliNDAtMmJiOTExZTUtOTZhMGI4YjgtMWZkZDgwNzQ8YnI+CiAgICAgICAgICAg
ICAgICBuc2NwZW50cnl3c2k6IGVudHJ5dXNuOiA4Njxicj4KICAgICAgICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3MS4x
MDAwMTA2QHJlZGhhdC5jb20iPiA8YnI+CiAgICAgICAgICAgICAgICAgIEZyb20gdGhlIG91dHB1
dCB5b3UgbWF5IG9ubHkgY29weS9wYXN0IHRoZSBvbmVzCiAgICAgICAgICAgICAgICAgIHJlbGF0
ZWQgdG8gdXNlckNlcnRpZmljYXRlPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgQWxzbyB0byBkdW1wIHRoZSBjdXJyZW50
IHJlcGxpY2F0aW9uIHN0YXR1cywgc2VuZCB0aGUKICAgICAgICAgICAgICAgICAgcmVzdWx0wqAg
b2Y8YnI+CiAgICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2Vh
cmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAt
YiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+CiAgICAgICAgICAgICAgICAgICAgPC9pPiIo
JmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZm
ZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgICAgIDwvZm9udD48L2Js
b2NrcXVvdGU+CiAgICAgICAgICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNl
YXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1i
ICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZm
ZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAgICAgICAgICAg
RW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgZG46IGNuPXJlcGxpY2Es
Y249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgICAgICAg
ICBjbjogcmVwbGljYTxicj4KICAgICAgICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAg
ICAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAg
ICAgICAgICAgICAgIGNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9jPGJyPgogICAg
ICAgICAgICAgICAgwqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAg
ICAgICAgICAgICAgbnNEUzVSZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAg
ICAgICAgICAgICAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvYzxicj4KICAg
ICAgICAgICAgICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAg
ICAgICAgICAgICAgIG5zRFM1UmVwbGljYUlkOiAxMDY1PGJyPgogICAgICAgICAgICAgICAgbnNE
UzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3OTExZTYtOTNlNmVmNGItNjlkY2MyZDE8YnI+CiAg
ICAgICAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAg
ICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgICAgICAgICAgICAgIG5zU3RhdGU6OgogICAg
ICAgICAgICAgICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJB
QUFBQUFBQUFBPT08YnI+CiAgICAgICAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDog
Y249cmVwbGljYXRpb24KICAgICAgICAgICAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLGNu
PWV0YyxkYz1icHQsPGJyPgogICAgICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAg
ICAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICAg
ICAgICAgICAgICBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAgICAgICAgICAgb2JqZWN0Q2xh
c3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgICAgICAgIG9iamVjdENsYXNzOiBleHRlbnNp
Ymxlb2JqZWN0PGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRp
b259IDU3YzI5MWQ5MDAwMDA0MjkwMDAwPGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7
cmVwbGljYSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAg
Y2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRh
cDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j
a3M6Mzg5PC9hPn0KICAgICAgICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICAg
ICAgICAgICAgICDCoDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8YnI+CiAgICAgICAgICAgICAgICBu
c2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAg
ICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAg
ICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5m
cy5icHQucm9ja3M6Mzg5PC9hPn08YnI+CiAgICAgICAgICAgICAgICBuc2RzNWFnbXRtYXhjc246
CiAgICAgICAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQu
cm9ja3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgICAgICAgICAgICAgwqB0bGVuZnMuYnB0LnJv
Y2tzOzM4OTt1bmF2YWlsYWJsZTxicj4KICAgICAgICAgICAgICAgIG5zZHM1YWdtdG1heGNzbjoK
ICAgICAgICAgICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5y
b2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgICAgICAgICDCoHRsZW5mcy5icHQucm9j
a3M7Mzg5O3VuYXZhaWxhYmxlPGJyPgogICAgICAgICAgICAgICAgbnNydXZSZXBsaWNhTGFzdE1v
ZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0
LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNl
YS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
PmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICAgIDU5
OGE8YnI+CiAgICAgICAgICAgICAgICDCoDFjMTY8YnI+CiAgICAgICAgICAgICAgICBuc3J1dlJl
cGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAgPGEKICAgICAgICAgICAgICAgICAgY2xh
c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcDov
L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1z
ZW5kPSJ0cnVlIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAg
ICAgICAgIDAwMDAwPGJyPgogICAgICAgICAgICAgICAgwqAwMDA8YnI+CiAgICAgICAgICAgICAg
ICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogODg1PGJyPgogICAgICAgICAgICAgICAgbnNkczVy
ZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9
ImNpdGUiCiAgICAgICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhh
dC5jb20iPjxmb250IHNpemU9Ii0xIj4KICAgICAgICAgICAgICAgICAgICBhbmQ8YnI+CiAgICAg
ICAgICAgICAgICAgIDwvZm9udD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1M
TEwgLUQKICAgICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYiAibz1p
cGFjYSI8Zm9udCBzaXplPSItMSI+PGk+CiAgICAgICAgICAgICAgICAgICAgPC9pPiIoJmFtcDso
b2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZm
ZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgICAgIDwvZm9udD48L2Jsb2NrcXVv
dGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVj
dG9yeQogICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgIm89aXBhY2EiCiIoJmFtcDsob2Jq
ZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm
ZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8
YnI+CiAgICAgICAgICAgICAgICBkbjogY249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFwcGlu
ZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgICAgIGNuOiByZXBsaWNhPGJyPgogICAg
ICAgICAgICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgICAgICAgICAgIG5zRFM1UmVwbGlj
YUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICAgICAgICAgICAgY2xvbmVBZ3Jl
ZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2s8YnI+CiAgICAgICAgICAgICAgICDCoHMtcGtpLXRv
bWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgICAgIG5zRFM1UmVwbGlj
YUlkOiAxMjkwPGJyPgogICAgICAgICAgICAgICAgbnNEUzVSZXBsaWNhTmFtZTogODcwNmFiMWUt
NmE4MzExZTYtYTliZmRiYmYtNzRkYzczMjM8YnI+CiAgICAgICAgICAgICAgICBuc0RTNVJlcGxp
Y2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAgICAgbnNEUzVSZXBsaWNhVHlwZTogMzxi
cj4KICAgICAgICAgICAgICAgIG5zU3RhdGU6OgogICAgICAgICAgICAgICAgQ2dVQUFBQUFBQUFL
RllwWkFBQUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAg
ICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAgICAgICAg
ICAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAgICAg
ICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRk
bmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICAgICAgICAgICAgICBvYmplY3RDbGFzczog
dG9wPGJyPgogICAgICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAg
ICAgICAgICAgICAgIG9iamVjdENsYXNzOiBleHRlbnNpYmxlb2JqZWN0PGJyPgogICAgICAgICAg
ICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU1YzhmM2FlMDAwMDAwNjAwMDAw
PGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1u
b3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVl
dGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tz
OjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAg
ICA1N2JlODA0YzAwMDAwNTBhMDAwMDxicj4KICAgICAgICAgICAgICAgIMKgIDU4NzIzNjE1MDAw
MDA1MGEwMDAwPGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxh
IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQt
bGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh
LmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAg
ICAgICAgICAgICAgIDU3YjEwM2Q0MDAwMDA0MjkwMDA8YnI+CiAgICAgICAgICAgICAgICDCoDAg
NTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAgICAgICAgICAgICAgICBuc2RzNWFnbXRtYXhjc246
CiAgICAgICAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5y
b2Nrcy1wa2ktdG9tY2F0O2ZyZWVpPGJyPgogICAgICAgICAgICAgICAgwqBwYS1zZWEuYnB0LnJv
Y2tzOzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAwPGJyPgogICAgICAgICAgICAgICAgbnNy
dXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICAg
IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgIGhyZWY9Imxk
YXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgICAgIG1vei1kby1u
b3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAg
ICAgICAgICAgICAwMDAwMDxicj4KICAgICAgICAgICAgICAgIMKgMDAwPGJyPgogICAgICAgICAg
ICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAg
ICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAg
IGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgICAg
ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5
PC9hPn0KICAgICAgICAgICAgICAgIDAwMDA8YnI+CiAgICAgICAgICAgICAgICDCoDAwMDA8YnI+
CiAgICAgICAgICAgICAgICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogMzxicj4KICAgICAgICAg
ICAgICAgIG5zZHM1cmVwbGljYXJlYXBhY3RpdmU6IDA8YnI+CiAgICAgICAgICAgICAgICA8Ymxv
Y2txdW90ZSB0eXBlPSJjaXRlIgogICAgICAgICAgICAgICAgICBjaXRlPSJtaWQ6NTk4ODI4NzEu
MTAwMDEwNkByZWRoYXQuY29tIj48Zm9udCBzaXplPSItMSI+CiAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgIFJlZ2FyZHM8YnI+CiAgICAgICAgICAgICAgICAgICAg
dGhpZXJyeTxicj4KICAgICAgICAgICAgICAgICAgPC9mb250PgogICAgICAgICAgICAgICAgICA8
YmxvY2txdW90ZQogICAgICAgICAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIz
NTAtMzQ3MC01ZDFhOWI5MjUyYzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgICAgICAgICB0eXBl
PSJjaXRlIj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5bcm9v
dEBmcmVlaXBhLXNlYSBpYW5oXSMKICAgICAgICAgICAgICAgICAgICAgIGxkYXBzZWFyY2ggLUxM
TCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgICAgICAgICAgICB1
aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAg
ICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgRW50ZXIg
TERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVz
ZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRp
ZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJn
a3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhk
ZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6Ogog
ICAgICAgICAgICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJQkFnSUVUL2tBRFRBTkJna3Foa2lH
OXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLCiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAmbHQ7dHJ1bmNhdGVkJmd0OwogICAgICAgICAgICAgICAgICAgICAg
ZnVRUVptUDFYcktrcmZzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgZGVzY3JpcHRpb246IDI7MTM0MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAg
ICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICDCoCAsTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAg
ICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgICAg
ICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQog
ICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46IHVp
ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
dXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB
Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAg
ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4
bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlv
bjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1C
UFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgIMKgIENLUyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlCiAgICAgICAg
ICAgICAgICAgICAgICAgIGNlcnRpZmljYXRlcyBkYXRlcywgSSBndWVzcyB0aGF0IHRoZSBtb3N0
IHJlY2VudAogICAgICAgICAgICAgICAgICAgICAgICBvbmUgaXMgb24gc2VydmVyIHNlYXR0bGVu
ZnMgKGJlY2F1c2Ugb2Ygc2VyaWFsCiAgICAgICAgICAgICAgICAgICAgICAgIG51bWJlcnMpLiBD
YW4geW91IGNvbmZpcm0gdGhpcyAoYmVjYXVzZSBvdXIgZ29hbAogICAgICAgICAgICAgICAgICAg
ICAgICBpcyB0byBoYXZlIHRoZSBtb3N0IHJlY2VudCBjZXJ0IHN0b3JlZCBpbiBhbGwKICAgICAg
ICAgICAgICAgICAgICAgICAgdGhlIE5TU0RCcyBhbmQgaW4gTERBUCk/IDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBUaGFua3MsIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9j
a3F1b3RlIHR5cGU9ImNpdGUiPklmIHlvdXIgcmVuZXdhbCBtYXN0ZXIKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgIGlzIHRoZSBtYWNoaW5lIG9uIHdoaWNoIHRoZSBOU1MgREIKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgY29udGFpbnMgdGhl
IG5ld2VyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LCB0aGVuIHlvdSBjYW4gbWFu
dWFsbHkgcnVuIHRoZSBzY3JpcHRzOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSWYgSSdtIGludGVycHJldGlu
ZyB0aGlzIGNvcnJlY3RseSwgdGhlbiBpdAogICAgICAgICAgICAgICAgICAgICAgICAgIGlzLi4u
IHNvIEkgcmFuIHRoaXMgb24gdGhlIGJyb2tlbiBtYWNoaW5lCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgKHNlYXR0bGVuZnMpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBzdWRvCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3Rv
cF9wa2ljYWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgJCBzdWRvCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2Ff
Y2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgInN1YnN5c3RlbUNlcnQgY2VydC1wa2kt
Y2EiIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIEkgcmFuIHRoaXMsIGl0IHRvb2sgYSB3aGlsZSwgdGhl
biBJIHJlLWNoZWNrZWQKICAgICAgICAgICAgICAgICAgICAgICAgICBhbmQgdGhlIHNlcmlhbCBz
dGlsbCBzZWVtcyB0byBiZSA0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9y
eSBtYW5hZ2VyJyAtVwogICAgICAgICAgICAgICAgICAgICAgICAgIC1iIHVpZD1wa2lkYnVzZXIs
b3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNh
dGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAg
UGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNl
cixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNl
cnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJ
QkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICDCoAogICAgICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdq
TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAg
ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtD
Tj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5S
T0NLUztDTj1DQQogICAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NL
UyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg
ICAgICAgIEhlcmUncyB3aGF0IHdhcyBpbgogICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIv
bG9nL3BraS9wa2ktdG9tY2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts
b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgID09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09IDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
CiAgICAgICAgICAgICAgICAgICAgICAgICAgPT09PT3CoCBERUJVRyBTVUJTWVNURU0gSU5JVElB
TElaRUTCoMKgID09PT09PT0gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAg
ICAgICAgICA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PSA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVz
dGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg
ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRo
PwogICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3Mv
YXV0b1NodXRkb3duLmNydW1iCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0
U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGFib3V0IHRvIGxv
b2sgZm9yIGNlcnQgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgYXV0by1zaHV0ZG93biBz
dXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBr
aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx
XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0Vu
Z2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx
NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAg
ICAgICBDTVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1kZWJ1ZyA8YnI+CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgog
ICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgZGVidWcgPGJy
PgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo
b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGlu
aXRTdWJzeXN0ZW0gaWQ9bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVn
LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg
ICAgICAgICAgQ01TRW5naW5lOiByZWFkeSB0byBpbml0IGlkPWxvZyA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w
LTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9z
aWduZWRBdWRpdC9jYV9hdWRpdCkKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3Rh
cnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9n
cy9jYS9zeXN0ZW0pCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x
XToKICAgICAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAgICAgICAg
ICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvY2EvdHJh
bnNhY3Rpb25zKQogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06
CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0
ZG93bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox
Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAg
ICBDTVNFbmdpbmU6IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1
bWIKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg
ICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IK
ICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRvLXNodXRkb3duIHN1cHBvcnQ6YXVkaXRTaWdu
aW5nQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAg
ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy
dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0
OmF1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog
ZG9uZSBpbml0IGlkPWxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y
MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAg
ICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgbG9nIDxicj4KICAgICAgICAgICAgICAgICAg
ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0U3Vic3lzdGVtIGlkPWpzcyA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog
cmVhZHkgdG8gaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
ICAgICAgICAgICBDTVNFbmdpbmU6IHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0
b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFy
L2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0ZG93bi5jcnVtYgogICAgICAgICAgICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6
MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgQ01TRW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvcgogICAgICAgICAgICAgICAg
ICAgICAgICAgIGF1dG8tc2h1dGRvd24gc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAg
ICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2Vy
dAogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQgaWQ9anNz
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv
Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5l
OiBpbml0aWFsaXplZCBqc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcv
MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAg
ICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9ZGJzIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZWFkeSB0byBpbml0IGlk
PWRicyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx
XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIERCU3Vi
c3lzdGVtOiBpbml0KCkgbUVuYWJsZVNlcmlhbE1nbXQ9dHJ1ZSA8YnI+CiAgICAgICAgICAgICAg
ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd
OgogICAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nIExkYXBCb3VuZENvbm5GYWN0b3Io
REJTdWJzeXN0ZW0pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6
MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgTGRhcEJvdW5kQ29ubkZhY3Rvcnk6IGluaXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTpkb0Nsb25pbmcgdHJ1ZSA8
YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh
bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIExkYXBBdXRoSW5m
bzogaW5pdCgpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6
NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgICAg
TGRhcEF1dGhJbmZvOiBpbml0IGJlZ2lucyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg
WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg
ICAgICAgICAgICAgICAgIExkYXBBdXRoSW5mbzogaW5pdCBlbmRzIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At
MV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgaW5pdDogYmVmb3JlIG1ha2VDb25uZWN0aW9u
IGVycm9ySWZEb3duIGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgdHJ1ZSA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3Rh
cnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJv
cklmRG93biB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6
MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAg
ICAgVENQIEtlZXAtQWxpdmU6IHRydWUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFsw
My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAg
ICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgZGVzaXJlZCBjZXJ0IG5pY2tuYW1lIHRvOiBzdWJzeXN0
ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0
U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBMZGFwSnNzU1NMU29ja2V0OiBzZXQg
Y2xpZW50IGF1dGggY2VydAogICAgICAgICAgICAgICAgICAgICAgICAgIG5pY2tuYW1lIHN1YnN5
c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9B
dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg
ICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0U2VsZWN0aW9uQ0I6IEVudGVyaW5nISA8YnI+
CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv
c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENhbmRpZGF0ZSBjZXJ0
OiBvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg
ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg
ICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBr
aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx
XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIFNTTENs
aWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6IGRlc2lyZWQgY2VydAogICAgICAgICAgICAgICAg
ICAgICAgICAgIGZvdW5kIGluIGxpc3Q6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgog
ICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0
LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZp
Y2F0ZVNlbGVjdGlvbkNCOiByZXR1cm5pbmc6CiAgICAgICAgICAgICAgICAgICAgICAgICAgc3Vi
c3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAz
L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg
ICAgICAgICAgICAgIFNTTCBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAgICAgICAg
ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK
ICAgICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmUuc2h1dGRvd24oKSA8YnI+CiAgICAg
ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICBJIHJlYWxseSBhcHByZWNpYXRlIHlvdSBzdGlja2lu
ZyB3aXRoIG1lCiAgICAgICAgICAgICAgICAgICAgICAgICAgdGhyb3VnaCB0aGlzLsKgIEkgb3dl
IHlvdS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg
ICAgICAgICAgICAtIElhbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg
ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkFmdGVyIHRoYXQs
IGNoZWNrIHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBMREFQIGVudHJ5IGhh
cyBiZWVuIHVwZGF0ZWQuIElmIGl0IGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUg
Y2FzZSwgeW91IHNob3VsZCBiZSBhYmxlIHRvIHJlc3RhcnQgcGtpLgogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg
IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
PlRoYW5rIHlvdSBhZ2FpbiBmb3IKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeW91ciB0
aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgSWFuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl
Ij5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0
eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hpY2gg
c2VlbXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi
PlRoZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiBhdHRy
aWJ1dGUgaW4gdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxkYXBzZWFy
Y2ggb3V0cHV0IGlzIG9mIHRoZSBmb3JtCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIDI7IztETjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNo
IHRoZSBzZXJpYWwgbnVtYmVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu
IHRoZSBmaXJzdCBjZXJ0dXRpbCBvdXRwdXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBB
U0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5ECiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIGhlYWRlcnMpIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxicj4KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGF0dHJpYnV0ZXMuIDxi
cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr
cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl
PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+
CiAgICAgICAgICAgICAgICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIG1h
aWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1s
aW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJl
ZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICAgICAgICAgICAg
ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVk
Lm9yZzwvYT4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg
IFRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEKICAgICAgICAgICAgICAgICAgICAg
ICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgICAgICAg
ICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y
ZyIKICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBh
LXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CiAgICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg
ICAgICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxi
cj4KICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQog
ICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAg
ICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9y
YWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi
PmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgICAgICAg
ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFp
bCB0byA8YQogICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZp
YXRlZCIKICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxl
YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8t
bm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y
ZzwvYT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2tx
dW90ZT4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl
PgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg
ICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAg
ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxwcmUgd3JhcD0iIj5fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpGcmVlSVBBLXVzZXJzIG1haWxp
bmcgbGlzdCAtLSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWls
dG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9
InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJz
Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk
IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
IiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3Jh
aG9zdGVkLm9yZzwvYT4KPC9wcmU+CiAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg
ICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8YnI+CiAg
ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVu
dEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8cHJlIHdy
YXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRnJl
ZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZp
YXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIg
bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5v
cmc8L2E+ClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEgY2xhc3M9Im1vei10eHQt
bGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMu
ZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxl
YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgICAgICAgPC9ibG9ja3F1
b3RlPgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8YnI+CiAg
ICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBj
bGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAg
PHByZSB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fCkZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst
YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3Rl
ZC5vcmciPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJz
Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk
IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn
Ij5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjwvcHJlPgog
ICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo=
--===============3500582530928333893==--