From ianh at brownpapertickets.com Sun Jul 30 16:53:44 2017 Content-Type: multipart/mixed; boundary="===============8172539176512698099==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Failed Upgrade? Date: Sun, 30 Jul 2017 09:53:02 -0700 Message-ID: <90eeb6d6-2e9c-ba97-ce21-38d62aa88e9c@brownpapertickets.com> --===============8172539176512698099== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I had an unexpected restart of an IPA server that had apparently had updates run but had not been restarted. ipactl says pki-tomcatd would not start. Strangely, the actual service appears to be running: [root(a)seattlenfs slapd-BPT-ROCKS]# systemctl status pki-tomcatd(a)pki-tomcat.service =E2=97=8F pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat Loaded: loaded (/lib/systemd/system/pki-tomcatd(a).service; enabled; vendor preset: disabled) Active: active (running) since Fri 2017-07-28 11:03:34 PDT; 36min ago Process: 14289 ExecStartPre=3D/usr/bin/pkidaemon start %i (code=3Dexited, status=3D0/SUCCESS) Main PID: 14406 (java) CGroup: /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service =E2=94=94=E2=94=8014406 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=3D/usr/share/java/resteasy-base -Djava.library.path=3D/usr/lib64/nuxwdog-jni -classpath /usr/... Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: Jul 28, 2017 11:39:50 AM org.apache.catalina.core.ContainerBase backgroundProcess Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: WARNING: Exception processing realm com.netscape.cms.tomcat.ProxyRealm(a)67cf2df background process Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: javax.ws.rs.ServiceUnavailableException: Subsystem unavailable Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java= :1357) Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.process= Children(ContainerBase.java:1543) Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.process= Children(ContainerBase.java:1553) Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.process= Children(ContainerBase.java:1553) Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(Con= tainerBase.java:1521) Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at java.lang.Thread.run(Thread.java:748) However, the /var/log/ipaupgrade.log is full of trouble. It ends with: 2017-07-28T17:01:19Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2017-07-28T17:01:19Z DEBUG Waiting for CA to start... 2017-07-28T17:01:20Z DEBUG request POST http://seattlenfs.bpt.rocks:8080/ca/admin/ca/getStatus 2017-07-28T17:01:20Z DEBUG request body '' 2017-07-28T17:01:20Z DEBUG response status 500 2017-07-28T17:01:20Z DEBUG response headers {'content-length': '2208', 'content-language': 'en', 'server': 'Apache-Coyote/1.1', 'connection': 'close', 'date': 'Fri, 28 Jul 2017 17:01:20 GMT', 'content-type': 'text/html;charset=3Dutf-8'} 2017-07-28T17:01:20Z DEBUG response body 'Apache Tomcat/7.0.69 - Error report

HTTP Status 500 - Subsystem unavailable


type Exception report

message Subsystem unavailable

description The server encountered an internal error that prevented it from fulfilling this request.

exception

javax.ws.rs.ServiceUnavailableException: Subsystem
unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(P=
roxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.=
invoke(AuthenticatorBase.java:499)\n\torg.apache.catalina.valves.ErrorRepor=
tValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.Acce=
ssLogValve.invoke(AccessLogValve.java:956)\n\torg.apache.catalina.connector=
.CoyoteAdapter.service(CoyoteAdapter.java:436)\n\torg.apache.coyote.http11.=
AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)\n\torg.a=
pache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractPro=
tocol.java:625)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.r=
un(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWork=
er(ThreadPoolExecutor.java:1142)\n\tjava.util.concurrent.ThreadPoolExecutor=
$Worker.run(ThreadPoolExecutor.java:617)\n\torg.apache.tomcat.util.threads.=
TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run=
(Thread.java:745)\n

note The full stack trace of the root cause is available in the Apache Tomcat/7.0.69 logs.


Apache Tomcat/7.0.69

' 2017-07-28T17:01:20Z DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500 2017-07-28T17:01:20Z DEBUG Waiting for CA to start... 2017-07-28T17:01:21Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2017-07-28T17:01:21Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute return_value =3D self.run() File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 48, in run raise admintool.ScriptError(str(e)) 2017-07-28T17:01:21Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: CA did not start in 300.0s 2017-07-28T17:01:21Z ERROR CA did not start in 300.0s 2017-07-28T17:01:21Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information Should I just blindly run ipa-server-upgrade again? Googling had me look at certificate expirations, they seem to be good. [root(a)seattlenfs slapd-BPT-ROCKS]# getcert list | grep expires expires: 2019-05-29 05:54:06 UTC expires: 2019-05-29 05:53:57 UTC expires: 2019-05-29 05:53:16 UTC expires: 2035-07-16 12:51:42 UTC expires: 2019-05-29 05:53:37 UTC expires: 2018-08-15 05:20:24 UTC expires: 2018-08-26 05:01:42 UTC expires: 2018-08-26 05:01:43 UTC [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep ipa- ipa-admintools.noarch 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-client.x86_64 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-client-common.noarch 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-common.noarch 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-python-compat.noarch 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-server.x86_64 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-server-common.noarch 4.4.0-14.el7.centos.7 @test-centos7-updates ipa-server-dns.noarch 4.4.0-14.el7.centos.7 @test-centos7-updates [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep pki- pki-base.noarch 10.3.3-19.el7_3 @updates pki-base-java.noarch 10.3.3-19.el7_3 @updates pki-ca.noarch 10.3.3-19.el7_3 @updates pki-kra.noarch 10.3.3-19.el7_3 @updates pki-server.noarch 10.3.3-19.el7_3 @updates pki-tools.x86_64 10.3.3-19.el7_3 @updates [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep tomcat tomcat.noarch 7.0.69-12.el7_3 @updates tomcat-el-2.2-api.noarch 7.0.69-12.el7_3 @updates tomcat-jsp-2.2-api.noarch 7.0.69-12.el7_3 @updates tomcat-lib.noarch 7.0.69-12.el7_3 @updates tomcat-servlet-3.0-api.noarch 7.0.69-12.el7_3 @updates tomcatjss.noarch 7.1.2-3.el7 @base [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep java java-1.7.0-openjdk.x86_64 1:1.7.0.141-2.6.10.1.el7_3 @test-centos7-updates java-1.7.0-openjdk-devel.x86_64 1:1.7.0.141-2.6.10.1.el7_3 @test-centos7-updates java-1.7.0-openjdk-headless.x86_64 1:1.7.0.141-2.6.10.1.el7_3 @test-centos7-updates java-1.8.0-openjdk.x86_64 1:1.8.0.141-1.b16.el7_3 @updates java-1.8.0-openjdk-headless.x86_64 1:1.8.0.141-1.b16.el7_3 @updates javamail.noarch 1.4.6-8.el7 @base javapackages-tools.noarch 3.4.1-11.el7 @base javassist.noarch 3.16.1-10.el7 @base nuxwdog-client-java.x86_64 1.0.3-5.el7 @base pki-base-java.noarch 10.3.3-19.el7_3 @updates python-javapackages.noarch 3.4.1-11.el7 @base tzdata-java.noarch 2017a-1.el7 @test-centos7-updates Any other useful information I can provide? -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============8172539176512698099==-- From pvoborni at redhat.com Mon Jul 31 07:57:05 2017 Content-Type: multipart/mixed; boundary="===============0577184679072358727==" MIME-Version: 1.0 From: Petr Vobornik To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Mon, 31 Jul 2017 09:56:17 +0200 Message-ID: In-Reply-To: 90eeb6d6-2e9c-ba97-ce21-38d62aa88e9c@brownpapertickets.com --===============0577184679072358727== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Sun, Jul 30, 2017 at 6:53 PM, Ian Harding via FreeIPA-users wrote: > I had an unexpected restart of an IPA server that had apparently had > updates run but had not been restarted. ipactl says pki-tomcatd would > not start. > > Strangely, the actual service appears to be running: > > [root(a)seattlenfs slapd-BPT-ROCKS]# systemctl status > pki-tomcatd(a)pki-tomcat.service > =E2=97=8F pki-tomcatd(a)pki-tomcat.service - PKI Tomcat Server pki-tomcat > Loaded: loaded (/lib/systemd/system/pki-tomcatd(a).service; enabled; > vendor preset: disabled) > Active: active (running) since Fri 2017-07-28 11:03:34 PDT; 36min ago > Process: 14289 ExecStartPre=3D/usr/bin/pkidaemon start %i (code=3Dexite= d, > status=3D0/SUCCESS) > Main PID: 14406 (java) > CGroup: > /system.slice/system-pki\x2dtomcatd.slice/pki-tomcatd(a)pki-tomcat.service > =E2=94=94=E2=94=8014406 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java > -DRESTEASY_LIB=3D/usr/share/java/resteasy-base > -Djava.library.path=3D/usr/lib64/nuxwdog-jni -classpath /usr/... > > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: Jul 28, 2017 > 11:39:50 AM org.apache.catalina.core.ContainerBase backgroundProcess > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: WARNING: Exception > processing realm com.netscape.cms.tomcat.ProxyRealm(a)67cf2df background > process > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: > javax.ws.rs.ServiceUnavailableException: Subsystem unavailable > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > com.netscape.cms.tomcat.ProxyRealm.backgroundProcess(ProxyRealm.java:137) > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.ja= va:1357) > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.proce= ssChildren(ContainerBase.java:1543) > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.proce= ssChildren(ContainerBase.java:1553) > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.proce= ssChildren(ContainerBase.java:1553) > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(C= ontainerBase.java:1521) > Jul 28 11:39:50 seattlenfs.bpt.rocks server[14406]: at > java.lang.Thread.run(Thread.java:748) > > However, the /var/log/ipaupgrade.log is full of trouble. It ends with: > > 2017-07-28T17:01:19Z DEBUG The CA status is: check interrupted due to > error: Retrieving CA status failed with status 500 > 2017-07-28T17:01:19Z DEBUG Waiting for CA to start... > 2017-07-28T17:01:20Z DEBUG request POST > http://seattlenfs.bpt.rocks:8080/ca/admin/ca/getStatus > 2017-07-28T17:01:20Z DEBUG request body '' > 2017-07-28T17:01:20Z DEBUG response status 500 > 2017-07-28T17:01:20Z DEBUG response headers {'content-length': '2208', > 'content-language': 'en', 'server': 'Apache-Coyote/1.1', 'connection': > 'close', 'date': 'Fri, 28 Jul 2017 17:01:20 GMT', 'content-type': > 'text/html;charset=3Dutf-8'} > 2017-07-28T17:01:20Z DEBUG response body 'Apache > Tomcat/7.0.69 - Error report >

HTTP Status 500 - Subsystem unavailable


size=3D"1" noshade=3D"noshade">

type Exception > report

message Subsystem > unavailable

description The server encountered an > internal error that prevented it from fulfilling this > request.

exception >

javax.ws.rs.ServiceUnavailableException: Subsystem
> unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints=
(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBas=
e.invoke(AuthenticatorBase.java:499)\n\torg.apache.catalina.valves.ErrorRep=
ortValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.Ac=
cessLogValve.invoke(AccessLogValve.java:956)\n\torg.apache.catalina.connect=
or.CoyoteAdapter.service(CoyoteAdapter.java:436)\n\torg.apache.coyote.http1=
1.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)\n\torg=
.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractP=
rotocol.java:625)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor=
.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWo=
rker(ThreadPoolExecutor.java:1142)\n\tjava.util.concurrent.ThreadPoolExecut=
or$Worker.run(ThreadPoolExecutor.java:617)\n\torg.apache.tomcat.util.thread=
s.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.r=
un(Thread.java:745)\n

note > The full stack trace of the root cause is available in the Apache > Tomcat/7.0.69 logs.


Apache > Tomcat/7.0.69

' > 2017-07-28T17:01:20Z DEBUG The CA status is: check interrupted due to > error: Retrieving CA status failed with status 500 > 2017-07-28T17:01:20Z DEBUG Waiting for CA to start... > 2017-07-28T17:01:21Z ERROR IPA server upgrade failed: Inspect > /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. > 2017-07-28T17:01:21Z DEBUG File > "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in > execute > return_value =3D self.run() > File > "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py= ", > line 48, in run > raise admintool.ScriptError(str(e)) > > 2017-07-28T17:01:21Z DEBUG The ipa-server-upgrade command failed, > exception: ScriptError: CA did not start in 300.0s > 2017-07-28T17:01:21Z ERROR CA did not start in 300.0s > 2017-07-28T17:01:21Z ERROR The ipa-server-upgrade command failed. See > /var/log/ipaupgrade.log for more information > > > Should I just blindly run ipa-server-upgrade again? > > Googling had me look at certificate expirations, they seem to be good. > > [root(a)seattlenfs slapd-BPT-ROCKS]# getcert list | grep expires > expires: 2019-05-29 05:54:06 UTC > expires: 2019-05-29 05:53:57 UTC > expires: 2019-05-29 05:53:16 UTC > expires: 2035-07-16 12:51:42 UTC > expires: 2019-05-29 05:53:37 UTC > expires: 2018-08-15 05:20:24 UTC > expires: 2018-08-26 05:01:42 UTC > expires: 2018-08-26 05:01:43 UTC > > [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep ipa- > ipa-admintools.noarch 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-client.x86_64 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-client-common.noarch 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-common.noarch 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-python-compat.noarch 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-server.x86_64 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-server-common.noarch 4.4.0-14.el7.centos.7 > @test-centos7-updates > ipa-server-dns.noarch 4.4.0-14.el7.centos.7 > @test-centos7-updates > > [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep pki- > pki-base.noarch 10.3.3-19.el7_3 > @updates > pki-base-java.noarch 10.3.3-19.el7_3 > @updates > pki-ca.noarch 10.3.3-19.el7_3 > @updates > pki-kra.noarch 10.3.3-19.el7_3 > @updates > pki-server.noarch 10.3.3-19.el7_3 > @updates > pki-tools.x86_64 10.3.3-19.el7_3 > @updates > > [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep tomcat > tomcat.noarch 7.0.69-12.el7_3 > @updates > tomcat-el-2.2-api.noarch 7.0.69-12.el7_3 > @updates > tomcat-jsp-2.2-api.noarch 7.0.69-12.el7_3 > @updates > tomcat-lib.noarch 7.0.69-12.el7_3 > @updates > tomcat-servlet-3.0-api.noarch 7.0.69-12.el7_3 > @updates > tomcatjss.noarch 7.1.2-3.el7 > @base > > [root(a)seattlenfs slapd-BPT-ROCKS]# yum list | grep java > java-1.7.0-openjdk.x86_64 1:1.7.0.141-2.6.10.1.el7_3 > @test-centos7-updates > java-1.7.0-openjdk-devel.x86_64 1:1.7.0.141-2.6.10.1.el7_3 > @test-centos7-updates > java-1.7.0-openjdk-headless.x86_64 1:1.7.0.141-2.6.10.1.el7_3 > @test-centos7-updates > java-1.8.0-openjdk.x86_64 1:1.8.0.141-1.b16.el7_3 > @updates > java-1.8.0-openjdk-headless.x86_64 1:1.8.0.141-1.b16.el7_3 > @updates > javamail.noarch 1.4.6-8.el7 > @base > javapackages-tools.noarch 3.4.1-11.el7 > @base > javassist.noarch 3.16.1-10.el7 > @base > nuxwdog-client-java.x86_64 1.0.3-5.el7 > @base > pki-base-java.noarch 10.3.3-19.el7_3 > @updates > python-javapackages.noarch 3.4.1-11.el7 > @base > tzdata-java.noarch 2017a-1.el7 > @test-centos7-updates > > Any other useful information I can provide? There is a good page for reporting issues: https://www.freeipa.org/page/Files_to_be_attached_to_bug_report#Dogtag_CA_f= ailed In your case, Dogtag CA did to start so the relevant section is: ausearch -m AVC > avc.log journalctl -u pki-tomcatd(a)pki-tomcat.service /var/log/pki/pki-tomcat/ca/debug <---- usually most important additionally: /var/log/pki/pki-tomcat/ca/selftests.log only in install: /var/log/pki/pki-ca-spawn..log -- = Petr Vobornik --===============0577184679072358727==-- From rcritten at redhat.com Mon Jul 31 18:35:41 2017 Content-Type: multipart/mixed; boundary="===============8737302312525971382==" MIME-Version: 1.0 From: Rob Crittenden To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Mon, 31 Jul 2017 14:34:50 -0400 Message-ID: <97c7a0eb-e7ec-9026-f804-21381dee6f17@redhat.com> In-Reply-To: 90eeb6d6-2e9c-ba97-ce21-38d62aa88e9c@brownpapertickets.com --===============8737302312525971382== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ian Harding via FreeIPA-users wrote: > I had an unexpected restart of an IPA server that had apparently had > updates run but had not been restarted. ipactl says pki-tomcatd would > not start. > = > Strangely, the actual service appears to be running: > = dogtag is an application within tomcat so tomcat can run without dogtag running. We need to see more of the dogtag debug log to see what is going on. I don't think re-running the upgrade command would help. rob --===============8737302312525971382==-- From ianh at brownpapertickets.com Mon Jul 31 23:46:33 2017 Content-Type: multipart/mixed; boundary="===============2211228541388510137==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Mon, 31 Jul 2017 16:32:22 -0700 Message-ID: <4a914ba4-b129-0c0d-beff-c0f81e19bf99@brownpapertickets.com> In-Reply-To: 97c7a0eb-e7ec-9026-f804-21381dee6f17@redhat.com --===============2211228541388510137== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 07/31/2017 11:34 AM, Rob Crittenden wrote: > Ian Harding via FreeIPA-users wrote: >> I had an unexpected restart of an IPA server that had apparently had >> updates run but had not been restarted. ipactl says pki-tomcatd would >> not start. >> >> Strangely, the actual service appears to be running: >> > = > dogtag is an application within tomcat so tomcat can run without dogtag > running. > = > We need to see more of the dogtag debug log to see what is going on. > = It looks like an authentication problem... [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = Error netscape.ldap.LDAPException: Authentication failed (49) at = org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java= :1966) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1= 142) at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:= 617) at java.lang.Thread.run(Thread.java:745) Internal Database Error encountered: Could not connect to LDAP server = host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = Authentication failed (49) at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) at com.netscape.certsrv.apps.CMS.init(CMS.java:188) at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) at = com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at = sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6= 2) at = sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp= l.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 75) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 24) at = org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1= 270) at = org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1= 195) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) at = org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java= :5318) at = org.apache.catalina.core.StandardContext.startInternal(StandardContext.java= :5610) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) at = org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:= 899) at = org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:156) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) at = org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) at = org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java= :1966) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1= 142) at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:= 617) at java.lang.Thread.run(Thread.java:745) [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown() [28/Jul/2017:10:08:46][localhost-startStop-1]: = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUBSY= STEM = INITIALIZED =3D=3D=3D=3D=3D=3D=3D [28/Jul/2017:10:08:46][localhost-startStop-1]: = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at = autoShutdown? false [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init id=3Dde= bug [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized debug [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initSubsystem = id=3Dlog [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to init = id=3Dlog [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = autoShutdown? false [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3Dlog [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized log [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem = id=3Djss [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init = id=3Djss [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = autoShutdown? false [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3Djss [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized jss [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem = id=3Ddbs [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init = id=3Ddbs [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() = mEnableSerialMgmt=3Dtrue [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = LdapBoundConnFactor(DBSubsystem) [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: init [28/Jul/2017:10:08:47][localhost-startStop-1]: = LdapBoundConnFactory:doCloning true [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init() [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before = makeConnection errorIfDown is true [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: = errorIfDown true [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true [28/Jul/2017:10:08:47][localhost-startStop-1]: = SSLClientCertificateSelectionCB: Setting desired cert nickname to: = subsystemCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set = client auth cert nickname subsystemCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: = SSLClientCertificatSelectionCB: Entering! [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = ocspSigningCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = subsystemCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: = SSLClientCertificateSelectionCB: desired cert found in list: = subsystemCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: = SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = Error netscape.ldap.LDAPException: Authentication failed (49) at = com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBound= ConnFactory.java:205) at = com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor= y.java:166) at = com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor= y.java:130) at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) at com.netscape.certsrv.apps.CMS.init(CMS.java:188) at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) at = com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at = sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6= 2) at = sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp= l.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 75) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 24) at = org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1= 270) at = org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1= 195) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) at = org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java= :5318) at = org.apache.catalina.core.StandardContext.startInternal(StandardContext.java= :5610) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) at = org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:= 899) at = org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:156) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) at = org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) at = org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java= :1966) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1= 142) at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:= 617) at java.lang.Thread.run(Thread.java:745) Internal Database Error encountered: Could not connect to LDAP server = host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = Authentication failed (49) at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) at com.netscape.certsrv.apps.CMS.init(CMS.java:188) at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) at = com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at = sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6= 2) at = sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp= l.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 75) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 24) at = org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1= 270) at = org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1= 195) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) at = org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java= :5318) at = org.apache.catalina.core.StandardContext.startInternal(StandardContext.java= :5610) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) at = org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:= 899) at = org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:156) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:145) at java.security.AccessController.doPrivileged(Native Method) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) at = org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:679) at = org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java= :1966) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at = java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1= 142) at = java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:= 617) at java.lang.Thread.run(Thread.java:745) [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown() [28/Jul/2017:10:13:29][localhost-startStop-2]: = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG SUBSY= STEM = INITIALIZED =3D=3D=3D=3D=3D=3D=3D [28/Jul/2017:10:13:29][localhost-startStop-2]: = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = autoShutdown? false [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3Dde= bug [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized debug [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem = id=3Dlog [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init = id=3Dlog [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = autoShutdown? false [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3Dlog [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized log [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem = id=3Djss [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init = id=3Djss [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = autoShutdown? false [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3Djss [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized jss [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem = id=3Ddbs [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init = id=3Ddbs [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() = mEnableSerialMgmt=3Dtrue [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = LdapBoundConnFactor(DBSubsystem) [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: init [28/Jul/2017:10:13:29][localhost-startStop-2]: = LdapBoundConnFactory:doCloning true [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init() [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before = makeConnection errorIfDown is true [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: = errorIfDown true [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true [28/Jul/2017:10:13:29][localhost-startStop-2]: = SSLClientCertificateSelectionCB: Setting desired cert nickname to: = subsystemCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set = client auth cert nickname subsystemCert cert-pki-ca [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = Error netscape.ldap.LDAPException: Authentication failed (49) at = com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBound= ConnFactory.java:205) at = com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor= y.java:166) at = com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFactor= y.java:130) at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) at com.netscape.certsrv.apps.CMS.init(CMS.java:188) at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) at = com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:114) at javax.servlet.GenericServlet.init(GenericServlet.java:158) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at = sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6= 2) at = sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp= l.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 75) at = org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:1= 24) at = org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1= 270) at = org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1= 195) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) at = org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java= :5318) at = org.apache.catalina.core.StandardContext.startInternal(StandardContext.java= :5610) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) at = org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:= 899) at = org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) at = org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBase= .java:156) > I don't think re-running the upgrade command would help. > = > rob > = -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============2211228541388510137==-- From flo at redhat.com Tue Aug 1 08:49:04 2017 Content-Type: multipart/mixed; boundary="===============4543534041936500907==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 01 Aug 2017 10:48:31 +0200 Message-ID: <44253e02-8887-85b8-137d-8e8eebb73d88@redhat.com> In-Reply-To: 4a914ba4-b129-0c0d-beff-c0f81e19bf99@brownpapertickets.com --===============4543534041936500907== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: > = > = > On 07/31/2017 11:34 AM, Rob Crittenden wrote: >> Ian Harding via FreeIPA-users wrote: >>> I had an unexpected restart of an IPA server that had apparently had >>> updates run but had not been restarted. ipactl says pki-tomcatd would >>> not start. >>> >>> Strangely, the actual service appears to be running: >>> >> >> dogtag is an application within tomcat so tomcat can run without dogtag >> running. >> >> We need to see more of the dogtag debug log to see what is going on. >> > = > It looks like an authentication problem... > = > [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened > Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = > Error netscape.ldap.LDAPException: Authentication failed (49) > = Hi, dogtag stores its internal data in the LDAP server and needs to = establish a secure LDAP connection. You can check how this connection is = configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines: internaldb.ldapauth.authtype=3DSslClientAuth internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager internaldb.ldapauth.bindPWPrompt=3Dinternaldb internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca internaldb.ldapconn.host=3Dvm-... internaldb.ldapconn.port=3D636 internaldb.ldapconn.secureConn authtype can be SslClientAuth (authentication with a ssl certificate) or = BasicAuth (authentication with a bind DN and password stored in = /var/lib/pki/pki-tomcat/conf/password.conf). You can use this information to manually check the credentials. For = instance with sslclientauth: export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) HTH, Flo. > = > = > at = > org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja= va:1966) = > = > at = > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > at = > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java= :1142) = > = > at = > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav= a:617) = > = > at java.lang.Thread.run(Thread.java:745) > Internal Database Error encountered: Could not connect to LDAP server = > host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = > Authentication failed (49) > at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) > at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) > at com.netscape.certsrv.apps.CMS.init(CMS.java:188) > at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) > at = > com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1= 14) = > = > at javax.servlet.GenericServlet.init(GenericServlet.java:158) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at = > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java= :62) = > = > at = > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI= mpl.java:43) = > = > at java.lang.reflect.Method.invoke(Method.java:498) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > at java.security.AccessController.doPrivileged(Native Method) > at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) > at = > org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :175) = > = > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :124) = > = > at = > org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java= :1270) = > = > at = > org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java= :1195) = > = > at = > org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) > at = > org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja= va:5318) = > = > at = > org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja= va:5610) = > = > at = > org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) > at = > org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav= a:899) = > = > at = > org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:156) = > = > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:145) = > = > at java.security.AccessController.doPrivileged(Native Method) > at = > org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) > at = > org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) > at = > org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:6= 79) = > = > at = > org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja= va:1966) = > = > at = > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > at = > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java= :1142) = > = > at = > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav= a:617) = > = > at java.lang.Thread.run(Thread.java:745) > [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown() > [28/Jul/2017:10:08:46][localhost-startStop-1]: = > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUB= SYSTEM = > INITIALIZED =3D=3D=3D=3D=3D=3D=3D > [28/Jul/2017:10:08:46][localhost-startStop-1]: = > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at = > autoShutdown? false > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init = > id=3Ddebug > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized deb= ug > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initSubsystem = > id=3Dlog > [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to init = > id=3Dlog > [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) > [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) > [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = > autoShutdown? false > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3D= log > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized log > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem = > id=3Djss > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init = > id=3Djss > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = > autoShutdown? false > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init id=3D= jss > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized jss > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initSubsystem = > id=3Ddbs > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to init = > id=3Ddbs > [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() = > mEnableSerialMgmt=3Dtrue > [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = > LdapBoundConnFactor(DBSubsystem) > [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: init > [28/Jul/2017:10:08:47][localhost-startStop-1]: = > LdapBoundConnFactory:doCloning true > [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init() > [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins > [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends > [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before = > makeConnection errorIfDown is true > [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: = > errorIfDown true > [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true > [28/Jul/2017:10:08:47][localhost-startStop-1]: = > SSLClientCertificateSelectionCB: Setting desired cert nickname to: = > subsystemCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set = > client auth cert nickname subsystemCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: = > SSLClientCertificatSelectionCB: Entering! > [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = > ocspSigningCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = > subsystemCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: = > SSLClientCertificateSelectionCB: desired cert found in list: = > subsystemCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: = > SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca > [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened > Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = > Error netscape.ldap.LDAPException: Authentication failed (49) > at = > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBou= ndConnFactory.java:205) = > = > at = > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact= ory.java:166) = > = > at = > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact= ory.java:130) = > = > at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) > at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) > at com.netscape.certsrv.apps.CMS.init(CMS.java:188) > at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) > at = > com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1= 14) = > = > at javax.servlet.GenericServlet.init(GenericServlet.java:158) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at = > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java= :62) = > = > at = > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI= mpl.java:43) = > = > at java.lang.reflect.Method.invoke(Method.java:498) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > at java.security.AccessController.doPrivileged(Native Method) > at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) > at = > org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :175) = > = > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :124) = > = > at = > org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java= :1270) = > = > at = > org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java= :1195) = > = > at = > org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) > at = > org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja= va:5318) = > = > at = > org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja= va:5610) = > = > at = > org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) > at = > org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav= a:899) = > = > at = > org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:156) = > = > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:145) = > = > at java.security.AccessController.doPrivileged(Native Method) > at = > org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) > at = > org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) > at = > org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:6= 79) = > = > at = > org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja= va:1966) = > = > at = > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > at = > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java= :1142) = > = > at = > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav= a:617) = > = > at java.lang.Thread.run(Thread.java:745) > Internal Database Error encountered: Could not connect to LDAP server = > host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = > Authentication failed (49) > at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) > at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) > at com.netscape.certsrv.apps.CMS.init(CMS.java:188) > at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) > at = > com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1= 14) = > = > at javax.servlet.GenericServlet.init(GenericServlet.java:158) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at = > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java= :62) = > = > at = > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI= mpl.java:43) = > = > at java.lang.reflect.Method.invoke(Method.java:498) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > at java.security.AccessController.doPrivileged(Native Method) > at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) > at = > org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :175) = > = > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :124) = > = > at = > org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java= :1270) = > = > at = > org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java= :1195) = > = > at = > org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) > at = > org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja= va:5318) = > = > at = > org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja= va:5610) = > = > at = > org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) > at = > org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav= a:899) = > = > at = > org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:156) = > = > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:145) = > = > at java.security.AccessController.doPrivileged(Native Method) > at = > org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) > at = > org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) > at = > org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:6= 79) = > = > at = > org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.ja= va:1966) = > = > at = > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > at java.util.concurrent.FutureTask.run(FutureTask.java:266) > at = > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java= :1142) = > = > at = > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.jav= a:617) = > = > at java.lang.Thread.run(Thread.java:745) > [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown() > [28/Jul/2017:10:13:29][localhost-startStop-2]: = > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG SUB= SYSTEM = > INITIALIZED =3D=3D=3D=3D=3D=3D=3D > [28/Jul/2017:10:13:29][localhost-startStop-2]: = > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = > autoShutdown? false > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = > id=3Ddebug > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized deb= ug > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem = > id=3Dlog > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init = > id=3Dlog > [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) > [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) > [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = > autoShutdown? false > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3D= log > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized log > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem = > id=3Djss > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init = > id=3Djss > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = > autoShutdown? false > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init id=3D= jss > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized jss > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initSubsystem = > id=3Ddbs > [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to init = > id=3Ddbs > [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() = > mEnableSerialMgmt=3Dtrue > [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = > LdapBoundConnFactor(DBSubsystem) > [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: init > [28/Jul/2017:10:13:29][localhost-startStop-2]: = > LdapBoundConnFactory:doCloning true > [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init() > [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins > [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends > [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before = > makeConnection errorIfDown is true > [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: = > errorIfDown true > [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true > [28/Jul/2017:10:13:29][localhost-startStop-2]: = > SSLClientCertificateSelectionCB: Setting desired cert nickname to: = > subsystemCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set = > client auth cert nickname subsystemCert cert-pki-ca > [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened > Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = > Error netscape.ldap.LDAPException: Authentication failed (49) > at = > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBou= ndConnFactory.java:205) = > = > at = > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact= ory.java:166) = > = > at = > com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFact= ory.java:130) = > = > at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) > at = > com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) > at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) > at com.netscape.certsrv.apps.CMS.init(CMS.java:188) > at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) > at = > com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:1= 14) = > = > at javax.servlet.GenericServlet.init(GenericServlet.java:158) > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > at = > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java= :62) = > = > at = > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorI= mpl.java:43) = > = > at java.lang.reflect.Method.invoke(Method.java:498) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) > at = > org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) > at java.security.AccessController.doPrivileged(Native Method) > at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) > at = > org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :175) = > = > at = > org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java= :124) = > = > at = > org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java= :1270) = > = > at = > org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java= :1195) = > = > at = > org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) > at = > org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.ja= va:5318) = > = > at = > org.apache.catalina.core.StandardContext.startInternal(StandardContext.ja= va:5610) = > = > at = > org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) > at = > org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.jav= a:899) = > = > at = > org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) > at = > org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerBa= se.java:156) = > = > = > = >> I don't think re-running the upgrade command would help. >> >> rob >> >=20 --===============4543534041936500907==-- From ianh at brownpapertickets.com Tue Aug 1 13:12:27 2017 Content-Type: multipart/mixed; boundary="===============5180792033005011879==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 01 Aug 2017 06:11:50 -0700 Message-ID: <26a15abb-30d1-d2fc-cb34-17fe86409f15@brownpapertickets.com> In-Reply-To: 44253e02-8887-85b8-137d-8e8eebb73d88@redhat.com --===============5180792033005011879== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: > On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >> >> >> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>> Ian Harding via FreeIPA-users wrote: >>>> I had an unexpected restart of an IPA server that had apparently had >>>> updates run but had not been restarted. ipactl says pki-tomcatd would >>>> not start. >>>> >>>> Strangely, the actual service appears to be running: >>>> >>> >>> dogtag is an application within tomcat so tomcat can run without dogtag >>> running. >>> >>> We need to see more of the dogtag debug log to see what is going on. >>> >> >> It looks like an authentication problem... >> >> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >> Error netscape.ldap.LDAPException: Authentication failed (49) >> > = > Hi, > = > dogtag stores its internal data in the LDAP server and needs to = > establish a secure LDAP connection. You can check how this connection is = > configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines: > = > internaldb.ldapauth.authtype=3DSslClientAuth > internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager > internaldb.ldapauth.bindPWPrompt=3Dinternaldb > internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca > internaldb.ldapconn.host=3Dvm-... > internaldb.ldapconn.port=3D636 > internaldb.ldapconn.secureConn > = > authtype can be SslClientAuth (authentication with a ssl certificate) or = > BasicAuth (authentication with a bind DN and password stored in = > /var/lib/pki/pki-tomcat/conf/password.conf). > = > You can use this information to manually check the credentials. For = > instance with sslclientauth: > = > export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias > export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' > = > ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL > (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) > = I found this: internaldb.ldapauth.authtype=3DSslClientAuth internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca internaldb.ldapauth.bindPWPrompt=3Dinternaldb internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca internaldb.ldapconn.cloneReplicationPort=3D389 ... and when I try the ldapsearch I am presented with a prompt to provide a = pin/password Please enter pin, password, or pass phrase for security token 'ldap(0)': but there is no password file... ls -a /etc/pki/pki-tomcat/alias/ . .. cert8.db key3.db secmod.db There are "internal" and "replicationdb" values in = /var/lib/pki/pki-tomcat/conf/password.conf but they don't work in = response to the ldapsearch prompt above. Thank you so much for your help! > HTH, > Flo. >> >> >> at = >> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j= ava:1966) = >> >> at = >> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >> at = >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav= a:1142) = >> >> at = >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja= va:617) = >> >> at java.lang.Thread.run(Thread.java:745) >> Internal Database Error encountered: Could not connect to LDAP server = >> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = >> Authentication failed (49) >> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >> at = >> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:= 114) = >> >> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> at = >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav= a:62) = >> >> at = >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor= Impl.java:43) = >> >> at java.lang.reflect.Method.invoke(Method.java:498) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >> at java.security.AccessController.doPrivileged(Native Method) >> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >> at = >> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:175) = >> >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:124) = >> >> at = >> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav= a:1270) = >> >> at = >> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav= a:1195) = >> >> at = >> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >> at = >> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j= ava:5318) = >> >> at = >> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j= ava:5610) = >> >> at = >> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >> at = >> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja= va:899) = >> >> at = >> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:156) = >> >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:145) = >> >> at java.security.AccessController.doPrivileged(Native Method) >> at = >> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >> at = >> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >> at = >> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:= 679) = >> >> at = >> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j= ava:1966) = >> >> at = >> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >> at = >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav= a:1142) = >> >> at = >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja= va:617) = >> >> at java.lang.Thread.run(Thread.java:745) >> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown() >> [28/Jul/2017:10:08:46][localhost-startStop-1]: = >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SU= BSYSTEM = >> INITIALIZED =3D=3D=3D=3D=3D=3D=3D >> [28/Jul/2017:10:08:46][localhost-startStop-1]: = >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at = >> autoShutdown? false >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: autoShutdown = >> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init = >> id=3Ddebug >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized = >> debug >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: = >> initSubsystem id=3Dlog >> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to = >> init id=3Dlog >> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = >> autoShutdown? false >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown = >> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init = >> id=3Dlog >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized log >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >> initSubsystem id=3Djss >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to = >> init id=3Djss >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = >> autoShutdown? false >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: autoShutdown = >> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init = >> id=3Djss >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized jss >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >> initSubsystem id=3Ddbs >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to = >> init id=3Ddbs >> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() = >> mEnableSerialMgmt=3Dtrue >> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = >> LdapBoundConnFactor(DBSubsystem) >> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: init >> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >> LdapBoundConnFactory:doCloning true >> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init() >> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins >> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends >> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before = >> makeConnection errorIfDown is true >> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: = >> errorIfDown true >> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true >> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >> subsystemCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set = >> client auth cert nickname subsystemCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >> SSLClientCertificatSelectionCB: Entering! >> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = >> ocspSigningCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = >> subsystemCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >> SSLClientCertificateSelectionCB: desired cert found in list: = >> subsystemCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >> Error netscape.ldap.LDAPException: Authentication failed (49) >> at = >> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBo= undConnFactory.java:205) = >> >> at = >> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac= tory.java:166) = >> >> at = >> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac= tory.java:130) = >> >> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >> at = >> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:= 114) = >> >> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> at = >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav= a:62) = >> >> at = >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor= Impl.java:43) = >> >> at java.lang.reflect.Method.invoke(Method.java:498) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >> at java.security.AccessController.doPrivileged(Native Method) >> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >> at = >> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:175) = >> >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:124) = >> >> at = >> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav= a:1270) = >> >> at = >> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav= a:1195) = >> >> at = >> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >> at = >> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j= ava:5318) = >> >> at = >> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j= ava:5610) = >> >> at = >> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >> at = >> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja= va:899) = >> >> at = >> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:156) = >> >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:145) = >> >> at java.security.AccessController.doPrivileged(Native Method) >> at = >> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >> at = >> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >> at = >> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:= 679) = >> >> at = >> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j= ava:1966) = >> >> at = >> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >> at = >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav= a:1142) = >> >> at = >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja= va:617) = >> >> at java.lang.Thread.run(Thread.java:745) >> Internal Database Error encountered: Could not connect to LDAP server = >> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = >> Authentication failed (49) >> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >> at = >> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:= 114) = >> >> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> at = >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav= a:62) = >> >> at = >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor= Impl.java:43) = >> >> at java.lang.reflect.Method.invoke(Method.java:498) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >> at java.security.AccessController.doPrivileged(Native Method) >> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >> at = >> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:175) = >> >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:124) = >> >> at = >> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav= a:1270) = >> >> at = >> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav= a:1195) = >> >> at = >> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >> at = >> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j= ava:5318) = >> >> at = >> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j= ava:5610) = >> >> at = >> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >> at = >> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja= va:899) = >> >> at = >> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:156) = >> >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:145) = >> >> at java.security.AccessController.doPrivileged(Native Method) >> at = >> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >> at = >> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >> at = >> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:= 679) = >> >> at = >> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.j= ava:1966) = >> >> at = >> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >> at = >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.jav= a:1142) = >> >> at = >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.ja= va:617) = >> >> at java.lang.Thread.run(Thread.java:745) >> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown() >> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG SU= BSYSTEM = >> INITIALIZED =3D=3D=3D=3D=3D=3D=3D >> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >> autoShutdown? false >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = >> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >> id=3Ddebug >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized = >> debug >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >> initSubsystem id=3Dlog >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >> init id=3Dlog >> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >> autoShutdown? false >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = >> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >> id=3Dlog >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized log >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >> initSubsystem id=3Djss >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >> init id=3Djss >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >> autoShutdown? false >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: autoShutdown = >> crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >> id=3Djss >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized jss >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >> initSubsystem id=3Ddbs >> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >> init id=3Ddbs >> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() = >> mEnableSerialMgmt=3Dtrue >> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >> LdapBoundConnFactor(DBSubsystem) >> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: init >> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >> LdapBoundConnFactory:doCloning true >> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init() >> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins >> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends >> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before = >> makeConnection errorIfDown is true >> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: = >> errorIfDown true >> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true >> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >> subsystemCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set = >> client auth cert nickname subsystemCert cert-pki-ca >> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened >> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >> Error netscape.ldap.LDAPException: Authentication failed (49) >> at = >> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapBo= undConnFactory.java:205) = >> >> at = >> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac= tory.java:166) = >> >> at = >> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFac= tory.java:130) = >> >> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >> at = >> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >> at = >> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:= 114) = >> >> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >> at = >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.jav= a:62) = >> >> at = >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessor= Impl.java:43) = >> >> at java.lang.reflect.Method.invoke(Method.java:498) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >> at = >> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >> at java.security.AccessController.doPrivileged(Native Method) >> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >> at = >> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:175) = >> >> at = >> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.jav= a:124) = >> >> at = >> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.jav= a:1270) = >> >> at = >> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.jav= a:1195) = >> >> at = >> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >> at = >> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.j= ava:5318) = >> >> at = >> org.apache.catalina.core.StandardContext.startInternal(StandardContext.j= ava:5610) = >> >> at = >> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >> at = >> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.ja= va:899) = >> >> at = >> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:133) >> at = >> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(ContainerB= ase.java:156) = >> >> >> >>> I don't think re-running the upgrade command would help. >>> >>> rob >>> >> > = -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============5180792033005011879==-- From flo at redhat.com Tue Aug 1 14:39:56 2017 Content-Type: multipart/mixed; boundary="===============0265493955462484505==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 01 Aug 2017 16:39:12 +0200 Message-ID: In-Reply-To: 26a15abb-30d1-d2fc-cb34-17fe86409f15@brownpapertickets.com --===============0265493955462484505== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2017 03:11 PM, Ian Harding wrote: > On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>> >>> >>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>> Ian Harding via FreeIPA-users wrote: >>>>> I had an unexpected restart of an IPA server that had apparently had >>>>> updates run but had not been restarted. ipactl says pki-tomcatd would >>>>> not start. >>>>> >>>>> Strangely, the actual service appears to be running: >>>>> >>>> >>>> dogtag is an application within tomcat so tomcat can run without dogtag >>>> running. >>>> >>>> We need to see more of the dogtag debug log to see what is going on. >>>> >>> >>> It looks like an authentication problem... >>> >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >>> Error netscape.ldap.LDAPException: Authentication failed (49) >>> >> >> Hi, >> >> dogtag stores its internal data in the LDAP server and needs to = >> establish a secure LDAP connection. You can check how this connection = >> is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines: >> >> internaldb.ldapauth.authtype=3DSslClientAuth >> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >> internaldb.ldapconn.host=3Dvm-... >> internaldb.ldapconn.port=3D636 >> internaldb.ldapconn.secureConn >> >> authtype can be SslClientAuth (authentication with a ssl certificate) = >> or BasicAuth (authentication with a bind DN and password stored in = >> /var/lib/pki/pki-tomcat/conf/password.conf). >> >> You can use this information to manually check the credentials. For = >> instance with sslclientauth: >> >> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >> >> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >> > = > I found this: > = > internaldb.ldapauth.authtype=3DSslClientAuth > internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > internaldb.ldapauth.bindPWPrompt=3Dinternaldb > internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca > internaldb.ldapconn.cloneReplicationPort=3D389 > ... > = > and when I try the ldapsearch I am presented with a prompt to provide a = > pin/password > = > Please enter pin, password, or pass phrase for security token 'ldap(0)': > = > but there is no password file... > = Hi, you are right, in 4.4. there is no pwdfile.txt and the password can be = found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag = internal=3D...) Can you check if the password with the tag internal=3D... allows to read = the keys from the NSS db? certutil -K -d /etc/pki/pki-tomcat/alias (provide password) If the password is not the right one, certutil will prompt you once = again for it. This would mean that the password does not allow to access = the key from the NSSdb and Dogtag will not be able to use the = certificate for authentication. Flo > ls -a /etc/pki/pki-tomcat/alias/ > . .. cert8.db key3.db secmod.db > = > There are "internal" and "replicationdb" values in = > /var/lib/pki/pki-tomcat/conf/password.conf but they don't work in = > response to the ldapsearch prompt above. > = > Thank you so much for your help! > = >> HTH, >> Flo. >>> >>> >>> at = >>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.= java:1966) = >>> >>> at = >>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>> at = >>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja= va:1142) = >>> >>> at = >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j= ava:617) = >>> >>> at java.lang.Thread.run(Thread.java:745) >>> Internal Database Error encountered: Could not connect to LDAP server = >>> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = >>> Authentication failed (49) >>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>> at = >>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java= :114) = >>> >>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>> at = >>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja= va:62) = >>> >>> at = >>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso= rImpl.java:43) = >>> >>> at java.lang.reflect.Method.invoke(Method.java:498) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>> at java.security.AccessController.doPrivileged(Native Method) >>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>> at = >>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:175) = >>> >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:124) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja= va:1270) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja= va:1195) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >>> at = >>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.= java:5318) = >>> >>> at = >>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.= java:5610) = >>> >>> at = >>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>> at = >>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j= ava:899) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13= 3) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:156) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:145) = >>> >>> at java.security.AccessController.doPrivileged(Native Method) >>> at = >>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >>> at = >>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >>> at = >>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java= :679) = >>> >>> at = >>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.= java:1966) = >>> >>> at = >>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>> at = >>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja= va:1142) = >>> >>> at = >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j= ava:617) = >>> >>> at java.lang.Thread.run(Thread.java:745) >>> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown() >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: = >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG S= UBSYSTEM = >>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: = >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at = >>> autoShutdown? false >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init = >>> id=3Ddebug >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: initialized = >>> debug >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: = >>> initSubsystem id=3Dlog >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to = >>> init id=3Dlog >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = >>> autoShutdown? false >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init = >>> id=3Dlog >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized = >>> log >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>> initSubsystem id=3Djss >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to = >>> init id=3Djss >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = >>> autoShutdown? false >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init = >>> id=3Djss >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: initialized = >>> jss >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>> initSubsystem id=3Ddbs >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to = >>> init id=3Ddbs >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() = >>> mEnableSerialMgmt=3Dtrue >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = >>> LdapBoundConnFactor(DBSubsystem) >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: = >>> init >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>> LdapBoundConnFactory:doCloning true >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init() >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init begins >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before = >>> makeConnection errorIfDown is true >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: = >>> errorIfDown true >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>> subsystemCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set = >>> client auth cert nickname subsystemCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>> SSLClientCertificatSelectionCB: Entering! >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = >>> ocspSigningCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = >>> subsystemCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>> SSLClientCertificateSelectionCB: desired cert found in list: = >>> subsystemCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >>> Error netscape.ldap.LDAPException: Authentication failed (49) >>> at = >>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapB= oundConnFactory.java:205) = >>> >>> at = >>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa= ctory.java:166) = >>> >>> at = >>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa= ctory.java:130) = >>> >>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>> at = >>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java= :114) = >>> >>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>> at = >>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja= va:62) = >>> >>> at = >>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso= rImpl.java:43) = >>> >>> at java.lang.reflect.Method.invoke(Method.java:498) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>> at java.security.AccessController.doPrivileged(Native Method) >>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>> at = >>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:175) = >>> >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:124) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja= va:1270) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja= va:1195) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >>> at = >>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.= java:5318) = >>> >>> at = >>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.= java:5610) = >>> >>> at = >>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>> at = >>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j= ava:899) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13= 3) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:156) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:145) = >>> >>> at java.security.AccessController.doPrivileged(Native Method) >>> at = >>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >>> at = >>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >>> at = >>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java= :679) = >>> >>> at = >>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.= java:1966) = >>> >>> at = >>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>> at = >>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja= va:1142) = >>> >>> at = >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j= ava:617) = >>> >>> at java.lang.Thread.run(Thread.java:745) >>> Internal Database Error encountered: Could not connect to LDAP server = >>> host seattlenfs.bpt.rocks port 636 Error netscape.ldap.LDAPException: = >>> Authentication failed (49) >>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>> at = >>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java= :114) = >>> >>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>> at = >>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja= va:62) = >>> >>> at = >>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso= rImpl.java:43) = >>> >>> at java.lang.reflect.Method.invoke(Method.java:498) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>> at java.security.AccessController.doPrivileged(Native Method) >>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>> at = >>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:175) = >>> >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:124) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja= va:1270) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja= va:1195) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >>> at = >>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.= java:5318) = >>> >>> at = >>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.= java:5610) = >>> >>> at = >>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>> at = >>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j= ava:899) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13= 3) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:156) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:145) = >>> >>> at java.security.AccessController.doPrivileged(Native Method) >>> at = >>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >>> at = >>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >>> at = >>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java= :679) = >>> >>> at = >>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.= java:1966) = >>> >>> at = >>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>> at = >>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.ja= va:1142) = >>> >>> at = >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.j= ava:617) = >>> >>> at java.lang.Thread.run(Thread.java:745) >>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown() >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG S= UBSYSTEM = >>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >>> autoShutdown? false >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >>> id=3Ddebug >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized = >>> debug >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>> initSubsystem id=3Dlog >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >>> init id=3Dlog >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >>> autoShutdown? false >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >>> id=3Dlog >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized = >>> log >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>> initSubsystem id=3Djss >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >>> init id=3Djss >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >>> autoShutdown? false >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >>> id=3Djss >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: initialized = >>> jss >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>> initSubsystem id=3Ddbs >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >>> init id=3Ddbs >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() = >>> mEnableSerialMgmt=3Dtrue >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>> LdapBoundConnFactor(DBSubsystem) >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: = >>> init >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>> LdapBoundConnFactory:doCloning true >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init() >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init begins >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before = >>> makeConnection errorIfDown is true >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: = >>> errorIfDown true >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>> subsystemCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set = >>> client auth cert nickname subsystemCert cert-pki-ca >>> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened >>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >>> Error netscape.ldap.LDAPException: Authentication failed (49) >>> at = >>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(LdapB= oundConnFactory.java:205) = >>> >>> at = >>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa= ctory.java:166) = >>> >>> at = >>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnFa= ctory.java:130) = >>> >>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>> at = >>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>> at = >>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java= :114) = >>> >>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>> at = >>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja= va:62) = >>> >>> at = >>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso= rImpl.java:43) = >>> >>> at java.lang.reflect.Method.invoke(Method.java:498) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>> at = >>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>> at java.security.AccessController.doPrivileged(Native Method) >>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>> at = >>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:320) >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:175) = >>> >>> at = >>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.ja= va:124) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.ja= va:1270) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.ja= va:1195) = >>> >>> at = >>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1085) >>> at = >>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.= java:5318) = >>> >>> at = >>> org.apache.catalina.core.StandardContext.startInternal(StandardContext.= java:5610) = >>> >>> at = >>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>> at = >>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.j= ava:899) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:13= 3) = >>> >>> at = >>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Container= Base.java:156) = >>> >>> >>> >>>> I don't think re-running the upgrade command would help. >>>> >>>> rob >>>> >>> >> >=20 --===============0265493955462484505==-- From ianh at brownpapertickets.com Tue Aug 1 17:03:53 2017 Content-Type: multipart/mixed; boundary="===============1477773526450600254==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 01 Aug 2017 10:03:07 -0700 Message-ID: <3e986b45-f163-80f0-2f88-ef3880ea441d@brownpapertickets.com> In-Reply-To: b8f5fd77-6f4a-d19c-a11d-e49fc0858cce@redhat.com --===============1477773526450600254== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: > On 08/01/2017 03:11 PM, Ian Harding wrote: >> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>> >>>> >>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>> Ian Harding via FreeIPA-users wrote: >>>>>> I had an unexpected restart of an IPA server that had apparently had >>>>>> updates run but had not been restarted. ipactl says pki-tomcatd = >>>>>> would >>>>>> not start. >>>>>> >>>>>> Strangely, the actual service appears to be running: >>>>>> >>>>> >>>>> dogtag is an application within tomcat so tomcat can run without = >>>>> dogtag >>>>> running. >>>>> >>>>> We need to see more of the dogtag debug log to see what is going on. >>>>> >>>> >>>> It looks like an authentication problem... >>>> >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>> >>> >>> Hi, >>> >>> dogtag stores its internal data in the LDAP server and needs to = >>> establish a secure LDAP connection. You can check how this connection = >>> is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for the lines: >>> >>> internaldb.ldapauth.authtype=3DSslClientAuth >>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>> internaldb.ldapconn.host=3Dvm-... >>> internaldb.ldapconn.port=3D636 >>> internaldb.ldapconn.secureConn >>> >>> authtype can be SslClientAuth (authentication with a ssl certificate) = >>> or BasicAuth (authentication with a bind DN and password stored in = >>> /var/lib/pki/pki-tomcat/conf/password.conf). >>> >>> You can use this information to manually check the credentials. For = >>> instance with sslclientauth: >>> >>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>> >>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>> >> >> I found this: >> >> internaldb.ldapauth.authtype=3DSslClientAuth >> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >> internaldb.ldapconn.cloneReplicationPort=3D389 >> ... >> >> and when I try the ldapsearch I am presented with a prompt to provide = >> a pin/password >> >> Please enter pin, password, or pass phrase for security token 'ldap(0)': >> >> but there is no password file... >> > Hi, > = > you are right, in 4.4. there is no pwdfile.txt and the password can be = > found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag = > internal=3D...) > = > Can you check if the password with the tag internal=3D... allows to read = > the keys from the NSS db? > certutil -K -d /etc/pki/pki-tomcat/alias > (provide password) That works... # certutil -K -d /etc/pki/pki-tomcat/alias certutil: Checking token "NSS Certificate DB" in slot "NSS User Private = Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate = DB:auditSigningCert cert-pki-ca < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert = cert-pki-ca < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate = DB:ocspSigningCert cert-pki-ca < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert = cert-pki-ca < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate = DB:subsystemCert cert-pki-ca But this doesn't (with the same password from password.conf) # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL Please enter pin, password, or pass phrase for security token 'ldap(0)': SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) That password is getting me somewhere though, since if I put in a = nonsense or incorrect password it just prompts over and over. > = > If the password is not the right one, certutil will prompt you once = > again for it. This would mean that the password does not allow to access = > the key from the NSSdb and Dogtag will not be able to use the = > certificate for authentication. > = > Flo > = >> ls -a /etc/pki/pki-tomcat/alias/ >> . .. cert8.db key3.db secmod.db >> >> There are "internal" and "replicationdb" values in = >> /var/lib/pki/pki-tomcat/conf/password.conf but they don't work in = >> response to the ldapsearch prompt above. >> >> Thank you so much for your help! >> >>> HTH, >>> Flo. >>>> >>>> >>>> at = >>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig= .java:1966) = >>>> >>>> at = >>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j= ava:1142) = >>>> >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.= java:617) = >>>> >>>> at java.lang.Thread.run(Thread.java:745) >>>> Internal Database Error encountered: Could not connect to LDAP = >>>> server host seattlenfs.bpt.rocks port 636 Error = >>>> netscape.ldap.LDAPException: Authentication failed (49) >>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>>> at = >>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav= a:114) = >>>> >>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>>> at = >>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j= ava:62) = >>>> >>>> at = >>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess= orImpl.java:43) = >>>> >>>> at java.lang.reflect.Method.invoke(Method.java:498) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>>> at = >>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32= 0) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:175) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:124) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j= ava:1270) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j= ava:1195) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108= 5) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext= .java:5318) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext= .java:5610) = >>>> >>>> at = >>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.= java:899) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1= 33) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:156) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:145) = >>>> >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >>>> at = >>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >>>> at = >>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.jav= a:679) = >>>> >>>> at = >>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig= .java:1966) = >>>> >>>> at = >>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j= ava:1142) = >>>> >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.= java:617) = >>>> >>>> at java.lang.Thread.run(Thread.java:745) >>>> [28/Jul/2017:09:56:24][localhost-startStop-1]: CMSEngine.shutdown() >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: = >>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG = >>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: = >>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: restart at = >>>> autoShutdown? false >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: done init = >>>> id=3Ddebug >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: = >>>> initialized debug >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: = >>>> initSubsystem id=3Dlog >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: CMSEngine: ready to = >>>> init id=3Dlog >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>>> [28/Jul/2017:10:08:46][localhost-startStop-1]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = >>>> autoShutdown? false >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init = >>>> id=3Dlog >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>>> initialized log >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>>> initSubsystem id=3Djss >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to = >>>> init id=3Djss >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: restart at = >>>> autoShutdown? false >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: done init = >>>> id=3Djss >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>>> initialized jss >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: = >>>> initSubsystem id=3Ddbs >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine: ready to = >>>> init id=3Ddbs >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: DBSubsystem: init() = >>>> mEnableSerialMgmt=3Dtrue >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Creating = >>>> LdapBoundConnFactor(DBSubsystem) >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapBoundConnFactory: = >>>> init >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>>> LdapBoundConnFactory:doCloning true >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init() >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init = >>>> begins >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapAuthInfo: init ends >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: init: before = >>>> makeConnection errorIfDown is true >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: makeConnection: = >>>> errorIfDown true >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: TCP Keep-Alive: true >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>>> subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: LdapJssSSLSocket: set = >>>> client auth cert nickname subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>>> SSLClientCertificatSelectionCB: Entering! >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = >>>> ocspSigningCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: Candidate cert: = >>>> subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>> subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: = >>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>> at = >>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(Ldap= BoundConnFactory.java:205) = >>>> >>>> at = >>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF= actory.java:166) = >>>> >>>> at = >>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF= actory.java:130) = >>>> >>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>>> at = >>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav= a:114) = >>>> >>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>>> at = >>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j= ava:62) = >>>> >>>> at = >>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess= orImpl.java:43) = >>>> >>>> at java.lang.reflect.Method.invoke(Method.java:498) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>>> at = >>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32= 0) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:175) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:124) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j= ava:1270) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j= ava:1195) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108= 5) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext= .java:5318) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext= .java:5610) = >>>> >>>> at = >>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.= java:899) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1= 33) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:156) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:145) = >>>> >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >>>> at = >>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >>>> at = >>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.jav= a:679) = >>>> >>>> at = >>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig= .java:1966) = >>>> >>>> at = >>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j= ava:1142) = >>>> >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.= java:617) = >>>> >>>> at java.lang.Thread.run(Thread.java:745) >>>> Internal Database Error encountered: Could not connect to LDAP = >>>> server host seattlenfs.bpt.rocks port 636 Error = >>>> netscape.ldap.LDAPException: Authentication failed (49) >>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:676) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>>> at = >>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav= a:114) = >>>> >>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>>> at = >>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j= ava:62) = >>>> >>>> at = >>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess= orImpl.java:43) = >>>> >>>> at java.lang.reflect.Method.invoke(Method.java:498) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>>> at = >>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32= 0) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:175) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:124) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j= ava:1270) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j= ava:1195) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108= 5) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext= .java:5318) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext= .java:5610) = >>>> >>>> at = >>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.= java:899) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1= 33) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:156) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:145) = >>>> >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:873) >>>> at = >>>> org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) >>>> at = >>>> org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.jav= a:679) = >>>> >>>> at = >>>> org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig= .java:1966) = >>>> >>>> at = >>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) >>>> at java.util.concurrent.FutureTask.run(FutureTask.java:266) >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.j= ava:1142) = >>>> >>>> at = >>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.= java:617) = >>>> >>>> at java.lang.Thread.run(Thread.java:745) >>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: CMSEngine.shutdown() >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: =3D=3D=3D=3D=3D DEBUG = >>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >>>> autoShutdown? false >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >>>> id=3Ddebug >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> initialized debug >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> initSubsystem id=3Dlog >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >>>> init id=3Dlog >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >>>> autoShutdown? false >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >>>> id=3Dlog >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> initialized log >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> initSubsystem id=3Djss >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >>>> init id=3Djss >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: restart at = >>>> autoShutdown? false >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: done init = >>>> id=3Djss >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> initialized jss >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: = >>>> initSubsystem id=3Ddbs >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: CMSEngine: ready to = >>>> init id=3Ddbs >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: DBSubsystem: init() = >>>> mEnableSerialMgmt=3Dtrue >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: Creating = >>>> LdapBoundConnFactor(DBSubsystem) >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapBoundConnFactory: = >>>> init >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>>> LdapBoundConnFactory:doCloning true >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init() >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init = >>>> begins >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapAuthInfo: init ends >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: init: before = >>>> makeConnection errorIfDown is true >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: makeConnection: = >>>> errorIfDown true >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: TCP Keep-Alive: true >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: = >>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>>> subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: LdapJssSSLSocket: set = >>>> client auth cert nickname subsystemCert cert-pki-ca >>>> [28/Jul/2017:10:13:29][localhost-startStop-2]: SSL handshake happened >>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 = >>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>> at = >>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.makeConnection(Ldap= BoundConnFactory.java:205) = >>>> >>>> at = >>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF= actory.java:166) = >>>> >>>> at = >>>> com.netscape.cmscore.ldapconn.LdapBoundConnFactory.init(LdapBoundConnF= actory.java:130) = >>>> >>>> at com.netscape.cmscore.dbs.DBSubsystem.init(DBSubsystem.java:654) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:1172) >>>> at = >>>> com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:1078) >>>> at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:570) >>>> at com.netscape.certsrv.apps.CMS.init(CMS.java:188) >>>> at com.netscape.certsrv.apps.CMS.start(CMS.java:1621) >>>> at = >>>> com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.jav= a:114) = >>>> >>>> at javax.servlet.GenericServlet.init(GenericServlet.java:158) >>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) >>>> at = >>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.j= ava:62) = >>>> >>>> at = >>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccess= orImpl.java:43) = >>>> >>>> at java.lang.reflect.Method.invoke(Method.java:498) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:288) >>>> at = >>>> org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:285) >>>> at java.security.AccessController.doPrivileged(Native Method) >>>> at javax.security.auth.Subject.doAsPrivileged(Subject.java:549) >>>> at = >>>> org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:32= 0) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:175) = >>>> >>>> at = >>>> org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.j= ava:124) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.j= ava:1270) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.j= ava:1195) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:108= 5) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext= .java:5318) = >>>> >>>> at = >>>> org.apache.catalina.core.StandardContext.startInternal(StandardContext= .java:5610) = >>>> >>>> at = >>>> org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:147) >>>> at = >>>> org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.= java:899) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase.access$000(ContainerBase.java:1= 33) = >>>> >>>> at = >>>> org.apache.catalina.core.ContainerBase$PrivilegedAddChild.run(Containe= rBase.java:156) = >>>> >>>> >>>> >>>>> I don't think re-running the upgrade command would help. >>>>> >>>>> rob >>>>> >>>> >>> >> > = -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============1477773526450600254==-- From rcritten at redhat.com Tue Aug 1 19:04:05 2017 Content-Type: multipart/mixed; boundary="===============0859076021646391306==" MIME-Version: 1.0 From: Rob Crittenden To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 01 Aug 2017 15:03:21 -0400 Message-ID: In-Reply-To: 3e986b45-f163-80f0-2f88-ef3880ea441d@brownpapertickets.com --===============0859076021646391306== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Ian Harding wrote: > On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >> On 08/01/2017 03:11 PM, Ian Harding wrote: >>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>> >>>>> >>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>> I had an unexpected restart of an IPA server that had apparently had >>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd >>>>>>> would >>>>>>> not start. >>>>>>> >>>>>>> Strangely, the actual service appears to be running: >>>>>>> >>>>>> >>>>>> dogtag is an application within tomcat so tomcat can run without >>>>>> dogtag >>>>>> running. >>>>>> >>>>>> We need to see more of the dogtag debug log to see what is going on. >>>>>> >>>>> >>>>> It looks like an authentication problem... >>>>> >>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 >>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>> >>>> >>>> Hi, >>>> >>>> dogtag stores its internal data in the LDAP server and needs to >>>> establish a secure LDAP connection. You can check how this >>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>> the lines: >>>> >>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>> internaldb.ldapconn.host=3Dvm-... >>>> internaldb.ldapconn.port=3D636 >>>> internaldb.ldapconn.secureConn >>>> >>>> authtype can be SslClientAuth (authentication with a ssl >>>> certificate) or BasicAuth (authentication with a bind DN and >>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>> >>>> You can use this information to manually check the credentials. For >>>> instance with sslclientauth: >>>> >>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>> >>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>> >>> >>> I found this: >>> >>> internaldb.ldapauth.authtype=3DSslClientAuth >>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>> internaldb.ldapconn.cloneReplicationPort=3D389 >>> ... >>> >>> and when I try the ldapsearch I am presented with a prompt to provide >>> a pin/password >>> >>> Please enter pin, password, or pass phrase for security token 'ldap(0)': >>> >>> but there is no password file... >>> >> Hi, >> >> you are right, in 4.4. there is no pwdfile.txt and the password can be >> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >> internal=3D...) >> >> Can you check if the password with the tag internal=3D... allows to read >> the keys from the NSS db? >> certutil -K -d /etc/pki/pki-tomcat/alias >> (provide password) > = > That works... > = > # certutil -K -d /etc/pki/pki-tomcat/alias > certutil: Checking token "NSS Certificate DB" in slot "NSS User Private > Key and Certificate Services" > Enter Password or Pin for "NSS Certificate DB": > < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) > < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate > DB:auditSigningCert cert-pki-ca > < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert > cert-pki-ca > < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate > DB:ocspSigningCert cert-pki-ca > < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert > cert-pki-ca > < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate > DB:subsystemCert cert-pki-ca > = > But this doesn't (with the same password from password.conf) > = > # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL > Please enter pin, password, or pass phrase for security token 'ldap(0)': > SASL/EXTERNAL authentication started > ldap_sasl_interactive_bind_s: Invalid credentials (49) > = > That password is getting me somewhere though, since if I put in a > nonsense or incorrect password it just prompts over and over. Let's step back a second. You upgraded from what to what? Are you running in SELinux enforcing mode? If so can you run: # ausearch -m AVC I suspect that the subsystem cert was renewed and everything wasn't updated properly. If I'm right this is unrelated to the upgrade it just shone a spotlight on it. Can you run these commands: $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description and # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep Serial # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a The description attribute in the ldapsearch output is of the form 2;#;DN;DN The # should match the serial number in the first certutil output The ASCII blob (minus the BEGIN/END headers) should match one of the userCertificate attributes. rob --===============0859076021646391306==-- From ianh at brownpapertickets.com Tue Aug 1 23:46:14 2017 Content-Type: multipart/mixed; boundary="===============8250142675854330470==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 01 Aug 2017 16:43:15 -0700 Message-ID: <9b0d6fa9-f327-42df-1ad3-c7b9acd9f32d@brownpapertickets.com> In-Reply-To: ac159308-eb9c-e0e9-9ab4-446f96bebaee@redhat.com --===============8250142675854330470== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/01/2017 12:03 PM, Rob Crittenden wrote: > Ian Harding wrote: >> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>> >>>>>> >>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>> I had an unexpected restart of an IPA server that had apparently h= ad >>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd >>>>>>>> would >>>>>>>> not start. >>>>>>>> >>>>>>>> Strangely, the actual service appears to be running: >>>>>>>> >>>>>>> >>>>>>> dogtag is an application within tomcat so tomcat can run without >>>>>>> dogtag >>>>>>> running. >>>>>>> >>>>>>> We need to see more of the dogtag debug log to see what is going on. >>>>>>> >>>>>> >>>>>> It looks like an authentication problem... >>>>>> >>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake happened >>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 >>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>> >>>>> >>>>> Hi, >>>>> >>>>> dogtag stores its internal data in the LDAP server and needs to >>>>> establish a secure LDAP connection. You can check how this >>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>> the lines: >>>>> >>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>> internaldb.ldapconn.host=3Dvm-... >>>>> internaldb.ldapconn.port=3D636 >>>>> internaldb.ldapconn.secureConn >>>>> >>>>> authtype can be SslClientAuth (authentication with a ssl >>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>> >>>>> You can use this information to manually check the credentials. For >>>>> instance with sslclientauth: >>>>> >>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>> >>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>> >>>> >>>> I found this: >>>> >>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>> ... >>>> >>>> and when I try the ldapsearch I am presented with a prompt to provide >>>> a pin/password >>>> >>>> Please enter pin, password, or pass phrase for security token 'ldap(0)= ': >>>> >>>> but there is no password file... >>>> >>> Hi, >>> >>> you are right, in 4.4. there is no pwdfile.txt and the password can be >>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>> internal=3D...) >>> >>> Can you check if the password with the tag internal=3D... allows to read >>> the keys from the NSS db? >>> certutil -K -d /etc/pki/pki-tomcat/alias >>> (provide password) >> >> That works... >> >> # certutil -K -d /etc/pki/pki-tomcat/alias >> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private >> Key and Certificate Services" >> Enter Password or Pin for "NSS Certificate DB": >> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate >> DB:auditSigningCert cert-pki-ca >> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >> cert-pki-ca >> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate >> DB:ocspSigningCert cert-pki-ca >> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >> cert-pki-ca >> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate >> DB:subsystemCert cert-pki-ca >> >> But this doesn't (with the same password from password.conf) >> >> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >> Please enter pin, password, or pass phrase for security token 'ldap(0)': >> SASL/EXTERNAL authentication started >> ldap_sasl_interactive_bind_s: Invalid credentials (49) >> >> That password is getting me somewhere though, since if I put in a >> nonsense or incorrect password it just prompts over and over. > = > Let's step back a second. You upgraded from what to what? There wasn't much of a change... I just assumed someone ran yum upgrade = and didn't restart, then the power outage... it looks like not much of a = version change though. # grep ipa /var/log/yum.log Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:45:32 Installed: ipa-client-common-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:47:05 Installed: python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:47:05 Installed: ipa-server-common-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:47:06 Installed: python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:47:36 Installed: ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch # grep pki /var/log/yum.log Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch > = > Are you running in SELinux enforcing mode? # getenforce Enforcing > = > If so can you run: > = > # ausearch -m AVC > = # ausearch -m AVC The NOLOG option to log_format is deprecated. Please use the write_logs = option. The NOLOG option is overriding the write_logs current setting. ---- time->Mon Mar 14 10:39:01 2016 type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e syscall= =3D2 = success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0= items=3D0 = ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D581400001 = suid=3D0 = fsuid=3D581400001 egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) = ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } for = pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D11639= 3517 = scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile > I suspect that the subsystem cert was renewed and everything wasn't > updated properly. If I'm right this is unrelated to the upgrade it just > shone a spotlight on it. > = > Can you run these commands: > = > $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description > = This returns $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC ... stuff ... ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = Subsystem,O=3DBPT.ROCKS > and > = > # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert > cert-pki-ca' | grep Serial > # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca'= -a > = These both return # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = cert-pki-ca' | grep Serial Enter Password or Pin for "NSS Certificate DB": certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized = Object Identifier. # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = cert-pki-ca' -a certutil: Checking token "NSS Certificate DB" in slot "NSS User Private = Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized = Object Identifier. which seems weird. > The description attribute in the ldapsearch output is of the form 2;#;DN;= DN > = > The # should match the serial number in the first certutil output > = > The ASCII blob (minus the BEGIN/END headers) should match one of the > userCertificate attributes. > = > rob > = -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============8250142675854330470==-- From flo at redhat.com Wed Aug 2 07:12:33 2017 Content-Type: multipart/mixed; boundary="===============3295431487290206174==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Wed, 02 Aug 2017 09:11:17 +0200 Message-ID: In-Reply-To: 9b0d6fa9-f327-42df-1ad3-c7b9acd9f32d@brownpapertickets.com --===============3295431487290206174== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/02/2017 01:43 AM, Ian Harding wrote: > On 08/01/2017 12:03 PM, Rob Crittenden wrote: >> Ian Harding wrote: >>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>> >>>>>>> >>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>> apparently had >>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd >>>>>>>>> would >>>>>>>>> not start. >>>>>>>>> >>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>> >>>>>>>> >>>>>>>> dogtag is an application within tomcat so tomcat can run without >>>>>>>> dogtag >>>>>>>> running. >>>>>>>> >>>>>>>> We need to see more of the dogtag debug log to see what is going = >>>>>>>> on. >>>>>>>> >>>>>>> >>>>>>> It looks like an authentication problem... >>>>>>> >>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake = >>>>>>> happened >>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 >>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>> >>>>>> >>>>>> Hi, >>>>>> >>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>> establish a secure LDAP connection. You can check how this >>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>> the lines: >>>>>> >>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>> internaldb.ldapconn.port=3D636 >>>>>> internaldb.ldapconn.secureConn >>>>>> >>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>> >>>>>> You can use this information to manually check the credentials. For >>>>>> instance with sslclientauth: >>>>>> >>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>> >>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>> >>>>> >>>>> I found this: >>>>> >>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>> ... >>>>> >>>>> and when I try the ldapsearch I am presented with a prompt to provide >>>>> a pin/password >>>>> >>>>> Please enter pin, password, or pass phrase for security token = >>>>> 'ldap(0)': >>>>> >>>>> but there is no password file... >>>>> >>>> Hi, >>>> >>>> you are right, in 4.4. there is no pwdfile.txt and the password can be >>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>> internal=3D...) >>>> >>>> Can you check if the password with the tag internal=3D... allows to re= ad >>>> the keys from the NSS db? >>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>> (provide password) >>> >>> That works... >>> >>> # certutil -K -d /etc/pki/pki-tomcat/alias >>> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private >>> Key and Certificate Services" >>> Enter Password or Pin for "NSS Certificate DB": >>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS Certificate >>> DB:auditSigningCert cert-pki-ca >>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>> cert-pki-ca >>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS Certificate >>> DB:ocspSigningCert cert-pki-ca >>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>> cert-pki-ca >>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS Certificate >>> DB:subsystemCert cert-pki-ca >>> >>> But this doesn't (with the same password from password.conf) >>> >>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>> Please enter pin, password, or pass phrase for security token 'ldap(0)': >>> SASL/EXTERNAL authentication started >>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>> >>> That password is getting me somewhere though, since if I put in a >>> nonsense or incorrect password it just prompts over and over. >> >> Let's step back a second. You upgraded from what to what? > = > There wasn't much of a change... I just assumed someone ran yum upgrade = > and didn't restart, then the power outage... it looks like not much of a = > version change though. > = > # grep ipa /var/log/yum.log > Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch > Jan 08 04:45:32 Installed: ipa-client-common-4.4.0-14.el7.centos.1.1.noar= ch > Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 > Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 > Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch > Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch > Jan 08 04:47:05 Installed: python2-ipaclient-4.4.0-14.el7.centos.1.1.noar= ch > Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch > Jan 08 04:47:05 Installed: ipa-server-common-4.4.0-14.el7.centos.1.1.noar= ch > Jan 08 04:47:06 Installed: python2-ipaserver-4.4.0-14.el7.centos.1.1.noar= ch > Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 > Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 > Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 > Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch > Jan 08 04:47:36 Installed: ipa-python-compat-4.4.0-14.el7.centos.1.1.noar= ch > Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 > Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 > Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 > Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch > Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch > = > # grep pki /var/log/yum.log > Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch > Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 > Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch > Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 > Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch > Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch > Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch > Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch > Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch > Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 > Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch > Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch > Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch > = > = >> >> Are you running in SELinux enforcing mode? > = > # getenforce > Enforcing > = >> >> If so can you run: >> >> # ausearch -m AVC >> > = > # ausearch -m AVC > The NOLOG option to log_format is deprecated. Please use the write_logs = > option. > The NOLOG option is overriding the write_logs current setting. > ---- > time->Mon Mar 14 10:39:01 2016 > type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e syscall= =3D2 = > success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42= e0 items=3D0 = > ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D58140000= 1 suid=3D0 = > fsuid=3D581400001 egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none= ) = > ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = > subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) > type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } for = > pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D116= 393517 = > scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = > tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile > = > = >> I suspect that the subsystem cert was renewed and everything wasn't >> updated properly. If I'm right this is unrelated to the upgrade it just >> shone a spotlight on it. >> >> Can you run these commands: >> >> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >> > = > This returns > = > $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC > ... stuff ... > ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = > Subsystem,O=3DBPT.ROCKS > = >> and >> >> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >> cert-pki-ca' | grep Serial >> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >> cert-pki-ca' -a >> > = > These both return > = > # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = > cert-pki-ca' | grep Serial > Enter Password or Pin for "NSS Certificate DB": > certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized = > Object Identifier. > = > = > # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = > cert-pki-ca' -a > certutil: Checking token "NSS Certificate DB" in slot "NSS User Private = > Key and Certificate Services" > Enter Password or Pin for "NSS Certificate DB": > certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: Unrecognized = > Object Identifier. > = Hi, you made a typo and requested the keys (-K) instead of the certs (-L). = Please retry with -L and you should be able to see the certificate serial. Flo. > = > which seems weird. > = >> The description attribute in the ldapsearch output is of the form = >> 2;#;DN;DN >> >> The # should match the serial number in the first certutil output >> >> The ASCII blob (minus the BEGIN/END headers) should match one of the >> userCertificate attributes. >> >> rob >> >=20 --===============3295431487290206174==-- From ianh at brownpapertickets.com Wed Aug 2 23:08:08 2017 Content-Type: multipart/mixed; boundary="===============4390725634595251771==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Wed, 02 Aug 2017 14:51:47 -0700 Message-ID: <829dc322-a677-7aad-7724-b12b4b35ab18@brownpapertickets.com> In-Reply-To: b839bdc7-0e5a-c365-48cf-81ab2bf119f7@redhat.com --===============4390725634595251771== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: > On 08/02/2017 01:43 AM, Ian Harding wrote: >> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>> Ian Harding wrote: >>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>> >>>>>>>> >>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>> apparently had >>>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd >>>>>>>>>> would >>>>>>>>>> not start. >>>>>>>>>> >>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>> >>>>>>>>> >>>>>>>>> dogtag is an application within tomcat so tomcat can run without >>>>>>>>> dogtag >>>>>>>>> running. >>>>>>>>> >>>>>>>>> We need to see more of the dogtag debug log to see what is = >>>>>>>>> going on. >>>>>>>>> >>>>>>>> >>>>>>>> It looks like an authentication problem... >>>>>>>> >>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake = >>>>>>>> happened >>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port 636 >>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>>> >>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>>> establish a secure LDAP connection. You can check how this >>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>> the lines: >>>>>>> >>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>> internaldb.ldapconn.port=3D636 >>>>>>> internaldb.ldapconn.secureConn >>>>>>> >>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>> >>>>>>> You can use this information to manually check the credentials. For >>>>>>> instance with sslclientauth: >>>>>>> >>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>> >>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>> >>>>>> >>>>>> I found this: >>>>>> >>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>> ... >>>>>> >>>>>> and when I try the ldapsearch I am presented with a prompt to provide >>>>>> a pin/password >>>>>> >>>>>> Please enter pin, password, or pass phrase for security token = >>>>>> 'ldap(0)': >>>>>> >>>>>> but there is no password file... >>>>>> >>>>> Hi, >>>>> >>>>> you are right, in 4.4. there is no pwdfile.txt and the password can be >>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>>> internal=3D...) >>>>> >>>>> Can you check if the password with the tag internal=3D... allows to r= ead >>>>> the keys from the NSS db? >>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>> (provide password) >>>> >>>> That works... >>>> >>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User Private >>>> Key and Certificate Services" >>>> Enter Password or Pin for "NSS Certificate DB": >>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>> Certificate >>>> DB:auditSigningCert cert-pki-ca >>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>> cert-pki-ca >>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>> Certificate >>>> DB:ocspSigningCert cert-pki-ca >>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>> cert-pki-ca >>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>> Certificate >>>> DB:subsystemCert cert-pki-ca >>>> >>>> But this doesn't (with the same password from password.conf) >>>> >>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>> Please enter pin, password, or pass phrase for security token = >>>> 'ldap(0)': >>>> SASL/EXTERNAL authentication started >>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>> >>>> That password is getting me somewhere though, since if I put in a >>>> nonsense or incorrect password it just prompts over and over. >>> >>> Let's step back a second. You upgraded from what to what? >> >> There wasn't much of a change... I just assumed someone ran yum = >> upgrade and didn't restart, then the power outage... it looks like not = >> much of a version change though. >> >> # grep ipa /var/log/yum.log >> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:45:32 Installed: = >> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >> Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:47:05 Installed: = >> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:47:05 Installed: = >> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:47:06 Installed: = >> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:47:36 Installed: = >> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch >> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch >> >> # grep pki /var/log/yum.log >> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >> >> >>> >>> Are you running in SELinux enforcing mode? >> >> # getenforce >> Enforcing >> >>> >>> If so can you run: >>> >>> # ausearch -m AVC >>> >> >> # ausearch -m AVC >> The NOLOG option to log_format is deprecated. Please use the = >> write_logs option. >> The NOLOG option is overriding the write_logs current setting. >> ---- >> time->Mon Mar 14 10:39:01 2016 >> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e syscal= l=3D2 = >> success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f4= 2e0 = >> items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 euid= =3D581400001 = >> suid=3D0 fsuid=3D581400001 egid=3D581400001 sgid=3D0 fsgid=3D581400001 = >> tty=3D(none) ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } for = >> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D11= 6393517 = >> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >> >> >>> I suspect that the subsystem cert was renewed and everything wasn't >>> updated properly. If I'm right this is unrelated to the upgrade it just >>> shone a spotlight on it. >>> >>> Can you run these commands: >>> >>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>> >> >> This returns >> >> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >> ... stuff ... >> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >> Subsystem,O=3DBPT.ROCKS >> >>> and >>> >>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>> cert-pki-ca' | grep Serial >>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>> cert-pki-ca' -a >>> >> >> These both return >> >> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >> cert-pki-ca' | grep Serial >> Enter Password or Pin for "NSS Certificate DB": >> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >> Unrecognized Object Identifier. >> >> >> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >> cert-pki-ca' -a >> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >> Private Key and Certificate Services" >> Enter Password or Pin for "NSS Certificate DB": >> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >> Unrecognized Object Identifier. >> > Hi, > = > you made a typo and requested the keys (-K) instead of the certs (-L). = > Please retry with -L and you should be able to see the certificate serial. > = [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC ... ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = Subsystem,O=3DBPT.ROCKS So the serial is 4? [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = 'subsystemCert cert-pki-ca' | grep Serial Serial Number: 1341718541 (0x4ff9000d) Which is NOT 4... [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = 'subsystemCert cert-pki-ca' -a -----BEGIN CERTIFICATE----- MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC ... sjeiFbUFtoMnfmHLIYpe5QAR -----END CERTIFICATE----- And this cert is NOT the same. Thank you again for your time! Ian > Flo. >> >> which seems weird. >> >>> The description attribute in the ldapsearch output is of the form = >>> 2;#;DN;DN >>> >>> The # should match the serial number in the first certutil output >>> >>> The ASCII blob (minus the BEGIN/END headers) should match one of the >>> userCertificate attributes. >>> >>> rob >>> >> > = -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============4390725634595251771==-- From flo at redhat.com Thu Aug 3 07:29:46 2017 Content-Type: multipart/mixed; boundary="===============0027247055320873546==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Thu, 03 Aug 2017 09:28:49 +0200 Message-ID: <43de55b7-6aff-21e3-0338-ca5f34fa212f@redhat.com> In-Reply-To: 829dc322-a677-7aad-7724-b12b4b35ab18@brownpapertickets.com --===============0027247055320873546== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: > On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >> On 08/02/2017 01:43 AM, Ian Harding wrote: >>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>> Ian Harding wrote: >>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>> apparently had >>>>>>>>>>> updates run but had not been restarted. ipactl says pki-tomcatd >>>>>>>>>>> would >>>>>>>>>>> not start. >>>>>>>>>>> >>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> dogtag is an application within tomcat so tomcat can run without >>>>>>>>>> dogtag >>>>>>>>>> running. >>>>>>>>>> >>>>>>>>>> We need to see more of the dogtag debug log to see what is = >>>>>>>>>> going on. >>>>>>>>>> >>>>>>>>> >>>>>>>>> It looks like an authentication problem... >>>>>>>>> >>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake = >>>>>>>>> happened >>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks port = >>>>>>>>> 636 >>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>>>> >>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>> the lines: >>>>>>>> >>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>> internaldb.ldapconn.secureConn >>>>>>>> >>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>> >>>>>>>> You can use this information to manually check the credentials. For >>>>>>>> instance with sslclientauth: >>>>>>>> >>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>> >>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>> >>>>>>> >>>>>>> I found this: >>>>>>> >>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>> ... >>>>>>> >>>>>>> and when I try the ldapsearch I am presented with a prompt to = >>>>>>> provide >>>>>>> a pin/password >>>>>>> >>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>> 'ldap(0)': >>>>>>> >>>>>>> but there is no password file... >>>>>>> >>>>>> Hi, >>>>>> >>>>>> you are right, in 4.4. there is no pwdfile.txt and the password = >>>>>> can be >>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>>>> internal=3D...) >>>>>> >>>>>> Can you check if the password with the tag internal=3D... allows to = >>>>>> read >>>>>> the keys from the NSS db? >>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>> (provide password) >>>>> >>>>> That works... >>>>> >>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>> Private >>>>> Key and Certificate Services" >>>>> Enter Password or Pin for "NSS Certificate DB": >>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>> Certificate >>>>> DB:auditSigningCert cert-pki-ca >>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>>> cert-pki-ca >>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>> Certificate >>>>> DB:ocspSigningCert cert-pki-ca >>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>> cert-pki-ca >>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>> Certificate >>>>> DB:subsystemCert cert-pki-ca >>>>> >>>>> But this doesn't (with the same password from password.conf) >>>>> >>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>> Please enter pin, password, or pass phrase for security token = >>>>> 'ldap(0)': >>>>> SASL/EXTERNAL authentication started >>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>> >>>>> That password is getting me somewhere though, since if I put in a >>>>> nonsense or incorrect password it just prompts over and over. >>>> >>>> Let's step back a second. You upgraded from what to what? >>> >>> There wasn't much of a change... I just assumed someone ran yum = >>> upgrade and didn't restart, then the power outage... it looks like = >>> not much of a version change though. >>> >>> # grep ipa /var/log/yum.log >>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:45:32 Installed: = >>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>> Jan 08 04:47:04 Installed: python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:47:05 Installed: = >>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:47:05 Installed: = >>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:47:06 Installed: = >>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:47:36 Installed: = >>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>> >>> # grep pki /var/log/yum.log >>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>> >>> >>>> >>>> Are you running in SELinux enforcing mode? >>> >>> # getenforce >>> Enforcing >>> >>>> >>>> If so can you run: >>>> >>>> # ausearch -m AVC >>>> >>> >>> # ausearch -m AVC >>> The NOLOG option to log_format is deprecated. Please use the = >>> write_logs option. >>> The NOLOG option is overriding the write_logs current setting. >>> ---- >>> time->Mon Mar 14 10:39:01 2016 >>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e sysca= ll=3D2 = >>> success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f= 42e0 = >>> items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 = >>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 sgid=3D0 = >>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" = >>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>> key=3D(null) >>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } fo= r = >>> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" ino=3D1= 16393517 = >>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>> >>> >>>> I suspect that the subsystem cert was renewed and everything wasn't >>>> updated properly. If I'm right this is unrelated to the upgrade it just >>>> shone a spotlight on it. >>>> >>>> Can you run these commands: >>>> >>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>> >>> >>> This returns >>> >>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>> ... stuff ... >>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>> Subsystem,O=3DBPT.ROCKS >>> >>>> and >>>> >>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>> cert-pki-ca' | grep Serial >>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>> cert-pki-ca' -a >>>> >>> >>> These both return >>> >>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>> cert-pki-ca' | grep Serial >>> Enter Password or Pin for "NSS Certificate DB": >>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>> Unrecognized Object Identifier. >>> >>> >>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>> cert-pki-ca' -a >>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>> Private Key and Certificate Services" >>> Enter Password or Pin for "NSS Certificate DB": >>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>> Unrecognized Object Identifier. >>> >> Hi, >> >> you made a typo and requested the keys (-K) instead of the certs (-L). = >> Please retry with -L and you should be able to see the certificate = >> serial. >> > = > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = -b = > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC > ... > ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = > Subsystem,O=3DBPT.ROCKS > = > So the serial is 4? > = > [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = > 'subsystemCert cert-pki-ca' | grep Serial > Serial Number: 1341718541 (0x4ff9000d) > = > Which is NOT 4... > = > [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = > 'subsystemCert cert-pki-ca' -a > -----BEGIN CERTIFICATE----- > MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC > ... > sjeiFbUFtoMnfmHLIYpe5QAR > -----END CERTIFICATE----- > = > And this cert is NOT the same. > = Hi, when certmonger renews a certificate, it runs pre-save and post-save = commands (which you can see in the output of getcert list). In your = case, the post-save command for subsystemCert cert-pki-ca probably failed. This command (on the renewal master) is responsible for copying the new = cert from the NSS db to the LDAP server. You need first to check which = IPA server is the renewal master (as the serial numbers are in a = completely different range, I assume that you have multiple IPA servers = configured with a CA instance): $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-` $ kinit admin $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn dn: = cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc= =3Dipadomain,dc=3Dcom In this example the renewal master is vm-ipaserver. If your renewal master is the machine on which the NSS DB = /etc/pki/pki-tomcat/alias contains the newer cert, then you can manually = run the scripts: $ sudo /usr/libexec/ipa/certmonger/stop_pkicad $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" After that, check that the LDAP entry has been updated. If it is the = case, you should be able to restart pki. Flo > Thank you again for your time! > = > Ian > = >> Flo. >>> >>> which seems weird. >>> >>>> The description attribute in the ldapsearch output is of the form = >>>> 2;#;DN;DN >>>> >>>> The # should match the serial number in the first certutil output >>>> >>>> The ASCII blob (minus the BEGIN/END headers) should match one of the >>>> userCertificate attributes. >>>> >>>> rob >>>> >>> >> >=20 --===============0027247055320873546==-- From ianh at brownpapertickets.com Thu Aug 3 22:15:44 2017 Content-Type: multipart/mixed; boundary="===============3760006118306233222==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Thu, 03 Aug 2017 14:13:20 -0700 Message-ID: <10d05c35-cf22-6008-8d2b-3ce352357cb1@brownpapertickets.com> In-Reply-To: 43de55b7-6aff-21e3-0338-ca5f34fa212f@redhat.com --===============3760006118306233222== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: > On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>> Ian Harding wrote: >>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>> apparently had >>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>> would >>>>>>>>>>>> not start. >>>>>>>>>>>> >>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> dogtag is an application within tomcat so tomcat can run without >>>>>>>>>>> dogtag >>>>>>>>>>> running. >>>>>>>>>>> >>>>>>>>>>> We need to see more of the dogtag debug log to see what is = >>>>>>>>>>> going on. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> It looks like an authentication problem... >>>>>>>>>> >>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake = >>>>>>>>>> happened >>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks = >>>>>>>>>> port 636 >>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>>>>> >>>>>>>>> >>>>>>>>> Hi, >>>>>>>>> >>>>>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, look = >>>>>>>>> for >>>>>>>>> the lines: >>>>>>>>> >>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>> >>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>> >>>>>>>>> You can use this information to manually check the credentials. = >>>>>>>>> For >>>>>>>>> instance with sslclientauth: >>>>>>>>> >>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>> >>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>> >>>>>>>> >>>>>>>> I found this: >>>>>>>> >>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>> ... >>>>>>>> >>>>>>>> and when I try the ldapsearch I am presented with a prompt to = >>>>>>>> provide >>>>>>>> a pin/password >>>>>>>> >>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>> 'ldap(0)': >>>>>>>> >>>>>>>> but there is no password file... >>>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> you are right, in 4.4. there is no pwdfile.txt and the password = >>>>>>> can be >>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>>>>> internal=3D...) >>>>>>> >>>>>>> Can you check if the password with the tag internal=3D... allows to = >>>>>>> read >>>>>>> the keys from the NSS db? >>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>> (provide password) >>>>>> >>>>>> That works... >>>>>> >>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>> Private >>>>>> Key and Certificate Services" >>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>> Certificate >>>>>> DB:auditSigningCert cert-pki-ca >>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>> caSigningCert >>>>>> cert-pki-ca >>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>> Certificate >>>>>> DB:ocspSigningCert cert-pki-ca >>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>> cert-pki-ca >>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>> Certificate >>>>>> DB:subsystemCert cert-pki-ca >>>>>> >>>>>> But this doesn't (with the same password from password.conf) >>>>>> >>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>> Please enter pin, password, or pass phrase for security token = >>>>>> 'ldap(0)': >>>>>> SASL/EXTERNAL authentication started >>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>> >>>>>> That password is getting me somewhere though, since if I put in a >>>>>> nonsense or incorrect password it just prompts over and over. >>>>> >>>>> Let's step back a second. You upgraded from what to what? >>>> >>>> There wasn't much of a change... I just assumed someone ran yum = >>>> upgrade and didn't restart, then the power outage... it looks like = >>>> not much of a version change though. >>>> >>>> # grep ipa /var/log/yum.log >>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:45:32 Installed: = >>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>> Jan 08 04:47:04 Installed: = >>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:47:05 Installed: = >>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:47:05 Installed: = >>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:47:06 Installed: = >>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:47:36 Installed: = >>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:42 Updated: ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:43 Updated: ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:44 Updated: python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:45 Updated: python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>> Jul 28 09:55:48 Updated: ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>> >>>> # grep pki /var/log/yum.log >>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>> >>>> >>>>> >>>>> Are you running in SELinux enforcing mode? >>>> >>>> # getenforce >>>> Enforcing >>>> >>>>> >>>>> If so can you run: >>>>> >>>>> # ausearch -m AVC >>>>> >>>> >>>> # ausearch -m AVC >>>> The NOLOG option to log_format is deprecated. Please use the = >>>> write_logs option. >>>> The NOLOG option is overriding the write_logs current setting. >>>> ---- >>>> time->Mon Mar 14 10:39:01 2016 >>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e = >>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 = >>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295 = uid=3D0 = >>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 s= gid=3D0 = >>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" = >>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>> key=3D(null) >>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } f= or = >>>> pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" = >>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>> >>>> >>>>> I suspect that the subsystem cert was renewed and everything wasn't >>>>> updated properly. If I'm right this is unrelated to the upgrade it = >>>>> just >>>>> shone a spotlight on it. >>>>> >>>>> Can you run these commands: >>>>> >>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>> >>>> >>>> This returns >>>> >>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>> ... stuff ... >>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>> Subsystem,O=3DBPT.ROCKS >>>> >>>>> and >>>>> >>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>> cert-pki-ca' | grep Serial >>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>> cert-pki-ca' -a >>>>> >>>> >>>> These both return >>>> >>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>> cert-pki-ca' | grep Serial >>>> Enter Password or Pin for "NSS Certificate DB": >>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>> Unrecognized Object Identifier. >>>> >>>> >>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>> cert-pki-ca' -a >>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>> Private Key and Certificate Services" >>>> Enter Password or Pin for "NSS Certificate DB": >>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>> Unrecognized Object Identifier. >>>> >>> Hi, >>> >>> you made a typo and requested the keys (-K) instead of the certs = >>> (-L). Please retry with -L and you should be able to see the = >>> certificate serial. >>> >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >> ... >> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >> Subsystem,O=3DBPT.ROCKS >> >> So the serial is 4? >> >> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >> 'subsystemCert cert-pki-ca' | grep Serial >> Serial Number: 1341718541 (0x4ff9000d) >> >> Which is NOT 4... >> >> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >> 'subsystemCert cert-pki-ca' -a >> -----BEGIN CERTIFICATE----- >> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >> ... >> sjeiFbUFtoMnfmHLIYpe5QAR >> -----END CERTIFICATE----- >> >> And this cert is NOT the same. >> > Hi, > = > when certmonger renews a certificate, it runs pre-save and post-save = > commands (which you can see in the output of getcert list). In your = > case, the post-save command for subsystemCert cert-pki-ca probably failed. > = > This command (on the renewal master) is responsible for copying the new = > cert from the NSS db to the LDAP server. You need first to check which = > IPA server is the renewal master (as the serial numbers are in a = > completely different range, I assume that you have multiple IPA servers = > configured with a CA instance): > = > $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-` > $ kinit admin > $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = > "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = > '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn > dn: = > cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc= =3Dipadomain,dc=3Dcom = > = > = > In this example the renewal master is vm-ipaserver. > = I get this $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn dn: cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=3D= bpt,dc=3Drocks Which is the other FreeIPA server. > If your renewal master is the machine on which the NSS DB = > /etc/pki/pki-tomcat/alias contains the newer cert, then you can manually = > run the scripts: If I'm interpreting this correctly, then it is... so I ran this on the = broken machine (seattlenfs) > $ sudo /usr/libexec/ipa/certmonger/stop_pkicad > $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = > cert-pki-ca" > = I ran this, it took a while, then I re-checked and the serial still = seems to be 4 $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC ... ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = Subsystem,O=3DBPT.ROCKS Here's what was in /var/log/pki/pki-tomcat/ca/debug [03/Aug/2017:13:52:51][localhost-startStop-1]: = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUBSY= STEM = INITIALIZED =3D=3D=3D=3D=3D=3D=3D [03/Aug/2017:13:52:51][localhost-startStop-1]: = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = autoShutdown? false [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3Dde= bug [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized debug [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem = id=3Dlog [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init = id=3Dlog [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = autoShutdown? false [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3Dlog [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized log [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem = id=3Djss [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init = id=3Djss [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = autoShutdown? false [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown = crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look = for cert for auto-shutdown support:auditSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = cert:auditSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3Djss [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized jss [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem = id=3Ddbs [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init = id=3Ddbs [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() = mEnableSerialMgmt=3Dtrue [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = LdapBoundConnFactor(DBSubsystem) [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: init [03/Aug/2017:13:52:51][localhost-startStop-1]: = LdapBoundConnFactory:doCloning true [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = makeConnection errorIfDown is true [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = errorIfDown true [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true [03/Aug/2017:13:52:51][localhost-startStop-1]: = SSLClientCertificateSelectionCB: Setting desired cert nickname to: = subsystemCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set = client auth cert nickname subsystemCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: = SSLClientCertificatSelectionCB: Entering! [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = ocspSigningCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = subsystemCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: = SSLClientCertificateSelectionCB: desired cert found in list: = subsystemCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: = SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() I really appreciate you sticking with me through this. I owe you. - Ian > After that, check that the LDAP entry has been updated. If it is the = > case, you should be able to restart pki. > = > Flo > = >> Thank you again for your time! >> >> Ian >> >>> Flo. >>>> >>>> which seems weird. >>>> >>>>> The description attribute in the ldapsearch output is of the form = >>>>> 2;#;DN;DN >>>>> >>>>> The # should match the serial number in the first certutil output >>>>> >>>>> The ASCII blob (minus the BEGIN/END headers) should match one of the >>>>> userCertificate attributes. >>>>> >>>>> rob >>>>> >>>> >>> >> > = -- = Ian Harding IT Director Brown Paper Tickets 1-800-838-3006 ext 7186 http://www.brownpapertickets.com --===============3760006118306233222==-- From flo at redhat.com Fri Aug 4 09:17:44 2017 Content-Type: multipart/mixed; boundary="===============7421681902227138929==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Fri, 04 Aug 2017 11:16:49 +0200 Message-ID: In-Reply-To: 10d05c35-cf22-6008-8d2b-3ce352357cb1@brownpapertickets.com --===============7421681902227138929== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: > On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>> Ian Harding wrote: >>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>>> apparently had >>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>> would >>>>>>>>>>>>> not start. >>>>>>>>>>>>> >>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run = >>>>>>>>>>>> without >>>>>>>>>>>> dogtag >>>>>>>>>>>> running. >>>>>>>>>>>> >>>>>>>>>>>> We need to see more of the dogtag debug log to see what is = >>>>>>>>>>>> going on. >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>> >>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL handshake = >>>>>>>>>>> happened >>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks = >>>>>>>>>>> port 636 >>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, = >>>>>>>>>> look for >>>>>>>>>> the lines: >>>>>>>>>> >>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-= ca >>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>> >>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>> >>>>>>>>>> You can use this information to manually check the = >>>>>>>>>> credentials. For >>>>>>>>>> instance with sslclientauth: >>>>>>>>>> >>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>> >>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>>>> (provide the password from /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>> >>>>>>>>> >>>>>>>>> I found this: >>>>>>>>> >>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-ca >>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>> ... >>>>>>>>> >>>>>>>>> and when I try the ldapsearch I am presented with a prompt to = >>>>>>>>> provide >>>>>>>>> a pin/password >>>>>>>>> >>>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>>> 'ldap(0)': >>>>>>>>> >>>>>>>>> but there is no password file... >>>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the password = >>>>>>>> can be >>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>>>>>> internal=3D...) >>>>>>>> >>>>>>>> Can you check if the password with the tag internal=3D... allows = >>>>>>>> to read >>>>>>>> the keys from the NSS db? >>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>> (provide password) >>>>>>> >>>>>>> That works... >>>>>>> >>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>>> Private >>>>>>> Key and Certificate Services" >>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>> Certificate >>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>>>>> cert-pki-ca >>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>> Certificate >>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>> cert-pki-ca >>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>> Certificate >>>>>>> DB:subsystemCert cert-pki-ca >>>>>>> >>>>>>> But this doesn't (with the same password from password.conf) >>>>>>> >>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>> 'ldap(0)': >>>>>>> SASL/EXTERNAL authentication started >>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>> >>>>>>> That password is getting me somewhere though, since if I put in a >>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>> >>>>>> Let's step back a second. You upgraded from what to what? >>>>> >>>>> There wasn't much of a change... I just assumed someone ran yum = >>>>> upgrade and didn't restart, then the power outage... it looks like = >>>>> not much of a version change though. >>>>> >>>>> # grep ipa /var/log/yum.log >>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:45:32 Installed: = >>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>> Jan 08 04:47:04 Installed: = >>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:47:05 Installed: = >>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:47:05 Updated: ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:47:05 Installed: = >>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:47:06 Installed: = >>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>> Jan 08 04:47:27 Updated: ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:47:36 Installed: = >>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:42 Updated: = >>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:43 Updated: = >>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:44 Updated: = >>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:45 Updated: = >>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>> Jul 28 09:55:48 Updated: = >>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>> >>>>> # grep pki /var/log/yum.log >>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>> >>>>> >>>>>> >>>>>> Are you running in SELinux enforcing mode? >>>>> >>>>> # getenforce >>>>> Enforcing >>>>> >>>>>> >>>>>> If so can you run: >>>>>> >>>>>> # ausearch -m AVC >>>>>> >>>>> >>>>> # ausearch -m AVC >>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>> write_logs option. >>>>> The NOLOG option is overriding the write_logs current setting. >>>>> ---- >>>>> time->Mon Mar 14 10:39:01 2016 >>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e = >>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D1 = >>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967295= uid=3D0 = >>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 = sgid=3D0 = >>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" = >>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>> key=3D(null) >>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } = >>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" = >>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>> >>>>> >>>>>> I suspect that the subsystem cert was renewed and everything wasn't >>>>>> updated properly. If I'm right this is unrelated to the upgrade it = >>>>>> just >>>>>> shone a spotlight on it. >>>>>> >>>>>> Can you run these commands: >>>>>> >>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>> >>>>> >>>>> This returns >>>>> >>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>> ... stuff ... >>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>> Subsystem,O=3DBPT.ROCKS >>>>> >>>>>> and >>>>>> >>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>> cert-pki-ca' | grep Serial >>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>> cert-pki-ca' -a >>>>>> >>>>> >>>>> These both return >>>>> >>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>> cert-pki-ca' | grep Serial >>>>> Enter Password or Pin for "NSS Certificate DB": >>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>> Unrecognized Object Identifier. >>>>> >>>>> >>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>> cert-pki-ca' -a >>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>> Private Key and Certificate Services" >>>>> Enter Password or Pin for "NSS Certificate DB": >>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>> Unrecognized Object Identifier. >>>>> >>>> Hi, >>>> >>>> you made a typo and requested the keys (-K) instead of the certs = >>>> (-L). Please retry with -L and you should be able to see the = >>>> certificate serial. >>>> >>> >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>> ... >>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>> Subsystem,O=3DBPT.ROCKS >>> >>> So the serial is 4? >>> >>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>> 'subsystemCert cert-pki-ca' | grep Serial >>> Serial Number: 1341718541 (0x4ff9000d) >>> >>> Which is NOT 4... >>> >>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>> 'subsystemCert cert-pki-ca' -a >>> -----BEGIN CERTIFICATE----- >>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>> ... >>> sjeiFbUFtoMnfmHLIYpe5QAR >>> -----END CERTIFICATE----- >>> >>> And this cert is NOT the same. >>> >> Hi, >> >> when certmonger renews a certificate, it runs pre-save and post-save = >> commands (which you can see in the output of getcert list). In your = >> case, the post-save command for subsystemCert cert-pki-ca probably = >> failed. >> >> This command (on the renewal master) is responsible for copying the = >> new cert from the NSS db to the LDAP server. You need first to check = >> which IPA server is the renewal master (as the serial numbers are in a = >> completely different range, I assume that you have multiple IPA = >> servers configured with a CA instance): >> >> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-` >> $ kinit admin >> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >> dn: = >> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,d= c=3Dipadomain,dc=3Dcom = >> >> >> In this example the renewal master is vm-ipaserver. >> > = > I get this > = > $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = > "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = > '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn > dn: cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc= =3Dbpt,dc=3Drocks > = > Which is the other FreeIPA server. > = Hi Ian, it's getting difficult to follow this thread, so could we step back and = summarize? - On server freeipa-sea (=3Drenewal master), the CA component is installed = and 'subsystemCert cert-pki-ca' has Serial number 4 in the NSSDB = /etc/pki/pki-tomcat/alias - On server seattlenfs (where PKI fails to restart), the CA component is = installed and 'subsystemCert cert-pki-ca' has Serial number 1341718541 = in the NSSDB /etc/pki/pki-tomcat/alias. - In the LDAP servers, the cert is stored in the entry = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is the = cert from freeipa-sea). If you check the certificates dates, I guess that the most recent one is = on server seattlenfs (because of serial numbers). Can you confirm this = (because our goal is to have the most recent cert stored in all the = NSSDBs and in LDAP)? Thanks, Flo >> If your renewal master is the machine on which the NSS DB = >> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >> manually run the scripts: > = > If I'm interpreting this correctly, then it is... so I ran this on the = > broken machine (seattlenfs) > = >> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >> cert-pki-ca" >> > = > I ran this, it took a while, then I re-checked and the serial still = > seems to be 4 > = > $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC > ... > ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = > Subsystem,O=3DBPT.ROCKS > = > Here's what was in /var/log/pki/pki-tomcat/ca/debug > = > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SUB= SYSTEM = > INITIALIZED =3D=3D=3D=3D=3D=3D=3D > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = > autoShutdown? false > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = > id=3Ddebug > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized deb= ug > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem = > id=3Dlog > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init = > id=3Dlog > [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) > [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) > [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = > RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = > autoShutdown? false > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3D= log > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized log > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem = > id=3Djss > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init = > id=3Djss > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = > autoShutdown? false > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: autoShutdown = > crumb file path? /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to look = > for cert for auto-shutdown support:auditSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = > cert:auditSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init id=3D= jss > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized jss > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initSubsystem = > id=3Ddbs > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to init = > id=3Ddbs > [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() = > mEnableSerialMgmt=3Dtrue > [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = > LdapBoundConnFactor(DBSubsystem) > [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: init > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > LdapBoundConnFactory:doCloning true > [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() > [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins > [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends > [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = > makeConnection errorIfDown is true > [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = > errorIfDown true > [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > SSLClientCertificateSelectionCB: Setting desired cert nickname to: = > subsystemCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set = > client auth cert nickname subsystemCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > SSLClientCertificatSelectionCB: Entering! > [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = > ocspSigningCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = > subsystemCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > SSLClientCertificateSelectionCB: desired cert found in list: = > subsystemCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: = > SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca > [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened > [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() > = > = > I really appreciate you sticking with me through this. I owe you. > = > - Ian > = >> After that, check that the LDAP entry has been updated. If it is the = >> case, you should be able to restart pki. >> >> Flo >> >>> Thank you again for your time! >>> >>> Ian >>> >>>> Flo. >>>>> >>>>> which seems weird. >>>>> >>>>>> The description attribute in the ldapsearch output is of the form = >>>>>> 2;#;DN;DN >>>>>> >>>>>> The # should match the serial number in the first certutil output >>>>>> >>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of the >>>>>> userCertificate attributes. >>>>>> >>>>>> rob >>>>>> >>>>> >>>> >>> >> >=20 --===============7421681902227138929==-- From ianh at brownpapertickets.com Fri Aug 4 21:03:34 2017 Content-Type: multipart/mixed; boundary="===============3441199417339637142==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Fri, 04 Aug 2017 14:02:44 -0700 Message-ID: <0d346ba2-7727-f18c-1bda-9cb9b72b1140@brownpapertickets.com> In-Reply-To: dd5e8cd3-5498-bc55-891c-5da39ced8238@redhat.com --===============3441199417339637142== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: > On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>> Ian Harding wrote: >>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>>>> apparently had >>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>> would >>>>>>>>>>>>>> not start. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run = >>>>>>>>>>>>> without >>>>>>>>>>>>> dogtag >>>>>>>>>>>>> running. >>>>>>>>>>>>> >>>>>>>>>>>>> We need to see more of the dogtag debug log to see what is = >>>>>>>>>>>>> going on. >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>> >>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>> handshake happened >>>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks = >>>>>>>>>>>> port 636 >>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, = >>>>>>>>>>> look for >>>>>>>>>>> the lines: >>>>>>>>>>> >>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>> cert-pki-ca >>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>> >>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>> >>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>> credentials. For >>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>> >>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>> >>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>>>>> (provide the password from = >>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I found this: >>>>>>>>>> >>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dipa= ca >>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki-= ca >>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>> ... >>>>>>>>>> >>>>>>>>>> and when I try the ldapsearch I am presented with a prompt to = >>>>>>>>>> provide >>>>>>>>>> a pin/password >>>>>>>>>> >>>>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>>>> 'ldap(0)': >>>>>>>>>> >>>>>>>>>> but there is no password file... >>>>>>>>>> >>>>>>>>> Hi, >>>>>>>>> >>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>> password can be >>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>>>>>>> internal=3D...) >>>>>>>>> >>>>>>>>> Can you check if the password with the tag internal=3D... allows = >>>>>>>>> to read >>>>>>>>> the keys from the NSS db? >>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>> (provide password) >>>>>>>> >>>>>>>> That works... >>>>>>>> >>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>>>> Private >>>>>>>> Key and Certificate Services" >>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>> Certificate >>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>>>>>> cert-pki-ca >>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>> Certificate >>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>>> cert-pki-ca >>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>> Certificate >>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>> >>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>> >>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>> 'ldap(0)': >>>>>>>> SASL/EXTERNAL authentication started >>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>> >>>>>>>> That password is getting me somewhere though, since if I put in a >>>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>>> >>>>>>> Let's step back a second. You upgraded from what to what? >>>>>> >>>>>> There wasn't much of a change... I just assumed someone ran yum = >>>>>> upgrade and didn't restart, then the power outage... it looks = >>>>>> like not much of a version change though. >>>>>> >>>>>> # grep ipa /var/log/yum.log >>>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:45:32 Installed: = >>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>>> Jan 08 04:47:04 Installed: = >>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:47:05 Installed: = >>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:47:05 Updated: = >>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:47:05 Installed: = >>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:47:06 Installed: = >>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>> Jan 08 04:47:27 Updated: = >>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:47:36 Installed: = >>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:42 Updated: = >>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:43 Updated: = >>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:44 Updated: = >>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:45 Updated: = >>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>> Jul 28 09:55:48 Updated: = >>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>> >>>>>> # grep pki /var/log/yum.log >>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>> >>>>>> >>>>>>> >>>>>>> Are you running in SELinux enforcing mode? >>>>>> >>>>>> # getenforce >>>>>> Enforcing >>>>>> >>>>>>> >>>>>>> If so can you run: >>>>>>> >>>>>>> # ausearch -m AVC >>>>>>> >>>>>> >>>>>> # ausearch -m AVC >>>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>>> write_logs option. >>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>> ---- >>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e = >>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2=3D= 1 = >>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D429496729= 5 uid=3D0 = >>>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001= sgid=3D0 = >>>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" = >>>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c102= 3 = >>>>>> key=3D(null) >>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } = >>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" = >>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>> >>>>>> >>>>>>> I suspect that the subsystem cert was renewed and everything wasn't >>>>>>> updated properly. If I'm right this is unrelated to the upgrade = >>>>>>> it just >>>>>>> shone a spotlight on it. >>>>>>> >>>>>>> Can you run these commands: >>>>>>> >>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>> >>>>>> >>>>>> This returns >>>>>> >>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>> ... stuff ... >>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>> Subsystem,O=3DBPT.ROCKS >>>>>> >>>>>>> and >>>>>>> >>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>> cert-pki-ca' | grep Serial >>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>> cert-pki-ca' -a >>>>>>> >>>>>> >>>>>> These both return >>>>>> >>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>> cert-pki-ca' | grep Serial >>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>> Unrecognized Object Identifier. >>>>>> >>>>>> >>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>> cert-pki-ca' -a >>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>> Private Key and Certificate Services" >>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>> Unrecognized Object Identifier. >>>>>> >>>>> Hi, >>>>> >>>>> you made a typo and requested the keys (-K) instead of the certs = >>>>> (-L). Please retry with -L and you should be able to see the = >>>>> certificate serial. >>>>> >>>> >>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>> ... >>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>> Subsystem,O=3DBPT.ROCKS >>>> >>>> So the serial is 4? >>>> >>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>> 'subsystemCert cert-pki-ca' | grep Serial >>>> Serial Number: 1341718541 (0x4ff9000d) >>>> >>>> Which is NOT 4... >>>> >>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>> -n 'subsystemCert cert-pki-ca' -a >>>> -----BEGIN CERTIFICATE----- >>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>> ... >>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>> -----END CERTIFICATE----- >>>> >>>> And this cert is NOT the same. >>>> >>> Hi, >>> >>> when certmonger renews a certificate, it runs pre-save and post-save = >>> commands (which you can see in the output of getcert list). In your = >>> case, the post-save command for subsystemCert cert-pki-ca probably = >>> failed. >>> >>> This command (on the renewal master) is responsible for copying the = >>> new cert from the NSS db to the LDAP server. You need first to check = >>> which IPA server is the renewal master (as the serial numbers are in = >>> a completely different range, I assume that you have multiple IPA = >>> servers configured with a CA instance): >>> >>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-` >>> $ kinit admin >>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>> dn: = >>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc,= dc=3Dipadomain,dc=3Dcom = >>> >>> >>> In this example the renewal master is vm-ipaserver. >>> >> >> I get this >> >> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >> dn: = >> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=3Db= pt,dc=3Drocks >> >> Which is the other FreeIPA server. >> > Hi Ian, > > it's getting difficult to follow this thread, so could we step back = > and summarize? Yes, it is. Sorry. > > - On server freeipa-sea (=3Drenewal master), the CA component is = > installed and 'subsystemCert cert-pki-ca' has Serial number 4 in the = > NSSDB /etc/pki/pki-tomcat/alias No? [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = 'subsystemCert cert-pki-ca' | grep Serial Serial Number: 1341718541 (0x4ff9000d) > - On server seattlenfs (where PKI fails to restart), the CA component = > is installed and 'subsystemCert cert-pki-ca' has Serial number = > 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. Yes [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = 'subsystemCert cert-pki-ca' | grep Serial Serial Number: 1341718541 (0x4ff9000d) > > - In the LDAP servers, the cert is stored in the entry = > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is th= e = > cert from freeipa-sea). This is where the difference is. There are two certificates on the = master and only one on the other. I wonder if this is a result of the = slow motion replication trainwreck I have going on due to a zombie = replica in the ldap database that no longer exists in the real world and = I can't seem to get rid of. [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D userCertificate:: = MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = Subsystem ,O=3DBPT.ROCKS [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = Subsystem,O=3DBPT.RO CKS > If you check the certificates dates, I guess that the most recent one = > is on server seattlenfs (because of serial numbers). Can you confirm = > this (because our goal is to have the most recent cert stored in all = > the NSSDBs and in LDAP)? > > Thanks, > Flo > > >>> If your renewal master is the machine on which the NSS DB = >>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >>> manually run the scripts: >> >> If I'm interpreting this correctly, then it is... so I ran this on = >> the broken machine (seattlenfs) >> >>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >>> cert-pki-ca" >>> >> >> I ran this, it took a while, then I re-checked and the serial still = >> seems to be 4 >> >> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >> ... >> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >> Subsystem,O=3DBPT.ROCKS >> >> Here's what was in /var/log/pki/pki-tomcat/ca/debug >> >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG SU= BSYSTEM = >> INITIALIZED =3D=3D=3D=3D=3D=3D=3D >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = >> autoShutdown? false >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >> autoShutdown crumb file path? = >> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >> id=3Ddebug >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized = >> debug >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >> initSubsystem id=3Dlog >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >> init id=3Dlog >> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = >> autoShutdown? false >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >> autoShutdown crumb file path? = >> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >> id=3Dlog >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized = >> log >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >> initSubsystem id=3Djss >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >> init id=3Djss >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = >> autoShutdown? false >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >> autoShutdown crumb file path? = >> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >> cert:auditSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >> id=3Djss >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized = >> jss >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >> initSubsystem id=3Ddbs >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >> init id=3Ddbs >> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() = >> mEnableSerialMgmt=3Dtrue >> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >> LdapBoundConnFactor(DBSubsystem) >> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: = >> init >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> LdapBoundConnFactory:doCloning true >> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() >> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins >> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends >> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >> makeConnection errorIfDown is true >> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >> errorIfDown true >> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >> subsystemCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set = >> client auth cert nickname subsystemCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> SSLClientCertificatSelectionCB: Entering! >> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >> ocspSigningCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >> subsystemCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> SSLClientCertificateSelectionCB: desired cert found in list: = >> subsystemCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened >> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() >> >> >> I really appreciate you sticking with me through this. I owe you. >> >> - Ian >> >>> After that, check that the LDAP entry has been updated. If it is the = >>> case, you should be able to restart pki. >>> >>> Flo >>> >>>> Thank you again for your time! >>>> >>>> Ian >>>> >>>>> Flo. >>>>>> >>>>>> which seems weird. >>>>>> >>>>>>> The description attribute in the ldapsearch output is of the = >>>>>>> form 2;#;DN;DN >>>>>>> >>>>>>> The # should match the serial number in the first certutil output >>>>>>> >>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of = >>>>>>> the >>>>>>> userCertificate attributes. >>>>>>> >>>>>>> rob >>>>>>> >>>>>> >>>>> >>>> >>> >> > --===============3441199417339637142==-- From flo at redhat.com Mon Aug 7 07:23:18 2017 Content-Type: multipart/mixed; boundary="===============0930980801637162743==" MIME-Version: 1.0 From: Florence Blanc-Renaud To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Mon, 07 Aug 2017 09:22:43 +0200 Message-ID: <331efb67-dd3b-2350-3470-5d1a9b9252c3@redhat.com> In-Reply-To: 0d346ba2-7727-f18c-1bda-9cb9b72b1140@brownpapertickets.com --===============0930980801637162743== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: > On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: > = >> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>> Ian Harding wrote: >>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>>>>> apparently had >>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>>> would >>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run = >>>>>>>>>>>>>> without >>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>> running. >>>>>>>>>>>>>> >>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what is = >>>>>>>>>>>>>> going on. >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>> >>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>> handshake happened >>>>>>>>>>>>> Could not connect to LDAP server host seattlenfs.bpt.rocks = >>>>>>>>>>>>> port 636 >>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed (49) >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> dogtag stores its internal data in the LDAP server and needs to >>>>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, = >>>>>>>>>>>> look for >>>>>>>>>>>> the lines: >>>>>>>>>>>> >>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>> >>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>>>>>> password stored in /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>> >>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>> credentials. For >>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>> >>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>> >>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>>>>>> (provide the password from = >>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> I found this: >>>>>>>>>>> >>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Dip= aca >>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert cert-pki= -ca >>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>> ... >>>>>>>>>>> >>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt to = >>>>>>>>>>> provide >>>>>>>>>>> a pin/password >>>>>>>>>>> >>>>>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>>>>> 'ldap(0)': >>>>>>>>>>> >>>>>>>>>>> but there is no password file... >>>>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>> password can be >>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with the tag >>>>>>>>>> internal=3D...) >>>>>>>>>> >>>>>>>>>> Can you check if the password with the tag internal=3D... allows = >>>>>>>>>> to read >>>>>>>>>> the keys from the NSS db? >>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>> (provide password) >>>>>>>>> >>>>>>>>> That works... >>>>>>>>> >>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>>>>> Private >>>>>>>>> Key and Certificate Services" >>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>> Certificate >>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>>>>>>> cert-pki-ca >>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>> Certificate >>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>>>> cert-pki-ca >>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>> Certificate >>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>> >>>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>>> >>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>>> 'ldap(0)': >>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>> >>>>>>>>> That password is getting me somewhere though, since if I put in a >>>>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>>>> >>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>> >>>>>>> There wasn't much of a change... I just assumed someone ran yum = >>>>>>> upgrade and didn't restart, then the power outage... it looks = >>>>>>> like not much of a version change though. >>>>>>> >>>>>>> # grep ipa /var/log/yum.log >>>>>>> Jan 08 04:45:32 Installed: ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:45:32 Installed: = >>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>> Jan 08 04:46:07 Updated: python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>>>> Jan 08 04:47:04 Installed: = >>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:47:05 Installed: = >>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:47:05 Updated: = >>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:47:05 Installed: = >>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:47:06 Installed: = >>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>> Jan 08 04:47:27 Updated: = >>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:47:36 Installed: = >>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>> Jan 08 04:50:07 Erased: ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:42 Updated: = >>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:43 Updated: = >>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:43 Updated: python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:44 Updated: = >>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:45 Updated: = >>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:45 Updated: ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>> Jul 28 09:55:48 Updated: ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>> Jul 28 09:55:48 Updated: = >>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>> >>>>>>> # grep pki /var/log/yum.log >>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>> >>>>>>> >>>>>>>> >>>>>>>> Are you running in SELinux enforcing mode? >>>>>>> >>>>>>> # getenforce >>>>>>> Enforcing >>>>>>> >>>>>>>> >>>>>>>> If so can you run: >>>>>>>> >>>>>>>> # ausearch -m AVC >>>>>>>> >>>>>>> >>>>>>> # ausearch -m AVC >>>>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>>>> write_logs option. >>>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>>> ---- >>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e = >>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2= =3D1 = >>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D42949672= 95 uid=3D0 = >>>>>>> gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D58140000= 1 sgid=3D0 = >>>>>>> fsgid=3D581400001 tty=3D(none) ses=3D4294967295 comm=3D"sshd" = >>>>>>> exe=3D"/usr/sbin/sshd" subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c10= 23 = >>>>>>> key=3D(null) >>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } = >>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2" = >>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>> >>>>>>> >>>>>>>> I suspect that the subsystem cert was renewed and everything wasn't >>>>>>>> updated properly. If I'm right this is unrelated to the upgrade = >>>>>>>> it just >>>>>>>> shone a spotlight on it. >>>>>>>> >>>>>>>> Can you run these commands: >>>>>>>> >>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>> >>>>>>> >>>>>>> This returns >>>>>>> >>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>> Enter LDAP Password: >>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>> userCertificate:: = >>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>> ... stuff ... >>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>> >>>>>>>> and >>>>>>>> >>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>> cert-pki-ca' | grep Serial >>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>> cert-pki-ca' -a >>>>>>>> >>>>>>> >>>>>>> These both return >>>>>>> >>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>> cert-pki-ca' | grep Serial >>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>> Unrecognized Object Identifier. >>>>>>> >>>>>>> >>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>> cert-pki-ca' -a >>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>>> Private Key and Certificate Services" >>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>> Unrecognized Object Identifier. >>>>>>> >>>>>> Hi, >>>>>> >>>>>> you made a typo and requested the keys (-K) instead of the certs = >>>>>> (-L). Please retry with -L and you should be able to see the = >>>>>> certificate serial. >>>>>> >>>>> >>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti= on >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>> ... >>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>> Subsystem,O=3DBPT.ROCKS >>>>> >>>>> So the serial is 4? >>>>> >>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>> 'subsystemCert cert-pki-ca' | grep Serial >>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>> >>>>> Which is NOT 4... >>>>> >>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>> 'subsystemCert cert-pki-ca' -a >>>>> -----BEGIN CERTIFICATE----- >>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>> ... >>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>> -----END CERTIFICATE----- >>>>> >>>>> And this cert is NOT the same. >>>>> >>>> Hi, >>>> >>>> when certmonger renews a certificate, it runs pre-save and post-save = >>>> commands (which you can see in the output of getcert list). In your = >>>> case, the post-save command for subsystemCert cert-pki-ca probably = >>>> failed. >>>> >>>> This command (on the renewal master) is responsible for copying the = >>>> new cert from the NSS db to the LDAP server. You need first to check = >>>> which IPA server is the renewal master (as the serial numbers are in = >>>> a completely different range, I assume that you have multiple IPA = >>>> servers configured with a CA instance): >>>> >>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-` >>>> $ kinit admin >>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>> dn: = >>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Detc= ,dc=3Dipadomain,dc=3Dcom = >>>> >>>> >>>> In this example the renewal master is vm-ipaserver. >>>> >>> >>> I get this >>> >>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>> dn: = >>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc=3D= bpt,dc=3Drocks >>> >>> Which is the other FreeIPA server. >>> >> Hi Ian, >> >> it's getting difficult to follow this thread, so could we step back = >> and summarize? > Yes, it is. Sorry. >> >> - On server freeipa-sea (=3Drenewal master), the CA component is = >> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in the = >> NSSDB /etc/pki/pki-tomcat/alias > No? > = > [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = > 'subsystemCert cert-pki-ca' | grep Serial > Serial Number: 1341718541 (0x4ff9000d) >> - On server seattlenfs (where PKI fails to restart), the CA component = >> is installed and 'subsystemCert cert-pki-ca' has Serial number = >> 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. > Yes > = > [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = > 'subsystemCert cert-pki-ca' | grep Serial > Serial Number: 1341718541 (0x4ff9000d) > = >> >> - In the LDAP servers, the cert is stored in the entry = >> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is t= he = >> cert from freeipa-sea). > This is where the difference is. There are two certificates on the = > master and only one on the other. I wonder if this is a result of the = > slow motion replication trainwreck I have going on due to a zombie = > replica in the ldap database that no longer exists in the real world and = > I can't seem to get rid of. > = Hi, the remaining issue is a replication problem. There is a = "Troubleshooting replication" section [1] in IdM Admin guide that may = help you. Regarding your zombie replica, which commands did you use to try to = remove it, and what was the output? Flo [1] = https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht= ml/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-replic= ation.html > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W= -b = > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC > > ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > userCertificate:: = > MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK > fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR > description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC= A = > Subsystem > ,O=3DBPT.ROCKS > = > = > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = -b = > uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC > > ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = > Subsystem,O=3DBPT.RO > CKS > = >> If you check the certificates dates, I guess that the most recent one = >> is on server seattlenfs (because of serial numbers). Can you confirm = >> this (because our goal is to have the most recent cert stored in all = >> the NSSDBs and in LDAP)? >> >> Thanks, >> Flo >> >> >>>> If your renewal master is the machine on which the NSS DB = >>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >>>> manually run the scripts: >>> >>> If I'm interpreting this correctly, then it is... so I ran this on = >>> the broken machine (seattlenfs) >>> >>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >>>> cert-pki-ca" >>>> >>> >>> I ran this, it took a while, then I re-checked and the serial still = >>> seems to be 4 >>> >>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>> ... >>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>> Subsystem,O=3DBPT.ROCKS >>> >>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>> >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG S= UBSYSTEM = >>> INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = >>> autoShutdown? false >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >>> id=3Ddebug >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized = >>> debug >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>> initSubsystem id=3Dlog >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>> init id=3Dlog >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = >>> autoShutdown? false >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >>> id=3Dlog >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized = >>> log >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>> initSubsystem id=3Djss >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>> init id=3Djss >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart at = >>> autoShutdown? false >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>> autoShutdown crumb file path? = >>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>> cert:auditSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >>> id=3Djss >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: initialized = >>> jss >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>> initSubsystem id=3Ddbs >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>> init id=3Ddbs >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() = >>> mEnableSerialMgmt=3Dtrue >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>> LdapBoundConnFactor(DBSubsystem) >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapBoundConnFactory: = >>> init >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> LdapBoundConnFactory:doCloning true >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init begins >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>> makeConnection errorIfDown is true >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>> errorIfDown true >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>> subsystemCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: set = >>> client auth cert nickname subsystemCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> SSLClientCertificatSelectionCB: Entering! >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>> ocspSigningCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>> subsystemCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> SSLClientCertificateSelectionCB: desired cert found in list: = >>> subsystemCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened >>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() >>> >>> >>> I really appreciate you sticking with me through this. I owe you. >>> >>> - Ian >>> >>>> After that, check that the LDAP entry has been updated. If it is the = >>>> case, you should be able to restart pki. >>>> >>>> Flo >>>> >>>>> Thank you again for your time! >>>>> >>>>> Ian >>>>> >>>>>> Flo. >>>>>>> >>>>>>> which seems weird. >>>>>>> >>>>>>>> The description attribute in the ldapsearch output is of the = >>>>>>>> form 2;#;DN;DN >>>>>>>> >>>>>>>> The # should match the serial number in the first certutil output >>>>>>>> >>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one of = >>>>>>>> the >>>>>>>> userCertificate attributes. >>>>>>>> >>>>>>>> rob >>>>>>>> >>>>>>> >>>>>> >>>>> >>>> >>> >> > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org --===============0930980801637162743==-- From tbordaz at redhat.com Tue Aug 8 14:53:03 2017 Content-Type: multipart/mixed; boundary="===============5361506650663838278==" MIME-Version: 1.0 From: thierry bordaz To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Mon, 07 Aug 2017 08:44:58 +0000 Message-ID: <59882871.1000106@redhat.com> In-Reply-To: 331efb67-dd3b-2350-3470-5d1a9b9252c3@redhat.com --===============5361506650663838278== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote: > On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >> >>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>> Ian Harding wrote: >>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>>>>>> apparently had >>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can run = >>>>>>>>>>>>>>> without >>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what = >>>>>>>>>>>>>>> is going on. >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>> >>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed = >>>>>>>>>>>>>> (49) >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Hi, >>>>>>>>>>>>> >>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and = >>>>>>>>>>>>> needs to >>>>>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>>>>> connection is configured in /etc/pki/pki-tomcat/ca/CS.cfg, = >>>>>>>>>>>>> look for >>>>>>>>>>>>> the lines: >>>>>>>>>>>>> >>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>> >>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>>>>>>> password stored in = >>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>> >>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>> credentials. For >>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>> >>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>> >>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> I found this: >>>>>>>>>>>> >>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3Di= paca >>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>> ... >>>>>>>>>>>> >>>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt = >>>>>>>>>>>> to provide >>>>>>>>>>>> a pin/password >>>>>>>>>>>> >>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>> >>>>>>>>>>>> but there is no password file... >>>>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>> password can be >>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with = >>>>>>>>>>> the tag >>>>>>>>>>> internal=3D...) >>>>>>>>>>> >>>>>>>>>>> Can you check if the password with the tag internal=3D... = >>>>>>>>>>> allows to read >>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>> (provide password) >>>>>>>>>> >>>>>>>>>> That works... >>>>>>>>>> >>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>> User Private >>>>>>>>>> Key and Certificate Services" >>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>> Certificate >>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>>>>>>>> cert-pki-ca >>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>> Certificate >>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>>>>> cert-pki-ca >>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>> Certificate >>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>> >>>>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>>>> >>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL >>>>>>>>>> Please enter pin, password, or pass phrase for security token = >>>>>>>>>> 'ldap(0)': >>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>> >>>>>>>>>> That password is getting me somewhere though, since if I put = >>>>>>>>>> in a >>>>>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>>>>> >>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>> >>>>>>>> There wasn't much of a change... I just assumed someone ran yum = >>>>>>>> upgrade and didn't restart, then the power outage... it looks = >>>>>>>> like not much of a version change though. >>>>>>>> >>>>>>>> # grep ipa /var/log/yum.log >>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>> Jan 08 04:47:17 Updated: ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>> Jan 08 04:47:23 Updated: ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>> >>>>>>>> # grep pki /var/log/yum.log >>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>> >>>>>>>> >>>>>>>>> >>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>> >>>>>>>> # getenforce >>>>>>>> Enforcing >>>>>>>> >>>>>>>>> >>>>>>>>> If so can you run: >>>>>>>>> >>>>>>>>> # ausearch -m AVC >>>>>>>>> >>>>>>>> >>>>>>>> # ausearch -m AVC >>>>>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>>>>> write_logs option. >>>>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>>>> ---- >>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e = >>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2= =3D1 = >>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294967= 295 = >>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 = >>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D429= 4967295 = >>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read } = >>>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-2= " = >>>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>> >>>>>>>> >>>>>>>>> I suspect that the subsystem cert was renewed and everything = >>>>>>>>> wasn't >>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>> upgrade it just >>>>>>>>> shone a spotlight on it. >>>>>>>>> >>>>>>>>> Can you run these commands: >>>>>>>>> >>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>>> >>>>>>>> >>>>>>>> This returns >>>>>>>> >>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>> Enter LDAP Password: >>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>> userCertificate:: = >>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>> ... stuff ... >>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>> >>>>>>>>> and >>>>>>>>> >>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>> cert-pki-ca' -a >>>>>>>>> >>>>>>>> >>>>>>>> These both return >>>>>>>> >>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>> cert-pki-ca' | grep Serial >>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>> Unrecognized Object Identifier. >>>>>>>> >>>>>>>> >>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>> cert-pki-ca' -a >>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS User = >>>>>>>> Private Key and Certificate Services" >>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>> Unrecognized Object Identifier. >>>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> you made a typo and requested the keys (-K) instead of the certs = >>>>>>> (-L). Please retry with -L and you should be able to see the = >>>>>>> certificate serial. >>>>>>> >>>>>> >>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript= ion >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>> ... >>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>> Subsystem,O=3DBPT.ROCKS >>>>>> >>>>>> So the serial is 4? >>>>>> >>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>> >>>>>> Which is NOT 4... >>>>>> >>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>> -n 'subsystemCert cert-pki-ca' -a >>>>>> -----BEGIN CERTIFICATE----- >>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>> ... >>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>> -----END CERTIFICATE----- >>>>>> >>>>>> And this cert is NOT the same. >>>>>> >>>>> Hi, >>>>> >>>>> when certmonger renews a certificate, it runs pre-save and = >>>>> post-save commands (which you can see in the output of getcert = >>>>> list). In your case, the post-save command for subsystemCert = >>>>> cert-pki-ca probably failed. >>>>> >>>>> This command (on the renewal master) is responsible for copying = >>>>> the new cert from the NSS db to the LDAP server. You need first to = >>>>> check which IPA server is the renewal master (as the serial = >>>>> numbers are in a completely different range, I assume that you = >>>>> have multiple IPA servers configured with a CA instance): >>>>> >>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2-` >>>>> $ kinit admin >>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>> dn: = >>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3Det= c,dc=3Dipadomain,dc=3Dcom = >>>>> >>>>> >>>>> In this example the renewal master is vm-ipaserver. >>>>> >>>> >>>> I get this >>>> >>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>> dn: = >>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc= =3Dbpt,dc=3Drocks = >>>> >>>> >>>> Which is the other FreeIPA server. >>>> >>> Hi Ian, >>> >>> it's getting difficult to follow this thread, so could we step back = >>> and summarize? >> Yes, it is. Sorry. >>> >>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in the = >>> NSSDB /etc/pki/pki-tomcat/alias >> No? >> >> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >> 'subsystemCert cert-pki-ca' | grep Serial >> Serial Number: 1341718541 (0x4ff9000d) >>> - On server seattlenfs (where PKI fails to restart), the CA = >>> component is installed and 'subsystemCert cert-pki-ca' has Serial = >>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >> Yes >> >> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >> 'subsystemCert cert-pki-ca' | grep Serial >> Serial Number: 1341718541 (0x4ff9000d) >> >>> >>> - In the LDAP servers, the cert is stored in the entry = >>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is = the = >>> cert from freeipa-sea). >> This is where the difference is. There are two certificates on the = >> master and only one on the other. I wonder if this is a result of = >> the slow motion replication trainwreck I have going on due to a = >> zombie replica in the ldap database that no longer exists in the real = >> world and I can't seem to get rid of. >> > Hi, > > the remaining issue is a replication problem. There is a = > "Troubleshooting replication" section [1] in IdM Admin guide that may = > help you. > > Regarding your zombie replica, which commands did you use to try to = > remove it, and what was the output? > > Flo > > [1] = > https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/= html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-repl= ication.html > Hi, To debug replication latency or problem we would need several info but = starting with the results of the following commands [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi and [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi From the output you may only copy/past the ones related to userCertificate Also to dump the current replication status, send the result of [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-= ffffffff-ffffffff))" and [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-= ffffffff-ffffffff))" Regards thierry >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >> >> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> userCertificate:: = >> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >> description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D= CA = >> Subsystem >> ,O=3DBPT.ROCKS >> >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >> >> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >> Subsystem,O=3DBPT.RO >> CKS >> >>> If you check the certificates dates, I guess that the most recent = >>> one is on server seattlenfs (because of serial numbers). Can you = >>> confirm this (because our goal is to have the most recent cert = >>> stored in all the NSSDBs and in LDAP)? >>> >>> Thanks, >>> Flo >>> >>> >>>>> If your renewal master is the machine on which the NSS DB = >>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >>>>> manually run the scripts: >>>> >>>> If I'm interpreting this correctly, then it is... so I ran this on = >>>> the broken machine (seattlenfs) >>>> >>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >>>>> cert-pki-ca" >>>>> >>>> >>>> I ran this, it took a while, then I re-checked and the serial still = >>>> seems to be 4 >>>> >>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>> ... >>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>> Subsystem,O=3DBPT.ROCKS >>>> >>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>> >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG = >>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>> at autoShutdown? false >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >>>> id=3Ddebug >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> initialized debug >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> initSubsystem id=3Dlog >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>>> init id=3Dlog >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>> at autoShutdown? false >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >>>> id=3Dlog >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> initialized log >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> initSubsystem id=3Djss >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>>> init id=3Djss >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>> at autoShutdown? false >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> autoShutdown crumb file path? = >>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>> cert:auditSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done init = >>>> id=3Djss >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> initialized jss >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>> initSubsystem id=3Ddbs >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>>> init id=3Ddbs >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() = >>>> mEnableSerialMgmt=3Dtrue >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>> LdapBoundConnFactor(DBSubsystem) >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> LdapBoundConnFactory: init >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> LdapBoundConnFactory:doCloning true >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init = >>>> begins >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init ends >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>> makeConnection errorIfDown is true >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>>> errorIfDown true >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>>> subsystemCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: = >>>> set client auth cert nickname subsystemCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> SSLClientCertificatSelectionCB: Entering! >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>> ocspSigningCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>> subsystemCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>> subsystemCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened >>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() >>>> >>>> >>>> I really appreciate you sticking with me through this. I owe you. >>>> >>>> - Ian >>>> >>>>> After that, check that the LDAP entry has been updated. If it is = >>>>> the case, you should be able to restart pki. >>>>> >>>>> Flo >>>>> >>>>>> Thank you again for your time! >>>>>> >>>>>> Ian >>>>>> >>>>>>> Flo. >>>>>>>> >>>>>>>> which seems weird. >>>>>>>> >>>>>>>>> The description attribute in the ldapsearch output is of the = >>>>>>>>> form 2;#;DN;DN >>>>>>>>> >>>>>>>>> The # should match the serial number in the first certutil output >>>>>>>>> >>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one = >>>>>>>>> of the >>>>>>>>> userCertificate attributes. >>>>>>>>> >>>>>>>>> rob >>>>>>>>> >>>>>>>> >>>>>>> >>>>>> >>>>> >>>> >>> >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to = >> freeipa-users-leave(a)lists.fedorahosted.org > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to = > freeipa-users-leave(a)lists.fedorahosted.org --===============5361506650663838278== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPGJyPgogICAgPGJyPgogICAgPGRpdiBjbGFz cz0ibW96LWNpdGUtcHJlZml4Ij5PbiAwOC8wNy8yMDE3IDA5OjIyIEFNLCBGbG9yZW5jZQogICAg ICBCbGFuYy1SZW5hdWQgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6PGJyPgogICAgPC9kaXY+CiAg ICA8YmxvY2txdW90ZQogICAgICBjaXRlPSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQx YTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0LzIwMTcgMTE6 MDIgUE0sIElhbiBIYXJkaW5nIHZpYSBGcmVlSVBBLXVzZXJzCiAgICAgIHdyb3RlOgogICAgICA8 YnI+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDgvNC8xNyAyOjE2IEFNLCBGbG9y ZW5jZSBCbGFuYy1SZW5hdWQKICAgICAgICB3cm90ZToKICAgICAgICA8YnI+CiAgICAgICAgPGJy PgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6MTMgUE0s IElhbiBIYXJkaW5nIHZpYQogICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZToKICAgICAgICAg IDxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTI6 MjggQU0sIEZsb3JlbmNlCiAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZToKICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3 IDExOjUxIFBNLCBJYW4gSGFyZGluZwogICAgICAgICAgICAgIHZpYSBGcmVlSVBBLXVzZXJzIHdy b3RlOgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj aXRlIj5PbiAwOC8wMi8yMDE3IDEyOjExIEFNLCBGbG9yZW5jZQogICAgICAgICAgICAgICAgQmxh bmMtUmVuYXVkIHdyb3RlOgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAwMTo0MyBBTSwgSWFuCiAgICAgICAg ICAgICAgICAgIEhhcmRpbmcgd3JvdGU6CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAxMjowMyBQTSwg Um9iCiAgICAgICAgICAgICAgICAgICAgQ3JpdHRlbmRlbiB3cm90ZToKICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFu IEhhcmRpbmcgd3JvdGU6CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDA3OjM5IEFNLAog ICAgICAgICAgICAgICAgICAgICAgICBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6CiAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv dGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAwMzoxMSBQTSwKICAgICAgICAgICAgICAgICAg ICAgICAgICBJYW4gSGFyZGluZyB3cm90ZToKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgv MDEvMjAxNyAwMTo0OAogICAgICAgICAgICAgICAgICAgICAgICAgICAgQU0sIEZsb3JlbmNlIEJs YW5jLVJlbmF1ZCB3cm90ZToKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIw MTcgMDE6MzIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQU0sIElhbiBIYXJkaW5nIHZp YSBGcmVlSVBBLXVzZXJzIHdyb3RlOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT24gMDcvMzEv MjAxNyAxMTozNCBBTSwgUm9iIENyaXR0ZW5kZW4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB3cm90ZToKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFuIEhhcmRp bmcgdmlhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIHdy b3RlOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBoYWQgYW4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdW5leHBlY3RlZCByZXN0YXJ0IG9mIGFu IElQQSBzZXJ2ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhhdCBoYWQg YXBwYXJlbnRseSBoYWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1cGRhdGVzIHJ1biBidXQgaGFkIG5v dCBiZWVuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJlc3RhcnRlZC4gaXBh Y3RsIHNheXMgcGtpLXRvbWNhdGQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3b3VsZAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIG5vdCBzdGFydC4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFN0cmFuZ2VseSwgdGhlIGFjdHVhbCBzZXJ2aWNlCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFwcGVhcnMgdG8gYmUgcnVubmluZzoK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgaXMgYW4gYXBwbGljYXRpb24g d2l0aGluIHRvbWNhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc28gdG9tY2F0 IGNhbiBydW4gd2l0aG91dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBy dW5uaW5nLgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgV2UgbmVlZCB0byBzZWUgbW9yZSBvZiB0aGUgZG9ndGFnCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBkZWJ1ZyBsb2cgdG8gc2VlIHdoYXQgaXMgZ29pbmcgb24uCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBJdCBsb29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0aW9uCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgcHJvYmxlbS4uLgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNTTCBoYW5k c2hha2UgaGFwcGVuZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgQ291bGQgbm90IGNvbm5lY3QgdG8gTERBUCBzZXJ2 ZXIgaG9zdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlYXR0bGVuZnMuYnB0LnJv Y2tzIHBvcnQgNjM2CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yIG5ldHNjYXBlLmxkYXAuTERBUEV4Y2VwdGlv bjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRoZW50aWNhdGlvbiBmYWlsZWQg KDQ5KQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxv Y2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBIaSwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGRvZ3RhZyBzdG9yZXMgaXRzIGludGVybmFsIGRhdGEgaW4gdGhlCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIExEQVAgc2VydmVyIGFuZCBuZWVkcyB0bwogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVzdGFi bGlzaCBhIHNlY3VyZSBMREFQIGNvbm5lY3Rpb24uIFlvdQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBjYW4gY2hlY2sgaG93IHRoaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25uZWN0aW9uIGlzIGNvbmZpZ3Vy ZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9j YS9DUy5jZmcsIGxvb2sgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xD bGllbnRBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49Y249RGlyZWN0b3J5 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1hbmFnZXIKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5h bGRiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lz dGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGludGVybmFsZGIubGRhcGNvbm4uaG9zdD12bS0uLi4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBj b25uLnBvcnQ9NjM2CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5zZWN1cmVDb25uCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRodHlwZSBjYW4gYmUgU3Ns Q2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0aGVudGljYXRpb24g d2l0aCBhIHNzbAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGNlcnRpZmljYXRlKSBvciBCYXNpY0F1dGggKGF1dGhlbnRpY2F0 aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGggYSBiaW5kIEROIGFuZAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHBhc3N3b3JkIHN0b3JlZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFy L2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYpLgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgWW91IGNhbiB1c2UgdGhpcyBpbmZvcm1hdGlvbiB0 byBtYW51YWxseQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjaGVjayB0aGUgY3JlZGVu dGlhbHMuIEZvcgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGluc3RhbmNlIHdpdGggc3NsY2xpZW50YXV0aDoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBMREFQVExTX0NBQ0VSVERJUj0vZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgZXhwb3J0IExEQVBUTFNfQ0VSVD0nc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGxkYXBzZWFyY2ggLUggPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVl dGV4dCIgaHJlZj0ibGRhcHM6Ly8iPmxkYXBzOi8vPC9hPmBob3N0bmFtZWA6NjM2IC1iICIiCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1zIGJhc2UgLVkgRVhURVJOQUwKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAo cHJvdmlkZSB0aGUgcGFzc3dvcmQgZnJvbQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAv ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzL3B3ZGZpbGUudHh0KQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczoKICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGF1dGguYXV0 aHR5cGU9U3NsQ2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgppbnRl cm5hbGRiLmxkYXBhdXRoLmJpbmRETj11aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5hbGRiCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5h bGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYQogICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5jbG9u ZVJlcGxpY2F0aW9uUG9ydD0zODkKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC4uLgogICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgYW5kIHdoZW4gSSB0cnkgdGhlIGxkYXBzZWFyY2ggSSBhbSBwcmVzZW50ZWQKICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGggYSBwcm9tcHQgdG8gcHJvdmlkZQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBw aW4vcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSBl bnRlciBwaW4sIHBhc3N3b3JkLCBvciBwYXNzIHBocmFzZQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgZm9yIHNlY3VyaXR5IHRva2VuICdsZGFwKDApJzoKICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZCBmaWxlLi4uCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg ICAgICAgICAgIEhpLAogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgeW91IGFyZSByaWdo dCwgaW4gNC40LiB0aGVyZSBpcyBubyBwd2RmaWxlLnR4dAogICAgICAgICAgICAgICAgICAgICAg ICAgIGFuZCB0aGUgcGFzc3dvcmQgY2FuIGJlCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgIGZvdW5kIGluCiAgICAgICAgICAgICAgICAgICAg ICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29yZC5jb25mCiAgICAgICAg ICAgICAgICAgICAgICAgICAgKHdpdGggdGhlIHRhZwogICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4pCiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRoIHRo ZSB0YWcKICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4gYWxsb3dzIHRvIHJl YWQKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPwogICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2kt dG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIChwcm92aWRlIHBhc3N3b3JkKQogICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQgd29ya3MuLi4KICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcwogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTIENlcnRpZmljYXRlIERCIiBpbgogICAg ICAgICAgICAgICAgICAgICAgICBzbG90ICJOU1MgVXNlciBQcml2YXRlCiAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgS2V5IGFuZCBDZXJ0aWZpY2F0 ZSBTZXJ2aWNlcyIKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9yICJOU1MgQ2VydGlmaWNhdGUgREIiOgog ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICZsdDsg MCZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgIDBmMzI3ZTc2MGE3ZWVjZGNmNjk3M2Y1 ZGM1N2NhNTM2N2M1OTJkNjTCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgIChvcnBoYW4pCiAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAx Jmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgYjEyNTgwYzdjNjk2Y2ZjZDhhZWZjOTQw NWE3YTg3MGIyNGI3Yjk2YcKgwqAgTlNTCiAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmlj YXRlCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg REI6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgMiZndDsgcnNhCiAgICAgICAgICAgICAg ICAgICAgICAgIDg4MWI3MjU0YzQwZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAg ICAgICAgICAgICAgICAgICAgY2FTaWduaW5nQ2VydAogICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0OyByc2EKICAgICAg ICAgICAgICAgICAgICAgICAgZmE5YTI1NWExZDE1NTg1YWMyODA2NGMwZjQ5ODZlNDE2YmM0ODQw M8KgwqAgTlNTCiAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlCiAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdD ZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgJmx0OyA0Jmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgM2ZiNjA5 ZDBmN2Q3MmMyZDMyNWQ2YTJkYzE2NTc3YTdmN2U1YTAxZgogICAgICAgICAgICAgICAgICAgICAg ICBTZXJ2ZXItQ2VydAogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgJmx0OyA1Jmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAg MWU5NDc5YTk1NTZhZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAgTlNTCiAgICAgICAg ICAgICAgICAgICAgICAgIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgREI6c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYQogICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgQnV0IHRoaXMgZG9lc24ndCAod2l0aCB0aGUgc2FtZSBwYXNz d29yZCBmcm9tCiAgICAgICAgICAgICAgICAgICAgICAgIHBhc3N3b3JkLmNvbmYpCiAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAjIGxkYXBzZWFyY2ggLUggPGEgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIgaHJlZj0ibGRhcHM6Ly8iPmxkYXBzOi8vPC9hPmBob3N0bmFtZWA6NjM2IC1iICIi IC1zCiAgICAgICAgICAgICAgICAgICAgICAgIGJhc2UgLVkgRVhURVJOQUwKICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgZW50ZXIgcGlu LCBwYXNzd29yZCwgb3IgcGFzcyBwaHJhc2UgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgIHNl Y3VyaXR5IHRva2VuICdsZGFwKDApJzoKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICBTQVNML0VYVEVSTkFMIGF1dGhlbnRpY2F0aW9uIHN0YXJ0ZWQK ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBsZGFw X3Nhc2xfaW50ZXJhY3RpdmVfYmluZF9zOiBJbnZhbGlkCiAgICAgICAgICAgICAgICAgICAgICAg IGNyZWRlbnRpYWxzICg0OSkKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQgcGFzc3dvcmQg aXMgZ2V0dGluZyBtZSBzb21ld2hlcmUgdGhvdWdoLAogICAgICAgICAgICAgICAgICAgICAgICBz aW5jZSBpZiBJIHB1dCBpbiBhCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgbm9uc2Vuc2Ugb3IgaW5jb3JyZWN0IHBhc3N3b3JkIGl0IGp1c3QgcHJv bXB0cwogICAgICAgICAgICAgICAgICAgICAgICBvdmVyIGFuZCBvdmVyLgogICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBMZXQncyBzdGVwIGJh Y2sgYSBzZWNvbmQuIFlvdSB1cGdyYWRlZCBmcm9tIHdoYXQKICAgICAgICAgICAgICAgICAgICAg IHRvIHdoYXQ/CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICBUaGVyZSB3YXNuJ3QgbXVjaCBvZiBhIGNoYW5nZS4uLiBJIGp1c3QgYXNzdW1lZAogICAgICAg ICAgICAgICAgICAgIHNvbWVvbmUgcmFuIHl1bSB1cGdyYWRlIGFuZCBkaWRuJ3QgcmVzdGFydCwg dGhlbiB0aGUKICAgICAgICAgICAgICAgICAgICBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MgbGlr ZSBub3QgbXVjaCBvZiBhIHZlcnNpb24KICAgICAgICAgICAgICAgICAgICBjaGFuZ2UgdGhvdWdo LgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgIyBncmVwIGlwYSAvdmFyL2xvZy95dW0ubG9nCiAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6 CiAgICAgICAgICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5u b2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4 IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1v bi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAgICAgICAgICAg ICAgICAgICAgbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0CiAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNyBVcGRhdGVk OgogICAgICAgICAgICAgICAgICAgIHB5dGhvbi1saWJpcGFfaGJhYy0xLjE0LjAtNDMuZWw3XzMu NC54ODZfNjQKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFu IDA4IDA0OjQ2OjA4IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICBweXRob24taXBhZGRy ZXNzLTEuMC4xNi0yLmVsNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg ICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3Rh bGxlZDoKICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcu Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgaXBhLWFk bWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAg ICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4x LjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEph biAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFz ZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAg ICAgICAgICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NAogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTcgVXBkYXRl ZDoKICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4x Lng4Nl82NAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKYW4g MDggMDQ6NDc6MjMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLTQuNC4w LTE0LmVsNy5jZW50b3MuMS4xLng4Nl82NAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjM2IEluc3Rh bGxlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcu Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICBpcGEtcHl0 aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NAogICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAg ICAgICAgICAgICAgICBpcGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQy IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC1jb21tb24tNC40LjAtMTQu ZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBpcGEt c2VydmVyLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgog ICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhbGliLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5u b2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSnVsIDI4 IDA5OjU1OjQ0IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFjbGllbnQt NC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAg ICAgICBweXRob24yLWlwYXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NSBV cGRhdGVkOgogICAgICAgICAgICAgICAgICAgIGlwYS1hZG1pbnRvb2xzLTQuNC4wLTE0LmVsNy5j ZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgSnVsIDI4IDA5OjU1OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVu dC00LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAg ICAgICAgIGlwYS1zZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NAogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRl ZDoKICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2VudG9z Ljcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIEp1 bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgIGlwYS1weXRob24tY29t cGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICMgZ3JlcCBwa2kg L3Zhci9sb2cveXVtLmxvZwogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDY6MDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBwa2ktYmFz ZS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowOSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAg IGtyYjUtcGtpbml0LTEuMTQuMS0yNy5lbDdfMy54ODZfNjQKICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IEluc3RhbGxlZDoKICAgICAg ICAgICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2gKICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVw ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcGtpLXRvb2xzLTEwLjMuMy0xNC5lbDdfMy54ODZf NjQKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0 OjQ3OjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQu ZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg IEphbiAwOCAwNDo0NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgIHBraS1rcmEtMTAu My4zLTE0LmVsN18zLm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBwa2kt Y2EtMTAuMy4zLTE0LmVsN18zLm5vYXJjaAogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRhdGVkOgogICAgICAgICAg ICAgICAgICAgIHBraS1iYXNlLWphdmEtMTAuMy4zLTE5LmVsN18zLm5vYXJjaAogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRl ZDoKICAgICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE5LmVsN18zLng4Nl82NAog ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6 MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMuMy0xOS5lbDdf My5ub2FyY2gKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSnVs IDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4zLjMt MTkuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgIHBraS1jYS0x MC4zLjMtMTkuZWw3XzMubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICBBcmUgeW91IHJ1bm5pbmcgaW4gU0VMaW51eCBlbmZvcmNpbmcg bW9kZT8KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICMg Z2V0ZW5mb3JjZQogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBF bmZvcmNpbmcKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgSWYgc28gY2FuIHlvdSBydW46 CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQwogICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwv YmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg IyBhdXNlYXJjaCAtbSBBVkMKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgVGhlIE5PTE9HIG9wdGlvbiB0byBsb2dfZm9ybWF0IGlzIGRlcHJlY2F0ZWQuIFBsZWFz ZQogICAgICAgICAgICAgICAgICAgIHVzZSB0aGUgd3JpdGVfbG9ncyBvcHRpb24uCiAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gaXMg b3ZlcnJpZGluZyB0aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgIGN1cnJlbnQgc2V0 dGluZy4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgLS0tLQog ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICB0aW1lLSZndDtNb24g TWFyIDE0IDEwOjM5OjAxIDIwMTYKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgdHlwZT1TWVNDQUxMIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6CiAg ICAgICAgICAgICAgICAgICAgYXJjaD1jMDAwMDAzZSBzeXNjYWxsPTIgc3VjY2Vzcz1ubyBleGl0 PS0xMwogICAgICAgICAgICAgICAgICAgIGEwPTdmYmNhYjAzOGQxMCBhMT04MDAgYTI9MSBhMz03 ZmJjYTYwZjQyZTAgaXRlbXM9MAogICAgICAgICAgICAgICAgICAgIHBwaWQ9MTQwNiBwaWQ9MTI5 NjUgYXVpZD00Mjk0OTY3Mjk1IHVpZD0wIGdpZD0wCiAgICAgICAgICAgICAgICAgICAgZXVpZD01 ODE0MDAwMDEgc3VpZD0wIGZzdWlkPTU4MTQwMDAwMSBlZ2lkPTU4MTQwMDAwMQogICAgICAgICAg ICAgICAgICAgIHNnaWQ9MCBmc2dpZD01ODE0MDAwMDEgdHR5PShub25lKSBzZXM9NDI5NDk2NzI5 NQogICAgICAgICAgICAgICAgICAgIGNvbW09InNzaGQiIGV4ZT0iL3Vzci9zYmluL3NzaGQiCiAg ICAgICAgICAgICAgICAgICAgc3Viaj1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAu YzEwMjMKICAgICAgICAgICAgICAgICAgICBrZXk9KG51bGwpCiAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2 NzoxNzUzNyk6IGF2YzrCoAogICAgICAgICAgICAgICAgICAgIGRlbmllZCB7IHJlYWQgfSBmb3Ig cGlkPTEyOTY1IGNvbW09InNzaGQiCiAgICAgICAgICAgICAgICAgICAgbmFtZT0iYXV0aG9yaXpl ZF9rZXlzIiBkZXY9ImRtLTIiIGlubz0xMTYzOTM1MTcKICAgICAgICAgICAgICAgICAgICBzY29u dGV4dD1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAuYzEwMjMKICAgICAgICAgICAg ICAgICAgICB0Y29udGV4dD1zeXN0ZW1fdTpvYmplY3Rfcjp1bmxhYmVsZWRfdDpzMAogICAgICAg ICAgICAgICAgICAgIHRjbGFzcz1maWxlCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBzdXNwZWN0IHRoYXQgdGhlIHN1YnN5c3Rl bQogICAgICAgICAgICAgICAgICAgICAgY2VydCB3YXMgcmVuZXdlZCBhbmQgZXZlcnl0aGluZyB3 YXNuJ3QKICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHVw ZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0aGlzIGlzIHVucmVsYXRlZAogICAgICAgICAg ICAgICAgICAgICAgdG8gdGhlIHVwZ3JhZGUgaXQganVzdAogICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgc2hvbmUgYSBzcG90bGlnaHQgb24gaXQuCiAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICBDYW4geW91IHJ1biB0aGVzZSBjb21tYW5kczoKICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICQgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVz ZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAg ICBkZXNjcmlwdGlvbgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgVGhpcyByZXR1cm5zCiAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAg ICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlm aWNhdGUKICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbgogICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOgogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1w ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAuLi4gc3R1ZmYgLi4uCiAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxW YTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAg ICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MK ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPmFuZAogICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgIyBjZXJ0dXRpbCAtTCAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAg ICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwKICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwgLWQg L2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5 c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hCiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgog ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBUaGVzZSBib3RoIHJl dHVybgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2Fs aWFzIC1uCiAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIHwg Z3JlcCBTZXJpYWwKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg RW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlIERCIjoKICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlz dGluZyBrZXlzOgogICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lE OiBVbnJlY29nbml6ZWQgT2JqZWN0CiAgICAgICAgICAgICAgICAgICAgSWRlbnRpZmllci4KICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMv cGtpL3BraS10b21jYXQvYWxpYXPCoCAtbgogICAgICAgICAgICAgICAgICAgICdzdWJzeXN0ZW1D ZXJ0IGNlcnQtcGtpLWNhJyAtYQogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIgaW4K ICAgICAgICAgICAgICAgICAgICBzbG90ICJOU1MgVXNlciBQcml2YXRlIEtleSBhbmQgQ2VydGlm aWNhdGUgU2VydmljZXMiCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6CiAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVt IGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVE X09JRDogVW5yZWNvZ25pemVkIE9iamVjdAogICAgICAgICAgICAgICAgICAgIElkZW50aWZpZXIu CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICBIaSwKICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIHlv dSBtYWRlIGEgdHlwbyBhbmQgcmVxdWVzdGVkIHRoZSBrZXlzICgtSykgaW5zdGVhZCBvZgogICAg ICAgICAgICAgICAgICB0aGUgY2VydHMgKC1MKS4gUGxlYXNlIHJldHJ5IHdpdGggLUwgYW5kIHlv dSBzaG91bGQgYmUKICAgICAgICAgICAgICAgICAgYWJsZSB0byBzZWUgdGhlIGNlcnRpZmljYXRl IHNlcmlhbC4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp cmVjdG9yeQogICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1w ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9u CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3Jk OgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIs b3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIHVz ZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5C Z2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgIC4uLgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg Wk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPQogICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0 ZQogICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxP PUJQVC5ST0NLUwogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgU28gdGhlIHNlcmlhbCBpcyA0PwogICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMg Y2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMg LW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnCiAgICAgICAgICAgICAgICB8IGdyZXAgU2Vy aWFsCiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDCoMKg IFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpCiAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBXaGljaCBpcyBOT1QgNC4u LgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAg IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2En CiAgICAgICAgICAgICAgICAtYQogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCiAgICAgICAgICAgICAgICA8YnI+Ck1JSURiakND QWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMK ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIC4uLgogICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgc2plaUZiVUZ0b01uZm1ITElZcGU1UUFSCiAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCiAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBBbmQg dGhpcyBjZXJ0IGlzIE5PVCB0aGUgc2FtZS4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgSGks CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICB3aGVu IGNlcnRtb25nZXIgcmVuZXdzIGEgY2VydGlmaWNhdGUsIGl0IHJ1bnMgcHJlLXNhdmUgYW5kCiAg ICAgICAgICAgICAgcG9zdC1zYXZlIGNvbW1hbmRzICh3aGljaCB5b3UgY2FuIHNlZSBpbiB0aGUg b3V0cHV0IG9mCiAgICAgICAgICAgICAgZ2V0Y2VydCBsaXN0KS4gSW4geW91ciBjYXNlLCB0aGUg cG9zdC1zYXZlIGNvbW1hbmQgZm9yCiAgICAgICAgICAgICAgc3Vic3lzdGVtQ2VydCBjZXJ0LXBr aS1jYSBwcm9iYWJseSBmYWlsZWQuCiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICBUaGlzIGNvbW1hbmQgKG9uIHRoZSByZW5ld2FsIG1hc3RlcikgaXMg cmVzcG9uc2libGUgZm9yCiAgICAgICAgICAgICAgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0 aGUgTlNTIGRiIHRvIHRoZSBMREFQIHNlcnZlci4KICAgICAgICAgICAgICBZb3UgbmVlZCBmaXJz dCB0byBjaGVjayB3aGljaCBJUEEgc2VydmVyIGlzIHRoZSByZW5ld2FsCiAgICAgICAgICAgICAg bWFzdGVyIChhcyB0aGUgc2VyaWFsIG51bWJlcnMgYXJlIGluIGEgY29tcGxldGVseQogICAgICAg ICAgICAgIGRpZmZlcmVudCByYW5nZSwgSSBhc3N1bWUgdGhhdCB5b3UgaGF2ZSBtdWx0aXBsZSBJ UEEKICAgICAgICAgICAgICBzZXJ2ZXJzIGNvbmZpZ3VyZWQgd2l0aCBhIENBIGluc3RhbmNlKToK ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICQgZXhw b3J0IEJBU0VETj1gZ3JlcCBiYXNlZG4gL2V0Yy9pcGEvZGVmYXVsdC5jb25mIHwgY3V0CiAgICAg ICAgICAgICAgLWQ9IC1mMi1gCiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICQga2lu aXQgYWRtaW4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1M TEwgLVEgLWggYGhvc3RuYW1lYCAtcCAzODkgLVkgR1NTQVBJIC1iCiAgICAgICAgICAgICAgImNu PW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICcoJmFtcDsoY249 Q0EpKGlwYUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScgZG4KICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgZG46CiAgICAgICAgICAgICAgY249Q0EsY249dm0taXBhc2VydmVy LmlwYWRvbWFpbi5jb20sY249bWFzdGVycyxjbj1pcGEsY249ZXRjLGRjPWlwYWRvbWFpbixkYz1j b20KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIElu IHRoaXMgZXhhbXBsZSB0aGUgcmVuZXdhbCBtYXN0ZXIgaXMgdm0taXBhc2VydmVyLgogICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBJIGdldCB0aGlzCiAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtUSAtaCBgaG9z dG5hbWVgIC1wIDM4OSAtWSBHU1NBUEkgLWIKICAgICAgICAgICAgImNuPW1hc3RlcnMsY249aXBh LGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJp bmc9Y2FSZW5ld2FsTWFzdGVyKSknIGRuCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgZG46 CiAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2VhLmJwdC5yb2Nrcyxjbj1tYXN0ZXJzLGNu PWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg PGJyPgogICAgICAgICAgICBXaGljaCBpcyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuCiAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgSGkgSWFuLAogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgaXQn cyBnZXR0aW5nIGRpZmZpY3VsdCB0byBmb2xsb3cgdGhpcyB0aHJlYWQsIHNvIGNvdWxkIHdlIHN0 ZXAKICAgICAgICAgIGJhY2sgYW5kIHN1bW1hcml6ZT8KICAgICAgICAgIDxicj4KICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgWWVzLCBpdCBpcy7CoCBTb3JyeS4KICAgICAgICA8YnI+CiAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICAt IE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlIENBIGNvbXBvbmVu dCBpcwogICAgICAgICAgaW5zdGFsbGVkIGFuZCAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScg aGFzIFNlcmlhbCBudW1iZXIgNAogICAgICAgICAgaW4gdGhlIE5TU0RCIC9ldGMvcGtpL3BraS10 b21jYXQvYWxpYXMKICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg Tm8/CiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBp YW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1u ICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8IGdyZXAKICAgICAgICBTZXJpYWwKICAgICAg ICA8YnI+CiAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx ICgweDRmZjkwMDBkKQogICAgICAgIDxicj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij4tIE9uIHNlcnZlciBzZWF0dGxlbmZzICh3aGVyZSBQS0kgZmFpbHMKICAgICAgICAgIHRvIHJl c3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50IGlzIGluc3RhbGxlZCBhbmQgJ3N1YnN5c3RlbUNlcnQK ICAgICAgICAgIGNlcnQtcGtpLWNhJyBoYXMgU2VyaWFsIG51bWJlciAxMzQxNzE4NTQxIGluIHRo ZSBOU1NEQgogICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcy4KICAgICAgICAgIDxi cj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgWWVzCiAgICAgICAgPGJyPgogICAgICAg IDxicj4KICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZCAvZXRj L3BraS9wa2ktdG9tY2F0L2FsaWFzCiAgICAgICAgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2kt Y2EnIHwgZ3JlcCBTZXJpYWwKICAgICAgICA8YnI+CiAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBT ZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKQogICAgICAgIDxicj4KICAgICAg ICA8YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICA8YnI+CiAg ICAgICAgICAtIEluIHRoZSBMREFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUg ZW50cnkKICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2Egd2l0aCBTZXJp YWwgbnVtYmVyIDQgKGkuZS4gaXQKICAgICAgICAgIGlzIHRoZSBjZXJ0IGZyb20gZnJlZWlwYS1z ZWEpLgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICBUaGlzIGlz IHdoZXJlIHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28gY2VydGlmaWNhdGVzIG9u CiAgICAgICAgdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24gdGhlIG90aGVyLsKgIEkgd29uZGVy IGlmIHRoaXMgaXMgYQogICAgICAgIHJlc3VsdCBvZiB0aGUgc2xvdyBtb3Rpb24gcmVwbGljYXRp b24gdHJhaW53cmVjayBJIGhhdmUgZ29pbmcgb24KICAgICAgICBkdWUgdG8gYSB6b21iaWUgcmVw bGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0IG5vIGxvbmdlcgogICAgICAgIGV4aXN0cyBp biB0aGUgcmVhbCB3b3JsZCBhbmQgSSBjYW4ndCBzZWVtIHRvIGdldCByaWQgb2YuCiAgICAgICAg PGJyPgogICAgICAgIDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBIaSwKICAgICAgPGJy PgogICAgICA8YnI+CiAgICAgIHRoZSByZW1haW5pbmcgaXNzdWUgaXMgYSByZXBsaWNhdGlvbiBw cm9ibGVtLiBUaGVyZSBpcyBhCiAgICAgICJUcm91Ymxlc2hvb3RpbmcgcmVwbGljYXRpb24iIHNl Y3Rpb24gWzFdIGluIElkTSBBZG1pbiBndWlkZSB0aGF0CiAgICAgIG1heSBoZWxwIHlvdS4KICAg ICAgPGJyPgogICAgICA8YnI+CiAgICAgIFJlZ2FyZGluZyB5b3VyIHpvbWJpZSByZXBsaWNhLCB3 aGljaCBjb21tYW5kcyBkaWQgeW91IHVzZSB0byB0cnkKICAgICAgdG8gcmVtb3ZlIGl0LCBhbmQg d2hhdCB3YXMgdGhlIG91dHB1dD8KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIEZsbwogICAg ICA8YnI+CiAgICAgIDxicj4KICAgICAgWzFdCjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl eHQiIGhyZWY9Imh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9S ZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRo ZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWwi Pmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0Vu dGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlv bl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgog ICAgICA8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBIaSw8YnI+CiAgICA8YnI+ CiAgICBUbyBkZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVl ZCBzZXZlcmFsIGluZm8KICAgIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRzIG9mIHRoZSBm b2xsb3dpbmcgY29tbWFuZHM8YnI+CiAgICA8YnI+CiAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5o XSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgIC1XIC1iICJ1 aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICBhbmQ8 YnI+CiAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp cmVjdG9yeSBtYW5hZ2VyJyAtVwogICAgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj YSBuc2NwZW50cnl3c2k8YnI+CiAgICA8YnI+CiAgICBGcm9tIHRoZSBvdXRwdXQgeW91IG1heSBv bmx5IGNvcHkvcGFzdCB0aGUgb25lcyByZWxhdGVkIHRvCiAgICB1c2VyQ2VydGlmaWNhdGU8YnI+ CiAgICA8YnI+CiAgICA8YnI+CiAgICA8Zm9udCBzaXplPSItMSI+PC9mb250PkFsc28gdG8gZHVt cCB0aGUgY3VycmVudCByZXBsaWNhdGlvbiBzdGF0dXMsCiAgICBzZW5kIHRoZSByZXN1bHTCoCBv Zjxicj4KICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2Nu PWRpcmVjdG9yeSBtYW5hZ2VyJwogICAgLVcgLWIgIm89aXBhY2EiPGZvbnQgc2l6ZT0iLTEiPjxp PiA8L2k+IigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZm Zi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAgICAgYW5kPGJyPgogICAgPC9m b250Pltyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0 b3J5CiAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+IDwvaT4i KCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZm ZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICA8YnI+CiAgICAgIFJlZ2FyZHM8YnI+ CiAgICAgIHRoaWVycnk8YnI+CiAgICA8L2ZvbnQ+CiAgICA8YmxvY2txdW90ZQogICAgICBjaXRl PSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAg ICAgIHR5cGU9ImNpdGUiPgogICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5bcm9vdEBmcmVl aXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMCiAgICAgICAgLUQgJ2NuPWRpcmVjdG9yeSBt YW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgdXNl ckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uCiAgICAgICAgPGJyPgogICAgICAgIEVudGVyIExEQVAg UGFzc3dvcmQ6CiAgICAgICAgPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3Bs ZSxvPWlwYWNhCiAgICAgICAgPGJyPgogICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAg TUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtE QWxDCiAgICAgICAgPGJyPgogICAgICAgIMKgICZsdDt0cnVuY2F0ZWQmZ3Q7CiAgICAgICAgPGJy PgogICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9G Yz0KICAgICAgICA8YnI+CiAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICBNSUlEYmpD Q0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUsKICAg ICAgICA8YnI+CiAgICAgICAgJmx0O3RydW5jYXRlZCZndDsgZnVRUVptUDFYcktrcmZzamVpRmJV RnRvTW5mbUhMSVlwZTVRQVIKICAgICAgICA8YnI+CiAgICAgICAgZGVzY3JpcHRpb246IDI7MTM0 MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1D QSBTdWJzeXN0ZW0KICAgICAgICA8YnI+CiAgICAgICAgwqAgLE89QlBULlJPQ0tTCiAgICAgICAg PGJyPgogICAgICAgIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBp YW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2VyJyAt VyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAg ICAgIGRlc2NyaXB0aW9uCiAgICAgICAgPGJyPgogICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6 CiAgICAgICAgPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh CiAgICAgICAgPGJyPgogICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgTUlJRGN6Q0NB bHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAg ICAgPGJyPgogICAgICAgIMKgICZsdDt0cnVuY2F0ZWQmZ3Q7CiAgICAgICAgPGJyPgogICAgICAg IMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAg ICA8YnI+CiAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHks Tz1CUFQuUk9DS1M7Q049Q0EKICAgICAgICBTdWJzeXN0ZW0sTz1CUFQuUk8KICAgICAgICA8YnI+ CiAgICAgICAgwqAgQ0tTCiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICA8YmxvY2tx dW90ZSB0eXBlPSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlIGNlcnRpZmljYXRlcyBkYXRlcywgSQog ICAgICAgICAgZ3Vlc3MgdGhhdCB0aGUgbW9zdCByZWNlbnQgb25lIGlzIG9uIHNlcnZlciBzZWF0 dGxlbmZzCiAgICAgICAgICAoYmVjYXVzZSBvZiBzZXJpYWwgbnVtYmVycykuIENhbiB5b3UgY29u ZmlybSB0aGlzIChiZWNhdXNlIG91cgogICAgICAgICAgZ29hbCBpcyB0byBoYXZlIHRoZSBtb3N0 IHJlY2VudCBjZXJ0IHN0b3JlZCBpbiBhbGwgdGhlIE5TU0RCcwogICAgICAgICAgYW5kIGluIExE QVApPwogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgVGhhbmtzLAogICAg ICAgICAgPGJyPgogICAgICAgICAgRmxvCiAgICAgICAgICA8YnI+CiAgICAgICAgICA8YnI+CiAg ICAgICAgICA8YnI+CiAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4KICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWYgeW91ciByZW5ld2FsIG1hc3RlciBpcyB0aGUK ICAgICAgICAgICAgICBtYWNoaW5lIG9uIHdoaWNoIHRoZSBOU1MgREIgL2V0Yy9wa2kvcGtpLXRv bWNhdC9hbGlhcwogICAgICAgICAgICAgIGNvbnRhaW5zIHRoZSBuZXdlciBjZXJ0LCB0aGVuIHlv dSBjYW4gbWFudWFsbHkgcnVuIHRoZQogICAgICAgICAgICAgIHNjcmlwdHM6CiAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgSWYgSSdtIGludGVycHJldGluZyB0aGlzIGNvcnJlY3RseSwgdGhlbiBpdCBpcy4uLiBz byBJIHJhbgogICAgICAgICAgICB0aGlzIG9uIHRoZSBicm9rZW4gbWFjaGluZSAoc2VhdHRsZW5m cykKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiPiQgc3VkbwogICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2Vy dG1vbmdlci9zdG9wX3BraWNhZAogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAkIHN1 ZG8gL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3JlbmV3X2NhX2NlcnQKICAgICAgICAgICAg ICAic3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSIKICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgSSByYW4gdGhpcywgaXQgdG9vayBhIHdoaWxlLCB0aGVuIEkgcmUtY2hlY2tlZCBh bmQgdGhlCiAgICAgICAgICAgIHNlcmlhbCBzdGlsbCBzZWVtcyB0byBiZSA0CiAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAn Y249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9 cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDoKICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYQogICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgIE1JSURjekNDQWx1 Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgIC4uLgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIMKg IFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNlcnRpZmljYXRlIEF1dGhv cml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAgICBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MK ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIEhlcmUncyB3aGF0 IHdhcyBpbiAvdmFyL2xvZy9wa2kvcGtpLXRvbWNhdC9jYS9kZWJ1ZwogICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICA9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogPT09PT3CoCBERUJVRwogICAg ICAgICAgICBTVUJTWVNURU0gSU5JVElBTElaRUTCoMKgID09PT09PT0KICAgICAgICAgICAgPGJy PgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIHJlc3RhcnQgYXQg YXV0b1NodXRkb3duPyBmYWxzZQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAg ICAgICBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAvdmFyL2xpYi9w a2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0ZG93bi5jcnVtYgogICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTog Q01TRW5naW5lOgogICAgICAgICAgICBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNo dXRkb3duCiAgICAgICAgICAgIHN1cHBvcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQog ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICBmb3VuZCBjZXJ0OmF1ZGl0 U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAg ICAgICAgICAgZG9uZSBpbml0IGlkPWRlYnVnCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6 CiAgICAgICAgICAgIGluaXRpYWxpemVkIGRlYnVnCiAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdp bmU6CiAgICAgICAgICAgIGluaXRTdWJzeXN0ZW0gaWQ9bG9nCiAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBD TVNFbmdpbmU6CiAgICAgICAgICAgIHJlYWR5IHRvIGluaXQgaWQ9bG9nCiAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOiBDcmVhdGluZwogICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtp LXRvbWNhdC9sb2dzL2NhL3NpZ25lZEF1ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTog Q3JlYXRpbmcKICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21j YXQvbG9ncy9jYS9zeXN0ZW0pCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDcmVhdGluZwogICAgICAgICAg ICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2NhL3RyYW5zYWN0 aW9ucykKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgcmVzdGFydCBh dCBhdXRvU2h1dGRvd24/IGZhbHNlCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAg ICAgICAgIGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgIC92YXIvbGli L3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iCiAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd OiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yIGF1dG8t c2h1dGRvd24KICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGZvdW5kIGNlcnQ6YXVk aXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFsw My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgog ICAgICAgICAgICBkb25lIGluaXQgaWQ9bG9nCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6 CiAgICAgICAgICAgIGluaXRpYWxpemVkIGxvZwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAg IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5l OgogICAgICAgICAgICBpbml0U3Vic3lzdGVtIGlkPWpzcwogICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01T RW5naW5lOgogICAgICAgICAgICByZWFkeSB0byBpbml0IGlkPWpzcwogICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XTogQ01TRW5naW5lOgogICAgICAgICAgICByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93bj8gZmFsc2UK ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs aG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgYXV0b1NodXRkb3duIGNy dW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9h dXRvU2h1dGRvd24uY3J1bWIKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAg ICAgYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICBz dXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENN U0VuZ2luZToKICAgICAgICAgICAgZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtp LWNhCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGRvbmUgaW5pdCBp ZD1qc3MKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgaW5pdGlhbGl6 ZWQganNzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIGluaXRTdWJz eXN0ZW0gaWQ9ZGJzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgIHJl YWR5IHRvIGluaXQgaWQ9ZGJzCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBEQlN1YnN5c3RlbToKICAgICAg ICAgICAgaW5pdCgpIG1FbmFibGVTZXJpYWxNZ210PXRydWUKICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENy ZWF0aW5nCiAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3IoREJTdWJzeXN0ZW0pCiAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdAogICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgTGRhcEJvdW5kQ29ubkZhY3Rvcnk6ZG9DbG9uaW5n IHRydWUKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IExkYXBBdXRoSW5mbzoKICAgICAgICAgICAgaW5pdCgp CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOiBMZGFwQXV0aEluZm86CiAgICAgICAgICAgIGluaXQgYmVnaW5z CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOiBMZGFwQXV0aEluZm86CiAgICAgICAgICAgIGluaXQgZW5kcwog ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXTogaW5pdDogYmVmb3JlCiAgICAgICAgICAgIG1ha2VDb25uZWN0aW9u IGVycm9ySWZEb3duIGlzIHRydWUKICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgIG1ha2VD b25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVlCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBUQ1AKICAgICAg ICAgICAgS2VlcC1BbGl2ZTogdHJ1ZQogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgU1NM Q2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogU2V0dGluZyBkZXNpcmVkIGNlcnQKICAgICAg ICAgICAgbmlja25hbWUgdG86IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAg PGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0 b3AtMV06CiAgICAgICAgICAgIExkYXBKc3NTU0xTb2NrZXQ6IHNldCBjbGllbnQgYXV0aCBjZXJ0 IG5pY2tuYW1lCiAgICAgICAgICAgIHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EKICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06CiAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRTZWxlY3Rpb25DQjogRW50 ZXJpbmchCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDYW5kaWRhdGUKICAgICAgICAgICAgY2VydDogb2Nz cFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDYW5kaWRhdGUKICAg ICAgICAgICAgY2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogZGVzaXJlZCBj ZXJ0IGZvdW5kIGluIGxpc3Q6CiAgICAgICAgICAgIHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EK ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs aG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0 aW9uQ0I6IHJldHVybmluZzogc3Vic3lzdGVtQ2VydAogICAgICAgICAgICBjZXJ0LXBraS1jYQog ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXTogU1NMIGhhbmRzaGFrZQogICAgICAgICAgICBoYXBwZW5lZAogICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgQ01TRW5naW5lLnNodXRkb3duKCkKICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgSSBy ZWFsbHkgYXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoIHRoaXMuwqAgSQog ICAgICAgICAgICBvd2UgeW91LgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgLSBJYW4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkFmdGVyIHRoYXQsIGNoZWNrIHRoYXQgdGhlIExE QVAKICAgICAgICAgICAgICBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUgY2Fz ZSwgeW91IHNob3VsZCBiZQogICAgICAgICAgICAgIGFibGUgdG8gcmVzdGFydCBwa2kuCiAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBGbG8KICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPlRoYW5rIHlvdSBhZ2FpbiBmb3IgeW91ciB0aW1lIQogICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgSWFuCiAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2tx dW90ZSB0eXBlPSJjaXRlIj5GbG8uCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgIHdoaWNoIHNlZW1zIHdlaXJkLgogICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+VGhlIGRlc2NyaXB0aW9uIGF0dHJpYnV0ZSBpbgogICAgICAgICAg ICAgICAgICAgICAgdGhlIGxkYXBzZWFyY2ggb3V0cHV0IGlzIG9mIHRoZSBmb3JtIDI7IztETjtE TgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRoZSBzZXJpYWwgbnVtYmVy IGluIHRoZSBmaXJzdAogICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWwgb3V0cHV0CiAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICBUaGUgQVNDSUkgYmxvYiAobWludXMgdGhlIEJFR0lOL0VORCBoZWFkZXJz KQogICAgICAgICAgICAgICAgICAgICAgc2hvdWxkIG1hdGNoIG9uZSBvZiB0aGUKICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBh dHRyaWJ1dGVzLgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgcm9iCiAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv dGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8YnI+ CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCiAgICAgICAgPGJyPgogICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tCiAg ICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZy ZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5m ZWRvcmFob3N0ZWQub3JnPC9hPgogICAgICAgIDxicj4KICAgICAgICBUbyB1bnN1YnNjcmliZSBz ZW5kIGFuIGVtYWlsIHRvCiAgICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRl ZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZyI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgogICAgICAg IDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwogICAgICA8YnI+CiAgICAgIEZyZWVJUEEtdXNlcnMgbWFp bGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1h aWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnNA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgPGJyPgogICAgICBUbyB1bnN1YnNjcmli ZSBzZW5kIGFuIGVtYWlsIHRvCiAgICAgIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0 ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAg PGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============5361506650663838278==-- From ianh at brownpapertickets.com Tue Aug 8 20:34:20 2017 Content-Type: multipart/mixed; boundary="===============5624228806415025913==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 08 Aug 2017 13:33:45 -0700 Message-ID: <2f60c4af-680c-4382-9704-41a24c8121a2@brownpapertickets.com> In-Reply-To: 59882871.1000106@redhat.com --===============5624228806415025913== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/7/17 1:44 AM, thierry bordaz wrote: > > > On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote: >> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>> >>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>> Ian Harding wrote: >>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>>>>>>> apparently had >>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can = >>>>>>>>>>>>>>>> run without >>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see what = >>>>>>>>>>>>>>>> is going on. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication failed = >>>>>>>>>>>>>>> (49) >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>> >>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and = >>>>>>>>>>>>>> needs to >>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>> >>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>> >>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN and >>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>> >>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>> >>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>> >>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> I found this: >>>>>>>>>>>>> >>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o=3D= ipaca >>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>> ... >>>>>>>>>>>>> >>>>>>>>>>>>> and when I try the ldapsearch I am presented with a prompt = >>>>>>>>>>>>> to provide >>>>>>>>>>>>> a pin/password >>>>>>>>>>>>> >>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>> >>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>>> password can be >>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with = >>>>>>>>>>>> the tag >>>>>>>>>>>> internal=3D...) >>>>>>>>>>>> >>>>>>>>>>>> Can you check if the password with the tag internal=3D... = >>>>>>>>>>>> allows to read >>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>> (provide password) >>>>>>>>>>> >>>>>>>>>>> That works... >>>>>>>>>>> >>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>>> User Private >>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>> Certificate >>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e caSigningCert >>>>>>>>>>> cert-pki-ca >>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>> Certificate >>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>>>>>> cert-pki-ca >>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>> Certificate >>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>> >>>>>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>>>>> >>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>> EXTERNAL >>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>> >>>>>>>>>>> That password is getting me somewhere though, since if I put = >>>>>>>>>>> in a >>>>>>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>>>>>> >>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>> >>>>>>>>> There wasn't much of a change... I just assumed someone ran = >>>>>>>>> yum upgrade and didn't restart, then the power outage... it = >>>>>>>>> looks like not much of a version change though. >>>>>>>>> >>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>> >>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>> >>>>>>>>> >>>>>>>>>> >>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>> >>>>>>>>> # getenforce >>>>>>>>> Enforcing >>>>>>>>> >>>>>>>>>> >>>>>>>>>> If so can you run: >>>>>>>>>> >>>>>>>>>> # ausearch -m AVC >>>>>>>>>> >>>>>>>>> >>>>>>>>> # ausearch -m AVC >>>>>>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>>>>>> write_logs option. >>>>>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>>>>> ---- >>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003e = >>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a2= =3D1 = >>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D429496= 7295 = >>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 = >>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) = >>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read = } = >>>>>>>>> for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"dm-= 2" = >>>>>>>>> ino=3D116393517 scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c102= 3 = >>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>> >>>>>>>>> >>>>>>>>>> I suspect that the subsystem cert was renewed and everything = >>>>>>>>>> wasn't >>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>> upgrade it just >>>>>>>>>> shone a spotlight on it. >>>>>>>>>> >>>>>>>>>> Can you run these commands: >>>>>>>>>> >>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>>>> >>>>>>>>> >>>>>>>>> This returns >>>>>>>>> >>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>>> Enter LDAP Password: >>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>> userCertificate:: = >>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>> ... stuff ... >>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>> >>>>>>>>>> and >>>>>>>>>> >>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>>> cert-pki-ca' -a >>>>>>>>>> >>>>>>>>> >>>>>>>>> These both return >>>>>>>>> >>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>> Unrecognized Object Identifier. >>>>>>>>> >>>>>>>>> >>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>> cert-pki-ca' -a >>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>> User Private Key and Certificate Services" >>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>> Unrecognized Object Identifier. >>>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> you made a typo and requested the keys (-K) instead of the = >>>>>>>> certs (-L). Please retry with -L and you should be able to see = >>>>>>>> the certificate serial. >>>>>>>> >>>>>>> >>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificat= e = >>>>>>> description >>>>>>> Enter LDAP Password: >>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>> userCertificate:: = >>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>> ... >>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>> >>>>>>> So the serial is 4? >>>>>>> >>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>> >>>>>>> Which is NOT 4... >>>>>>> >>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>>> -n 'subsystemCert cert-pki-ca' -a >>>>>>> -----BEGIN CERTIFICATE----- >>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>> ... >>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>> -----END CERTIFICATE----- >>>>>>> >>>>>>> And this cert is NOT the same. >>>>>>> >>>>>> Hi, >>>>>> >>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>> post-save commands (which you can see in the output of getcert = >>>>>> list). In your case, the post-save command for subsystemCert = >>>>>> cert-pki-ca probably failed. >>>>>> >>>>>> This command (on the renewal master) is responsible for copying = >>>>>> the new cert from the NSS db to the LDAP server. You need first = >>>>>> to check which IPA server is the renewal master (as the serial = >>>>>> numbers are in a completely different range, I assume that you = >>>>>> have multiple IPA servers configured with a CA instance): >>>>>> >>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f2= -` >>>>>> $ kinit admin >>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>> dn: = >>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3De= tc,dc=3Dipadomain,dc=3Dcom = >>>>>> >>>>>> >>>>>> In this example the renewal master is vm-ipaserver. >>>>>> >>>>> >>>>> I get this >>>>> >>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>> dn: = >>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc= =3Dbpt,dc=3Drocks = >>>>> >>>>> >>>>> Which is the other FreeIPA server. >>>>> >>>> Hi Ian, >>>> >>>> it's getting difficult to follow this thread, so could we step back = >>>> and summarize? >>> Yes, it is. Sorry. >>>> >>>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in = >>>> the NSSDB /etc/pki/pki-tomcat/alias >>> No? >>> >>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>> 'subsystemCert cert-pki-ca' | grep Serial >>> Serial Number: 1341718541 (0x4ff9000d) >>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>> component is installed and 'subsystemCert cert-pki-ca' has Serial = >>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>> Yes >>> >>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>> 'subsystemCert cert-pki-ca' | grep Serial >>> Serial Number: 1341718541 (0x4ff9000d) >>> >>>> >>>> - In the LDAP servers, the cert is stored in the entry = >>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it is = >>>> the cert from freeipa-sea). >>> This is where the difference is. There are two certificates on the = >>> master and only one on the other. I wonder if this is a result of = >>> the slow motion replication trainwreck I have going on due to a = >>> zombie replica in the ldap database that no longer exists in the = >>> real world and I can't seem to get rid of. >>> >> Hi, >> >> the remaining issue is a replication problem. There is a = >> "Troubleshooting replication" section [1] in IdM Admin guide that may = >> help you. >> >> Regarding your zombie replica, which commands did you use to try to = >> remove it, and what was the output? >> >> Flo >> >> [1] = >> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7= /html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-rep= lication.html >> > > Hi, > > To debug replication latency or problem we would need several info but = > starting with the results of the following commands > > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi: = entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: 75274897 nscpentrywsi: = modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 90004: 20170608055334Z nscpentrywsi: = modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 003: cn=3DDirectory Manager nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 nscpentrywsi: cn: pkidbuser nscpentrywsi: createTimestamp: 20150716125146Z nscpentrywsi: creatorsName: cn=3Ddirectory manager nscpentrywsi: description;vucsn-5938e688000104290001: = 2;1341718541;CN=3DCertific ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = 2;4;CN=3DCertifica te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS nscpentrywsi: mail: nscpentrywsi: objectClass: top nscpentrywsi: objectClass: person nscpentrywsi: objectClass: organizationalPerson nscpentrywsi: objectClass: inetOrgPerson nscpentrywsi: objectClass: cmsuser nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS nscpentrywsi: sn: pkidbuser nscpentrywsi: uid: pkidbuser nscpentrywsi: userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = MIIDbjCCAlagAwIBAgI AR nscpentrywsi: userPassword:: nscpentrywsi: userstate: 1 nscpentrywsi: usertype: agentType nscpentrywsi: parentid: 2 nscpentrywsi: entryid: 51 > and > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi Enter LDAP Password: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS nscpentrywsi: userCertificate:: = MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D nscpentrywsi: description: 2;4;CN=3DCertificate = Authority,O=3DBPT.ROCKS;CN=3DCA Subs ystem,O=3DBPT.ROCKS nscpentrywsi: entryid: 51 nscpentrywsi: parentid: 2 nscpentrywsi: modifyTimestamp: 20150716125146Z nscpentrywsi: createTimestamp: 20150716125146Z nscpentrywsi: modifiersName: cn=3Ddirectory manager nscpentrywsi: creatorsName: cn=3Ddirectory manager nscpentrywsi: userPassword:: nscpentrywsi: userstate: 1 nscpentrywsi: usertype: agentType nscpentrywsi: mail: nscpentrywsi: cn: pkidbuser nscpentrywsi: sn: pkidbuser nscpentrywsi: uid: pkidbuser nscpentrywsi: objectClass: top nscpentrywsi: objectClass: person nscpentrywsi: objectClass: organizationalPerson nscpentrywsi: objectClass: inetOrgPerson nscpentrywsi: objectClass: cmsuser nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 nscpentrywsi: entryusn: 86 > > From the output you may only copy/past the ones related to userCertificate > > > Also to dump the current replication status, send the result of > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b = > "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffffff= f-ffffffff-ffffffff))" [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = "o=3Dipaca" = "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ffff= ffff))" Enter LDAP Password: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=3DReplication Manager = cloneAgreement1-freeipa-sea.bpt.roc ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nsDS5ReplicaBindDN: cn=3DReplication Manager = masterAgreement1-seattlenfs.bpt.roc ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nsDS5ReplicaId: 1065 nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 nsDS5ReplicaRoot: o=3Dipaca nsDS5ReplicaType: 3 nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D nsds5replicabinddngroup: cn=3Dreplication = managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, dc=3Drocks nsds5replicabinddngroupcheckinterval: 60 objectClass: top objectClass: nsDS5Replica objectClass: extensibleobject nsds50ruv: {replicageneration} 57c291d9000004290000 nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = 57f840bf00000429000 0 598a1c40000104290000 nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} nsds5agmtmaxcsn: = o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat tlenfs.bpt.rocks;389;unavailable nsds5agmtmaxcsn: = o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat tlenfs.bpt.rocks;389;unavailable nsruvReplicaLastModified: {replica 1065 = ldap://freeipa-sea.bpt.rocks:389} 598a 1c16 nsruvReplicaLastModified: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = 00000 000 nsds5ReplicaChangeCount: 885 nsds5replicareapactive: 0 > and > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b = > "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffffff= f-ffffffff-ffffffff))" [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = "o=3Dipaca" = "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ffff= ffff))" Enter LDAP Password: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig cn: replica nsDS5Flags: 1 nsDS5ReplicaBindDN: cn=3DReplication Manager = cloneAgreement1-seattlenfs.bpt.rock s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nsDS5ReplicaId: 1290 nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 nsDS5ReplicaRoot: o=3Dipaca nsDS5ReplicaType: 3 nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D nsds5replicabinddngroup: cn=3Dreplication = managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, dc=3Drocks nsds5replicabinddngroupcheckinterval: 60 objectClass: top objectClass: nsDS5Replica objectClass: extensibleobject nsds50ruv: {replicageneration} 55c8f3ae000000600000 nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = 57be804c0000050a0000 587236150000050a0000 nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = 57b103d400000429000 0 57be8043000704290000 nsds5agmtmaxcsn: = o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei pa-sea.bpt.rocks;389;1065;587236150000050a0000 nsruvReplicaLastModified: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = 00000 000 nsruvReplicaLastModified: {replica 1065 = ldap://freeipa-sea.bpt.rocks:389} 0000 0000 nsds5ReplicaChangeCount: 3 nsds5replicareapactive: 0 > > Regards > thierry >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>> >>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> userCertificate:: = >>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>> description: 2;1341718541;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN= =3DCA = >>> Subsystem >>> ,O=3DBPT.ROCKS >>> >>> >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>> >>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>> Subsystem,O=3DBPT.RO >>> CKS >>> >>>> If you check the certificates dates, I guess that the most recent = >>>> one is on server seattlenfs (because of serial numbers). Can you = >>>> confirm this (because our goal is to have the most recent cert = >>>> stored in all the NSSDBs and in LDAP)? >>>> >>>> Thanks, >>>> Flo >>>> >>>> >>>>>> If your renewal master is the machine on which the NSS DB = >>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >>>>>> manually run the scripts: >>>>> >>>>> If I'm interpreting this correctly, then it is... so I ran this on = >>>>> the broken machine (seattlenfs) >>>>> >>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >>>>>> cert-pki-ca" >>>>>> >>>>> >>>>> I ran this, it took a while, then I re-checked and the serial = >>>>> still seems to be 4 >>>>> >>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>> ... >>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>> Subsystem,O=3DBPT.ROCKS >>>>> >>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>> >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG = >>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>>> at autoShutdown? false >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> autoShutdown crumb file path? = >>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>> cert:auditSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>> init id=3Ddebug >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> initialized debug >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> initSubsystem id=3Dlog >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>>>> init id=3Dlog >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>>> at autoShutdown? false >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> autoShutdown crumb file path? = >>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>> cert:auditSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>> init id=3Dlog >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> initialized log >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> initSubsystem id=3Djss >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>>>> init id=3Djss >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>>> at autoShutdown? false >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> autoShutdown crumb file path? = >>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about to = >>>>> look for cert for auto-shutdown support:auditSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>> cert:auditSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>> init id=3Djss >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> initialized jss >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>> initSubsystem id=3Ddbs >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready to = >>>>> init id=3Ddbs >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: init() = >>>>> mEnableSerialMgmt=3Dtrue >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>> LdapBoundConnFactor(DBSubsystem) >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> LdapBoundConnFactory: init >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> LdapBoundConnFactory:doCloning true >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init = >>>>> begins >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init = >>>>> ends >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>> makeConnection errorIfDown is true >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>>>> errorIfDown true >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname to: = >>>>> subsystemCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: = >>>>> set client auth cert nickname subsystemCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> SSLClientCertificatSelectionCB: Entering! >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>> ocspSigningCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>> subsystemCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>> subsystemCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>> SSLClientCertificateSelectionCB: returning: subsystemCert cert-pki-ca >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake happened >>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() >>>>> >>>>> >>>>> I really appreciate you sticking with me through this. I owe you. >>>>> >>>>> - Ian >>>>> >>>>>> After that, check that the LDAP entry has been updated. If it is = >>>>>> the case, you should be able to restart pki. >>>>>> >>>>>> Flo >>>>>> >>>>>>> Thank you again for your time! >>>>>>> >>>>>>> Ian >>>>>>> >>>>>>>> Flo. >>>>>>>>> >>>>>>>>> which seems weird. >>>>>>>>> >>>>>>>>>> The description attribute in the ldapsearch output is of the = >>>>>>>>>> form 2;#;DN;DN >>>>>>>>>> >>>>>>>>>> The # should match the serial number in the first certutil = >>>>>>>>>> output >>>>>>>>>> >>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match one = >>>>>>>>>> of the >>>>>>>>>> userCertificate attributes. >>>>>>>>>> >>>>>>>>>> rob >>>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>> >>>>> >>>> >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to = >>> freeipa-users-leave(a)lists.fedorahosted.org >> _______________________________________________ >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email to = >> freeipa-users-leave(a)lists.fedorahosted.org > --===============5624228806415025913== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPHA+T24gOC83LzE3IDE6NDQgQU0sIHRoaWVy cnkgYm9yZGF6IHdyb3RlOjxicj4KICAgIDwvcD4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi IGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPgogICAgICA8bWV0YSBjb250 ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+ CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgi Pk9uIDA4LzA3LzIwMTcgMDk6MjIgQU0sIEZsb3JlbmNlCiAgICAgICAgQmxhbmMtUmVuYXVkIHZp YSBGcmVlSVBBLXVzZXJzIHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3Rl CiAgICAgICAgY2l0ZT0ibWlkOjMzMWVmYjY3LWRkM2ItMjM1MC0zNDcwLTVkMWE5YjkyNTJjM0By ZWRoYXQuY29tIgogICAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0LzIwMTcgMTE6MDIgUE0sIElh biBIYXJkaW5nIHZpYQogICAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICA8 YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiA4LzQvMTcgMjoxNiBBTSwgRmxvcmVuY2UgQmxhbmMt UmVuYXVkCiAgICAgICAgICB3cm90ZTogPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDMvMjAxNyAxMToxMyBQTSwgSWFuIEhhcmRpbmcK ICAgICAgICAgICAgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDMvMjAxNyAxMjoyOCBBTSwgRmxvcmVuY2UKICAg ICAgICAgICAgICBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICA8YmxvY2tx dW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDExOjUxIFBNLCBJYW4KICAgICAgICAgICAg ICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAg IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMTI6MTEgQU0sIEZsb3JlbmNl CiAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDAxOjQzIEFNLCBJYW4K ICAgICAgICAgICAgICAgICAgICBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAxMjowMyBQTSwgUm9iCiAg ICAgICAgICAgICAgICAgICAgICBDcml0dGVuZGVuIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JYW4gSGFyZGluZyB3cm90ZTogPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8y MDE3IDA3OjM5IEFNLAogICAgICAgICAgICAgICAgICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJl bmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcgMDM6MTEKICAgICAgICAgICAgICAgICAgICAgICAgICAg IFBNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNyAwMTo0OAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBBTSwgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4 LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwMTozMiBBTSwgSWFuIEhh cmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3 cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPbiAwNy8zMS8yMDE3IDExOjM0IEFNLCBS b2IgQ3JpdHRlbmRlbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPklhbiBIYXJkaW5nCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZpYSBG cmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkkgaGFkIGFuCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgdW5leHBlY3RlZCByZXN0YXJ0IG9mIGFuIElQQQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciB0aGF0IGhhZCBhcHBhcmVudGx5IGhh ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXBkYXRlcyBydW4g YnV0IGhhZCBub3QgYmVlbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJl c3RhcnRlZC4gaXBhY3RsIHNheXMgcGtpLXRvbWNhdGQKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg d291bGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vdCBzdGFy dC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdHJhbmdlbHksIHRoZSBhY3R1YWwgc2Vy dmljZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFwcGVhcnMgdG8gYmUg cnVubmluZzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGRvZ3RhZyBpcyBhbiBhcHBsaWNhdGlvbiB3aXRoaW4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgdG9tY2F0IHNvIHRvbWNhdCBjYW4gcnVuIHdpdGhvdXQg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nLiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgV2UgbmVlZCB0byBzZWUgbW9yZSBvZiB0aGUgZG9ndGFnCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGRlYnVnIGxvZyB0byBzZWUgd2hhdCBpcyBnb2luZyBvbi4g PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJdCBs b29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBwcm9ibGVtLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBTU0wgaGFu ZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENv dWxkIG5vdCBjb25uZWN0IHRvIExEQVAgc2VydmVyIGhvc3QKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHNlYXR0bGVuZnMuYnB0LnJvY2tzIHBvcnQgNjM2IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yIG5ldHNjYXBlLmxkYXAuTERBUEV4Y2VwdGlv bjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhlbnRpY2F0aW9uIGZhaWxl ZCAoNDkpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGRvZ3RhZyBzdG9yZXMgaXRzIGludGVybmFsIGRhdGEgaW4gdGhlCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTERBUCBzZXJ2ZXIgYW5kIG5lZWRzIHRvIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlc3RhYmxpc2ggYSBzZWN1cmUgTERB UCBjb25uZWN0aW9uLiBZb3UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjYW4gY2hl Y2sgaG93IHRoaXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rp b24gaXMgY29uZmlndXJlZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMv cGtpL3BraS10b21jYXQvY2EvQ1MuY2ZnLCBsb29rIGZvcgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgbGluZXM6 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CmludGVybmFsZGIubGRh cGF1dGguYXV0aHR5cGU9U3NsQ2xpZW50QXV0aCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49Y249RGlyZWN0b3J5CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgTWFuYWdlciA8YnI+CmludGVybmFsZGIubGRhcGF1dGgu YmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENl cnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLmhvc3Q9dm0tLi4uIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLnBvcnQ9NjM2 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25u LnNlY3VyZUNvbm4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRodHlwZSBjYW4gYmUgU3NsQ2xpZW50QXV0 aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEg c3NsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSkgb3Ig QmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9u IHdpdGggYSBiaW5kIEROIGFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg cGFzc3dvcmQgc3RvcmVkIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9s aWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29yZC5jb25mKS4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlvdSBjYW4gdXNlIHRoaXMgaW5mb3JtYXRp b24gdG8gbWFudWFsbHkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjaGVjayB0aGUg Y3JlZGVudGlhbHMuIEZvciA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW5z dGFuY2Ugd2l0aCBzc2xjbGllbnRhdXRoOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNfQ0FDRVJURElSPS9ldGMvcGtpL3BraS10 b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgZXhwb3J0IExEQVBUTFNfQ0VSVD0nc3Vic3lzdGVtQ2Vy dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGxkYXBzZWFyY2ggLUggPGEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBocmVmPSJsZGFwczovLyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwczovLzwv YT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1iICIiIC1z IGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChw cm92aWRlIHRoZSBwYXNzd29yZCBmcm9tCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg L2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczogPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIu bGRhcGF1dGguYXV0aHR5cGU9U3NsQ2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmluZEROPXVpZD1wa2lkYnVzZXIsb3U9cGVv cGxlLG89aXBhY2EgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5h bGRiIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lzdGVt Q2VydCBjZXJ0LXBraS1jYSA8YnI+CmludGVybmFsZGIubGRhcGNvbm4uY2xvbmVSZXBsaWNhdGlv blBvcnQ9Mzg5IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBhbmQgd2hlbiBJIHRyeSB0aGUgbGRhcHNlYXJjaCBJIGFtCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IHRvIHByb3ZpZGUgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBhIHBpbi9wYXNzd29yZCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxl YXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MgcGhyYXNlCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGZvciBzZWN1cml0eSB0b2tlbiAnbGRhcCgwKSc6IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBi dXQgdGhlcmUgaXMgbm8gcGFzc3dvcmQgZmlsZS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB5b3UgYXJlIHJpZ2h0LCBp biA0LjQuIHRoZXJlIGlzIG5vCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwd2RmaWxlLnR4 dCBhbmQgdGhlIHBhc3N3b3JkIGNhbiBiZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICBmb3VuZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10 b21jYXQvY29uZi9wYXNzd29yZC5jb25mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAod2l0 aCB0aGUgdGFnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsPS4uLikg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgQ2FuIHlvdSBjaGVjayBpZiB0aGUgcGFzc3dvcmQgd2l0aCB0aGUgdGFnCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4gYWxsb3dzIHRvIHJlYWQgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPyA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2kt dG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIChwcm92aWRlIHBh c3N3b3JkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBUaGF0 IHdvcmtzLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4g Ik5TUyBDZXJ0aWZpY2F0ZSBEQiIKICAgICAgICAgICAgICAgICAgICAgICAgICBpbiBzbG90ICJO U1MgVXNlciBQcml2YXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBLZXkgYW5kIENl cnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIg UGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAg ICAgICAgREIiOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAwJmd0OyByc2EK ICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdjYTUz NjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgIChvcnBoYW4pIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDEmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAg ICAgICAgIGIxMjU4MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4NzBiMjRiN2I5NmHCoMKgIE5TUwog ICAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICBEQjphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAmbHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAg IDg4MWI3MjU0YzQwZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAg ICAgICAgICAgICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBj ZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0OyByc2EK ICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlhMjU1YTFkMTU1ODVhYzI4MDY0YzBmNDk4NmU0 MTZiYzQ4NDAzwqDCoCBOU1MKICAgICAgICAgICAgICAgICAgICAgICAgICBDZXJ0aWZpY2F0ZSA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtp LWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQogICAgICAg ICAgICAgICAgICAgICAgICAgIDNmYjYwOWQwZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3ZjdlNWEw MWYKICAgICAgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICZsdDsgNSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5NDc5YTk1NTZhZjkz MzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAgTlNTCiAgICAgICAgICAgICAgICAgICAgICAg ICAgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3Rl bUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhpcyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lIHBh c3N3b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNzd29yZC5jb25mKSA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICMgbGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1v ei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imxk YXBzOi8vIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXBzOi8vPC9hPmBob3N0bmFtZWA6NjM2 CiAgICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIgLXMgYmFzZSAtWSBFWFRFUk5BTCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9y IHBhc3MgcGhyYXNlIGZvcgogICAgICAgICAgICAgICAgICAgICAgICAgIHNlY3VyaXR5IHRva2Vu ICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFNBU0wvRVhURVJOQUwg YXV0aGVudGljYXRpb24gc3RhcnRlZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgbGRh cF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczogSW52YWxpZAogICAgICAgICAgICAgICAgICAgICAg ICAgIGNyZWRlbnRpYWxzICg0OSkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29t ZXdoZXJlIHRob3VnaCwKICAgICAgICAgICAgICAgICAgICAgICAgICBzaW5jZSBpZiBJIHB1dCBp biBhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBub25zZW5zZSBvciBpbmNvcnJlY3Qg cGFzc3dvcmQgaXQganVzdCBwcm9tcHRzCiAgICAgICAgICAgICAgICAgICAgICAgICAgb3ZlciBh bmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgTGV0J3Mgc3Rl cCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQgZnJvbSB3aGF0CiAgICAgICAgICAgICAgICAg ICAgICAgIHRvIHdoYXQ/IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFRoZXJlIHdh c24ndCBtdWNoIG9mIGEgY2hhbmdlLi4uIEkganVzdCBhc3N1bWVkCiAgICAgICAgICAgICAgICAg ICAgICBzb21lb25lIHJhbiB5dW0gdXBncmFkZSBhbmQgZGlkbid0IHJlc3RhcnQsIHRoZW4KICAg ICAgICAgICAgICAgICAgICAgIHRoZSBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MgbGlrZSBub3Qg bXVjaCBvZiBhCiAgICAgICAgICAgICAgICAgICAgICB2ZXJzaW9uIGNoYW5nZSB0aG91Z2guIDxi cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgZ3Jl cCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg MDQ6NDU6MzIgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQu MC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFu IDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQt Y29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICBKYW4gMDggMDQ6NDY6MDYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGxp YmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDY6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIHB5dGhv bi1saWJpcGFfaGJhYy0xLjE0LjAtNDMuZWw3XzMuNC54ODZfNjQgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjQ2OjA4IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg IHB5dGhvbi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICBKYW4gMDggMDQ6NDc6MDQgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAg cHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoIDxicj4KICAgICAg ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAg ICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gg PGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAg ICAgICAgICAgICAgICAgICBpcGEtYWRtaW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5u b2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxl ZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5j ZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6 MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40 LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEph biAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgc3NzZC1pcGEtMS4x NC4wLTQzLmVsN18zLjQueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw NDo0NzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC00LjQuMC0x NC5lbDcuY2VudG9zLjEuMS54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4 IDA0OjQ3OjIzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLTQuNC4w LTE0LmVsNy5jZW50b3MuMS4xLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4g MDggMDQ6NDc6MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItZG5z LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICBKYW4gMDggMDQ6NDc6MzYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLXB5 dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoIDxicj4KICAgICAgICAg ICAgICAgICAgICAgIEphbiAwOCAwNDo1MDowNyBFcmFzZWQ6CiAgICAgICAgICAgICAgICAgICAg ICBpcGEtcHl0aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAgICAgICAgICAg ICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDIgVXBkYXRlZDoKICAgICAgICAgICAgICAg ICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJy PgogICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQzIFVwZGF0ZWQ6CiAgICAgICAg ICAgICAgICAgICAgICBpcGEtc2VydmVyLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9h cmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgog ICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy43 Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDQgVXBkYXRl ZDoKICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhY2xpZW50LTQuNC4wLTE0LmVsNy5j ZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ1 IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYXNlcnZlci00LjQuMC0x NC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAw OTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40 LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwg MjggMDk6NTU6NDYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40 LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwg MjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40 LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwg MjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItZG5z LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAg SnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9u LWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgZ3JlcCBwa2kgL3Zhci9sb2cveXVt LmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDUgVXBkYXRlZDoK ICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJy PgogICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA5IFVwZGF0ZWQ6CiAgICAgICAg ICAgICAgICAgICAgICBrcmI1LXBraW5pdC0xLjE0LjEtMjcuZWw3XzMueDg2XzY0IDxicj4KICAg ICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAg ICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAg ICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVwZGF0ZWQ6CiAgICAgICAgICAgICAg ICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAg IHBraS1zZXJ2ZXItMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIHBraS1r cmEtMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKYW4g MDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMt MTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzox NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtMTAuMy4zLTE5LmVsN18z Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRl ZDoKICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEtMTAuMy4zLTE5LmVsN18zLm5v YXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoK ICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTkuZWw3XzMueDg2XzY0IDxi cj4KICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAg ICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAg ICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAg ICAgICAgICAgcGtpLWtyYS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAg ICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg cGtpLWNhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgQXJlIHlv dSBydW5uaW5nIGluIFNFTGludXggZW5mb3JjaW5nIG1vZGU/IDxicj4KICAgICAgICAgICAgICAg ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICMgZ2V0ZW5mb3JjZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBFbmZv cmNpbmcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg SWYgc28gY2FuIHlvdSBydW46IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0g QVZDIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gdG8gbG9nX2Zv cm1hdCBpcyBkZXByZWNhdGVkLgogICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIHVzZSB0aGUg d3JpdGVfbG9ncyBvcHRpb24uIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBv cHRpb24gaXMgb3ZlcnJpZGluZyB0aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgICAg Y3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAtLS0tIDxicj4KICAg ICAgICAgICAgICAgICAgICAgIHRpbWUtJmd0O01vbiBNYXIgMTQgMTA6Mzk6MDEgMjAxNiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NBTEwgbXNnPWF1ZGl0KDE0NTc5NzcxNDEu NzY3OjE3NTM3KToKICAgICAgICAgICAgICAgICAgICAgIGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0y IHN1Y2Nlc3M9bm8gZXhpdD0tMTMKICAgICAgICAgICAgICAgICAgICAgIGEwPTdmYmNhYjAzOGQx MCBhMT04MDAgYTI9MSBhMz03ZmJjYTYwZjQyZTAKICAgICAgICAgICAgICAgICAgICAgIGl0ZW1z PTAgcHBpZD0xNDA2IHBpZD0xMjk2NSBhdWlkPTQyOTQ5NjcyOTUgdWlkPTAKICAgICAgICAgICAg ICAgICAgICAgIGdpZD0wIGV1aWQ9NTgxNDAwMDAxIHN1aWQ9MCBmc3VpZD01ODE0MDAwMDEKICAg ICAgICAgICAgICAgICAgICAgIGVnaWQ9NTgxNDAwMDAxIHNnaWQ9MCBmc2dpZD01ODE0MDAwMDEg dHR5PShub25lKQogICAgICAgICAgICAgICAgICAgICAgc2VzPTQyOTQ5NjcyOTUgY29tbT0ic3No ZCIgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgIHN1Ymo9c3lzdGVt X3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICBr ZXk9KG51bGwpIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDIG1zZz1hdWRpdCgx NDU3OTc3MTQxLjc2NzoxNzUzNyk6IGF2YzrCoAogICAgICAgICAgICAgICAgICAgICAgZGVuaWVk IHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUgY29tbT0ic3NoZCIKICAgICAgICAgICAgICAgICAgICAg IG5hbWU9ImF1dGhvcml6ZWRfa2V5cyIgZGV2PSJkbS0yIiBpbm89MTE2MzkzNTE3CiAgICAgICAg ICAgICAgICAgICAgICBzY29udGV4dD1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAu YzEwMjMKICAgICAgICAgICAgICAgICAgICAgIHRjb250ZXh0PXN5c3RlbV91Om9iamVjdF9yOnVu bGFiZWxlZF90OnMwCiAgICAgICAgICAgICAgICAgICAgICB0Y2xhc3M9ZmlsZSA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JIHN1c3BlY3QgdGhhdCB0aGUK ICAgICAgICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtIGNlcnQgd2FzIHJlbmV3ZWQgYW5kIGV2 ZXJ5dGhpbmcgd2Fzbid0CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgdXBkYXRlZCBwcm9wZXJseS4gSWYgSSdtIHJpZ2h0IHRoaXMgaXMgdW5yZWxh dGVkCiAgICAgICAgICAgICAgICAgICAgICAgIHRvIHRoZSB1cGdyYWRlIGl0IGp1c3QgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBhIHNwb3RsaWdodCBvbiBpdC4gPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIENhbiB5b3Ug cnVuIHRoZXNlIGNvbW1hbmRzOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBt YW5hZ2VyJyAtVwogICAgICAgICAgICAgICAgICAgICAgICAtYiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl CiAgICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgVGhpcyByZXR1cm5zIDxi cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICQgbGRh cHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAg ICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl CiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBkbjog dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJ QkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAuLi4gc3R1ZmYgLi4uIDxicj4K ICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84 ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtD Tj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tT O0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUwogICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv dGUgdHlwZT0iY2l0ZSI+YW5kIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1kIC9ldGMvcGtpL3BraS10b21jYXQv YWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgfCBncmVwIFNlcmlhbCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9h bGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j YScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICBUaGVzZSBib3RoIHJldHVybiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10 b21jYXQvYWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQt cGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBh c3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAgICAgICAgICAg ICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAg ICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lEOiBVbnJlY29nbml6ZWQgT2JqZWN0CiAg ICAgICAgICAgICAgICAgICAgICBJZGVudGlmaWVyLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAj IGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXPCoCAtbgogICAgICAgICAg ICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAg ICAgICAgICAgICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTIENlcnRpZmljYXRlIERC IiBpbgogICAgICAgICAgICAgICAgICAgICAgc2xvdCAiTlNTIFVzZXIgUHJpdmF0ZSBLZXkgYW5k IENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBTZXJ2aWNlcyIgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRl IERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGlu ZyBrZXlzOgogICAgICAgICAgICAgICAgICAgICAgU0VDX0VSUk9SX1VOUkVDT0dOSVpFRF9PSUQ6 IFVucmVjb2duaXplZCBPYmplY3QKICAgICAgICAgICAgICAgICAgICAgIElkZW50aWZpZXIuIDxi cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgeW91IG1hZGUgYSB0eXBvIGFuZCByZXF1ZXN0ZWQgdGhl IGtleXMgKC1LKSBpbnN0ZWFkCiAgICAgICAgICAgICAgICAgICAgb2YgdGhlIGNlcnRzICgtTCku IFBsZWFzZSByZXRyeSB3aXRoIC1MIGFuZCB5b3UKICAgICAgICAgICAgICAgICAgICBzaG91bGQg YmUgYWJsZSB0byBzZWUgdGhlIGNlcnRpZmljYXRlIHNlcmlhbC4gPGJyPgogICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBz ZWFyY2ggLUxMTCAtRAogICAgICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1X IC1iCiAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNl ckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAg ICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICBkbjog dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgIHVz ZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRB TkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgIFpObzRlWDdq TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAg ICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgIEF1 dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFNvIHRoZSBzZXJpYWwgaXMgND8g PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0 bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3Br aS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgY2VydC1w a2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDC oMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpIDxicj4KICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBXaGljaCBpcyBOT1QgNC4uLiA8YnI+CiAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBp YW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScg LWEgPGJyPgogICAgICAgICAgICAgICAgICAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0gPGJy PgpNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZ RFZRUUtEQWxDIDxicj4KICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAg ICAgc2plaUZiVUZ0b01uZm1ITElZcGU1UUFSIDxicj4KICAgICAgICAgICAgICAgICAgLS0tLS1F TkQgQ0VSVElGSUNBVEUtLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgQW5kIHRoaXMgY2VydCBpcyBOT1QgdGhlIHNhbWUuIDxicj4KICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg SGksIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIHdoZW4gY2VydG1v bmdlciByZW5ld3MgYSBjZXJ0aWZpY2F0ZSwgaXQgcnVucyBwcmUtc2F2ZQogICAgICAgICAgICAg ICAgYW5kIHBvc3Qtc2F2ZSBjb21tYW5kcyAod2hpY2ggeW91IGNhbiBzZWUgaW4gdGhlIG91dHB1 dAogICAgICAgICAgICAgICAgb2YgZ2V0Y2VydCBsaXN0KS4gSW4geW91ciBjYXNlLCB0aGUgcG9z dC1zYXZlIGNvbW1hbmQKICAgICAgICAgICAgICAgIGZvciBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtp LWNhIHByb2JhYmx5IGZhaWxlZC4gPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgVGhpcyBjb21tYW5kIChvbiB0aGUgcmVuZXdhbCBtYXN0ZXIpIGlzIHJlc3BvbnNpYmxl IGZvcgogICAgICAgICAgICAgICAgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0aGUgTlNTIGRi IHRvIHRoZSBMREFQIHNlcnZlci4KICAgICAgICAgICAgICAgIFlvdSBuZWVkIGZpcnN0IHRvIGNo ZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMgdGhlIHJlbmV3YWwKICAgICAgICAgICAgICAgIG1hc3Rl ciAoYXMgdGhlIHNlcmlhbCBudW1iZXJzIGFyZSBpbiBhIGNvbXBsZXRlbHkKICAgICAgICAgICAg ICAgIGRpZmZlcmVudCByYW5nZSwgSSBhc3N1bWUgdGhhdCB5b3UgaGF2ZSBtdWx0aXBsZSBJUEEK ICAgICAgICAgICAgICAgIHNlcnZlcnMgY29uZmlndXJlZCB3aXRoIGEgQ0EgaW5zdGFuY2UpOiA8 YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAkIGV4cG9ydCBCQVNFRE49 YGdyZXAgYmFzZWRuIC9ldGMvaXBhL2RlZmF1bHQuY29uZiB8IGN1dAogICAgICAgICAgICAgICAg LWQ9IC1mMi1gIDxicj4KICAgICAgICAgICAgICAgICQga2luaXQgYWRtaW4gPGJyPgogICAgICAg ICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLVEgLWggYGhvc3RuYW1lYCAtcCAzODkgLVkgR1NT QVBJIC1iCiAgICAgICAgICAgICAgICAiY249bWFzdGVycyxjbj1pcGEsY249ZXRjLCRCQVNFRE4i CiAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FSZW5ld2Fs TWFzdGVyKSknIGRuIDxicj4KICAgICAgICAgICAgICAgIGRuOgpjbj1DQSxjbj12bS1pcGFzZXJ2 ZXIuaXBhZG9tYWluLmNvbSxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9aXBhZG9tYWluLGRj PWNvbQogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgSW4gdGhpcyBleGFtcGxlIHRoZSByZW5ld2FsIG1hc3RlciBpcyB2bS1pcGFzZXJ2ZXIu IDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIEkgZ2V0IHRoaXMgPGJyPgogICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtUSAtaCBgaG9zdG5hbWVg IC1wIDM4OSAtWSBHU1NBUEkgLWIKICAgICAgICAgICAgICAiY249bWFzdGVycyxjbj1pcGEsY249 ZXRjLCRCQVNFRE4iCiAgICAgICAgICAgICAgJygmYW1wOyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5n PWNhUmVuZXdhbE1hc3RlcikpJyBkbiA8YnI+CiAgICAgICAgICAgICAgZG46CiAgICAgICAgICAg ICAgY249Q0EsY249ZnJlZWlwYS1zZWEuYnB0LnJvY2tzLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0 YyxkYz1icHQsZGM9cm9ja3MKICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgIFdoaWNoIGlzIHRoZSBvdGhlciBGcmVlSVBBIHNlcnZlci4gPGJyPgogICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBIaSBJ YW4sIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBpdCdzIGdldHRpbmcgZGlmZmlj dWx0IHRvIGZvbGxvdyB0aGlzIHRocmVhZCwgc28gY291bGQgd2UKICAgICAgICAgICAgc3RlcCBi YWNrIGFuZCBzdW1tYXJpemU/IDxicj4KICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg IFllcywgaXQgaXMuwqAgU29ycnkuIDxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPiA8YnI+CiAgICAgICAgICAgIC0gT24gc2VydmVyIGZyZWVpcGEtc2VhICg9cmVuZXdhbCBt YXN0ZXIpLCB0aGUgQ0EgY29tcG9uZW50CiAgICAgICAgICAgIGlzIGluc3RhbGxlZCBhbmQgJ3N1 YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIGhhcyBTZXJpYWwKICAgICAgICAgICAgbnVtYmVyIDQg aW4gdGhlIE5TU0RCIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgTm8/IDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIFty b290QGZyZWVpcGEtc2VhIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgL2V0Yy9wa2kv cGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgfAogICAgICAg ICAgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVt YmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj4tIE9uIHNlcnZlciBzZWF0dGxlbmZzICh3aGVyZSBQS0kKICAgICAgICAgICAg ZmFpbHMgdG8gcmVzdGFydCksIHRoZSBDQSBjb21wb25lbnQgaXMgaW5zdGFsbGVkIGFuZAogICAg ICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgaGFzIFNlcmlhbCBudW1iZXIgMTM0 MTcxODU0MSBpbgogICAgICAgICAgICB0aGUgTlNTREIgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cy4gPGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgWWVzIDxicj4KICAgICAg ICAgIDxicj4KICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1k CiAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0IGNl cnQtcGtpLWNhJyB8CiAgICAgICAgICBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAgICDCoMKgwqDC oMKgwqDCoMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpIDxicj4KICAg ICAgICAgIDxicj4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAg ICAgICAgIC0gSW4gdGhlIExEQVAgc2VydmVycywgdGhlIGNlcnQgaXMgc3RvcmVkIGluIHRoZSBl bnRyeQogICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHdpdGggU2Vy aWFsIG51bWJlciA0IChpLmUuCiAgICAgICAgICAgIGl0IGlzIHRoZSBjZXJ0IGZyb20gZnJlZWlw YS1zZWEpLiA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICBUaGlzIGlzIHdo ZXJlIHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28gY2VydGlmaWNhdGVzCiAgICAg ICAgICBvbiB0aGUgbWFzdGVyIGFuZCBvbmx5IG9uZSBvbiB0aGUgb3RoZXIuwqAgSSB3b25kZXIg aWYgdGhpcyBpcwogICAgICAgICAgYSByZXN1bHQgb2YgdGhlIHNsb3cgbW90aW9uIHJlcGxpY2F0 aW9uIHRyYWlud3JlY2sgSSBoYXZlCiAgICAgICAgICBnb2luZyBvbiBkdWUgdG8gYSB6b21iaWUg cmVwbGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0IG5vCiAgICAgICAgICBsb25nZXIgZXhp c3RzIGluIHRoZSByZWFsIHdvcmxkIGFuZCBJIGNhbid0IHNlZW0gdG8gZ2V0IHJpZAogICAgICAg ICAgb2YuIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg SGksIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgdGhlIHJlbWFpbmluZyBpc3N1ZSBpcyBhIHJl cGxpY2F0aW9uIHByb2JsZW0uIFRoZXJlIGlzIGEKICAgICAgICAiVHJvdWJsZXNob290aW5nIHJl cGxpY2F0aW9uIiBzZWN0aW9uIFsxXSBpbiBJZE0gQWRtaW4gZ3VpZGUKICAgICAgICB0aGF0IG1h eSBoZWxwIHlvdS4gPGJyPgogICAgICAgIDxicj4KICAgICAgICBSZWdhcmRpbmcgeW91ciB6b21i aWUgcmVwbGljYSwgd2hpY2ggY29tbWFuZHMgZGlkIHlvdSB1c2UgdG8gdHJ5CiAgICAgICAgdG8g cmVtb3ZlIGl0LCBhbmQgd2hhdCB3YXMgdGhlIG91dHB1dD8gPGJyPgogICAgICAgIDxicj4KICAg ICAgICBGbG8gPGJyPgogICAgICAgIDxicj4KICAgICAgICBbMV0KICAgICAgICA8YSBjbGFzcz0i bW96LXR4dC1saW5rLWZyZWV0ZXh0IgpocmVmPSJodHRwczovL2FjY2Vzcy5yZWRoYXQuY29tL2Rv Y3VtZW50YXRpb24vZW4tVVMvUmVkX0hhdF9FbnRlcnByaXNlX0xpbnV4LzcvaHRtbC9MaW51eF9E b21haW5fSWRlbnRpdHlfQXV0aGVudGljYXRpb25fYW5kX1BvbGljeV9HdWlkZS90cm91YmxlLWdl bi1yZXBsaWNhdGlvbi5odG1sIgogICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5odHRw czovL2FjY2Vzcy5yZWRoYXQuY29tL2RvY3VtZW50YXRpb24vZW4tVVMvUmVkX0hhdF9FbnRlcnBy aXNlX0xpbnV4LzcvaHRtbC9MaW51eF9Eb21haW5fSWRlbnRpdHlfQXV0aGVudGljYXRpb25fYW5k X1BvbGljeV9HdWlkZS90cm91YmxlLWdlbi1yZXBsaWNhdGlvbi5odG1sPC9hPjxicj4KICAgICAg ICA8YnI+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICBIaSw8YnI+CiAgICAg IDxicj4KICAgICAgVG8gZGVidWcgcmVwbGljYXRpb24gbGF0ZW5jeSBvciBwcm9ibGVtIHdlIHdv dWxkIG5lZWQgc2V2ZXJhbCBpbmZvCiAgICAgIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRz IG9mIHRoZSBmb2xsb3dpbmcgY29tbWFuZHM8YnI+CiAgICAgIDxicj4KICAgICAgW3Jvb3RAZnJl ZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXIn CiAgICAgIC1XIC1iICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3 c2k8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRh cHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgIC1XIC1iICJ1aWQ9cGtp ZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICBFbnRlciBMREFQ IFBhc3N3b3JkOiA8YnI+CiAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxi cj4KICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8 YnI+CiAgICBuc2NwZW50cnl3c2k6CiAgICBlbnRyeXVzbjthZGNzbi01OTM4ZTY4ODAwMDEwNDI5 MDAwNTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNTogPGJyPgogICAgwqA3NTI3NDg5Nzxicj4K ICAgIG5zY3BlbnRyeXdzaToKICAgIG1vZGlmeVRpbWVzdGFtcDthZGNzbi01OTM4ZTY4ODAwMDEw NDI5MDAwNDt2dWNzbi01OTM4ZTY4ODAwMDEwNDI8YnI+CiAgICDCoDkwMDA0OiAyMDE3MDYwODA1 NTMzNFo8YnI+CiAgICBuc2NwZW50cnl3c2k6CiAgICBtb2RpZmllcnNOYW1lO2FkY3NuLTU5Mzhl Njg4MDAwMTA0MjkwMDAzO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwPGJyPgogICAgwqAwMDM6IGNu PURpcmVjdG9yeSBNYW5hZ2VyPGJyPgogICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgw OWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgIG5zY3BlbnRyeXdzaTogY246 IHBraWRidXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogY3JlYXRlVGltZXN0YW1wOiAyMDE1MDcx NjEyNTE0Nlo8YnI+CiAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5 IG1hbmFnZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uO3Z1Y3NuLTU5MzhlNjg4 MDAwMTA0MjkwMDAxOgogICAgMjsxMzQxNzE4NTQxO0NOPUNlcnRpZmljPGJyPgogICAgwqBhdGUg QXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAg IG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVs ZXRlZDoKICAgIDI7NDtDTj1DZXJ0aWZpY2E8YnI+CiAgICDCoHRlIEF1dGhvcml0eSxPPUJQVC5S T0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICBuc2NwZW50cnl3c2k6IG1h aWw6PGJyPgogICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogdG9wPGJyPgogICAgbnNjcGVu dHJ5d3NpOiBvYmplY3RDbGFzczogcGVyc29uPGJyPgogICAgbnNjcGVudHJ5d3NpOiBvYmplY3RD bGFzczogb3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENs YXNzOiBpbmV0T3JnUGVyc29uPGJyPgogICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21z dXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBU LlJPQ0tTPGJyPgogICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJyPgogICAgbnNjcGVu dHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmlj YXRlOjoKICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8 YnI+CiAgICAmbHQ7c25pcCZndDs8YnI+CiAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhB YTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgIG5zY3BlbnRyeXdzaTog dXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAgIE1JSURiakND QWxhZ0F3SUJBZ0k8YnI+CiAgICAmbHQ7c25pcCZndDs8YnI+CiAgICDCoEFSPGJyPgogICAgbnNj cGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICBuc2NwZW50cnl3 c2k6IHVzZXJzdGF0ZTogMTxicj4KICAgIG5zY3BlbnRyeXdzaTogdXNlcnR5cGU6IGFnZW50VHlw ZTxicj4KICAgIG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICBuc2NwZW50cnl3c2k6 IGVudHJ5aWQ6IDUxPGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5 ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IGFuZDxicj4KICAgICAgW3Jvb3RAc2VhdHRsZW5m cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgICAg LVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAg ICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFw c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVwogICAgLWIgdWlkPXBraWRi dXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAgICBFbnRlciBMREFQIFBh c3N3b3JkOiA8YnI+CiAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4K ICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+ CiAgICBuc2NwZW50cnl3c2k6IHNlZUFsc286IENOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxi cj4KICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgIE1JSURjekNDQWx1Z0F3 SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAmbHQ7c25pcCZndDs8YnI+ CiAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhk ZkFQWE1Kb0ZjPTxicj4KICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0 aWZpY2F0ZQogICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnM8YnI+CiAgICDCoHlz dGVtLE89QlBULlJPQ0tTPGJyPgogICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAg IG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICBuc2NwZW50cnl3c2k6IG1vZGlmeVRp bWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgIG5zY3BlbnRyeXdzaTogbW9kaWZpZXJzTmFt ZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFt ZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29y ZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgog ICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgbnNjcGVudHJ5d3Np OiBtYWlsOjxicj4KICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNlcjxicj4KICAgIG5zY3Bl bnRyeXdzaTogc246IHBraWRidXNlcjxicj4KICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVz ZXI8YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICBuc2NwZW50 cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENs YXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxicj4KICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xh c3M6IGluZXRPcmdQZXJzb248YnI+CiAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1 c2VyPGJyPgogICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05 NmEwYjhiOC0xZmRkODA3NDxicj4KICAgIG5zY3BlbnRyeXdzaTogZW50cnl1c246IDg2PGJyPgog ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVk aGF0LmNvbSI+IDxicj4KICAgICAgRnJvbSB0aGUgb3V0cHV0IHlvdSBtYXkgb25seSBjb3B5L3Bh c3QgdGhlIG9uZXMgcmVsYXRlZCB0bwogICAgICB1c2VyQ2VydGlmaWNhdGU8YnI+CiAgICAgIDxi cj4KICAgICAgPGJyPgogICAgICBBbHNvIHRvIGR1bXAgdGhlIGN1cnJlbnQgcmVwbGljYXRpb24g c3RhdHVzLCBzZW5kIHRoZSByZXN1bHTCoCBvZjxicj4KICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEg aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInCiAgICAgIC1X IC1iICJvPWlwYWNhIjxmb250IHNpemU9Ii0xIj48aT4gPC9pPiIoJmFtcDsob2JqZWN0Y2xhc3M9 bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm ZmYpKSI8YnI+CiAgICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICBbcm9vdEBmcmVlaXBhLXNl YSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgIC1X IC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlk PWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgRW50ZXIgTERB UCBQYXNzd29yZDogPGJyPgogICAgZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBp bmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICBjbjogcmVwbGljYTxicj4KICAgIG5zRFM1RmxhZ3M6 IDE8YnI+CiAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAg IGNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9jPGJyPgogICAgwqBrcy1wa2ktdG9t Y2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgbnNEUzVSZXBsaWNhQmluZEROOiBjbj1S ZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJv Yzxicj4KICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgIG5z RFM1UmVwbGljYUlkOiAxMDY1PGJyPgogICAgbnNEUzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3 OTExZTYtOTNlNmVmNGItNjlkY2MyZDE8YnI+CiAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNh PGJyPgogICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgIG5zU3RhdGU6OiBLUVFBQUFBQUFB QWhISXBaQUFBQUFBRUFBQUFBQUFBQUtnQUFBQUFBQUFBQkFBQUFBQUFBQUE9PTxicj4KICAgIG5z ZHM1cmVwbGljYWJpbmRkbmdyb3VwOiBjbj1yZXBsaWNhdGlvbgogICAgbWFuYWdlcnMsY249c3lz YWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICDCoGRjPXJvY2tzPGJyPgogICAgbnNkczVy ZXBsaWNhYmluZGRuZ3JvdXBjaGVja2ludGVydmFsOiA2MDxicj4KICAgIG9iamVjdENsYXNzOiB0 b3A8YnI+CiAgICBvYmplY3RDbGFzczogbnNEUzVSZXBsaWNhPGJyPgogICAgb2JqZWN0Q2xhc3M6 IGV4dGVuc2libGVvYmplY3Q8YnI+CiAgICBuc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0g NTdjMjkxZDkwMDAwMDQyOTAwMDA8YnI+CiAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEg Y2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJw dC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgIDU3 Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICDCoDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8YnI+CiAg ICBuc2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4 dCIgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVu ZnMuYnB0LnJvY2tzOjM4OTwvYT59PGJyPgogICAgbnNkczVhZ210bWF4Y3NuOgogICAgbz1pcGFj YTtjbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0LnJvY2tzLXBraS10b21jYXQ7c2VhdDxi cj4KICAgIMKgdGxlbmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICBuc2RzNWFn bXRtYXhjc246CiAgICBvPWlwYWNhO21hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9j a3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1bmF2YWls YWJsZTxicj4KICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAg PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh LmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0gNTk4 YTxicj4KICAgIMKgMWMxNjxicj4KICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxp Y2EgMTI5MAogICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDov L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4 OTwvYT59IDAwMDAwPGJyPgogICAgwqAwMDA8YnI+CiAgICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3Vu dDogODg1PGJyPgogICAgbnNkczVyZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgIDxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPjxm b250CiAgICAgICAgc2l6ZT0iLTEiPiBhbmQ8YnI+CiAgICAgIDwvZm9udD5bcm9vdEBzZWF0dGxl bmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICBtYW5hZ2Vy JyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+IDwvaT4iKCZhbXA7KG9iamVjdGNs YXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZm ZmZmZmZmKSkiPGJyPgogICAgICA8L2ZvbnQ+PC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgPGJy PgogICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJl Y3RvcnkgbWFuYWdlcicgLVcKICAgIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5z dG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZm KSkiPGJyPgogICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgZG46IGNuPXJlcGxpY2Es Y249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICBjbjogcmVwbGlj YTxicj4KICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJl cGxpY2F0aW9uIE1hbmFnZXIKICAgIGNsb25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nr PGJyPgogICAgwqBzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1jb25maWc8YnI+CiAgICBuc0RT NVJlcGxpY2FJZDogMTI5MDxicj4KICAgIG5zRFM1UmVwbGljYU5hbWU6IDg3MDZhYjFlLTZhODMx MWU2LWE5YmZkYmJmLTc0ZGM3MzIzPGJyPgogICAgbnNEUzVSZXBsaWNhUm9vdDogbz1pcGFjYTxi cj4KICAgIG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICBuc1N0YXRlOjogQ2dVQUFBQUFBQUFL RllwWkFBQUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICBuc2Rz NXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAgIG1hbmFnZXJzLGNuPXN5c2Fj Y291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAgwqBkYz1yb2Nrczxicj4KICAgIG5zZHM1cmVw bGljYWJpbmRkbmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICBvYmplY3RDbGFzczogdG9w PGJyPgogICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgIG9iamVjdENsYXNzOiBl eHRlbnNpYmxlb2JqZWN0PGJyPgogICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU1 YzhmM2FlMDAwMDAwNjAwMDAwPGJyPgogICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y b2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgNTdiZTgw NGMwMDAwMDUwYTAwMDA8YnI+CiAgICDCoCA1ODcyMzYxNTAwMDAwNTBhMDAwMDxicj4KICAgIG5z ZHM1MHJ1djoge3JlcGxpY2EgMTA2NSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBo cmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2Vh LmJwdC5yb2NrczozODk8L2E+fQogICAgNTdiMTAzZDQwMDAwMDQyOTAwMDxicj4KICAgIMKgMCA1 N2JlODA0MzAwMDcwNDI5MDAwMDxicj4KICAgIG5zZHM1YWdtdG1heGNzbjoKICAgIG89aXBhY2E7 Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ7ZnJlZWk8YnI+ CiAgICDCoHBhLXNlYS5icHQucm9ja3M7Mzg5OzEwNjU7NTg3MjM2MTUwMDAwMDUwYTAwMDA8YnI+ CiAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAKICAgIDxhIGNsYXNz PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2Nr czozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fSAwMDAwMDxicj4KICAg IMKgMDAwPGJyPgogICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1CiAg ICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1z ZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fSAw MDAwPGJyPgogICAgwqAwMDAwPGJyPgogICAgbnNkczVSZXBsaWNhQ2hhbmdlQ291bnQ6IDM8YnI+ CiAgICBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAgICAg ICBzaXplPSItMSI+IDxicj4KICAgICAgICBSZWdhcmRzPGJyPgogICAgICAgIHRoaWVycnk8YnI+ CiAgICAgIDwvZm9udD4KICAgICAgPGJsb2NrcXVvdGUKICAgICAgICBjaXRlPSJtaWQ6MzMxZWZi NjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAgICAgdHlwZT0i Y2l0ZSI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3Jvb3RAZnJlZWlwYS1zZWEg aWFuaF0jIGxkYXBzZWFyY2ggLUxMTAogICAgICAgICAgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2Vy JyAtVyAtYgogICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2Vy dGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDog PGJyPgogICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgog ICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lC QkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQyA8YnI+CiAgICAgICAgICDC oCAmbHQ7dHJ1bmNhdGVkJmd0OyA8YnI+CiAgICAgICAgICDCoCBaTm80ZVg3ak5UOEFhMjNnRGw2 eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0 ZTo6CiAgICAgICAgICBNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFz RkFEQTBNUkl3RUFZRFZRUUsgPGJyPgogICAgICAgICAgJmx0O3RydW5jYXRlZCZndDsgZnVRUVpt UDFYcktrcmZzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgZGVzY3JpcHRp b246IDI7MTM0MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgQXV0aG9yaXR5LE89QlBU LlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+CiAgICAgICAgICDCoCAsTz1CUFQuUk9DS1MgPGJy PgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgW3Jvb3RAc2VhdHRsZW5m cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgIG1hbmFn ZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl CiAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3Jk OiA8YnI+CiAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+ CiAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFn SUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDIDxicj4KICAgICAgICAg IMKgICZsdDt0cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dE bDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgZGVzY3JpcHRpb246 IDI7NDtDTj1DZXJ0aWZpY2F0ZSBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EKICAgICAgICAg IFN1YnN5c3RlbSxPPUJQVC5STyA8YnI+CiAgICAgICAgICDCoCBDS1MgPGJyPgogICAgICAgICAg PGJyPgogICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWYgeW91IGNoZWNrIHRoZSBj ZXJ0aWZpY2F0ZXMgZGF0ZXMsIEkKICAgICAgICAgICAgZ3Vlc3MgdGhhdCB0aGUgbW9zdCByZWNl bnQgb25lIGlzIG9uIHNlcnZlciBzZWF0dGxlbmZzCiAgICAgICAgICAgIChiZWNhdXNlIG9mIHNl cmlhbCBudW1iZXJzKS4gQ2FuIHlvdSBjb25maXJtIHRoaXMgKGJlY2F1c2UKICAgICAgICAgICAg b3VyIGdvYWwgaXMgdG8gaGF2ZSB0aGUgbW9zdCByZWNlbnQgY2VydCBzdG9yZWQgaW4gYWxsIHRo ZQogICAgICAgICAgICBOU1NEQnMgYW5kIGluIExEQVApPyA8YnI+CiAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgVGhhbmtzLCA8YnI+CiAgICAgICAgICAgIEZsbyA8YnI+CiAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3VyIHJlbmV3YWwg bWFzdGVyIGlzIHRoZQogICAgICAgICAgICAgICAgbWFjaGluZSBvbiB3aGljaCB0aGUgTlNTIERC IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgIGNvbnRhaW5zIHRoZSBu ZXdlciBjZXJ0LCB0aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZQogICAgICAgICAgICAgICAg c2NyaXB0czogPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgSWYgSSdtIGludGVycHJldGluZyB0aGlzIGNvcnJlY3RseSwgdGhl biBpdCBpcy4uLiBzbyBJIHJhbgogICAgICAgICAgICAgIHRoaXMgb24gdGhlIGJyb2tlbiBtYWNo aW5lIChzZWF0dGxlbmZzKSA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPiQgc3VkbwogICAgICAgICAgICAgICAgL3Vzci9saWJleGVj L2lwYS9jZXJ0bW9uZ2VyL3N0b3BfcGtpY2FkIDxicj4KICAgICAgICAgICAgICAgICQgc3VkbyAv dXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAg InN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg IEkgcmFuIHRoaXMsIGl0IHRvb2sgYSB3aGlsZSwgdGhlbiBJIHJlLWNoZWNrZWQgYW5kIHRoZQog ICAgICAgICAgICAgIHNlcmlhbCBzdGlsbCBzZWVtcyB0byBiZSA0IDxicj4KICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBt YW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBh Y2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAg ICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICBkbjogdWlkPXBr aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgdXNlckNlcnRpZmlj YXRlOjoKICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJB UXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg Li4uIDxicj4KICAgICAgICAgICAgICDCoCBaTm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4 WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAgICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNl cnRpZmljYXRlCiAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5 c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIEhl cmUncyB3aGF0IHdhcyBpbiAvdmFyL2xvZy9wa2kvcGtpLXRvbWNhdC9jYS9kZWJ1ZyA8YnI+CiAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICA9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiA9PT09PcKgCiAgICAgICAgICAgICAgREVC VUcgU1VCU1lTVEVNIElOSVRJQUxJWkVEwqDCoCA9PT09PT09IDxicj4KICAgICAgICAgICAgICBb MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg ICAgPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0gPGJyPgogICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTog Q01TRW5naW5lOgogICAgICAgICAgICAgIHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8 YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRT dG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYXV0b1NodXRkb3duIGNydW1iIGZpbGUg cGF0aD8KICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0 ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYWJvdXQgdG8gbG9v ayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgIHN1cHBvcnQ6YXVkaXRT aWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAg Zm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAg ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2lu ZToKICAgICAgICAgICAgICBkb25lIGluaXQgaWQ9ZGVidWcgPGJyPgogICAgICAgICAgICAgIFsw My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgog ICAgICAgICAgICAgIGluaXRpYWxpemVkIGRlYnVnIDxicj4KICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAg ICAgICAgICBpbml0U3Vic3lzdGVtIGlkPWxvZyA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAg ICAgICAgcmVhZHkgdG8gaW5pdCBpZD1sb2cgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ3JlYXRpbmcKICAgICAgICAgICAg ICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2NhL3NpZ25lZEF1 ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENyZWF0aW5nCiAgICAgICAgICAg ICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9zeXN0ZW0p IDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06IENyZWF0aW5nCiAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIv cGtpL3BraS10b21jYXQvbG9ncy9jYS90cmFuc2FjdGlvbnMpCiAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XTogQ01TRW5naW5lOgogICAgICAgICAgICAgIHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxz ZSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3Rh cnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYXV0b1NodXRkb3duIGNydW1iIGZp bGUgcGF0aD8KICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9T aHV0ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgYWJvdXQgdG8g bG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgIHN1cHBvcnQ6YXVk aXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3 OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAg ICAgZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0Vu Z2luZToKICAgICAgICAgICAgICBkb25lIGluaXQgaWQ9bG9nIDxicj4KICAgICAgICAgICAgICBb MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToK ICAgICAgICAgICAgICBpbml0aWFsaXplZCBsb2cgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAg ICAgICAgIGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAg ICAgICByZWFkeSB0byBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3 OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAg ICAgcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4KICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENNU0VuZ2luZToKICAg ICAgICAgICAgICBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgIC92 YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iIDxicj4KICAgICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENN U0VuZ2luZToKICAgICAgICAgICAgICBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNo dXRkb3duCiAgICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh IDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06IENNU0VuZ2luZToKICAgICAgICAgICAgICBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmlu Z0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICAgIGRvbmUg aW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j YWxob3N0LXN0YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICAgIGluaXRpYWxpemVk IGpzcyA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOiBDTVNFbmdpbmU6CiAgICAgICAgICAgICAgaW5pdFN1YnN5c3RlbSBpZD1k YnMgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0 YXJ0U3RvcC0xXTogQ01TRW5naW5lOgogICAgICAgICAgICAgIHJlYWR5IHRvIGluaXQgaWQ9ZGJz IDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06CiAgICAgICAgICAgICAgREJTdWJzeXN0ZW06IGluaXQoKSBtRW5hYmxlU2VyaWFs TWdtdD10cnVlIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs aG9zdC1zdGFydFN0b3AtMV06IENyZWF0aW5nCiAgICAgICAgICAgICAgTGRhcEJvdW5kQ29ubkZh Y3RvcihEQlN1YnN5c3RlbSkgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFj dG9yeTogaW5pdCA8YnI+CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3J5OmRv Q2xvbmluZyB0cnVlIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBpbml0KCkg PGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0 U3RvcC0xXToKICAgICAgICAgICAgICBMZGFwQXV0aEluZm86IGluaXQgYmVnaW5zIDxicj4KICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 CiAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBpbml0IGVuZHMgPGJyPgogICAgICAgICAgICAg IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogaW5pdDoKICAg ICAgICAgICAgICBiZWZvcmUgbWFrZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+ CiAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVlIDxicj4K ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06IFRDUAogICAgICAgICAgICAgIEtlZXAtQWxpdmU6IHRydWUgPGJyPgogICAgICAgICAgICAg IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg ICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nIGRlc2lyZWQgY2Vy dAogICAgICAgICAgICAgIG5pY2tuYW1lIHRvOiBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxi cj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0 b3AtMV06CiAgICAgICAgICAgICAgTGRhcEpzc1NTTFNvY2tldDogc2V0IGNsaWVudCBhdXRoIGNl cnQgbmlja25hbWUKICAgICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4K ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRlcmlu ZyEgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0 YXJ0U3RvcC0xXTogQ2FuZGlkYXRlCiAgICAgICAgICAgICAgY2VydDogb2NzcFNpZ25pbmdDZXJ0 IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06IENhbmRpZGF0ZQogICAgICAgICAgICAgIGNlcnQ6IHN1YnN5 c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0 aWZpY2F0ZVNlbGVjdGlvbkNCOiBkZXNpcmVkIGNlcnQgZm91bmQgaW4KICAgICAgICAgICAgICBs aXN0OiBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgU1NM Q2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJuaW5nOiBzdWJzeXN0ZW1DZXJ0CiAg ICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogU1NMCiAgICAgICAgICAgICAgaGFuZHNo YWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgQ01TRW5naW5lLnNodXRkb3duKCkg PGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg SSByZWFsbHkgYXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoIHRoaXMuwqAg SQogICAgICAgICAgICAgIG93ZSB5b3UuIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgLSBJYW4gPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8YmxvY2tx dW90ZSB0eXBlPSJjaXRlIj5BZnRlciB0aGF0LCBjaGVjayB0aGF0IHRoZSBMREFQCiAgICAgICAg ICAgICAgICBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUgY2FzZSwgeW91IHNo b3VsZCBiZQogICAgICAgICAgICAgICAgYWJsZSB0byByZXN0YXJ0IHBraS4gPGJyPgogICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoYW5rIHlvdSBhZ2Fp biBmb3IgeW91ciB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgSWFuIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8 YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgd2hpY2ggc2Vl bXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoZSBkZXNjcmlwdGlvbiBhdHRyaWJ1dGUK ICAgICAgICAgICAgICAgICAgICAgICAgaW4gdGhlIGxkYXBzZWFyY2ggb3V0cHV0IGlzIG9mIHRo ZSBmb3JtCiAgICAgICAgICAgICAgICAgICAgICAgIDI7IztETjtETiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1h dGNoIHRoZSBzZXJpYWwgbnVtYmVyIGluIHRoZQogICAgICAgICAgICAgICAgICAgICAgICBmaXJz dCBjZXJ0dXRpbCBvdXRwdXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5EIGhl YWRlcnMpCiAgICAgICAgICAgICAgICAgICAgICAgIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGF0dHJpYnV0ZXMuIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBy b2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICBGcmVl SVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1s aW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0Bs aXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi PmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgIDxicj4K ICAgICAgICAgIFRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEKICAgICAgICAgICAg Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgaHJlZj0ibWFpbHRv OmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmc8L2E+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4KICAg ICAgICBGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgY2xhc3M9Im1v ei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVz ZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRy dWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICA8YnI+ CiAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgY2xh c3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVl aXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICBtb3otZG8t bm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZzwvYT4KICAgICAgICA8YnI+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgPC9i bG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============5624228806415025913==-- From tbordaz at redhat.com Wed Aug 9 10:06:40 2017 Content-Type: multipart/mixed; boundary="===============8600127386348226288==" MIME-Version: 1.0 From: thierry bordaz To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Wed, 09 Aug 2017 12:05:51 +0200 Message-ID: <598ADE7F.3080308@redhat.com> In-Reply-To: 2f60c4af-680c-4382-9704-41a24c8121a2@brownpapertickets.com --===============8600127386348226288== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Ian, Thanks for having gather those data. # # So pkidbuser entries have a same (old) userCertificate likely generated during install # But only freeipa-sea has a new one created on freeipa-sea around Jun 8th 2017 05:54:16 # This recent certificate is identified by 5938e688000104290000 # [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca ... nscpentrywsi: userCertificate:: MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: MIIDbjCCAlagAwIBAgI [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi: userCertificate:: MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR # # why 5938e688000104290000 value was not propagated to seattlenfs ? # The most recent update (from freeipa-sea) that was replicated to seattlenfs # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07). # In addition seattlenfs received direct update (last one was in Jan 1017) that were not # replicated to freeipa-sea # # The two servers have diverged because they can not replicate to eachother because # they were not correctly initialize. # They have different "replicageneration" (57c291d9000004290000 vs 55c8f3ae000000600000) # # It is looking like freeipa-sea was created one or two years ago and used to initialized seattlenfs. # But later freeipa-sea was recreated. # [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b "o=3Dipaca" "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-= ffffffff))" Enter LDAP Password: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nsds50ruv: {replicageneration} 57c291d9000004290000 nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} 57f840bf000004290000 598a1c40000104290000 nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} nsruvReplicaLastModified: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} 598a1c16 nsruvReplicaLastModified: {replica 1290 ldap://seattlenfs.bpt.rocks:389} 00000000 [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b "o=3Dipaca" "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-= ffffffff))" dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nsds50ruv: {replicageneration} 55c8f3ae000000600000 nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} 57b103d4000004290000 57be8043000704290000 nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} 57be804c0000050a0000 587236150000050a0000 nsruvReplicaLastModified: {replica 1290 ldap://seattlenfs.bpt.rocks:389} 00000000 nsruvReplicaLastModified: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} 00000000 In conclusion: From replication pov, the two instances can not communicate. One solution would be to identify which instance is the good one, = you want to keep. and reinit the second one from that reference. On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote: > > On 8/7/17 1:44 AM, thierry bordaz wrote: > >> >> >> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote: >>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>>> >>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>>> Ian Harding wrote: >>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users = >>>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that had = >>>>>>>>>>>>>>>>>> apparently had >>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can = >>>>>>>>>>>>>>>>> run without >>>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see = >>>>>>>>>>>>>>>>> what is going on. >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication = >>>>>>>>>>>>>>>> failed (49) >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and = >>>>>>>>>>>>>>> needs to >>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind DN = >>>>>>>>>>>>>>> and >>>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> I found this: >>>>>>>>>>>>>> >>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o= =3Dipaca >>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>>> ... >>>>>>>>>>>>>> >>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a = >>>>>>>>>>>>>> prompt to provide >>>>>>>>>>>>>> a pin/password >>>>>>>>>>>>>> >>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>>> >>>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>>> >>>>>>>>>>>>> Hi, >>>>>>>>>>>>> >>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>>>> password can be >>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with = >>>>>>>>>>>>> the tag >>>>>>>>>>>>> internal=3D...) >>>>>>>>>>>>> >>>>>>>>>>>>> Can you check if the password with the tag internal=3D... = >>>>>>>>>>>>> allows to read >>>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>> (provide password) >>>>>>>>>>>> >>>>>>>>>>>> That works... >>>>>>>>>>>> >>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>>>> User Private >>>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>>> Certificate >>>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>>>>>>>> caSigningCert >>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>>> Certificate >>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>>> Certificate >>>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>>> >>>>>>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>>>>>> >>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>> EXTERNAL >>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>>> >>>>>>>>>>>> That password is getting me somewhere though, since if I = >>>>>>>>>>>> put in a >>>>>>>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>>>>>>> >>>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>>> >>>>>>>>>> There wasn't much of a change... I just assumed someone ran = >>>>>>>>>> yum upgrade and didn't restart, then the power outage... it = >>>>>>>>>> looks like not much of a version change though. >>>>>>>>>> >>>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>>> Jul 28 09:55:41 Updated: ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:46 Updated: ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>> Jul 28 09:55:48 Updated: ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>>> >>>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>>> >>>>>>>>>> # getenforce >>>>>>>>>> Enforcing >>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> If so can you run: >>>>>>>>>>> >>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> # ausearch -m AVC >>>>>>>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>>>>>>> write_logs option. >>>>>>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>>>>>> ---- >>>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc000003= e = >>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 a= 2=3D1 = >>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D42949= 67295 = >>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 = >>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) = >>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { read = >>>>>>>>>> } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" dev=3D"= dm-2" = >>>>>>>>>> ino=3D116393517 = >>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>> I suspect that the subsystem cert was renewed and everything = >>>>>>>>>>> wasn't >>>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>>> upgrade it just >>>>>>>>>>> shone a spotlight on it. >>>>>>>>>>> >>>>>>>>>>> Can you run these commands: >>>>>>>>>>> >>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti= on >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> This returns >>>>>>>>>> >>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>>>> Enter LDAP Password: >>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>> userCertificate:: = >>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>> ... stuff ... >>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC= A = >>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>> >>>>>>>>>>> and >>>>>>>>>>> >>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>>>> cert-pki-ca' -a >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> These both return >>>>>>>>>> >>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>>> Unrecognized Object Identifier. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>>> cert-pki-ca' -a >>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>> User Private Key and Certificate Services" >>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>>> Unrecognized Object Identifier. >>>>>>>>>> >>>>>>>>> Hi, >>>>>>>>> >>>>>>>>> you made a typo and requested the keys (-K) instead of the = >>>>>>>>> certs (-L). Please retry with -L and you should be able to see = >>>>>>>>> the certificate serial. >>>>>>>>> >>>>>>>> >>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertifica= te = >>>>>>>> description >>>>>>>> Enter LDAP Password: >>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>> userCertificate:: = >>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>> ... >>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>> >>>>>>>> So the serial is 4? >>>>>>>> >>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep = >>>>>>>> Serial >>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>> >>>>>>>> Which is NOT 4... >>>>>>>> >>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a >>>>>>>> -----BEGIN CERTIFICATE----- >>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>> ... >>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>> -----END CERTIFICATE----- >>>>>>>> >>>>>>>> And this cert is NOT the same. >>>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>>> post-save commands (which you can see in the output of getcert = >>>>>>> list). In your case, the post-save command for subsystemCert = >>>>>>> cert-pki-ca probably failed. >>>>>>> >>>>>>> This command (on the renewal master) is responsible for copying = >>>>>>> the new cert from the NSS db to the LDAP server. You need first = >>>>>>> to check which IPA server is the renewal master (as the serial = >>>>>>> numbers are in a completely different range, I assume that you = >>>>>>> have multiple IPA servers configured with a CA instance): >>>>>>> >>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -f= 2-` >>>>>>> $ kinit admin >>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>> dn: = >>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn=3D= etc,dc=3Dipadomain,dc=3Dcom = >>>>>>> >>>>>>> >>>>>>> In this example the renewal master is vm-ipaserver. >>>>>>> >>>>>> >>>>>> I get this >>>>>> >>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>> dn: = >>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,dc= =3Dbpt,dc=3Drocks = >>>>>> >>>>>> >>>>>> Which is the other FreeIPA server. >>>>>> >>>>> Hi Ian, >>>>> >>>>> it's getting difficult to follow this thread, so could we step = >>>>> back and summarize? >>>> Yes, it is. Sorry. >>>>> >>>>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in = >>>>> the NSSDB /etc/pki/pki-tomcat/alias >>>> No? >>>> >>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>> Serial Number: 1341718541 (0x4ff9000d) >>>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>>> component is installed and 'subsystemCert cert-pki-ca' has Serial = >>>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>>> Yes >>>> >>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>> 'subsystemCert cert-pki-ca' | grep Serial >>>> Serial Number: 1341718541 (0x4ff9000d) >>>> >>>>> >>>>> - In the LDAP servers, the cert is stored in the entry = >>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it i= s = >>>>> the cert from freeipa-sea). >>>> This is where the difference is. There are two certificates on the = >>>> master and only one on the other. I wonder if this is a result of = >>>> the slow motion replication trainwreck I have going on due to a = >>>> zombie replica in the ldap database that no longer exists in the = >>>> real world and I can't seem to get rid of. >>>> >>> Hi, >>> >>> the remaining issue is a replication problem. There is a = >>> "Troubleshooting replication" section [1] in IdM Admin guide that = >>> may help you. >>> >>> Regarding your zombie replica, which commands did you use to try to = >>> remove it, and what was the output? >>> >>> Flo >>> >>> [1] = >>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/= 7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-re= plication.html >>> >> >> Hi, >> >> To debug replication latency or problem we would need several info = >> but starting with the results of the following commands >> >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >> -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > nscpentrywsi: = > entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: > 75274897 > nscpentrywsi: = > modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 > 90004: 20170608055334Z > nscpentrywsi: = > modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 > 003: cn=3DDirectory Manager > nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 > nscpentrywsi: cn: pkidbuser > nscpentrywsi: createTimestamp: 20150716125146Z > nscpentrywsi: creatorsName: cn=3Ddirectory manager > nscpentrywsi: description;vucsn-5938e688000104290001: = > 2;1341718541;CN=3DCertific > ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS > nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = > 2;4;CN=3DCertifica > te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS > nscpentrywsi: mail: > nscpentrywsi: objectClass: top > nscpentrywsi: objectClass: person > nscpentrywsi: objectClass: organizationalPerson > nscpentrywsi: objectClass: inetOrgPerson > nscpentrywsi: objectClass: cmsuser > nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS > nscpentrywsi: sn: pkidbuser > nscpentrywsi: uid: pkidbuser > nscpentrywsi: userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR > > cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = > MIIDbjCCAlagAwIBAgI > > AR > nscpentrywsi: userPassword:: > nscpentrywsi: userstate: 1 > nscpentrywsi: usertype: agentType > nscpentrywsi: parentid: 2 > nscpentrywsi: entryid: 51 >> and >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi > > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi > Enter LDAP Password: > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS > nscpentrywsi: userCertificate:: = > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR > > cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D > nscpentrywsi: description: 2;4;CN=3DCertificate = > Authority,O=3DBPT.ROCKS;CN=3DCA Subs > ystem,O=3DBPT.ROCKS > nscpentrywsi: entryid: 51 > nscpentrywsi: parentid: 2 > nscpentrywsi: modifyTimestamp: 20150716125146Z > nscpentrywsi: createTimestamp: 20150716125146Z > nscpentrywsi: modifiersName: cn=3Ddirectory manager > nscpentrywsi: creatorsName: cn=3Ddirectory manager > nscpentrywsi: userPassword:: > nscpentrywsi: userstate: 1 > nscpentrywsi: usertype: agentType > nscpentrywsi: mail: > nscpentrywsi: cn: pkidbuser > nscpentrywsi: sn: pkidbuser > nscpentrywsi: uid: pkidbuser > nscpentrywsi: objectClass: top > nscpentrywsi: objectClass: person > nscpentrywsi: objectClass: organizationalPerson > nscpentrywsi: objectClass: inetOrgPerson > nscpentrywsi: objectClass: cmsuser > nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 > nscpentrywsi: entryusn: 86 >> >> From the output you may only copy/past the ones related to = >> userCertificate >> >> >> Also to dump the current replication status, send the result of >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >> -b = >> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffff= ff-ffffffff-ffffffff))" > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "o=3Dipaca" = > "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ff= ffffff))" > Enter LDAP Password: > dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig > cn: replica > nsDS5Flags: 1 > nsDS5ReplicaBindDN: cn=3DReplication Manager = > cloneAgreement1-freeipa-sea.bpt.roc > ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig > nsDS5ReplicaBindDN: cn=3DReplication Manager = > masterAgreement1-seattlenfs.bpt.roc > ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig > nsDS5ReplicaId: 1065 > nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 > nsDS5ReplicaRoot: o=3Dipaca > nsDS5ReplicaType: 3 > nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D > nsds5replicabinddngroup: cn=3Dreplication = > managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, > dc=3Drocks > nsds5replicabinddngroupcheckinterval: 60 > objectClass: top > objectClass: nsDS5Replica > objectClass: extensibleobject > nsds50ruv: {replicageneration} 57c291d9000004290000 > nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = > 57f840bf00000429000 > 0 598a1c40000104290000 > nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} > nsds5agmtmaxcsn: = > o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat > tlenfs.bpt.rocks;389;unavailable > nsds5agmtmaxcsn: = > o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat > tlenfs.bpt.rocks;389;unavailable > nsruvReplicaLastModified: {replica 1065 = > ldap://freeipa-sea.bpt.rocks:389} 598a > 1c16 > nsruvReplicaLastModified: {replica 1290 = > ldap://seattlenfs.bpt.rocks:389} 00000 > 000 > nsds5ReplicaChangeCount: 885 > nsds5replicareapactive: 0 >> and >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b = >> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffff= ff-ffffffff-ffffffff))" > > > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "o=3Dipaca" = > "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-ff= ffffff))" > Enter LDAP Password: > dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig > cn: replica > nsDS5Flags: 1 > nsDS5ReplicaBindDN: cn=3DReplication Manager = > cloneAgreement1-seattlenfs.bpt.rock > s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig > nsDS5ReplicaId: 1290 > nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 > nsDS5ReplicaRoot: o=3Dipaca > nsDS5ReplicaType: 3 > nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D > nsds5replicabinddngroup: cn=3Dreplication = > managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, > dc=3Drocks > nsds5replicabinddngroupcheckinterval: 60 > objectClass: top > objectClass: nsDS5Replica > objectClass: extensibleobject > nsds50ruv: {replicageneration} 55c8f3ae000000600000 > nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = > 57be804c0000050a0000 > 587236150000050a0000 > nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = > 57b103d400000429000 > 0 57be8043000704290000 > nsds5agmtmaxcsn: = > o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei > pa-sea.bpt.rocks;389;1065;587236150000050a0000 > nsruvReplicaLastModified: {replica 1290 = > ldap://seattlenfs.bpt.rocks:389} 00000 > 000 > nsruvReplicaLastModified: {replica 1065 = > ldap://freeipa-sea.bpt.rocks:389} 0000 > 0000 > nsds5ReplicaChangeCount: 3 > nsds5replicareapactive: 0 >> >> Regards >> thierry >>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>> >>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> userCertificate:: = >>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>>> description: 2;1341718541;CN=3DCertificate = >>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem >>>> ,O=3DBPT.ROCKS >>>> >>>> >>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>> >>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>> Subsystem,O=3DBPT.RO >>>> CKS >>>> >>>>> If you check the certificates dates, I guess that the most recent = >>>>> one is on server seattlenfs (because of serial numbers). Can you = >>>>> confirm this (because our goal is to have the most recent cert = >>>>> stored in all the NSSDBs and in LDAP)? >>>>> >>>>> Thanks, >>>>> Flo >>>>> >>>>> >>>>>>> If your renewal master is the machine on which the NSS DB = >>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >>>>>>> manually run the scripts: >>>>>> >>>>>> If I'm interpreting this correctly, then it is... so I ran this = >>>>>> on the broken machine (seattlenfs) >>>>>> >>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >>>>>>> cert-pki-ca" >>>>>>> >>>>>> >>>>>> I ran this, it took a while, then I re-checked and the serial = >>>>>> still seems to be 4 >>>>>> >>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>> ... >>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>> Subsystem,O=3DBPT.ROCKS >>>>>> >>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>>> >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBUG = >>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>>>> at autoShutdown? false >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> autoShutdown crumb file path? = >>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>> cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>> cert:auditSigningCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>> init id=3Ddebug >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> initialized debug >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> initSubsystem id=3Dlog >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>> to init id=3Dlog >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit) >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>>>> at autoShutdown? false >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> autoShutdown crumb file path? = >>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>> cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>> cert:auditSigningCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>> init id=3Dlog >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> initialized log >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> initSubsystem id=3Djss >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>> to init id=3Djss >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: restart = >>>>>> at autoShutdown? false >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> autoShutdown crumb file path? = >>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>> cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>> cert:auditSigningCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>> init id=3Djss >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> initialized jss >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>> initSubsystem id=3Ddbs >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>> to init id=3Ddbs >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: = >>>>>> init() mEnableSerialMgmt=3Dtrue >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>> LdapBoundConnFactor(DBSubsystem) >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> LdapBoundConnFactory: init >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> LdapBoundConnFactory:doCloning true >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init = >>>>>> begins >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init = >>>>>> ends >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>>> makeConnection errorIfDown is true >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>>>>> errorIfDown true >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname = >>>>>> to: subsystemCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: = >>>>>> set client auth cert nickname subsystemCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> SSLClientCertificatSelectionCB: Entering! >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>> ocspSigningCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>> subsystemCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>>> subsystemCert cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert = >>>>>> cert-pki-ca >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake = >>>>>> happened >>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() >>>>>> >>>>>> >>>>>> I really appreciate you sticking with me through this. I owe you. >>>>>> >>>>>> - Ian >>>>>> >>>>>>> After that, check that the LDAP entry has been updated. If it is = >>>>>>> the case, you should be able to restart pki. >>>>>>> >>>>>>> Flo >>>>>>> >>>>>>>> Thank you again for your time! >>>>>>>> >>>>>>>> Ian >>>>>>>> >>>>>>>>> Flo. >>>>>>>>>> >>>>>>>>>> which seems weird. >>>>>>>>>> >>>>>>>>>>> The description attribute in the ldapsearch output is of the = >>>>>>>>>>> form 2;#;DN;DN >>>>>>>>>>> >>>>>>>>>>> The # should match the serial number in the first certutil = >>>>>>>>>>> output >>>>>>>>>>> >>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match = >>>>>>>>>>> one of the >>>>>>>>>>> userCertificate attributes. >>>>>>>>>>> >>>>>>>>>>> rob >>>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>> >>>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to = >>>> freeipa-users-leave(a)lists.fedorahosted.org >>> _______________________________________________ >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to = >>> freeipa-users-leave(a)lists.fedorahosted.org >> > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org --===============8600127386348226288== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgSGkgSWFuLDxicj4KICAgIDxicj4KICAgIFRo YW5rcyBmb3IgaGF2aW5nIGdhdGhlciB0aG9zZSBkYXRhLiA8YnI+CiAgICA8dHQ+PGJyPgogICAg PC90dD4KICAgIDxibG9ja3F1b3RlPjx0dD4jPC90dD48YnI+CiAgICAgIDx0dD4jIFNvIHBraWRi dXNlciBlbnRyaWVzIGhhdmUgYSBzYW1lIChvbGQpIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgIGxp a2VseSBnZW5lcmF0ZWQgZHVyaW5nIGluc3RhbGw8L3R0Pjxicj4KICAgICAgPHR0PiMgQnV0IG9u bHkgZnJlZWlwYS1zZWEgaGFzIGEgbmV3IG9uZSBjcmVhdGVkIG9uIGZyZWVpcGEtc2VhCiAgICAg ICAgYXJvdW5kIEp1biA4dGggMjAxNyAwNTo1NDoxNjwvdHQ+PGJyPgogICAgICA8dHQ+IyBUaGlz IHJlY2VudCBjZXJ0aWZpY2F0ZSBpcyBpZGVudGlmaWVkIGJ5CiAgICAgICAgNTkzOGU2ODgwMDAx MDQyOTAwMDAgPC90dD48YnI+CiAgICAgIDx0dD4jPC90dD48YnI+CiAgICAgIDx0dD5bcm9vdEBm cmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAg ICBtYW5hZ2VyJyAtVyAtYiAidWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVu dHJ5d3NpPC90dD48YnI+CiAgICAgIDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1p cGFjYTwvdHQ+PGJyPgogICAgICA8dHQ+Li4uPC90dD48YnI+CiAgICAgIDx0dD5uc2NwZW50cnl3 c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdr cWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgPHR0Pm5zY3Bl bnRyeXdzaTogdXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAg ICAgICBNSUlEYmpDQ0FsYWdBd0lCQWdJICZsdDtzbmlwJmd0OzwvdHQ+PGJyPgogICAgICA8YnI+ CiAgICAgIDx0dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2Nu PWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl LG89aXBhY2EgbnNjcGVudHJ5d3NpPC90dD48YnI+CiAgICAgIDx0dD5kbjogdWlkPXBraWRidXNl cixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAgICA8dHQ+bnNjcGVudHJ5d3NpOiB1c2Vy Q2VydGlmaWNhdGU6OgogICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcw QkFRc0ZBREEwTVIgJmx0O3NuaXAmZ3Q7PC90dD48YnI+CiAgICAgIDxicj4KICAgICAgPGJyPgog ICAgICA8YnI+CiAgICAgIDx0dD4jPC90dD48YnI+CiAgICAgIDx0dD4jIHdoeSA1OTM4ZTY4ODAw MDEwNDI5MDAwMCB2YWx1ZSB3YXMgbm90IHByb3BhZ2F0ZWQgdG8KICAgICAgICBzZWF0dGxlbmZz ID88L3R0Pjxicj4KICAgICAgPHR0PiMgVGhlIG1vc3QgcmVjZW50IHVwZGF0ZSAoZnJvbSBmcmVl aXBhLXNlYSkgdGhhdCB3YXMKICAgICAgICByZXBsaWNhdGVkIHRvIHNlYXR0bGVuZnM8L3R0Pjxi cj4KICAgICAgPHR0PiMgaXPCoCAxIHllYXIgb2xkICg1N2JlODA0MzAwMDcwNDI5MDAwMCAtIEF1 ZyAyNXRoIDIwMTYKICAgICAgICAwNToyMTowNykuPC90dD48YnI+CiAgICAgIDx0dD4jIEluIGFk ZGl0aW9uIHNlYXR0bGVuZnMgcmVjZWl2ZWQgZGlyZWN0IHVwZGF0ZSAobGFzdCBvbmUgd2FzCiAg ICAgICAgaW4gSmFuIDEwMTcpIHRoYXQgd2VyZSBub3Q8L3R0Pjxicj4KICAgICAgPHR0PiMgcmVw bGljYXRlZCB0byBmcmVlaXBhLXNlYTwvdHQ+PGJyPgogICAgICA8dHQ+IyA8L3R0Pjxicj4KICAg ICAgPHR0PiMgVGhlIHR3byBzZXJ2ZXJzIGhhdmUgZGl2ZXJnZWQgYmVjYXVzZSB0aGV5IGNhbiBu b3QgcmVwbGljYXRlCiAgICAgICAgdG8gZWFjaG90aGVyIGJlY2F1c2U8L3R0Pjxicj4KICAgICAg PHR0PiMgdGhleSB3ZXJlIG5vdCBjb3JyZWN0bHkgaW5pdGlhbGl6ZS48L3R0Pjxicj4KICAgICAg PHR0PiMgVGhleSBoYXZlIGRpZmZlcmVudCAicmVwbGljYWdlbmVyYXRpb24iCiAgICAgICAgKDU3 YzI5MWQ5MDAwMDA0MjkwMDAwIHZzIDU1YzhmM2FlMDAwMDAwNjAwMDAwKTwvdHQ+PGJyPgogICAg ICA8dHQ+IzwvdHQ+PGJyPgogICAgICA8dHQ+IyBJdCBpcyBsb29raW5nIGxpa2UgZnJlZWlwYS1z ZWEgd2FzIGNyZWF0ZWQgb25lIG9yIHR3byB5ZWFycwogICAgICAgIGFnbyBhbmQgdXNlZCB0byBp bml0aWFsaXplZCBzZWF0dGxlbmZzLjwvdHQ+PGJyPgogICAgICA8dHQ+IyBCdXQgbGF0ZXIgZnJl ZWlwYS1zZWEgd2FzIHJlY3JlYXRlZC48L3R0Pjxicj4KICAgICAgPHR0PiM8L3R0Pjxicj4KICAg ICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp cmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNs YXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZm ZmZmZmZmKSkiPC90dD48YnI+CiAgICAgIDx0dD5FbnRlciBMREFQIFBhc3N3b3JkOjwvdHQ+PGJy PgogICAgICA8dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxj bj1jb25maWc8L3R0Pjxicj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9u fSA1N2MyOTFkOTAwMDAwNDI5MDAwMDwvdHQ+PGJyPgogICAgICA8dHQ+bnNkczUwcnV2OiB7cmVw bGljYSAxMDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9m cmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4 OTwvYT59CiAgICAgICAgNTdmODQwYmYwMDAwMDQyOTAwMDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8 L3R0Pjxicj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBjbGFzcz0ibW96 LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5 Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn08L3R0Pjxicj4KICAgICAgPHR0 Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAgICAgIDxhIGNsYXNz PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j a3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDU5OGExYzE2PC90 dD48YnI+CiAgICAgIDx0dD5uc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAK ICAgICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2Vh dHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9h Pn0gMDAwMDAwMDA8L3R0Pjxicj4KICAgICAgPGJyPgogICAgICA8dHQ+W3Jvb3RAc2VhdHRsZW5m cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2Vy JyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlx dWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAg ICA8dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25m aWc8L3R0Pjxicj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1NWM4 ZjNhZTAwMDAwMDYwMDAwMDwvdHQ+PGJyPgogICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYSAx MDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBh LXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59 CiAgICAgICAgNTdiMTAzZDQwMDAwMDQyOTAwMDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8L3R0Pjxi cj4KICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBjbGFzcz0ibW96LXR4dC1s aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFw Oi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn3CoAogICAgICAgIDU3YmU4MDRjMDAwMDA1 MGEwMDAwIDU4NzIzNjE1MDAwMDA1MGEwMDAwPC90dD48YnI+CiAgICAgIDx0dD5uc3J1dlJlcGxp Y2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAKICAgICAgICA8YSBjbGFzcz0ibW96LXR4dC1s aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFw Oi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0gMDAwMDAwMDA8L3R0Pjxicj4KICAgICAg PHR0Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAgICAgIDxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQu cm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDAwMDAwMDAw PC90dD48L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgICBJbiBjb25jbHVzaW9uOjxi cj4KICAgIMKgwqDCoCBGcm9tIHJlcGxpY2F0aW9uIHBvdiwgdGhlIHR3byBpbnN0YW5jZXMgY2Fu IG5vdCBjb21tdW5pY2F0ZS48YnI+CiAgICDCoMKgwqAgT25lIHNvbHV0aW9uIHdvdWxkIGJlIHRv IGlkZW50aWZ5IHdoaWNoIGluc3RhbmNlIGlzIHRoZSBnb29kCiAgICBvbmUsIHlvdSB3YW50IHRv IGtlZXAuPGJyPgogICAgwqDCoMKgIGFuZCByZWluaXQgdGhlIHNlY29uZCBvbmUgZnJvbSB0aGF0 IHJlZmVyZW5jZS48YnI+CiAgICA8YnI+CiAgICA8YnI+CiAgICA8ZGl2IGNsYXNzPSJtb3otY2l0 ZS1wcmVmaXgiPk9uIDA4LzA4LzIwMTcgMTA6MzMgUE0sIElhbiBIYXJkaW5nIHZpYQogICAgICBG cmVlSVBBLXVzZXJzIHdyb3RlOjxicj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUKICAgICAg Y2l0ZT0ibWlkOjJmNjBjNGFmLTY4MGMtNDM4Mi05NzA0LTQxYTI0YzgxMjFhMkBicm93bnBhcGVy dGlja2V0cy5jb20iCiAgICAgIHR5cGU9ImNpdGUiPgogICAgICA8bWV0YSBodHRwLWVxdWl2PSJD b250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgICAgIDxw Pk9uIDgvNy8xNyAxOjQ0IEFNLCB0aGllcnJ5IGJvcmRheiB3cm90ZTo8YnI+CiAgICAgIDwvcD4K ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZA cmVkaGF0LmNvbSI+CiAgICAgICAgPG1ldGEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0 Zi04IgogICAgICAgICAgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIj4KICAgICAgICA8YnI+CiAg ICAgICAgPGJyPgogICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcv MjAxNyAwOToyMiBBTSwgRmxvcmVuY2UKICAgICAgICAgIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQ QS11c2VycyB3cm90ZTo8YnI+CiAgICAgICAgPC9kaXY+CiAgICAgICAgPGJsb2NrcXVvdGUKICAg ICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUyYzNAcmVk aGF0LmNvbSIKICAgICAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0LzIwMTcgMTE6MDIgUE0sIElh biBIYXJkaW5nIHZpYQogICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gOC80LzE3IDI6MTYgQU0sIEZsb3JlbmNlCiAg ICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6MTMgUE0sIElh biBIYXJkaW5nCiAgICAgICAgICAgICAgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAg ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4IEFN LCBGbG9yZW5jZQogICAgICAgICAgICAgICAgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAg ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDExOjUxIFBN LCBJYW4KICAgICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTog PGJyPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8y MDE3IDEyOjExIEFNLAogICAgICAgICAgICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3 cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9u IDA4LzAyLzIwMTcgMDE6NDMgQU0sIElhbgogICAgICAgICAgICAgICAgICAgICAgSGFyZGluZyB3 cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+ T24gMDgvMDEvMjAxNyAxMjowMyBQTSwKICAgICAgICAgICAgICAgICAgICAgICAgUm9iIENyaXR0 ZW5kZW4gd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+SWFuIEhhcmRpbmcgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDA3OjM5CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICBBTSwgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8w MS8yMDE3IDAzOjExCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBNLCBJYW4gSGFyZGlu ZyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg MDE6NDggQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDAxOjMyIEFNLCBJYW4gSGFyZGluZyB2 aWEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT24gMDcvMzEvMjAxNyAxMTozNCBBTSwg Um9iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENyaXR0ZW5kZW4gd3JvdGU6 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+SWFuIEhhcmRpbmcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkkgaGFkIGFuCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1bmV4cGVjdGVkIHJlc3RhcnQgb2YgYW4gSVBB CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzZXJ2ZXIgdGhhdCBoYWQg YXBwYXJlbnRseSBoYWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgdXBkYXRlcyBydW4gYnV0IGhhZCBub3QgYmVlbgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgcmVzdGFydGVkLiBpcGFjdGwgc2F5cwogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgcGtpLXRvbWNhdGQgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgd291bGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgbm90IHN0YXJ0LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBTdHJhbmdlbHksIHRoZSBhY3R1YWwgc2VydmljZQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgYXBwZWFycyB0byBiZSBydW5uaW5nOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcg aXMgYW4gYXBwbGljYXRpb24gd2l0aGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgdG9tY2F0IHNvIHRvbWNhdCBjYW4gcnVuIHdpdGhvdXQgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgcnVubmluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBX ZSBuZWVkIHRvIHNlZSBtb3JlIG9mIHRoZSBkb2d0YWcKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBkZWJ1ZyBsb2cgdG8gc2VlIHdoYXQgaXMgZ29pbmcgb24uCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEl0IGxvb2tzIGxpa2UgYW4gYXV0aGVu dGljYXRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJvYmxlbS4uLiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTU0wgaGFu ZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Q291bGQgbm90IGNvbm5lY3QgdG8gTERBUCBzZXJ2ZXIKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaG9zdCBzZWF0dGxlbmZzLmJwdC5yb2NrcyBwb3J0IDYzNiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yIG5ldHNjYXBlLmxkYXAuTERBUEV4 Y2VwdGlvbjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aGVudGljYXRp b24gZmFpbGVkICg0OSkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIHN0b3JlcyBpdHMgaW50 ZXJuYWwgZGF0YSBpbiB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExEQVAg c2VydmVyIGFuZCBuZWVkcyB0byA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBlc3RhYmxpc2ggYSBzZWN1cmUgTERBUCBjb25uZWN0aW9uLgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgWW91IGNhbiBjaGVjayBob3cgdGhpcyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBjb25uZWN0aW9uIGlzIGNvbmZpZ3VyZWQgaW4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvY2EvQ1MuY2ZnLCBs b29rCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmb3IgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBp bnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVudEF1dGgKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGludGVybmFsZGIubGRhcGF1dGguYmluZEROPWNuPURpcmVjdG9yeQoKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIE1hbmFnZXIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kUFdQcm9tcHQ9aW50ZXJuYWxkYgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lz dGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5o b3N0PXZtLS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5h bGRiLmxkYXBjb25uLnBvcnQ9NjM2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGludGVybmFsZGIubGRhcGNvbm4uc2VjdXJlQ29ubiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBh dXRodHlwZSBjYW4gYmUgU3NsQ2xpZW50QXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGggYSBzc2wgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgY2VydGlmaWNhdGUpIG9yIEJhc2ljQXV0aAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGggYSBiaW5kIEROIGFuZCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNzd29yZCBzdG9yZWQgaW4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2Nv bmYvcGFzc3dvcmQuY29uZikuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBZb3UgY2FuIHVzZSB0aGlzIGluZm9ybWF0aW9uIHRvCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBtYW51YWxseSBjaGVjayB0aGUgY3JlZGVudGlhbHMu IEZvciA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnN0YW5jZSB3aXRo IHNzbGNsaWVudGF1dGg6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgTERBUFRMU19DQUNFUlRESVI9L2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgZXhwb3J0IExEQVBUTFNfQ0VSVD0nc3Vic3lzdGVtQ2Vy dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGxkYXBzZWFyY2ggLUggPGEKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIgaHJlZj0ibGRhcHM6Ly8iPmxkYXBzOi8vPC9hPjwvYT5gaG9zdG5hbWVgOjYz NgoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhU RVJOQUwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKHByb3ZpZGUgdGhl IHBhc3N3b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtp L3BraS10b21jYXQvYWxpYXMvcHdkZmlsZS50eHQpCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJIGZv dW5kIHRoaXM6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1T c2xDbGllbnRBdXRoCgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj11aWQ9 cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGF1 dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0 aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBpbnRlcm5hbGRiLmxkYXBjb25uLmNsb25lUmVwbGljYXRpb25Qb3J0PTM4OQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBhbmQgd2hlbiBJIHRyeSB0aGUgbGRhcHNlYXJjaCBJIGFt CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJlc2VudGVkIHdpdGggYSBwcm9tcHQg dG8gcHJvdmlkZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBwaW4vcGFz c3dvcmQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgZW50ZXIgcGluLCBwYXNzd29yZCwgb3IgcGFz cwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkgdG9r ZW4gJ2xkYXAoMCknOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZCBm aWxlLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB5b3UgYXJlIHJpZ2h0LCBpbiA0LjQuIHRoZXJlIGlz IG5vCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB3ZGZpbGUudHh0IGFuZCB0aGUgcGFz c3dvcmQgY2FuIGJlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZm91bmQgaW4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29u Zi9wYXNzd29yZC5jb25mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICh3aXRoIHRoZSB0 YWcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4pIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRoIHRoZSB0YWcKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWw9Li4uIGFsbG93cyB0byByZWFkIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPyA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtp L3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJv dmlkZSBwYXNzd29yZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgVGhhdCB3b3Jrcy4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtp L3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0 aWw6IENoZWNraW5nIHRva2VuICJOU1MgQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAg ICAgICAgIERCIiBpbiBzbG90ICJOU1MgVXNlciBQcml2YXRlIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEtleSBhbmQgQ2VydGlmaWNhdGUgU2VydmljZXMiIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZp Y2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgREIiOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAmbHQ7IDAmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAg MGYzMjdlNzYwYTdlZWNkY2Y2OTczZjVkYzU3Y2E1MzY3YzU5MmQ2NMKgwqAKICAgICAgICAgICAg ICAgICAgICAgICAgICAgIChvcnBoYW4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICZsdDsgMSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBiMTI1ODBjN2M2OTZj ZmNkOGFlZmM5NDA1YTdhODcwYjI0YjdiOTZhwqDCoAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgTlNTIENlcnRpZmljYXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOmF1 ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgJmx0OyAyJmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDg4MWI3MjU0YzQw ZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAgICAgICAgICAgICAg IGNhU2lnbmluZ0NlcnQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2kt Y2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0OyByc2EKICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGZhOWEyNTVhMWQxNTU4NWFjMjgwNjRjMGY0OTg2ZTQxNmJj NDg0MDPCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtp LWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgNCZndDsgcnNhCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAzZmI2MDlkMGY3ZDcyYzJkMzI1ZDZhMmRjMTY1NzdhN2Y3 ZTVhMDFmCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAmbHQ7IDUmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5 NDc5YTk1NTZhZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBEQjpzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJ1dCB0aGlzIGRvZXNu J3QgKHdpdGggdGhlIHNhbWUgcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZy b20gcGFzc3dvcmQuY29uZikgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGhyZWY9ImxkYXBzOi8vIiBtb3otZG8tbm90LXNlbmQ9InRy dWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXBzOi8vIj5sZGFw czovLzwvYT48L2E+YGhvc3RuYW1lYDo2MzYKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAt YiAiIiAtcyBiYXNlIC1ZIEVYVEVSTkFMIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg IFBsZWFzZSBlbnRlciBwaW4sIHBhc3N3b3JkLCBvciBwYXNzIHBocmFzZQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgZm9yIHNlY3VyaXR5IHRva2VuICdsZGFwKDApJzogPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgU0FTTC9FWFRFUk5BTCBhdXRoZW50aWNhdGlvbiBzdGFydGVk IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxkYXBfc2FzbF9pbnRlcmFjdGl2ZV9i aW5kX3M6IEludmFsaWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRlbnRpYWxzICg0 OSkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgVGhhdCBwYXNzd29yZCBpcyBnZXR0aW5nIG1lIHNvbWV3aGVyZQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgdGhvdWdoLCBzaW5jZSBpZiBJIHB1dCBpbiBhIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgIG5vbnNlbnNlIG9yIGluY29ycmVjdCBwYXNzd29yZCBp dCBqdXN0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcm9tcHRzIG92ZXIgYW5kIG92ZXIu IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIExldCdzIHN0ZXAg YmFjayBhIHNlY29uZC4gWW91IHVwZ3JhZGVkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAg ICB3aGF0IHRvIHdoYXQ/IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl PgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFRo ZXJlIHdhc24ndCBtdWNoIG9mIGEgY2hhbmdlLi4uIEkganVzdCBhc3N1bWVkCiAgICAgICAgICAg ICAgICAgICAgICAgIHNvbWVvbmUgcmFuIHl1bSB1cGdyYWRlIGFuZCBkaWRuJ3QgcmVzdGFydCwg dGhlbgogICAgICAgICAgICAgICAgICAgICAgICB0aGUgcG93ZXIgb3V0YWdlLi4uIGl0IGxvb2tz IGxpa2Ugbm90IG11Y2ggb2YgYQogICAgICAgICAgICAgICAgICAgICAgICB2ZXJzaW9uIGNoYW5n ZSB0aG91Z2guIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAjIGdyZXAgaXBhIC92YXIvbG9nL3l1bS5sb2cgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICBKYW4gMDggMDQ6NDU6MzIgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAg ICAgICBpcGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAgICAgICAgICAg ICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5v YXJjaAogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IEphbiAwOCAwNDo0NjowNiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBsaWJpcGFf aGJhYy0xLjE0LjAtNDMuZWw3XzMuNC54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICBKYW4gMDggMDQ6NDY6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9u LWxpYmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIEphbiAwOCAwNDo0NjowOCBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAg ICAgIHB5dGhvbi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNCBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAg ICAgICAgIHB5dGhvbjItaXBhbGliLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAg ICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3Mu MS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgIEphbiAwOCAwNDo0NzowNSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBp cGEtYWRtaW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2ggPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDUgSW5zdGFsbGVkOgogICAgICAgICAgICAg ICAgICAgICAgICBpcGEtc2VydmVyLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2Fy Y2gKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBK YW4gMDggMDQ6NDc6MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICBweXRob24y LWlwYXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDcgVXBk YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgc3NzZC1pcGEtMS4xNC4wLTQzLmVsN18zLjQu eDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE3IFVwZGF0 ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40LjAtMTQuZWw3LmNlbnRv cy4xLjEueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIz IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40LjAtMTQuZWw3 LmNlbnRvcy4xLjEueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0 OjQ3OjI3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItZG5zLTQu NC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IEphbiAwOCAwNDo0NzozNiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1w eXRob24tY29tcGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo1MDowNyBF cmFzZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1weXRob24tNC4yLjAtMTUuMC4xLmVs Ny5jZW50b3MuMTkueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5 OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAt MTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy OCAwOTo1NTo0MiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LWNv bW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgSnVsIDI4IDA5OjU1OjQzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlw YS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAg ICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NCBVcGRhdGVkOgogICAgICAg ICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjcu bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ1IFVwZGF0 ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2VydmVyLTQuNC4wLTE0LmVs Ny5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6 NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40 LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEp1 bCAyOCAwOTo1NTo0NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50 LTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNl cnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIGlw YS1zZXJ2ZXItZG5zLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgaXBhLXB5dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgIyBn cmVwIHBraSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFu IDA4IDA0OjQ2OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEw LjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg MDQ6NDY6MDkgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAga3JiNS1wa2luaXQtMS4x NC4xLTI3LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw NDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEt MTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAw OCAwNDo0NzoxOSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAu My4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw NDo0NzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMu My0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6 NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4zLjMtMTQu ZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIy IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMtMTQuZWw3XzMu bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjE2IFVwZGF0 ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xOS5lbDdfMy5ub2Fy Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoK ICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTkuZWw3XzMubm9h cmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjE3IFVwZGF0ZWQ6 CiAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTkuZWw3XzMueDg2XzY0 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgIHBraS1zZXJ2ZXItMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAg ICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MjEgVXBkYXRlZDoKICAgICAgICAg ICAgICAgICAgICAgICAgcGtpLWNhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICBBcmUgeW91IHJ1bm5pbmcgaW4gU0VMaW51eCBlbmZvcmNpbmcgbW9k ZT8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgIyBnZXRlbmZvcmNlIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgRW5mb3JjaW5nIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj aXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIElmIHNvIGNhbiB5b3UgcnVuOiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICMgYXVzZWFyY2ggLW0gQVZDIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gdG8gbG9nX2Zvcm1hdCBp cyBkZXByZWNhdGVkLgogICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgdXNlIHRoZSB3cml0 ZV9sb2dzIG9wdGlvbi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0 aW9uIGlzIG92ZXJyaWRpbmcgdGhlIHdyaXRlX2xvZ3MKICAgICAgICAgICAgICAgICAgICAgICAg Y3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC0tLS0gPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICB0aW1lLSZndDtNb24gTWFyIDE0IDEwOjM5OjAxIDIwMTYg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NBTEwgbXNnPWF1ZGl0KDE0NTc5 NzcxNDEuNzY3OjE3NTM3KToKICAgICAgICAgICAgICAgICAgICAgICAgYXJjaD1jMDAwMDAzZSBz eXNjYWxsPTIgc3VjY2Vzcz1ubyBleGl0PS0xMwogICAgICAgICAgICAgICAgICAgICAgICBhMD03 ZmJjYWIwMzhkMTAgYTE9ODAwIGEyPTEgYTM9N2ZiY2E2MGY0MmUwCiAgICAgICAgICAgICAgICAg ICAgICAgIGl0ZW1zPTAgcHBpZD0xNDA2IHBpZD0xMjk2NSBhdWlkPTQyOTQ5NjcyOTUKICAgICAg ICAgICAgICAgICAgICAgICAgdWlkPTAgZ2lkPTAgZXVpZD01ODE0MDAwMDEgc3VpZD0wCiAgICAg ICAgICAgICAgICAgICAgICAgIGZzdWlkPTU4MTQwMDAwMSBlZ2lkPTU4MTQwMDAwMSBzZ2lkPTAK ICAgICAgICAgICAgICAgICAgICAgICAgZnNnaWQ9NTgxNDAwMDAxIHR0eT0obm9uZSkgc2VzPTQy OTQ5NjcyOTUKICAgICAgICAgICAgICAgICAgICAgICAgY29tbT0ic3NoZCIgZXhlPSIvdXNyL3Ni aW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgICAgc3Viaj1zeXN0ZW1fdTpzeXN0ZW1fcjpz c2hkX3Q6czAtczA6YzAuYzEwMjMKICAgICAgICAgICAgICAgICAgICAgICAga2V5PShudWxsKSA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDIG1zZz1hdWRpdCgxNDU3OTc3MTQx Ljc2NzoxNzUzNyk6IGF2YzrCoAogICAgICAgICAgICAgICAgICAgICAgICBkZW5pZWQgeyByZWFk IH0gZm9yIHBpZD0xMjk2NSBjb21tPSJzc2hkIgogICAgICAgICAgICAgICAgICAgICAgICBuYW1l PSJhdXRob3JpemVkX2tleXMiIGRldj0iZG0tMiIgaW5vPTExNjM5MzUxNwogICAgICAgICAgICAg ICAgICAgICAgICBzY29udGV4dD1zeXN0ZW1fdTpzeXN0ZW1fcjpzc2hkX3Q6czAtczA6YzAuYzEw MjMKICAgICAgICAgICAgICAgICAgICAgICAgdGNvbnRleHQ9c3lzdGVtX3U6b2JqZWN0X3I6dW5s YWJlbGVkX3Q6czAKICAgICAgICAgICAgICAgICAgICAgICAgdGNsYXNzPWZpbGUgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBzdXNwZWN0IHRo YXQgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtIGNlcnQgd2FzIHJlbmV3 ZWQgYW5kIGV2ZXJ5dGhpbmcKICAgICAgICAgICAgICAgICAgICAgICAgICB3YXNuJ3QgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0 aGlzIGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgdW5yZWxhdGVkIHRvIHRoZSB1cGdyYWRl IGl0IGp1c3QgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIHNob25lIGEgc3BvdGxpZ2h0 IG9uIGl0LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIENhbiB5b3UgcnVuIHRoZXNlIGNvbW1hbmRzOiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJj aCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcKICAgICAgICAgICAgICAgICAgICAg ICAgICAtYiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1w ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBk ZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgVGhpcyByZXR1cm5zIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAt RCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XCiAgICAgICAgICAgICAgICAgICAgICAgIC1iIHVp ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgdXNl ckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgRW50 ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBr aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIHVz ZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC4uLiBzdHVmZiAuLi4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICBaTm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4 WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246 IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1C UFQuUk9DS1M7Q049Q0EKICAgICAgICAgICAgICAgICAgICAgICAgU3Vic3lzdGVtLE89QlBULlJP Q0tTIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5hbmQgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1kIC9l dGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vi c3lzdGVtQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwg Z3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwg LWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAg ICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgVGhlc2UgYm90aCBy ZXR1cm4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbgogICAg ICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgfCBncmVwIFNl cmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBm b3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAg ICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09JRDogVW5yZWNvZ25p emVkIE9iamVjdAogICAgICAgICAgICAgICAgICAgICAgICBJZGVudGlmaWVyLiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10b21jYXQv YWxpYXPCoCAtbgogICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBr aS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcg dG9rZW4gIk5TUyBDZXJ0aWZpY2F0ZSBEQiIgaW4KICAgICAgICAgICAgICAgICAgICAgICAgc2xv dCAiTlNTIFVzZXIgUHJpdmF0ZSBLZXkgYW5kIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAg ICAgICAgIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3 b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZSBEQiI6CiAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGlu ZyBrZXlzOgogICAgICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09J RDogVW5yZWNvZ25pemVkIE9iamVjdAogICAgICAgICAgICAgICAgICAgICAgICBJZGVudGlmaWVy LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICB5b3UgbWFkZSBhIHR5cG8gYW5k IHJlcXVlc3RlZCB0aGUga2V5cyAoLUspCiAgICAgICAgICAgICAgICAgICAgICBpbnN0ZWFkIG9m IHRoZSBjZXJ0cyAoLUwpLiBQbGVhc2UgcmV0cnkgd2l0aCAtTAogICAgICAgICAgICAgICAgICAg ICAgYW5kIHlvdSBzaG91bGQgYmUgYWJsZSB0byBzZWUgdGhlIGNlcnRpZmljYXRlCiAgICAgICAg ICAgICAgICAgICAgICBzZXJpYWwuIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxM TCAtRAogICAgICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAg ICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0 aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAg ICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgZG46 IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAg IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFn SUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAg ICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAg ICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQu Uk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBT byB0aGUgc2VyaWFsIGlzIDQ/IDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAg ICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0 CiAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAg ICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0 MSAoMHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICBXaGljaCBpcyBOT1QgNC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1k CiAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lz dGVtQ2VydAogICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAg ICAgICAgICAgICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tIDxicj4KICAgICAgICAgICAg ICAgICAgICBNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBN Ukl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgc2plaUZiVUZ0b01uZm1ITElZcGU1UUFS IDxicj4KICAgICAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIDxicj4K ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgQW5kIHRoaXMgY2Vy dCBpcyBOT1QgdGhlIHNhbWUuIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICB3aGVuIGNlcnRtb25nZXIgcmVuZXdz IGEgY2VydGlmaWNhdGUsIGl0IHJ1bnMgcHJlLXNhdmUKICAgICAgICAgICAgICAgICAgYW5kIHBv c3Qtc2F2ZSBjb21tYW5kcyAod2hpY2ggeW91IGNhbiBzZWUgaW4gdGhlCiAgICAgICAgICAgICAg ICAgIG91dHB1dCBvZiBnZXRjZXJ0IGxpc3QpLiBJbiB5b3VyIGNhc2UsIHRoZSBwb3N0LXNhdmUK ICAgICAgICAgICAgICAgICAgY29tbWFuZCBmb3Igc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSBw cm9iYWJseSBmYWlsZWQuCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICBUaGlzIGNvbW1hbmQgKG9uIHRoZSByZW5ld2FsIG1hc3Rl cikgaXMgcmVzcG9uc2libGUKICAgICAgICAgICAgICAgICAgZm9yIGNvcHlpbmcgdGhlIG5ldyBj ZXJ0IGZyb20gdGhlIE5TUyBkYiB0byB0aGUgTERBUAogICAgICAgICAgICAgICAgICBzZXJ2ZXIu IFlvdSBuZWVkIGZpcnN0IHRvIGNoZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMKICAgICAgICAgICAg ICAgICAgdGhlIHJlbmV3YWwgbWFzdGVyIChhcyB0aGUgc2VyaWFsIG51bWJlcnMgYXJlIGluIGEK ICAgICAgICAgICAgICAgICAgY29tcGxldGVseSBkaWZmZXJlbnQgcmFuZ2UsIEkgYXNzdW1lIHRo YXQgeW91IGhhdmUKICAgICAgICAgICAgICAgICAgbXVsdGlwbGUgSVBBIHNlcnZlcnMgY29uZmln dXJlZCB3aXRoIGEgQ0EgaW5zdGFuY2UpOiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgJCBleHBvcnQgQkFTRUROPWBncmVwIGJhc2VkbiAvZXRjL2lwYS9kZWZh dWx0LmNvbmYgfAogICAgICAgICAgICAgICAgICBjdXQgLWQ9IC1mMi1gIDxicj4KICAgICAgICAg ICAgICAgICAgJCBraW5pdCBhZG1pbiA8YnI+CiAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJj aCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQSSAtYgogICAgICAgICAgICAg ICAgICAiY249bWFzdGVycyxjbj1pcGEsY249ZXRjLCRCQVNFRE4iCiAgICAgICAgICAgICAgICAg ICcoJmFtcDsoY249Q0EpKGlwYUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScgZG4gPGJy PgogICAgICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgICAgY249Q0EsY249dm0taXBh c2VydmVyLmlwYWRvbWFpbi5jb20sY249bWFzdGVycyxjbj1pcGEsY249ZXRjLGRjPWlwYWRvbWFp bixkYz1jb20KCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICBJbiB0aGlzIGV4YW1wbGUgdGhlIHJlbmV3YWwgbWFzdGVyIGlzIHZt LWlwYXNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBJIGdldCB0 aGlzIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICQgbGRhcHNlYXJj aCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQSSAtYgogICAgICAgICAgICAg ICAgImNuPW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICAgJygm YW1wOyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJyBkbiA8YnI+CiAg ICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2VhLmJw dC5yb2Nrcyxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBXaGljaCBp cyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgSGkgSWFuLCA8YnI+CiAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgIGl0J3MgZ2V0dGluZyBkaWZmaWN1bHQgdG8gZm9s bG93IHRoaXMgdGhyZWFkLCBzbyBjb3VsZCB3ZQogICAgICAgICAgICAgIHN0ZXAgYmFjayBhbmQg c3VtbWFyaXplPyA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgWWVz LCBpdCBpcy7CoCBTb3JyeS4gPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij4gPGJyPgogICAgICAgICAgICAgIC0gT24gc2VydmVyIGZyZWVpcGEtc2VhICg9cmVuZXdhbCBt YXN0ZXIpLCB0aGUgQ0EKICAgICAgICAgICAgICBjb21wb25lbnQgaXMgaW5zdGFsbGVkIGFuZCAn c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgaGFzCiAgICAgICAgICAgICAgU2VyaWFsIG51bWJl ciA0IGluIHRoZSBOU1NEQiAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAg ICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBObz8gPGJyPgogICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAg ICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtp LWNhJyB8CiAgICAgICAgICAgIGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgwqDCoMKgwqDC oMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAg ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPi0gT24gc2VydmVyIHNlYXR0bGVuZnMgKHdo ZXJlIFBLSQogICAgICAgICAgICAgIGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50 IGlzIGluc3RhbGxlZCBhbmQKICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j YScgaGFzIFNlcmlhbCBudW1iZXIgMTM0MTcxODU0MQogICAgICAgICAgICAgIGluIHRoZSBOU1NE QiAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzLiA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90 ZT4KICAgICAgICAgICAgWWVzIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbcm9v dEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8CiAgICAgICAg ICAgIGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwg TnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAtIElu IHRoZSBMREFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUgZW50cnkKICAgICAg ICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHdpdGggU2VyaWFsIG51bWJl ciA0IChpLmUuCiAgICAgICAgICAgICAgaXQgaXMgdGhlIGNlcnQgZnJvbSBmcmVlaXBhLXNlYSku IDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBUaGlzIGlzIHdoZXJl IHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28gY2VydGlmaWNhdGVzCiAgICAgICAg ICAgIG9uIHRoZSBtYXN0ZXIgYW5kIG9ubHkgb25lIG9uIHRoZSBvdGhlci7CoCBJIHdvbmRlciBp ZiB0aGlzCiAgICAgICAgICAgIGlzIGEgcmVzdWx0IG9mIHRoZSBzbG93IG1vdGlvbiByZXBsaWNh dGlvbiB0cmFpbndyZWNrIEkgaGF2ZQogICAgICAgICAgICBnb2luZyBvbiBkdWUgdG8gYSB6b21i aWUgcmVwbGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0CiAgICAgICAgICAgIG5vIGxvbmdl ciBleGlzdHMgaW4gdGhlIHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qgc2VlbSB0byBnZXQKICAgICAg ICAgICAgcmlkIG9mLiA8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgIDwvYmxvY2txdW90 ZT4KICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICB0aGUgcmVtYWlu aW5nIGlzc3VlIGlzIGEgcmVwbGljYXRpb24gcHJvYmxlbS4gVGhlcmUgaXMgYQogICAgICAgICAg IlRyb3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBbMV0gaW4gSWRNIEFkbWluIGd1 aWRlCiAgICAgICAgICB0aGF0IG1heSBoZWxwIHlvdS4gPGJyPgogICAgICAgICAgPGJyPgogICAg ICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1hbmRzIGRpZCB5 b3UgdXNlIHRvCiAgICAgICAgICB0cnkgdG8gcmVtb3ZlIGl0LCBhbmQgd2hhdCB3YXMgdGhlIG91 dHB1dD8gPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgRmxvIDxicj4KICAgICAgICAgIDxi cj4KICAgICAgICAgIFsxXSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgpocmVmPSJo dHRwczovL2FjY2Vzcy5yZWRoYXQuY29tL2RvY3VtZW50YXRpb24vZW4tVVMvUmVkX0hhdF9FbnRl cnByaXNlX0xpbnV4LzcvaHRtbC9MaW51eF9Eb21haW5fSWRlbnRpdHlfQXV0aGVudGljYXRpb25f YW5kX1BvbGljeV9HdWlkZS90cm91YmxlLWdlbi1yZXBsaWNhdGlvbi5odG1sIgogICAgICAgICAg ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1l bnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFp bl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJl cGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90 ZT4KICAgICAgICA8YnI+CiAgICAgICAgSGksPGJyPgogICAgICAgIDxicj4KICAgICAgICBUbyBk ZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZCBzZXZlcmFs CiAgICAgICAgaW5mbyBidXQgc3RhcnRpbmcgd2l0aCB0aGUgcmVzdWx0cyBvZiB0aGUgZm9sbG93 aW5nIGNvbW1hbmRzPGJyPgogICAgICAgIDxicj4KICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBp YW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2VyJyAt VyAtYiAidWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVudHJ5d3NpPGJyPgog ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2Vh cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJwogICAgICAtVyAtYiAidWlkPXBraWRi dXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVudHJ5d3NpPGJyPgogICAgICBFbnRlciBMREFQ IFBhc3N3b3JkOiA8YnI+CiAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh PGJyPgogICAgICBuc2NwZW50cnl3c2k6IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlw YWNhPGJyPgogICAgICBuc2NwZW50cnl3c2k6CiAgICAgIGVudHJ5dXNuO2FkY3NuLTU5MzhlNjg4 MDAwMTA0MjkwMDA1O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1OiA8YnI+CiAgICAgIMKgNzUy NzQ4OTc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaToKICAgICAgbW9kaWZ5VGltZXN0YW1wO2FkY3Nu LTU5MzhlNjg4MDAwMTA0MjkwMDA0O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0Mjxicj4KICAgICAgwqA5 MDAwNDogMjAxNzA2MDgwNTUzMzRaPGJyPgogICAgICBuc2NwZW50cnl3c2k6CiAgICAgIG1vZGlm aWVyc05hbWU7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDM7dnVjc24tNTkzOGU2ODgwMDAxMDQy OTA8YnI+CiAgICAgIMKgMDAzOiBjbj1EaXJlY3RvcnkgTWFuYWdlcjxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxi cj4KICAgICAgbnNjcGVudHJ5d3NpOiBjbjogcGtpZGJ1c2VyPGJyPgogICAgICBuc2NwZW50cnl3 c2k6IGNyZWF0ZVRpbWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgICBuc2NwZW50cnl3 c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgIG5zY3BlbnRy eXdzaTogZGVzY3JpcHRpb247dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDE6CiAgICAgIDI7MTM0 MTcxODU0MTtDTj1DZXJ0aWZpYzxicj4KICAgICAgwqBhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tT O0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBkZXNj cmlwdGlvbjt2ZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMjtkZWxldGVkOgogICAgICAyOzQ7Q049 Q2VydGlmaWNhPGJyPgogICAgICDCoHRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJz eXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbWFpbDo8YnI+CiAgICAg IG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBv YmplY3RDbGFzczogcGVyc29uPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBv cmdhbml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczog aW5ldE9yZ1BlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21zdXNl cjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNvOiBDTj1DQSBTdWJzeXN0ZW0sTz1CUFQu Uk9DS1M8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogc246IHBraWRidXNlcjxicj4KICAgICAgbnNj cGVudHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2Vy dGlmaWNhdGU6OgogICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNG QURBME1SPGJyPgogICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgIMKgY0JkNG5PVjRtOUErcVJa Tm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9PGJyPgogICAgICBu c2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMDo6 CiAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8YnI+CiAgICAgICZsdDtzbmlwJmd0Ozxicj4KICAg ICAgwqBBUjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZn dDs8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgogICAgICBuc2NwZW50 cnl3c2k6IHVzZXJ0eXBlOiBhZ2VudFR5cGU8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogcGFyZW50 aWQ6IDI8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogZW50cnlpZDogNTE8YnI+CiAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20i PgogICAgICAgIGFuZDxicj4KICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2Vh cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lk YnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgbnNjcGVudHJ5d3NpPGJyPgogICAgICA8L2Jsb2NrcXVv dGU+CiAgICAgIDxicj4KICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAt TExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgICAgLVcgLWIgdWlkPXBraWRidXNlcixv dT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAgICAgIEVudGVyIExEQVAgUGFzc3dv cmQ6IDxicj4KICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+ CiAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tT PGJyPgogICAgICBuc2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgIE1JSURjekND QWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICZsdDtzbmlw Jmd0Ozxicj4KICAgICAgwqBjQmQ0bk9WNG05QStxUlpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFT eGx5RThYRW84ZGZBUFhNSm9GYz08YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246 IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vi czxicj4KICAgICAgwqB5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBl bnRyeWlkOiA1MTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBwYXJlbnRpZDogMjxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBtb2RpZnlUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBtb2RpZmllcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAg ICAgbnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgog ICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgICAg bnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnR5 cGU6IGFnZW50VHlwZTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgbnNj cGVudHJ5d3NpOiBjbjogcGtpZGJ1c2VyPGJyPgogICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lk YnVzZXI8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAgIG5z Y3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmpl Y3RDbGFzczogcGVyc29uPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdh bml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogaW5l dE9yZ1BlcnNvbjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21zdXNlcjxi cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEw YjhiOC0xZmRkODA3NDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeXVzbjogODY8YnI+CiAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJl ZGhhdC5jb20iPiA8YnI+CiAgICAgICAgRnJvbSB0aGUgb3V0cHV0IHlvdSBtYXkgb25seSBjb3B5 L3Bhc3QgdGhlIG9uZXMgcmVsYXRlZCB0bwogICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTxicj4KICAg ICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIEFsc28gdG8gZHVtcCB0aGUgY3VycmVudCBy ZXBsaWNhdGlvbiBzdGF0dXMsIHNlbmQgdGhlIHJlc3VsdMKgIG9mPGJyPgogICAgICAgIFtyb290 QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAg ICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250IHNpemU9Ii0xIj48aT4gPC9pPiIoJmFt cDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYt ZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgPC9mb250PjwvYmxvY2txdW90ZT4KICAg ICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0 b3J5IG1hbmFnZXInCiAgICAgIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5z dG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZm KSkiPGJyPgogICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgIGRuOiBjbj1yZXBs aWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBjbjog cmVwbGljYTxicj4KICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgbnNEUzVSZXBsaWNhQmlu ZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgIGNsb25lQWdyZWVtZW50MS1mcmVlaXBh LXNlYS5icHQucm9jPGJyPgogICAgICDCoGtzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1jb25m aWc8YnI+CiAgICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgog ICAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvYzxicj4KICAgICAgwqBrcy1w a2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICBuc0RTNVJlcGxpY2FJZDog MTA2NTxicj4KICAgICAgbnNEUzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3OTExZTYtOTNlNmVm NGItNjlkY2MyZDE8YnI+CiAgICAgIG5zRFM1UmVwbGljYVJvb3Q6IG89aXBhY2E8YnI+CiAgICAg IG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICAgIG5zU3RhdGU6OiBLUVFBQUFBQUFBQWhISXBa QUFBQUFBRUFBQUFBQUFBQUtnQUFBQUFBQUFBQkFBQUFBQUFBQUE9PTxicj4KICAgICAgbnNkczVy ZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAgICAgIG1hbmFnZXJzLGNuPXN5c2Fj Y291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAgICDCoGRjPXJvY2tzPGJyPgogICAgICBuc2Rz NXJlcGxpY2FiaW5kZG5ncm91cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICBvYmplY3RDbGFz czogdG9wPGJyPgogICAgICBvYmplY3RDbGFzczogbnNEUzVSZXBsaWNhPGJyPgogICAgICBvYmpl Y3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdl bmVyYXRpb259IDU3YzI5MWQ5MDAwMDA0MjkwMDAwPGJyPgogICAgICBuc2RzNTBydXY6IHtyZXBs aWNhIDEwNjUgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgIGNsYXNzPSJtb3otdHh0 LWxpbmstZnJlZXRleHQiCiAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2Nr czozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgNTdmODQw YmYwMDAwMDQyOTAwMDxicj4KICAgICAgwqAwIDU5OGExYzQwMDAwMTA0MjkwMDAwPGJyPgogICAg ICBuc2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAg ICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgaHJlZj0ibGRhcDovL3Nl YXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwv YT59PGJyPgogICAgICBuc2RzNWFnbXRtYXhjc246CiAgICAgIG89aXBhY2E7Y2xvbmVBZ3JlZW1l bnQxLWZyZWVpcGEtc2VhLmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgIMKgdGxl bmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICAgIG5zZHM1YWdtdG1heGNzbjoK ICAgICAgbz1pcGFjYTttYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10 b21jYXQ7c2VhdDxicj4KICAgICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1bmF2YWlsYWJsZTxi cj4KICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhIG1vei1k by1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0Igog ICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJl ZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgIDU5OGE8YnI+CiAgICAgIMKgMWMxNjxi cj4KICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhIG1vei1k by1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0Igog ICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0 dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAwMDAwMDxicj4KICAgICAgwqAwMDA8YnI+ CiAgICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiA4ODU8YnI+CiAgICAgIG5zZHM1cmVwbGlj YXJlYXBhY3RpdmU6IDA8YnI+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1p ZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPjxmb250CiAgICAgICAgICBzaXplPSItMSI+ IGFuZDxicj4KICAgICAgICA8L2ZvbnQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJj aCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8 Zm9udCBzaXplPSItMSI+PGk+IDwvaT4iKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShu c1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAg ICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgICBbcm9v dEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5h Z2VyJwogICAgICAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9u ZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4K ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICBkbjogY249cmVwbGljYSxjbj1v XDNEaXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgY246IHJlcGxpY2E8 YnI+CiAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249 UmVwbGljYXRpb24gTWFuYWdlcgogICAgICBjbG9uZUFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQu cm9jazxicj4KICAgICAgwqBzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1jb25maWc8YnI+CiAg ICAgIG5zRFM1UmVwbGljYUlkOiAxMjkwPGJyPgogICAgICBuc0RTNVJlcGxpY2FOYW1lOiA4NzA2 YWIxZS02YTgzMTFlNi1hOWJmZGJiZi03NGRjNzMyMzxicj4KICAgICAgbnNEUzVSZXBsaWNhUm9v dDogbz1pcGFjYTxicj4KICAgICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgICAgbnNTdGF0 ZTo6IENnVUFBQUFBQUFBS0ZZcFpBQUFBQUFBQUFBQUFBQUFBS2dBQUFBQUFBQUFCQUFBQUFBQUFB QT09PGJyPgogICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAg ICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICAgIMKgZGM9 cm9ja3M8YnI+CiAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8 YnI+CiAgICAgIG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAgIG9iamVjdENsYXNzOiBuc0RTNVJl cGxpY2E8YnI+CiAgICAgIG9iamVjdENsYXNzOiBleHRlbnNpYmxlb2JqZWN0PGJyPgogICAgICBu c2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAwMDA8YnI+CiAg ICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAg ICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICBocmVmPSJsZGFwOi8v c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5 PC9hPn0KICAgICAgNTdiZTgwNGMwMDAwMDUwYTAwMDA8YnI+CiAgICAgIMKgIDU4NzIzNjE1MDAw MDA1MGEwMDAwPGJyPgogICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIgogICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAg ICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBh LXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgNTdiMTAzZDQwMDAwMDQyOTAwMDxicj4KICAg ICAgwqAwIDU3YmU4MDQzMDAwNzA0MjkwMDAwPGJyPgogICAgICBuc2RzNWFnbXRtYXhjc246CiAg ICAgIG89aXBhY2E7Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21j YXQ7ZnJlZWk8YnI+CiAgICAgIMKgcGEtc2VhLmJwdC5yb2NrczszODk7MTA2NTs1ODcyMzYxNTAw MDAwNTBhMDAwMDxicj4KICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAx MjkwIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5r LWZyZWV0ZXh0IgogICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODki PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAwMDAwMDxicj4KICAg ICAgwqAwMDA8YnI+CiAgICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2 NSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIKICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+ bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAwMDAwPGJyPgogICAg ICDCoDAwMDA8YnI+CiAgICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiAzPGJyPgogICAgICBu c2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl IiBjaXRlPSJtaWQ6NTk4ODI4NzEuMTAwMDEwNkByZWRoYXQuY29tIj48Zm9udAogICAgICAgICAg c2l6ZT0iLTEiPiA8YnI+CiAgICAgICAgICBSZWdhcmRzPGJyPgogICAgICAgICAgdGhpZXJyeTxi cj4KICAgICAgICA8L2ZvbnQ+CiAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgIGNpdGU9Im1p ZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUyYzNAcmVkaGF0LmNvbSIKICAgICAg ICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3Jvb3RA ZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2gKICAgICAgICAgICAgLUxMTCAtRCAnY249ZGly ZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl LG89aXBhY2EgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICBkbjogdWlkPXBr aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0 ZTo6CiAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZB REEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIMKgICZsdDt0 cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZh MVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6 CiAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNG QURBME1SSXdFQVlEVlFRSwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICZsdDt0cnVuY2F0 ZWQmZ3Q7IGZ1UVFabVAxWHJLa3Jmc2plaUZiVUZ0b01uZm1ITElZcGU1UUFSIDxicj4KICAgICAg ICAgICAgZGVzY3JpcHRpb246IDI7MTM0MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAg ICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtIDxicj4KICAgICAgICAgICAg wqAgLE89QlBULlJPQ0tTIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249 ZGlyZWN0b3J5CiAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVv cGxlLG89aXBhY2EKICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4K ICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICBkbjogdWlk PXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgIHVzZXJDZXJ0aWZp Y2F0ZTo6CiAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFR c0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIMKgICZs dDt0cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1 TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAy OzQ7Q049Q2VydGlmaWNhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAg IFN1YnN5c3RlbSxPPUJQVC5STyA8YnI+CiAgICAgICAgICAgIMKgIENLUyA8YnI+CiAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWYgeW91IGNoZWNr IHRoZSBjZXJ0aWZpY2F0ZXMgZGF0ZXMsCiAgICAgICAgICAgICAgSSBndWVzcyB0aGF0IHRoZSBt b3N0IHJlY2VudCBvbmUgaXMgb24gc2VydmVyIHNlYXR0bGVuZnMKICAgICAgICAgICAgICAoYmVj YXVzZSBvZiBzZXJpYWwgbnVtYmVycykuIENhbiB5b3UgY29uZmlybSB0aGlzIChiZWNhdXNlCiAg ICAgICAgICAgICAgb3VyIGdvYWwgaXMgdG8gaGF2ZSB0aGUgbW9zdCByZWNlbnQgY2VydCBzdG9y ZWQgaW4gYWxsIHRoZQogICAgICAgICAgICAgIE5TU0RCcyBhbmQgaW4gTERBUCk/IDxicj4KICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgVGhhbmtzLCA8YnI+CiAgICAgICAgICAgICAg RmxvIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+SWYgeW91ciByZW5ld2FsIG1hc3RlciBpcyB0aGUKICAgICAgICAgICAgICAg ICAgbWFjaGluZSBvbiB3aGljaCB0aGUgTlNTIERCIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMK ICAgICAgICAgICAgICAgICAgY29udGFpbnMgdGhlIG5ld2VyIGNlcnQsIHRoZW4geW91IGNhbiBt YW51YWxseSBydW4gdGhlCiAgICAgICAgICAgICAgICAgIHNjcmlwdHM6IDxicj4KICAgICAgICAg ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg IElmIEknbSBpbnRlcnByZXRpbmcgdGhpcyBjb3JyZWN0bHksIHRoZW4gaXQgaXMuLi4gc28gSQog ICAgICAgICAgICAgICAgcmFuIHRoaXMgb24gdGhlIGJyb2tlbiBtYWNoaW5lIChzZWF0dGxlbmZz KSA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj4kIHN1ZG8KICAgICAgICAgICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0 bW9uZ2VyL3N0b3BfcGtpY2FkIDxicj4KICAgICAgICAgICAgICAgICAgJCBzdWRvIC91c3IvbGli ZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICJzdWJz eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgIEkgcmFuIHRoaXMsIGl0IHRvb2sgYSB3aGlsZSwgdGhlbiBJIHJlLWNoZWNrZWQgYW5kIHRo ZQogICAgICAgICAgICAgICAgc2VyaWFsIHN0aWxsIHNlZW1zIHRvIGJlIDQgPGJyPgogICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp cmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1w ZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9u IDxicj4KICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAg ICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAg ICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lC QWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICDCoCBaTm80 ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9IDxicj4KICAgICAgICAg ICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgIEF1 dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgSGVyZSdzIHdoYXQgd2FzIGluIC92YXIv bG9nL3BraS9wa2ktdG9tY2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09IDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXTogPT09PT3CoAogICAgICAgICAgICAgICAgREVCVUcgU1VCU1lTVEVN IElOSVRJQUxJWkVEwqDCoCA9PT09PT09IDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgID09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09IDxicj4KICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4K ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUg cGF0aD8KICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1No dXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b bG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQg dG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgICAgc3VwcG9y dDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg IENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4K ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0IGlkPWRlYnVnIDxicj4K ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgZGVidWcgPGJyPgog ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0U3Vic3lzdGVtIGlkPWxvZyA8YnI+ CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0 b3AtMV06CiAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9bG9nIDxi cj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0 U3RvcC0xXTogQ3JlYXRpbmcKICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGli L3BraS9wa2ktdG9tY2F0L2xvZ3MvY2Evc2lnbmVkQXVkaXQvY2FfYXVkaXQpCgogICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOiBDcmVhdGluZwogICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUo L3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9zeXN0ZW0pIDxicj4KICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogQ3JlYXRp bmcKICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9wa2ktdG9tY2F0 L2xvZ3MvY2EvdHJhbnNhY3Rpb25zKQoKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4K ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUg cGF0aD8KICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1No dXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b bG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQg dG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgICAgc3VwcG9y dDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg IENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4K ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0IGlkPWxvZyA8YnI+CiAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGxvZyA8YnI+CiAgICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 CiAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1qc3MgPGJyPgog ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93bj8g ZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24g Y3J1bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQv bG9ncy9hdXRvU2h1dGRvd24uY3J1bWIgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3 OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5n aW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNodXRkb3duCiAgICAgICAgICAg ICAgICBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAg ICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAg ICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1w a2ktY2EgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQgaWQ9 anNzIDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQganNz IDxicj4KICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0 YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdFN1YnN5c3RlbSBpZD1k YnMgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZWFkeSB0byBpbml0IGlk PWRicyA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICBEQlN1YnN5c3RlbTogaW5pdCgpIG1FbmFi bGVTZXJpYWxNZ210PXRydWUgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUy OjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBDcmVhdGluZwogICAgICAgICAgICAgICAgTGRh cEJvdW5kQ29ubkZhY3RvcihEQlN1YnN5c3RlbSkgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg TGRhcEJvdW5kQ29ubkZhY3Rvcnk6IGluaXQgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgTGRh cEJvdW5kQ29ubkZhY3Rvcnk6ZG9DbG9uaW5nIHRydWUgPGJyPgogICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgTGRhcEF1dGhJbmZvOiBpbml0KCkgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3 OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgTGRhcEF1 dGhJbmZvOiBpbml0IGJlZ2lucyA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICBMZGFwQXV0aElu Zm86IGluaXQgZW5kcyA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IGluaXQ6CiAgICAgICAgICAgICAgICBiZWZvcmUgbWFr ZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICBtYWtlQ29ubmVjdGlvbjogZXJyb3JJZkRvd24gdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICBb MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IFRDUAogICAgICAg ICAgICAgICAgS2VlcC1BbGl2ZTogdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICBTU0xD bGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nIGRlc2lyZWQgY2VydAogICAgICAg ICAgICAgICAgbmlja25hbWUgdG86IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd OgogICAgICAgICAgICAgICAgTGRhcEpzc1NTTFNvY2tldDogc2V0IGNsaWVudCBhdXRoIGNlcnQg bmlja25hbWUKICAgICAgICAgICAgICAgIHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgog ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRl cmluZyEgPGJyPgogICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOiBDYW5kaWRhdGUKICAgICAgICAgICAgICAgIGNlcnQ6IG9jc3BTaWdu aW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IENhbmRpZGF0ZQogICAgICAgICAgICAgICAg Y2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBkZXNpcmVkIGNlcnQgZm91bmQgaW4K ICAgICAgICAgICAgICAgIGxpc3Q6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd OgogICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJu aW5nOgogICAgICAgICAgICAgICAgc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 IFNTTAogICAgICAgICAgICAgICAgaGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgIENNU0VuZ2luZS5zaHV0ZG93bigpIDxicj4KICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIEkgcmVhbGx5IGFwcHJlY2lhdGUg eW91IHN0aWNraW5nIHdpdGggbWUgdGhyb3VnaCB0aGlzLsKgCiAgICAgICAgICAgICAgICBJIG93 ZSB5b3UuIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIC0gSWFuIDxi cj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPkFmdGVyIHRoYXQsIGNoZWNrIHRoYXQgdGhlIExEQVAKICAgICAgICAgICAgICAgICAg ZW50cnkgaGFzIGJlZW4gdXBkYXRlZC4gSWYgaXQgaXMgdGhlIGNhc2UsIHlvdSBzaG91bGQKICAg ICAgICAgICAgICAgICAgYmUgYWJsZSB0byByZXN0YXJ0IHBraS4gPGJyPgogICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIEZsbyA8YnI+CiAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+VGhhbmsgeW91IGFn YWluIGZvciB5b3VyIHRpbWUhCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBJYW4gPGJyPgogICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5GbG8u IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIHdoaWNoIHNlZW1zIHdlaXJkLiA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+VGhlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgYXR0 cmlidXRlIGluIHRoZSBsZGFwc2VhcmNoIG91dHB1dCBpcyBvZiB0aGUKICAgICAgICAgICAgICAg ICAgICAgICAgICBmb3JtIDI7IztETjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSAjIHNob3VsZCBtYXRjaCB0aGUgc2Vy aWFsIG51bWJlciBpbiB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICBmaXJzdCBjZXJ0dXRp bCBvdXRwdXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICBUaGUgQVNDSUkgYmxvYiAobWludXMgdGhlIEJFR0lOL0VORCBoZWFkZXJz KQogICAgICAgICAgICAgICAgICAgICAgICAgIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUgYXR0cmlidXRlcy4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0 IC0tIDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAg ICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQu b3JnIgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9Im1vei10 eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPjwv YT4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVt YWlsIHRvIDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIK ICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRv cmFob3N0ZWQub3JnIgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xh c3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMt bGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5m ZWRvcmFob3N0ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18gPGJyPgogICAgICAgICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEK ICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAg aHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAg ICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJl dmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3Jn Ij5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9hPgogICAgICAgICAg PGJyPgogICAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAg ICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICBocmVmPSJt YWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAg ICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2 aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3Rl ZC5vcmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48L2E+ CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIDxicj4KICAgICAg PC9ibG9ja3F1b3RlPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGZpZWxkc2V0IGNsYXNz PSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgPGJyPgogICAgICA8cHJl IHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K RnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJy ZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgpUbyB1bnN1YnNjcmli ZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhy ZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZy ZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPC9wcmU+CiAgICA8 L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgPC9ib2R5Pgo8L2h0bWw+Cg== --===============8600127386348226288==-- From ianh at brownpapertickets.com Wed Aug 9 19:31:30 2017 Content-Type: multipart/mixed; boundary="===============4767585338843903604==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Wed, 09 Aug 2017 12:30:52 -0700 Message-ID: In-Reply-To: 598ADE7F.3080308@redhat.com --===============4767585338843903604== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/9/17 3:05 AM, thierry bordaz wrote: > Hi Ian, > > Thanks for having gather those data. > > # > # So pkidbuser entries have a same (old) userCertificate likely > generated during install > # But only freeipa-sea has a new one created on freeipa-sea around > Jun 8th 2017 05:54:16 > # This recent certificate is identified by 5938e688000104290000 > # > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' > -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > ... > nscpentrywsi: userCertificate:: > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR > nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: > MIIDbjCCAlagAwIBAgI > > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' > -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi > dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca > nscpentrywsi: userCertificate:: > MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR > > > > # > # why 5938e688000104290000 value was not propagated to seattlenfs ? > # The most recent update (from freeipa-sea) that was replicated to > seattlenfs > # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07). > # In addition seattlenfs received direct update (last one was in > Jan 1017) that were not > # replicated to freeipa-sea > # > # The two servers have diverged because they can not replicate to > eachother because > # they were not correctly initialize. > # They have different "replicageneration" (57c291d9000004290000 vs > 55c8f3ae000000600000) > # > # It is looking like freeipa-sea was created one or two years ago > and used to initialized seattlenfs. > # But later freeipa-sea was recreated. > That's about right. > > # > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' > -W -b "o=3Dipaca" > "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff= f-ffffffff))" > Enter LDAP Password: > dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig > nsds50ruv: {replicageneration} 57c291d9000004290000 > nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} > 57f840bf000004290000 598a1c40000104290000 > nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} > nsruvReplicaLastModified: {replica 1065 > ldap://freeipa-sea.bpt.rocks:389} 598a1c16 > nsruvReplicaLastModified: {replica 1290 > ldap://seattlenfs.bpt.rocks:389} 00000000 > > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' > -W -b "o=3Dipaca" > "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff= f-ffffffff))" > dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig > nsds50ruv: {replicageneration} 55c8f3ae000000600000 > nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} > 57b103d4000004290000 57be8043000704290000 > nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} > 57be804c0000050a0000 587236150000050a0000 > nsruvReplicaLastModified: {replica 1290 > ldap://seattlenfs.bpt.rocks:389} 00000000 > nsruvReplicaLastModified: {replica 1065 > ldap://freeipa-sea.bpt.rocks:389} 00000000 > > > > In conclusion: > From replication pov, the two instances can not communicate. > One solution would be to identify which instance is the good one, = > you want to keep. > and reinit the second one from that reference. > What exactly does reinit mean? I have run ipa-replica-manage re-initialize --from freeipa-sea.bpt.rocks several times over the years when replication has stopped. Replication actually is working, as far as user and machine accounts and = attributes are concerned anyway, and has been for a while. There is a zombie server freeipa-dal.bpt.rocks that I can't get rid = of... it shows up in the GUI on the Topology page but generates a Server = not found error. I don't know if that's related. > > On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote: >> >> On 8/7/17 1:44 AM, thierry bordaz wrote: >> >>> >>> >>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote: >>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>>>> >>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>>>> Ian Harding wrote: >>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users = >>>>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that = >>>>>>>>>>>>>>>>>>> had apparently had >>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can = >>>>>>>>>>>>>>>>>> run without >>>>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see = >>>>>>>>>>>>>>>>>> what is going on. >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication = >>>>>>>>>>>>>>>>> failed (49) >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and = >>>>>>>>>>>>>>>> needs to >>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how this >>>>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind = >>>>>>>>>>>>>>>> DN and >>>>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> I found this: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o= =3Dipaca >>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>>>> ... >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a = >>>>>>>>>>>>>>> prompt to provide >>>>>>>>>>>>>>> a pin/password >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>>>> >>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>> >>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>>>>> password can be >>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf (with = >>>>>>>>>>>>>> the tag >>>>>>>>>>>>>> internal=3D...) >>>>>>>>>>>>>> >>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... = >>>>>>>>>>>>>> allows to read >>>>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>> (provide password) >>>>>>>>>>>>> >>>>>>>>>>>>> That works... >>>>>>>>>>>>> >>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>>>>> User Private >>>>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>>>> Certificate >>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>>>>>>>>> caSigningCert >>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>>>> Certificate >>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f Server-Cert >>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>>>> Certificate >>>>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>>>> >>>>>>>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>>>>>>> >>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>>>> >>>>>>>>>>>>> That password is getting me somewhere though, since if I = >>>>>>>>>>>>> put in a >>>>>>>>>>>>> nonsense or incorrect password it just prompts over and over. >>>>>>>>>>>> >>>>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>>>> >>>>>>>>>>> There wasn't much of a change... I just assumed someone ran = >>>>>>>>>>> yum upgrade and didn't restart, then the power outage... it = >>>>>>>>>>> looks like not much of a version change though. >>>>>>>>>>> >>>>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>> Jan 08 04:46:08 Installed: python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>>>> Jul 28 09:55:41 Updated: = >>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:46 Updated: = >>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>> >>>>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>>>> Jan 08 04:47:19 Installed: pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>>>> >>>>>>>>>>> # getenforce >>>>>>>>>>> Enforcing >>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> If so can you run: >>>>>>>>>>>> >>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use the = >>>>>>>>>>> write_logs option. >>>>>>>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>>>>>>> ---- >>>>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc00000= 3e = >>>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800 = a2=3D1 = >>>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D4294= 967295 = >>>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 = >>>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) = >>>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { = >>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" = >>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 = >>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>>> I suspect that the subsystem cert was renewed and = >>>>>>>>>>>> everything wasn't >>>>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>>>> upgrade it just >>>>>>>>>>>> shone a spotlight on it. >>>>>>>>>>>> >>>>>>>>>>>> Can you run these commands: >>>>>>>>>>>> >>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript= ion >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> This returns >>>>>>>>>>> >>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti= on >>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>> userCertificate:: = >>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>> ... stuff ... >>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D= CA = >>>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>>> >>>>>>>>>>>> and >>>>>>>>>>>> >>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> These both return >>>>>>>>>>> >>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n 'subsystemCert = >>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>>>> Unrecognized Object Identifier. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>>> User Private Key and Certificate Services" >>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>>>> Unrecognized Object Identifier. >>>>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> you made a typo and requested the keys (-K) instead of the = >>>>>>>>>> certs (-L). Please retry with -L and you should be able to = >>>>>>>>>> see the certificate serial. >>>>>>>>>> >>>>>>>>> >>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertific= ate = >>>>>>>>> description >>>>>>>>> Enter LDAP Password: >>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>> userCertificate:: = >>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>> ... >>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>> >>>>>>>>> So the serial is 4? >>>>>>>>> >>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>> grep Serial >>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>> >>>>>>>>> Which is NOT 4... >>>>>>>>> >>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a >>>>>>>>> -----BEGIN CERTIFICATE----- >>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>> ... >>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>>> -----END CERTIFICATE----- >>>>>>>>> >>>>>>>>> And this cert is NOT the same. >>>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>>>> post-save commands (which you can see in the output of getcert = >>>>>>>> list). In your case, the post-save command for subsystemCert = >>>>>>>> cert-pki-ca probably failed. >>>>>>>> >>>>>>>> This command (on the renewal master) is responsible for copying = >>>>>>>> the new cert from the NSS db to the LDAP server. You need first = >>>>>>>> to check which IPA server is the renewal master (as the serial = >>>>>>>> numbers are in a completely different range, I assume that you = >>>>>>>> have multiple IPA servers configured with a CA instance): >>>>>>>> >>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D -= f2-` >>>>>>>> $ kinit admin >>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>> dn: = >>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn= =3Detc,dc=3Dipadomain,dc=3Dcom = >>>>>>>> >>>>>>>> >>>>>>>> In this example the renewal master is vm-ipaserver. >>>>>>>> >>>>>>> >>>>>>> I get this >>>>>>> >>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>> dn: = >>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,d= c=3Dbpt,dc=3Drocks = >>>>>>> >>>>>>> >>>>>>> Which is the other FreeIPA server. >>>>>>> >>>>>> Hi Ian, >>>>>> >>>>>> it's getting difficult to follow this thread, so could we step = >>>>>> back and summarize? >>>>> Yes, it is. Sorry. >>>>>> >>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in = >>>>>> the NSSDB /etc/pki/pki-tomcat/alias >>>>> No? >>>>> >>>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>>>> component is installed and 'subsystemCert cert-pki-ca' has Serial = >>>>>> number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>>>> Yes >>>>> >>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>> >>>>>> >>>>>> - In the LDAP servers, the cert is stored in the entry = >>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it = is = >>>>>> the cert from freeipa-sea). >>>>> This is where the difference is. There are two certificates on = >>>>> the master and only one on the other. I wonder if this is a = >>>>> result of the slow motion replication trainwreck I have going on = >>>>> due to a zombie replica in the ldap database that no longer exists = >>>>> in the real world and I can't seem to get rid of. >>>>> >>>> Hi, >>>> >>>> the remaining issue is a replication problem. There is a = >>>> "Troubleshooting replication" section [1] in IdM Admin guide that = >>>> may help you. >>>> >>>> Regarding your zombie replica, which commands did you use to try to = >>>> remove it, and what was the output? >>>> >>>> Flo >>>> >>>> [1] = >>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux= /7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-r= eplication.html >>>> >>> >>> Hi, >>> >>> To debug replication latency or problem we would need several info = >>> but starting with the results of the following commands >>> >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >> -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> nscpentrywsi: = >> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: >> 75274897 >> nscpentrywsi: = >> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 >> 90004: 20170608055334Z >> nscpentrywsi: = >> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 >> 003: cn=3DDirectory Manager >> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >> nscpentrywsi: cn: pkidbuser >> nscpentrywsi: createTimestamp: 20150716125146Z >> nscpentrywsi: creatorsName: cn=3Ddirectory manager >> nscpentrywsi: description;vucsn-5938e688000104290001: = >> 2;1341718541;CN=3DCertific >> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = >> 2;4;CN=3DCertifica >> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >> nscpentrywsi: mail: >> nscpentrywsi: objectClass: top >> nscpentrywsi: objectClass: person >> nscpentrywsi: objectClass: organizationalPerson >> nscpentrywsi: objectClass: inetOrgPerson >> nscpentrywsi: objectClass: cmsuser >> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >> nscpentrywsi: sn: pkidbuser >> nscpentrywsi: uid: pkidbuser >> nscpentrywsi: userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >> >> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = >> MIIDbjCCAlagAwIBAgI >> >> AR >> nscpentrywsi: userPassword:: >> nscpentrywsi: userstate: 1 >> nscpentrywsi: usertype: agentType >> nscpentrywsi: parentid: 2 >> nscpentrywsi: entryid: 51 >>> and >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >> Enter LDAP Password: >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >> nscpentrywsi: userCertificate:: = >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >> >> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >> nscpentrywsi: description: 2;4;CN=3DCertificate = >> Authority,O=3DBPT.ROCKS;CN=3DCA Subs >> ystem,O=3DBPT.ROCKS >> nscpentrywsi: entryid: 51 >> nscpentrywsi: parentid: 2 >> nscpentrywsi: modifyTimestamp: 20150716125146Z >> nscpentrywsi: createTimestamp: 20150716125146Z >> nscpentrywsi: modifiersName: cn=3Ddirectory manager >> nscpentrywsi: creatorsName: cn=3Ddirectory manager >> nscpentrywsi: userPassword:: >> nscpentrywsi: userstate: 1 >> nscpentrywsi: usertype: agentType >> nscpentrywsi: mail: >> nscpentrywsi: cn: pkidbuser >> nscpentrywsi: sn: pkidbuser >> nscpentrywsi: uid: pkidbuser >> nscpentrywsi: objectClass: top >> nscpentrywsi: objectClass: person >> nscpentrywsi: objectClass: organizationalPerson >> nscpentrywsi: objectClass: inetOrgPerson >> nscpentrywsi: objectClass: cmsuser >> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >> nscpentrywsi: entryusn: 86 >>> >>> From the output you may only copy/past the ones related to = >>> userCertificate >>> >>> >>> Also to dump the current replication status, send the result of >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>> -W -b = >>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffff= fff-ffffffff-ffffffff))" >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >> -b "o=3Dipaca" = >> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-f= fffffff))" >> Enter LDAP Password: >> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >> cn: replica >> nsDS5Flags: 1 >> nsDS5ReplicaBindDN: cn=3DReplication Manager = >> cloneAgreement1-freeipa-sea.bpt.roc >> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >> nsDS5ReplicaBindDN: cn=3DReplication Manager = >> masterAgreement1-seattlenfs.bpt.roc >> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >> nsDS5ReplicaId: 1065 >> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 >> nsDS5ReplicaRoot: o=3Dipaca >> nsDS5ReplicaType: 3 >> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D >> nsds5replicabinddngroup: cn=3Dreplication = >> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >> dc=3Drocks >> nsds5replicabinddngroupcheckinterval: 60 >> objectClass: top >> objectClass: nsDS5Replica >> objectClass: extensibleobject >> nsds50ruv: {replicageneration} 57c291d9000004290000 >> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >> 57f840bf00000429000 >> 0 598a1c40000104290000 >> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >> nsds5agmtmaxcsn: = >> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat >> tlenfs.bpt.rocks;389;unavailable >> nsds5agmtmaxcsn: = >> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat >> tlenfs.bpt.rocks;389;unavailable >> nsruvReplicaLastModified: {replica 1065 = >> ldap://freeipa-sea.bpt.rocks:389} 598a >> 1c16 >> nsruvReplicaLastModified: {replica 1290 = >> ldap://seattlenfs.bpt.rocks:389} 00000 >> 000 >> nsds5ReplicaChangeCount: 885 >> nsds5replicareapactive: 0 >>> and >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >>> -b = >>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fffff= fff-ffffffff-ffffffff))" >> >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b "o=3Dipaca" = >> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-f= fffffff))" >> Enter LDAP Password: >> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >> cn: replica >> nsDS5Flags: 1 >> nsDS5ReplicaBindDN: cn=3DReplication Manager = >> cloneAgreement1-seattlenfs.bpt.rock >> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >> nsDS5ReplicaId: 1290 >> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 >> nsDS5ReplicaRoot: o=3Dipaca >> nsDS5ReplicaType: 3 >> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D >> nsds5replicabinddngroup: cn=3Dreplication = >> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >> dc=3Drocks >> nsds5replicabinddngroupcheckinterval: 60 >> objectClass: top >> objectClass: nsDS5Replica >> objectClass: extensibleobject >> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = >> 57be804c0000050a0000 >> 587236150000050a0000 >> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >> 57b103d400000429000 >> 0 57be8043000704290000 >> nsds5agmtmaxcsn: = >> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei >> pa-sea.bpt.rocks;389;1065;587236150000050a0000 >> nsruvReplicaLastModified: {replica 1290 = >> ldap://seattlenfs.bpt.rocks:389} 00000 >> 000 >> nsruvReplicaLastModified: {replica 1065 = >> ldap://freeipa-sea.bpt.rocks:389} 0000 >> 0000 >> nsds5ReplicaChangeCount: 3 >> nsds5replicareapactive: 0 >>> >>> Regards >>> thierry >>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti= on >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>> >>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> userCertificate:: = >>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>>>> description: 2;1341718541;CN=3DCertificate = >>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem >>>>> ,O=3DBPT.ROCKS >>>>> >>>>> >>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti= on >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>> >>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>> Subsystem,O=3DBPT.RO >>>>> CKS >>>>> >>>>>> If you check the certificates dates, I guess that the most recent = >>>>>> one is on server seattlenfs (because of serial numbers). Can you = >>>>>> confirm this (because our goal is to have the most recent cert = >>>>>> stored in all the NSSDBs and in LDAP)? >>>>>> >>>>>> Thanks, >>>>>> Flo >>>>>> >>>>>> >>>>>>>> If your renewal master is the machine on which the NSS DB = >>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you can = >>>>>>>> manually run the scripts: >>>>>>> >>>>>>> If I'm interpreting this correctly, then it is... so I ran this = >>>>>>> on the broken machine (seattlenfs) >>>>>>> >>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert = >>>>>>>> cert-pki-ca" >>>>>>>> >>>>>>> >>>>>>> I ran this, it took a while, then I re-checked and the serial = >>>>>>> still seems to be 4 >>>>>>> >>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>> Enter LDAP Password: >>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>> userCertificate:: = >>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>> ... >>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>> >>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>>>> >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DEBU= G = >>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> restart at autoShutdown? false >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> autoShutdown crumb file path? = >>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>>> cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>>> cert:auditSigningCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>> init id=3Ddebug >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> initialized debug >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> initSubsystem id=3Dlog >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>>> to init id=3Dlog >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit= ) = >>>>>>> >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> restart at autoShutdown? false >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> autoShutdown crumb file path? = >>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>>> cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>>> cert:auditSigningCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>> init id=3Dlog >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> initialized log >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> initSubsystem id=3Djss >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>>> to init id=3Djss >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> restart at autoShutdown? false >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> autoShutdown crumb file path? = >>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>>> cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>>> cert:auditSigningCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>> init id=3Djss >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> initialized jss >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>> initSubsystem id=3Ddbs >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>>> to init id=3Ddbs >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: = >>>>>>> init() mEnableSerialMgmt=3Dtrue >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>> LdapBoundConnFactor(DBSubsystem) >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> LdapBoundConnFactory: init >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> LdapBoundConnFactory:doCloning true >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: init() >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>> init begins >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>> init ends >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>>>> makeConnection errorIfDown is true >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>>>>>> errorIfDown true >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: true >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname = >>>>>>> to: subsystemCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapJssSSLSocket: = >>>>>>> set client auth cert nickname subsystemCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> SSLClientCertificatSelectionCB: Entering! >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>>> ocspSigningCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>>> subsystemCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>>>> subsystemCert cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert = >>>>>>> cert-pki-ca >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake = >>>>>>> happened >>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine.shutdown() >>>>>>> >>>>>>> >>>>>>> I really appreciate you sticking with me through this. I owe you. >>>>>>> >>>>>>> - Ian >>>>>>> >>>>>>>> After that, check that the LDAP entry has been updated. If it = >>>>>>>> is the case, you should be able to restart pki. >>>>>>>> >>>>>>>> Flo >>>>>>>> >>>>>>>>> Thank you again for your time! >>>>>>>>> >>>>>>>>> Ian >>>>>>>>> >>>>>>>>>> Flo. >>>>>>>>>>> >>>>>>>>>>> which seems weird. >>>>>>>>>>> >>>>>>>>>>>> The description attribute in the ldapsearch output is of = >>>>>>>>>>>> the form 2;#;DN;DN >>>>>>>>>>>> >>>>>>>>>>>> The # should match the serial number in the first certutil = >>>>>>>>>>>> output >>>>>>>>>>>> >>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match = >>>>>>>>>>>> one of the >>>>>>>>>>>> userCertificate attributes. >>>>>>>>>>>> >>>>>>>>>>>> rob >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>> >>>>> _______________________________________________ >>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>> To unsubscribe send an email to = >>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>> _______________________________________________ >>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email to = >>>> freeipa-users-leave(a)lists.fedorahosted.org >>> >> >> >> >> _______________________________________________ >> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.= org > --===============4767585338843903604== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPHA+T24gOC85LzE3IDM6MDUgQU0sIHRoaWVy cnkgYm9yZGF6IHdyb3RlOjxicj4KICAgIDwvcD4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi IGNpdGU9Im1pZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICA8bWV0YSBjb250 ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+ CiAgICAgIEhpIElhbiw8YnI+CiAgICAgIDxicj4KICAgICAgVGhhbmtzIGZvciBoYXZpbmcgZ2F0 aGVyIHRob3NlIGRhdGEuIDxicj4KICAgICAgPHR0Pjxicj4KICAgICAgPC90dD4KICAgICAgPGJs b2NrcXVvdGU+PHR0PiM8L3R0Pjxicj4KICAgICAgICA8dHQ+IyBTbyBwa2lkYnVzZXIgZW50cmll cyBoYXZlIGEgc2FtZSAob2xkKSB1c2VyQ2VydGlmaWNhdGUKICAgICAgICAgIGxpa2VseSBnZW5l cmF0ZWQgZHVyaW5nIGluc3RhbGw8L3R0Pjxicj4KICAgICAgICA8dHQ+IyBCdXQgb25seSBmcmVl aXBhLXNlYSBoYXMgYSBuZXcgb25lIGNyZWF0ZWQgb24gZnJlZWlwYS1zZWEKICAgICAgICAgIGFy b3VuZCBKdW4gOHRoIDIwMTcgMDU6NTQ6MTY8L3R0Pjxicj4KICAgICAgICA8dHQ+IyBUaGlzIHJl Y2VudCBjZXJ0aWZpY2F0ZSBpcyBpZGVudGlmaWVkIGJ5CiAgICAgICAgICA1OTM4ZTY4ODAwMDEw NDI5MDAwMCA8L3R0Pjxicj4KICAgICAgICA8dHQ+IzwvdHQ+PGJyPgogICAgICAgIDx0dD5bcm9v dEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAg ICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBu c2NwZW50cnl3c2k8L3R0Pjxicj4KICAgICAgICA8dHQ+ZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVv cGxlLG89aXBhY2E8L3R0Pjxicj4KICAgICAgICA8dHQ+Li4uPC90dD48YnI+CiAgICAgICAgPHR0 Pm5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgIE1JSURjekNDQWx1Z0F3 SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVIgJmx0O3NuaXAmZ3Q7PC90dD48YnI+CiAg ICAgICAgPHR0Pm5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAw MTA0MjkwMDAwOjoKICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0kgJmx0O3NuaXAmZ3Q7PC90 dD48YnI+CiAgICAgICAgPGJyPgogICAgICAgIDx0dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBs ZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicgLVcgLWIg dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8L3R0Pjxicj4KICAg ICAgICA8dHQ+ZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8L3R0Pjxicj4KICAg ICAgICA8dHQ+bnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgTUlJRGN6 Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8L3R0 Pjxicj4KICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIDxicj4KICAgICAgICA8dHQ+ IzwvdHQ+PGJyPgogICAgICAgIDx0dD4jIHdoeSA1OTM4ZTY4ODAwMDEwNDI5MDAwMCB2YWx1ZSB3 YXMgbm90IHByb3BhZ2F0ZWQgdG8KICAgICAgICAgIHNlYXR0bGVuZnMgPzwvdHQ+PGJyPgogICAg ICAgIDx0dD4jIFRoZSBtb3N0IHJlY2VudCB1cGRhdGUgKGZyb20gZnJlZWlwYS1zZWEpIHRoYXQg d2FzCiAgICAgICAgICByZXBsaWNhdGVkIHRvIHNlYXR0bGVuZnM8L3R0Pjxicj4KICAgICAgICA8 dHQ+IyBpc8KgIDEgeWVhciBvbGQgKDU3YmU4MDQzMDAwNzA0MjkwMDAwIC0gQXVnIDI1dGggMjAx NgogICAgICAgICAgMDU6MjE6MDcpLjwvdHQ+PGJyPgogICAgICAgIDx0dD4jIEluIGFkZGl0aW9u IHNlYXR0bGVuZnMgcmVjZWl2ZWQgZGlyZWN0IHVwZGF0ZSAobGFzdCBvbmUKICAgICAgICAgIHdh cyBpbiBKYW4gMTAxNykgdGhhdCB3ZXJlIG5vdDwvdHQ+PGJyPgogICAgICAgIDx0dD4jIHJlcGxp Y2F0ZWQgdG8gZnJlZWlwYS1zZWE8L3R0Pjxicj4KICAgICAgICA8dHQ+IyA8L3R0Pjxicj4KICAg ICAgICA8dHQ+IyBUaGUgdHdvIHNlcnZlcnMgaGF2ZSBkaXZlcmdlZCBiZWNhdXNlIHRoZXkgY2Fu IG5vdAogICAgICAgICAgcmVwbGljYXRlIHRvIGVhY2hvdGhlciBiZWNhdXNlPC90dD48YnI+CiAg ICAgICAgPHR0PiMgdGhleSB3ZXJlIG5vdCBjb3JyZWN0bHkgaW5pdGlhbGl6ZS48L3R0Pjxicj4K ICAgICAgICA8dHQ+IyBUaGV5IGhhdmUgZGlmZmVyZW50ICJyZXBsaWNhZ2VuZXJhdGlvbiIKICAg ICAgICAgICg1N2MyOTFkOTAwMDAwNDI5MDAwMCB2cyA1NWM4ZjNhZTAwMDAwMDYwMDAwMCk8L3R0 Pjxicj4KICAgICAgICA8dHQ+IzwvdHQ+PGJyPgogICAgICAgIDx0dD4jIEl0IGlzIGxvb2tpbmcg bGlrZSBmcmVlaXBhLXNlYSB3YXMgY3JlYXRlZCBvbmUgb3IgdHdvCiAgICAgICAgICB5ZWFycyBh Z28gYW5kIHVzZWQgdG8gaW5pdGlhbGl6ZWQgc2VhdHRsZW5mcy48L3R0Pjxicj4KICAgICAgICA8 dHQ+IyBCdXQgbGF0ZXIgZnJlZWlwYS1zZWEgd2FzIHJlY3JlYXRlZC48L3R0Pjxicj4KICAgICAg PC9ibG9ja3F1b3RlPgogICAgPC9ibG9ja3F1b3RlPgogICAgPHR0PlRoYXQncyBhYm91dCByaWdo dC48L3R0Pjxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3 Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICA8YmxvY2txdW90ZT4gPHR0PiM8L3R0Pjxicj4K ICAgICAgICA8dHQ+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAn Y249ZGlyZWN0b3J5CiAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhv YmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZm ZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgIDx0dD5FbnRlciBMREFQIFBhc3N3b3Jk OjwvdHQ+PGJyPgogICAgICAgIDx0dD5kbjogY249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFw cGluZyB0cmVlLGNuPWNvbmZpZzwvdHQ+PGJyPgogICAgICAgIDx0dD5uc2RzNTBydXY6IHtyZXBs aWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkwMDAwMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICA8dHQ+ bnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQi CiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAg ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j a3M6Mzg5PC9hPn0KICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDAwIDU5OGExYzQwMDAwMTA0 MjkwMDAwPC90dD48YnI+CiAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBj bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICBocmVmPSJsZGFwOi8vc2Vh dHRsZW5mcy5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fTwvdHQ+PGJyPgogICAgICAgIDx0 dD5uc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAg Y2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgaHJlZj0ibGRhcDovL2Zy ZWVpcGEtc2VhLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1 ZSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgNTk4YTFj MTY8L3R0Pjxicj4KICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGlj YSAxMjkwIDxhCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAg ICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAg IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwv YT59CiAgICAgICAgICAwMDAwMDAwMDwvdHQ+PGJyPgogICAgICAgIDxicj4KICAgICAgICA8dHQ+ W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkK ICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5z dG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZm KSkiPC90dD48YnI+CiAgICAgICAgPHR0PmRuOiBjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1t YXBwaW5nIHRyZWUsY249Y29uZmlnPC90dD48YnI+CiAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3Jl cGxpY2FnZW5lcmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYwMDAwMDwvdHQ+PGJyPgogICAgICAgIDx0 dD5uc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4 dCIKICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiCiAg ICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5y b2NrczozODk8L2E+fQogICAgICAgICAgNTdiMTAzZDQwMDAwMDQyOTAwMDAgNTdiZTgwNDMwMDA3 MDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxh IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9z ZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1 ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59wqAKICAgICAgICAgIDU3YmU4 MDRjMDAwMDA1MGEwMDAwIDU4NzIzNjE1MDAwMDA1MGEwMDAwPC90dD48YnI+CiAgICAgICAgPHR0 Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICBj bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICBocmVmPSJsZGFwOi8vc2Vh dHRsZW5mcy5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgMDAwMDAwMDA8 L3R0Pjxicj4KICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAx MDY1IDxhCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAg ICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICBt b3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9h Pn0KICAgICAgICAgIDAwMDAwMDAwPC90dD48L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAgICAg PGJyPgogICAgICBJbiBjb25jbHVzaW9uOjxicj4KICAgICAgwqDCoMKgIEZyb20gcmVwbGljYXRp b24gcG92LCB0aGUgdHdvIGluc3RhbmNlcyBjYW4gbm90IGNvbW11bmljYXRlLjxicj4KICAgICAg wqDCoMKgIE9uZSBzb2x1dGlvbiB3b3VsZCBiZSB0byBpZGVudGlmeSB3aGljaCBpbnN0YW5jZSBp cyB0aGUgZ29vZAogICAgICBvbmUsIHlvdSB3YW50IHRvIGtlZXAuPGJyPgogICAgICDCoMKgwqAg YW5kIHJlaW5pdCB0aGUgc2Vjb25kIG9uZSBmcm9tIHRoYXQgcmVmZXJlbmNlLjxicj4KICAgICAg PGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgV2hhdCBleGFjdGx5IGRvZXMgcmVpbml0IG1lYW4/ wqAgSSBoYXZlIHJ1bjxicj4KICAgIDxicj4KICAgIGlwYS1yZXBsaWNhLW1hbmFnZSByZS1pbml0 aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5icHQucm9ja3M8YnI+CiAgICA8YnI+CiAgICBzZXZl cmFsIHRpbWVzIG92ZXIgdGhlIHllYXJzIHdoZW4gcmVwbGljYXRpb24gaGFzIHN0b3BwZWQuwqAg PGJyPgogICAgPGJyPgogICAgUmVwbGljYXRpb24gYWN0dWFsbHkgaXMgd29ya2luZywgYXMgZmFy IGFzIHVzZXIgYW5kIG1hY2hpbmUgYWNjb3VudHMKICAgIGFuZCBhdHRyaWJ1dGVzIGFyZSBjb25j ZXJuZWQgYW55d2F5LCBhbmQgaGFzIGJlZW4gZm9yIGEgd2hpbGUuPGJyPgogICAgPGJyPgogICAg VGhlcmUgaXMgYSB6b21iaWUgc2VydmVyIGZyZWVpcGEtZGFsLmJwdC5yb2NrcyB0aGF0IEkgY2Fu J3QgZ2V0IHJpZAogICAgb2YuLi4gaXQgc2hvd3MgdXAgaW4gdGhlIEdVSSBvbiB0aGUgVG9wb2xv Z3kgcGFnZSBidXQgZ2VuZXJhdGVzIGEKICAgIFNlcnZlciBub3QgZm91bmQgZXJyb3IuwqAgSSBk b24ndCBrbm93IGlmIHRoYXQncyByZWxhdGVkLjxicj4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiIGNpdGU9Im1pZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20iPiA8YnI+CiAgICAgIDxk aXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDgvMjAxNyAxMDozMyBQTSwgSWFuIEhh cmRpbmcKICAgICAgICB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICAgIDwvZGl2Pgog ICAgICA8YmxvY2txdW90ZQogICAgICAgIGNpdGU9Im1pZDoyZjYwYzRhZi02ODBjLTQzODItOTcw NC00MWEyNGM4MTIxYTJAYnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICAgIHR5cGU9ImNpdGUi PgogICAgICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9o dG1sOwogICAgICAgICAgY2hhcnNldD11dGYtOCI+CiAgICAgICAgPHA+T24gOC83LzE3IDE6NDQg QU0sIHRoaWVycnkgYm9yZGF6IHdyb3RlOjxicj4KICAgICAgICA8L3A+CiAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+ CiAgICAgICAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiCiAgICAg ICAgICAgIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgICAgICAgICA8YnI+CiAgICAgICAg ICA8YnI+CiAgICAgICAgICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDA4LzA3LzIw MTcgMDk6MjIgQU0sIEZsb3JlbmNlCiAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQ QS11c2VycyB3cm90ZTo8YnI+CiAgICAgICAgICA8L2Rpdj4KICAgICAgICAgIDxibG9ja3F1b3Rl CiAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUy YzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0ZSI+T24gMDgvMDQvMjAxNyAxMTow MiBQTSwgSWFuIEhhcmRpbmcgdmlhCiAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxi cj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gOC80LzE3IDI6MTYgQU0s IEZsb3JlbmNlCiAgICAgICAgICAgICAgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAz LzIwMTcgMTE6MTMgUE0sIElhbgogICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11 c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+ T24gMDgvMDMvMjAxNyAxMjoyOCBBTSwgRmxvcmVuY2UKICAgICAgICAgICAgICAgICAgQmxhbmMt UmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPk9uIDA4LzAyLzIwMTcgMTE6NTEgUE0sIElhbgogICAgICAgICAgICAgICAgICAgIEhhcmRp bmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDEyOjExIEFNLAogICAgICAgICAgICAg ICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDAxOjQzIEFNLAog ICAgICAgICAgICAgICAgICAgICAgICBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDEyOjAz IFBNLAogICAgICAgICAgICAgICAgICAgICAgICAgIFJvYiBDcml0dGVuZGVuIHdyb3RlOiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFuIEhh cmRpbmcgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcgMDc6MzkKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMDM6MTEgUE0sIElhbiBIYXJkaW5nIHdyb3Rl OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSI+T24gMDgvMDEvMjAxNwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMDE6 NDggQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZToKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgMDE6MzIgQU0sIElhbiBIYXJkaW5nIHZpYQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIE9uIDA3LzMxLzIwMTcgMTE6MzQgQU0sIFJvYgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIENyaXR0ZW5kZW4gd3JvdGU6IDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5J YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZy ZWVJUEEtdXNlcnMgd3JvdGU6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj5JIGhhZCBhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB1bmV4cGVjdGVkIHJlc3RhcnQgb2YgYW4gSVBBCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciB0aGF0IGhhZCBhcHBhcmVudGx5IGhhZAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZXMgcnVuIGJ1dCBoYWQgbm90IGJlZW4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVzdGFydGVkLiBpcGFj dGwgc2F5cwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktdG9t Y2F0ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdvdWxk IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbm90IHN0YXJ0 LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3RyYW5nZWx5LCB0aGUgYWN0 dWFsIHNlcnZpY2UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXBw ZWFycyB0byBiZSBydW5uaW5nOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwv YmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyBpcyBhbiBhcHBs aWNhdGlvbiB3aXRoaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRv bWNhdCBzbyB0b21jYXQgY2FuIHJ1biB3aXRob3V0CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBkb2d0YWcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnVu bmluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV2UgbmVlZCB0byBzZWUgbW9y ZSBvZiB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyBk ZWJ1ZyBsb2cgdG8gc2VlIHdoYXQgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGdvaW5nIG9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJdCBsb29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0 aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJvYmxlbS4uLiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgpbMjgvSnVsLzIwMTc6 MTA6MDg6NDddW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IFNTTCBoYW5kc2hha2UgaGFwcGVuZWQg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENvdWxkIG5vdCBjb25u ZWN0IHRvIExEQVAgc2VydmVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg aG9zdCBzZWF0dGxlbmZzLmJwdC5yb2NrcyBwb3J0IDYzNgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBFcnJvciBuZXRzY2FwZS5sZGFwLkxEQVBFeGNlcHRpb246CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgQXV0aGVudGljYXRpb24gZmFpbGVkICg0OSkgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIHN0b3JlcyBpdHMgaW50ZXJuYWwgZGF0YSBpbgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgTERBUCBzZXJ2ZXIgYW5kIG5l ZWRzIHRvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXN0YWJsaXNo IGEgc2VjdXJlIExEQVAgY29ubmVjdGlvbi4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgWW91IGNhbiBjaGVjayBob3cgdGhpcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGNvbm5lY3Rpb24gaXMgY29uZmlndXJlZCBpbgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2NhL0NTLmNmZywgbG9vawog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmb3IgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB0aGUgbGluZXM6IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENs aWVudEF1dGggPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj1jbj1EaXJlY3RvcnkgTWFu YWdlciA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJy PgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNl cnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJu YWxkYi5sZGFwY29ubi5ob3N0PXZtLS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGludGVybmFsZGIubGRhcGNvbm4ucG9ydD02MzYgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLnNlY3VyZUNvbm4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGF1dGh0eXBlIGNhbiBiZSBTc2xDbGllbnRBdXRoCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEgc3Ns IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydGlmaWNhdGUpIG9y IEJhc2ljQXV0aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0aGVudGlj YXRpb24gd2l0aCBhIGJpbmQgRE4gYW5kIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgcGFzc3dvcmQgc3RvcmVkIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZikuCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZ b3UgY2FuIHVzZSB0aGlzIGluZm9ybWF0aW9uIHRvCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIG1hbnVhbGx5IGNoZWNrIHRoZSBjcmVkZW50aWFscy4gRm9yCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaW5zdGFuY2Ugd2l0aCBzc2xjbGllbnRhdXRoOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgZXhwb3J0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNf Q0FDRVJURElSPS9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBl eHBvcnQgTERBUFRMU19DRVJUPSdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGRhcHNl YXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtYiAiIiAtcyBiYXNlIC1ZIEVYVEVSTkFMIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKHByb3ZpZGUgdGhlIHBhc3N3 b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtp LXRvbWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBJIGZvdW5kIHRoaXM6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xDbGllbnRBdXRoIDxicj4KaW50ZXJu YWxkYi5sZGFwYXV0aC5iaW5kRE49dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+ CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5h bGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNh IDxicj4KaW50ZXJuYWxkYi5sZGFwY29ubi5jbG9uZVJlcGxpY2F0aW9uUG9ydD0zODkgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGFuZCB3aGVuIEkgdHJ5IHRoZSBsZGFwc2VhcmNoIEkgYW0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IHRvIHByb3ZpZGUgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBwaW4vcGFzc3dvcmQgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkgdG9rZW4gJ2xkYXAoMCkn OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBidXQgdGhlcmUgaXMgbm8gcGFzc3dvcmQgZmlsZS4uLiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBhcmUgcmlnaHQsIGluIDQuNC4gdGhlcmUg aXMgbm8KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwd2RmaWxlLnR4dCBhbmQgdGhl IHBhc3N3b3JkIGNhbiBiZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZm91 bmQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRv bWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAo d2l0aCB0aGUgdGFnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5h bD0uLi4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgQ2FuIHlvdSBjaGVjayBpZiB0aGUgcGFzc3dvcmQgd2l0 aCB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0YWcgaW50ZXJuYWw9Li4uIGFs bG93cyB0byByZWFkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUga2V5 cyBmcm9tIHRoZSBOU1MgZGI/IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBj ZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChwcm92 aWRlIHBhc3N3b3JkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBUaGF0IHdvcmtzLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1k IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9r ZW4gIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQiIgaW4g c2xvdCAiTlNTIFVzZXIgUHJpdmF0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IEtleSBhbmQgQ2VydGlmaWNhdGUgU2VydmljZXMiIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAmbHQ7IDAmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMy N2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdjYTUzNjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAob3JwaGFuKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICZsdDsgMSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4MGM3YzY5 NmNmY2Q4YWVmYzk0MDVhN2E4NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IERCOmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAmbHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA4 ODFiNzI1NGM0MGZhNDBiYzUwNjgxYmNjOGQzN2JiM2ViNDk5MzdlCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGNhU2lnbmluZ0NlcnQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsg MyZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZhOWEyNTVhMWQxNTU4NWFj MjgwNjRjMGY0OTg2ZTQxNmJjNDg0MDPCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOm9j c3BTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICZsdDsgNCZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDNmYjYwOWQw ZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3ZjdlNWEwMWYKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgU2VydmVyLUNlcnQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0 LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgNSZndDsgcnNh CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDFlOTQ3OWE5NTU2YWY5MzM5YmI1ZTQ1NTJj Y2JkMzgxZDNjMzg4NTbCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE5TUyBDZXJ0 aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3RlbUNl cnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJ1dCB0aGlzIGRvZXNuJ3QgKHdpdGggdGhlIHNh bWUgcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZnJvbSBwYXNzd29yZC5j b25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIyBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBocmVmPSJsZGFwczovLyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5s ZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAt YiAiIiAtcyBiYXNlIC1ZIEVYVEVSTkFMIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MgcGhyYXNlCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGZvciBzZWN1cml0eSB0b2tlbiAnbGRhcCgwKSc6IDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgU0FTTC9FWFRFUk5BTCBhdXRoZW50aWNhdGlvbiBz dGFydGVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGRhcF9zYXNsX2ludGVy YWN0aXZlX2JpbmRfczogSW52YWxpZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjcmVk ZW50aWFscyAoNDkpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29t ZXdoZXJlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRob3VnaCwgc2luY2UgaWYgSSBw dXQgaW4gYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vbnNlbnNlIG9yIGlu Y29ycmVjdCBwYXNzd29yZCBpdCBqdXN0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBy b21wdHMgb3ZlciBhbmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQgZnJv bQogICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hhdCB0byB3aGF0PyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBUaGVyZSB3YXNuJ3QgbXVjaCBvZiBhIGNo YW5nZS4uLiBJIGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAgICBhc3N1bWVkIHNvbWVvbmUg cmFuIHl1bSB1cGdyYWRlIGFuZCBkaWRuJ3QKICAgICAgICAgICAgICAgICAgICAgICAgICByZXN0 YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MKICAgICAgICAgICAgICAgICAg ICAgICAgICBsaWtlIG5vdCBtdWNoIG9mIGEgdmVyc2lvbiBjaGFuZ2UgdGhvdWdoLiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICMg Z3JlcCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg SmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEt Y29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gK ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg SmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgbGliaXBh X2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDY6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBw eXRob24tbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDggSW5zdGFsbGVkOgogICAgICAgICAgICAg ICAgICAgICAgICAgIHB5dGhvbi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoKICAgICAg ICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjEu MS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg ICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSmFu IDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWlu dG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0 YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAt MTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAgICAg ICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRv cy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAg ICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAg ICAgICAgICAgaXBhLWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMyBVcGRhdGVkOgogICAgICAg ICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEueDg2 XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjcgVXBkYXRl ZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcu Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjM2IEluc3RhbGxlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5u b2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBp cGEtcHl0aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDIgVXBkYXRlZDoKICAgICAg ICAgICAgICAgICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9z Ljcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg ICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4 IDA5OjU1OjQzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFs aWItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgSnVsIDI4IDA5OjU1OjQ0IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAg cHl0aG9uMi1pcGFjbGllbnQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6 NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYXNlcnZl ci00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NSBVcGRhdGVkOgog ICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1hZG1pbnRvb2xzLTQuNC4wLTE0LmVsNy5jZW50 b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0 NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40LjAtMTQu ZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4 IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci00 LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEt c2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAjIGdyZXAgcGtpIC92YXIvbG9nL3l1bS5sb2cg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNSBVcGRhdGVkOgog ICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2gg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowOSBVcGRhdGVkOgog ICAgICAgICAgICAgICAgICAgICAgICAgIGtyYjUtcGtpbml0LTEuMTQuMS0yNy5lbDdfMy54ODZf NjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoxOSBJbnN0YWxs ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTQuZWw3 XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTkg VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVs N18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIx IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQu ZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6 MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMuMy0xNC5l bDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0Nzoy MiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMtMTQuZWw3 XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTYg VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3 XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcg VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0x OS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDox MzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMt MTkuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6 MTM6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMu My0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx MDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1rcmEtMTAuMy4z LTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEw OjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWNhLTEwLjMuMy0x OS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFyZSB5 b3UgcnVubmluZyBpbiBTRUxpbnV4IGVuZm9yY2luZyBtb2RlPyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAjIGdldGVuZm9yY2UgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIEVuZm9yY2luZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBJZiBzbyBjYW4geW91IHJ1bjogPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg IyBhdXNlYXJjaCAtbSBBVkMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgIyBhdXNlYXJjaCAtbSBBVkMg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBvcHRpb24gdG8gbG9nX2Zv cm1hdCBpcyBkZXByZWNhdGVkLgogICAgICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSB1c2Ug dGhlIHdyaXRlX2xvZ3Mgb3B0aW9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgVGhl IE5PTE9HIG9wdGlvbiBpcyBvdmVycmlkaW5nIHRoZSB3cml0ZV9sb2dzCiAgICAgICAgICAgICAg ICAgICAgICAgICAgY3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgdGltZS0mZ3Q7TW9uIE1hciAx NCAxMDozOTowMSAyMDE2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NB TEwgbXNnPWF1ZGl0KDE0NTc5NzcxNDEuNzY3OjE3NTM3KToKICAgICAgICAgICAgICAgICAgICAg ICAgICBhcmNoPWMwMDAwMDNlIHN5c2NhbGw9MiBzdWNjZXNzPW5vIGV4aXQ9LTEzCiAgICAgICAg ICAgICAgICAgICAgICAgICAgYTA9N2ZiY2FiMDM4ZDEwIGExPTgwMCBhMj0xIGEzPTdmYmNhNjBm NDJlMAogICAgICAgICAgICAgICAgICAgICAgICAgIGl0ZW1zPTAgcHBpZD0xNDA2IHBpZD0xMjk2 NSBhdWlkPTQyOTQ5NjcyOTUKICAgICAgICAgICAgICAgICAgICAgICAgICB1aWQ9MCBnaWQ9MCBl dWlkPTU4MTQwMDAwMSBzdWlkPTAKICAgICAgICAgICAgICAgICAgICAgICAgICBmc3VpZD01ODE0 MDAwMDEgZWdpZD01ODE0MDAwMDEgc2dpZD0wCiAgICAgICAgICAgICAgICAgICAgICAgICAgZnNn aWQ9NTgxNDAwMDAxIHR0eT0obm9uZSkgc2VzPTQyOTQ5NjcyOTUKICAgICAgICAgICAgICAgICAg ICAgICAgICBjb21tPSJzc2hkIiBleGU9Ii91c3Ivc2Jpbi9zc2hkIgogICAgICAgICAgICAgICAg ICAgICAgICAgIHN1Ymo9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAg ICAgICAgICAgICAgICAgICAgICAgICAga2V5PShudWxsKSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgdHlwZT1BVkMgbXNnPWF1ZGl0KDE0NTc5NzcxNDEuNzY3OjE3NTM3KToKICAgICAg ICAgICAgICAgICAgICAgICAgICBhdmM6wqAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUK ICAgICAgICAgICAgICAgICAgICAgICAgICBjb21tPSJzc2hkIiBuYW1lPSJhdXRob3JpemVkX2tl eXMiIGRldj0iZG0tMiIKICAgICAgICAgICAgICAgICAgICAgICAgICBpbm89MTE2MzkzNTE3CiAg ICAgICAgICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90 OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgdGNvbnRleHQ9c3lzdGVt X3U6b2JqZWN0X3I6dW5sYWJlbGVkX3Q6czAKICAgICAgICAgICAgICAgICAgICAgICAgICB0Y2xh c3M9ZmlsZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj5JIHN1c3BlY3QgdGhhdCB0aGUKICAgICAgICAgICAgICAgICAgICAgICAgICAg IHN1YnN5c3RlbSBjZXJ0IHdhcyByZW5ld2VkIGFuZCBldmVyeXRoaW5nCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICB3YXNuJ3QgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgdXBk YXRlZCBwcm9wZXJseS4gSWYgSSdtIHJpZ2h0IHRoaXMgaXMKICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHVucmVsYXRlZCB0byB0aGUgdXBncmFkZSBpdCBqdXN0IDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHNob25lIGEgc3BvdGxpZ2h0IG9uIGl0LiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBDYW4geW91 IHJ1biB0aGVzZSBjb21tYW5kczogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp cmVjdG9yeSBtYW5hZ2VyJwogICAgICAgICAgICAgICAgICAgICAgICAgICAgLVcgLWIgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9u IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgIFRoaXMgcmV0dXJucyA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExM IC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcKICAgICAgICAgICAgICAgICAgICAgICAgICAt YiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAg ICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgICAgTUlJ RGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxD CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg IC4uLiBzdHVmZiAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdqTlQ4 QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1D ZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NL UztDTj1DQQogICAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPmFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1k IC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1u ICdzdWJzeXN0ZW1DZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtp LWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2Vy dHV0aWwgLUwgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcwogICAgICAgICAgICAgICAgICAg ICAgICAgICAgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgIFRoZXNlIGJvdGggcmV0dXJuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNl cnQgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIEVudGVyIFBhc3N3b3JkIG9yIFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgICAg ICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1 dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAgICAgICAgICAgICBTRUNf RVJST1JfVU5SRUNPR05JWkVEX09JRDogVW5yZWNvZ25pemVkCiAgICAgICAgICAgICAgICAgICAg ICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhc8KgIC1uCiAgICAg ICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIC1hIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4gIk5TUyBD ZXJ0aWZpY2F0ZSBEQiIKICAgICAgICAgICAgICAgICAgICAgICAgICBpbiBzbG90ICJOU1MgVXNl ciBQcml2YXRlIEtleSBhbmQgQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICBT ZXJ2aWNlcyIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3b3JkIG9y IFBpbiBmb3IgIk5TUyBDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgIERCIjog PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVtIGxpc3Rpbmcg a2V5czoKICAgICAgICAgICAgICAgICAgICAgICAgICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09J RDogVW5yZWNvZ25pemVkCiAgICAgICAgICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZp ZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICB5b3UgbWFk ZSBhIHR5cG8gYW5kIHJlcXVlc3RlZCB0aGUga2V5cyAoLUspCiAgICAgICAgICAgICAgICAgICAg ICAgIGluc3RlYWQgb2YgdGhlIGNlcnRzICgtTCkuIFBsZWFzZSByZXRyeSB3aXRoIC1MCiAgICAg ICAgICAgICAgICAgICAgICAgIGFuZCB5b3Ugc2hvdWxkIGJlIGFibGUgdG8gc2VlIHRoZSBjZXJ0 aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICBzZXJpYWwuIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRs ZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAgICAgICAnY249 ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1 c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAg ICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNz d29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVv cGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoK ICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcw QkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdq TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAg ICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAg ICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUwog ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgU28gdGhlIHNlcmlhbCBpcyA0PyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhd IyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2kt Y2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqDCoMKgwqDCoMKg wqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBXaGljaCBpcyBOT1QgNC4u LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBb cm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAg ICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAg ICAgICAgICAgICAgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAgICAgICAgICAgICAgIC0t LS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLSA8YnI+Ck1JSURiakNDQWxhZ0F3SUJBZ0lFVC9rQURU QU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgIHNqZWlGYlVGdG9NbmZtSExJ WXBlNVFBUiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0t LS0tIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg IEFuZCB0aGlzIGNlcnQgaXMgTk9UIHRoZSBzYW1lLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg ICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg IHdoZW4gY2VydG1vbmdlciByZW5ld3MgYSBjZXJ0aWZpY2F0ZSwgaXQgcnVucwogICAgICAgICAg ICAgICAgICAgIHByZS1zYXZlIGFuZCBwb3N0LXNhdmUgY29tbWFuZHMgKHdoaWNoIHlvdSBjYW4g c2VlCiAgICAgICAgICAgICAgICAgICAgaW4gdGhlIG91dHB1dCBvZiBnZXRjZXJ0IGxpc3QpLiBJ biB5b3VyIGNhc2UsIHRoZQogICAgICAgICAgICAgICAgICAgIHBvc3Qtc2F2ZSBjb21tYW5kIGZv ciBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAgICAgcHJvYmFibHkg ZmFpbGVkLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg IFRoaXMgY29tbWFuZCAob24gdGhlIHJlbmV3YWwgbWFzdGVyKSBpcyByZXNwb25zaWJsZQogICAg ICAgICAgICAgICAgICAgIGZvciBjb3B5aW5nIHRoZSBuZXcgY2VydCBmcm9tIHRoZSBOU1MgZGIg dG8gdGhlIExEQVAKICAgICAgICAgICAgICAgICAgICBzZXJ2ZXIuIFlvdSBuZWVkIGZpcnN0IHRv IGNoZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMKICAgICAgICAgICAgICAgICAgICB0aGUgcmVuZXdh bCBtYXN0ZXIgKGFzIHRoZSBzZXJpYWwgbnVtYmVycyBhcmUgaW4gYQogICAgICAgICAgICAgICAg ICAgIGNvbXBsZXRlbHkgZGlmZmVyZW50IHJhbmdlLCBJIGFzc3VtZSB0aGF0IHlvdSBoYXZlCiAg ICAgICAgICAgICAgICAgICAgbXVsdGlwbGUgSVBBIHNlcnZlcnMgY29uZmlndXJlZCB3aXRoIGEg Q0EgaW5zdGFuY2UpOgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgJCBleHBvcnQgQkFTRUROPWBncmVwIGJhc2VkbiAv ZXRjL2lwYS9kZWZhdWx0LmNvbmYgfAogICAgICAgICAgICAgICAgICAgIGN1dCAtZD0gLWYyLWAg PGJyPgogICAgICAgICAgICAgICAgICAgICQga2luaXQgYWRtaW4gPGJyPgogICAgICAgICAgICAg ICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQ SQogICAgICAgICAgICAgICAgICAgIC1iICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VE TiIKICAgICAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FS ZW5ld2FsTWFzdGVyKSknIGRuCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgIGRuOgpjbj1DQSxjbj12bS1pcGFzZXJ2ZXIuaXBhZG9tYWluLmNvbSxjbj1tYXN0ZXJz LGNuPWlwYSxjbj1ldGMsZGM9aXBhZG9tYWluLGRjPWNvbQogICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSW4gdGhpcyBl eGFtcGxlIHRoZSByZW5ld2FsIG1hc3RlciBpcyB2bS1pcGFzZXJ2ZXIuCiAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIEkgZ2V0 IHRoaXMgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICQgbGRh cHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZIEdTU0FQSSAtYgogICAgICAg ICAgICAgICAgICAiY249bWFzdGVycyxjbj1pcGEsY249ZXRjLCRCQVNFRE4iCiAgICAgICAgICAg ICAgICAgICcoJmFtcDsoY249Q0EpKGlwYUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScg ZG4gPGJyPgogICAgICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgICAgY249Q0EsY249 ZnJlZWlwYS1zZWEuYnB0LnJvY2tzLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0YyxkYz1icHQsZGM9 cm9ja3MKICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgIFdoaWNoIGlzIHRoZSBvdGhlciBGcmVlSVBBIHNlcnZlci4gPGJyPgogICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg ICAgICAgICBIaSBJYW4sIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg IGl0J3MgZ2V0dGluZyBkaWZmaWN1bHQgdG8gZm9sbG93IHRoaXMgdGhyZWFkLCBzbyBjb3VsZAog ICAgICAgICAgICAgICAgd2Ugc3RlcCBiYWNrIGFuZCBzdW1tYXJpemU/IDxicj4KICAgICAgICAg ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgWWVzLCBpdCBpcy7CoCBTb3JyeS4gPGJy PgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAg ICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlIENBCiAg ICAgICAgICAgICAgICBjb21wb25lbnQgaXMgaW5zdGFsbGVkIGFuZCAnc3Vic3lzdGVtQ2VydCBj ZXJ0LXBraS1jYScKICAgICAgICAgICAgICAgIGhhcyBTZXJpYWwgbnVtYmVyIDQgaW4gdGhlIE5T U0RCCiAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgTm8/IDxicj4KICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGNlcnR1dGlsIC1M IC1kCiAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVt Q2VydCBjZXJ0LXBraS1jYScgfAogICAgICAgICAgICAgIGdyZXAgU2VyaWFsIDxicj4KICAgICAg ICAgICAgICDCoMKgwqDCoMKgwqDCoMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZm OTAwMGQpIDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4tIE9uIHNl cnZlciBzZWF0dGxlbmZzICh3aGVyZSBQS0kKICAgICAgICAgICAgICAgIGZhaWxzIHRvIHJlc3Rh cnQpLCB0aGUgQ0EgY29tcG9uZW50IGlzIGluc3RhbGxlZCBhbmQKICAgICAgICAgICAgICAgICdz dWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyBoYXMgU2VyaWFsIG51bWJlciAxMzQxNzE4NTQxCiAg ICAgICAgICAgICAgICBpbiB0aGUgTlNTREIgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcy4gPGJy PgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICBZZXMgPGJyPgogICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0 dXRpbCAtTCAtZAogICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1 YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIHwKICAgICAgICAgICAgICBncmVwIFNlcmlhbCA8YnI+ CiAgICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAtIEluIHRoZSBMREFQIHNl cnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUgZW50cnkKICAgICAgICAgICAgICAgIHVp ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2Egd2l0aCBTZXJpYWwgbnVtYmVyIDQKICAgICAg ICAgICAgICAgIChpLmUuIGl0IGlzIHRoZSBjZXJ0IGZyb20gZnJlZWlwYS1zZWEpLiA8YnI+CiAg ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIFRoaXMgaXMgd2hlcmUgdGhl IGRpZmZlcmVuY2UgaXMuwqAgVGhlcmUgYXJlIHR3bwogICAgICAgICAgICAgIGNlcnRpZmljYXRl cyBvbiB0aGUgbWFzdGVyIGFuZCBvbmx5IG9uZSBvbiB0aGUgb3RoZXIuwqAgSQogICAgICAgICAg ICAgIHdvbmRlciBpZiB0aGlzIGlzIGEgcmVzdWx0IG9mIHRoZSBzbG93IG1vdGlvbiByZXBsaWNh dGlvbgogICAgICAgICAgICAgIHRyYWlud3JlY2sgSSBoYXZlIGdvaW5nIG9uIGR1ZSB0byBhIHpv bWJpZSByZXBsaWNhIGluIHRoZQogICAgICAgICAgICAgIGxkYXAgZGF0YWJhc2UgdGhhdCBubyBs b25nZXIgZXhpc3RzIGluIHRoZSByZWFsIHdvcmxkIGFuZAogICAgICAgICAgICAgIEkgY2FuJ3Qg c2VlbSB0byBnZXQgcmlkIG9mLiA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgdGhlIHJlbWFpbmluZyBpc3N1ZSBpcyBhIHJlcGxpY2F0aW9uIHByb2JsZW0uIFRoZXJl IGlzIGEKICAgICAgICAgICAgIlRyb3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBb MV0gaW4gSWRNIEFkbWluIGd1aWRlCiAgICAgICAgICAgIHRoYXQgbWF5IGhlbHAgeW91LiA8YnI+ CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxp Y2EsIHdoaWNoIGNvbW1hbmRzIGRpZCB5b3UgdXNlIHRvCiAgICAgICAgICAgIHRyeSB0byByZW1v dmUgaXQsIGFuZCB3aGF0IHdhcyB0aGUgb3V0cHV0PyA8YnI+CiAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBbMV0gPGEgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKaHJlZj0iaHR0cHM6Ly9hY2Nlc3MucmVkaGF0LmNv bS9kb2N1bWVudGF0aW9uL2VuLVVTL1JlZF9IYXRfRW50ZXJwcmlzZV9MaW51eC83L2h0bWwvTGlu dXhfRG9tYWluX0lkZW50aXR5X0F1dGhlbnRpY2F0aW9uX2FuZF9Qb2xpY3lfR3VpZGUvdHJvdWJs ZS1nZW4tcmVwbGljYXRpb24uaHRtbCIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRy dWUiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0 X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNh dGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJy PgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+ CiAgICAgICAgICBIaSw8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBUbyBkZWJ1ZyByZXBs aWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZCBzZXZlcmFsCiAgICAgICAg ICBpbmZvIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRzIG9mIHRoZSBmb2xsb3dpbmcgY29t bWFuZHM8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5o XSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgIG1hbmFnZXInIC1X IC1iICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAg ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFw c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9 cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgRW50 ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3Bs ZSxvPWlwYWNhPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9 cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgIGVudHJ5dXNu O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1Ogog ICAgICAgIDxicj4KICAgICAgICDCoDc1Mjc0ODk3PGJyPgogICAgICAgIG5zY3BlbnRyeXdzaToK ICAgICAgICBtb2RpZnlUaW1lc3RhbXA7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDQ7dnVjc24t NTkzOGU2ODgwMDAxMDQyPGJyPgogICAgICAgIMKgOTAwMDQ6IDIwMTcwNjA4MDU1MzM0Wjxicj4K ICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgbW9kaWZpZXJzTmFtZTthZGNzbi01OTM4ZTY4 ODAwMDEwNDI5MDAwMzt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDxicj4KICAgICAgICDCoDAwMzog Y249RGlyZWN0b3J5IE1hbmFnZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlk OiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgICAgICBuc2NwZW50 cnl3c2k6IGNuOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3Jz TmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBkZXNj cmlwdGlvbjt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMToKICAgICAgICAyOzEzNDE3MTg1NDE7 Q049Q2VydGlmaWM8YnI+CiAgICAgICAgwqBhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNB IFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0 aW9uO3ZkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAyO2RlbGV0ZWQ6CiAgICAgICAgMjs0O0NOPUNl cnRpZmljYTxicj4KICAgICAgICDCoHRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJz eXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAg ICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAgICAgbnNjcGVudHJ5 d3NpOiBvYmplY3RDbGFzczogcGVyc29uPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0 Q2xhc3M6IG9yZ2FuaXphdGlvbmFsUGVyc29uPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2Jq ZWN0Q2xhc3M6IGluZXRPcmdQZXJzb248YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RD bGFzczogY21zdXNlcjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHNlZUFsc286IENOPUNBIFN1 YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lkYnVz ZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgICBu c2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFn SUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUjxicj4KICAgICAgICAmbHQ7c25pcCZndDs8YnI+ CiAgICAgICAgwqBjQmQ0bk9WNG05QStxUlpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThY RW84ZGZBUFhNSm9GYz08YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU7 dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDA6OgogICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8 YnI+CiAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgIMKgQVI8YnI+CiAgICAgICAgbnNj cGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgbnNjcGVu dHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTog YWdlbnRUeXBlPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICAg ICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIiBjaXRlPSJtaWQ6NTk4ODI4NzEuMTAwMDEwNkByZWRoYXQuY29tIj4KICAgICAgICAg IGFuZDxicj4KICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxM TCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2Vy LG91PXBlb3BsZSxvPWlwYWNhIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+ CiAgICAgICAgPGJyPgogICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2gg LUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNl cixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgRW50ZXIgTERBUCBQ YXNzd29yZDogPGJyPgogICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh PGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89 aXBhY2E8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNvOiBDTj1DQSBTdWJzeXN0ZW0s Tz1CUFQuUk9DS1M8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU6Ogog ICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+ CiAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgIMKgY0JkNG5PVjRtOUErcVJaTm80ZVg3 ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9PGJyPgogICAgICAgIG5zY3Bl bnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgIEF1dGhvcml0 eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzPGJyPgogICAgICAgIMKgeXN0ZW0sTz1CUFQuUk9DS1M8 YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAgICAgICBuc2NwZW50 cnl3c2k6IHBhcmVudGlkOiAyPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogbW9kaWZ5VGltZXN0 YW1wOiAyMDE1MDcxNjEyNTE0Nlo8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IG1vZGlmaWVy c05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogY3Jl YXRvcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6 IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHVz ZXJzdGF0ZTogMTxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJ0eXBlOiBhZ2VudFR5cGU8 YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6 IGNuOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJy PgogICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgbnNjcGVu dHJ5d3NpOiBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0 Q2xhc3M6IHBlcnNvbjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdh bml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBp bmV0T3JnUGVyc29uPGJyPgogICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGNtc3Vz ZXI8YnI+CiAgICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFl NS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgICAgICBuc2NwZW50cnl3c2k6IGVudHJ5dXNuOiA4 Njxicj4KICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk4ODI4NzEu MTAwMDEwNkByZWRoYXQuY29tIj4KICAgICAgICAgIDxicj4KICAgICAgICAgIEZyb20gdGhlIG91 dHB1dCB5b3UgbWF5IG9ubHkgY29weS9wYXN0IHRoZSBvbmVzIHJlbGF0ZWQgdG8KICAgICAgICAg IHVzZXJDZXJ0aWZpY2F0ZTxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAg ICAgIEFsc28gdG8gZHVtcCB0aGUgY3VycmVudCByZXBsaWNhdGlvbiBzdGF0dXMsIHNlbmQgdGhl IHJlc3VsdMKgCiAgICAgICAgICBvZjxicj4KICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlh bmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicg LVcgLWIgIm89aXBhY2EiPGZvbnQgc2l6ZT0iLTEiPjxpPiA8L2k+IigmYW1wOyhvYmplY3RjbGFz cz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZm ZmZmZikpIjxicj4KICAgICAgICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAgICAgW3Jvb3RA ZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAg ICAgbWFuYWdlcicgLVcgLWIgIm89aXBhY2EiCiIoJmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3Rv bmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+ CiAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgIGRuOiBjbj1yZXBsaWNh LGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgIGNuOiBy ZXBsaWNhPGJyPgogICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgICAgbnNEUzVSZXBsaWNh QmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgICAgY2xvbmVBZ3JlZW1lbnQxLWZy ZWVpcGEtc2VhLmJwdC5yb2M8YnI+CiAgICAgICAgwqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMs Y249Y29uZmlnPGJyPgogICAgICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24g TWFuYWdlcgogICAgICAgIG1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9jPGJyPgog ICAgICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICBu c0RTNVJlcGxpY2FJZDogMTA2NTxicj4KICAgICAgICBuc0RTNVJlcGxpY2FOYW1lOiBiMjFhMWYx ZS02Mjc5MTFlNi05M2U2ZWY0Yi02OWRjYzJkMTxicj4KICAgICAgICBuc0RTNVJlcGxpY2FSb290 OiBvPWlwYWNhPGJyPgogICAgICAgIG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICAgICAgbnNT dGF0ZTo6CiAgICAgICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFB QUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJl cGxpY2F0aW9uCiAgICAgICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8 YnI+CiAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91 cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgIG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAg ICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICBvYmplY3RDbGFzczogZXh0 ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0g NTdjMjkxZDkwMDAwMDQyOTAwMDA8YnI+CiAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1 IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmst ZnJlZXRleHQiCiAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4 OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgIDU3Zjg0MGJm MDAwMDA0MjkwMDA8YnI+CiAgICAgICAgwqAwIDU5OGExYzQwMDAwMTA0MjkwMDAwPGJyPgogICAg ICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAg ICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgaHJlZj0ibGRh cDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tz OjM4OTwvYT59PGJyPgogICAgICAgIG5zZHM1YWdtdG1heGNzbjoKICAgICAgICBvPWlwYWNhO2Ns b25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdDtzZWF0PGJyPgog ICAgICAgIMKgdGxlbmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICAgICAgbnNk czVhZ210bWF4Y3NuOgogICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZz LmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgwqB0bGVuZnMuYnB0LnJvY2tz OzM4OTt1bmF2YWlsYWJsZTxicj4KICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHty ZXBsaWNhIDEwNjUgPGEKICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1v ei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5i cHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAg ICAgNTk4YTxicj4KICAgICAgICDCoDFjMTY8YnI+CiAgICAgICAgbnNydXZSZXBsaWNhTGFzdE1v ZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICBocmVmPSJsZGFwOi8vc2Vh dHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9h Pn0KICAgICAgICAwMDAwMDxicj4KICAgICAgICDCoDAwMDxicj4KICAgICAgICBuc2RzNVJlcGxp Y2FDaGFuZ2VDb3VudDogODg1PGJyPgogICAgICAgIG5zZHM1cmVwbGljYXJlYXBhY3RpdmU6IDA8 YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEw MDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAgICAgICAgICAgc2l6ZT0iLTEiPiBhbmQ8YnI+CiAg ICAgICAgICA8L2ZvbnQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1E CiAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250IHNp emU9Ii0xIj48aT4gPC9pPiIoJmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVl SWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICA8 L2ZvbnQ+PC9ibG9ja3F1b3RlPgogICAgICAgIDxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3Jv b3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAg ICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJz dG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxi cj4KICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgZG46IGNuPXJlcGxp Y2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgY246 IHJlcGxpY2E8YnI+CiAgICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgICBuc0RTNVJlcGxp Y2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgICBjbG9uZUFncmVlbWVudDEt c2VhdHRsZW5mcy5icHQucm9jazxicj4KICAgICAgICDCoHMtcGtpLXRvbWNhdCxvdT1jc3VzZXJz LGNuPWNvbmZpZzxicj4KICAgICAgICBuc0RTNVJlcGxpY2FJZDogMTI5MDxicj4KICAgICAgICBu c0RTNVJlcGxpY2FOYW1lOiA4NzA2YWIxZS02YTgzMTFlNi1hOWJmZGJiZi03NGRjNzMyMzxicj4K ICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgIG5zRFM1UmVwbGlj YVR5cGU6IDM8YnI+CiAgICAgICAgbnNTdGF0ZTo6CiAgICAgICAgQ2dVQUFBQUFBQUFLRllwWkFB QUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAgbnNkczVy ZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAgICAgICAgbWFuYWdlcnMsY249c3lz YWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAg ICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgIG9i amVjdENsYXNzOiB0b3A8YnI+CiAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4K ICAgICAgICBvYmplY3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICBuc2RzNTBy dXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAwMDA8YnI+CiAgICAgICAg bnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAg ICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICBocmVmPSJsZGFwOi8v c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5 PC9hPn0KICAgICAgICA1N2JlODA0YzAwMDAwNTBhMDAwMDxicj4KICAgICAgICDCoCA1ODcyMzYx NTAwMDAwNTBhMDAwMDxicj4KICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgbW96 LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4 dCIKICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFw Oi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgNTdiMTAzZDQwMDAwMDQy OTAwMDxicj4KICAgICAgICDCoDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAgICAgICAgbnNk czVhZ210bWF4Y3NuOgogICAgICAgIG89aXBhY2E7Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMu YnB0LnJvY2tzLXBraS10b21jYXQ7ZnJlZWk8YnI+CiAgICAgICAgwqBwYS1zZWEuYnB0LnJvY2tz OzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAwPGJyPgogICAgICAgIG5zcnV2UmVwbGljYUxh c3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIiBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgaHJlZj0ibGRhcDov L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4 OTwvYT59CiAgICAgICAgMDAwMDA8YnI+CiAgICAgICAgwqAwMDA8YnI+CiAgICAgICAgbnNydXZS ZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICBtb3otZG8tbm90 LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICBocmVm PSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJw dC5yb2NrczozODk8L2E+fQogICAgICAgIDAwMDA8YnI+CiAgICAgICAgwqAwMDAwPGJyPgogICAg ICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiAzPGJyPgogICAgICAgIG5zZHM1cmVwbGljYXJl YXBhY3RpdmU6IDA8YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlk OjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAgICAgICAgICAgc2l6ZT0iLTEi PiA8YnI+CiAgICAgICAgICAgIFJlZ2FyZHM8YnI+CiAgICAgICAgICAgIHRoaWVycnk8YnI+CiAg ICAgICAgICA8L2ZvbnQ+CiAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgICBjaXRlPSJt aWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAg ICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5b cm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaAogICAgICAgICAgICAgIC1MTEwgLUQg J2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIs b3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgZGVzY3JpcHRp b24gPGJyPgogICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAg ICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAg ICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJE QU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsgPGJyPgogICAgICAgICAgICAgIMKg IFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAg ICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJ QkFnSUVUL2tBRFRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLCiAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICZsdDt0cnVuY2F0ZWQmZ3Q7IGZ1UVFabVAxWHJLa3Jmc2pl aUZiVUZ0b01uZm1ITElZcGU1UUFSIDxicj4KICAgICAgICAgICAgICBkZXNjcmlwdGlvbjogMjsx MzQxNzE4NTQxO0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJP Q0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+CiAgICAgICAgICAgICAgwqAgLE89QlBULlJPQ0tTIDxi cj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIFty b290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAg ICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj YQogICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAg ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgIGRuOiB1aWQ9cGtp ZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNh dGU6OgogICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFR c0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICDC oCAmbHQ7dHJ1bmNhdGVkJmd0OyA8YnI+CiAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIz Z0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgZGVzY3Jp cHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5S T0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk8gPGJyPgogICAgICAgICAgICAgIMKgIENLUyA8 YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPklmIHlvdSBjaGVjayB0aGUgY2VydGlmaWNhdGVzCiAgICAgICAgICAgICAgICBkYXRlcywg SSBndWVzcyB0aGF0IHRoZSBtb3N0IHJlY2VudCBvbmUgaXMgb24gc2VydmVyCiAgICAgICAgICAg ICAgICBzZWF0dGxlbmZzIChiZWNhdXNlIG9mIHNlcmlhbCBudW1iZXJzKS4gQ2FuIHlvdSBjb25m aXJtCiAgICAgICAgICAgICAgICB0aGlzIChiZWNhdXNlIG91ciBnb2FsIGlzIHRvIGhhdmUgdGhl IG1vc3QgcmVjZW50IGNlcnQKICAgICAgICAgICAgICAgIHN0b3JlZCBpbiBhbGwgdGhlIE5TU0RC cyBhbmQgaW4gTERBUCk/IDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg IFRoYW5rcywgPGJyPgogICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3Vy IHJlbmV3YWwgbWFzdGVyIGlzIHRoZQogICAgICAgICAgICAgICAgICAgIG1hY2hpbmUgb24gd2hp Y2ggdGhlIE5TUyBEQgogICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxp YXMgY29udGFpbnMgdGhlIG5ld2VyIGNlcnQsCiAgICAgICAgICAgICAgICAgICAgdGhlbiB5b3Ug Y2FuIG1hbnVhbGx5IHJ1biB0aGUgc2NyaXB0czogPGJyPgogICAgICAgICAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgSWYgSSdt IGludGVycHJldGluZyB0aGlzIGNvcnJlY3RseSwgdGhlbiBpdCBpcy4uLiBzbyBJCiAgICAgICAg ICAgICAgICAgIHJhbiB0aGlzIG9uIHRoZSBicm9rZW4gbWFjaGluZSAoc2VhdHRsZW5mcykgPGJy PgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPiQgc3VkbwogICAgICAgICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2Vy dG1vbmdlci9zdG9wX3BraWNhZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgJCBzdWRvIC91c3Iv bGliZXhlYy9pcGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAg InN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EiIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICBJIHJhbiB0aGlzLCBpdCB0b29rIGEgd2hpbGUsIHRoZW4gSSByZS1j aGVja2VkIGFuZCB0aGUKICAgICAgICAgICAgICAgICAgc2VyaWFsIHN0aWxsIHNlZW1zIHRvIGJl IDQgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICQgbGRhcHNl YXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAg ICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNhdGUKICAgICAg ICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICBFbnRlciBMREFQ IFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBl b3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAg ICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFE QTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZh MVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9u OiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJP Q0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgSGVyZSdzIHdoYXQgd2FzIGluIC92YXIvbG9nL3BraS9wa2kt dG9tY2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg ICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 IDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOiA9PT09PcKgCiAgICAgICAgICAgICAgICAgIERFQlVHIFNVQlNZU1RFTSBJ TklUSUFMSVpFRMKgwqAgPT09PT09PSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0gPGJyPgogICAgICAgICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg ICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNl IDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGF1dG9TaHV0ZG93biBj cnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0 L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBD TVNFbmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yIGF1dG8tc2h1dGRvd24KICAgICAg ICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAg ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5n Q2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5l OiBkb25lIGluaXQgaWQ9ZGVidWcgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6 MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0Vu Z2luZTogaW5pdGlhbGl6ZWQgZGVidWcgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENN U0VuZ2luZTogaW5pdFN1YnN5c3RlbSBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAg ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAg ICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIv bGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvY2Evc2lnbmVkQXVkaXQvY2FfYXVkaXQpCiAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAg ICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2Nh L3N5c3RlbSkKICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg IENyZWF0aW5nCiAgICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9w a2ktdG9tY2F0L2xvZ3MvY2EvdHJhbnNhY3Rpb25zKQogICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93 bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1No dXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3Br aS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1bWIgPGJyPgogICAgICAgICAgICAgICAgICBb MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg ICAgICAgIENNU0VuZ2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93 bgogICAgICAgICAgICAgICAgICBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2Eg PGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZm91bmQgY2VydDphdWRp dFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBD TVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg IENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgbG9nIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg ICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg ICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9anNzIDxicj4KICAgICAgICAgICAg ICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAg ICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8 YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0 YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1 bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9s b2dzL2F1dG9TaHV0ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01T RW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNodXRkb3duCiAgICAgICAg ICAgICAgICAgIHN1cHBvcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmluZ0Nl cnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6 NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog ZG9uZSBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgQ01TRW5naW5l OiBpbml0aWFsaXplZCBqc3MgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENNU0VuZ2lu ZTogaW5pdFN1YnN5c3RlbSBpZD1kYnMgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIENN U0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1kYnMgPGJyPgogICAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICAgIERCU3Vic3lzdGVtOiBpbml0KCkgbUVuYWJsZVNlcmlhbE1nbXQ9dHJ1ZSA8YnI+CiAgICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcgTGRhcEJvdW5kQ29ubkZhY3RvcihEQlN1YnN5 c3RlbSkgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs aG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3J5 OiBpbml0IDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9y eTpkb0Nsb25pbmcgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgTGRhcEF1dGhJ bmZvOiBpbml0KCkgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIExkYXBBdXRoSW5mbzog aW5pdCBiZWdpbnMgPGJyPgogICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFd W2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgIExkYXBBdXRoSW5mbzog aW5pdCBlbmRzIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBpbml0OgogICAgICAgICAgICAgICAgICBiZWZvcmUgbWFr ZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgIFsw My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAg ICAgICAgbWFrZUNvbm5lY3Rpb246IGVycm9ySWZEb3duIHRydWUgPGJyPgogICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06IFRDUAog ICAgICAgICAgICAgICAgICBLZWVwLUFsaXZlOiB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg ICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nIGRlc2lyZWQg Y2VydAogICAgICAgICAgICAgICAgICBuaWNrbmFtZSB0bzogc3Vic3lzdGVtQ2VydCBjZXJ0LXBr aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgTGRhcEpzc1NTTFNvY2tldDogc2V0 IGNsaWVudCBhdXRoIGNlcnQgbmlja25hbWUKICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtQ2Vy dCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2Vy dGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRlcmluZyEgPGJyPgogICAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICAgIENhbmRpZGF0ZSBjZXJ0OiBvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgICAgIENhbmRpZGF0ZSBjZXJ0OiBzdWJzeXN0ZW1DZXJ0IGNlcnQt cGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0 ZVNlbGVjdGlvbkNCOiBkZXNpcmVkIGNlcnQgZm91bmQgaW4KICAgICAgICAgICAgICAgICAgbGlz dDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg ICAgU1NMQ2xpZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJuaW5nOgogICAgICAgICAg ICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBTU0wKICAgICAg ICAgICAgICAgICAgaGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICBDTVNFbmdpbmUuc2h1dGRvd24oKSA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBJIHJlYWxseSBhcHByZWNpYXRl IHlvdSBzdGlja2luZyB3aXRoIG1lIHRocm91Z2gKICAgICAgICAgICAgICAgICAgdGhpcy7CoCBJ IG93ZSB5b3UuIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAt IElhbiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+QWZ0ZXIgdGhhdCwgY2hlY2sgdGhhdCB0aGUKICAgICAgICAgICAg ICAgICAgICBMREFQIGVudHJ5IGhhcyBiZWVuIHVwZGF0ZWQuIElmIGl0IGlzIHRoZSBjYXNlLCB5 b3UKICAgICAgICAgICAgICAgICAgICBzaG91bGQgYmUgYWJsZSB0byByZXN0YXJ0IHBraS4gPGJy PgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBGbG8gPGJyPgog ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj5UaGFuayB5b3UgYWdhaW4gZm9yIHlvdXIKICAgICAgICAgICAgICAgICAgICAg IHRpbWUhIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgIElhbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICB3aGljaCBzZWVtcyB3ZWlyZC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5UaGUg ZGVzY3JpcHRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGF0dHJpYnV0ZSBpbiB0aGUg bGRhcHNlYXJjaCBvdXRwdXQgaXMgb2YgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBm b3JtIDI7IztETjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBUaGUgIyBzaG91bGQgbWF0Y2ggdGhlIHNlcmlhbCBudW1i ZXIgaW4gdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBmaXJzdCBjZXJ0dXRpbCBvdXRw dXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgVGhlIEFTQ0lJIGJsb2IgKG1pbnVzIHRoZSBCRUdJTi9FTkQgaGVhZGVycykK ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBhdHRyaWJ1dGVzLiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyA8YnI+CiAg ICAgICAgICAgICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAg ICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAgICAgICBocmVm PSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAg ICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhv c3RlZC5vcmc8L2E+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIFRvIHVuc3Vic2Ny aWJlIHNlbmQgYW4gZW1haWwgdG8gPGEKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxp bmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vy cy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICAgICAgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8 L2E+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAg ICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4K ICAgICAgICAgICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAg ICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgIGhyZWY9Im1h aWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmc8L2E+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBh biBlbWFpbCB0byA8YQogICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0 ZWQiCiAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZy ZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgICAg PGJyPgogICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxv Y2txdW90ZT4KICAgICAgICA8YnI+CiAgICAgICAgPGJyPgogICAgICAgIDxmaWVsZHNldCBjbGFz cz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgICAgPGJyPgogICAgICAg IDxwcmUgd3JhcD0iIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXwpGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YSBjbGFzcz0ibW96LXR4dC1saW5r LWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0 ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0i bW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2 ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEt dXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KPC9wcmU+CiAgICAgIDwvYmxv Y2txdW90ZT4KICAgICAgPGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4K PC9odG1sPgo= --===============4767585338843903604==-- From tbordaz at redhat.com Thu Aug 10 09:46:33 2017 Content-Type: multipart/mixed; boundary="===============0674695975783376051==" MIME-Version: 1.0 From: thierry bordaz To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Thu, 10 Aug 2017 11:45:51 +0200 Message-ID: <598C2B4F.2000202@redhat.com> In-Reply-To: fe5259f3-ae4a-8389-5425-9b84b11b71d5@brownpapertickets.com --===============0674695975783376051== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 08/09/2017 09:30 PM, Ian Harding via FreeIPA-users wrote: > > On 8/9/17 3:05 AM, thierry bordaz wrote: > >> Hi Ian, >> >> Thanks for having gather those data. >> >> # >> # So pkidbuser entries have a same (old) userCertificate likely >> generated during install >> # But only freeipa-sea has a new one created on freeipa-sea >> around Jun 8th 2017 05:54:16 >> # This recent certificate is identified by 5938e688000104290000 >> # >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory >> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> ... >> nscpentrywsi: userCertificate:: >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: >> MIIDbjCCAlagAwIBAgI >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' >> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >> nscpentrywsi: userCertificate:: >> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >> >> >> >> # >> # why 5938e688000104290000 value was not propagated to seattlenfs ? >> # The most recent update (from freeipa-sea) that was replicated >> to seattlenfs >> # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07). >> # In addition seattlenfs received direct update (last one was in >> Jan 1017) that were not >> # replicated to freeipa-sea >> # >> # The two servers have diverged because they can not replicate to >> eachother because >> # they were not correctly initialize. >> # They have different "replicageneration" (57c291d9000004290000 >> vs 55c8f3ae000000600000) >> # >> # It is looking like freeipa-sea was created one or two years ago >> and used to initialized seattlenfs. >> # But later freeipa-sea was recreated. >> > That's about right. >> >> # >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory >> manager' -W -b "o=3Dipaca" >> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff= ff-ffffffff))" >> Enter LDAP Password: >> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >> nsds50ruv: {replicageneration} 57c291d9000004290000 >> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} >> 57f840bf000004290000 598a1c40000104290000 >> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >> nsruvReplicaLastModified: {replica 1065 >> ldap://freeipa-sea.bpt.rocks:389} 598a1c16 >> nsruvReplicaLastModified: {replica 1290 >> ldap://seattlenfs.bpt.rocks:389} 00000000 >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' >> -W -b "o=3Dipaca" >> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff= ff-ffffffff))" >> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} >> 57b103d4000004290000 57be8043000704290000 >> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >> 57be804c0000050a0000 587236150000050a0000 >> nsruvReplicaLastModified: {replica 1290 >> ldap://seattlenfs.bpt.rocks:389} 00000000 >> nsruvReplicaLastModified: {replica 1065 >> ldap://freeipa-sea.bpt.rocks:389} 00000000 >> >> >> >> In conclusion: >> From replication pov, the two instances can not communicate. >> One solution would be to identify which instance is the good one, = >> you want to keep. >> and reinit the second one from that reference. >> > What exactly does reinit mean? I have run > > ipa-replica-manage re-initialize --from freeipa-sea.bpt.rocks This triggers the reinit of 'dc=3Dipadomain,dc=3Dcom' suffix but not for = o=3Dipaca suffix. To reinit o=3Dipaca you may use ipa-cs-replica-manager re-initialize --from freeipa-sea.bpt.rocks. Note that it will overwrite all data of ipaca on seattlenfs with the = data from freeipa-sea. This is why it is important to know which server = is the valid one. On freeipa-sea and seattlenfs you may check the ipaca replica agreements = status before/after reinit. I would guess they are currently reporting = failures between these two replicas. ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus > > several times over the years when replication has stopped. > > Replication actually is working, as far as user and machine accounts = > and attributes are concerned anyway, and has been for a while. > > There is a zombie server freeipa-dal.bpt.rocks that I can't get rid = > of... it shows up in the GUI on the Topology page but generates a = > Server not found error. I don't know if that's related. Zombie servers have been discussed a lot on this mailing list. You may = get rid of them with list-ruv/clean-ruv subcommand. Replication usually = manage to work fine even if some zombie entries exist but it is a good = practice to clean them. regards thierry >> >> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote: >>> >>> On 8/7/17 1:44 AM, thierry bordaz wrote: >>> >>>> >>>> >>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote: >>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>>>>> >>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>>>>> Ian Harding wrote: >>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users = >>>>>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that = >>>>>>>>>>>>>>>>>>>> had apparently had >>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl says = >>>>>>>>>>>>>>>>>>>> pki-tomcatd >>>>>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat can = >>>>>>>>>>>>>>>>>>> run without >>>>>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see = >>>>>>>>>>>>>>>>>>> what is going on. >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication = >>>>>>>>>>>>>>>>>> failed (49) >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server and = >>>>>>>>>>>>>>>>> needs to >>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how = >>>>>>>>>>>>>>>>> this >>>>>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind = >>>>>>>>>>>>>>>>> DN and >>>>>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> I found this: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,o= =3Dipaca >>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>>>>> ... >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a = >>>>>>>>>>>>>>>> prompt to provide >>>>>>>>>>>>>>>> a pin/password >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>>>>>> password can be >>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf = >>>>>>>>>>>>>>> (with the tag >>>>>>>>>>>>>>> internal=3D...) >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... = >>>>>>>>>>>>>>> allows to read >>>>>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>> (provide password) >>>>>>>>>>>>>> >>>>>>>>>>>>>> That works... >>>>>>>>>>>>>> >>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot = >>>>>>>>>>>>>> "NSS User Private >>>>>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>>>>>>>>>> caSigningCert >>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f = >>>>>>>>>>>>>> Server-Cert >>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>>>>> >>>>>>>>>>>>>> But this doesn't (with the same password from password.conf) >>>>>>>>>>>>>> >>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>>>>> >>>>>>>>>>>>>> That password is getting me somewhere though, since if I = >>>>>>>>>>>>>> put in a >>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and = >>>>>>>>>>>>>> over. >>>>>>>>>>>>> >>>>>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>>>>> >>>>>>>>>>>> There wasn't much of a change... I just assumed someone ran = >>>>>>>>>>>> yum upgrade and didn't restart, then the power outage... it = >>>>>>>>>>>> looks like not much of a version change though. >>>>>>>>>>>> >>>>>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>> Jan 08 04:46:08 Installed: = >>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>>>>> Jul 28 09:55:41 Updated: = >>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:46 Updated: = >>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>> >>>>>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>>>>> Jan 08 04:47:19 Installed: = >>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>>>>> >>>>>>>>>>>> # getenforce >>>>>>>>>>>> Enforcing >>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> If so can you run: >>>>>>>>>>>>> >>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use = >>>>>>>>>>>> the write_logs option. >>>>>>>>>>>> The NOLOG option is overriding the write_logs current setting. >>>>>>>>>>>> ---- >>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): arch=3Dc0000= 03e = >>>>>>>>>>>> syscall=3D2 success=3Dno exit=3D-13 a0=3D7fbcab038d10 a1=3D800= a2=3D1 = >>>>>>>>>>>> a3=3D7fbca60f42e0 items=3D0 ppid=3D1406 pid=3D12965 auid=3D429= 4967295 = >>>>>>>>>>>> uid=3D0 gid=3D0 euid=3D581400001 suid=3D0 fsuid=3D581400001 = >>>>>>>>>>>> egid=3D581400001 sgid=3D0 fsgid=3D581400001 tty=3D(none) = >>>>>>>>>>>> ses=3D4294967295 comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { = >>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" = >>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 = >>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>>> I suspect that the subsystem cert was renewed and = >>>>>>>>>>>>> everything wasn't >>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>>>>> upgrade it just >>>>>>>>>>>>> shone a spotlight on it. >>>>>>>>>>>>> >>>>>>>>>>>>> Can you run these commands: >>>>>>>>>>>>> >>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descrip= tion >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> This returns >>>>>>>>>>>> >>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript= ion >>>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>>> userCertificate:: = >>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>>> ... stuff ... >>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN= =3DCA = >>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>>>> >>>>>>>>>>>>> and >>>>>>>>>>>>> >>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> These both return >>>>>>>>>>>> >>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial >>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>>>>> Unrecognized Object Identifier. >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>>>> User Private Key and Certificate Services" >>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>> certutil: problem listing keys: SEC_ERROR_UNRECOGNIZED_OID: = >>>>>>>>>>>> Unrecognized Object Identifier. >>>>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> you made a typo and requested the keys (-K) instead of the = >>>>>>>>>>> certs (-L). Please retry with -L and you should be able to = >>>>>>>>>>> see the certificate serial. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca = >>>>>>>>>> userCertificate description >>>>>>>>>> Enter LDAP Password: >>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>> userCertificate:: = >>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>> ... >>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC= A = >>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>> >>>>>>>>>> So the serial is 4? >>>>>>>>>> >>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>>> grep Serial >>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>>> >>>>>>>>>> Which is NOT 4... >>>>>>>>>> >>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a >>>>>>>>>> -----BEGIN CERTIFICATE----- >>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>> ... >>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>>>> -----END CERTIFICATE----- >>>>>>>>>> >>>>>>>>>> And this cert is NOT the same. >>>>>>>>>> >>>>>>>>> Hi, >>>>>>>>> >>>>>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>>>>> post-save commands (which you can see in the output of getcert = >>>>>>>>> list). In your case, the post-save command for subsystemCert = >>>>>>>>> cert-pki-ca probably failed. >>>>>>>>> >>>>>>>>> This command (on the renewal master) is responsible for = >>>>>>>>> copying the new cert from the NSS db to the LDAP server. You = >>>>>>>>> need first to check which IPA server is the renewal master (as = >>>>>>>>> the serial numbers are in a completely different range, I = >>>>>>>>> assume that you have multiple IPA servers configured with a CA = >>>>>>>>> instance): >>>>>>>>> >>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D = >>>>>>>>> -f2-` >>>>>>>>> $ kinit admin >>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>> dn: = >>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn= =3Detc,dc=3Dipadomain,dc=3Dcom = >>>>>>>>> >>>>>>>>> >>>>>>>>> In this example the renewal master is vm-ipaserver. >>>>>>>>> >>>>>>>> >>>>>>>> I get this >>>>>>>> >>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>> dn: = >>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc,= dc=3Dbpt,dc=3Drocks = >>>>>>>> >>>>>>>> >>>>>>>> Which is the other FreeIPA server. >>>>>>>> >>>>>>> Hi Ian, >>>>>>> >>>>>>> it's getting difficult to follow this thread, so could we step = >>>>>>> back and summarize? >>>>>> Yes, it is. Sorry. >>>>>>> >>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 in = >>>>>>> the NSSDB /etc/pki/pki-tomcat/alias >>>>>> No? >>>>>> >>>>>> [root(a)freeipa-sea ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>>>>> component is installed and 'subsystemCert cert-pki-ca' has = >>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>>>>> Yes >>>>>> >>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>> >>>>>>> >>>>>>> - In the LDAP servers, the cert is stored in the entry = >>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. it= is = >>>>>>> the cert from freeipa-sea). >>>>>> This is where the difference is. There are two certificates on = >>>>>> the master and only one on the other. I wonder if this is a = >>>>>> result of the slow motion replication trainwreck I have going on = >>>>>> due to a zombie replica in the ldap database that no longer = >>>>>> exists in the real world and I can't seem to get rid of. >>>>>> >>>>> Hi, >>>>> >>>>> the remaining issue is a replication problem. There is a = >>>>> "Troubleshooting replication" section [1] in IdM Admin guide that = >>>>> may help you. >>>>> >>>>> Regarding your zombie replica, which commands did you use to try = >>>>> to remove it, and what was the output? >>>>> >>>>> Flo >>>>> >>>>> [1] = >>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linu= x/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen-= replication.html >>>>> >>>> >>>> Hi, >>>> >>>> To debug replication latency or problem we would need several info = >>>> but starting with the results of the following commands >>>> >>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> nscpentrywsi: = >>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: >>> 75274897 >>> nscpentrywsi: = >>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 >>> 90004: 20170608055334Z >>> nscpentrywsi: = >>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 >>> 003: cn=3DDirectory Manager >>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>> nscpentrywsi: cn: pkidbuser >>> nscpentrywsi: createTimestamp: 20150716125146Z >>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>> nscpentrywsi: description;vucsn-5938e688000104290001: = >>> 2;1341718541;CN=3DCertific >>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = >>> 2;4;CN=3DCertifica >>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>> nscpentrywsi: mail: >>> nscpentrywsi: objectClass: top >>> nscpentrywsi: objectClass: person >>> nscpentrywsi: objectClass: organizationalPerson >>> nscpentrywsi: objectClass: inetOrgPerson >>> nscpentrywsi: objectClass: cmsuser >>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>> nscpentrywsi: sn: pkidbuser >>> nscpentrywsi: uid: pkidbuser >>> nscpentrywsi: userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>> >>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = >>> MIIDbjCCAlagAwIBAgI >>> >>> AR >>> nscpentrywsi: userPassword:: >>> nscpentrywsi: userstate: 1 >>> nscpentrywsi: usertype: agentType >>> nscpentrywsi: parentid: 2 >>> nscpentrywsi: entryid: 51 >>>> and >>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>> >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >>> -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>> Enter LDAP Password: >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>> nscpentrywsi: userCertificate:: = >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>> >>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>> nscpentrywsi: description: 2;4;CN=3DCertificate = >>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs >>> ystem,O=3DBPT.ROCKS >>> nscpentrywsi: entryid: 51 >>> nscpentrywsi: parentid: 2 >>> nscpentrywsi: modifyTimestamp: 20150716125146Z >>> nscpentrywsi: createTimestamp: 20150716125146Z >>> nscpentrywsi: modifiersName: cn=3Ddirectory manager >>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>> nscpentrywsi: userPassword:: >>> nscpentrywsi: userstate: 1 >>> nscpentrywsi: usertype: agentType >>> nscpentrywsi: mail: >>> nscpentrywsi: cn: pkidbuser >>> nscpentrywsi: sn: pkidbuser >>> nscpentrywsi: uid: pkidbuser >>> nscpentrywsi: objectClass: top >>> nscpentrywsi: objectClass: person >>> nscpentrywsi: objectClass: organizationalPerson >>> nscpentrywsi: objectClass: inetOrgPerson >>> nscpentrywsi: objectClass: cmsuser >>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>> nscpentrywsi: entryusn: 86 >>>> >>>> From the output you may only copy/past the ones related to = >>>> userCertificate >>>> >>>> >>>> Also to dump the current replication status, send the result of >>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b = >>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffff= ffff-ffffffff-ffffffff))" >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>> -W -b "o=3Dipaca" = >>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-= ffffffff))" >>> Enter LDAP Password: >>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>> cn: replica >>> nsDS5Flags: 1 >>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>> cloneAgreement1-freeipa-sea.bpt.roc >>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>> masterAgreement1-seattlenfs.bpt.roc >>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>> nsDS5ReplicaId: 1065 >>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 >>> nsDS5ReplicaRoot: o=3Dipaca >>> nsDS5ReplicaType: 3 >>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D >>> nsds5replicabinddngroup: cn=3Dreplication = >>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>> dc=3Drocks >>> nsds5replicabinddngroupcheckinterval: 60 >>> objectClass: top >>> objectClass: nsDS5Replica >>> objectClass: extensibleobject >>> nsds50ruv: {replicageneration} 57c291d9000004290000 >>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>> 57f840bf00000429000 >>> 0 598a1c40000104290000 >>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >>> nsds5agmtmaxcsn: = >>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat >>> tlenfs.bpt.rocks;389;unavailable >>> nsds5agmtmaxcsn: = >>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat >>> tlenfs.bpt.rocks;389;unavailable >>> nsruvReplicaLastModified: {replica 1065 = >>> ldap://freeipa-sea.bpt.rocks:389} 598a >>> 1c16 >>> nsruvReplicaLastModified: {replica 1290 = >>> ldap://seattlenfs.bpt.rocks:389} 00000 >>> 000 >>> nsds5ReplicaChangeCount: 885 >>> nsds5replicareapactive: 0 >>>> and >>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b = >>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffff= ffff-ffffffff-ffffffff))" >>> >>> >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >>> -b "o=3Dipaca" = >>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff-= ffffffff))" >>> Enter LDAP Password: >>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>> cn: replica >>> nsDS5Flags: 1 >>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>> cloneAgreement1-seattlenfs.bpt.rock >>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>> nsDS5ReplicaId: 1290 >>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 >>> nsDS5ReplicaRoot: o=3Dipaca >>> nsDS5ReplicaType: 3 >>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D >>> nsds5replicabinddngroup: cn=3Dreplication = >>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>> dc=3Drocks >>> nsds5replicabinddngroupcheckinterval: 60 >>> objectClass: top >>> objectClass: nsDS5Replica >>> objectClass: extensibleobject >>> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = >>> 57be804c0000050a0000 >>> 587236150000050a0000 >>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>> 57b103d400000429000 >>> 0 57be8043000704290000 >>> nsds5agmtmaxcsn: = >>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei >>> pa-sea.bpt.rocks;389;1065;587236150000050a0000 >>> nsruvReplicaLastModified: {replica 1290 = >>> ldap://seattlenfs.bpt.rocks:389} 00000 >>> 000 >>> nsruvReplicaLastModified: {replica 1065 = >>> ldap://freeipa-sea.bpt.rocks:389} 0000 >>> 0000 >>> nsds5ReplicaChangeCount: 3 >>> nsds5replicareapactive: 0 >>>> >>>> Regards >>>> thierry >>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate = >>>>>> description >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>> >>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> userCertificate:: = >>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>>>>> description: 2;1341718541;CN=3DCertificate = >>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem >>>>>> ,O=3DBPT.ROCKS >>>>>> >>>>>> >>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descript= ion >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>> >>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>> Subsystem,O=3DBPT.RO >>>>>> CKS >>>>>> >>>>>>> If you check the certificates dates, I guess that the most = >>>>>>> recent one is on server seattlenfs (because of serial numbers). = >>>>>>> Can you confirm this (because our goal is to have the most = >>>>>>> recent cert stored in all the NSSDBs and in LDAP)? >>>>>>> >>>>>>> Thanks, >>>>>>> Flo >>>>>>> >>>>>>> >>>>>>>>> If your renewal master is the machine on which the NSS DB = >>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you = >>>>>>>>> can manually run the scripts: >>>>>>>> >>>>>>>> If I'm interpreting this correctly, then it is... so I ran this = >>>>>>>> on the broken machine (seattlenfs) >>>>>>>> >>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert = >>>>>>>>> "subsystemCert cert-pki-ca" >>>>>>>>> >>>>>>>> >>>>>>>> I ran this, it took a while, then I re-checked and the serial = >>>>>>>> still seems to be 4 >>>>>>>> >>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>> Enter LDAP Password: >>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>> userCertificate:: = >>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>> ... >>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>> >>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>>>>> >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D DE= BUG = >>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> restart at autoShutdown? false >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> autoShutdown crumb file path? = >>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>>>> cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>>>> cert:auditSigningCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>>> init id=3Ddebug >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> initialized debug >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> initSubsystem id=3Dlog >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>>>> to init id=3Dlog >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audi= t) = >>>>>>>> >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> restart at autoShutdown? false >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> autoShutdown crumb file path? = >>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>>>> cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>>>> cert:auditSigningCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>>> init id=3Dlog >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> initialized log >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> initSubsystem id=3Djss >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>>>> to init id=3Djss >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> restart at autoShutdown? false >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> autoShutdown crumb file path? = >>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: about = >>>>>>>> to look for cert for auto-shutdown support:auditSigningCert = >>>>>>>> cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: found = >>>>>>>> cert:auditSigningCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>>> init id=3Djss >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> initialized jss >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>> initSubsystem id=3Ddbs >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: ready = >>>>>>>> to init id=3Ddbs >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: = >>>>>>>> init() mEnableSerialMgmt=3Dtrue >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>> LdapBoundConnFactor(DBSubsystem) >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> LdapBoundConnFactory: init >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> LdapBoundConnFactory:doCloning true >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>> init() >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>> init begins >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>> init ends >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>>>>> makeConnection errorIfDown is true >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>>>>>>> errorIfDown true >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: = >>>>>>>> true >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname = >>>>>>>> to: subsystemCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> LdapJssSSLSocket: set client auth cert nickname subsystemCert = >>>>>>>> cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> SSLClientCertificatSelectionCB: Entering! >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>>>> ocspSigningCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>>>> subsystemCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>>>>> subsystemCert cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert = >>>>>>>> cert-pki-ca >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake = >>>>>>>> happened >>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>> CMSEngine.shutdown() >>>>>>>> >>>>>>>> >>>>>>>> I really appreciate you sticking with me through this. I owe you. >>>>>>>> >>>>>>>> - Ian >>>>>>>> >>>>>>>>> After that, check that the LDAP entry has been updated. If it = >>>>>>>>> is the case, you should be able to restart pki. >>>>>>>>> >>>>>>>>> Flo >>>>>>>>> >>>>>>>>>> Thank you again for your time! >>>>>>>>>> >>>>>>>>>> Ian >>>>>>>>>> >>>>>>>>>>> Flo. >>>>>>>>>>>> >>>>>>>>>>>> which seems weird. >>>>>>>>>>>> >>>>>>>>>>>>> The description attribute in the ldapsearch output is of = >>>>>>>>>>>>> the form 2;#;DN;DN >>>>>>>>>>>>> >>>>>>>>>>>>> The # should match the serial number in the first certutil = >>>>>>>>>>>>> output >>>>>>>>>>>>> >>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match = >>>>>>>>>>>>> one of the >>>>>>>>>>>>> userCertificate attributes. >>>>>>>>>>>>> >>>>>>>>>>>>> rob >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>> _______________________________________________ >>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>>> To unsubscribe send an email to = >>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>> _______________________________________________ >>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>> To unsubscribe send an email to = >>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>> >>> >>> >>> >>> _______________________________________________ >>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted= .org >> > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org --===============0674695975783376051== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgPGJyPgogICAgPGJyPgogICAgPGRpdiBjbGFz cz0ibW96LWNpdGUtcHJlZml4Ij5PbiAwOC8wOS8yMDE3IDA5OjMwIFBNLCBJYW4gSGFyZGluZyB2 aWEKICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1 b3RlCiAgICAgIGNpdGU9Im1pZDpmZTUyNTlmMy1hZTRhLTgzODktNTQyNS05Yjg0YjExYjcxZDVA YnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICB0eXBlPSJjaXRlIj4KICAgICAgPG1ldGEgaHR0 cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgi PgogICAgICA8cD5PbiA4LzkvMTcgMzowNSBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6PGJyPgog ICAgICA8L3A+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3 Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsg Y2hhcnNldD11dGYtOCIKICAgICAgICAgIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgICAg ICAgSGkgSWFuLDxicj4KICAgICAgICA8YnI+CiAgICAgICAgVGhhbmtzIGZvciBoYXZpbmcgZ2F0 aGVyIHRob3NlIGRhdGEuIDxicj4KICAgICAgICA8dHQ+PGJyPgogICAgICAgIDwvdHQ+CiAgICAg ICAgPGJsb2NrcXVvdGU+PHR0PiM8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jIFNvIHBraWRidXNl ciBlbnRyaWVzIGhhdmUgYSBzYW1lIChvbGQpIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAgICBs aWtlbHkgZ2VuZXJhdGVkIGR1cmluZyBpbnN0YWxsPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBC dXQgb25seSBmcmVlaXBhLXNlYSBoYXMgYSBuZXcgb25lIGNyZWF0ZWQgb24KICAgICAgICAgICAg ZnJlZWlwYS1zZWEgYXJvdW5kIEp1biA4dGggMjAxNyAwNTo1NDoxNjwvdHQ+PGJyPgogICAgICAg ICAgPHR0PiMgVGhpcyByZWNlbnQgY2VydGlmaWNhdGUgaXMgaWRlbnRpZmllZCBieQogICAgICAg ICAgICA1OTM4ZTY4ODAwMDEwNDI5MDAwMCA8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jPC90dD48 YnI+CiAgICAgICAgICA8dHQ+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxM TCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9cGtpZGJ1 c2VyLG91PXBlb3BsZSxvPWlwYWNhIgogICAgICAgICAgICBuc2NwZW50cnl3c2k8L3R0Pjxicj4K ICAgICAgICAgIDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJy PgogICAgICAgICAgPHR0Pi4uLjwvdHQ+PGJyPgogICAgICAgICAgPHR0Pm5zY3BlbnRyeXdzaTog dXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdr cWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgICAgIDx0dD5u c2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMDo6 CiAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0kgJmx0O3NuaXAmZ3Q7PC90dD48YnI+CiAg ICAgICAgICA8YnI+CiAgICAgICAgICA8dHQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNl YXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlk PXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8L3R0Pjxicj4KICAgICAg ICAgIDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAg ICAgICAgPHR0Pm5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgTUlJ RGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUiAmbHQ7c25pcCZndDs8 L3R0Pjxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAg ICAgICAgIDx0dD4jPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyB3aHkgNTkzOGU2ODgwMDAxMDQy OTAwMDAgdmFsdWUgd2FzIG5vdCBwcm9wYWdhdGVkIHRvCiAgICAgICAgICAgIHNlYXR0bGVuZnMg PzwvdHQ+PGJyPgogICAgICAgICAgPHR0PiMgVGhlIG1vc3QgcmVjZW50IHVwZGF0ZSAoZnJvbSBm cmVlaXBhLXNlYSkgdGhhdCB3YXMKICAgICAgICAgICAgcmVwbGljYXRlZCB0byBzZWF0dGxlbmZz PC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBpc8KgIDEgeWVhciBvbGQgKDU3YmU4MDQzMDAwNzA0 MjkwMDAwIC0gQXVnIDI1dGggMjAxNgogICAgICAgICAgICAwNToyMTowNykuPC90dD48YnI+CiAg ICAgICAgICA8dHQ+IyBJbiBhZGRpdGlvbiBzZWF0dGxlbmZzIHJlY2VpdmVkIGRpcmVjdCB1cGRh dGUgKGxhc3Qgb25lCiAgICAgICAgICAgIHdhcyBpbiBKYW4gMTAxNykgdGhhdCB3ZXJlIG5vdDwv dHQ+PGJyPgogICAgICAgICAgPHR0PiMgcmVwbGljYXRlZCB0byBmcmVlaXBhLXNlYTwvdHQ+PGJy PgogICAgICAgICAgPHR0PiMgPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBUaGUgdHdvIHNlcnZl cnMgaGF2ZSBkaXZlcmdlZCBiZWNhdXNlIHRoZXkgY2FuIG5vdAogICAgICAgICAgICByZXBsaWNh dGUgdG8gZWFjaG90aGVyIGJlY2F1c2U8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jIHRoZXkgd2Vy ZSBub3QgY29ycmVjdGx5IGluaXRpYWxpemUuPC90dD48YnI+CiAgICAgICAgICA8dHQ+IyBUaGV5 IGhhdmUgZGlmZmVyZW50ICJyZXBsaWNhZ2VuZXJhdGlvbiIKICAgICAgICAgICAgKDU3YzI5MWQ5 MDAwMDA0MjkwMDAwIHZzIDU1YzhmM2FlMDAwMDAwNjAwMDAwKTwvdHQ+PGJyPgogICAgICAgICAg PHR0PiM8L3R0Pjxicj4KICAgICAgICAgIDx0dD4jIEl0IGlzIGxvb2tpbmcgbGlrZSBmcmVlaXBh LXNlYSB3YXMgY3JlYXRlZCBvbmUgb3IgdHdvCiAgICAgICAgICAgIHllYXJzIGFnbyBhbmQgdXNl ZCB0byBpbml0aWFsaXplZCBzZWF0dGxlbmZzLjwvdHQ+PGJyPgogICAgICAgICAgPHR0PiMgQnV0 IGxhdGVyIGZyZWVpcGEtc2VhIHdhcyByZWNyZWF0ZWQuPC90dD48YnI+CiAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDx0dD5UaGF0J3MgYWJvdXQgcmlnaHQu PC90dD48YnI+CiAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3 Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICAgIDxibG9ja3F1b3RlPiA8dHQ+IzwvdHQ+PGJy PgogICAgICAgICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg LUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigm YW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZm Zi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAgPHR0PkVudGVyIExEQVAg UGFzc3dvcmQ6PC90dD48YnI+CiAgICAgICAgICA8dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlw YWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8L3R0Pjxicj4KICAgICAgICAgIDx0dD5uc2Rz NTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkwMDAwMDQyOTAwMDA8L3R0Pjxicj4K ICAgICAgICAgIDx0dD5uc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgY2xhc3M9Im1vei10eHQt bGluay1mcmVldGV4dCIKICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0 LnJvY2tzOjM4OSIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9m cmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgNTdmODQwYmYwMDAwMDQy OTAwMDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICAgIDx0dD5uc2RzNTBy dXY6IHtyZXBsaWNhIDEyOTAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAg ICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5IgogICAgICAgICAg ICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4 OTwvYT59PC90dD48YnI+CiAgICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7 cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4 dCIKICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSIK ICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxp bmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFw Oi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT48L2E+fQogICAgICAgICAgICA1OThhMWMx NjwvdHQ+PGJyPgogICAgICAgICAgPHR0Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxp Y2EgMTI5MCA8YQogICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAg ICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAg ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl ZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0 dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjxi cj4KICAgICAgICAgIDxicj4KICAgICAgICAgIDx0dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBs ZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICBtYW5hZ2VyJyAtVyAt YiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1m ZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAg PHR0PmRuOiBjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmln PC90dD48YnI+CiAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU1 YzhmM2FlMDAwMDAwNjAwMDAwPC90dD48YnI+CiAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVw bGljYSAxMDY1IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAg aHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgbW96 LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59 CiAgICAgICAgICAgIDU3YjEwM2Q0MDAwMDA0MjkwMDAwIDU3YmU4MDQzMDAwNzA0MjkwMDAwPC90 dD48YnI+CiAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVu ZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxk YXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fcKgCgogICAgICAgICAgICA1N2JlODA0 YzAwMDAwNTBhMDAwMCA1ODcyMzYxNTAwMDAwNTBhMDAwMDwvdHQ+PGJyPgogICAgICAgICAgPHR0 Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICAg IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgaHJlZj0ibGRhcDov L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9 InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0 dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+ PC9hPn0KICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjxicj4KICAgICAgICAgIDx0dD5uc3J1dlJl cGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgICBjbGFzcz0i bW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBh LXNlYS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh LmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPjwvYT59 CiAgICAgICAgICAgIDAwMDAwMDAwPC90dD48L2Jsb2NrcXVvdGU+CiAgICAgICAgPGJyPgogICAg ICAgIDxicj4KICAgICAgICBJbiBjb25jbHVzaW9uOjxicj4KICAgICAgICDCoMKgwqAgRnJvbSBy ZXBsaWNhdGlvbiBwb3YsIHRoZSB0d28gaW5zdGFuY2VzIGNhbiBub3QgY29tbXVuaWNhdGUuPGJy PgogICAgICAgIMKgwqDCoCBPbmUgc29sdXRpb24gd291bGQgYmUgdG8gaWRlbnRpZnkgd2hpY2gg aW5zdGFuY2UgaXMgdGhlIGdvb2QKICAgICAgICBvbmUsIHlvdSB3YW50IHRvIGtlZXAuPGJyPgog ICAgICAgIMKgwqDCoCBhbmQgcmVpbml0IHRoZSBzZWNvbmQgb25lIGZyb20gdGhhdCByZWZlcmVu Y2UuPGJyPgogICAgICAgIDxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBXaGF0IGV4YWN0 bHkgZG9lcyByZWluaXQgbWVhbj/CoCBJIGhhdmUgcnVuPGJyPgogICAgICA8YnI+CiAgICAgIGlw YS1yZXBsaWNhLW1hbmFnZSByZS1pbml0aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5icHQucm9j a3M8YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBUaGlzIHRyaWdnZXJzIHRoZSBy ZWluaXQgb2YgJ2RjPWlwYWRvbWFpbixkYz1jb20nIHN1ZmZpeCBidXQgbm90IGZvcgogICAgbz1p cGFjYSBzdWZmaXguIFRvIHJlaW5pdCBvPWlwYWNhIHlvdSBtYXkgdXNlPGJyPgogICAgaXBhLWNz LXJlcGxpY2EtbWFuYWdlciByZS1pbml0aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5icHQucm9j a3MuPGJyPgogICAgTm90ZSB0aGF0IGl0IHdpbGwgb3ZlcndyaXRlIGFsbCBkYXRhIG9mIGlwYWNh IG9uIHNlYXR0bGVuZnMgd2l0aCB0aGUKICAgIGRhdGEgZnJvbSBmcmVlaXBhLXNlYS4gVGhpcyBp cyB3aHkgaXQgaXMgaW1wb3J0YW50IHRvIGtub3cgd2hpY2gKICAgIHNlcnZlciBpcyB0aGUgdmFs aWQgb25lLjxicj4KICAgIDxicj4KICAgIE9uIGZyZWVpcGEtc2VhIGFuZCBzZWF0dGxlbmZzIHlv dSBtYXkgY2hlY2sgdGhlIGlwYWNhIHJlcGxpY2EKICAgIGFncmVlbWVudHMgc3RhdHVzIGJlZm9y ZS9hZnRlciByZWluaXQuIEkgd291bGQgZ3Vlc3MgdGhleSBhcmUKICAgIGN1cnJlbnRseSByZXBv cnRpbmcgZmFpbHVyZXMgYmV0d2VlbiB0aGVzZSB0d28gcmVwbGljYXMuPGJyPgogICAgPGJyPgog ICAgPHR0PmxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICI8 L3R0Pjx0dD5jbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgIHRyZWUsY249 Y29uZmlnIiAib2JqZWN0Q2xhc3M9bnNkczVyZXBsaWNhdGlvbmFncmVlbWVudCIKICAgICAgbnNk czVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgPGJyPgogICAgPC90dD4KICAgIDxi bG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDpmZTUyNTlmMy1hZTRhLTgzODktNTQyNS05Yjg0YjEx YjcxZDVAYnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICB0eXBlPSJjaXRlIj4gPGJyPgogICAg ICBzZXZlcmFsIHRpbWVzIG92ZXIgdGhlIHllYXJzIHdoZW4gcmVwbGljYXRpb24gaGFzIHN0b3Bw ZWQuwqAgPGJyPgogICAgICA8YnI+CiAgICAgIFJlcGxpY2F0aW9uIGFjdHVhbGx5IGlzIHdvcmtp bmcsIGFzIGZhciBhcyB1c2VyIGFuZCBtYWNoaW5lCiAgICAgIGFjY291bnRzIGFuZCBhdHRyaWJ1 dGVzIGFyZSBjb25jZXJuZWQgYW55d2F5LCBhbmQgaGFzIGJlZW4gZm9yIGEKICAgICAgd2hpbGUu PGJyPgogICAgICA8YnI+CiAgICAgIFRoZXJlIGlzIGEgem9tYmllIHNlcnZlciBmcmVlaXBhLWRh bC5icHQucm9ja3MgdGhhdCBJIGNhbid0IGdldAogICAgICByaWQgb2YuLi4gaXQgc2hvd3MgdXAg aW4gdGhlIEdVSSBvbiB0aGUgVG9wb2xvZ3kgcGFnZSBidXQKICAgICAgZ2VuZXJhdGVzIGEgU2Vy dmVyIG5vdCBmb3VuZCBlcnJvci7CoCBJIGRvbid0IGtub3cgaWYgdGhhdCdzCiAgICAgIHJlbGF0 ZWQuPGJyPgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgWm9tYmllIHNlcnZlcnMgaGF2 ZSBiZWVuIGRpc2N1c3NlZCBhIGxvdCBvbiB0aGlzIG1haWxpbmcgbGlzdC4gWW91CiAgICBtYXkg Z2V0IHJpZCBvZiB0aGVtIHdpdGggbGlzdC1ydXYvY2xlYW4tcnV2IHN1YmNvbW1hbmQuIFJlcGxp Y2F0aW9uCiAgICB1c3VhbGx5IG1hbmFnZSB0byB3b3JrIGZpbmUgZXZlbiBpZiBzb21lIHpvbWJp ZSBlbnRyaWVzIGV4aXN0IGJ1dCBpdAogICAgaXMgYSBnb29kIHByYWN0aWNlIHRvIGNsZWFuIHRo ZW0uPGJyPgogICAgPGJyPgogICAgcmVnYXJkczxicj4KICAgIHRoaWVycnk8YnI+CiAgICA8Ymxv Y2txdW90ZQogICAgICBjaXRlPSJtaWQ6ZmU1MjU5ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3 MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20i PiA8YnI+CiAgICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4Ij5PbiAwOC8wOC8yMDE3 IDEwOjMzIFBNLCBJYW4gSGFyZGluZwogICAgICAgICAgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6 PGJyPgogICAgICAgIDwvZGl2PgogICAgICAgIDxibG9ja3F1b3RlCiAgICAgICAgICBjaXRlPSJt aWQ6MmY2MGM0YWYtNjgwYy00MzgyLTk3MDQtNDFhMjRjODEyMWEyQGJyb3ducGFwZXJ0aWNrZXRz LmNvbSIKICAgICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgPG1ldGEgaHR0cC1lcXVpdj0i Q29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7CiAgICAgICAgICAgIGNoYXJzZXQ9dXRm LTgiPgogICAgICAgICAgPHA+T24gOC83LzE3IDE6NDQgQU0sIHRoaWVycnkgYm9yZGF6IHdyb3Rl Ojxicj4KICAgICAgICAgIDwvcD4KICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNp dGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPgogICAgICAgICAgICA8bWV0YSBj b250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiCiAgICAgICAgICAgICAgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcvMjAxNyAwOToyMiBB TSwKICAgICAgICAgICAgICBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgdmlhIEZyZWVJUEEtdXNlcnMg d3JvdGU6PGJyPgogICAgICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUKICAg ICAgICAgICAgICBjaXRlPSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMz QHJlZGhhdC5jb20iCiAgICAgICAgICAgICAgdHlwZT0iY2l0ZSI+T24gMDgvMDQvMjAxNyAxMTow MiBQTSwgSWFuIEhhcmRpbmcgdmlhCiAgICAgICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTog PGJyPgogICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDgvNC8xNyAyOjE2 IEFNLCBGbG9yZW5jZQogICAgICAgICAgICAgICAgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij5PbiAwOC8wMy8yMDE3IDExOjEzIFBNLCBJYW4KICAgICAgICAgICAgICAgICAgSGFyZGluZyB2 aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90 ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4IEFNLAogICAgICAgICAgICAgICAgICAg IEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgIDxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMTE6NTEgUE0sIElhbgogICAgICAg ICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAg ICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAx MjoxMSBBTSwKICAgICAgICAgICAgICAgICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdy b3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi Pk9uIDA4LzAyLzIwMTcgMDE6NDMgQU0sCiAgICAgICAgICAgICAgICAgICAgICAgICAgSWFuIEhh cmRpbmcgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3IDEyOjAzCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICBQTSwgUm9iIENyaXR0ZW5kZW4gd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklhbiBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAx LzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwNzozOSBBTSwgRmxvcmVuY2Ug QmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDEvMjAxNwogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgMDM6MTEgUE0sIElhbiBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8w MS8yMDE3CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDAxOjQ4IEFNLCBGbG9y ZW5jZSBCbGFuYy1SZW5hdWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Jv dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwOC8w MS8yMDE3IDAxOjMyIEFNLCBJYW4gSGFyZGluZwogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHZpYSBGcmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIE9uIDA3LzMxLzIwMTcgMTE6MzQgQU0sIFJvYgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ3JpdHRlbmRlbiB3cm90ZTogPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSI+SWFuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhhcmRp bmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SSBoYWQKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBhbiB1bmV4cGVjdGVkIHJlc3RhcnQgb2YgYW4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJUEEgc2VydmVyIHRoYXQgaGFkCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXBwYXJlbnRseSBoYWQg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZXMg cnVuIGJ1dCBoYWQgbm90IGJlZW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICByZXN0YXJ0ZWQuIGlwYWN0bCBzYXlzCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgcGtpLXRvbWNhdGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHdvdWxkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBub3Qgc3RhcnQuIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgU3RyYW5nZWx5LCB0aGUgYWN0dWFsCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgc2VydmljZSBhcHBlYXJzIHRvIGJlCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnVubmluZzogPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGRvZ3RhZyBpcyBhbiBhcHBsaWNhdGlvbgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB3aXRoaW4gdG9tY2F0IHNvIHRvbWNhdCBjYW4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnVuIHdpdGhvdXQgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nLiA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgV2UgbmVlZCB0byBzZWUgbW9yZSBvZiB0aGUKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIGRlYnVnIGxvZyB0byBz ZWUgd2hhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcyBnb2lu ZyBvbi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBJdCBsb29rcyBsaWtlIGFuIGF1dGhlbnRpY2F0aW9u CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcm9ibGVtLi4uIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFsyOC9KdWwvMjAxNzoxMDowODo0N11bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFNTTCBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgQ291bGQgbm90IGNvbm5lY3QgdG8gTERBUCBzZXJ2ZXIKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhvc3Qgc2VhdHRsZW5mcy5icHQucm9ja3MgcG9y dAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgNjM2IDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVycm9yCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBuZXRzY2FwZS5sZGFwLkxEQVBFeGNlcHRpb246CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRoZW50aWNhdGlvbiBmYWlsZWQg KDQ5KSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcg c3RvcmVzIGl0cyBpbnRlcm5hbCBkYXRhIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgdGhlIExEQVAgc2VydmVyIGFuZCBuZWVkcyB0byA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgZXN0YWJsaXNoIGEgc2VjdXJlIExEQVAKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25uZWN0aW9uLiBZb3UgY2FuIGNoZWNrIGhv dyB0aGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rpb24gaXMgY29uZmlndXJlZCBp bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21j YXQvY2EvQ1MuY2ZnLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxvb2sg Zm9yIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgbGluZXM6 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlw ZT1Tc2xDbGllbnRBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGF1 dGguYmluZEROPWNuPURpcmVjdG9yeQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIE1hbmFnZXIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu dGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vic3lzdGVt Q2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBj b25uLmhvc3Q9dm0tLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBpbnRlcm5hbGRiLmxkYXBjb25uLnBvcnQ9NjM2IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLnNlY3VyZUNvbm4gPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBhdXRodHlwZSBjYW4gYmUgU3NsQ2xpZW50QXV0aAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEgc3Ns IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSkg b3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKGF1dGhl bnRpY2F0aW9uIHdpdGggYSBiaW5kIEROIGFuZAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNz d29yZCBzdG9yZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFy L2xpYi9wa2kvcGtpLXRvbWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYpLgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWW91IGNh biB1c2UgdGhpcyBpbmZvcm1hdGlvbiB0bwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIG1hbnVhbGx5IGNoZWNrIHRoZSBjcmVkZW50aWFscy4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBGb3IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGluc3RhbmNlIHdpdGggc3NsY2xpZW50YXV0aDogPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBleHBvcnQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBM REFQVExTX0NBQ0VSVERJUj0vZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGV4cG9ydCBMREFQVExTX0NFUlQ9J3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXBzOi8vIj5sZGFwczovLzwvYT48L2E+YGhv c3RuYW1lYDo2MzYKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIg LXMgYmFzZSAtWSBFWFRFUk5BTCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgKHByb3ZpZGUgdGhlIHBhc3N3b3JkIGZyb20KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzL3B3ZGZpbGUudHh0KQogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJIGZvdW5kIHRoaXM6IDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVu dEF1dGgKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj11aWQ9 cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxk Yi5sZGFwYXV0aC5iaW5kUFdQcm9tcHQ9aW50ZXJuYWxkYgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu dGVybmFsZGIubGRhcGF1dGguY2xpZW50Q2VydE5pY2tuYW1lPXN1YnN5c3RlbUNlcnQKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLmNsb25lUmVwbGlj YXRpb25Qb3J0PTM4OQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgYW5kIHdoZW4gSSB0cnkgdGhlIGxkYXBzZWFyY2ggSSBhbQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBwcmVzZW50ZWQgd2l0aCBhIHByb21wdCB0byBwcm92aWRlIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYSBwaW4vcGFzc3dvcmQgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSBlbnRlciBwaW4sIHBhc3N3b3JkLCBvciBwYXNz CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkg dG9rZW4gJ2xkYXAoMCknOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgYnV0IHRoZXJlIGlzIG5vIHBhc3N3b3JkIGZpbGUuLi4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeW91IGFyZSByaWdodCwgaW4gNC40 LiB0aGVyZSBpcyBubwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHdkZmlsZS50 eHQgYW5kIHRoZSBwYXNzd29yZCBjYW4gYmUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgZm91bmQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIv bGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgKHdpdGggdGhlIHRhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBpbnRlcm5hbD0uLi4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENhbiB5b3UgY2hl Y2sgaWYgdGhlIHBhc3N3b3JkIHdpdGggdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB0YWcgaW50ZXJuYWw9Li4uIGFsbG93cyB0byByZWFkIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHRoZSBrZXlzIGZyb20gdGhlIE5TUyBkYj8gPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWwgLUsgLWQKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgKHByb3ZpZGUgcGFzc3dvcmQpIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQg d29ya3MuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IENoZWNraW5nIHRva2VuICJOU1MKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiIgaW4gc2xvdCAiTlNT IFVzZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcml2YXRlIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGlu IGZvciAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIi OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAwJmd0OyByc2EKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdj YTUzNjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChvcnBoYW4p IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDEmZ3Q7IHJzYQogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4 NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTlNTIENlcnRp ZmljYXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQjphdWRpdFNpZ25p bmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAm bHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDg4MWI3MjU0YzQw ZmE0MGJjNTA2ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBj ZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAzJmd0 OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlhMjU1YTFkMTU1ODVhYzI4 MDY0YzBmNDk4NmU0MTZiYzQ4NDAzwqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREI6 b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDNm YjYwOWQwZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3ZjdlNWEwMWYKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZs dDsgNSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5NDc5YTk1NTZh ZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIERCOnN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhp cyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lIHBhc3N3b3JkCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgZnJvbSBwYXNzd29yZC5jb25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgbGRhcHNlYXJj aCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQt bGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Imxk YXBzOi8vIiBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl ZXRleHQiIGhyZWY9ImxkYXBzOi8vIj5sZGFwczovLzwvYT48L2E+YGhvc3RuYW1lYDo2MzYKCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIgLXMgYmFzZSAtWSBFWFRFUk5BTCA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFz c3dvcmQsIG9yIHBhc3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaHJhc2UgZm9y IHNlY3VyaXR5IHRva2VuICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIFNBU0wvRVhURVJOQUwgYXV0aGVudGljYXRpb24gc3RhcnRlZCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgbGRhcF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczogSW52 YWxpZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRlbnRpYWxzICg0OSkgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29tZXdoZXJlCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhvdWdoLCBzaW5jZSBpZiBJIHB1dCBpbiBhIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBub25zZW5zZSBvciBpbmNvcnJlY3Qg cGFzc3dvcmQgaXQganVzdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByb21wdHMg b3ZlciBhbmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgZnJvbSB3aGF0IHRvIHdoYXQ/IDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZXJlIHdhc24ndCBtdWNo IG9mIGEgY2hhbmdlLi4uIEkganVzdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgYXNzdW1l ZCBzb21lb25lIHJhbiB5dW0gdXBncmFkZSBhbmQgZGlkbid0CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICByZXN0YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2UuLi4gaXQgbG9va3MKICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGxpa2Ugbm90IG11Y2ggb2YgYSB2ZXJzaW9uIGNoYW5nZSB0 aG91Z2guIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICMgZ3JlcCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDU6MzIgSW5zdGFsbGVkOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgaXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2Fy Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3Rh bGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4w LTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBsaWJpcGFfaGJhYy0xLjE0LjAtNDMuZWw3XzMuNC54 ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA3IFVw ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24tbGliaXBhX2hiYWMtMS4x NC4wLTQzLmVsN18zLjQueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDggSW5zdGFsbGVkOgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uLWlwYWRkcmVzcy0xLjAuMTYtMi5lbDcubm9h cmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNCBJbnN0 YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0x NC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcu Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBVcGRhdGVkOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEu bm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDUgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDc6MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBK YW4gMDggMDQ6NDc6MDcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNzc2Qt aXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDc6MTcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg IGlwYS1jbGllbnQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEueDg2XzY0IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMyBVcGRhdGVkOgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgaXBhLXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjI3IFVwZGF0ZWQ6 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcu Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzozNiBJbnN0YWxsZWQ6CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9z LjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo1MDowNyBFcmFzZWQ6CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBpcGEtcHl0aG9uLTQuMi4wLTE1LjAuMS5lbDcuY2VudG9zLjE5Lng4Nl82NAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgSnVsIDI4IDA5OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBp cGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2ggPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQyIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg IGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy OCAwOTo1NTo0MyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1p cGFsaWItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ0IFVw ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQu MC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDUgVXBkYXRlZDoKICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2VydmVyLTQuNC4wLTE0LmVsNy5j ZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJj aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgSnVsIDI4IDA5OjU1OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICBpcGEtY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICBpcGEtc2VydmVyLTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVwZGF0ZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLWRucy00LjQuMC0xNC5lbDcuY2Vu dG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGlwYS1weXRob24tY29tcGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2Fy Y2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgZ3JlcCBwa2kgL3Zhci9s b2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6 MDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0x NC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0 OjQ2OjA5IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBrcmI1LXBraW5pdC0x LjE0LjEtMjcuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph biAwOCAwNDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kt YmFzZS1qYXZhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHBraS1zZXJ2ZXItMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHBraS1rcmEtMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHBraS1jYS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNiBVcGRhdGVkOgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoKICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEtMTAuMy4zLTE5LmVsN18zLm5v YXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBk YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTkuZWw3 XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoy MSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMt MTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx MDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4z LjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy OCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWNhLTEw LjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgQXJlIHlvdSBydW5uaW5nIGluIFNFTGludXggZW5mb3JjaW5nIG1vZGU/CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICMgZ2V0ZW5mb3JjZSA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICBFbmZvcmNpbmcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWYgc28gY2FuIHlvdSBydW46IDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVz ZWFyY2ggLW0gQVZDIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBOT0xPRyBv cHRpb24gdG8gbG9nX2Zvcm1hdCBpcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVwcmVj YXRlZC4gUGxlYXNlIHVzZSB0aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgICAgICAg ICAgb3B0aW9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0 aW9uIGlzIG92ZXJyaWRpbmcgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB3cml0ZV9s b2dzIGN1cnJlbnQgc2V0dGluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0t LSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aW1lLSZndDtNb24gTWFyIDE0IDEw OjM5OjAxIDIwMTYgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgdHlwZT1TWVNDQUxM CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBtc2c9YXVkaXQoMTQ1Nzk3NzE0MS43Njc6MTc1 MzcpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgYXJjaD1jMDAwMDAzZSBzeXNjYWxsPTIg c3VjY2Vzcz1ubyBleGl0PS0xMwogICAgICAgICAgICAgICAgICAgICAgICAgICAgYTA9N2ZiY2Fi MDM4ZDEwIGExPTgwMCBhMj0xIGEzPTdmYmNhNjBmNDJlMAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgaXRlbXM9MCBwcGlkPTE0MDYgcGlkPTEyOTY1IGF1aWQ9NDI5NDk2NzI5NQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgdWlkPTAgZ2lkPTAgZXVpZD01ODE0MDAwMDEgc3VpZD0wCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBmc3VpZD01ODE0MDAwMDEgZWdpZD01ODE0MDAwMDEg c2dpZD0wCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBmc2dpZD01ODE0MDAwMDEgdHR5PShu b25lKSBzZXM9NDI5NDk2NzI5NQogICAgICAgICAgICAgICAgICAgICAgICAgICAgY29tbT0ic3No ZCIgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN1Ymo9 c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBrZXk9KG51bGwpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIHR5 cGU9QVZDIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBhdmM6wqAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGNvbW09InNzaGQiIG5hbWU9ImF1dGhvcml6ZWRfa2V5cyIKICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGRldj0iZG0tMiIgaW5vPTExNjM5MzUxNwogICAgICAg ICAgICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMw LXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0Y29udGV4dD1zeXN0ZW1f dTpvYmplY3Rfcjp1bmxhYmVsZWRfdDpzMAogICAgICAgICAgICAgICAgICAgICAgICAgICAgdGNs YXNzPWZpbGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+SSBzdXNwZWN0IHRoYXQgdGhlCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHN1YnN5c3RlbSBjZXJ0IHdhcyByZW5ld2VkIGFuZCBldmVyeXRoaW5nCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHdhc24ndCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHVwZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0aGlzIGlzCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHVucmVsYXRlZCB0byB0aGUgdXBncmFkZSBpdCBqdXN0IDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2hvbmUgYSBzcG90bGlnaHQgb24gaXQu IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBDYW4geW91IHJ1biB0aGVzZSBjb21tYW5kczogPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQg bGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgbWFuYWdlcicgLVcgLWIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1 aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgIFRoaXMgcmV0dXJucyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0 b3J5IG1hbmFnZXInCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAtVyAtYiB1aWQ9cGtpZGJ1 c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2Vy dGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50 ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgZG46IHVp ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1JSURj ekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwog ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgLi4uIHN0dWZmIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBaTm80ZVg3 ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9CgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246 IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5 LE89QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdWJzeXN0ZW0s Tz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+YW5kIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAjIGNlcnR1dGlsIC1MIC1kIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgLW4gJ3N1YnN5c3RlbUNlcnQgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgfCBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUwgLWQgL2V0Yy9wa2kvcGtpLXRvbWNh dC9hbGlhcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbiAnc3Vic3lzdGVtQ2VydCBj ZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGVzZSBib3RoIHJl dHVybiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMK ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNh JyB8IGdyZXAgU2VyaWFsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9yICJOU1MgQ2VydGlm aWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgU0VDX0VSUk9SX1VOUkVDT0dOSVpFRF9PSUQ6IFVucmVjb2duaXpl ZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQgL2V0Yy9w a2kvcGtpLXRvbWNhdC9hbGlhc8KgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbiAnc3Vi c3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgY2VydHV0aWw6IENoZWNraW5nIHRva2VuICJOU1MgQ2VydGlmaWNhdGUKICAgICAgICAgICAg ICAgICAgICAgICAgICAgIERCIiBpbiBzbG90ICJOU1MgVXNlciBQcml2YXRlIEtleSBhbmQKICAg ICAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9yICJOU1MgQ2Vy dGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCIjogPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgU0VDX0VSUk9SX1VOUkVDT0dOSVpFRF9PSUQ6IFVucmVjb2du aXplZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgeW91IG1h ZGUgYSB0eXBvIGFuZCByZXF1ZXN0ZWQgdGhlIGtleXMgKC1LKQogICAgICAgICAgICAgICAgICAg ICAgICAgIGluc3RlYWQgb2YgdGhlIGNlcnRzICgtTCkuIFBsZWFzZSByZXRyeSB3aXRoCiAgICAg ICAgICAgICAgICAgICAgICAgICAgLUwgYW5kIHlvdSBzaG91bGQgYmUgYWJsZSB0byBzZWUgdGhl CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydGlmaWNhdGUgc2VyaWFsLiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAg ICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAg ICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNhdGUK ICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAgTUlJRGN6 Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlF OFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9u OiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89 QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5S T0NLUyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgU28gdGhlIHNlcmlhbCBpcyA0PyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0 aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScg fCBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKg wqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MSAoMHg0ZmY5MDAwZCkKICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0 dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2Fs aWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNh JyAtYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUt LS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0lFVC9r QURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICBzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBBbmQgdGhpcyBjZXJ0IGlzIE5P VCB0aGUgc2FtZS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgd2hlbiBjZXJ0 bW9uZ2VyIHJlbmV3cyBhIGNlcnRpZmljYXRlLCBpdCBydW5zCiAgICAgICAgICAgICAgICAgICAg ICBwcmUtc2F2ZSBhbmQgcG9zdC1zYXZlIGNvbW1hbmRzICh3aGljaCB5b3UgY2FuIHNlZQogICAg ICAgICAgICAgICAgICAgICAgaW4gdGhlIG91dHB1dCBvZiBnZXRjZXJ0IGxpc3QpLiBJbiB5b3Vy IGNhc2UsIHRoZQogICAgICAgICAgICAgICAgICAgICAgcG9zdC1zYXZlIGNvbW1hbmQgZm9yIHN1 YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgICAgICAgICAgIHByb2JhYmx5IGZh aWxlZC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgVGhpcyBjb21tYW5kIChvbiB0aGUgcmVuZXdhbCBtYXN0ZXIpIGlzCiAgICAgICAgICAgICAg ICAgICAgICByZXNwb25zaWJsZSBmb3IgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0aGUgTlNT CiAgICAgICAgICAgICAgICAgICAgICBkYiB0byB0aGUgTERBUCBzZXJ2ZXIuIFlvdSBuZWVkIGZp cnN0IHRvIGNoZWNrCiAgICAgICAgICAgICAgICAgICAgICB3aGljaCBJUEEgc2VydmVyIGlzIHRo ZSByZW5ld2FsIG1hc3RlciAoYXMgdGhlCiAgICAgICAgICAgICAgICAgICAgICBzZXJpYWwgbnVt YmVycyBhcmUgaW4gYSBjb21wbGV0ZWx5IGRpZmZlcmVudAogICAgICAgICAgICAgICAgICAgICAg cmFuZ2UsIEkgYXNzdW1lIHRoYXQgeW91IGhhdmUgbXVsdGlwbGUgSVBBIHNlcnZlcnMKICAgICAg ICAgICAgICAgICAgICAgIGNvbmZpZ3VyZWQgd2l0aCBhIENBIGluc3RhbmNlKTogPGJyPgogICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgJCBleHBvcnQgQkFT RUROPWBncmVwIGJhc2VkbiAvZXRjL2lwYS9kZWZhdWx0LmNvbmYKICAgICAgICAgICAgICAgICAg ICAgIHwgY3V0IC1kPSAtZjItYCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAkIGtpbml0IGFk bWluIDxicj4KICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBo b3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICBHU1NBUEkgLWIgImNuPW1h c3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICAgICAgICAgJygmYW1w Oyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJwogICAgICAgICAgICAg ICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46CiAgICAgICAgICAgICAg ICAgICAgICBjbj1DQSxjbj12bS1pcGFzZXJ2ZXIuaXBhZG9tYWluLmNvbSxjbj1tYXN0ZXJzLGNu PWlwYSxjbj1ldGMsZGM9aXBhZG9tYWluLGRjPWNvbQoKICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIEluIHRo aXMgZXhhbXBsZSB0aGUgcmVuZXdhbCBtYXN0ZXIgaXMKICAgICAgICAgICAgICAgICAgICAgIHZt LWlwYXNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgSSBnZXQgdGhpcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1Z IEdTU0FQSQogICAgICAgICAgICAgICAgICAgIC1iICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMs JEJBU0VETiIKICAgICAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJp bmc9Y2FSZW5ld2FsTWFzdGVyKSknIGRuCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgIGRuOgogICAgICAgICAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2Vh LmJwdC5yb2Nrcyxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICBXaGljaCBpcyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuIDxicj4KICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg ICAgICAgICAgSGkgSWFuLCA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgaXQncyBnZXR0aW5nIGRpZmZpY3VsdCB0byBmb2xsb3cgdGhpcyB0aHJlYWQsIHNvIGNv dWxkCiAgICAgICAgICAgICAgICAgIHdlIHN0ZXAgYmFjayBhbmQgc3VtbWFyaXplPyA8YnI+CiAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICBZZXMsIGl0IGlzLsKg IFNvcnJ5LiA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJy PgogICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJlbmV3YWwgbWFz dGVyKSwgdGhlIENBCiAgICAgICAgICAgICAgICAgIGNvbXBvbmVudCBpcyBpbnN0YWxsZWQgYW5k ICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJwogICAgICAgICAgICAgICAgICBoYXMgU2VyaWFs IG51bWJlciA0IGluIHRoZSBOU1NEQgogICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9t Y2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg ICAgIE5vPyA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBbcm9vdEBm cmVlaXBhLXNlYSBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgIC9ldGMvcGtp L3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnCiAgICAgICAg ICAgICAgICB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKg wqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MSAoMHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+LSBPbiBzZXJ2ZXIgc2VhdHRsZW5mcyAod2hl cmUKICAgICAgICAgICAgICAgICAgUEtJIGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9u ZW50IGlzIGluc3RhbGxlZAogICAgICAgICAgICAgICAgICBhbmQgJ3N1YnN5c3RlbUNlcnQgY2Vy dC1wa2ktY2EnIGhhcyBTZXJpYWwgbnVtYmVyCiAgICAgICAgICAgICAgICAgIDEzNDE3MTg1NDEg aW4gdGhlIE5TU0RCIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMuIDxicj4KICAgICAgICAgICAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIFllcyA8YnI+CiAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAt TCAtZAogICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lz dGVtQ2VydCBjZXJ0LXBraS1jYScKICAgICAgICAgICAgICAgIHwgZ3JlcCBTZXJpYWwgPGJyPgog ICAgICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8 YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAtIEluIHRoZSBM REFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUgZW50cnkKICAgICAgICAgICAg ICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB3aXRoIFNlcmlhbCBudW1iZXIg NAogICAgICAgICAgICAgICAgICAoaS5lLiBpdCBpcyB0aGUgY2VydCBmcm9tIGZyZWVpcGEtc2Vh KS4gPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgVGhp cyBpcyB3aGVyZSB0aGUgZGlmZmVyZW5jZSBpcy7CoCBUaGVyZSBhcmUgdHdvCiAgICAgICAgICAg ICAgICBjZXJ0aWZpY2F0ZXMgb24gdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24gdGhlIG90aGVy LsKgIEkKICAgICAgICAgICAgICAgIHdvbmRlciBpZiB0aGlzIGlzIGEgcmVzdWx0IG9mIHRoZSBz bG93IG1vdGlvbgogICAgICAgICAgICAgICAgcmVwbGljYXRpb24gdHJhaW53cmVjayBJIGhhdmUg Z29pbmcgb24gZHVlIHRvIGEgem9tYmllCiAgICAgICAgICAgICAgICByZXBsaWNhIGluIHRoZSBs ZGFwIGRhdGFiYXNlIHRoYXQgbm8gbG9uZ2VyIGV4aXN0cyBpbgogICAgICAgICAgICAgICAgdGhl IHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qgc2VlbSB0byBnZXQgcmlkIG9mLiA8YnI+CiAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIEhp LCA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIHRoZSByZW1haW5pbmcgaXNz dWUgaXMgYSByZXBsaWNhdGlvbiBwcm9ibGVtLiBUaGVyZSBpcyBhCiAgICAgICAgICAgICAgIlRy b3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBbMV0gaW4gSWRNIEFkbWluCiAgICAg ICAgICAgICAgZ3VpZGUgdGhhdCBtYXkgaGVscCB5b3UuIDxicj4KICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1h bmRzIGRpZCB5b3UgdXNlCiAgICAgICAgICAgICAgdG8gdHJ5IHRvIHJlbW92ZSBpdCwgYW5kIHdo YXQgd2FzIHRoZSBvdXRwdXQ/IDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg RmxvIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgWzFdIDxhIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiCmhyZWY9Imh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9j dW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0Rv bWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2Vu LXJlcGxpY2F0aW9uLmh0bWwiCiAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi Pmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0Vu dGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlv bl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgog ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgIEhpLDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUbyBk ZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAgICAg ICAgICBzZXZlcmFsIGluZm8gYnV0IHN0YXJ0aW5nIHdpdGggdGhlIHJlc3VsdHMgb2YgdGhlIGZv bGxvd2luZwogICAgICAgICAgICBjb21tYW5kczxicj4KICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJl Y3RvcnkKICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl LG89aXBhY2EiCiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg LUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicgLVcgLWIgInVpZD1wa2lkYnVzZXIs b3U9cGVvcGxlLG89aXBhY2EiIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICAgIEVudGVyIExEQVAg UGFzc3dvcmQ6IDxicj4KICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlw YWNhPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBkbjogdWlkPXBraWRidXNlcixvdT1wZW9w bGUsbz1pcGFjYTxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaToKICAgICAgICAgIGVudHJ5dXNu O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDA1Ogog ICAgICAgICAgPGJyPgogICAgICAgICAgwqA3NTI3NDg5Nzxicj4KICAgICAgICAgIG5zY3BlbnRy eXdzaToKICAgICAgICAgIG1vZGlmeVRpbWVzdGFtcDthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAw NDt2dWNzbi01OTM4ZTY4ODAwMDEwNDI8YnI+CiAgICAgICAgICDCoDkwMDA0OiAyMDE3MDYwODA1 NTMzNFo8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgICBtb2RpZmllcnNOYW1l O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAzO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwPGJyPgog ICAgICAgICAgwqAwMDM6IGNuPURpcmVjdG9yeSBNYW5hZ2VyPGJyPgogICAgICAgICAgbnNjcGVu dHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxi cj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNlcjxicj4KICAgICAgICAgIG5z Y3BlbnRyeXdzaTogY3JlYXRlVGltZXN0YW1wOiAyMDE1MDcxNjEyNTE0Nlo8YnI+CiAgICAgICAg ICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAg ICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0Mjkw MDAxOgogICAgICAgICAgMjsxMzQxNzE4NTQxO0NOPUNlcnRpZmljPGJyPgogICAgICAgICAgwqBh dGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4K ICAgICAgICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQy OTAwMDI7ZGVsZXRlZDoKICAgICAgICAgIDI7NDtDTj1DZXJ0aWZpY2E8YnI+CiAgICAgICAgICDC oHRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+ CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgbnNjcGVudHJ5d3Np OiBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFz czogcGVyc29uPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogb3JnYW5p emF0aW9uYWxQZXJzb248YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBp bmV0T3JnUGVyc29uPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogY21z dXNlcjxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVt LE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJy PgogICAgICAgICAgbnNjcGVudHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgICAgIG5z Y3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICAgICAmbHQ7c25pcCZndDs8 YnI+CiAgICAgICAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4 bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRp ZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAgICAgICAgIE1JSURiakNDQWxh Z0F3SUJBZ0k8YnI+CiAgICAgICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgICDCoEFSPGJy PgogICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+ CiAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJzdGF0ZTogMTxicj4KICAgICAgICAgIG5zY3Bl bnRyeXdzaTogdXNlcnR5cGU6IGFnZW50VHlwZTxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTog cGFyZW50aWQ6IDI8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IGVudHJ5aWQ6IDUxPGJyPgog ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAx MDZAcmVkaGF0LmNvbSI+CiAgICAgICAgICAgIGFuZDxicj4KICAgICAgICAgICAgW3Jvb3RAc2Vh dHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAg ICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50 cnl3c2k8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+CiAgICAgICAg ICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9y eQogICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj YSBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAg ICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4KICAgICAgICAg IG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAg ICAgICAgICBuc2NwZW50cnl3c2k6IHNlZUFsc286IENOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NL Uzxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAg IE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAg ICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgICDCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pO VDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgIG5zY3Bl bnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgQXV0aG9y aXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnM8YnI+CiAgICAgICAgICDCoHlzdGVtLE89QlBULlJP Q0tTPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAgICAgICAg IG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6IDI8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG1v ZGlmeVRpbWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3Np OiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgIG5zY3BlbnRy eXdzaTogbW9kaWZpZXJzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgICAgICBu c2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAg ICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4KICAgICAg ICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3Np OiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxi cj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNlcjxicj4KICAgICAgICAgIG5z Y3BlbnRyeXdzaTogc246IHBraWRidXNlcjxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlk OiBwa2lkYnVzZXI8YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8 YnI+CiAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICAg ICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxicj4K ICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGluZXRPcmdQZXJzb248YnI+CiAg ICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1c2VyPGJyPgogICAgICAgICAg bnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOiA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRk ODA3NDxicj4KICAgICAgICAgIG5zY3BlbnRyeXdzaTogZW50cnl1c246IDg2PGJyPgogICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVk aGF0LmNvbSI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgRnJvbSB0aGUgb3V0cHV0IHlv dSBtYXkgb25seSBjb3B5L3Bhc3QgdGhlIG9uZXMgcmVsYXRlZCB0bwogICAgICAgICAgICB1c2Vy Q2VydGlmaWNhdGU8YnI+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICBBbHNvIHRvIGR1bXAgdGhlIGN1cnJlbnQgcmVwbGljYXRpb24gc3RhdHVzLCBzZW5kIHRo ZQogICAgICAgICAgICByZXN1bHTCoCBvZjxicj4KICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1z ZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgIG1h bmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250IHNpemU9Ii0xIj48aT4gPC9pPiIoJmFtcDsob2Jq ZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm ZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgIDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAg ICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJl Y3RvcnkKICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNs YXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZm ZmZmZmZmKSkiPGJyPgogICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAg ICAgZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8 YnI+CiAgICAgICAgICBjbjogcmVwbGljYTxicj4KICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+ CiAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAg ICAgICAgIGNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9jPGJyPgogICAgICAgICAg wqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICAgICAgbnNEUzVS ZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgICAgICBtYXN0ZXJBZ3Jl ZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvYzxicj4KICAgICAgICAgIMKga3MtcGtpLXRvbWNhdCxv dT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgIG5zRFM1UmVwbGljYUlkOiAxMDY1PGJy PgogICAgICAgICAgbnNEUzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3OTExZTYtOTNlNmVmNGIt NjlkY2MyZDE8YnI+CiAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAg ICAgICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgICAgICAgIG5zU3RhdGU6OgogICAgICAg ICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFB PT08YnI+CiAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24K ICAgICAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAg ICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwY2hl Y2tpbnRlcnZhbDogNjA8YnI+CiAgICAgICAgICBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAg ICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgIG9iamVjdENsYXNzOiBl eHRlbnNpYmxlb2JqZWN0PGJyPgogICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRp b259IDU3YzI5MWQ5MDAwMDA0MjkwMDAwPGJyPgogICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGlj YSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgY2xhc3M9Im1vei10 eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJw dC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAg ICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICAgICAgICDCoDAgNTk4YTFjNDAwMDAxMDQy OTAwMDA8YnI+CiAgICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIgogICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0Igog ICAgICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8v c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn08YnI+CiAgICAgICAgICBuc2RzNWFnbXRtYXhj c246CiAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9j a3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgICAgICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1 bmF2YWlsYWJsZTxicj4KICAgICAgICAgIG5zZHM1YWdtdG1heGNzbjoKICAgICAgICAgIG89aXBh Y2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8 YnI+CiAgICAgICAgICDCoHRsZW5mcy5icHQucm9ja3M7Mzg5O3VuYXZhaWxhYmxlPGJyPgogICAg ICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAg ICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIK ICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPjxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQu cm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT48L2E+fQogICAg ICAgICAgNTk4YTxicj4KICAgICAgICAgIMKgMWMxNjxicj4KICAgICAgICAgIG5zcnV2UmVwbGlj YUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICBtb3otZG8tbm90LXNl bmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgIGhyZWY9 ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmst ZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9z ZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgIDAwMDAwPGJyPgogICAg ICAgICAgwqAwMDA8YnI+CiAgICAgICAgICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogODg1PGJy PgogICAgICAgICAgbnNkczVyZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20i Pjxmb250CiAgICAgICAgICAgICAgc2l6ZT0iLTEiPiBhbmQ8YnI+CiAgICAgICAgICAgIDwvZm9u dD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAg J2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+ IDwvaT4iKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZm LWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAgICAgICA8L2ZvbnQ+PC9i bG9ja3F1b3RlPgogICAgICAgICAgPGJyPgogICAgICAgICAgPGJyPgogICAgICAgICAgW3Jvb3RA c2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAg ICAgIG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0 b25lKShuc1VuaXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJy PgogICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgZG46IGNuPXJl cGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAg ICBjbjogcmVwbGljYTxicj4KICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgICAgICBu c0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgICAgIGNsb25l QWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2NrPGJyPgogICAgICAgICAgwqBzLXBraS10b21j YXQsb3U9Y3N1c2Vycyxjbj1jb25maWc8YnI+CiAgICAgICAgICBuc0RTNVJlcGxpY2FJZDogMTI5 MDxicj4KICAgICAgICAgIG5zRFM1UmVwbGljYU5hbWU6IDg3MDZhYjFlLTZhODMxMWU2LWE5YmZk YmJmLTc0ZGM3MzIzPGJyPgogICAgICAgICAgbnNEUzVSZXBsaWNhUm9vdDogbz1pcGFjYTxicj4K ICAgICAgICAgIG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAgICAgICAgICBuc1N0YXRlOjoKICAg ICAgICAgIENnVUFBQUFBQUFBS0ZZcFpBQUFBQUFBQUFBQUFBQUFBS2dBQUFBQUFBQUFCQUFBQUFB QUFBQT09PGJyPgogICAgICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0 aW9uCiAgICAgICAgICBtYW5hZ2Vycyxjbj1zeXNhY2NvdW50cyxjbj1ldGMsZGM9YnB0LDxicj4K ICAgICAgICAgIMKgZGM9cm9ja3M8YnI+CiAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91 cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgICAgb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAg ICAgICAgIG9iamVjdENsYXNzOiBuc0RTNVJlcGxpY2E8YnI+CiAgICAgICAgICBvYmplY3RDbGFz czogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2FnZW5l cmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYwMDAwMDxicj4KICAgICAgICAgIG5zZHM1MHJ1djoge3Jl cGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgIGNsYXNzPSJt b3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZz LmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAg ICAgICAgNTdiZTgwNGMwMDAwMDUwYTAwMDA8YnI+CiAgICAgICAgICDCoCA1ODcyMzYxNTAwMDAw NTBhMDAwMDxicj4KICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTA2NSA8YSBtb3otZG8t bm90LXNlbmQ9InRydWUiCiAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQi CiAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFw Oi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICA1N2IxMDNkNDAwMDAw NDI5MDAwPGJyPgogICAgICAgICAgwqAwIDU3YmU4MDQzMDAwNzA0MjkwMDAwPGJyPgogICAgICAg ICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAgICAgbz1pcGFjYTtjbG9uZUFncmVlbWVudDEtc2Vh dHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdDtmcmVlaTxicj4KICAgICAgICAgIMKgcGEtc2Vh LmJwdC5yb2NrczszODk7MTA2NTs1ODcyMzYxNTAwMDAwNTBhMDAwMDxicj4KICAgICAgICAgIG5z cnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5MCA8YQogICAgICAgICAgICBtb3ot ZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAg ICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPjxhIGNsYXNzPSJtb3ot dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODki PmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgIDAwMDAw PGJyPgogICAgICAgICAgwqAwMDA8YnI+CiAgICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZp ZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIiBj bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJl ZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg aHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNl YS5icHQucm9ja3M6Mzg5PC9hPjwvYT59CiAgICAgICAgICAwMDAwPGJyPgogICAgICAgICAgwqAw MDAwPGJyPgogICAgICAgICAgbnNkczVSZXBsaWNhQ2hhbmdlQ291bnQ6IDM8YnI+CiAgICAgICAg ICBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICAgICAgPGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQKICAg ICAgICAgICAgICBzaXplPSItMSI+IDxicj4KICAgICAgICAgICAgICBSZWdhcmRzPGJyPgogICAg ICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICAgIDwvZm9udD4KICAgICAgICAgICAgPGJs b2NrcXVvdGUKICAgICAgICAgICAgICBjaXRlPSJtaWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAt NWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAg ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0j CiAgICAgICAgICAgICAgICBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2Vy JyAtVyAtYgogICAgICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1 c2VyQ2VydGlmaWNhdGUKICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAg ICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgIGRuOiB1aWQ9 cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAgIHVzZXJDZXJ0 aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtp Rzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgIMKgICZsdDt0cnVuY2F0ZWQmZ3Q7IDxicj4KICAgICAgICAgICAgICAgIMKgIFpO bzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAg ICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3 SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRSwogICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgJmx0O3RydW5jYXRlZCZndDsgZnVRUVptUDFYcktr cmZzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgIGRlc2NyaXB0aW9uOiAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWNhdGUKICAgICAgICAg ICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0gPGJyPgogICAgICAg ICAgICAgICAgwqAgLE89QlBULlJPQ0tTIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxk YXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgICAgICBtYW5hZ2VyJyAt VyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICB1c2Vy Q2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgRW50ZXIgTERBUCBQ YXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl LG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAg ICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VB WURWUVFLREFsQwogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgwqAgJmx0O3Ry dW5jYXRlZCZndDsgPGJyPgogICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1 TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICBkZXNjcmlwdGlv bjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9D S1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPIDxicj4KICAgICAgICAgICAgICAgIMKgIENLUyA8 YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlIGNlcnRpZmljYXRlcwogICAgICAgICAgICAgICAgICBk YXRlcywgSSBndWVzcyB0aGF0IHRoZSBtb3N0IHJlY2VudCBvbmUgaXMgb24gc2VydmVyCiAgICAg ICAgICAgICAgICAgIHNlYXR0bGVuZnMgKGJlY2F1c2Ugb2Ygc2VyaWFsIG51bWJlcnMpLiBDYW4g eW91CiAgICAgICAgICAgICAgICAgIGNvbmZpcm0gdGhpcyAoYmVjYXVzZSBvdXIgZ29hbCBpcyB0 byBoYXZlIHRoZSBtb3N0CiAgICAgICAgICAgICAgICAgIHJlY2VudCBjZXJ0IHN0b3JlZCBpbiBh bGwgdGhlIE5TU0RCcyBhbmQgaW4gTERBUCk/IDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICBUaGFua3MsIDxicj4KICAgICAgICAgICAgICAgICAgRmxvIDxicj4K ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPklmIHlvdXIgcmVuZXdhbCBtYXN0ZXIgaXMKICAgICAgICAgICAg ICAgICAgICAgIHRoZSBtYWNoaW5lIG9uIHdoaWNoIHRoZSBOU1MgREIKICAgICAgICAgICAgICAg ICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgY29udGFpbnMgdGhlIG5ld2VyIGNlcnQs CiAgICAgICAgICAgICAgICAgICAgICB0aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZSBzY3Jp cHRzOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBJZiBJJ20gaW50ZXJwcmV0aW5nIHRoaXMg Y29ycmVjdGx5LCB0aGVuIGl0IGlzLi4uIHNvCiAgICAgICAgICAgICAgICAgICAgSSByYW4gdGhp cyBvbiB0aGUgYnJva2VuIG1hY2hpbmUgKHNlYXR0bGVuZnMpIDxicj4KICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBz dWRvCiAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3Rv cF9wa2ljYWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgJCBzdWRvIC91c3IvbGliZXhlYy9p cGEvY2VydG1vbmdlci9yZW5ld19jYV9jZXJ0CiAgICAgICAgICAgICAgICAgICAgICAic3Vic3lz dGVtQ2VydCBjZXJ0LXBraS1jYSIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgSSByYW4gdGhpcywgaXQgdG9vayBhIHdoaWxlLCB0aGVuIEkgcmUt Y2hlY2tlZCBhbmQKICAgICAgICAgICAgICAgICAgICB0aGUgc2VyaWFsIHN0aWxsIHNlZW1zIHRv IGJlIDQgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAk IGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAg ICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB1c2VyQ2VydGlmaWNh dGUKICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgIGRuOiB1aWQ9 cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIDxicj4KICAgICAgICAgICAgICAgICAgICB1c2Vy Q2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRB TkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgIMKg IFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAg ICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAg ICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJP Q0tTIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSGVy ZSdzIHdoYXQgd2FzIGluIC92YXIvbG9nL3BraS9wa2ktdG9tY2F0L2NhL2RlYnVnCiAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg ICAgICAgICAgICAgICAgPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0gPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICA9PT09PcKgIERFQlVHIFNVQlNZ U1RFTSBJTklUSUFMSVpFRMKgwqAgPT09PT09PSA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09IDxicj4K ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9T aHV0ZG93bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdp bmU6IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAgICAgICAgL3Zh ci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1bWIgPGJyPgogICAgICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQg Zm9yIGF1dG8tc2h1dGRvd24KICAgICAgICAgICAgICAgICAgICBzdXBwb3J0OmF1ZGl0U2lnbmlu Z0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNF bmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAg ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0IGlkPWRlYnVnIDxi cj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0aWFsaXplZCBk ZWJ1ZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdFN1 YnN5c3RlbSBpZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdp bmU6IHJlYWR5IHRvIGluaXQgaWQ9bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg ICAgQ3JlYXRpbmcKICAgICAgICAgICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9w a2kvcGtpLXRvbWNhdC9sb2dzL2NhL3NpZ25lZEF1ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcKICAgICAg ICAgICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dz L2NhL3N5c3RlbSkKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg ICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zh ci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS90cmFuc2FjdGlvbnMpCiAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlc3Rh cnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg ICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAg ICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0ZG93bi5jcnVtYiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQgdG8gbG9v ayBmb3IgY2VydCBmb3IgYXV0by1zaHV0ZG93bgogICAgICAgICAgICAgICAgICAgIHN1cHBvcnQ6 YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgIENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNh IDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQg aWQ9bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0 aWFsaXplZCBsb2cgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6 IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg Q01TRW5naW5lOiByZWFkeSB0byBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg ICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4K ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1 bWIgZmlsZSBwYXRoPwogICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0 L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg ICAgQ01TRW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvciBhdXRvLXNodXRkb3duCiAg ICAgICAgICAgICAgICAgICAgc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxi cj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1 ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg ICAgICBDTVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgICAgICAg IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg ICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGpzcyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAg ICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdFN1YnN5c3RlbSBpZD1kYnMgPGJyPgogICAg ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9ZGJz IDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgREJTdWJzeXN0ZW06IGluaXQoKSBt RW5hYmxlU2VyaWFsTWdtdD10cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg Q3JlYXRpbmcgTGRhcEJvdW5kQ29ubkZhY3RvcihEQlN1YnN5c3RlbSkgPGJyPgogICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgICAgIExkYXBCb3VuZENvbm5GYWN0b3J5OmRvQ2xvbmluZyB0 cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2Fs aG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBpbml0 KCkgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBMZGFwQXV0aEluZm86IGluaXQg YmVnaW5zIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgTGRhcEF1dGhJbmZvOiBp bml0IGVuZHMgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b bG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogaW5pdDoKICAgICAgICAgICAgICAgICAgICBiZWZvcmUg bWFrZUNvbm5lY3Rpb24gZXJyb3JJZkRvd24gaXMgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg ICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVlIDxicj4KICAgICAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06IFRDUAogICAgICAgICAgICAgICAgICAgIEtlZXAtQWxpdmU6IHRydWUgPGJyPgogICAgICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBT ZXR0aW5nIGRlc2lyZWQKICAgICAgICAgICAgICAgICAgICBjZXJ0IG5pY2tuYW1lIHRvOiBzdWJz eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg TGRhcEpzc1NTTFNvY2tldDogc2V0IGNsaWVudCBhdXRoIGNlcnQgbmlja25hbWUKICAgICAgICAg ICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg ICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNhdFNlbGVjdGlvbkNCOiBFbnRlcmluZyEg PGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogb2NzcFNp Z25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg Q2FuZGlkYXRlIGNlcnQ6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBkZXNp cmVkIGNlcnQgZm91bmQKICAgICAgICAgICAgICAgICAgICBpbiBsaXN0OiBzdWJzeXN0ZW1DZXJ0 IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6 NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgU1NMQ2xpZW50 Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogcmV0dXJuaW5nOgogICAgICAgICAgICAgICAgICAgIHN1 YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogU1NMCiAgICAgICAgICAgICAg ICAgICAgaGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg ICAgQ01TRW5naW5lLnNodXRkb3duKCkgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgSSByZWFsbHkgYXBwcmVj aWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoCiAgICAgICAgICAgICAgICAgICAgdGhp cy7CoCBJIG93ZSB5b3UuIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgLSBJYW4gPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5BZnRlciB0aGF0LCBjaGVjayB0aGF0IHRo ZQogICAgICAgICAgICAgICAgICAgICAgTERBUCBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBp dCBpcyB0aGUgY2FzZSwKICAgICAgICAgICAgICAgICAgICAgIHlvdSBzaG91bGQgYmUgYWJsZSB0 byByZXN0YXJ0IHBraS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoYW5rIHlvdSBhZ2FpbiBmb3Ig eW91cgogICAgICAgICAgICAgICAgICAgICAgICB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSWFuIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIj5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hpY2ggc2VlbXMg d2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPlRoZSBkZXNjcmlwdGlvbgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdHRyaWJ1dGUgaW4gdGhlIGxkYXBzZWFyY2gg b3V0cHV0IGlzIG9mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBmb3JtIDI7IztE TjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRoZSBzZXJpYWwgbnVtYmVyIGlu CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBmaXJzdCBjZXJ0dXRpbCBvdXRwdXQg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5ECiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGhlYWRlcnMpIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGF0dHJpYnV0 ZXMuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICAgICAgICBGcmVl SVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgICAgICAgICBjbGFzcz0ibW96 LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJl ZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICAgICAgICBtb3ot ZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhy ZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEt dXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48L2E+CiAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICBUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhCiAgICAg ICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAg ICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3Rl ZC5vcmciCiAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9 Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVh dmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRv cmFob3N0ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18gPGJyPgogICAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGlu ZyBsaXN0IC0tIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlh dGVkIgogICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVk b3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEg Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNl cnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0 ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgVG8gdW5zdWJz Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQt bGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVz ZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICBtb3otZG8t bm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9 Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVp cGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48L2E+CiAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAg IDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAg ICAgICA8YnI+CiAgICAgICAgICA8cHJlIHdyYXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEg Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNl cnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBh LXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4g ZW1haWwgdG8gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRv OmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1z ZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ CjwvcHJlPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8YnI+CiAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0 dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPHByZSB3cmFwPSIi Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZyZWVJUEEt dXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVp cGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJzY3JpYmUgc2VuZCBh biBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWls dG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5mcmVlaXBhLXVz ZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgPC9ibG9ja3F1 b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============0674695975783376051==-- From ianh at brownpapertickets.com Thu Aug 10 18:37:51 2017 Content-Type: multipart/mixed; boundary="===============5746937532678446188==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Thu, 10 Aug 2017 11:37:15 -0700 Message-ID: <7fc23432-e339-9b75-b9a6-ae4628f784e2@brownpapertickets.com> In-Reply-To: 598C2B4F.2000202@redhat.com --===============5746937532678446188== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/10/17 2:45 AM, thierry bordaz wrote: > > > On 08/09/2017 09:30 PM, Ian Harding via FreeIPA-users wrote: >> >> On 8/9/17 3:05 AM, thierry bordaz wrote: >> >>> Hi Ian, >>> >>> Thanks for having gather those data. >>> >>> # >>> # So pkidbuser entries have a same (old) userCertificate likely >>> generated during install >>> # But only freeipa-sea has a new one created on freeipa-sea >>> around Jun 8th 2017 05:54:16 >>> # This recent certificate is identified by 5938e688000104290000 >>> # >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory >>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> ... >>> nscpentrywsi: userCertificate:: >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: >>> MIIDbjCCAlagAwIBAgI >>> >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory >>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>> nscpentrywsi: userCertificate:: >>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>> >>> >>> >>> # >>> # why 5938e688000104290000 value was not propagated to seattlenfs ? >>> # The most recent update (from freeipa-sea) that was replicated >>> to seattlenfs >>> # is 1 year old (57be8043000704290000 - Aug 25th 2016 05:21:07). >>> # In addition seattlenfs received direct update (last one was in >>> Jan 1017) that were not >>> # replicated to freeipa-sea >>> # >>> # The two servers have diverged because they can not replicate >>> to eachother because >>> # they were not correctly initialize. >>> # They have different "replicageneration" (57c291d9000004290000 >>> vs 55c8f3ae000000600000) >>> # >>> # It is looking like freeipa-sea was created one or two years >>> ago and used to initialized seattlenfs. >>> # But later freeipa-sea was recreated. >>> >> That's about right. >>> >>> # >>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory >>> manager' -W -b "o=3Dipaca" >>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffff= fff-ffffffff))" >>> Enter LDAP Password: >>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>> nsds50ruv: {replicageneration} 57c291d9000004290000 >>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} >>> 57f840bf000004290000 598a1c40000104290000 >>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >>> nsruvReplicaLastModified: {replica 1065 >>> ldap://freeipa-sea.bpt.rocks:389} 598a1c16 >>> nsruvReplicaLastModified: {replica 1290 >>> ldap://seattlenfs.bpt.rocks:389} 00000000 >>> >>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory >>> manager' -W -b "o=3Dipaca" >>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffff= fff-ffffffff))" >>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} >>> 57b103d4000004290000 57be8043000704290000 >>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >>> 57be804c0000050a0000 587236150000050a0000 >>> nsruvReplicaLastModified: {replica 1290 >>> ldap://seattlenfs.bpt.rocks:389} 00000000 >>> nsruvReplicaLastModified: {replica 1065 >>> ldap://freeipa-sea.bpt.rocks:389} 00000000 >>> >>> >>> >>> In conclusion: >>> From replication pov, the two instances can not communicate. >>> One solution would be to identify which instance is the good = >>> one, you want to keep. >>> and reinit the second one from that reference. >>> >> What exactly does reinit mean? I have run >> >> ipa-replica-manage re-initialize --from freeipa-sea.bpt.rocks > > This triggers the reinit of 'dc=3Dipadomain,dc=3Dcom' suffix but not for = > o=3Dipaca suffix. To reinit o=3Dipaca you may use > ipa-cs-replica-manager re-initialize --from freeipa-sea.bpt.rocks. > Note that it will overwrite all data of ipaca on seattlenfs with the = > data from freeipa-sea. This is why it is important to know which = > server is the valid one. Hmm.. This looks odd. [root(a)seattlenfs ianh]# ipa-csreplica-manage re-initialize --from = freeipa-sea.bpt.rocks Directory Manager password: ipa: ERROR: Found multiple agreements for seattlenfs.bpt.rocks. Only = initializing the first one returned: = cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\= =3Dipaca,cn=3Dmapping = tree,cn=3Dconfig Update in progress, 15 seconds elapsed [freeipa-sea.bpt.rocks] reports: Update failed! Status: [32 - LDAP = error: No such object] > On freeipa-sea and seattlenfs you may check the ipaca replica = > agreements status before/after reinit. I would guess they are = > currently reporting failures between these two replicas. > > ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = > "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = > "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus Enter LDAP Password: dn: = cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3= Dipac a,cn=3Dmapping tree,cn=3Dconfig nsds5replicaLastUpdateStatus: Error (32) Problem connecting to replica - = LDAP error: No such object (connection error) dn: = cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3= Dipac a,cn=3Dmapping tree,cn=3Dconfig nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = replica: Replica has different database generation ID, remote replica may need = to be i nitialized (RUV error) and [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus Enter LDAP Password: dn: = cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3D= ipaca ,cn=3Dmapping tree,cn=3Dconfig nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = replica: Replica has different database generation ID, remote replica may need = to be i nitialized (RUV error) >> >> several times over the years when replication has stopped. >> >> Replication actually is working, as far as user and machine accounts = >> and attributes are concerned anyway, and has been for a while. >> >> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid = >> of... it shows up in the GUI on the Topology page but generates a = >> Server not found error. I don't know if that's related. > > Zombie servers have been discussed a lot on this mailing list. You may = > get rid of them with list-ruv/clean-ruv subcommand. Replication = > usually manage to work fine even if some zombie entries exist but it = > is a good practice to clean them. Yeah, I've been through every possible combination of = list-ruv/clean-ruv. I have something odd going on in that no = replication agreements show up anywhere for freeipa-dal. > > regards > thierry >>> >>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote: >>>> >>>> On 8/7/17 1:44 AM, thierry bordaz wrote: >>>> >>>>> >>>>> >>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users wrote: >>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>>>>>> >>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>>>>>> Ian Harding wrote: >>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via FreeIPA-users = >>>>>>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that = >>>>>>>>>>>>>>>>>>>>> had apparently had >>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl = >>>>>>>>>>>>>>>>>>>>> says pki-tomcatd >>>>>>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat = >>>>>>>>>>>>>>>>>>>> can run without >>>>>>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see = >>>>>>>>>>>>>>>>>>>> what is going on. >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication = >>>>>>>>>>>>>>>>>>> failed (49) >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server = >>>>>>>>>>>>>>>>>> and needs to >>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check how = >>>>>>>>>>>>>>>>>> this >>>>>>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a ssl >>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a bind = >>>>>>>>>>>>>>>>>> DN and >>>>>>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> I found this: >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople,= o=3Dipaca = >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>>>>>> ... >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a = >>>>>>>>>>>>>>>>> prompt to provide >>>>>>>>>>>>>>>>> a pin/password >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for = >>>>>>>>>>>>>>>>> security token 'ldap(0)': >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>>>>>>> password can be >>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf = >>>>>>>>>>>>>>>> (with the tag >>>>>>>>>>>>>>>> internal=3D...) >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Can you check if the password with the tag internal=3D... = >>>>>>>>>>>>>>>> allows to read >>>>>>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>> (provide password) >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> That works... >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot = >>>>>>>>>>>>>>> "NSS User Private >>>>>>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>>>>>>>>>>> caSigningCert >>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f = >>>>>>>>>>>>>>> Server-Cert >>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> But this doesn't (with the same password from = >>>>>>>>>>>>>>> password.conf) >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> That password is getting me somewhere though, since if I = >>>>>>>>>>>>>>> put in a >>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and = >>>>>>>>>>>>>>> over. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>>>>>> >>>>>>>>>>>>> There wasn't much of a change... I just assumed someone = >>>>>>>>>>>>> ran yum upgrade and didn't restart, then the power = >>>>>>>>>>>>> outage... it looks like not much of a version change though. >>>>>>>>>>>>> >>>>>>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:46:06 Updated: libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>> Jan 08 04:46:08 Installed: = >>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>>>>>> Jul 28 09:55:41 Updated: = >>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:46 Updated: = >>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>> >>>>>>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>>>>>> Jan 08 04:47:19 Installed: = >>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>>>>>> >>>>>>>>>>>>> # getenforce >>>>>>>>>>>>> Enforcing >>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> If so can you run: >>>>>>>>>>>>>> >>>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use = >>>>>>>>>>>>> the write_logs option. >>>>>>>>>>>>> The NOLOG option is overriding the write_logs current = >>>>>>>>>>>>> setting. >>>>>>>>>>>>> ---- >>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): = >>>>>>>>>>>>> arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-13 = >>>>>>>>>>>>> a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0 items=3D0 = >>>>>>>>>>>>> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 = >>>>>>>>>>>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 = >>>>>>>>>>>>> sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D4294967295 = >>>>>>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { = >>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys" = >>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 = >>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and = >>>>>>>>>>>>>> everything wasn't >>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>>>>>> upgrade it just >>>>>>>>>>>>>> shone a spotlight on it. >>>>>>>>>>>>>> >>>>>>>>>>>>>> Can you run these commands: >>>>>>>>>>>>>> >>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descri= ption >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> This returns >>>>>>>>>>>>> >>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descrip= tion >>>>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>>>> userCertificate:: = >>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>>>> ... stuff ... >>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>>>> description: 2;4;CN=3DCertificate = >>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>>>>>>>>> >>>>>>>>>>>>>> and >>>>>>>>>>>>>> >>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert >>>>>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> These both return >>>>>>>>>>>>> >>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial >>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>> certutil: problem listing keys: = >>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot "NSS = >>>>>>>>>>>>> User Private Key and Certificate Services" >>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>> certutil: problem listing keys: = >>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. >>>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> you made a typo and requested the keys (-K) instead of the = >>>>>>>>>>>> certs (-L). Please retry with -L and you should be able to = >>>>>>>>>>>> see the certificate serial. >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca = >>>>>>>>>>> userCertificate description >>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>> userCertificate:: = >>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>> ... >>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D= CA = >>>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>>> >>>>>>>>>>> So the serial is 4? >>>>>>>>>>> >>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>>>> grep Serial >>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>>>> >>>>>>>>>>> Which is NOT 4... >>>>>>>>>>> >>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a >>>>>>>>>>> -----BEGIN CERTIFICATE----- >>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAl= C = >>>>>>>>>>> >>>>>>>>>>> ... >>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>>>>> -----END CERTIFICATE----- >>>>>>>>>>> >>>>>>>>>>> And this cert is NOT the same. >>>>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>>>>>> post-save commands (which you can see in the output of = >>>>>>>>>> getcert list). In your case, the post-save command for = >>>>>>>>>> subsystemCert cert-pki-ca probably failed. >>>>>>>>>> >>>>>>>>>> This command (on the renewal master) is responsible for = >>>>>>>>>> copying the new cert from the NSS db to the LDAP server. You = >>>>>>>>>> need first to check which IPA server is the renewal master = >>>>>>>>>> (as the serial numbers are in a completely different range, I = >>>>>>>>>> assume that you have multiple IPA servers configured with a = >>>>>>>>>> CA instance): >>>>>>>>>> >>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d=3D = >>>>>>>>>> -f2-` >>>>>>>>>> $ kinit admin >>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>>> dn: = >>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,cn= =3Detc,dc=3Dipadomain,dc=3Dcom = >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> In this example the renewal master is vm-ipaserver. >>>>>>>>>> >>>>>>>>> >>>>>>>>> I get this >>>>>>>>> >>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>> dn: = >>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Detc= ,dc=3Dbpt,dc=3Drocks = >>>>>>>>> >>>>>>>>> >>>>>>>>> Which is the other FreeIPA server. >>>>>>>>> >>>>>>>> Hi Ian, >>>>>>>> >>>>>>>> it's getting difficult to follow this thread, so could we step = >>>>>>>> back and summarize? >>>>>>> Yes, it is. Sorry. >>>>>>>> >>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 = >>>>>>>> in the NSSDB /etc/pki/pki-tomcat/alias >>>>>>> No? >>>>>>> >>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d = >>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep = >>>>>>> Serial >>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has = >>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>>>>>> Yes >>>>>>> >>>>>>> [root(a)seattlenfs ianh]# certutil -L -d /etc/pki/pki-tomcat/alias = >>>>>>> -n 'subsystemCert cert-pki-ca' | grep Serial >>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>> >>>>>>>> >>>>>>>> - In the LDAP servers, the cert is stored in the entry = >>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. i= t = >>>>>>>> is the cert from freeipa-sea). >>>>>>> This is where the difference is. There are two certificates on = >>>>>>> the master and only one on the other. I wonder if this is a = >>>>>>> result of the slow motion replication trainwreck I have going on = >>>>>>> due to a zombie replica in the ldap database that no longer = >>>>>>> exists in the real world and I can't seem to get rid of. >>>>>>> >>>>>> Hi, >>>>>> >>>>>> the remaining issue is a replication problem. There is a = >>>>>> "Troubleshooting replication" section [1] in IdM Admin guide that = >>>>>> may help you. >>>>>> >>>>>> Regarding your zombie replica, which commands did you use to try = >>>>>> to remove it, and what was the output? >>>>>> >>>>>> Flo >>>>>> >>>>>> [1] = >>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Lin= ux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-gen= -replication.html >>>>>> >>>>> >>>>> Hi, >>>>> >>>>> To debug replication latency or problem we would need several info = >>>>> but starting with the results of the following commands >>>>> >>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> nscpentrywsi: = >>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: >>>> 75274897 >>>> nscpentrywsi: = >>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 >>>> 90004: 20170608055334Z >>>> nscpentrywsi: = >>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 >>>> 003: cn=3DDirectory Manager >>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>>> nscpentrywsi: cn: pkidbuser >>>> nscpentrywsi: createTimestamp: 20150716125146Z >>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>>> nscpentrywsi: description;vucsn-5938e688000104290001: = >>>> 2;1341718541;CN=3DCertific >>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = >>>> 2;4;CN=3DCertifica >>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>> nscpentrywsi: mail: >>>> nscpentrywsi: objectClass: top >>>> nscpentrywsi: objectClass: person >>>> nscpentrywsi: objectClass: organizationalPerson >>>> nscpentrywsi: objectClass: inetOrgPerson >>>> nscpentrywsi: objectClass: cmsuser >>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>>> nscpentrywsi: sn: pkidbuser >>>> nscpentrywsi: uid: pkidbuser >>>> nscpentrywsi: userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>>> >>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = >>>> MIIDbjCCAlagAwIBAgI >>>> >>>> AR >>>> nscpentrywsi: userPassword:: >>>> nscpentrywsi: userstate: 1 >>>> nscpentrywsi: usertype: agentType >>>> nscpentrywsi: parentid: 2 >>>> nscpentrywsi: entryid: 51 >>>>> and >>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>>> >>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>>> Enter LDAP Password: >>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>>> nscpentrywsi: userCertificate:: = >>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>>> >>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>> nscpentrywsi: description: 2;4;CN=3DCertificate = >>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs >>>> ystem,O=3DBPT.ROCKS >>>> nscpentrywsi: entryid: 51 >>>> nscpentrywsi: parentid: 2 >>>> nscpentrywsi: modifyTimestamp: 20150716125146Z >>>> nscpentrywsi: createTimestamp: 20150716125146Z >>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager >>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>>> nscpentrywsi: userPassword:: >>>> nscpentrywsi: userstate: 1 >>>> nscpentrywsi: usertype: agentType >>>> nscpentrywsi: mail: >>>> nscpentrywsi: cn: pkidbuser >>>> nscpentrywsi: sn: pkidbuser >>>> nscpentrywsi: uid: pkidbuser >>>> nscpentrywsi: objectClass: top >>>> nscpentrywsi: objectClass: person >>>> nscpentrywsi: objectClass: organizationalPerson >>>> nscpentrywsi: objectClass: inetOrgPerson >>>> nscpentrywsi: objectClass: cmsuser >>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>>> nscpentrywsi: entryusn: 86 >>>>> >>>>> From the output you may only copy/past the ones related to = >>>>> userCertificate >>>>> >>>>> >>>>> Also to dump the current replication status, send the result of >>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>> -W -b = >>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fff= fffff-ffffffff-ffffffff))" >>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b "o=3Dipaca" = >>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff= -ffffffff))" >>>> Enter LDAP Password: >>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>>> cn: replica >>>> nsDS5Flags: 1 >>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>> cloneAgreement1-freeipa-sea.bpt.roc >>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>> masterAgreement1-seattlenfs.bpt.roc >>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>> nsDS5ReplicaId: 1065 >>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 >>>> nsDS5ReplicaRoot: o=3Dipaca >>>> nsDS5ReplicaType: 3 >>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D >>>> nsds5replicabinddngroup: cn=3Dreplication = >>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>>> dc=3Drocks >>>> nsds5replicabinddngroupcheckinterval: 60 >>>> objectClass: top >>>> objectClass: nsDS5Replica >>>> objectClass: extensibleobject >>>> nsds50ruv: {replicageneration} 57c291d9000004290000 >>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>>> 57f840bf00000429000 >>>> 0 598a1c40000104290000 >>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >>>> nsds5agmtmaxcsn: = >>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat >>>> tlenfs.bpt.rocks;389;unavailable >>>> nsds5agmtmaxcsn: = >>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat >>>> tlenfs.bpt.rocks;389;unavailable >>>> nsruvReplicaLastModified: {replica 1065 = >>>> ldap://freeipa-sea.bpt.rocks:389} 598a >>>> 1c16 >>>> nsruvReplicaLastModified: {replica 1290 = >>>> ldap://seattlenfs.bpt.rocks:389} 00000 >>>> 000 >>>> nsds5ReplicaChangeCount: 885 >>>> nsds5replicareapactive: 0 >>>>> and >>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>>> -W -b = >>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-fff= fffff-ffffffff-ffffffff))" >>>> >>>> >>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>> -W -b "o=3Dipaca" = >>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffffff= -ffffffff))" >>>> Enter LDAP Password: >>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>>> cn: replica >>>> nsDS5Flags: 1 >>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>> cloneAgreement1-seattlenfs.bpt.rock >>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>> nsDS5ReplicaId: 1290 >>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 >>>> nsDS5ReplicaRoot: o=3Dipaca >>>> nsDS5ReplicaType: 3 >>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D=3D >>>> nsds5replicabinddngroup: cn=3Dreplication = >>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>>> dc=3Drocks >>>> nsds5replicabinddngroupcheckinterval: 60 >>>> objectClass: top >>>> objectClass: nsDS5Replica >>>> objectClass: extensibleobject >>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = >>>> 57be804c0000050a0000 >>>> 587236150000050a0000 >>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>>> 57b103d400000429000 >>>> 0 57be8043000704290000 >>>> nsds5agmtmaxcsn: = >>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei >>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000 >>>> nsruvReplicaLastModified: {replica 1290 = >>>> ldap://seattlenfs.bpt.rocks:389} 00000 >>>> 000 >>>> nsruvReplicaLastModified: {replica 1065 = >>>> ldap://freeipa-sea.bpt.rocks:389} 0000 >>>> 0000 >>>> nsds5ReplicaChangeCount: 3 >>>> nsds5replicareapactive: 0 >>>>> >>>>> Regards >>>>> thierry >>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificat= e = >>>>>>> description >>>>>>> Enter LDAP Password: >>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>> userCertificate:: = >>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>> >>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>> userCertificate:: = >>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>>>>>> description: 2;1341718541;CN=3DCertificate = >>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem >>>>>>> ,O=3DBPT.ROCKS >>>>>>> >>>>>>> >>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificat= e = >>>>>>> description >>>>>>> Enter LDAP Password: >>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>> userCertificate:: = >>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>> >>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>> Subsystem,O=3DBPT.RO >>>>>>> CKS >>>>>>> >>>>>>>> If you check the certificates dates, I guess that the most = >>>>>>>> recent one is on server seattlenfs (because of serial numbers). = >>>>>>>> Can you confirm this (because our goal is to have the most = >>>>>>>> recent cert stored in all the NSSDBs and in LDAP)? >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Flo >>>>>>>> >>>>>>>> >>>>>>>>>> If your renewal master is the machine on which the NSS DB = >>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you = >>>>>>>>>> can manually run the scripts: >>>>>>>>> >>>>>>>>> If I'm interpreting this correctly, then it is... so I ran = >>>>>>>>> this on the broken machine (seattlenfs) >>>>>>>>> >>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert = >>>>>>>>>> "subsystemCert cert-pki-ca" >>>>>>>>>> >>>>>>>>> >>>>>>>>> I ran this, it took a while, then I re-checked and the serial = >>>>>>>>> still seems to be 4 >>>>>>>>> >>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>>> Enter LDAP Password: >>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>> userCertificate:: = >>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>> ... >>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>> >>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>>>>>> >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D D= EBUG = >>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> restart at autoShutdown? false >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> autoShutdown crumb file path? = >>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>>>> init id=3Ddebug >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> initialized debug >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> initSubsystem id=3Dlog >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> ready to init id=3Dlog >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_aud= it) = >>>>>>>>> >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> restart at autoShutdown? false >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> autoShutdown crumb file path? = >>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>>>> init id=3Dlog >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> initialized log >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> initSubsystem id=3Djss >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> ready to init id=3Djss >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> restart at autoShutdown? false >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> autoShutdown crumb file path? = >>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: done = >>>>>>>>> init id=3Djss >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> initialized jss >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> initSubsystem id=3Ddbs >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>> ready to init id=3Ddbs >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: = >>>>>>>>> init() mEnableSerialMgmt=3Dtrue >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>> LdapBoundConnFactor(DBSubsystem) >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> LdapBoundConnFactory: init >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> LdapBoundConnFactory:doCloning true >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>> init() >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>> init begins >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>> init ends >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>>>>>> makeConnection errorIfDown is true >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: makeConnection: = >>>>>>>>> errorIfDown true >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP Keep-Alive: = >>>>>>>>> true >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert nickname = >>>>>>>>> to: subsystemCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> LdapJssSSLSocket: set client auth cert nickname subsystemCert = >>>>>>>>> cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> SSLClientCertificatSelectionCB: Entering! >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>>>>> ocspSigningCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate cert: = >>>>>>>>> subsystemCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>>>>>> subsystemCert cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert = >>>>>>>>> cert-pki-ca >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake = >>>>>>>>> happened >>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>> CMSEngine.shutdown() >>>>>>>>> >>>>>>>>> >>>>>>>>> I really appreciate you sticking with me through this. I owe = >>>>>>>>> you. >>>>>>>>> >>>>>>>>> - Ian >>>>>>>>> >>>>>>>>>> After that, check that the LDAP entry has been updated. If it = >>>>>>>>>> is the case, you should be able to restart pki. >>>>>>>>>> >>>>>>>>>> Flo >>>>>>>>>> >>>>>>>>>>> Thank you again for your time! >>>>>>>>>>> >>>>>>>>>>> Ian >>>>>>>>>>> >>>>>>>>>>>> Flo. >>>>>>>>>>>>> >>>>>>>>>>>>> which seems weird. >>>>>>>>>>>>> >>>>>>>>>>>>>> The description attribute in the ldapsearch output is of = >>>>>>>>>>>>>> the form 2;#;DN;DN >>>>>>>>>>>>>> >>>>>>>>>>>>>> The # should match the serial number in the first = >>>>>>>>>>>>>> certutil output >>>>>>>>>>>>>> >>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should match = >>>>>>>>>>>>>> one of the >>>>>>>>>>>>>> userCertificate attributes. >>>>>>>>>>>>>> >>>>>>>>>>>>>> rob >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> _______________________________________________ >>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>>>> To unsubscribe send an email to = >>>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>>> _______________________________________________ >>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>>> To unsubscribe send an email to = >>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahoste= d.org >>> >> >> >> >> _______________________________________________ >> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted.= org > --===============5746937532678446188== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPHA+T24gOC8xMC8xNyAyOjQ1IEFNLCB0aGll cnJ5IGJvcmRheiB3cm90ZTo8YnI+CiAgICA8L3A+CiAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl IiBjaXRlPSJtaWQ6NTk4QzJCNEYuMjAwMDIwMkByZWRoYXQuY29tIj4KICAgICAgPG1ldGEgY29u dGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IiBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUi PgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAwOC8wOS8yMDE3IDA5OjMwIFBNLCBJYW4gSGFyZGluZwogICAgICAgIHZpYSBGcmVlSVBB LXVzZXJzIHdyb3RlOjxicj4KICAgICAgPC9kaXY+CiAgICAgIDxibG9ja3F1b3RlCiAgICAgICAg Y2l0ZT0ibWlkOmZlNTI1OWYzLWFlNGEtODM4OS01NDI1LTliODRiMTFiNzFkNUBicm93bnBhcGVy dGlja2V0cy5jb20iCiAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7CiAgICAgICAgICBjaGFyc2V0PXV0 Zi04Ij4KICAgICAgICA8cD5PbiA4LzkvMTcgMzowNSBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6 PGJyPgogICAgICAgIDwvcD4KICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJt aWQ6NTk4QURFN0YuMzA4MDMwOEByZWRoYXQuY29tIj4KICAgICAgICAgIDxtZXRhIGNvbnRlbnQ9 InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIKICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29udGVu dC1UeXBlIj4KICAgICAgICAgIEhpIElhbiw8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBU aGFua3MgZm9yIGhhdmluZyBnYXRoZXIgdGhvc2UgZGF0YS4gPGJyPgogICAgICAgICAgPHR0Pjxi cj4KICAgICAgICAgIDwvdHQ+CiAgICAgICAgICA8YmxvY2txdW90ZT48dHQ+IzwvdHQ+PGJyPgog ICAgICAgICAgICA8dHQ+IyBTbyBwa2lkYnVzZXIgZW50cmllcyBoYXZlIGEgc2FtZSAob2xkKSB1 c2VyQ2VydGlmaWNhdGUKICAgICAgICAgICAgICBsaWtlbHkgZ2VuZXJhdGVkIGR1cmluZyBpbnN0 YWxsPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4jIEJ1dCBvbmx5IGZyZWVpcGEtc2VhIGhhcyBh IG5ldyBvbmUgY3JlYXRlZCBvbgogICAgICAgICAgICAgIGZyZWVpcGEtc2VhIGFyb3VuZCBKdW4g OHRoIDIwMTcgMDU6NTQ6MTY8L3R0Pjxicj4KICAgICAgICAgICAgPHR0PiMgVGhpcyByZWNlbnQg Y2VydGlmaWNhdGUgaXMgaWRlbnRpZmllZCBieQogICAgICAgICAgICAgIDU5MzhlNjg4MDAwMTA0 MjkwMDAwIDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IzwvdHQ+PGJyPgogICAgICAgICAgICA8 dHQ+W3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRAogICAgICAgICAg ICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAidWlkPXBraWRi dXNlcixvdT1wZW9wbGUsbz1pcGFjYSIgbnNjcGVudHJ5d3NpPC90dD48YnI+CiAgICAgICAgICAg IDx0dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAgICAg ICAgICA8dHQ+Li4uPC90dD48YnI+CiAgICAgICAgICAgIDx0dD5uc2NwZW50cnl3c2k6IHVzZXJD ZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhr aUc5dzBCQVFzRkFEQTBNUgogICAgICAgICAgICAgICZsdDtzbmlwJmd0OzwvdHQ+PGJyPgogICAg ICAgICAgICA8dHQ+bnNjcGVudHJ5d3NpOgogICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTt2 dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMDo6CiAgICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJ QkFnSSAmbHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8 dHQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3Rv cnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv PWlwYWNhCiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpPC90dD48YnI+CiAgICAgICAgICAgIDx0 dD5kbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTwvdHQ+PGJyPgogICAgICAgICAg ICA8dHQ+bnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgIE1JSURj ekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVIKICAgICAgICAgICAgICAm bHQ7c25pcCZndDs8L3R0Pjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPHR0PiM8L3R0Pjxicj4KICAgICAgICAgICAgPHR0 PiMgd2h5IDU5MzhlNjg4MDAwMTA0MjkwMDAwIHZhbHVlIHdhcyBub3QgcHJvcGFnYXRlZCB0bwog ICAgICAgICAgICAgIHNlYXR0bGVuZnMgPzwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBUaGUg bW9zdCByZWNlbnQgdXBkYXRlIChmcm9tIGZyZWVpcGEtc2VhKSB0aGF0IHdhcwogICAgICAgICAg ICAgIHJlcGxpY2F0ZWQgdG8gc2VhdHRsZW5mczwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBp c8KgIDEgeWVhciBvbGQgKDU3YmU4MDQzMDAwNzA0MjkwMDAwIC0gQXVnIDI1dGggMjAxNgogICAg ICAgICAgICAgIDA1OjIxOjA3KS48L3R0Pjxicj4KICAgICAgICAgICAgPHR0PiMgSW4gYWRkaXRp b24gc2VhdHRsZW5mcyByZWNlaXZlZCBkaXJlY3QgdXBkYXRlIChsYXN0CiAgICAgICAgICAgICAg b25lIHdhcyBpbiBKYW4gMTAxNykgdGhhdCB3ZXJlIG5vdDwvdHQ+PGJyPgogICAgICAgICAgICA8 dHQ+IyByZXBsaWNhdGVkIHRvIGZyZWVpcGEtc2VhPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4j IDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBUaGUgdHdvIHNlcnZlcnMgaGF2ZSBkaXZlcmdl ZCBiZWNhdXNlIHRoZXkgY2FuIG5vdAogICAgICAgICAgICAgIHJlcGxpY2F0ZSB0byBlYWNob3Ro ZXIgYmVjYXVzZTwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyB0aGV5IHdlcmUgbm90IGNvcnJl Y3RseSBpbml0aWFsaXplLjwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+IyBUaGV5IGhhdmUgZGlm ZmVyZW50ICJyZXBsaWNhZ2VuZXJhdGlvbiIKICAgICAgICAgICAgICAoNTdjMjkxZDkwMDAwMDQy OTAwMDAgdnMgNTVjOGYzYWUwMDAwMDA2MDAwMDApPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4j PC90dD48YnI+CiAgICAgICAgICAgIDx0dD4jIEl0IGlzIGxvb2tpbmcgbGlrZSBmcmVlaXBhLXNl YSB3YXMgY3JlYXRlZCBvbmUgb3IgdHdvCiAgICAgICAgICAgICAgeWVhcnMgYWdvIGFuZCB1c2Vk IHRvIGluaXRpYWxpemVkIHNlYXR0bGVuZnMuPC90dD48YnI+CiAgICAgICAgICAgIDx0dD4jIEJ1 dCBsYXRlciBmcmVlaXBhLXNlYSB3YXMgcmVjcmVhdGVkLjwvdHQ+PGJyPgogICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8dHQ+VGhhdCdzIGFib3V0 IHJpZ2h0LjwvdHQ+PGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1p ZDo1OThBREU3Ri4zMDgwMzA4QHJlZGhhdC5jb20iPgogICAgICAgICAgPGJsb2NrcXVvdGU+IDx0 dD4jPC90dD48YnI+CiAgICAgICAgICAgIDx0dD5bcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRh cHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAt YiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1m ZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAg ICA8dHQ+RW50ZXIgTERBUCBQYXNzd29yZDo8L3R0Pjxicj4KICAgICAgICAgICAgPHR0PmRuOiBj bj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPC90dD48YnI+ CiAgICAgICAgICAgIDx0dD5uc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkw MDAwMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2Eg MTA2NSA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAg ICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAg ICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0 LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgNTdmODQwYmYwMDAwMDQyOTAwMDAgNTk4YTFj NDAwMDAxMDQyOTAwMDA8L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxp Y2EgMTI5MCA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIK ICAgICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAg ICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9zZWF0dGxlbmZzLmJw dC5yb2NrczozODk8L2E+fTwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFz dE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4 dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh LmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxk YXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICA1OThhMWMx NjwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVw bGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0 IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIK ICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMu YnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjxicj4KICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICA8dHQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNl YXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAi bz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZm ZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjwvdHQ+PGJyPgogICAgICAgICAgICA8 dHQ+ZG46IGNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8 L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1 NWM4ZjNhZTAwMDAwMDYwMDAwMDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNkczUwcnV2OiB7 cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0 ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2Nrczoz ODkiCiAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBh LXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICA1N2IxMDNkNDAwMDAwNDI5MDAw MCA1N2JlODA0MzAwMDcwNDI5MDAwMDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNkczUwcnV2 OiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZy ZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tz OjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0 bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59wqAKICAgICAgICAgICAgICA1N2JlODA0YzAwMDAwNTBh MDAwMCA1ODcyMzYxNTAwMDAwNTBhMDAwMDwvdHQ+PGJyPgogICAgICAgICAgICA8dHQ+bnNydXZS ZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFz cz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3Nl YXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAg MDAwMDAwMDA8L3R0Pjxicj4KICAgICAgICAgICAgPHR0Pm5zcnV2UmVwbGljYUxhc3RNb2RpZmll ZDoge3JlcGxpY2EgMTA2NSA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1m cmVldGV4dCIKICAgICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j a3M6Mzg5IgogICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFwOi8vZnJl ZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgMDAwMDAwMDA8L3R0Pjwv YmxvY2txdW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIEluIGNv bmNsdXNpb246PGJyPgogICAgICAgICAgwqDCoMKgIEZyb20gcmVwbGljYXRpb24gcG92LCB0aGUg dHdvIGluc3RhbmNlcyBjYW4gbm90CiAgICAgICAgICBjb21tdW5pY2F0ZS48YnI+CiAgICAgICAg ICDCoMKgwqAgT25lIHNvbHV0aW9uIHdvdWxkIGJlIHRvIGlkZW50aWZ5IHdoaWNoIGluc3RhbmNl IGlzIHRoZQogICAgICAgICAgZ29vZCBvbmUsIHlvdSB3YW50IHRvIGtlZXAuPGJyPgogICAgICAg ICAgwqDCoMKgIGFuZCByZWluaXQgdGhlIHNlY29uZCBvbmUgZnJvbSB0aGF0IHJlZmVyZW5jZS48 YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgIFdoYXQgZXhh Y3RseSBkb2VzIHJlaW5pdCBtZWFuP8KgIEkgaGF2ZSBydW48YnI+CiAgICAgICAgPGJyPgogICAg ICAgIGlwYS1yZXBsaWNhLW1hbmFnZSByZS1pbml0aWFsaXplIC0tZnJvbSBmcmVlaXBhLXNlYS5i cHQucm9ja3M8YnI+CiAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICBUaGlzIHRy aWdnZXJzIHRoZSByZWluaXQgb2YgJ2RjPWlwYWRvbWFpbixkYz1jb20nIHN1ZmZpeCBidXQgbm90 CiAgICAgIGZvciBvPWlwYWNhIHN1ZmZpeC4gVG8gcmVpbml0IG89aXBhY2EgeW91IG1heSB1c2U8 YnI+CiAgICAgIGlwYS1jcy1yZXBsaWNhLW1hbmFnZXIgcmUtaW5pdGlhbGl6ZSAtLWZyb20gZnJl ZWlwYS1zZWEuYnB0LnJvY2tzLjxicj4KICAgICAgTm90ZSB0aGF0IGl0IHdpbGwgb3ZlcndyaXRl IGFsbCBkYXRhIG9mIGlwYWNhIG9uIHNlYXR0bGVuZnMgd2l0aAogICAgICB0aGUgZGF0YSBmcm9t IGZyZWVpcGEtc2VhLiBUaGlzIGlzIHdoeSBpdCBpcyBpbXBvcnRhbnQgdG8ga25vdwogICAgICB3 aGljaCBzZXJ2ZXIgaXMgdGhlIHZhbGlkIG9uZS48YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8 YnI+CiAgICBIbW0uLiBUaGlzIGxvb2tzIG9kZC48YnI+CiAgICA8YnI+CiAgICBbcm9vdEBzZWF0 dGxlbmZzIGlhbmhdIyBpcGEtY3NyZXBsaWNhLW1hbmFnZSByZS1pbml0aWFsaXplIC0tZnJvbQog ICAgZnJlZWlwYS1zZWEuYnB0LnJvY2tzPGJyPgogICAgRGlyZWN0b3J5IE1hbmFnZXIgcGFzc3dv cmQ6IDxicj4KICAgIDxicj4KICAgIGlwYTogRVJST1I6IEZvdW5kIG11bHRpcGxlIGFncmVlbWVu dHMgZm9yIHNlYXR0bGVuZnMuYnB0LnJvY2tzLiBPbmx5CiAgICBpbml0aWFsaXppbmcgdGhlIGZp cnN0IG9uZSByZXR1cm5lZDoKY249Y2xvbmVBZ3JlZW1lbnQxLWZyZWVpcGEtc2VhLmJwdC5yb2Nr cy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1w9aXBhY2EsY249bWFwcGluZwogICAgdHJlZSxj bj1jb25maWc8YnI+CiAgICBVcGRhdGUgaW4gcHJvZ3Jlc3MsIDE1IHNlY29uZHMgZWxhcHNlZDxi cj4KICAgIFtmcmVlaXBhLXNlYS5icHQucm9ja3NdIHJlcG9ydHM6IFVwZGF0ZSBmYWlsZWQhIFN0 YXR1czogWzMywqAgLSBMREFQCiAgICBlcnJvcjogTm8gc3VjaCBvYmplY3RdPGJyPgogICAgPGJy PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJA cmVkaGF0LmNvbSI+IE9uCiAgICAgIGZyZWVpcGEtc2VhIGFuZCBzZWF0dGxlbmZzIHlvdSBtYXkg Y2hlY2sgdGhlIGlwYWNhIHJlcGxpY2EKICAgICAgYWdyZWVtZW50cyBzdGF0dXMgYmVmb3JlL2Fm dGVyIHJlaW5pdC4gSSB3b3VsZCBndWVzcyB0aGV5IGFyZQogICAgICBjdXJyZW50bHkgcmVwb3J0 aW5nIGZhaWx1cmVzIGJldHdlZW4gdGhlc2UgdHdvIHJlcGxpY2FzLjxicj4KICAgICAgPGJyPgog ICAgICA8dHQ+bGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIg IjwvdHQ+PHR0PmNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcKICAgICAgICB0cmVl LGNuPWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAgICAg ICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgICA8YnI+CiAgICAgIDwv dHQ+PC9ibG9ja3F1b3RlPgogICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2Vh cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICBtYW5hZ2VyJyAtVyAtYiAiY249cmVwbGlj YSxjbj1vXDNEaXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZyIKICAgICAgIm9iamVjdENs YXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAgICAgIG5zZHM1cmVwbGljYUxhc3RVcGRh dGVTdGF0dXM8YnI+CiAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgZG46CmNu PWNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBs aWNhLGNuPW9cM0RpcGFjPGJyPgogICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxi cj4KICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czogRXJyb3IgKDMyKSBQcm9ibGVt IGNvbm5lY3RpbmcgdG8KICAgICAgcmVwbGljYSAtIExEQVAgPGJyPgogICAgICDCoGVycm9yOiBO byBzdWNoIG9iamVjdCAoY29ubmVjdGlvbiBlcnJvcik8YnI+CiAgICAgIDxicj4KICAgICAgZG46 CmNuPW1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1y ZXBsaWNhLGNuPW9cM0RpcGFjPGJyPgogICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZp Zzxicj4KICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBs aWNhdGlvbiBlcnJvcgogICAgICBhY3F1aXJpbmcgcmVwbGljYTogPGJyPgogICAgICDCoFJlcGxp Y2EgaGFzIGRpZmZlcmVudCBkYXRhYmFzZSBnZW5lcmF0aW9uIElELCByZW1vdGUgcmVwbGljYSBt YXkKICAgICAgbmVlZCB0byBiZSBpPGJyPgogICAgICDCoG5pdGlhbGl6ZWQgKFJVViBlcnJvcik8 YnI+CiAgICAgIDxicj4KICAgICAgYW5kPGJyPgogICAgICA8YnI+CiAgICAgIFtyb290QHNlYXR0 bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInCiAg ICAgIC1XIC1iICJjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29u ZmlnIgogICAgICAib2JqZWN0Q2xhc3M9bnNkczVyZXBsaWNhdGlvbmFncmVlbWVudCIKICAgICAg bnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgRW50ZXIgTERBUCBQYXNzd29y ZDogPGJyPgogICAgICBkbjoKY249Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tz LXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhY2E8YnI+CiAgICAgIMKgLGNuPW1hcHBp bmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgIG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM6 IEVycm9yICgxOSkgUmVwbGljYXRpb24gZXJyb3IKICAgICAgYWNxdWlyaW5nIHJlcGxpY2E6IDxi cj4KICAgICAgwqBSZXBsaWNhIGhhcyBkaWZmZXJlbnQgZGF0YWJhc2UgZ2VuZXJhdGlvbiBJRCwg cmVtb3RlIHJlcGxpY2EgbWF5CiAgICAgIG5lZWQgdG8gYmUgaTxicj4KICAgICAgwqBuaXRpYWxp emVkIChSVVYgZXJyb3IpPGJyPgogICAgICA8YnI+CiAgICA8L3R0Pjxicj4KICAgIDxibG9ja3F1 b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OThDMkI0Ri4yMDAwMjAyQHJlZGhhdC5jb20iPjx0 dD4KICAgICAgPC90dD4KICAgICAgPGJsb2NrcXVvdGUKICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5 ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAg ICAgICB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgIHNldmVyYWwgdGltZXMgb3ZlciB0aGUgeWVh cnMgd2hlbiByZXBsaWNhdGlvbiBoYXMgc3RvcHBlZC7CoCA8YnI+CiAgICAgICAgPGJyPgogICAg ICAgIFJlcGxpY2F0aW9uIGFjdHVhbGx5IGlzIHdvcmtpbmcsIGFzIGZhciBhcyB1c2VyIGFuZCBt YWNoaW5lCiAgICAgICAgYWNjb3VudHMgYW5kIGF0dHJpYnV0ZXMgYXJlIGNvbmNlcm5lZCBhbnl3 YXksIGFuZCBoYXMgYmVlbiBmb3IgYQogICAgICAgIHdoaWxlLjxicj4KICAgICAgICA8YnI+CiAg ICAgICAgVGhlcmUgaXMgYSB6b21iaWUgc2VydmVyIGZyZWVpcGEtZGFsLmJwdC5yb2NrcyB0aGF0 IEkgY2FuJ3QgZ2V0CiAgICAgICAgcmlkIG9mLi4uIGl0IHNob3dzIHVwIGluIHRoZSBHVUkgb24g dGhlIFRvcG9sb2d5IHBhZ2UgYnV0CiAgICAgICAgZ2VuZXJhdGVzIGEgU2VydmVyIG5vdCBmb3Vu ZCBlcnJvci7CoCBJIGRvbid0IGtub3cgaWYgdGhhdCdzCiAgICAgICAgcmVsYXRlZC48YnI+CiAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICBab21iaWUgc2VydmVycyBoYXZlIGJl ZW4gZGlzY3Vzc2VkIGEgbG90IG9uIHRoaXMgbWFpbGluZyBsaXN0LiBZb3UKICAgICAgbWF5IGdl dCByaWQgb2YgdGhlbSB3aXRoIGxpc3QtcnV2L2NsZWFuLXJ1diBzdWJjb21tYW5kLgogICAgICBS ZXBsaWNhdGlvbiB1c3VhbGx5IG1hbmFnZSB0byB3b3JrIGZpbmUgZXZlbiBpZiBzb21lIHpvbWJp ZQogICAgICBlbnRyaWVzIGV4aXN0IGJ1dCBpdCBpcyBhIGdvb2QgcHJhY3RpY2UgdG8gY2xlYW4g dGhlbS48YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICBZZWFoLCBJJ3ZlIGJlZW4gdGhyb3VnaCBl dmVyeSBwb3NzaWJsZSBjb21iaW5hdGlvbiBvZgogICAgbGlzdC1ydXYvY2xlYW4tcnV2LsKgIEkg aGF2ZSBzb21ldGhpbmcgb2RkIGdvaW5nIG9uIGluIHRoYXQgbm8KICAgIHJlcGxpY2F0aW9uIGFn cmVlbWVudHMgc2hvdyB1cCBhbnl3aGVyZSBmb3IgZnJlZWlwYS1kYWwuPGJyPgogICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJAcmVkaGF0LmNvbSI+ IDxicj4KICAgICAgcmVnYXJkczxicj4KICAgICAgdGhpZXJyeTxicj4KICAgICAgPGJsb2NrcXVv dGUKICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3MWQ1 QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgICB0eXBlPSJjaXRlIj4KICAgICAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk4QURFN0YuMzA4MDMwOEByZWRoYXQuY29t Ij4KICAgICAgICAgIDxicj4KICAgICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+ T24gMDgvMDgvMjAxNyAxMDozMyBQTSwgSWFuCiAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJ UEEtdXNlcnMgd3JvdGU6PGJyPgogICAgICAgICAgPC9kaXY+CiAgICAgICAgICA8YmxvY2txdW90 ZQogICAgICAgICAgICBjaXRlPSJtaWQ6MmY2MGM0YWYtNjgwYy00MzgyLTk3MDQtNDFhMjRjODEy MWEyQGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAg ICAgICAgIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1s OwogICAgICAgICAgICAgIGNoYXJzZXQ9dXRmLTgiPgogICAgICAgICAgICA8cD5PbiA4LzcvMTcg MTo0NCBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6PGJyPgogICAgICAgICAgICA8L3A+CiAgICAg ICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgY2l0ZT0ibWlkOjU5 ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+CiAgICAgICAgICAgICAgPG1ldGEgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IgogICAgICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29u dGVudC1UeXBlIj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcvMjAxNyAwOToyMiBB TSwKICAgICAgICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQQS11c2Vy cyB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJsb2NrcXVv dGUKICAgICAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFh OWI5MjUyYzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgICAgIHR5cGU9ImNpdGUiPk9uIDA4LzA0 LzIwMTcgMTE6MDIgUE0sIElhbiBIYXJkaW5nIHZpYQogICAgICAgICAgICAgICAgRnJlZUlQQS11 c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+ T24gOC80LzE3IDI6MTYgQU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1 ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6MTMgUE0sIElhbgogICAgICAg ICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6IDxicj4KICAgICAg ICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4 IEFNLAogICAgICAgICAgICAgICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8w Mi8yMDE3IDExOjUxIFBNLAogICAgICAgICAgICAgICAgICAgICAgICBJYW4gSGFyZGluZyB2aWEg RnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2tx dW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMi8yMDE3IDEyOjExIEFNLAogICAgICAgICAgICAgICAg ICAgICAgICAgIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMDE6NDMK ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgv MDEvMjAxNyAxMjowMwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQTSwgUm9iIENyaXR0 ZW5kZW4gd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv dGUgdHlwZT0iY2l0ZSI+SWFuIEhhcmRpbmcgd3JvdGU6CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDA3OjM5IEFNLCBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbiAwOC8wMS8yMDE3CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDAzOjExIFBNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5P bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDA4LzAxLzIwMTcgMDE6NDgg QU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQmxhbmMt UmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDA4LzAxLzIwMTcgMDE6MzIgQU0sIElhbiBIYXJkaW5nCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPbiAwNy8zMS8yMDE3 IDExOjM0IEFNLCBSb2IKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Q3JpdHRlbmRlbiB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JYW4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBIYXJkaW5nIHZpYSBGcmVlSVBBLXVzZXJzCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij5JCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBoYWQgYW4g dW5leHBlY3RlZCByZXN0YXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBvZiBhbiBJUEEgc2VydmVyIHRoYXQgaGFkCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBhcHBhcmVudGx5IGhhZCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1cGRhdGVzIHJ1biBidXQgaGFkIG5vdAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmVlbiByZXN0YXJ0 ZWQuIGlwYWN0bAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg c2F5cyBwa2ktdG9tY2F0ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB3b3VsZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBub3Qgc3RhcnQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIFN0cmFuZ2VseSwgdGhlIGFjdHVhbAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgc2VydmljZSBhcHBlYXJzIHRvIGJlCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nOiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBkb2d0YWcgaXMgYW4gYXBwbGljYXRpb24KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3aXRoaW4gdG9tY2F0IHNvIHRvbWNhdCBj YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW4gd2l0aG91 dCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFn IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5n LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFdlIG5lZWQgdG8gc2Vl IG1vcmUgb2YgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ZG9ndGFnIGRlYnVnIGxvZyB0byBzZWUgd2hhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGlzIGdvaW5nIG9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg SXQgbG9va3MgbGlrZSBhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBhdXRoZW50aWNhdGlvbiBwcm9ibGVtLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgPGJyPgpbMjgvSnVsLzIwMTc6MTA6MDg6NDddW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06IFNTTCBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBDb3VsZCBub3QgY29ubmVjdCB0byBMREFQCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciBob3N0CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlYXR0bGVuZnMuYnB0LnJvY2tzIHBv cnQgNjM2CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRXJyb3IKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbmV0c2NhcGUubGRhcC5MREFQRXhjZXB0aW9u OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRoZW50aWNhdGlv biBmYWlsZWQgKDQ5KSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBkb2d0YWcgc3RvcmVzIGl0cyBpbnRlcm5hbCBkYXRhCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbiB0aGUgTERBUCBzZXJ2ZXIgYW5kIG5lZWRz IHRvCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlc3RhYmxpc2ggYSBzZWN1cmUgTERBUAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29ubmVjdGlvbi4gWW91IGNh biBjaGVjayBob3cKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoaXMg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29ubmVjdGlvbiBp cyBjb25maWd1cmVkIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAv ZXRjL3BraS9wa2ktdG9tY2F0L2NhL0NTLmNmZywKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGxvb2sgZm9yIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHRoZSBsaW5lczogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVudEF1dGgg PGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRETj1jbj1EaXJlY3RvcnkgTWFuYWdlciA8YnI+ CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5h bGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNh IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIu bGRhcGNvbm4uaG9zdD12bS0uLi4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFs ZGIubGRhcGNvbm4ucG9ydD02MzYgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5zZWN1cmVDb25uIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGF1dGh0eXBlIGNhbiBiZSBTc2xDbGllbnRBdXRoCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0aGVudGljYXRpb24gd2l0aCBhIHNzbCA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZSkg b3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAoYXV0 aGVudGljYXRpb24gd2l0aCBhIGJpbmQgRE4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBwYXNzd29yZCBzdG9yZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZikuCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBZb3UgY2FuIHVzZSB0aGlzIGluZm9ybWF0aW9uIHRvCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBtYW51YWxseSBjaGVjayB0aGUgY3JlZGVudGlhbHMuCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBGb3IgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW5zdGFuY2Ugd2l0aCBzc2xjbGllbnRhdXRo OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBleHBvcnQKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNfQ0FDRVJURElSPS9ldGMvcGtpL3BraS10 b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTERBUFRMU19DRVJUPSdzdWJzeXN0ZW1DZXJ0 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0 ZXh0IgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJsZGFw czovLyIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5v dC1zZW5kPSJ0cnVlIj5sZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgLWIgIiIgLXMgYmFzZSAtWSBFWFRFUk5BTCA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlkZSB0aGUgcGFzc3dv cmQgZnJvbQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kv cGtpLXRvbWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczogPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlw ZT1Tc2xDbGllbnRBdXRoIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49dWlkPXBraWRi dXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmluZFBXUHJv bXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnROaWNrbmFt ZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KaW50ZXJuYWxkYi5sZGFwY29ubi5jbG9u ZVJlcGxpY2F0aW9uUG9ydD0zODkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFuZCB3aGVuIEkgdHJ5IHRo ZSBsZGFwc2VhcmNoIEkgYW0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBw cmVzZW50ZWQgd2l0aCBhIHByb21wdCB0byBwcm92aWRlCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGEgcGluL3Bhc3N3b3JkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVy IHBpbiwgcGFzc3dvcmQsIG9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg cGFzcyBwaHJhc2UgZm9yIHNlY3VyaXR5IHRva2VuCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgJ2xkYXAoMCknOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJ1dCB0 aGVyZSBpcyBubyBwYXNzd29yZCBmaWxlLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwv YmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB5b3UgYXJlIHJpZ2h0LCBpbiA0LjQuIHRoZXJlIGlzIG5vCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB3ZGZpbGUudHh0IGFuZCB0aGUgcGFz c3dvcmQgY2FuIGJlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZm91bmQgaW4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29y ZC5jb25mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICh3aXRoIHRoZSB0YWcg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbD0uLi4pIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSB0YWcgaW50ZXJuYWw9Li4u IGFsbG93cyB0byByZWFkCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNT IGRiPyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsIC1L IC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21j YXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlk ZSBwYXNzd29yZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgVGhhdCB3b3Jrcy4uLiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj L3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiIgaW4gc2xvdCAiTlNTIFVzZXIKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIFByaXZhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgS2V5IGFuZCBDZXJ0aWZpY2F0ZSBTZXJ2aWNlcyIgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgMCZndDsgcnNhCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNmNWRjNTdjYTUzNjdj NTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKG9ycGhhbikgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAxJmd0OyByc2EKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4 NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1MgQ2Vy dGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREI6YXVkaXRT aWduaW5nQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAmbHQ7IDImZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgODgx YjcyNTRjNDBmYTQwYmM1MDY4MWJjYzhkMzdiYjNlYjQ5OTM3ZQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgY2FTaWduaW5nQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAmbHQ7IDMmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmE5 YTI1NWExZDE1NTg1YWMyODA2NGMwZjQ5ODZlNDE2YmM0ODQwM8KgwqAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBEQjpvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyA0Jmd0OyByc2EKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDNmYjYwOWQwZjdkNzJjMmQzMjVkNmEyZGMxNjU3N2E3Zjdl NWEwMWYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNlcnZlci1DZXJ0IDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICZsdDsgNSZndDsgcnNhCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAxZTk0NzlhOTU1NmFmOTMzOWJiNWU0NTUyY2NiZDM4MWQzYzM4 ODU2wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTlNTIENlcnRpZmljYXRl IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3RlbUNlcnQg Y2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQnV0IHRoaXMgZG9lc24ndCAod2l0aCB0 aGUgc2FtZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFzc3dvcmQgZnJvbSBw YXNzd29yZC5jb25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGxkYXBzZWFyY2ggLUggPGEKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVl dGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8i CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1 ZSI+bGRhcHM6Ly88L2E+YGhvc3RuYW1lYDo2MzYKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgUGxlYXNlIGVudGVyIHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBocmFzZSBmb3Igc2VjdXJpdHkgdG9rZW4gJ2xk YXAoMCknOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTQVNML0VYVEVS TkFMIGF1dGhlbnRpY2F0aW9uIHN0YXJ0ZWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgbGRhcF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczogSW52YWxpZAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgY3JlZGVudGlhbHMgKDQ5KSA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUgc29tZXdoZXJlCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB0aG91Z2gsIHNpbmNlIGlmIEkgcHV0IGluIGEgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbm9uc2Vuc2Ugb3IgaW5jb3JyZWN0IHBhc3N3 b3JkIGl0IGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHByb21wdHMgb3Zl ciBhbmQgb3Zlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmcm9tIHdoYXQgdG8gd2hhdD8gPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlcmUg d2Fzbid0IG11Y2ggb2YgYSBjaGFuZ2UuLi4gSSBqdXN0CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGFzc3VtZWQgc29tZW9uZSByYW4geXVtIHVwZ3JhZGUgYW5kIGRpZG4ndAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICByZXN0YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2UuLi4g aXQgbG9va3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbGlrZSBub3QgbXVjaCBvZiBh IHZlcnNpb24gY2hhbmdlIHRob3VnaC4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICMgZ3JlcCBpcGEgL3Zhci9sb2cveXVtLmxvZyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaXBhLWNsaWVudC1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGxpYmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNyBVcGRhdGVkOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBweXRob24tbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQu eDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA4IEluc3RhbGxlZDoKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgcHl0aG9uLWlwYWRkcmVzcy0xLjAuMTYtMi5lbDcubm9hcmNoIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3 LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxlZDoKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFjbGllbnQtNC40LjAtMTQuZWw3 LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1hZG1pbnRvb2xzLTQuNC4wLTE0LmVsNy5jZW50 b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50 b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2VydmVyLTQuNC4wLTE0LmVsNy5jZW50 b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVkOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBzc3NkLWlwYS0xLjE0LjAtNDMuZWw3XzMuNC54ODZfNjQgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTcgVXBkYXRlZDoK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC00LjQuMC0xNC5lbDcuY2Vu dG9zLjEuMS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjMgVXBkYXRlZDoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54 ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjQ3OjM2IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgaXBhLXB5dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgaXBhLXB5dGhvbi00LjIuMC0xNS4wLjEuZWw3LmNlbnRvcy4xOS54ODZfNjQKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg aXBhLWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQyIFVwZGF0ZWQ6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5u b2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJj aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgSnVsIDI4IDA5OjU1OjQ0IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHB5dGhvbjItaXBhY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBK dWwgMjggMDk6NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0 aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAy OCAwOTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtYWRt aW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1 OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40 LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBpcGEtc2VydmVyLTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5v YXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNo CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGdyZXAgcGtpIC92 YXIvbG9nL3l1bS5sb2cgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg MDQ6NDY6MDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2Ut MTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IEphbiAwOCAwNDo0NjowOSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBr cmI1LXBraW5pdC0xLjE0LjEtMjcuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IFVwZGF0ZWQ6CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTQuZWw3XzMueDg2XzY0 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIxIFVwZGF0 ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1zZXJ2ZXItMTAuMy4zLTE0LmVs N18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0 NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMu My0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4g MDggMDQ6NDc6MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWNh LTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBKdWwgMjggMTA6MTM6MTYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg cGtpLWJhc2UtMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgcGtpLXRvb2xzLTEwLjMuMy0xOS5lbDdfMy54ODZfNjQgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MjEgVXBkYXRlZDoK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTkuZWw3XzMu bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIx IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1rcmEtMTAuMy4zLTE5 LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx MDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktY2EtMTAu My4zLTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEFyZSB5b3UgcnVubmluZyBpbiBTRUxpbnV4IGVuZm9yY2luZwogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1vZGU/IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgZ2V0ZW5mb3JjZSA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEVuZm9yY2luZyA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv dGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJZiBz byBjYW4geW91IHJ1bjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGF1c2VhcmNoIC1tIEFWQyA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBhdXNlYXJjaCAtbSBBVkMgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0aW9uIHRvIGxvZ19mb3JtYXQg aXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVwcmVjYXRlZC4gUGxlYXNlIHVzZSB0 aGUgd3JpdGVfbG9ncwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvcHRpb24uIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlIE5PTE9HIG9wdGlvbiBpcyBvdmVycmlk aW5nIHRoZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3cml0ZV9sb2dzIGN1cnJlbnQg c2V0dGluZy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLS0tIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGltZS0mZ3Q7TW9uIE1hciAxNCAxMDozOTowMSAy MDE2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdHlwZT1TWVNDQUxMCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0yIHN1 Y2Nlc3M9bm8KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhpdD0tMTMgYTA9N2ZiY2Fi MDM4ZDEwIGExPTgwMCBhMj0xCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEzPTdmYmNh NjBmNDJlMCBpdGVtcz0wIHBwaWQ9MTQwNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBw aWQ9MTI5NjUgYXVpZD00Mjk0OTY3Mjk1IHVpZD0wIGdpZD0wCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGV1aWQ9NTgxNDAwMDAxIHN1aWQ9MCBmc3VpZD01ODE0MDAwMDEKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgZWdpZD01ODE0MDAwMDEgc2dpZD0wIGZzZ2lkPTU4MTQwMDAw MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0dHk9KG5vbmUpIHNlcz00Mjk0OTY3Mjk1 IGNvbW09InNzaGQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4ZT0iL3Vzci9zYmlu L3NzaGQiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHN1Ymo9c3lzdGVtX3U6c3lzdGVt X3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtl eT0obnVsbCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPUFWQyBtc2c9 YXVkaXQoMTQ1Nzk3NzE0MS43Njc6MTc1MzcpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBhdmM6wqAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9MTI5NjUKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgY29tbT0ic3NoZCIgbmFtZT0iYXV0aG9yaXplZF9rZXlzIgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBkZXY9ImRtLTIiIGlubz0xMTYzOTM1MTcKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMw OmMwLmMxMDIzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRjb250ZXh0PXN5c3RlbV91 Om9iamVjdF9yOnVubGFiZWxlZF90OnMwCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRj bGFzcz1maWxlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkkgc3VzcGVjdCB0aGF0IHRoZQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHN1YnN5c3RlbSBjZXJ0IHdhcyByZW5ld2VkIGFuZAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGV2ZXJ5dGhpbmcgd2Fzbid0IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB1cGRhdGVkIHByb3Blcmx5LiBJZiBJJ20gcmlnaHQgdGhp cyBpcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVucmVsYXRlZCB0byB0aGUgdXBn cmFkZSBpdCBqdXN0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBh IHNwb3RsaWdodCBvbiBpdC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDYW4geW91IHJ1biB0aGVzZSBjb21t YW5kczogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBh Y2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUgZGVzY3Jp cHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoaXMgcmV0dXJucyA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3 MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gc3R1ZmYgLi4uIDxicj4KWk5v NGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+YW5kIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBjZXJ0 dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10 b21jYXQvYWxpYXMgLW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVt Q2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwg Z3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0 aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9t Y2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNl cnQgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBU aGVzZSBib3RoIHJldHVybiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZCAvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uICdzdWJzeXN0 ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8IGdyZXAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg U2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQg b3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogcHJvYmxl bSBsaXN0aW5nIGtleXM6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9V TlJFQ09HTklaRURfT0lEOiBVbnJlY29nbml6ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhc8KgIC1uCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBDaGVja2luZyB0b2tlbiAiTlNTIENlcnRpZmljYXRl CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERCIiBpbiBzbG90ICJOU1MgVXNlciBQcml2 YXRlIEtleSBhbmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgU2Vy dmljZXMiIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQg b3IgUGluIGZvciAiTlNTIENlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogcHJvYmxl bSBsaXN0aW5nIGtleXM6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9V TlJFQ09HTklaRURfT0lEOiBVbnJlY29nbml6ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBtYWRlIGEgdHlwbyBhbmQgcmVxdWVz dGVkIHRoZSBrZXlzICgtSykKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGluc3RlYWQgb2Yg dGhlIGNlcnRzICgtTCkuIFBsZWFzZSByZXRyeSB3aXRoCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAtTCBhbmQgeW91IHNob3VsZCBiZSBhYmxlIHRvIHNlZSB0aGUKICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGNlcnRpZmljYXRlIHNlcmlhbC4gPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jv b3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAg ICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICAg ICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAg ICAgICAgICB1c2VyQ2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAg ICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFR S0RBbEMKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBaTm80ZVg3ak5UOEFhMjNn RGw2eHVMVmExU3hseUU4WEVvOGRmQVBYTUpvRmM9CiAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlm aWNhdGUKICAgICAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049 Q0EKICAgICAgICAgICAgICAgICAgICAgICAgICBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBT byB0aGUgc2VyaWFsIGlzIDQ/IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwg LUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFz IC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2En IHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDC oMKgwqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MQogICAgICAgICAgICAgICAgICAgICAgICAg ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5m cyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3Br aS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAg ICAgICAgY2VydC1wa2ktY2EnIC1hIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAtLS0t LUJFR0lOIENFUlRJRklDQVRFLS0tLS0gPGJyPgpNSUlEYmpDQ0FsYWdBd0lCQWdJRVQva0FEVEFO QmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIHNqZWlGYlVGdG9N bmZtSExJWXBlNVFBUiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgLS0tLS1FTkQgQ0VS VElGSUNBVEUtLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIEFuZCB0aGlzIGNlcnQgaXMgTk9UIHRoZSBzYW1lLiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgd2hlbiBjZXJ0bW9uZ2VyIHJl bmV3cyBhIGNlcnRpZmljYXRlLCBpdCBydW5zCiAgICAgICAgICAgICAgICAgICAgICAgIHByZS1z YXZlIGFuZCBwb3N0LXNhdmUgY29tbWFuZHMgKHdoaWNoIHlvdSBjYW4KICAgICAgICAgICAgICAg ICAgICAgICAgc2VlIGluIHRoZSBvdXRwdXQgb2YgZ2V0Y2VydCBsaXN0KS4gSW4geW91cgogICAg ICAgICAgICAgICAgICAgICAgICBjYXNlLCB0aGUgcG9zdC1zYXZlIGNvbW1hbmQgZm9yIHN1YnN5 c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgcHJvYmFibHkgZmFp bGVkLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgVGhpcyBjb21tYW5kIChvbiB0aGUgcmVuZXdhbCBtYXN0ZXIpIGlzCiAgICAgICAgICAg ICAgICAgICAgICAgIHJlc3BvbnNpYmxlIGZvciBjb3B5aW5nIHRoZSBuZXcgY2VydCBmcm9tIHRo ZQogICAgICAgICAgICAgICAgICAgICAgICBOU1MgZGIgdG8gdGhlIExEQVAgc2VydmVyLiBZb3Ug bmVlZCBmaXJzdCB0bwogICAgICAgICAgICAgICAgICAgICAgICBjaGVjayB3aGljaCBJUEEgc2Vy dmVyIGlzIHRoZSByZW5ld2FsIG1hc3RlciAoYXMKICAgICAgICAgICAgICAgICAgICAgICAgdGhl IHNlcmlhbCBudW1iZXJzIGFyZSBpbiBhIGNvbXBsZXRlbHkgZGlmZmVyZW50CiAgICAgICAgICAg ICAgICAgICAgICAgIHJhbmdlLCBJIGFzc3VtZSB0aGF0IHlvdSBoYXZlIG11bHRpcGxlIElQQQog ICAgICAgICAgICAgICAgICAgICAgICBzZXJ2ZXJzIGNvbmZpZ3VyZWQgd2l0aCBhIENBIGluc3Rh bmNlKTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICQgZXhwb3J0IEJBU0VETj1gZ3JlcCBiYXNlZG4KICAgICAgICAgICAgICAgICAgICAg ICAgL2V0Yy9pcGEvZGVmYXVsdC5jb25mIHwgY3V0IC1kPSAtZjItYCA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICQga2luaXQgYWRtaW4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAk IGxkYXBzZWFyY2ggLUxMTCAtUSAtaCBgaG9zdG5hbWVgIC1wIDM4OSAtWQogICAgICAgICAgICAg ICAgICAgICAgICBHU1NBUEkgLWIgImNuPW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgog ICAgICAgICAgICAgICAgICAgICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FS ZW5ld2FsTWFzdGVyKSknCiAgICAgICAgICAgICAgICAgICAgICAgIGRuIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgZG46CmNuPUNBLGNuPXZtLWlwYXNlcnZlci5pcGFkb21haW4uY29tLGNu PW1hc3RlcnMsY249aXBhLGNuPWV0YyxkYz1pcGFkb21haW4sZGM9Y29tCiAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICBJbiB0aGlzIGV4YW1wbGUgdGhlIHJlbmV3YWwgbWFzdGVyIGlzCiAgICAgICAg ICAgICAgICAgICAgICAgIHZtLWlwYXNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBJIGdldCB0aGlzIDxicj4KICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAt TExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICBHU1NB UEkgLWIgImNuPW1hc3RlcnMsY249aXBhLGNuPWV0YywkQkFTRUROIgogICAgICAgICAgICAgICAg ICAgICAgJygmYW1wOyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJwog ICAgICAgICAgICAgICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46CiAg ICAgICAgICAgICAgICAgICAgICBjbj1DQSxjbj1mcmVlaXBhLXNlYS5icHQucm9ja3MsY249bWFz dGVycyxjbj1pcGEsY249ZXRjLGRjPWJwdCxkYz1yb2NrcwogICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgV2hp Y2ggaXMgdGhlIG90aGVyIEZyZWVJUEEgc2VydmVyLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAg ICAgIEhpIElhbiwgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICBpdCdzIGdldHRpbmcgZGlmZmljdWx0IHRvIGZvbGxvdyB0aGlzIHRocmVhZCwgc28KICAg ICAgICAgICAgICAgICAgICBjb3VsZCB3ZSBzdGVwIGJhY2sgYW5kIHN1bW1hcml6ZT8gPGJyPgog ICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIFllcywgaXQg aXMuwqAgU29ycnkuIDxicj4KICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNlYSAoPXJl bmV3YWwgbWFzdGVyKSwgdGhlIENBCiAgICAgICAgICAgICAgICAgICAgY29tcG9uZW50IGlzIGlu c3RhbGxlZCBhbmQgJ3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1j YScgaGFzIFNlcmlhbCBudW1iZXIgNCBpbiB0aGUgTlNTREIKICAgICAgICAgICAgICAgICAgICAv ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgICAgICAgICAgICBObz8gPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAog ICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1D ZXJ0CiAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAg ICAgICAgICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQx ICgweDRmZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPi0gT24gc2VydmVyIHNlYXR0bGVuZnMgKHdoZXJlCiAgICAgICAgICAgICAgICAgICAgUEtJ IGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50IGlzIGluc3RhbGxlZAogICAgICAg ICAgICAgICAgICAgIGFuZCAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgaGFzIFNlcmlhbCBu dW1iZXIKICAgICAgICAgICAgICAgICAgICAxMzQxNzE4NTQxIGluIHRoZSBOU1NEQiAvZXRjL3Br aS9wa2ktdG9tY2F0L2FsaWFzLiA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgWWVzIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAg ICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAg ICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAg ICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRm ZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAtIEluIHRoZSBM REFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUKICAgICAgICAgICAgICAgICAg ICBlbnRyeSB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHdpdGggU2VyaWFsCiAgICAg ICAgICAgICAgICAgICAgbnVtYmVyIDQgKGkuZS4gaXQgaXMgdGhlIGNlcnQgZnJvbSBmcmVlaXBh LXNlYSkuIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg ICAgICBUaGlzIGlzIHdoZXJlIHRoZSBkaWZmZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28KICAg ICAgICAgICAgICAgICAgY2VydGlmaWNhdGVzIG9uIHRoZSBtYXN0ZXIgYW5kIG9ubHkgb25lIG9u IHRoZSBvdGhlci7CoAogICAgICAgICAgICAgICAgICBJIHdvbmRlciBpZiB0aGlzIGlzIGEgcmVz dWx0IG9mIHRoZSBzbG93IG1vdGlvbgogICAgICAgICAgICAgICAgICByZXBsaWNhdGlvbiB0cmFp bndyZWNrIEkgaGF2ZSBnb2luZyBvbiBkdWUgdG8gYSB6b21iaWUKICAgICAgICAgICAgICAgICAg cmVwbGljYSBpbiB0aGUgbGRhcCBkYXRhYmFzZSB0aGF0IG5vIGxvbmdlciBleGlzdHMgaW4KICAg ICAgICAgICAgICAgICAgdGhlIHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qgc2VlbSB0byBnZXQgcmlk IG9mLiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICB0aGUgcmVtYWluaW5nIGlzc3VlIGlzIGEgcmVwbGljYXRpb24gcHJvYmxlbS4g VGhlcmUgaXMgYQogICAgICAgICAgICAgICAgIlRyb3VibGVzaG9vdGluZyByZXBsaWNhdGlvbiIg c2VjdGlvbiBbMV0gaW4gSWRNIEFkbWluCiAgICAgICAgICAgICAgICBndWlkZSB0aGF0IG1heSBo ZWxwIHlvdS4gPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgUmVnYXJk aW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1hbmRzIGRpZCB5b3UKICAgICAgICAg ICAgICAgIHVzZSB0byB0cnkgdG8gcmVtb3ZlIGl0LCBhbmQgd2hhdCB3YXMgdGhlIG91dHB1dD8g PGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIFsxXSA8YSBjbGFzcz0ibW96LXR4dC1saW5r LWZyZWV0ZXh0IgpocmVmPSJodHRwczovL2FjY2Vzcy5yZWRoYXQuY29tL2RvY3VtZW50YXRpb24v ZW4tVVMvUmVkX0hhdF9FbnRlcnByaXNlX0xpbnV4LzcvaHRtbC9MaW51eF9Eb21haW5fSWRlbnRp dHlfQXV0aGVudGljYXRpb25fYW5kX1BvbGljeV9HdWlkZS90cm91YmxlLWdlbi1yZXBsaWNhdGlv bi5odG1sIgogICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8v YWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2Vf TGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9s aWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgSGksPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBU byBkZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAg ICAgICAgICAgIHNldmVyYWwgaW5mbyBidXQgc3RhcnRpbmcgd2l0aCB0aGUgcmVzdWx0cyBvZiB0 aGUKICAgICAgICAgICAgICBmb2xsb3dpbmcgY29tbWFuZHM8YnI+CiAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg LUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iICJ1aWQ9cGtpZGJ1 c2VyLG91PXBlb3BsZSxvPWlwYWNhIgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTxicj4KICAg ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5o XSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgbWFuYWdlcicg LVcgLWIgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiCiAgICAgICAgICAgIG5zY3Bl bnRyeXdzaTxicj4KICAgICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAg ICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4KICAgICAgICAgICAg bnNjcGVudHJ5d3NpOiBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4KICAg ICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICBlbnRyeXVzbjthZGNzbi01OTM4ZTY4 ODAwMDEwNDI5MDAwNTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNToKICAgICAgICAgICAgPGJy PgogICAgICAgICAgICDCoDc1Mjc0ODk3PGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAg ICAgICAgICAgIG1vZGlmeVRpbWVzdGFtcDthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNDt2dWNz bi01OTM4ZTY4ODAwMDEwNDI8YnI+CiAgICAgICAgICAgIMKgOTAwMDQ6IDIwMTcwNjA4MDU1MzM0 Wjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICBtb2RpZmllcnNOYW1l O2FkY3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAzO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwPGJyPgog ICAgICAgICAgICDCoDAwMzogY249RGlyZWN0b3J5IE1hbmFnZXI8YnI+CiAgICAgICAgICAgIG5z Y3BlbnRyeXdzaTogbnNVbmlxdWVJZDoKICAgICAgICAgICAgNDg4MDliNDAtMmJiOTExZTUtOTZh MGI4YjgtMWZkZDgwNzQ8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogY246IHBraWRidXNl cjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2 MTI1MTQ2Wjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRp cmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9u O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAxOgogICAgICAgICAgICAyOzEzNDE3MTg1NDE7Q049 Q2VydGlmaWM8YnI+CiAgICAgICAgICAgIMKgYXRlIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1D QSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaToKICAg ICAgICAgICAgZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVsZXRlZDoK ICAgICAgICAgICAgMjs0O0NOPUNlcnRpZmljYTxicj4KICAgICAgICAgICAgwqB0ZSBBdXRob3Jp dHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAg ICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVj dENsYXNzOiB0b3A8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHBl cnNvbjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogb3JnYW5pemF0 aW9uYWxQZXJzb248YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGlu ZXRPcmdQZXJzb248YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGNt c3VzZXI8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lz dGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lkYnVz ZXI8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAg ICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgTUlJRGN6 Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUjxicj4KICAgICAgICAgICAg Jmx0O3NuaXAmZ3Q7PGJyPgrCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZh MVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vy Q2VydGlmaWNhdGU7dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDA6OgogICAgICAgICAgICBNSUlE YmpDQ0FsYWdBd0lCQWdJPGJyPgogICAgICAgICAgICAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAg ICAgIMKgQVI8YnI+CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlclBhc3N3b3JkOjogJmx0 O3NuaXAmZ3Q7PGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJzdGF0ZTogMTxicj4K ICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAg ICAgICBuc2NwZW50cnl3c2k6IHBhcmVudGlkOiAyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3 c2k6IGVudHJ5aWQ6IDUxPGJyPgogICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgog ICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhhdC5jb20iPiBhbmQ8 YnI+CiAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExM IC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1 c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpPGJyPgogICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgW3Jvb3RA c2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAg ICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2Nw ZW50cnl3c2k8YnI+CiAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAg ICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAg IG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAg ICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJP Q0tTPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAg ICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+ CiAgICAgICAgICAgICZsdDtzbmlwJmd0Ozxicj4KwqBjQmQ0bk9WNG05QStxUlpObzRlWDdqTlQ4 QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz08YnI+CiAgICAgICAgICAgIG5zY3Bl bnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICBBdXRo b3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Viczxicj4KICAgICAgICAgICAgwqB5c3RlbSxPPUJQ VC5ST0NLUzxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1MTxicj4KICAg ICAgICAgICAgbnNjcGVudHJ5d3NpOiBwYXJlbnRpZDogMjxicj4KICAgICAgICAgICAgbnNjcGVu dHJ5d3NpOiBtb2RpZnlUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgICAg bnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAg ICAgICAgbnNjcGVudHJ5d3NpOiBtb2RpZmllcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxi cj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBt YW5hZ2VyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtz bmlwJmd0Ozxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAg ICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnR5cGU6IGFnZW50VHlwZTxicj4KICAgICAgICAg ICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjbjog cGtpZGJ1c2VyPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IHNuOiBwa2lkYnVzZXI8YnI+ CiAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgICAg IG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiBvYmplY3RDbGFzczogcGVyc29uPGJyPgogICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9i amVjdENsYXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiBvYmplY3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiBvYmplY3RDbGFzczogY21zdXNlcjxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBu c1VuaXF1ZUlkOgogICAgICAgICAgICA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3 NDxicj4KICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeXVzbjogODY8YnI+CiAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgy ODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IDxicj4KICAgICAgICAgICAgICBGcm9tIHRoZSBvdXRw dXQgeW91IG1heSBvbmx5IGNvcHkvcGFzdCB0aGUgb25lcyByZWxhdGVkIHRvCiAgICAgICAgICAg ICAgdXNlckNlcnRpZmljYXRlPGJyPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgQWxzbyB0byBkdW1wIHRoZSBjdXJyZW50IHJlcGxpY2F0aW9uIHN0 YXR1cywgc2VuZCB0aGUKICAgICAgICAgICAgICByZXN1bHTCoCBvZjxicj4KICAgICAgICAgICAg ICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3Rv cnkKICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+ PGk+IDwvaT4iKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZmZmZm ZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAgICAgICAgIDwvZm9u dD48L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFw c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiAi bz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1mZmZm ZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAgICAgICAgICAgRW50ZXIg TERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICBkbjogY249cmVwbGljYSxjbj1vXDNEaXBh Y2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgY246IHJlcGxpY2E8 YnI+CiAgICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAgICAgICAgIG5zRFM1UmVwbGlj YUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICAgICAgICBjbG9uZUFncmVlbWVu dDEtZnJlZWlwYS1zZWEuYnB0LnJvYzxicj4KICAgICAgICAgICAgwqBrcy1wa2ktdG9tY2F0LG91 PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNu PVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgICAgICAgbWFzdGVyQWdyZWVtZW50MS1zZWF0dGxl bmZzLmJwdC5yb2M8YnI+CiAgICAgICAgICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNu PWNvbmZpZzxicj4KICAgICAgICAgICAgbnNEUzVSZXBsaWNhSWQ6IDEwNjU8YnI+CiAgICAgICAg ICAgIG5zRFM1UmVwbGljYU5hbWU6IGIyMWExZjFlLTYyNzkxMWU2LTkzZTZlZjRiLTY5ZGNjMmQx PGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAg ICBuc0RTNVJlcGxpY2FUeXBlOiAzPGJyPgogICAgICAgICAgICBuc1N0YXRlOjoKICAgICAgICAg ICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFB PT08YnI+CiAgICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwOiBjbj1yZXBsaWNhdGlv bgogICAgICAgICAgICBtYW5hZ2Vycyxjbj1zeXNhY2NvdW50cyxjbj1ldGMsZGM9YnB0LDxicj4K ICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgbnNkczVyZXBsaWNhYmluZGRu Z3JvdXBjaGVja2ludGVydmFsOiA2MDxicj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IHRvcDxi cj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgICAg b2JqZWN0Q2xhc3M6IGV4dGVuc2libGVvYmplY3Q8YnI+CiAgICAgICAgICAgIG5zZHM1MHJ1djog e3JlcGxpY2FnZW5lcmF0aW9ufSA1N2MyOTFkOTAwMDAwNDI5MDAwMDxicj4KICAgICAgICAgICAg bnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAg ICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9 ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0 LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICAg ICAgICAgIMKgMCA1OThhMWM0MDAwMDEwNDI5MDAwMDxicj4KICAgICAgICAgICAgbnNkczUwcnV2 OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICBj bGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9z ZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8 L2E+fTxicj4KICAgICAgICAgICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAgICAgICBvPWlwYWNh O2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdDtzZWF0PGJy PgogICAgICAgICAgICDCoHRsZW5mcy5icHQucm9ja3M7Mzg5O3VuYXZhaWxhYmxlPGJyPgogICAg ICAgICAgICBuc2RzNWFnbXRtYXhjc246CiAgICAgICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVt ZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgICAg IMKgdGxlbmZzLmJwdC5yb2NrczszODk7dW5hdmFpbGFibGU8YnI+CiAgICAgICAgICAgIG5zcnV2 UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NSA8YQogICAgICAgICAgICAgIGNsYXNz PSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVp cGEtc2VhLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVl Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgIDU5OGE8 YnI+CiAgICAgICAgICAgIMKgMWMxNjxicj4KICAgICAgICAgICAgbnNydXZSZXBsaWNhTGFzdE1v ZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIKICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9j a3M6Mzg5IgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0 bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgIDAwMDAwPGJyPgogICAgICAgICAg ICDCoDAwMDxicj4KICAgICAgICAgICAgbnNkczVSZXBsaWNhQ2hhbmdlQ291bnQ6IDg4NTxicj4K ICAgICAgICAgICAgbnNkczVyZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAgICAgICAgICBjaXRlPSJtaWQ6NTk4ODI4NzEuMTAw MDEwNkByZWRoYXQuY29tIj48Zm9udCBzaXplPSItMSI+CiAgICAgICAgICAgICAgICBhbmQ8YnI+ CiAgICAgICAgICAgICAgPC9mb250Pltyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2gg LUxMTCAtRAogICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIgIm89aXBh Y2EiPGZvbnQgc2l6ZT0iLTEiPjxpPgogICAgICAgICAgICAgICAgPC9pPiIoJmFtcDsob2JqZWN0 Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYt ZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgPC9mb250PjwvYmxvY2txdW90ZT4KICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMg aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgIG1hbmFn ZXInIC1XIC1iICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1Vu aXF1ZUlkPWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAg ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgIGRuOiBjbj1yZXBsaWNh LGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgICAgICBj bjogcmVwbGljYTxicj4KICAgICAgICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgICAgICAg bnNEUzVSZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAgICAgICAgIGNs b25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2NrPGJyPgogICAgICAgICAgICDCoHMtcGtp LXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgbnNEUzVSZXBsaWNh SWQ6IDEyOTA8YnI+CiAgICAgICAgICAgIG5zRFM1UmVwbGljYU5hbWU6IDg3MDZhYjFlLTZhODMx MWU2LWE5YmZkYmJmLTc0ZGM3MzIzPGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBv PWlwYWNhPGJyPgogICAgICAgICAgICBuc0RTNVJlcGxpY2FUeXBlOiAzPGJyPgogICAgICAgICAg ICBuc1N0YXRlOjoKICAgICAgICAgICAgQ2dVQUFBQUFBQUFLRllwWkFBQUFBQUFBQUFBQUFBQUFL Z0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRk bmdyb3VwOiBjbj1yZXBsaWNhdGlvbgogICAgICAgICAgICBtYW5hZ2Vycyxjbj1zeXNhY2NvdW50 cyxjbj1ldGMsZGM9YnB0LDxicj4KICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAg ICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXBjaGVja2ludGVydmFsOiA2MDxicj4KICAgICAgICAg ICAgb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVw bGljYTxicj4KICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IGV4dGVuc2libGVvYmplY3Q8YnI+CiAg ICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYw MDAwMDxicj4KICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0 IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxk YXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICA1N2JlODA0YzAw MDAwNTBhMDAwMDxicj4KICAgICAgICAgICAgwqAgNTg3MjM2MTUwMDAwMDUwYTAwMDA8YnI+CiAg ICAgICAgICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTA2NSA8YSBtb3otZG8tbm90LXNlbmQ9InRy dWUiCiAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAg ICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVp cGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICA1N2IxMDNkNDAwMDAwNDI5MDAw PGJyPgogICAgICAgICAgICDCoDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAgICAgICAgICAg IG5zZHM1YWdtdG1heGNzbjoKICAgICAgICAgICAgbz1pcGFjYTtjbG9uZUFncmVlbWVudDEtc2Vh dHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdDtmcmVlaTxicj4KICAgICAgICAgICAgwqBwYS1z ZWEuYnB0LnJvY2tzOzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAwPGJyPgogICAgICAgICAg ICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAgPGEKICAgICAgICAgICAg ICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6 Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAg MDAwMDA8YnI+CiAgICAgICAgICAgIMKgMDAwPGJyPgogICAgICAgICAgICBuc3J1dlJlcGxpY2FM YXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4 dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5i cHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+bGRhcDov L2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICAwMDAwPGJyPgogICAg ICAgICAgICDCoDAwMDA8YnI+CiAgICAgICAgICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiAz PGJyPgogICAgICAgICAgICBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICAgICAg ICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3 MS4xMDAwMTA2QHJlZGhhdC5jb20iPjxmb250IHNpemU9Ii0xIj4gPGJyPgogICAgICAgICAgICAg ICAgUmVnYXJkczxicj4KICAgICAgICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICAgICAg PC9mb250PgogICAgICAgICAgICAgIDxibG9ja3F1b3RlCiAgICAgICAgICAgICAgICBjaXRlPSJt aWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAg ICAgICAgICAgICB0eXBlPSJjaXRlIj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPltyb290QGZyZWVpcGEtc2VhIGlhbmhdIwogICAgICAgICAgICAgICAgICBsZGFwc2Vh cmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAg ICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAg ICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAg UGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVv cGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAg ICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURB ME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICDCoCAmbHQ7dHJ1bmNhdGVkJmd0OyA8YnI+CiAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdq TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAg ICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICBNSUlEYmpDQ0FsYWdBd0lC QWdJRVQva0FEVEFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUsKICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAmbHQ7dHJ1bmNhdGVkJmd0OwogICAgICAgICAg ICAgICAgICBmdVFRWm1QMVhyS2tyZnNqZWlGYlVGdG9NbmZtSExJWXBlNVFBUiA8YnI+CiAgICAg ICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWNhdGUKICAg ICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+ CiAgICAgICAgICAgICAgICAgIMKgICxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICBbcm9vdEBzZWF0 dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICAgJ2NuPWRp cmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91 PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICBkZXNjcmlw dGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAg ICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgog ICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICBNSUlE Y3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMK ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICDCoCAmbHQ7dHJ1bmNhdGVk Jmd0OyA8YnI+CiAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFT eGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbjog Mjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NL UztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk8gPGJyPgogICAgICAgICAgICAgICAgICDCoCBDS1Mg PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPklmIHlvdSBjaGVjayB0aGUgY2VydGlmaWNhdGVzCiAgICAgICAgICAgICAg ICAgICAgZGF0ZXMsIEkgZ3Vlc3MgdGhhdCB0aGUgbW9zdCByZWNlbnQgb25lIGlzIG9uIHNlcnZl cgogICAgICAgICAgICAgICAgICAgIHNlYXR0bGVuZnMgKGJlY2F1c2Ugb2Ygc2VyaWFsIG51bWJl cnMpLiBDYW4geW91CiAgICAgICAgICAgICAgICAgICAgY29uZmlybSB0aGlzIChiZWNhdXNlIG91 ciBnb2FsIGlzIHRvIGhhdmUgdGhlIG1vc3QKICAgICAgICAgICAgICAgICAgICByZWNlbnQgY2Vy dCBzdG9yZWQgaW4gYWxsIHRoZSBOU1NEQnMgYW5kIGluIExEQVApPyA8YnI+CiAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIFRoYW5rcywgPGJyPgogICAgICAgICAg ICAgICAgICAgIEZsbyA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4K ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklmIHlvdXIgcmVu ZXdhbCBtYXN0ZXIgaXMKICAgICAgICAgICAgICAgICAgICAgICAgdGhlIG1hY2hpbmUgb24gd2hp Y2ggdGhlIE5TUyBEQgogICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0 L2FsaWFzIGNvbnRhaW5zIHRoZSBuZXdlcgogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LCB0 aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZSBzY3JpcHRzOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICBJZiBJJ20gaW50ZXJwcmV0aW5nIHRoaXMgY29ycmVjdGx5LCB0aGVuIGl0 IGlzLi4uCiAgICAgICAgICAgICAgICAgICAgICBzbyBJIHJhbiB0aGlzIG9uIHRoZSBicm9rZW4g bWFjaGluZSAoc2VhdHRsZW5mcykgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBzdWRvCiAgICAgICAg ICAgICAgICAgICAgICAgIC91c3IvbGliZXhlYy9pcGEvY2VydG1vbmdlci9zdG9wX3BraWNhZCA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICQgc3VkbyAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRt b25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAgICAgICAgICAic3Vic3lzdGVtQ2Vy dCBjZXJ0LXBraS1jYSIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICBJIHJhbiB0aGlzLCBpdCB0b29rIGEgd2hpbGUsIHRoZW4gSSBy ZS1jaGVja2VkIGFuZAogICAgICAgICAgICAgICAgICAgICAgdGhlIHNlcmlhbCBzdGlsbCBzZWVt cyB0byBiZSA0IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIK ICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNl ckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgICAgICAgICAgTUlJ RGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxD CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlF OFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbjog Mjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQu Uk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTCiAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBIZXJl J3Mgd2hhdCB3YXMgaW4KICAgICAgICAgICAgICAgICAgICAgIC92YXIvbG9nL3BraS9wa2ktdG9t Y2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09IDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgID09PT09wqAg REVCVUcgU1VCU1lTVEVNIElOSVRJQUxJWkVEwqDCoCA9PT09PT09IDxicj4KICAgICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09IDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2lu ZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4KICAgICAgICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8K ICAgICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1No dXRkb3duLmNydW1iIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0Vu Z2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IKICAgICAgICAgICAgICAgICAgICAgIGF1 dG8tc2h1dGRvd24gc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNF bmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUy OjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5n aW5lOiBkb25lIGluaXQgaWQ9ZGVidWcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg ICAgICAgQ01TRW5naW5lOiBpbml0aWFsaXplZCBkZWJ1ZyA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg ICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9bG9nIDxicj4KICAg ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0 U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBp ZD1sb2cgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcKICAg ICAgICAgICAgICAgICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9wa2ktdG9tY2F0 L2xvZ3MvY2Evc2lnbmVkQXVkaXQvY2FfYXVkaXQpCiAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAg ICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9z eXN0ZW0pCiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBb MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg ICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUo L3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS90cmFuc2FjdGlvbnMpCiAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6 NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdp bmU6IHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg ICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/ CiAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9T aHV0ZG93bi5jcnVtYiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNF bmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yCiAgICAgICAgICAgICAgICAgICAgICBh dXRvLXNodXRkb3duIHN1cHBvcnQ6YXVkaXRTaWduaW5nQ2VydCBjZXJ0LXBraS1jYQogICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01T RW5naW5lOiBmb3VuZCBjZXJ0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0Vu Z2luZTogZG9uZSBpbml0IGlkPWxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg ICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAg ICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9anNzIDxicj4KICAgICAg ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVhZHkgdG8gaW5pdCBpZD1q c3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0 YXJ0IGF0IGF1dG9TaHV0ZG93bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwogICAgICAg ICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24u Y3J1bWIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBh Ym91dCB0byBsb29rIGZvciBjZXJ0IGZvcgogICAgICAgICAgICAgICAgICAgICAgYXV0by1zaHV0 ZG93biBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQgY2VydC1wa2ktY2EKICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1b bG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog Zm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhCiAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGRv bmUgaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgQ01T RW5naW5lOiBpbml0aWFsaXplZCBqc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg ICAgICAgQ01TRW5naW5lOiBpbml0U3Vic3lzdGVtIGlkPWRicyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg ICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9ZGJzIDxicj4K ICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0 YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIERCU3Vic3lzdGVtOiBpbml0KCkgbUVu YWJsZVNlcmlhbE1nbXQ9dHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg ICBDcmVhdGluZyBMZGFwQm91bmRDb25uRmFjdG9yKERCU3Vic3lzdGVtKSA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdCA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTpk b0Nsb25pbmcgdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFw QXV0aEluZm86IGluaXQoKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6 MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBM ZGFwQXV0aEluZm86IGluaXQgYmVnaW5zIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg ICAgICAgIExkYXBBdXRoSW5mbzogaW5pdCBlbmRzIDxicj4KICAgICAgICAgICAgICAgICAgICAg IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg ICAgICAgICAgICAgIGluaXQ6IGJlZm9yZSBtYWtlQ29ubmVjdGlvbiBlcnJvcklmRG93biBpcyB0 cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9u OiBlcnJvcklmRG93biB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogVENQCiAgICAgICAgICAgICAgICAg ICAgICBLZWVwLUFsaXZlOiB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAg ICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6IFNldHRpbmcgZGVzaXJlZAogICAg ICAgICAgICAgICAgICAgICAgY2VydCBuaWNrbmFtZSB0bzogc3Vic3lzdGVtQ2VydCBjZXJ0LXBr aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBMZGFwSnNzU1NMU29j a2V0OiBzZXQgY2xpZW50IGF1dGggY2VydCBuaWNrbmFtZQogICAgICAgICAgICAgICAgICAgICAg c3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0U2VsZWN0aW9uQ0I6IEVudGVyaW5nISA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogb2NzcFNpZ25p bmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAg IENhbmRpZGF0ZSBjZXJ0OiBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6 IGRlc2lyZWQgY2VydAogICAgICAgICAgICAgICAgICAgICAgZm91bmQgaW4gbGlzdDogc3Vic3lz dGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIw MTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAg ICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiByZXR1cm5pbmc6CiAgICAgICAgICAg ICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAg ICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXTogU1NM CiAgICAgICAgICAgICAgICAgICAgICBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd OgogICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lLnNodXRkb3duKCkgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgSSByZWFsbHkgYXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJv dWdoCiAgICAgICAgICAgICAgICAgICAgICB0aGlzLsKgIEkgb3dlIHlvdS4gPGJyPgogICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgLSBJYW4gPGJyPgogICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+QWZ0ZXIgdGhhdCwgY2hlY2sgdGhhdCB0aGUKICAgICAgICAgICAgICAgICAg ICAgICAgTERBUCBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUgY2FzZSwKICAg ICAgICAgICAgICAgICAgICAgICAgeW91IHNob3VsZCBiZSBhYmxlIHRvIHJlc3RhcnQgcGtpLiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg RmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5UaGFuayB5b3UgYWdhaW4gZm9yIHlvdXIKICAg ICAgICAgICAgICAgICAgICAgICAgICB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIElhbiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPkZsby4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVv dGUgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hpY2gg c2VlbXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5UaGUgZGVz Y3JpcHRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdHRyaWJ1dGUgaW4gdGhl IGxkYXBzZWFyY2ggb3V0cHV0IGlzIG9mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg dGhlIGZvcm0gMjsjO0ROO0ROIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRo ZSBzZXJpYWwgbnVtYmVyIGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGZp cnN0IGNlcnR1dGlsIG91dHB1dCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51 cyB0aGUgQkVHSU4vRU5ECiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaGVhZGVycykg c2hvdWxkIG1hdGNoIG9uZSBvZiB0aGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHVzZXJDZXJ0aWZpY2F0ZSBhdHRyaWJ1dGVzLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJvYiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv dGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4KICAgICAgICAgICAgICAg ICAgRnJlZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAgICAgICAgICBj bGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICAgIGhyZWY9 Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAg ICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmc8L2E+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg VG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgICAgICAgICAgIGNs YXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiCiAgICAgICAgICAgICAgICAgICAgaHJlZj0i bWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAg ICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVA bGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18gPGJyPgogICAgICAgICAgICAgICAgRnJlZUlQ QS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10 eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVp cGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIKICAgICAgICAgICAgICAgICAgbW96LWRv LW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBUbyB1bnN1YnNjcmliZSBzZW5k IGFuIGVtYWlsIHRvIDxhCiAgICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstYWJi cmV2aWF0ZWQiCiAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxl YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qt c2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h PgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1l bnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgPHByZSB3 cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZy ZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2 aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmci IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQu b3JnPC9hPgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0 LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3Rz LmZlZG9yYWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1s ZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgPGJyPgog ICAgICAgIDxicj4KICAgICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50SGVhZGVy Ij48L2ZpZWxkc2V0PgogICAgICAgIDxicj4KICAgICAgICA8cHJlIHdyYXA9IiI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRnJlZUlQQS11c2VycyBtYWls aW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFp bHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5k PSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+ClRvIHVuc3Vi c2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRl ZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAg IDwvYmxvY2txdW90ZT4KICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K --===============5746937532678446188==-- From ianh at brownpapertickets.com Tue Aug 15 15:58:11 2017 Content-Type: multipart/mixed; boundary="===============8211899678962370089==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Tue, 15 Aug 2017 08:57:27 -0700 Message-ID: <1aff2b26-b84a-fa2b-b970-84919bbfa2eb@brownpapertickets.com> In-Reply-To: 7fc23432-e339-9b75-b9a6-ae4628f784e2@brownpapertickets.com --===============8211899678962370089== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/10/17 11:37 AM, Ian Harding via FreeIPA-users wrote: > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = > "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus > Enter LDAP Password: > dn: = > cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do= \3Dipac > a,cn=3Dmapping tree,cn=3Dconfig > nsds5replicaLastUpdateStatus: Error (32) Problem connecting to replica = > - LDAP > error: No such object (connection error) > > dn: = > cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do= \3Dipac > a,cn=3Dmapping tree,cn=3Dconfig > nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = > replica: > Replica has different database generation ID, remote replica may need = > to be i > nitialized (RUV error) > > and > > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = > "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus > Enter LDAP Password: > dn: = > cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\= 3Dipaca > ,cn=3Dmapping tree,cn=3Dconfig > nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = > replica: > Replica has different database generation ID, remote replica may need = > to be i > nitialized (RUV error) So I know I need to ipa-csreplica-manage re-initialize --from = freeipa-sea.bpt.rocks on seattlenfs, but also that it fails because of = the above. I think this is the root of the problem where the certificate is not = replicated. Anyone know how I can clean it up? I'm really sorry I've taken up so = much of your time. I really appreciate it. The freeipa-dal problem may or may not be related... [root(a)freeipa-sea ianh]# ipa-csreplica-manage list Directory Manager password: seattlenfs.bpt.rocks: master freeipa-dal.bpt.rocks: CA not configured freeipa-sea.bpt.rocks: master [root(a)freeipa-sea ianh]# ipa-csreplica-manage del freeipa-dal.bpt.rocks Directory Manager password: 'freeipa-sea.bpt.rocks' has no replication agreement for = 'freeipa-dal.bpt.rocks' [root(a)seattlenfs ~]# ipa-csreplica-manage list Directory Manager password: seattlenfs.bpt.rocks: master freeipa-dal.bpt.rocks: CA not configured freeipa-sea.bpt.rocks: master [root(a)seattlenfs ~]# ipa-csreplica-manage del freeipa-dal.bpt.rocks Directory Manager password: 'seattlenfs.bpt.rocks' has no replication agreement for = 'freeipa-dal.bpt.rocks' [root(a)seattlenfs ~]# ipa-replica-manage list-ruv Directory Manager password: Replica Update Vectors: seattlenfs.bpt.rocks:389: 21 freeipa-sea.bpt.rocks:389: 20 Certificate Server Replica Update Vectors: seattlenfs.bpt.rocks:389: 1290 freeipa-sea.bpt.rocks:389: 1065 --===============8211899678962370089==-- From tbordaz at redhat.com Wed Aug 16 12:25:16 2017 Content-Type: multipart/mixed; boundary="===============5165044645924626980==" MIME-Version: 1.0 From: thierry bordaz To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Wed, 16 Aug 2017 14:24:30 +0200 Message-ID: <5994397E.20408@redhat.com> In-Reply-To: 7fc23432-e339-9b75-b9a6-ae4628f784e2@brownpapertickets.com --===============5165044645924626980== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Ian > Hmm.. This looks odd. > > [root(a)seattlenfs ianh]# ipa-csreplica-manage re-initialize --from = > freeipa-sea.bpt.rocks > Directory Manager password: > > ipa: ERROR: Found multiple agreements for seattlenfs.bpt.rocks. Only = > initializing the first one returned: = > cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do= \=3Dipaca,cn=3Dmapping = > tree,cn=3Dconfig > Update in progress, 15 seconds elapsed > [freeipa-sea.bpt.rocks] reports: Update failed! Status: [32 - LDAP = > error: No such object] Here there are several replica agreement from freeipa-sea.bpt.rocks-> = seattlenfs (for o=3Dipaca suffix). I am not sure how this can happen. It could be some remaining entries from previous install/uninstall or = multiple initialization from different sources. Looking at the error below, I wonder if there were actually 2 replica = agreements freeipa-sea->seattlenfs that are * cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat * masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat Would you dump (on all servers freeipa-sea, seattlenfs and freeipa-dal): ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi best regards thierry > >> On freeipa-sea and seattlenfs you may check the ipaca replica = >> agreements status before/after reinit. I would guess they are = >> currently reporting failures between these two replicas. >> >> ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >> "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = >> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus >> > [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = > "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus > Enter LDAP Password: > dn: = > cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do= \3Dipac > a,cn=3Dmapping tree,cn=3Dconfig > nsds5replicaLastUpdateStatus: Error (32) Problem connecting to replica = > - LDAP > error: No such object (connection error) > > dn: = > cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do= \3Dipac > a,cn=3Dmapping tree,cn=3Dconfig > nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = > replica: > Replica has different database generation ID, remote replica may need = > to be i > nitialized (RUV error) > > and > > [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = > -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = > "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus > Enter LDAP Password: > dn: = > cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\= 3Dipaca > ,cn=3Dmapping tree,cn=3Dconfig > nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = > replica: > Replica has different database generation ID, remote replica may need = > to be i > nitialized (RUV error) > > >>> >>> several times over the years when replication has stopped. >>> >>> Replication actually is working, as far as user and machine accounts = >>> and attributes are concerned anyway, and has been for a while. >>> >>> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid = >>> of... it shows up in the GUI on the Topology page but generates a = >>> Server not found error. I don't know if that's related. >> >> Zombie servers have been discussed a lot on this mailing list. You = >> may get rid of them with list-ruv/clean-ruv subcommand. Replication = >> usually manage to work fine even if some zombie entries exist but it = >> is a good practice to clean them. > Yeah, I've been through every possible combination of = > list-ruv/clean-ruv. I have something odd going on in that no = > replication agreements show up anywhere for freeipa-dal. >> >> regards >> thierry >>>> >>>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote: >>>>> >>>>> On 8/7/17 1:44 AM, thierry bordaz wrote: >>>>> >>>>>> >>>>>> >>>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users = >>>>>> wrote: >>>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>>>>>>> >>>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>>>>>>> Ian Harding wrote: >>>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via = >>>>>>>>>>>>>>>>>>> FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server that = >>>>>>>>>>>>>>>>>>>>>> had apparently had >>>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl = >>>>>>>>>>>>>>>>>>>>>> says pki-tomcatd >>>>>>>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be running: >>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat = >>>>>>>>>>>>>>>>>>>>> can run without >>>>>>>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to see = >>>>>>>>>>>>>>>>>>>>> what is going on. >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication = >>>>>>>>>>>>>>>>>>>> failed (49) >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server = >>>>>>>>>>>>>>>>>>> and needs to >>>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check = >>>>>>>>>>>>>>>>>>> how this >>>>>>>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with a = >>>>>>>>>>>>>>>>>>> ssl >>>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a = >>>>>>>>>>>>>>>>>>> bind DN and >>>>>>>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base = >>>>>>>>>>>>>>>>>>> -Y EXTERNAL >>>>>>>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> I found this: >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeople= ,o=3Dipaca = >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>>>>>>> ... >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a = >>>>>>>>>>>>>>>>>> prompt to provide >>>>>>>>>>>>>>>>>> a pin/password >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for = >>>>>>>>>>>>>>>>>> security token 'ldap(0)': >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and the = >>>>>>>>>>>>>>>>> password can be >>>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf = >>>>>>>>>>>>>>>>> (with the tag >>>>>>>>>>>>>>>>> internal=3D...) >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> Can you check if the password with the tag = >>>>>>>>>>>>>>>>> internal=3D... allows to read >>>>>>>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>> (provide password) >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> That works... >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot = >>>>>>>>>>>>>>>> "NSS User Private >>>>>>>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 (orphan) >>>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>>>>>>>>>>>> caSigningCert >>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f = >>>>>>>>>>>>>>>> Server-Cert >>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> But this doesn't (with the same password from = >>>>>>>>>>>>>>>> password.conf) >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y = >>>>>>>>>>>>>>>> EXTERNAL >>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for security = >>>>>>>>>>>>>>>> token 'ldap(0)': >>>>>>>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> That password is getting me somewhere though, since if = >>>>>>>>>>>>>>>> I put in a >>>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over and = >>>>>>>>>>>>>>>> over. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>>>>>>> >>>>>>>>>>>>>> There wasn't much of a change... I just assumed someone = >>>>>>>>>>>>>> ran yum upgrade and didn't restart, then the power = >>>>>>>>>>>>>> outage... it looks like not much of a version change though. >>>>>>>>>>>>>> >>>>>>>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:46:06 Updated: = >>>>>>>>>>>>>> libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>>> Jan 08 04:46:08 Installed: = >>>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>>>>>>> Jul 28 09:55:41 Updated: = >>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:46 Updated: = >>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>> >>>>>>>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>>>>>>> Jan 08 04:47:19 Installed: = >>>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>> Jul 28 10:13:17 Updated: = >>>>>>>>>>>>>> pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>>>>>>> >>>>>>>>>>>>>> # getenforce >>>>>>>>>>>>>> Enforcing >>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> If so can you run: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use = >>>>>>>>>>>>>> the write_logs option. >>>>>>>>>>>>>> The NOLOG option is overriding the write_logs current = >>>>>>>>>>>>>> setting. >>>>>>>>>>>>>> ---- >>>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): = >>>>>>>>>>>>>> arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-13 = >>>>>>>>>>>>>> a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0 items=3D= 0 = >>>>>>>>>>>>>> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 = >>>>>>>>>>>>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D581400001 = >>>>>>>>>>>>>> sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D4294967295 = >>>>>>>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { = >>>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_keys= " = >>>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 = >>>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and = >>>>>>>>>>>>>>> everything wasn't >>>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>>>>>>> upgrade it just >>>>>>>>>>>>>>> shone a spotlight on it. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Can you run these commands: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descr= iption >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> This returns >>>>>>>>>>>>>> >>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descri= ption >>>>>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>>>>> userCertificate:: = >>>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>>>>> ... stuff ... >>>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>>>>> description: 2;4;CN=3DCertificate = >>>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>>>>>>>>>> >>>>>>>>>>>>>>> and >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>>> 'subsystemCert >>>>>>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> These both return >>>>>>>>>>>>>> >>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial >>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>> certutil: problem listing keys: = >>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. >>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot = >>>>>>>>>>>>>> "NSS User Private Key and Certificate Services" >>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>> certutil: problem listing keys: = >>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. >>>>>>>>>>>>>> >>>>>>>>>>>>> Hi, >>>>>>>>>>>>> >>>>>>>>>>>>> you made a typo and requested the keys (-K) instead of the = >>>>>>>>>>>>> certs (-L). Please retry with -L and you should be able to = >>>>>>>>>>>>> see the certificate serial. >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca = >>>>>>>>>>>> userCertificate description >>>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>>> userCertificate:: = >>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>>> ... >>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN= =3DCA = >>>>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>>>> >>>>>>>>>>>> So the serial is 4? >>>>>>>>>>>> >>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>>>>> grep Serial >>>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>>>>> >>>>>>>>>>>> Which is NOT 4... >>>>>>>>>>>> >>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>> -----BEGIN CERTIFICATE----- >>>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDA= lC = >>>>>>>>>>>> >>>>>>>>>>>> ... >>>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>>>>>> -----END CERTIFICATE----- >>>>>>>>>>>> >>>>>>>>>>>> And this cert is NOT the same. >>>>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>>>>>>> post-save commands (which you can see in the output of = >>>>>>>>>>> getcert list). In your case, the post-save command for = >>>>>>>>>>> subsystemCert cert-pki-ca probably failed. >>>>>>>>>>> >>>>>>>>>>> This command (on the renewal master) is responsible for = >>>>>>>>>>> copying the new cert from the NSS db to the LDAP server. You = >>>>>>>>>>> need first to check which IPA server is the renewal master = >>>>>>>>>>> (as the serial numbers are in a completely different range, = >>>>>>>>>>> I assume that you have multiple IPA servers configured with = >>>>>>>>>>> a CA instance): >>>>>>>>>>> >>>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut -d= =3D = >>>>>>>>>>> -f2-` >>>>>>>>>>> $ kinit admin >>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>>>> dn: = >>>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,c= n=3Detc,dc=3Dipadomain,dc=3Dcom = >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> In this example the renewal master is vm-ipaserver. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I get this >>>>>>>>>> >>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>>> dn: = >>>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3Det= c,dc=3Dbpt,dc=3Drocks = >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Which is the other FreeIPA server. >>>>>>>>>> >>>>>>>>> Hi Ian, >>>>>>>>> >>>>>>>>> it's getting difficult to follow this thread, so could we step = >>>>>>>>> back and summarize? >>>>>>>> Yes, it is. Sorry. >>>>>>>>> >>>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component is = >>>>>>>>> installed and 'subsystemCert cert-pki-ca' has Serial number 4 = >>>>>>>>> in the NSSDB /etc/pki/pki-tomcat/alias >>>>>>>> No? >>>>>>>> >>>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d = >>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep = >>>>>>>> Serial >>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has = >>>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>>>>>>> Yes >>>>>>>> >>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | grep = >>>>>>>> Serial >>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>> >>>>>>>>> >>>>>>>>> - In the LDAP servers, the cert is stored in the entry = >>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e. = it = >>>>>>>>> is the cert from freeipa-sea). >>>>>>>> This is where the difference is. There are two certificates on = >>>>>>>> the master and only one on the other. I wonder if this is a = >>>>>>>> result of the slow motion replication trainwreck I have going = >>>>>>>> on due to a zombie replica in the ldap database that no longer = >>>>>>>> exists in the real world and I can't seem to get rid of. >>>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> the remaining issue is a replication problem. There is a = >>>>>>> "Troubleshooting replication" section [1] in IdM Admin guide = >>>>>>> that may help you. >>>>>>> >>>>>>> Regarding your zombie replica, which commands did you use to try = >>>>>>> to remove it, and what was the output? >>>>>>> >>>>>>> Flo >>>>>>> >>>>>>> [1] = >>>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Li= nux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-ge= n-replication.html >>>>>>> >>>>>> >>>>>> Hi, >>>>>> >>>>>> To debug replication latency or problem we would need several = >>>>>> info but starting with the results of the following commands >>>>>> >>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>> -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> nscpentrywsi: = >>>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: >>>>> 75274897 >>>>> nscpentrywsi: = >>>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 >>>>> 90004: 20170608055334Z >>>>> nscpentrywsi: = >>>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 >>>>> 003: cn=3DDirectory Manager >>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>>>> nscpentrywsi: cn: pkidbuser >>>>> nscpentrywsi: createTimestamp: 20150716125146Z >>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>>>> nscpentrywsi: description;vucsn-5938e688000104290001: = >>>>> 2;1341718541;CN=3DCertific >>>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = >>>>> 2;4;CN=3DCertifica >>>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>> nscpentrywsi: mail: >>>>> nscpentrywsi: objectClass: top >>>>> nscpentrywsi: objectClass: person >>>>> nscpentrywsi: objectClass: organizationalPerson >>>>> nscpentrywsi: objectClass: inetOrgPerson >>>>> nscpentrywsi: objectClass: cmsuser >>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>> nscpentrywsi: sn: pkidbuser >>>>> nscpentrywsi: uid: pkidbuser >>>>> nscpentrywsi: userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>>>> >>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = >>>>> MIIDbjCCAlagAwIBAgI >>>>> >>>>> AR >>>>> nscpentrywsi: userPassword:: >>>>> nscpentrywsi: userstate: 1 >>>>> nscpentrywsi: usertype: agentType >>>>> nscpentrywsi: parentid: 2 >>>>> nscpentrywsi: entryid: 51 >>>>>> and >>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>>>> >>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>>>> Enter LDAP Password: >>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>> nscpentrywsi: userCertificate:: = >>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>>>> >>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>> nscpentrywsi: description: 2;4;CN=3DCertificate = >>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs >>>>> ystem,O=3DBPT.ROCKS >>>>> nscpentrywsi: entryid: 51 >>>>> nscpentrywsi: parentid: 2 >>>>> nscpentrywsi: modifyTimestamp: 20150716125146Z >>>>> nscpentrywsi: createTimestamp: 20150716125146Z >>>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager >>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>>>> nscpentrywsi: userPassword:: >>>>> nscpentrywsi: userstate: 1 >>>>> nscpentrywsi: usertype: agentType >>>>> nscpentrywsi: mail: >>>>> nscpentrywsi: cn: pkidbuser >>>>> nscpentrywsi: sn: pkidbuser >>>>> nscpentrywsi: uid: pkidbuser >>>>> nscpentrywsi: objectClass: top >>>>> nscpentrywsi: objectClass: person >>>>> nscpentrywsi: objectClass: organizationalPerson >>>>> nscpentrywsi: objectClass: inetOrgPerson >>>>> nscpentrywsi: objectClass: cmsuser >>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>>>> nscpentrywsi: entryusn: 86 >>>>>> >>>>>> From the output you may only copy/past the ones related to = >>>>>> userCertificate >>>>>> >>>>>> >>>>>> Also to dump the current replication status, send the result of >>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>> manager' -W -b = >>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ff= ffffff-ffffffff-ffffffff))" >>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>> -W -b "o=3Dipaca" = >>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff= f-ffffffff))" >>>>> Enter LDAP Password: >>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>>>> cn: replica >>>>> nsDS5Flags: 1 >>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>>> cloneAgreement1-freeipa-sea.bpt.roc >>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>>> masterAgreement1-seattlenfs.bpt.roc >>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>>> nsDS5ReplicaId: 1065 >>>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 >>>>> nsDS5ReplicaRoot: o=3Dipaca >>>>> nsDS5ReplicaType: 3 >>>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D= =3D >>>>> nsds5replicabinddngroup: cn=3Dreplication = >>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>>>> dc=3Drocks >>>>> nsds5replicabinddngroupcheckinterval: 60 >>>>> objectClass: top >>>>> objectClass: nsDS5Replica >>>>> objectClass: extensibleobject >>>>> nsds50ruv: {replicageneration} 57c291d9000004290000 >>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>>>> 57f840bf00000429000 >>>>> 0 598a1c40000104290000 >>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >>>>> nsds5agmtmaxcsn: = >>>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat >>>>> tlenfs.bpt.rocks;389;unavailable >>>>> nsds5agmtmaxcsn: = >>>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat >>>>> tlenfs.bpt.rocks;389;unavailable >>>>> nsruvReplicaLastModified: {replica 1065 = >>>>> ldap://freeipa-sea.bpt.rocks:389} 598a >>>>> 1c16 >>>>> nsruvReplicaLastModified: {replica 1290 = >>>>> ldap://seattlenfs.bpt.rocks:389} 00000 >>>>> 000 >>>>> nsds5ReplicaChangeCount: 885 >>>>> nsds5replicareapactive: 0 >>>>>> and >>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>>> -W -b = >>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ff= ffffff-ffffffff-ffffffff))" >>>>> >>>>> >>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' = >>>>> -W -b "o=3Dipaca" = >>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-fffffff= f-ffffffff))" >>>>> Enter LDAP Password: >>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>>>> cn: replica >>>>> nsDS5Flags: 1 >>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>>> cloneAgreement1-seattlenfs.bpt.rock >>>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>>> nsDS5ReplicaId: 1290 >>>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 >>>>> nsDS5ReplicaRoot: o=3Dipaca >>>>> nsDS5ReplicaType: 3 >>>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D= =3D >>>>> nsds5replicabinddngroup: cn=3Dreplication = >>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>>>> dc=3Drocks >>>>> nsds5replicabinddngroupcheckinterval: 60 >>>>> objectClass: top >>>>> objectClass: nsDS5Replica >>>>> objectClass: extensibleobject >>>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = >>>>> 57be804c0000050a0000 >>>>> 587236150000050a0000 >>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>>>> 57b103d400000429000 >>>>> 0 57be8043000704290000 >>>>> nsds5agmtmaxcsn: = >>>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei >>>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000 >>>>> nsruvReplicaLastModified: {replica 1290 = >>>>> ldap://seattlenfs.bpt.rocks:389} 00000 >>>>> 000 >>>>> nsruvReplicaLastModified: {replica 1065 = >>>>> ldap://freeipa-sea.bpt.rocks:389} 0000 >>>>> 0000 >>>>> nsds5ReplicaChangeCount: 3 >>>>> nsds5replicareapactive: 0 >>>>>> >>>>>> Regards >>>>>> thierry >>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertifica= te = >>>>>>>> description >>>>>>>> Enter LDAP Password: >>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>> userCertificate:: = >>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>> >>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>> userCertificate:: = >>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>> description: 2;1341718541;CN=3DCertificate = >>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem >>>>>>>> ,O=3DBPT.ROCKS >>>>>>>> >>>>>>>> >>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertifica= te = >>>>>>>> description >>>>>>>> Enter LDAP Password: >>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>> userCertificate:: = >>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>> >>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>> Subsystem,O=3DBPT.RO >>>>>>>> CKS >>>>>>>> >>>>>>>>> If you check the certificates dates, I guess that the most = >>>>>>>>> recent one is on server seattlenfs (because of serial = >>>>>>>>> numbers). Can you confirm this (because our goal is to have = >>>>>>>>> the most recent cert stored in all the NSSDBs and in LDAP)? >>>>>>>>> >>>>>>>>> Thanks, >>>>>>>>> Flo >>>>>>>>> >>>>>>>>> >>>>>>>>>>> If your renewal master is the machine on which the NSS DB = >>>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you = >>>>>>>>>>> can manually run the scripts: >>>>>>>>>> >>>>>>>>>> If I'm interpreting this correctly, then it is... so I ran = >>>>>>>>>> this on the broken machine (seattlenfs) >>>>>>>>>> >>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert = >>>>>>>>>>> "subsystemCert cert-pki-ca" >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I ran this, it took a while, then I re-checked and the serial = >>>>>>>>>> still seems to be 4 >>>>>>>>>> >>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate description >>>>>>>>>> Enter LDAP Password: >>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>> userCertificate:: = >>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>> ... >>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DC= A = >>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>> >>>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>>>>>>> >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D = DEBUG = >>>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> restart at autoShutdown? false >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> autoShutdown crumb file path? = >>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> done init id=3Ddebug >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> initialized debug >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> initSubsystem id=3Dlog >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> ready to init id=3Dlog >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_au= dit) = >>>>>>>>>> >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> restart at autoShutdown? false >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> autoShutdown crumb file path? = >>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> done init id=3Dlog >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> initialized log >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> initSubsystem id=3Djss >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> ready to init id=3Djss >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> restart at autoShutdown? false >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> autoShutdown crumb file path? = >>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> done init id=3Djss >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> initialized jss >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> initSubsystem id=3Ddbs >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>> ready to init id=3Ddbs >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: = >>>>>>>>>> init() mEnableSerialMgmt=3Dtrue >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>> LdapBoundConnFactor(DBSubsystem) >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> LdapBoundConnFactory: init >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> LdapBoundConnFactory:doCloning true >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>>> init() >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>>> init begins >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>>> init ends >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>>>>>>> makeConnection errorIfDown is true >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> makeConnection: errorIfDown true >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP = >>>>>>>>>> Keep-Alive: true >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert = >>>>>>>>>> nickname to: subsystemCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> LdapJssSSLSocket: set client auth cert nickname subsystemCert = >>>>>>>>>> cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> SSLClientCertificatSelectionCB: Entering! >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate = >>>>>>>>>> cert: ocspSigningCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate = >>>>>>>>>> cert: subsystemCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>>>>>>> subsystemCert cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert = >>>>>>>>>> cert-pki-ca >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake = >>>>>>>>>> happened >>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>> CMSEngine.shutdown() >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> I really appreciate you sticking with me through this. I owe = >>>>>>>>>> you. >>>>>>>>>> >>>>>>>>>> - Ian >>>>>>>>>> >>>>>>>>>>> After that, check that the LDAP entry has been updated. If = >>>>>>>>>>> it is the case, you should be able to restart pki. >>>>>>>>>>> >>>>>>>>>>> Flo >>>>>>>>>>> >>>>>>>>>>>> Thank you again for your time! >>>>>>>>>>>> >>>>>>>>>>>> Ian >>>>>>>>>>>> >>>>>>>>>>>>> Flo. >>>>>>>>>>>>>> >>>>>>>>>>>>>> which seems weird. >>>>>>>>>>>>>> >>>>>>>>>>>>>>> The description attribute in the ldapsearch output is of = >>>>>>>>>>>>>>> the form 2;#;DN;DN >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> The # should match the serial number in the first = >>>>>>>>>>>>>>> certutil output >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should = >>>>>>>>>>>>>>> match one of the >>>>>>>>>>>>>>> userCertificate attributes. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> rob >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.o= rg >>>>>>>> To unsubscribe send an email to = >>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>>>> _______________________________________________ >>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org >>>>>>> To unsubscribe send an email to = >>>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >>>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahost= ed.org >>>> >>> >>> >>> >>> _______________________________________________ >>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahosted= .org >> > --===============5165044645924626980== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRm LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgSGkgSWFuPGJyPgogICAgPGJyPgogICAgPGJs b2NrcXVvdGUKICAgICAgY2l0ZT0ibWlkOjdmYzIzNDMyLWUzMzktOWI3NS1iOWE2LWFlNDYyOGY3 ODRlMkBicm93bnBhcGVydGlja2V0cy5jb20iCiAgICAgIHR5cGU9ImNpdGUiPiBIbW0uLiBUaGlz IGxvb2tzIG9kZC48YnI+CiAgICAgIDxicj4KICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMg aXBhLWNzcmVwbGljYS1tYW5hZ2UgcmUtaW5pdGlhbGl6ZSAtLWZyb20KICAgICAgZnJlZWlwYS1z ZWEuYnB0LnJvY2tzPGJyPgogICAgICBEaXJlY3RvcnkgTWFuYWdlciBwYXNzd29yZDogPGJyPgog ICAgICA8YnI+CiAgICAgIGlwYTogRVJST1I6IEZvdW5kIG11bHRpcGxlIGFncmVlbWVudHMgZm9y IHNlYXR0bGVuZnMuYnB0LnJvY2tzLgogICAgICBPbmx5IGluaXRpYWxpemluZyB0aGUgZmlyc3Qg b25lIHJldHVybmVkOgogICAgICBjbj1jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0LnJv Y2tzLXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXD1pcGFjYSxjbj1tYXBwaW5nCgogICAgICB0 cmVlLGNuPWNvbmZpZzxicj4KICAgICAgVXBkYXRlIGluIHByb2dyZXNzLCAxNSBzZWNvbmRzIGVs YXBzZWQ8YnI+CiAgICAgIFtmcmVlaXBhLXNlYS5icHQucm9ja3NdIHJlcG9ydHM6IFVwZGF0ZSBm YWlsZWQhIFN0YXR1czogWzMywqAgLQogICAgICBMREFQIGVycm9yOiBObyBzdWNoIG9iamVjdF08 YnI+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICBIZXJlIHRoZXJlIGFyZSBzZXZlcmFs IHJlcGxpY2EgYWdyZWVtZW50IGZyb20KICAgIGZyZWVpcGEtc2VhLmJwdC5yb2Nrcy0mZ3Q7IHNl YXR0bGVuZnMgKGZvciBvPWlwYWNhIHN1ZmZpeCkuPGJyPgogICAgSSBhbSBub3Qgc3VyZSBob3cg dGhpcyBjYW4gaGFwcGVuLiA8YnI+CiAgICBJdCBjb3VsZCBiZSBzb21lIHJlbWFpbmluZyBlbnRy aWVzIGZyb20gcHJldmlvdXMgaW5zdGFsbC91bmluc3RhbGwKICAgIG9yIG11bHRpcGxlIGluaXRp YWxpemF0aW9uIGZyb20gZGlmZmVyZW50IHNvdXJjZXMuPGJyPgogICAgPGJyPgogICAgTG9va2lu ZyBhdCB0aGUgZXJyb3IgYmVsb3csIEkgd29uZGVyIGlmIHRoZXJlIHdlcmUgYWN0dWFsbHkgMgog ICAgcmVwbGljYSBhZ3JlZW1lbnRzIGZyZWVpcGEtc2VhLSZndDtzZWF0dGxlbmZzIHRoYXQgYXJl IDxicj4KICAgIDx1bD4KICAgICAgPGxpPjx0dD5jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEu YnB0LnJvY2tzLXBraS10b21jYXQ8L3R0PjwvbGk+CiAgICAgIDxsaT48dHQ+bWFzdGVyQWdyZWVt ZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0PC90dD48L2xpPgogICAgPC91bD4K ICAgIDxwPldvdWxkIHlvdSBkdW1wIChvbiBhbGwgc2VydmVycyBmcmVlaXBhLXNlYSwgc2VhdHRs ZW5mcyBhbmQKICAgICAgZnJlZWlwYS1kYWwpOjxicj4KICAgIDwvcD4KICAgIDxwPjx0dD5sZGFw c2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICJjbj1y ZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnIiBuc2NwZW50cnl3 c2k8YnI+CiAgICAgIDwvdHQ+PC9wPgogICAgPHA+PHR0Pjxicj4KICAgICAgICBiZXN0IHJlZ2Fy ZHM8YnI+CiAgICAgICAgdGhpZXJyeTxicj4KICAgICAgPC90dD48L3A+CiAgICA8YmxvY2txdW90 ZQogICAgICBjaXRlPSJtaWQ6N2ZjMjM0MzItZTMzOS05Yjc1LWI5YTYtYWU0NjI4Zjc4NGUyQGJy b3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJAcmVkaGF0LmNvbSI+ IE9uCiAgICAgICAgZnJlZWlwYS1zZWEgYW5kIHNlYXR0bGVuZnMgeW91IG1heSBjaGVjayB0aGUg aXBhY2EgcmVwbGljYQogICAgICAgIGFncmVlbWVudHMgc3RhdHVzIGJlZm9yZS9hZnRlciByZWlu aXQuIEkgd291bGQgZ3Vlc3MgdGhleSBhcmUKICAgICAgICBjdXJyZW50bHkgcmVwb3J0aW5nIGZh aWx1cmVzIGJldHdlZW4gdGhlc2UgdHdvIHJlcGxpY2FzLjxicj4KICAgICAgICA8YnI+CiAgICAg ICAgPHR0PmxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICI8 L3R0Pjx0dD5jbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCgogICAgICAgICAgdHJl ZSxjbj1jb25maWciICJvYmplY3RDbGFzcz1uc2RzNXJlcGxpY2F0aW9uYWdyZWVtZW50IgogICAg ICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgICAgIDxicj4KICAg ICAgICA8L3R0PjwvYmxvY2txdW90ZT4KICAgICAgPHR0Pltyb290QGZyZWVpcGEtc2VhIGlhbmhd IyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgIG1hbmFnZXInIC1XIC1i ICJjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgICAgdHJlZSxjbj1jb25m aWciICJvYmplY3RDbGFzcz1uc2RzNXJlcGxpY2F0aW9uYWdyZWVtZW50IgogICAgICAgIG5zZHM1 cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM8YnI+CiAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDog PGJyPgogICAgICAgIGRuOgpjbj1jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0LnJvY2tz LXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhYzxicj4KICAgICAgICDCoGEsY249bWFw cGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICBuc2RzNXJlcGxpY2FMYXN0VXBkYXRlU3Rh dHVzOiBFcnJvciAoMzIpIFByb2JsZW0gY29ubmVjdGluZyB0bwogICAgICAgIHJlcGxpY2EgLSBM REFQIDxicj4KICAgICAgICDCoGVycm9yOiBObyBzdWNoIG9iamVjdCAoY29ubmVjdGlvbiBlcnJv cik8YnI+CiAgICAgICAgPGJyPgogICAgICAgIGRuOgpjbj1tYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0 bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhYzxicj4KICAg ICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICBuc2RzNXJlcGxp Y2FMYXN0VXBkYXRlU3RhdHVzOiBFcnJvciAoMTkpIFJlcGxpY2F0aW9uIGVycm9yCiAgICAgICAg YWNxdWlyaW5nIHJlcGxpY2E6IDxicj4KICAgICAgICDCoFJlcGxpY2EgaGFzIGRpZmZlcmVudCBk YXRhYmFzZSBnZW5lcmF0aW9uIElELCByZW1vdGUgcmVwbGljYQogICAgICAgIG1heSBuZWVkIHRv IGJlIGk8YnI+CiAgICAgICAgwqBuaXRpYWxpemVkIChSVVYgZXJyb3IpPGJyPgogICAgICAgIDxi cj4KICAgICAgICBhbmQ8YnI+CiAgICAgICAgPGJyPgogICAgICAgIFtyb290QHNlYXR0bGVuZnMg aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgbWFuYWdlcicg LVcgLWIgImNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcKICAgICAgICB0cmVlLGNu PWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAgICAgICAg bnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czxicj4KICAgICAgICBFbnRlciBMREFQIFBhc3N3 b3JkOiA8YnI+CiAgICAgICAgZG46CmNuPWNsb25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5y b2Nrcy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1wzRGlwYWNhPGJyPgogICAgICAgIMKgLGNu PW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgbnNkczVyZXBsaWNhTGFzdFVwZGF0 ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBsaWNhdGlvbiBlcnJvcgogICAgICAgIGFjcXVpcmluZyBy ZXBsaWNhOiA8YnI+CiAgICAgICAgwqBSZXBsaWNhIGhhcyBkaWZmZXJlbnQgZGF0YWJhc2UgZ2Vu ZXJhdGlvbiBJRCwgcmVtb3RlIHJlcGxpY2EKICAgICAgICBtYXkgbmVlZCB0byBiZSBpPGJyPgog ICAgICAgIMKgbml0aWFsaXplZCAoUlVWIGVycm9yKTxicj4KICAgICAgICA8YnI+CiAgICAgIDwv dHQ+PGJyPgogICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk4QzJCNEYu MjAwMDIwMkByZWRoYXQuY29tIj48dHQ+CiAgICAgICAgPC90dD4KICAgICAgICA8YmxvY2txdW90 ZQogICAgICAgICAgY2l0ZT0ibWlkOmZlNTI1OWYzLWFlNGEtODM4OS01NDI1LTliODRiMTFiNzFk NUBicm93bnBhcGVydGlja2V0cy5jb20iCiAgICAgICAgICB0eXBlPSJjaXRlIj4gPGJyPgogICAg ICAgICAgc2V2ZXJhbCB0aW1lcyBvdmVyIHRoZSB5ZWFycyB3aGVuIHJlcGxpY2F0aW9uIGhhcyBz dG9wcGVkLsKgIDxicj4KICAgICAgICAgIDxicj4KICAgICAgICAgIFJlcGxpY2F0aW9uIGFjdHVh bGx5IGlzIHdvcmtpbmcsIGFzIGZhciBhcyB1c2VyIGFuZCBtYWNoaW5lCiAgICAgICAgICBhY2Nv dW50cyBhbmQgYXR0cmlidXRlcyBhcmUgY29uY2VybmVkIGFueXdheSwgYW5kIGhhcyBiZWVuIGZv cgogICAgICAgICAgYSB3aGlsZS48YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBUaGVyZSBp cyBhIHpvbWJpZSBzZXJ2ZXIgZnJlZWlwYS1kYWwuYnB0LnJvY2tzIHRoYXQgSSBjYW4ndAogICAg ICAgICAgZ2V0IHJpZCBvZi4uLiBpdCBzaG93cyB1cCBpbiB0aGUgR1VJIG9uIHRoZSBUb3BvbG9n eSBwYWdlIGJ1dAogICAgICAgICAgZ2VuZXJhdGVzIGEgU2VydmVyIG5vdCBmb3VuZCBlcnJvci7C oCBJIGRvbid0IGtub3cgaWYgdGhhdCdzCiAgICAgICAgICByZWxhdGVkLjxicj4KICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgPGJyPgogICAgICAgIFpvbWJpZSBzZXJ2ZXJzIGhhdmUgYmVl biBkaXNjdXNzZWQgYSBsb3Qgb24gdGhpcyBtYWlsaW5nIGxpc3QuCiAgICAgICAgWW91IG1heSBn ZXQgcmlkIG9mIHRoZW0gd2l0aCBsaXN0LXJ1di9jbGVhbi1ydXYgc3ViY29tbWFuZC4KICAgICAg ICBSZXBsaWNhdGlvbiB1c3VhbGx5IG1hbmFnZSB0byB3b3JrIGZpbmUgZXZlbiBpZiBzb21lIHpv bWJpZQogICAgICAgIGVudHJpZXMgZXhpc3QgYnV0IGl0IGlzIGEgZ29vZCBwcmFjdGljZSB0byBj bGVhbiB0aGVtLjxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICBZZWFoLCBJJ3ZlIGJlZW4g dGhyb3VnaCBldmVyeSBwb3NzaWJsZSBjb21iaW5hdGlvbiBvZgogICAgICBsaXN0LXJ1di9jbGVh bi1ydXYuwqAgSSBoYXZlIHNvbWV0aGluZyBvZGQgZ29pbmcgb24gaW4gdGhhdCBubwogICAgICBy ZXBsaWNhdGlvbiBhZ3JlZW1lbnRzIHNob3cgdXAgYW55d2hlcmUgZm9yIGZyZWVpcGEtZGFsLjxi cj4KICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAy MDJAcmVkaGF0LmNvbSI+IDxicj4KICAgICAgICByZWdhcmRzPGJyPgogICAgICAgIHRoaWVycnk8 YnI+CiAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgIGNpdGU9Im1pZDpmZTUyNTlmMy1hZTRh LTgzODktNTQyNS05Yjg0YjExYjcxZDVAYnJvd25wYXBlcnRpY2tldHMuY29tIgogICAgICAgICAg dHlwZT0iY2l0ZSI+CiAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6 NTk4QURFN0YuMzA4MDMwOEByZWRoYXQuY29tIj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICA8ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDA4LzA4LzIwMTcgMTA6MzMgUE0sIElh bgogICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMgd3JvdGU6PGJyPgogICAg ICAgICAgICA8L2Rpdj4KICAgICAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgICAgICBjaXRl PSJtaWQ6MmY2MGM0YWYtNjgwYy00MzgyLTk3MDQtNDFhMjRjODEyMWEyQGJyb3ducGFwZXJ0aWNr ZXRzLmNvbSIKICAgICAgICAgICAgICB0eXBlPSJjaXRlIj4KICAgICAgICAgICAgICA8bWV0YSBo dHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsKICAgICAgICAgICAg ICAgIGNoYXJzZXQ9dXRmLTgiPgogICAgICAgICAgICAgIDxwPk9uIDgvNy8xNyAxOjQ0IEFNLCB0 aGllcnJ5IGJvcmRheiB3cm90ZTo8YnI+CiAgICAgICAgICAgICAgPC9wPgogICAgICAgICAgICAg IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgICBjaXRlPSJtaWQ6NTk4ODI4 NzEuMTAwMDEwNkByZWRoYXQuY29tIj4KICAgICAgICAgICAgICAgIDxtZXRhIGNvbnRlbnQ9InRl eHQvaHRtbDsgY2hhcnNldD11dGYtOCIKICAgICAgICAgICAgICAgICAgaHR0cC1lcXVpdj0iQ29u dGVudC1UeXBlIj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+T24gMDgvMDcvMjAxNyAw OToyMiBBTSwKICAgICAgICAgICAgICAgICAgRmxvcmVuY2UgQmxhbmMtUmVuYXVkIHZpYSBGcmVl SVBBLXVzZXJzIHdyb3RlOjxicj4KICAgICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUKICAgICAgICAgICAgICAgICAgY2l0ZT0ibWlkOjMzMWVmYjY3LWRkM2It MjM1MC0zNDcwLTVkMWE5YjkyNTJjM0ByZWRoYXQuY29tIgogICAgICAgICAgICAgICAgICB0eXBl PSJjaXRlIj5PbiAwOC8wNC8yMDE3IDExOjAyIFBNLCBJYW4gSGFyZGluZyB2aWEKICAgICAgICAg ICAgICAgICAgRnJlZUlQQS11c2VycyB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj5PbiA4LzQvMTcgMjoxNiBBTSwgRmxvcmVuY2UKICAgICAgICAg ICAgICAgICAgICBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDMv MjAxNyAxMToxMyBQTSwgSWFuCiAgICAgICAgICAgICAgICAgICAgICBIYXJkaW5nIHZpYSBGcmVl SVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj5PbiAwOC8wMy8yMDE3IDEyOjI4IEFNLAogICAgICAgICAgICAgICAgICAgICAg ICBGbG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAxMTo1MSBQTSwKICAgICAg ICAgICAgICAgICAgICAgICAgICBJYW4gSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTog PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9u IDA4LzAyLzIwMTcgMTI6MTEKICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFNLCBGbG9yZW5j ZSBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAyLzIwMTcgMDE6NDMKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgQU0sIElhbiBIYXJkaW5nIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAxMjowMyBQTSwgUm9iIENyaXR0ZW5kZW4gd3Jv dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIj5JYW4gSGFyZGluZwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Jv dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPk9uIDA4LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgMDc6MzkgQU0sIEZsb3JlbmNlIEJsYW5jLVJlbmF1ZAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDA4LzAxLzIwMTcgMDM6MTEgUE0sIElhbiBIYXJkaW5nCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5PbgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMDgvMDEvMjAxNyAwMTo0OCBBTSwgRmxvcmVu Y2UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3 cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2Nr cXVvdGUgdHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgMDgvMDEvMjAxNyAwMTozMiBBTSwgSWFuCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+IDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgT24gMDcvMzEvMjAxNyAxMTozNCBBTSwg Um9iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ3JpdHRlbmRl biB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycwogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PkkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaGFkIGFu IHVuZXhwZWN0ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgcmVzdGFydCBvZiBhbiBJUEEgc2VydmVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHRoYXQgaGFkIGFwcGFyZW50bHkgaGFkCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXBkYXRlcyBydW4gYnV0IGhhZCBub3QKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmVlbiByZXN0YXJ0 ZWQuIGlwYWN0bAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBzYXlzIHBraS10b21jYXRkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgd291bGQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBub3Qgc3RhcnQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBTdHJhbmdlbHksIHRoZSBhY3R1YWwKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2VydmljZSBhcHBlYXJzIHRvIGJlCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJ1bm5pbmc6IDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIGlzIGFuIGFw cGxpY2F0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3 aXRoaW4gdG9tY2F0IHNvIHRvbWNhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgY2FuIHJ1biB3aXRob3V0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGRvZ3RhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBydW5uaW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBXZSBuZWVkIHRvIHNlZSBtb3JlIG9mIHRoZQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9ndGFnIGRlYnVnIGxvZyB0byBz ZWUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdoYXQgaXMg Z29pbmcgb24uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEl0IGxvb2tzIGxp a2UgYW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRoZW50 aWNhdGlvbiBwcm9ibGVtLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNTTCBoYW5kc2hha2UgaGFwcGVu ZWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENvdWxk IG5vdCBjb25uZWN0IHRvIExEQVAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBzZXJ2ZXIgaG9zdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHNlYXR0bGVuZnMuYnB0LnJvY2tzIHBvcnQKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA2MzYgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEVycm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgbmV0c2NhcGUubGRhcC5MREFQRXhjZXB0aW9uOgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhlbnRpY2F0aW9uIGZhaWxlZCAoNDkpIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGRvZ3RhZyBzdG9yZXMgaXRzIGludGVybmFsCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGRhdGEgaW4gdGhlIExEQVAgc2VydmVyIGFuZAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBuZWVkcyB0byA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGVzdGFibGlzaCBhIHNlY3VyZSBMREFQCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rpb24uIFlvdSBj YW4gY2hlY2sgaG93CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRo aXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25uZWN0 aW9uIGlzIGNvbmZpZ3VyZWQgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9jYS9DUy5jZmcsCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGxvb2sgZm9yIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOiA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xDbGllbnRBdXRoCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5iaW5kRE49 Y249RGlyZWN0b3J5CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE1h bmFnZXIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRl cm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5hbGRiCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5jbGllbnRDZXJ0Tmlja25hbWU9c3Vi c3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0 LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu dGVybmFsZGIubGRhcGNvbm4uaG9zdD12bS0uLi4KCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5wb3J0PTYzNiA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsZGIubGRhcGNvbm4uc2VjdXJlQ29ubgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgYXV0aHR5cGUgY2FuIGJlIFNzbENsaWVudEF1dGgKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGgg YSBzc2wgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0 aWZpY2F0ZSkgb3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIChhdXRoZW50aWNhdGlvbiB3aXRoIGEgYmluZCBETgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBhbmQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBwYXNzd29yZCBzdG9yZWQgaW4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29y ZC5jb25mKS4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlvdSBjYW4gdXNlIHRoaXMgaW5mb3JtYXRp b24KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdG8gbWFudWFsbHkg Y2hlY2sgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRl bnRpYWxzLiBGb3IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBpbnN0YW5jZSB3aXRoIHNzbGNsaWVudGF1dGg6IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBleHBvcnQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgTERBUFRMU19DQUNFUlRESVI9L2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcwogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBMREFQVExTX0NFUlQ9J3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBsZGFwc2VhcmNoIC1IIDxhCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJsZGFwczovLyIK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNl bmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXBzOi8v Ij5sZGFwczovLzwvYT48L2E+YGhvc3RuYW1lYDo2MzYKCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlkZSB0aGUgcGFzc3dvcmQg ZnJvbQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzL3B3ZGZpbGUudHh0KQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEkgZm91bmQgdGhpczogPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgaW50ZXJuYWxkYi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xD bGllbnRBdXRoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRo LmJpbmRETj11aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmJpbmRQV1Byb21wdD1pbnRlcm5hbGRiCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBpbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnRO aWNrbmFtZT1zdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBpbnRlcm5hbGRiLmxkYXBjb25uLmNsb25lUmVwbGljYXRpb25Qb3J0PTM4OQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGFuZCB3aGVuIEkgdHJ5IHRoZSBsZGFwc2VhcmNoIEkKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGFtIHByZXNlbnRlZCB3aXRoIGEgcHJvbXB0IHRvCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcm92aWRlIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGEgcGluL3Bhc3N3b3JkIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIFBsZWFzZSBlbnRlciBwaW4sIHBhc3N3b3JkLCBvcgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFzcyBwaHJhc2UgZm9yIHNlY3VyaXR5IHRv a2VuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnbGRhcCgwKSc6IDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZCBm aWxlLi4uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBhcmUg cmlnaHQsIGluIDQuNC4gdGhlcmUgaXMgbm8KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBwd2RmaWxlLnR4dCBhbmQgdGhlIHBhc3N3b3JkIGNhbgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGJlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBmb3VuZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2NvbmYvcGFzc3dvcmQuY29uZgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICh3aXRoIHRoZSB0YWcgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsPS4uLikgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBDYW4geW91IGNoZWNrIGlmIHRoZSBwYXNzd29yZCB3aXRoCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIHRhZyBpbnRlcm5hbD0uLi4gYWxsb3dzIHRv CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVhZCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGtleXMgZnJvbSB0aGUgTlNTIGRiPyA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWwgLUsgLWQK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0 L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAocHJvdmlk ZSBwYXNzd29yZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhhdCB3b3Jrcy4uLiA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIyBjZXJ0dXRpbCAtSyAtZAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IENoZWNraW5nIHRva2VuICJOU1MKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIHNsb3QgIk5TUyBV c2VyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFByaXZhdGUgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZp Y2VzIiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBhc3N3 b3JkIG9yIFBpbiBmb3IgIk5TUwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBD ZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Jmx0OyAwJmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMGYzMjdl NzYwYTdlZWNkY2Y2OTczZjVkYzU3Y2E1MzY3YzU5MmQ2NMKgwqAKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgKG9ycGhhbikgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAmbHQ7IDEmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBiMTI1ODBjN2M2OTZjZmNkOGFlZmM5NDA1YTdhODcwYjI0YjdiOTZhwqDCoAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQjphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtp LWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAyJmd0OyBy c2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgODgxYjcyNTRjNDBmYTQwYmM1 MDY4MWJjYzhkMzdiYjNlYjQ5OTM3ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Y2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7 IDMmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlhMjU1YTFk MTU1ODVhYzI4MDY0YzBmNDk4NmU0MTZiYzQ4NDAzwqDCoAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBEQjpvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAzZmI2MDlkMGY3ZDcyYzJkMzI1ZDZhMmRjMTY1NzdhN2Y3 ZTVhMDFmCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNlcnZlci1DZXJ0IDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDUmZ3Q7IHJzYQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAxZTk0NzlhOTU1NmFmOTMzOWJiNWU0NTUyY2Ni ZDM4MWQzYzM4ODU2wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOU1Mg Q2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBEQjpz dWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhp cyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHBhc3N3b3JkIGZyb20gcGFzc3dvcmQuY29uZikgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICMgbGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaHJlZj0ibGRhcHM6Ly8iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWZy ZWV0ZXh0IiBocmVmPSJsZGFwczovLyI+bGRhcHM6Ly88L2E+PC9hPmBob3N0bmFtZWA6NjM2Cgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtYiAiIiAtcyBiYXNlIC1ZIEVYVEVS TkFMIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUGxlYXNlIGVudGVy IHBpbiwgcGFzc3dvcmQsIG9yIHBhc3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgcGhyYXNlIGZvciBzZWN1cml0eSB0b2tlbiAnbGRhcCgwKSc6CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgU0FTTC9FWFRFUk5BTCBhdXRoZW50aWNhdGlvbiBzdGFydGVkCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgbGRhcF9zYXNsX2ludGVyYWN0aXZlX2JpbmRfczoKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSW52YWxpZCBjcmVkZW50aWFscyAoNDkpIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBUaGF0IHBhc3N3b3JkIGlzIGdldHRpbmcgbWUKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgc29tZXdoZXJlIHRob3VnaCwgc2luY2UgaWYgSSBwdXQgaW4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIG5vbnNlbnNlIG9yIGluY29ycmVjdCBwYXNzd29yZCBpdAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBqdXN0IHByb21wdHMgb3ZlciBhbmQgb3Zlci4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgTGV0J3Mgc3RlcCBiYWNrIGEgc2Vjb25kLiBZb3UgdXBncmFkZWQKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGZyb20gd2hhdCB0byB3aGF0PyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGVyZSB3 YXNuJ3QgbXVjaCBvZiBhIGNoYW5nZS4uLiBJIGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBhc3N1bWVkIHNvbWVvbmUgcmFuIHl1bSB1cGdyYWRlIGFuZAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGRpZG4ndCByZXN0YXJ0LCB0aGVuIHRoZSBwb3dlciBvdXRhZ2Uu Li4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdCBsb29rcyBsaWtlIG5vdCBtdWNo IG9mIGEgdmVyc2lvbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNoYW5nZSB0aG91 Z2guIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIyBncmVwIGlwYSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDU6MzIgSW5zdGFsbGVkOgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNl bnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVudC1jb21tb24tNC40LjAtMTQu ZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNiBVcGRhdGVk OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxpYmlwYV9oYmFjLTEuMTQuMC00My5l bDdfMy40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4 IDA0OjQ2OjA3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9u LWxpYmlwYV9oYmFjLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDgg MDQ6NDY6MDggSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhv bi1pcGFkZHJlc3MtMS4wLjE2LTIuZWw3Lm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA0IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2Fy Y2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IEluc3RhbGxlZDoKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQuMC0xNC5lbDcuY2VudG9zLjEu MS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjA1IFVwZGF0ZWQ6CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4x LjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxsZWQ6CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNl bnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNiBJbnN0YWxsZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQu ZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNyBVcGRhdGVk OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdf My40Lng4Nl82NCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0 OjQ3OjE3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNsaWVu dC00LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3 OjIzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci00 LjQuMC0xNC5lbDcuY2VudG9zLjEuMS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjI3 IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMt NC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0Nzoz NiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXB5dGhvbi1j b21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAw NDo1MDowNyBFcmFzZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXB5dGhv bi00LjIuMC0xNS4wLjEuZWw3LmNlbnRvcy4xOS54ODZfNjQKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5 OjU1OjQxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWNvbW1v bi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0 MiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29t bW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1 OjQzIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1j b21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6 NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlw YWxpYi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1 NTo0NCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBh Y2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5 OjU1OjQ1IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1p cGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjgg MDk6NTU6NDUgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtYWRt aW50b29scy00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAw OTo1NTo0NiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGll bnQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lng4Nl82NAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6 NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtc2VydmVyLTQu NC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ4IFVw ZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLXNlcnZlci1kbnMtNC40 LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDggVXBk YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpcGEtcHl0aG9uLWNvbXBhdC00 LjQuMC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAjIGdyZXAgcGtpIC92YXIvbG9nL3l1bS5sb2cgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowNSBVcGRhdGVkOgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLTEwLjMuMy0xNC5lbDdfMy5ub2Fy Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NjowOSBV cGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtyYjUtcGtpbml0LTEuMTQu MS0yNy5lbDdfMy54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph biAwOCAwNDo0NzoxOSBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg cGtpLWJhc2UtamF2YS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTkgVXBkYXRlZDoKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBwa2ktdG9vbHMtMTAuMy4zLTE0LmVsN18zLng4Nl82NCA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjIxIFVwZGF0ZWQ6CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQuZWw3XzMu bm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6 MjIgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMu My0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph biAwOCAwNDo0NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBr aS1jYS0xMC4zLjMtMTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBKdWwgMjggMTA6MTM6MTYgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKdWwgMjggMTA6MTM6MTcgVXBkYXRlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBwa2ktYmFzZS1qYXZhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2gg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRh dGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS10b29scy0xMC4zLjMtMTku ZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjgg MTA6MTM6MjEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktc2Vy dmVyLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIEp1bCAyOCAxMDoxMzoyMSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHBraS1rcmEtMTAuMy4zLTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgcGtpLWNhLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFyZSB5 b3UgcnVubmluZyBpbiBTRUxpbnV4IGVuZm9yY2luZwogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgbW9kZT8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxv Y2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIyBnZXRlbmZvcmNlIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBFbmZvcmNpbmcgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBl PSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSWYgc28gY2Fu IHlvdSBydW46IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0gQVZDIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0gQVZDIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGUgTk9MT0cgb3B0aW9uIHRvIGxv Z19mb3JtYXQgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXByZWNhdGVkLiBQ bGVhc2UgdXNlIHRoZSB3cml0ZV9sb2dzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg b3B0aW9uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlIE5PTE9HIG9w dGlvbiBpcyBvdmVycmlkaW5nIHRoZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdy aXRlX2xvZ3MgY3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGltZS0mZ3Q7 TW9uIE1hciAxNCAxMDozOTowMSAyMDE2IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB0eXBlPVNZU0NBTEwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtc2c9YXVk aXQoMTQ1Nzk3NzE0MS43Njc6MTc1MzcpOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0yIHN1Y2Nlc3M9bm8KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBleGl0PS0xMyBhMD03ZmJjYWIwMzhkMTAgYTE9ODAwIGEyPTEKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBhMz03ZmJjYTYwZjQyZTAgaXRlbXM9MCBwcGlkPTE0MDYK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaWQ9MTI5NjUgYXVpZD00Mjk0OTY3Mjk1 IHVpZD0wIGdpZD0wCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXVpZD01ODE0MDAw MDEgc3VpZD0wIGZzdWlkPTU4MTQwMDAwMQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGVnaWQ9NTgxNDAwMDAxIHNnaWQ9MCBmc2dpZD01ODE0MDAwMDEKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB0dHk9KG5vbmUpIHNlcz00Mjk0OTY3Mjk1IGNvbW09InNzaGQiCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBzdWJqPXN5c3RlbV91OnN5c3RlbV9yOnNzaGRfdDpzMC1z MDpjMC5jMTAyMwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtleT0obnVsbCkgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgbXNnPWF1ZGl0KDE0NTc5NzcxNDEuNzY3OjE3NTM3KTogYXZjOsKg CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVuaWVkIHsgcmVhZCB9IGZvciBwaWQ9 MTI5NjUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb21tPSJzc2hkIiBuYW1lPSJh dXRob3JpemVkX2tleXMiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGV2PSJkbS0y IiBpbm89MTE2MzkzNTE3CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2NvbnRleHQ9 c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgdGNvbnRleHQ9c3lzdGVtX3U6b2JqZWN0X3I6dW5sYWJlbGVkX3Q6czAK CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGNsYXNzPWZpbGUgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+SSBzdXNwZWN0IHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHRoZSBzdWJzeXN0ZW0gY2VydCB3YXMgcmVuZXdlZCBhbmQKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGV2ZXJ5dGhpbmcgd2Fzbid0IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHVwZGF0ZWQgcHJvcGVybHkuIElmIEknbSByaWdodCB0aGlzIGlzCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1bnJlbGF0ZWQgdG8gdGhlIHVwZ3JhZGUgaXQg anVzdCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBhIHNwb3Rs aWdodCBvbiBpdC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2FuIHlvdSBydW4gdGhlc2UgY29tbWFu ZHM6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3Rv cnkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1hbmFnZXInIC1XIC1iIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl LG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0 ZSBkZXNjcmlwdGlvbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBUaGlzIHJldHVybnMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249 ZGlyZWN0b3J5CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv PWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGRl c2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQ IFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG46IHVpZD1w a2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg TUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtE QWxDCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIC4uLiBzdHVmZiAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPmFuZCA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNl cnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9w a2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vi c3lzdGVtQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBr aS1jYScgfCBncmVwIFNlcmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAjIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj L3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxv Y2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgVGhlc2UgYm90aCByZXR1cm4gPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAj IGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kv cGtpLXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdzdWJz eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyB8IGdyZXAKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIFBh c3N3b3JkIG9yIFBpbiBmb3IgIk5TUwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENl cnRpZmljYXRlIERCIjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1 dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBTRUNfRVJST1JfVU5SRUNPR05JWkVEX09JRDogVW5yZWNvZ25pemVkCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwgLUsgLWQKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzwqAgLW4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j YScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnR1dGlsOiBDaGVj a2luZyB0b2tlbiAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNh dGUgREIiIGluIHNsb3QgIk5TUyBVc2VyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg UHJpdmF0ZSBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiOiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0gbGlzdGluZyBrZXlzOgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lEOiBV bnJlY29nbml6ZWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBPYmplY3QgSWRlbnRp Zmllci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBtYWRlIGEgdHlwbyBhbmQgcmVxdWVzdGVkIHRo ZSBrZXlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICgtSykgaW5zdGVhZCBvZiB0aGUg Y2VydHMgKC1MKS4gUGxlYXNlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHJ5IHdp dGggLUwgYW5kIHlvdSBzaG91bGQgYmUgYWJsZSB0bwogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBzZWUgdGhlIGNlcnRpZmljYXRlIHNlcmlhbC4gPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZSBkZXNjcmlwdGlvbiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj YSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6OgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhraUc5 dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0Zj PQoKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAg ICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgU3Vic3lzdGVtLE89QlBULlJPQ0tTIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNvIHRoZSBzZXJpYWwgaXMg ND8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAg ICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5 c3RlbUNlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAg U2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAg U2VyaWFsIE51bWJlcjogMTM0MTcxODU0MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgKDB4 NGZmOTAwMGQpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIFtyb290QHNlYXR0 bGVuZnMgaWFuaF0jIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAv ZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURB ME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICBzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBBbmQgdGhpcyBjZXJ0IGlzIE5P VCB0aGUgc2FtZS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAg ICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICB3aGVuIGNlcnRtb25nZXIgcmVuZXdzIGEgY2VydGlmaWNhdGUsIGl0IHJ1bnMK ICAgICAgICAgICAgICAgICAgICAgICAgICBwcmUtc2F2ZSBhbmQgcG9zdC1zYXZlIGNvbW1hbmRz ICh3aGljaCB5b3UgY2FuCiAgICAgICAgICAgICAgICAgICAgICAgICAgc2VlIGluIHRoZSBvdXRw dXQgb2YgZ2V0Y2VydCBsaXN0KS4gSW4geW91cgogICAgICAgICAgICAgICAgICAgICAgICAgIGNh c2UsIHRoZSBwb3N0LXNhdmUgY29tbWFuZCBmb3Igc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAg ICAgICAgICAgICAgIGNlcnQtcGtpLWNhIHByb2JhYmx5IGZhaWxlZC4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBUaGlzIGNvbW1h bmQgKG9uIHRoZSByZW5ld2FsIG1hc3RlcikgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICBy ZXNwb25zaWJsZSBmb3IgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbSB0aGUKICAgICAgICAgICAg ICAgICAgICAgICAgICBOU1MgZGIgdG8gdGhlIExEQVAgc2VydmVyLiBZb3UgbmVlZCBmaXJzdCB0 bwogICAgICAgICAgICAgICAgICAgICAgICAgIGNoZWNrIHdoaWNoIElQQSBzZXJ2ZXIgaXMgdGhl IHJlbmV3YWwgbWFzdGVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgKGFzIHRoZSBzZXJpYWwg bnVtYmVycyBhcmUgaW4gYSBjb21wbGV0ZWx5CiAgICAgICAgICAgICAgICAgICAgICAgICAgZGlm ZmVyZW50IHJhbmdlLCBJIGFzc3VtZSB0aGF0IHlvdSBoYXZlCiAgICAgICAgICAgICAgICAgICAg ICAgICAgbXVsdGlwbGUgSVBBIHNlcnZlcnMgY29uZmlndXJlZCB3aXRoIGEgQ0EKICAgICAgICAg ICAgICAgICAgICAgICAgICBpbnN0YW5jZSk6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgJCBleHBvcnQgQkFTRUROPWBncmVwIGJh c2VkbgogICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvaXBhL2RlZmF1bHQuY29uZiB8IGN1 dCAtZD0gLWYyLWAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQga2luaXQgYWRtaW4g PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBo b3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICAgICAgR1NTQVBJIC1iICJj bj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VETiIKICAgICAgICAgICAgICAgICAgICAgICAg ICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FSZW5ld2FsTWFzdGVyKSknCiAgICAg ICAgICAgICAgICAgICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIGRu OgogICAgICAgICAgICAgICAgICAgICAgICAgIGNuPUNBLGNuPXZtLWlwYXNlcnZlci5pcGFkb21h aW4uY29tLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0YyxkYz1pcGFkb21haW4sZGM9Y29tCgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgSW4gdGhpcyBleGFtcGxlIHRoZSByZW5ld2FsIG1h c3RlciBpcwogICAgICAgICAgICAgICAgICAgICAgICAgIHZtLWlwYXNlcnZlci4gPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9j a3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIEkgZ2V0IHRoaXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1oIGBob3N0bmFtZWAgLXAgMzg5 IC1ZCiAgICAgICAgICAgICAgICAgICAgICAgIEdTU0FQSSAtYiAiY249bWFzdGVycyxjbj1pcGEs Y249ZXRjLCRCQVNFRE4iCiAgICAgICAgICAgICAgICAgICAgICAgICcoJmFtcDsoY249Q0EpKGlw YUNvbmZpZ1N0cmluZz1jYVJlbmV3YWxNYXN0ZXIpKScKICAgICAgICAgICAgICAgICAgICAgICAg ZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBkbjoKICAgICAgICAgICAgICAgICAgICAg ICAgY249Q0EsY249ZnJlZWlwYS1zZWEuYnB0LnJvY2tzLGNuPW1hc3RlcnMsY249aXBhLGNuPWV0 YyxkYz1icHQsZGM9cm9ja3MKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIHRoZSBv dGhlciBGcmVlSVBBIHNlcnZlci4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICBI aSBJYW4sIDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgIGl0J3MgZ2V0dGluZyBkaWZmaWN1bHQgdG8gZm9sbG93IHRoaXMgdGhyZWFkLCBzbwogICAg ICAgICAgICAgICAgICAgICAgY291bGQgd2Ugc3RlcCBiYWNrIGFuZCBzdW1tYXJpemU/IDxicj4K ICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgWWVz LCBpdCBpcy7CoCBTb3JyeS4gPGJyPgogICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBh LXNlYSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlIENBCiAgICAgICAgICAgICAgICAgICAgICBjb21w b25lbnQgaXMgaW5zdGFsbGVkIGFuZCAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAg ICAgY2VydC1wa2ktY2EnIGhhcyBTZXJpYWwgbnVtYmVyIDQgaW4gdGhlIE5TU0RCCiAgICAgICAg ICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAgICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgTm8/IDxicj4KICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEg aWFuaF0jIGNlcnR1dGlsIC1MIC1kCiAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRv bWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAgICAgICAgICAgIGNlcnQtcGtp LWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAgICDCoMKgwqDCoMKgwqDC oMKgIFNlcmlhbCBOdW1iZXI6IDEzNDE3MTg1NDEgKDB4NGZmOTAwMGQpIDxicj4KICAgICAgICAg ICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4tIE9uIHNlcnZlciBzZWF0dGxlbmZz CiAgICAgICAgICAgICAgICAgICAgICAod2hlcmUgUEtJIGZhaWxzIHRvIHJlc3RhcnQpLCB0aGUg Q0EgY29tcG9uZW50IGlzCiAgICAgICAgICAgICAgICAgICAgICBpbnN0YWxsZWQgYW5kICdzdWJz eXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyBoYXMKICAgICAgICAgICAgICAgICAgICAgIFNlcmlhbCBu dW1iZXIgMTM0MTcxODU0MSBpbiB0aGUgTlNTREIKICAgICAgICAgICAgICAgICAgICAgIC9ldGMv cGtpL3BraS10b21jYXQvYWxpYXMuIDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv dGU+CiAgICAgICAgICAgICAgICAgICAgWWVzIDxicj4KICAgICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgY2VydHV0aWwgLUwg LWQKICAgICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uICdzdWJz eXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwg PGJyPgogICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAgU2VyaWFsIE51bWJlcjog MTM0MTcxODU0MSAoMHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgLSBJbiB0aGUgTERBUCBzZXJ2ZXJzLCB0aGUgY2VydCBpcyBzdG9yZWQgaW4g dGhlCiAgICAgICAgICAgICAgICAgICAgICBlbnRyeSB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv PWlwYWNhIHdpdGggU2VyaWFsCiAgICAgICAgICAgICAgICAgICAgICBudW1iZXIgNCAoaS5lLiBp dCBpcyB0aGUgY2VydCBmcm9tIGZyZWVpcGEtc2VhKS4gPGJyPgogICAgICAgICAgICAgICAgICAg IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICBUaGlzIGlzIHdoZXJlIHRoZSBkaWZm ZXJlbmNlIGlzLsKgIFRoZXJlIGFyZSB0d28KICAgICAgICAgICAgICAgICAgICBjZXJ0aWZpY2F0 ZXMgb24gdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24gdGhlCiAgICAgICAgICAgICAgICAgICAg b3RoZXIuwqAgSSB3b25kZXIgaWYgdGhpcyBpcyBhIHJlc3VsdCBvZiB0aGUgc2xvdwogICAgICAg ICAgICAgICAgICAgIG1vdGlvbiByZXBsaWNhdGlvbiB0cmFpbndyZWNrIEkgaGF2ZSBnb2luZyBv biBkdWUgdG8KICAgICAgICAgICAgICAgICAgICBhIHpvbWJpZSByZXBsaWNhIGluIHRoZSBsZGFw IGRhdGFiYXNlIHRoYXQgbm8gbG9uZ2VyCiAgICAgICAgICAgICAgICAgICAgZXhpc3RzIGluIHRo ZSByZWFsIHdvcmxkIGFuZCBJIGNhbid0IHNlZW0gdG8gZ2V0IHJpZAogICAgICAgICAgICAgICAg ICAgIG9mLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIEhpLCA8YnI+CiAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgdGhlIHJlbWFpbmluZyBpc3N1ZSBpcyBhIHJlcGxpY2F0 aW9uIHByb2JsZW0uIFRoZXJlIGlzCiAgICAgICAgICAgICAgICAgIGEgIlRyb3VibGVzaG9vdGlu ZyByZXBsaWNhdGlvbiIgc2VjdGlvbiBbMV0gaW4gSWRNCiAgICAgICAgICAgICAgICAgIEFkbWlu IGd1aWRlIHRoYXQgbWF5IGhlbHAgeW91LiA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgUmVnYXJkaW5nIHlvdXIgem9tYmllIHJlcGxpY2EsIHdoaWNoIGNvbW1h bmRzIGRpZCB5b3UKICAgICAgICAgICAgICAgICAgdXNlIHRvIHRyeSB0byByZW1vdmUgaXQsIGFu ZCB3aGF0IHdhcyB0aGUgb3V0cHV0PyA8YnI+CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICBbMV0gPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKaHJlZj0iaHR0cHM6Ly9h Y2Nlc3MucmVkaGF0LmNvbS9kb2N1bWVudGF0aW9uL2VuLVVTL1JlZF9IYXRfRW50ZXJwcmlzZV9M aW51eC83L2h0bWwvTGludXhfRG9tYWluX0lkZW50aXR5X0F1dGhlbnRpY2F0aW9uX2FuZF9Qb2xp Y3lfR3VpZGUvdHJvdWJsZS1nZW4tcmVwbGljYXRpb24uaHRtbCIKICAgICAgICAgICAgICAgICAg ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1l bnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFp bl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJl cGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBI aSw8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICBUbyBkZWJ1ZyByZXBs aWNhdGlvbiBsYXRlbmN5IG9yIHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAgICAgICAgICAgICAg c2V2ZXJhbCBpbmZvIGJ1dCBzdGFydGluZyB3aXRoIHRoZSByZXN1bHRzIG9mIHRoZQogICAgICAg ICAgICAgICAgZm9sbG93aW5nIGNvbW1hbmRzPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRAog ICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAg ICAgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiIG5zY3BlbnRyeXdzaTxicj4KICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEg aWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgICAgbWFu YWdlcicgLVcgLWIgInVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiCiAgICAgICAgICAg ICAgbnNjcGVudHJ5d3NpPGJyPgogICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxi cj4KICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYTxicj4K ICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv PWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaToKICAgICAgICAgICAgICBlbnRy eXVzbjthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNTt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDAw NToKICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgwqA3NTI3NDg5Nzxicj4KICAgICAg ICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgICAgICAgbW9kaWZ5VGltZXN0YW1wO2FkY3Nu LTU5MzhlNjg4MDAwMTA0MjkwMDA0O3Z1Y3NuLTU5MzhlNjg4MDAwMTA0Mjxicj4KICAgICAgICAg ICAgICDCoDkwMDA0OiAyMDE3MDYwODA1NTMzNFo8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOgogICAgICAgICAgICAgIG1vZGlmaWVyc05hbWU7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAw MDM7dnVjc24tNTkzOGU2ODgwMDAxMDQyOTA8YnI+CiAgICAgICAgICAgICAgwqAwMDM6IGNuPURp cmVjdG9yeSBNYW5hZ2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogbnNVbmlxdWVJ ZDoKICAgICAgICAgICAgICA0ODgwOWI0MC0yYmI5MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4K ICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGNuOiBwa2lkYnVzZXI8YnI+CiAgICAgICAgICAg ICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAg ICAgICAgICAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFn ZXI8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBkZXNjcmlwdGlvbjt2dWNzbi01OTM4 ZTY4ODAwMDEwNDI5MDAwMToKICAgICAgICAgICAgICAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWM8 YnI+CiAgICAgICAgICAgICAgwqBhdGUgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5 c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAg ICAgICAgZGVzY3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVsZXRlZDoKICAg ICAgICAgICAgICAyOzQ7Q049Q2VydGlmaWNhPGJyPgogICAgICAgICAgICAgIMKgdGUgQXV0aG9y aXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSxPPUJQVC5ST0NLUzxicj4KICAgICAgICAg ICAgICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog b2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENs YXNzOiBwZXJzb248YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczog b3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmpl Y3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9i amVjdENsYXNzOiBjbXN1c2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc2VlQWxz bzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRy eXdzaTogc246IHBraWRidXNlcjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVpZDog cGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlckNlcnRpZmljYXRl OjoKICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNG QURBME1SPGJyPgogICAgICAgICAgICAgICZsdDtzbmlwJmd0Ozxicj4KwqBjQmQ0bk9WNG05QStx UlpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz08YnI+CiAgICAg ICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyQ2VydGlmaWNhdGU7dnVjc24tNTkzOGU2ODgwMDAx MDQyOTAwMDA6OgogICAgICAgICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8YnI+CiAgICAgICAg ICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgogICAgICAgICAgICAgIMKgQVI8YnI+CiAgICAgICAgICAg ICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAg ICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAgICAgICAgICAgbnNjcGVu dHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdz aTogcGFyZW50aWQ6IDI8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBlbnRyeWlkOiA1 MTxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAgICAgICAgICAg ICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IGFuZDxicj4KICAgICAg ICAgICAgICAgIFtyb290QHNlYXR0bGVuZnMgaWFuaF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249 ZGlyZWN0b3J5CiAgICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiB1aWQ9cGtpZGJ1c2VyLG91 PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAg ICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICBbcm9v dEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAg ICAgICAgICAgIG1hbmFnZXInIC1XIC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EK ICAgICAgICAgICAgICBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgICAgICAgRW50ZXIgTERBUCBQ YXNzd29yZDogPGJyPgogICAgICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxv PWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIs b3U9cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNv OiBDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiB1c2VyQ2VydGlmaWNhdGU6OgogICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lC QkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICAgICAgICAgJmx0O3NuaXAmZ3Q7 PGJyPgrCoGNCZDRuT1Y0bTlBK3FSWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhk ZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uOiAy OzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049 Q0EgU3Viczxicj4KICAgICAgICAgICAgICDCoHlzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAg ICAgICAgIG5zY3BlbnRyeXdzaTogZW50cnlpZDogNTE8YnI+CiAgICAgICAgICAgICAgbnNjcGVu dHJ5d3NpOiBwYXJlbnRpZDogMjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG1vZGlm eVRpbWVzdGFtcDogMjAxNTA3MTYxMjUxNDZaPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdz aTogY3JlYXRlVGltZXN0YW1wOiAyMDE1MDcxNjEyNTE0Nlo8YnI+CiAgICAgICAgICAgICAgbnNj cGVudHJ5d3NpOiBtb2RpZmllcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAgICAg ICAgICAgICBuc2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8 YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZn dDs8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2Vyc3RhdGU6IDE8YnI+CiAgICAg ICAgICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAg ICAgIG5zY3BlbnRyeXdzaTogbWFpbDo8YnI+CiAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBj bjogcGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc246IHBraWRidXNl cjxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVpZDogcGtpZGJ1c2VyPGJyPgogICAg ICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgICAgICAg ICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICAgICAgICAgICAgbnNj cGVudHJ5d3NpOiBvYmplY3RDbGFzczogb3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICAgICAg ICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogaW5ldE9yZ1BlcnNvbjxicj4KICAgICAg ICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1c2VyPGJyPgogICAgICAgICAg ICAgIG5zY3BlbnRyeXdzaTogbnNVbmlxdWVJZDoKICAgICAgICAgICAgICA0ODgwOWI0MC0yYmI5 MTFlNS05NmEwYjhiOC0xZmRkODA3NDxicj4KICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGVu dHJ5dXNuOiA4Njxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAg ICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IDxicj4K ICAgICAgICAgICAgICAgIEZyb20gdGhlIG91dHB1dCB5b3UgbWF5IG9ubHkgY29weS9wYXN0IHRo ZSBvbmVzIHJlbGF0ZWQKICAgICAgICAgICAgICAgIHRvIHVzZXJDZXJ0aWZpY2F0ZTxicj4KICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIEFs c28gdG8gZHVtcCB0aGUgY3VycmVudCByZXBsaWNhdGlvbiBzdGF0dXMsIHNlbmQgdGhlCiAgICAg ICAgICAgICAgICByZXN1bHTCoCBvZjxicj4KICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEt c2VhIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICdjbj1kaXJlY3Rv cnkgbWFuYWdlcicgLVcgLWIgIm89aXBhY2EiPGZvbnQgc2l6ZT0iLTEiPjxpPgogICAgICAgICAg ICAgICAgICA8L2k+IigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSkobnNVbmlxdWVJZD1m ZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAgICAgICAgICAgICAg IDwvZm9udD48L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgW3Jvb3RAZnJlZWlwYS1zZWEgaWFu aF0jIGxkYXBzZWFyY2ggLUxMTCAtRCAnY249ZGlyZWN0b3J5CiAgICAgICAgICAgICAgbWFuYWdl cicgLVcgLWIgIm89aXBhY2EiCiIoJmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5p cXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAg ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgIGRuOiBjbj1yZXBs aWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgICAg ICAgIGNuOiByZXBsaWNhPGJyPgogICAgICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAg ICAgICAgICAgbnNEUzVSZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAgICAg ICAgICAgICAgY2xvbmVBZ3JlZW1lbnQxLWZyZWVpcGEtc2VhLmJwdC5yb2M8YnI+CiAgICAgICAg ICAgICAgwqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAgICAgICAg ICAgIG5zRFM1UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICAgICAg ICAgIG1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9jPGJyPgogICAgICAgICAgICAg IMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgICBu c0RTNVJlcGxpY2FJZDogMTA2NTxicj4KICAgICAgICAgICAgICBuc0RTNVJlcGxpY2FOYW1lOiBi MjFhMWYxZS02Mjc5MTFlNi05M2U2ZWY0Yi02OWRjYzJkMTxicj4KICAgICAgICAgICAgICBuc0RT NVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zRFM1UmVwbGljYVR5cGU6 IDM8YnI+CiAgICAgICAgICAgICAgbnNTdGF0ZTo6CiAgICAgICAgICAgICAgS1FRQUFBQUFBQUFo SElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAg ICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAgICAgICAgICAg ICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAgICAgICAgICAg ICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cGNo ZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgICAgICAgIG9iamVjdENsYXNzOiB0b3A8YnI+CiAg ICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgICAgICBv YmplY3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICAgICAgICBuc2RzNTBydXY6 IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTdjMjkxZDkwMDAwMDQyOTAwMDA8YnI+CiAgICAgICAgICAg ICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAg ICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAg ICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEt c2VhLmJwdC5yb2NrczozODk8L2E+fQogICAgICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8 YnI+CiAgICAgICAgICAgICAgwqAwIDU5OGExYzQwMDAwMTA0MjkwMDAwPGJyPgogICAgICAgICAg ICAgIG5zZHM1MHJ1djoge3JlcGxpY2EgMTI5MCA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiCiAg ICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAg ICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVu ZnMuYnB0LnJvY2tzOjM4OTwvYT59PGJyPgogICAgICAgICAgICAgIG5zZHM1YWdtdG1heGNzbjoK ICAgICAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9j a3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgICAgICAgICAgIMKgdGxlbmZzLmJwdC5yb2Nrczsz ODk7dW5hdmFpbGFibGU8YnI+CiAgICAgICAgICAgICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAg ICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2kt dG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgICAgICAgwqB0bGVuZnMuYnB0LnJvY2tzOzM4OTt1bmF2 YWlsYWJsZTxicj4KICAgICAgICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBs aWNhIDEwNjUgPGEKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQi CiAgICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OSIK ICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9Im1vei10eHQt bGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxk YXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPjwvYT59CiAgICAgICAgICAgICAgNTk4 YTxicj4KICAgICAgICAgICAgICDCoDFjMTY8YnI+CiAgICAgICAgICAgICAgbnNydXZSZXBsaWNh TGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICBjbGFzcz0ibW96 LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVu ZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ PGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMu YnB0LnJvY2tzOjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT48L2E+fQog ICAgICAgICAgICAgIDAwMDAwPGJyPgogICAgICAgICAgICAgIMKgMDAwPGJyPgogICAgICAgICAg ICAgIG5zZHM1UmVwbGljYUNoYW5nZUNvdW50OiA4ODU8YnI+CiAgICAgICAgICAgICAgbnNkczVy ZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj aXRlIgogICAgICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNv bSI+PGZvbnQgc2l6ZT0iLTEiPgogICAgICAgICAgICAgICAgICBhbmQ8YnI+CiAgICAgICAgICAg ICAgICA8L2ZvbnQ+W3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAg ICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iICJvPWlwYWNhIjxmb250 IHNpemU9Ii0xIj48aT4KICAgICAgICAgICAgICAgICAgPC9pPiIoJmFtcDsob2JqZWN0Y2xhc3M9 bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm ZmYpKSI8YnI+CiAgICAgICAgICAgICAgICA8L2ZvbnQ+PC9ibG9ja3F1b3RlPgogICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5m cyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICBt YW5hZ2VyJyAtVyAtYiAibz1pcGFjYSIKIigmYW1wOyhvYmplY3RjbGFzcz1uc3RvbWJzdG9uZSko bnNVbmlxdWVJZD1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZi1mZmZmZmZmZikpIjxicj4KICAg ICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAgICAgICAgZG46IGNu PXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAg ICAgICAgICAgY246IHJlcGxpY2E8YnI+CiAgICAgICAgICAgICAgbnNEUzVGbGFnczogMTxicj4K ICAgICAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIK ICAgICAgICAgICAgICBjbG9uZUFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9jazxicj4KICAg ICAgICAgICAgICDCoHMtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAg ICAgICAgICBuc0RTNVJlcGxpY2FJZDogMTI5MDxicj4KICAgICAgICAgICAgICBuc0RTNVJlcGxp Y2FOYW1lOiA4NzA2YWIxZS02YTgzMTFlNi1hOWJmZGJiZi03NGRjNzMyMzxicj4KICAgICAgICAg ICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAgIG5zRFM1UmVw bGljYVR5cGU6IDM8YnI+CiAgICAgICAgICAgICAgbnNTdGF0ZTo6CiAgICAgICAgICAgICAgQ2dV QUFBQUFBQUFLRllwWkFBQUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+ CiAgICAgICAgICAgICAgbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0aW9uCiAg ICAgICAgICAgICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsY249ZXRjLGRjPWJwdCw8YnI+CiAg ICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5k ZG5ncm91cGNoZWNraW50ZXJ2YWw6IDYwPGJyPgogICAgICAgICAgICAgIG9iamVjdENsYXNzOiB0 b3A8YnI+CiAgICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAg ICAgICAgICBvYmplY3RDbGFzczogZXh0ZW5zaWJsZW9iamVjdDxicj4KICAgICAgICAgICAgICBu c2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAwMDA8YnI+CiAg ICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1ub3Qtc2VuZD0i dHJ1ZSIKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAg ICAgICAgICAgICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8v c2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICA1N2JlODA0YzAwMDAw NTBhMDAwMDxicj4KICAgICAgICAgICAgICDCoCA1ODcyMzYxNTAwMDAwNTBhMDAwMDxicj4KICAg ICAgICAgICAgICBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNjUgPGEgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIgogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAg ICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5Ij5sZGFwOi8v ZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAgNTdiMTAzZDQwMDAw MDQyOTAwMDxicj4KICAgICAgICAgICAgICDCoDAgNTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAg ICAgICAgICAgICAgbnNkczVhZ210bWF4Y3NuOgogICAgICAgICAgICAgIG89aXBhY2E7Y2xvbmVB Z3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ7ZnJlZWk8YnI+CiAgICAg ICAgICAgICAgwqBwYS1zZWEuYnB0LnJvY2tzOzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAw PGJyPgogICAgICAgICAgICAgIG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTI5 MCA8YQogICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAg ICAgICAgICAgIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAg ICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJl ZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0 dGxlbmZzLmJwdC5yb2NrczozODk8L2E+PC9hPn0KICAgICAgICAgICAgICAwMDAwMDxicj4KICAg ICAgICAgICAgICDCoDAwMDxicj4KICAgICAgICAgICAgICBuc3J1dlJlcGxpY2FMYXN0TW9kaWZp ZWQ6IHtyZXBsaWNhIDEwNjUgPGEKICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmst ZnJlZXRleHQiCiAgICAgICAgICAgICAgICBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJv Y2tzOjM4OSIKICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEgY2xhc3M9 Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2Nr czozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPjwvYT59CiAgICAgICAg ICAgICAgMDAwMDxicj4KICAgICAgICAgICAgICDCoDAwMDA8YnI+CiAgICAgICAgICAgICAgbnNk czVSZXBsaWNhQ2hhbmdlQ291bnQ6IDM8YnI+CiAgICAgICAgICAgICAgbnNkczVyZXBsaWNhcmVh cGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIgogICAg ICAgICAgICAgICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+PGZvbnQg c2l6ZT0iLTEiPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIFJlZ2Fy ZHM8YnI+CiAgICAgICAgICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICAgICAgICA8L2Zv bnQ+CiAgICAgICAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgICAgICAgICBjaXRlPSJt aWQ6MzMxZWZiNjctZGQzYi0yMzUwLTM0NzAtNWQxYTliOTI1MmMzQHJlZGhhdC5jb20iCiAgICAg ICAgICAgICAgICAgIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj5bcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMKICAgICAgICAgICAgICAgICAgICBs ZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYgogICAgICAgICAg ICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgdXNlckNlcnRpZmljYXRl CiAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAg IEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBr aWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgdXNlckNl cnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5C Z2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsgPGJyPgogICAgICAg ICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhN Sm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAg ICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJQkFnSUVUL2tBRFRBTkJna3Foa2lHOXcwQkFRc0ZB REEwTVJJd0VBWURWUVFLCiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICZsdDt0cnVuY2F0ZWQmZ3Q7CiAgICAgICAgICAgICAgICAgICAgZnVRUVptUDFYcktrcmZz amVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAgICAgICAgIGRlc2NyaXB0 aW9uOiAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICBBdXRo b3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtIDxicj4KICAgICAgICAgICAgICAgICAg ICDCoCAsTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5o XSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBt YW5hZ2VyJyAtVyAtYgogICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxl LG89aXBhY2EgdXNlckNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24g PGJyPgogICAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAgUGFzc3dvcmQ6IDxicj4KICAgICAg ICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAg ICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICBN SUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RB bEMKICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3Ry dW5jYXRlZCZndDsgPGJyPgogICAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dE bDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJyPgogICAgICAgICAgICAgICAgICAgIGRl c2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAgICAgICAgICAgICBBdXRob3Jp dHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPIDxicj4KICAgICAgICAgICAg ICAgICAgICDCoCBDS1MgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlCiAgICAgICAg ICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZXMgZGF0ZXMsIEkgZ3Vlc3MgdGhhdCB0aGUgbW9zdCBy ZWNlbnQKICAgICAgICAgICAgICAgICAgICAgIG9uZSBpcyBvbiBzZXJ2ZXIgc2VhdHRsZW5mcyAo YmVjYXVzZSBvZiBzZXJpYWwKICAgICAgICAgICAgICAgICAgICAgIG51bWJlcnMpLiBDYW4geW91 IGNvbmZpcm0gdGhpcyAoYmVjYXVzZSBvdXIgZ29hbAogICAgICAgICAgICAgICAgICAgICAgaXMg dG8gaGF2ZSB0aGUgbW9zdCByZWNlbnQgY2VydCBzdG9yZWQgaW4gYWxsIHRoZQogICAgICAgICAg ICAgICAgICAgICAgTlNTREJzIGFuZCBpbiBMREFQKT8gPGJyPgogICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgVGhhbmtzLCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICBGbG8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPklmIHlv dXIgcmVuZXdhbCBtYXN0ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICBpcyB0aGUgbWFjaGlu ZSBvbiB3aGljaCB0aGUgTlNTIERCCiAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kv cGtpLXRvbWNhdC9hbGlhcyBjb250YWlucyB0aGUgbmV3ZXIKICAgICAgICAgICAgICAgICAgICAg ICAgICBjZXJ0LCB0aGVuIHlvdSBjYW4gbWFudWFsbHkgcnVuIHRoZSBzY3JpcHRzOiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBJZiBJJ20gaW50ZXJwcmV0aW5nIHRoaXMg Y29ycmVjdGx5LCB0aGVuIGl0CiAgICAgICAgICAgICAgICAgICAgICAgIGlzLi4uIHNvIEkgcmFu IHRoaXMgb24gdGhlIGJyb2tlbiBtYWNoaW5lCiAgICAgICAgICAgICAgICAgICAgICAgIChzZWF0 dGxlbmZzKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBzdWRvCiAgICAgICAgICAgICAgICAg ICAgICAgICAgL3Vzci9saWJleGVjL2lwYS9jZXJ0bW9uZ2VyL3N0b3BfcGtpY2FkIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAkIHN1ZG8KICAgICAgICAgICAgICAgICAgICAgICAgICAv dXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2FfY2VydAogICAgICAgICAgICAgICAg ICAgICAgICAgICJzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSSByYW4g dGhpcywgaXQgdG9vayBhIHdoaWxlLCB0aGVuIEkgcmUtY2hlY2tlZAogICAgICAgICAgICAgICAg ICAgICAgICBhbmQgdGhlIHNlcmlhbCBzdGlsbCBzZWVtcyB0byBiZSA0IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFyY2gg LUxMTCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XCiAgICAgICAgICAgICAgICAgICAgICAg IC1iIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAg ICAgdXNlckNlcnRpZmljYXRlIGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBkbjog dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1 Z0F3SUJBZ0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIC4uLiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgIMKgIFpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThY RW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICBkZXNjcmlwdGlvbjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAg ICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5ST0NLUztDTj1DQQogICAgICAgICAgICAgICAgICAg ICAgICBTdWJzeXN0ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIEhlcmUncyB3aGF0IHdhcyBpbgogICAgICAgICAg ICAgICAgICAgICAgICAvdmFyL2xvZy9wa2kvcGtpLXRvbWNhdC9jYS9kZWJ1ZyA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAg ICAgICA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PSA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0 YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgPT09PT3CoCBERUJVRyBTVUJTWVNU RU0gSU5JVElBTElaRUTCoMKgID09PT09PT0gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBb MDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAg ICAgICAgICAgICAgID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJl c3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAg ICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRoPwog ICAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9T aHV0ZG93bi5jcnVtYgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0 IGZvcgogICAgICAgICAgICAgICAgICAgICAgICBhdXRvLXNodXRkb3duIHN1cHBvcnQ6YXVkaXRT aWduaW5nQ2VydAogICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0 U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0OmF1 ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1z dGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogZG9uZSBpbml0 IGlkPWRlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUy OjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNF bmdpbmU6IGluaXRpYWxpemVkIGRlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9bG9nIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9 bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwog ICAgICAgICAgICAgICAgICAgICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRv bWNhdC9sb2dzL2NhL3NpZ25lZEF1ZGl0L2NhX2F1ZGl0KQogICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ3JlYXRpbmcKICAg ICAgICAgICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21j YXQvbG9ncy9jYS9zeXN0ZW0pCiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAgICAgICAg ICAgICBSb2xsaW5nTG9nRmlsZSgvdmFyL2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2NhL3RyYW5z YWN0aW9ucykKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAg ICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVzdGFydCBhdCBhdXRvU2h1dGRvd24/IGZh bHNlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6 IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAgICAgICAgICAgIC92 YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvYXV0b1NodXRkb3duLmNydW1iCiAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBD TVNFbmdpbmU6IGFib3V0IHRvIGxvb2sgZm9yIGNlcnQgZm9yCiAgICAgICAgICAgICAgICAgICAg ICAgIGF1dG8tc2h1dGRvd24gc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAg ICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1 Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAg ICAgICAgICBDTVNFbmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2VydAogICAgICAgICAg ICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFsw My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAg ICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQgaWQ9bG9nIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd OgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRpYWxpemVkIGxvZyA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0U3Vi c3lzdGVtIGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAg Q01TRW5naW5lOiByZWFkeSB0byBpbml0IGlkPWpzcyA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0ZG93bj8gZmFs c2UgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog YXV0b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgICAgICAgICAgICAgL3Zh ci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1bWIKICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENN U0VuZ2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IKICAgICAgICAgICAgICAgICAgICAg ICAgYXV0by1zaHV0ZG93biBzdXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAg ICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg ICAgICAgIENNU0VuZ2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAg ICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgICAgICBDTVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 CiAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQganNzIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJz eXN0ZW0gaWQ9ZGJzIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEz OjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBD TVNFbmdpbmU6IHJlYWR5IHRvIGluaXQgaWQ9ZGJzIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg ICAgICAgICAgICAgICAgICBEQlN1YnN5c3RlbTogaW5pdCgpIG1FbmFibGVTZXJpYWxNZ210PXRy dWUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nIExk YXBCb3VuZENvbm5GYWN0b3IoREJTdWJzeXN0ZW0pIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg ICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTogaW5pdCA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3Rv cC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgTGRhcEJvdW5kQ29ubkZhY3Rvcnk6ZG9DbG9u aW5nIHRydWUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6 NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIExkYXBB dXRoSW5mbzogaW5pdCgpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3 OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAg ICBMZGFwQXV0aEluZm86IGluaXQgYmVnaW5zIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg ICAgICAgICAgICAgICBMZGFwQXV0aEluZm86IGluaXQgZW5kcyA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICAgICAgaW5pdDogYmVmb3JlIG1ha2VDb25uZWN0aW9uIGVycm9y SWZEb3duIGlzIHRydWUKICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 CiAgICAgICAgICAgICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJvcklmRG93biB0cnVl IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBUQ1AgS2VlcC1BbGl2 ZTogdHJ1ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1 MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgU1NMQ2xp ZW50Q2VydGlmaWNhdGVTZWxlY3Rpb25DQjogU2V0dGluZyBkZXNpcmVkCiAgICAgICAgICAgICAg ICAgICAgICAgIGNlcnQgbmlja25hbWUgdG86IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9z dC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgIExkYXBKc3NTU0xTb2NrZXQ6 IHNldCBjbGllbnQgYXV0aCBjZXJ0IG5pY2tuYW1lCiAgICAgICAgICAgICAgICAgICAgICAgIHN1 YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBbMDMv QXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAg ICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRTZWxlY3Rpb25DQjogRW50ZXJpbmchIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qt c3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogb2Nz cFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgU1NMQ2xpZW50Q2VydGlmaWNh dGVTZWxlY3Rpb25DQjogZGVzaXJlZCBjZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgIGZvdW5k IGluIGxpc3Q6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg ICAgICAgICAgICAgICAgICAgICAgIFNTTENsaWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6IHJl dHVybmluZzoKICAgICAgICAgICAgICAgICAgICAgICAgc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1j YSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9j YWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgU1NMIGhhbmRzaGFr ZSBoYXBwZW5lZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1 Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgQ01T RW5naW5lLnNodXRkb3duKCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgSSByZWFsbHkg YXBwcmVjaWF0ZSB5b3Ugc3RpY2tpbmcgd2l0aCBtZSB0aHJvdWdoCiAgICAgICAgICAgICAgICAg ICAgICAgIHRoaXMuwqAgSSBvd2UgeW91LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgLSBJYW4gPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PkFmdGVyIHRoYXQsIGNoZWNrIHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUgTERB UCBlbnRyeSBoYXMgYmVlbiB1cGRhdGVkLiBJZiBpdCBpcyB0aGUKICAgICAgICAgICAgICAgICAg ICAgICAgICBjYXNlLCB5b3Ugc2hvdWxkIGJlIGFibGUgdG8gcmVzdGFydCBwa2kuIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgRmxv IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+VGhhbmsgeW91IGFnYWluIGZvcgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgeW91ciB0aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBJYW4gPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+RmxvLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgd2hpY2ggc2VlbXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+VGhlIGRlc2NyaXB0aW9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBhdHRyaWJ1dGUgaW4gdGhlIGxkYXBzZWFyY2ggb3V0cHV0IGlzCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBvZiB0aGUgZm9ybSAyOyM7RE47RE4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgVGhlICMgc2hvdWxkIG1hdGNoIHRoZSBzZXJpYWwgbnVtYmVyCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBpbiB0aGUgZmlyc3QgY2VydHV0aWwgb3V0cHV0IDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIFRoZSBBU0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5ECiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBoZWFkZXJzKSBzaG91bGQgbWF0Y2ggb25lIG9mIHRo ZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUg YXR0cmlidXRlcy4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcm9iIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAg ICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gPGJyPgog ICAgICAgICAgICAgICAgICAgIEZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhCiAgICAg ICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAg ICAgICAgICAgICAgICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9z dGVkLm9yZyIKICAgICAgICAgICAgICAgICAgICAgIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+PGEg Y2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNl cnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0 ZWQub3JnPC9hPjwvYT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YQogICAgICAgICAgICAgICAgICAg ICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgICAgICAg IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmci CiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPjxhIGNsYXNzPSJt b3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZl QGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZzwvYT48L2E+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgIF9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fIDxicj4KICAgICAgICAgICAgICAgICAgRnJlZUlQ QS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEKICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96 LXR4dC1saW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpm cmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5mcmVl aXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9hPgogICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgIFRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8g PGEKICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIgog ICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3Rz LmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0 cnVlIj48YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWlsdG86ZnJl ZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5mcmVlaXBhLXVzZXJzLWxl YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9hPgogICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+ PC9maWVsZHNldD4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgPHByZSB3cmFwPSIi Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZyZWVJUEEt dXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIG1vei1k by1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h PgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBs aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICAgICAgPC9ibG9ja3F1b3Rl PgogICAgICAgICAgICA8YnI+CiAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICA8YnI+ CiAgICAgICAgICA8YnI+CiAgICAgICAgICA8ZmllbGRzZXQgY2xhc3M9Im1pbWVBdHRhY2htZW50 SGVhZGVyIj48L2ZpZWxkc2V0PgogICAgICAgICAgPGJyPgogICAgICAgICAgPHByZSB3cmFwPSIi Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkZyZWVJUEEt dXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIG1vei1k by1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnPC9h PgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmciIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSI+ZnJlZWlwYS11c2Vycy1sZWF2ZUBs aXN0cy5mZWRvcmFob3N0ZWQub3JnPC9hPgo8L3ByZT4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgICAgPGJyPgogICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgIDxicj4KICAgIDwvYmxvY2txdW90 ZT4KICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K --===============5165044645924626980==-- From ianh at brownpapertickets.com Wed Aug 16 14:37:31 2017 Content-Type: multipart/mixed; boundary="===============3500582530928333893==" MIME-Version: 1.0 From: Ian Harding To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Re: Failed Upgrade? Date: Wed, 16 Aug 2017 07:36:31 -0700 Message-ID: <18ba2786-b6c1-4532-676d-790ef7b07701@brownpapertickets.com> In-Reply-To: 5994397E.20408@redhat.com --===============3500582530928333893== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 8/16/17 5:24 AM, thierry bordaz via FreeIPA-users wrote: > Hi Ian > >> Hmm.. This looks odd. >> >> [root(a)seattlenfs ianh]# ipa-csreplica-manage re-initialize --from = >> freeipa-sea.bpt.rocks >> Directory Manager password: >> >> ipa: ERROR: Found multiple agreements for seattlenfs.bpt.rocks. Only = >> initializing the first one returned: = >> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3D= o\=3Dipaca,cn=3Dmapping = >> tree,cn=3Dconfig >> Update in progress, 15 seconds elapsed >> [freeipa-sea.bpt.rocks] reports: Update failed! Status: [32 - LDAP = >> error: No such object] > > Here there are several replica agreement from freeipa-sea.bpt.rocks-> = > seattlenfs (for o=3Dipaca suffix). > I am not sure how this can happen. > It could be some remaining entries from previous install/uninstall or = > multiple initialization from different sources. If it's possible to do something wrong I am sure I have done it. I have = tried the various clean-ruv commands for the apparently existing = agreements with nonexistent servers many times but it seems ot have no = effect. > > Looking at the error below, I wonder if there were actually 2 replica = > agreements freeipa-sea->seattlenfs that are > > * cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat > * masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat > > Would you dump (on all servers freeipa-sea, seattlenfs and freeipa-dal): > > ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = > "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi > > freeipa-dal no longer exists. Also, since they also appear below... = neither do edinburghnfs, fremontnis, bellevuenfs or bpt-nyc1-nfs. The = one causing me the most obvious headaches is freeipa-dal. [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -= b = "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi Enter LDAP Password: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: cn: replica nscpentrywsi: createTimestamp: 20160814234939Z nscpentrywsi: creatorsName: cn=3Ddirectory manager nscpentrywsi: modifiersName: cn=3DMultimaster Replication = Plugin,cn=3Dplugins,cn=3Dc onfig nscpentrywsi: modifyTimestamp: 20170816141634Z nscpentrywsi: nsDS5Flags: 1 nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager = cloneAgreement1-freei pa-sea.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager = masterAgreement1-seat tlenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nscpentrywsi: nsDS5ReplicaId: 1065 nscpentrywsi: nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca nscpentrywsi: nsDS5ReplicaType: 3 nscpentrywsi: nsState:: = KQQAAAAAAADAU5RZAAAAAAAAAAAAAAAAKgAAAAAAAAAAAAAAAAAAAA =3D=3D nscpentrywsi: nsds5replicabinddngroup: cn=3Dreplication = managers,cn=3Dsysaccounts, cn=3Detc,dc=3Dbpt,dc=3Drocks nscpentrywsi: nsds5replicabinddngroupcheckinterval: 60 nscpentrywsi: objectClass: top nscpentrywsi: objectClass: nsDS5Replica nscpentrywsi: objectClass: extensibleobject nscpentrywsi: numSubordinates: 2 nscpentrywsi: nsds5ReplicaChangeCount: 961 nscpentrywsi: nsds5replicareapactive: 0 dn: = cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3= Dipac a,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: dn: = cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Drepli ca,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: cn: cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat nscpentrywsi: createTimestamp: 20160814234940Z nscpentrywsi: creatorsName: cn=3Ddirectory manager nscpentrywsi: description: cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat nscpentrywsi: modifiersName: cn=3DMultimaster Replication = Plugin,cn=3Dplugins,cn=3Dc onfig nscpentrywsi: modifyTimestamp: 20170810183437Z nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager = masterAgreement1-free ipa-sea.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nscpentrywsi: nsDS5ReplicaBindMethod: Simple nscpentrywsi: nsDS5ReplicaCredentials: = {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1 NxR1NJYjNEUUVGRERBNEJDUXhNemsyTlRka05TMHhZMlE1TTJKbA0KT1MwNU1HTm1PV0V6T1M= wMk5 qazNNV0V3TndBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJC= Q0da bE1zY2Nod0FQeFlXMkF0Y3RhTA=3D=3D}AIuTmb+o3/MWgo0mc8r8fw=3D=3D nscpentrywsi: nsDS5ReplicaHost: seattlenfs.bpt.rocks nscpentrywsi: nsDS5ReplicaPort: 389 nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca nscpentrywsi: nsDS5ReplicaTransportInfo: TLS nscpentrywsi: nsds50ruv: {replicageneration} 55c8f3ae000000600000 nscpentrywsi: nsds50ruv: {replica 81 ldap://seattlenfs.bpt.rocks:389} = 568ac431 000000510000 57b103ce000500510000 nscpentrywsi: nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = 57b10 3d4000004290000 57b254df000004290000 nscpentrywsi: nsds50ruv: {replica 1095 ldap://freeipa-sea.bpt.rocks:389} = 579a9 63c000004470000 57a42389000104470000 nscpentrywsi: nsds50ruv: {replica 96 ldap://freeipa-sea.bpt.rocks:389} = 55c8f3b d000000600000 5799a02e000000600000 nscpentrywsi: nsds5ReplicaEnabled: on nscpentrywsi: nsruvReplicaLastModified: {replica 81 = ldap://seattlenfs.bpt.rock s:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1065 = ldap://freeipa-sea.bpt.r ocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1095 = ldap://freeipa-sea.bpt.r ocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 96 = ldap://freeipa-sea.bpt.roc ks:389} 00000000 nscpentrywsi: objectClass: top nscpentrywsi: objectClass: nsds5replicationagreement nscpentrywsi: nsds5replicareapactive: 0 nscpentrywsi: nsds5replicaLastUpdateStart: 19700101000000Z nscpentrywsi: nsds5replicaLastUpdateEnd: 19700101000000Z nscpentrywsi: nsds5replicaChangesSentSinceStartup: nscpentrywsi: nsds5replicaLastUpdateStatus: Error (32) Problem = connecting to r eplica - LDAP error: No such object (connection error) nscpentrywsi: nsds5replicaUpdateInProgress: FALSE nscpentrywsi: nsds5replicaLastInitStart: 19700101000000Z nscpentrywsi: nsds5replicaLastInitEnd: 19700101000000Z dn: = cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3= Dipac a,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: dn: = cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Drepli ca,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: cn: masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat nscpentrywsi: createTimestamp: 20160825052011Z nscpentrywsi: creatorsName: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi: description: masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat nscpentrywsi: modifiersName: cn=3DMultimaster Replication = Plugin,cn=3Dplugins,cn=3Dc onfig nscpentrywsi: modifyTimestamp: 20170706211220Z nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager = cloneAgreement1-seatt lenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nscpentrywsi: nsDS5ReplicaBindMethod: Simple nscpentrywsi: nsDS5ReplicaCredentials: = {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1 NxR1NJYjNEUUVGRERBNEJDUXhNemsyTlRka05TMHhZMlE1TTJKbA0KT1MwNU1HTm1PV0V6T1M= wMk5 qazNNV0V3TndBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJC= QnZ6 Z2tGUzErSjlvdEVYRlFJaVQyMA=3D=3D}yhEAKKElqudqql31/kWsUw=3D=3D nscpentrywsi: nsDS5ReplicaHost: seattlenfs.bpt.rocks nscpentrywsi: nsDS5ReplicaPort: 389 nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca nscpentrywsi: nsDS5ReplicaTransportInfo: TLS nscpentrywsi: nsds50ruv: {replicageneration} 55c8f3ae000000600000 nscpentrywsi: nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = 57be80 4c0000050a0000 587236150000050a0000 nscpentrywsi: nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = 57b10 3d4000004290000 57be8043000704290000 nscpentrywsi: nsds50ruv: {replica 1070 ldap://bellevuenfs.bpt.rocks:389} = 57a4f 2700000042e0000 57a4f2700007042e0000 nscpentrywsi: nsds50ruv: {replica 1075 = ldap://bpt-nyc1-nfs.bpt.rocks:389} 57a4 7865000004330000 57b111c8000404330000 nscpentrywsi: nsds50ruv: {replica 1085 ldap://fremontnis.bpt.rocks:389} = 57a403 e60000043d0000 57a643ea0000043d0000 nscpentrywsi: nsds50ruv: {replica 1090 ldap://freeipa-dal.bpt.rocks:389} = 57a2d d35000004420000 57a2dd35000404420000 nscpentrywsi: nsds50ruv: {replica 1195 = ldap://edinburghnfs.bpt.rocks:389} 57a4 2390000004ab0000 57a42390000404ab0000 nscpentrywsi: nsruvReplicaLastModified: {replica 1290 = ldap://seattlenfs.bpt.ro cks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1065 = ldap://freeipa-sea.bpt.r ocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1070 = ldap://bellevuenfs.bpt.r ocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1075 = ldap://bpt-nyc1-nfs.bpt. rocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1085 = ldap://fremontnis.bpt.ro cks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1090 = ldap://freeipa-dal.bpt.r ocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1195 = ldap://edinburghnfs.bpt. rocks:389} 00000000 nscpentrywsi: objectClass: top nscpentrywsi: objectClass: nsds5replicationagreement nscpentrywsi: nsds5replicareapactive: 0 nscpentrywsi: nsds5replicaLastUpdateStart: 19700101000000Z nscpentrywsi: nsds5replicaLastUpdateEnd: 19700101000000Z nscpentrywsi: nsds5replicaChangesSentSinceStartup: nscpentrywsi: nsds5replicaLastUpdateStatus: Error (19) Replication error = acqui ring replica: Replica has different database generation ID, remote = replica ma y need to be initialized (RUV error) nscpentrywsi: nsds5replicaUpdateInProgress: FALSE nscpentrywsi: nsds5replicaLastInitStart: 19700101000000Z nscpentrywsi: nsds5replicaLastInitEnd: 19700101000000Z ################## [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" nscpentrywsi Enter LDAP Password: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: cn: replica nscpentrywsi: createTimestamp: 20160825052011Z nscpentrywsi: creatorsName: cn=3Ddirectory manager nscpentrywsi: modifiersName: cn=3DMultimaster Replication = Plugin,cn=3Dplugins,cn=3Dc onfig nscpentrywsi: modifyTimestamp: 20170810182749Z nscpentrywsi: nsDS5Flags: 1 nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager = cloneAgreement1-seatt lenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nscpentrywsi: nsDS5ReplicaId: 1290 nscpentrywsi: nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca nscpentrywsi: nsDS5ReplicaType: 3 nscpentrywsi: nsState:: = CgUAAAAAAACkpYxZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA =3D=3D nscpentrywsi: nsds5replicabinddngroup: cn=3Dreplication = managers,cn=3Dsysaccounts, cn=3Detc,dc=3Dbpt,dc=3Drocks nscpentrywsi: nsds5replicabinddngroupcheckinterval: 60 nscpentrywsi: objectClass: top nscpentrywsi: objectClass: nsDS5Replica nscpentrywsi: objectClass: extensibleobject nscpentrywsi: numSubordinates: 1 nscpentrywsi: nsds5ReplicaChangeCount: 3 nscpentrywsi: nsds5replicareapactive: 0 dn: = cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do\3D= ipaca ,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: dn: = cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplic a,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig nscpentrywsi: cn: cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat nscpentrywsi: createTimestamp: 20160825052011Z nscpentrywsi: creatorsName: cn=3Ddirectory manager nscpentrywsi: description: cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat nscpentrywsi: modifiersName: cn=3Ddirectory manager nscpentrywsi: modifyTimestamp: 20170810183422Z nscpentrywsi: nsDS5ReplicaBindDN: cn=3DReplication Manager = masterAgreement1-seat tlenfs.bpt.rocks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig nscpentrywsi: nsDS5ReplicaBindMethod: Simple nscpentrywsi: nsDS5ReplicaCredentials: = {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1 NxR1NJYjNEUUVGRERBNEJDUXhNemsyTlRka05TMHhZMlE1TTJKbA0KT1MwNU1HTm1PV0V6T1M= wMk5 qazNNV0V3TndBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJC= QzZI d20zcHNMYTZKT3dQVDg4RW9XRA=3D=3D}PpeZp0WYyNiA7DWqrsJfBw=3D=3D nscpentrywsi: nsDS5ReplicaHost: freeipa-sea.bpt.rocks nscpentrywsi: nsDS5ReplicaPort: 389 nscpentrywsi: nsDS5ReplicaRoot: o=3Dipaca nscpentrywsi: nsDS5ReplicaTransportInfo: TLS nscpentrywsi: nsds50ruv: {replicageneration} 57c291d9000004290000 nscpentrywsi: nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = 57f84 0bf000004290000 598ca31f000104290000 nscpentrywsi: nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} nscpentrywsi: nsruvReplicaLastModified: {replica 1065 = ldap://freeipa-sea.bpt.r ocks:389} 00000000 nscpentrywsi: nsruvReplicaLastModified: {replica 1290 = ldap://seattlenfs.bpt.ro cks:389} 00000000 nscpentrywsi: objectClass: top nscpentrywsi: objectClass: nsds5replicationagreement nscpentrywsi: nsds5ReplicaEnabled: on nscpentrywsi: nsds5replicareapactive: 0 nscpentrywsi: nsds5replicaLastUpdateStart: 19700101000000Z nscpentrywsi: nsds5replicaLastUpdateEnd: 19700101000000Z nscpentrywsi: nsds5replicaChangesSentSinceStartup: nscpentrywsi: nsds5replicaLastUpdateStatus: Error (19) Replication error = acqui ring replica: Replica has different database generation ID, remote = replica ma y need to be initialized (RUV error) nscpentrywsi: nsds5replicaUpdateInProgress: FALSE nscpentrywsi: nsds5replicaLastInitStart: 19700101000000Z nscpentrywsi: nsds5replicaLastInitEnd: 19700101000000Z > best regards > thierry > >> >>> On freeipa-sea and seattlenfs you may check the ipaca replica = >>> agreements status before/after reinit. I would guess they are = >>> currently reporting failures between these two replicas. >>> >>> ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>> "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = >>> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus >>> >> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -= W = >> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = >> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus >> Enter LDAP Password: >> dn: = >> cn=3DcloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3D= o\3Dipac >> a,cn=3Dmapping tree,cn=3Dconfig >> nsds5replicaLastUpdateStatus: Error (32) Problem connecting to = >> replica - LDAP >> error: No such object (connection error) >> >> dn: = >> cn=3DmasterAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3D= o\3Dipac >> a,cn=3Dmapping tree,cn=3Dconfig >> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = >> replica: >> Replica has different database generation ID, remote replica may = >> need to be i >> nitialized (RUV error) >> >> and >> >> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager' -W = >> -b "cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig" = >> "objectClass=3Dnsds5replicationagreement" nsds5replicaLastUpdateStatus >> Enter LDAP Password: >> dn: = >> cn=3DcloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat,cn=3Dreplica,cn=3Do= \3Dipaca >> ,cn=3Dmapping tree,cn=3Dconfig >> nsds5replicaLastUpdateStatus: Error (19) Replication error acquiring = >> replica: >> Replica has different database generation ID, remote replica may = >> need to be i >> nitialized (RUV error) >> >> >>>> >>>> several times over the years when replication has stopped. >>>> >>>> Replication actually is working, as far as user and machine = >>>> accounts and attributes are concerned anyway, and has been for a while. >>>> >>>> There is a zombie server freeipa-dal.bpt.rocks that I can't get rid = >>>> of... it shows up in the GUI on the Topology page but generates a = >>>> Server not found error. I don't know if that's related. >>> >>> Zombie servers have been discussed a lot on this mailing list. You = >>> may get rid of them with list-ruv/clean-ruv subcommand. Replication = >>> usually manage to work fine even if some zombie entries exist but it = >>> is a good practice to clean them. >> Yeah, I've been through every possible combination of = >> list-ruv/clean-ruv. I have something odd going on in that no = >> replication agreements show up anywhere for freeipa-dal. >>> >>> regards >>> thierry >>>>> >>>>> On 08/08/2017 10:33 PM, Ian Harding via FreeIPA-users wrote: >>>>>> >>>>>> On 8/7/17 1:44 AM, thierry bordaz wrote: >>>>>> >>>>>>> >>>>>>> >>>>>>> On 08/07/2017 09:22 AM, Florence Blanc-Renaud via FreeIPA-users = >>>>>>> wrote: >>>>>>>> On 08/04/2017 11:02 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>> On 8/4/17 2:16 AM, Florence Blanc-Renaud wrote: >>>>>>>>> >>>>>>>>>> On 08/03/2017 11:13 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>> On 08/03/2017 12:28 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>> On 08/02/2017 11:51 PM, Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>> On 08/02/2017 12:11 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>> On 08/02/2017 01:43 AM, Ian Harding wrote: >>>>>>>>>>>>>>> On 08/01/2017 12:03 PM, Rob Crittenden wrote: >>>>>>>>>>>>>>>> Ian Harding wrote: >>>>>>>>>>>>>>>>> On 08/01/2017 07:39 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>>>> On 08/01/2017 03:11 PM, Ian Harding wrote: >>>>>>>>>>>>>>>>>>> On 08/01/2017 01:48 AM, Florence Blanc-Renaud wrote: >>>>>>>>>>>>>>>>>>>> On 08/01/2017 01:32 AM, Ian Harding via = >>>>>>>>>>>>>>>>>>>> FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> On 07/31/2017 11:34 AM, Rob Crittenden wrote: >>>>>>>>>>>>>>>>>>>>>> Ian Harding via FreeIPA-users wrote: >>>>>>>>>>>>>>>>>>>>>>> I had an unexpected restart of an IPA server = >>>>>>>>>>>>>>>>>>>>>>> that had apparently had >>>>>>>>>>>>>>>>>>>>>>> updates run but had not been restarted. ipactl = >>>>>>>>>>>>>>>>>>>>>>> says pki-tomcatd >>>>>>>>>>>>>>>>>>>>>>> would >>>>>>>>>>>>>>>>>>>>>>> not start. >>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>>> Strangely, the actual service appears to be = >>>>>>>>>>>>>>>>>>>>>>> running: >>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>> dogtag is an application within tomcat so tomcat = >>>>>>>>>>>>>>>>>>>>>> can run without >>>>>>>>>>>>>>>>>>>>>> dogtag >>>>>>>>>>>>>>>>>>>>>> running. >>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>> We need to see more of the dogtag debug log to = >>>>>>>>>>>>>>>>>>>>>> see what is going on. >>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> It looks like an authentication problem... >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> [28/Jul/2017:10:08:47][localhost-startStop-1]: SSL = >>>>>>>>>>>>>>>>>>>>> handshake happened >>>>>>>>>>>>>>>>>>>>> Could not connect to LDAP server host = >>>>>>>>>>>>>>>>>>>>> seattlenfs.bpt.rocks port 636 >>>>>>>>>>>>>>>>>>>>> Error netscape.ldap.LDAPException: Authentication = >>>>>>>>>>>>>>>>>>>>> failed (49) >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> dogtag stores its internal data in the LDAP server = >>>>>>>>>>>>>>>>>>>> and needs to >>>>>>>>>>>>>>>>>>>> establish a secure LDAP connection. You can check = >>>>>>>>>>>>>>>>>>>> how this >>>>>>>>>>>>>>>>>>>> connection is configured in = >>>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/ca/CS.cfg, look for >>>>>>>>>>>>>>>>>>>> the lines: >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Dcn=3DDirectory Manager >>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.host=3Dvm-... >>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.port=3D636 >>>>>>>>>>>>>>>>>>>> internaldb.ldapconn.secureConn >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> authtype can be SslClientAuth (authentication with = >>>>>>>>>>>>>>>>>>>> a ssl >>>>>>>>>>>>>>>>>>>> certificate) or BasicAuth (authentication with a = >>>>>>>>>>>>>>>>>>>> bind DN and >>>>>>>>>>>>>>>>>>>> password stored in = >>>>>>>>>>>>>>>>>>>> /var/lib/pki/pki-tomcat/conf/password.conf). >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> You can use this information to manually check the = >>>>>>>>>>>>>>>>>>>> credentials. For >>>>>>>>>>>>>>>>>>>> instance with sslclientauth: >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> export LDAPTLS_CACERTDIR=3D/etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>>>>> export LDAPTLS_CERT=3D'subsystemCert cert-pki-ca' >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> ldapsearch -H ldaps://`hostname`:636 -b "" -s base = >>>>>>>>>>>>>>>>>>>> -Y EXTERNAL >>>>>>>>>>>>>>>>>>>> (provide the password from = >>>>>>>>>>>>>>>>>>>> /etc/pki/pki-tomcat/alias/pwdfile.txt) >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> I found this: >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.authtype=3DSslClientAuth >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindDN=3Duid=3Dpkidbuser,ou=3Dpeopl= e,o=3Dipaca = >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.bindPWPrompt=3Dinternaldb >>>>>>>>>>>>>>>>>>> internaldb.ldapauth.clientCertNickname=3DsubsystemCert = >>>>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>>>> internaldb.ldapconn.cloneReplicationPort=3D389 >>>>>>>>>>>>>>>>>>> ... >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> and when I try the ldapsearch I am presented with a = >>>>>>>>>>>>>>>>>>> prompt to provide >>>>>>>>>>>>>>>>>>> a pin/password >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for = >>>>>>>>>>>>>>>>>>> security token 'ldap(0)': >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> but there is no password file... >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> you are right, in 4.4. there is no pwdfile.txt and = >>>>>>>>>>>>>>>>>> the password can be >>>>>>>>>>>>>>>>>> found in /var/lib/pki/pki-tomcat/conf/password.conf = >>>>>>>>>>>>>>>>>> (with the tag >>>>>>>>>>>>>>>>>> internal=3D...) >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> Can you check if the password with the tag = >>>>>>>>>>>>>>>>>> internal=3D... allows to read >>>>>>>>>>>>>>>>>> the keys from the NSS db? >>>>>>>>>>>>>>>>>> certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>>> (provide password) >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> That works... >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias >>>>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot = >>>>>>>>>>>>>>>>> "NSS User Private >>>>>>>>>>>>>>>>> Key and Certificate Services" >>>>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>>>>> < 0> rsa 0f327e760a7eecdcf6973f5dc57ca5367c592d64 = >>>>>>>>>>>>>>>>> (orphan) >>>>>>>>>>>>>>>>> < 1> rsa b12580c7c696cfcd8aefc9405a7a870b24b7b96a NSS = >>>>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>>>> DB:auditSigningCert cert-pki-ca >>>>>>>>>>>>>>>>> < 2> rsa 881b7254c40fa40bc50681bcc8d37bb3eb49937e = >>>>>>>>>>>>>>>>> caSigningCert >>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>> < 3> rsa fa9a255a1d15585ac28064c0f4986e416bc48403 NSS = >>>>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>>>> DB:ocspSigningCert cert-pki-ca >>>>>>>>>>>>>>>>> < 4> rsa 3fb609d0f7d72c2d325d6a2dc16577a7f7e5a01f = >>>>>>>>>>>>>>>>> Server-Cert >>>>>>>>>>>>>>>>> cert-pki-ca >>>>>>>>>>>>>>>>> < 5> rsa 1e9479a9556af9339bb5e4552ccbd381d3c38856 NSS = >>>>>>>>>>>>>>>>> Certificate >>>>>>>>>>>>>>>>> DB:subsystemCert cert-pki-ca >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> But this doesn't (with the same password from = >>>>>>>>>>>>>>>>> password.conf) >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> # ldapsearch -H ldaps://`hostname`:636 -b "" -s base = >>>>>>>>>>>>>>>>> -Y EXTERNAL >>>>>>>>>>>>>>>>> Please enter pin, password, or pass phrase for = >>>>>>>>>>>>>>>>> security token 'ldap(0)': >>>>>>>>>>>>>>>>> SASL/EXTERNAL authentication started >>>>>>>>>>>>>>>>> ldap_sasl_interactive_bind_s: Invalid credentials (49) >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> That password is getting me somewhere though, since if = >>>>>>>>>>>>>>>>> I put in a >>>>>>>>>>>>>>>>> nonsense or incorrect password it just prompts over = >>>>>>>>>>>>>>>>> and over. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Let's step back a second. You upgraded from what to what? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> There wasn't much of a change... I just assumed someone = >>>>>>>>>>>>>>> ran yum upgrade and didn't restart, then the power = >>>>>>>>>>>>>>> outage... it looks like not much of a version change = >>>>>>>>>>>>>>> though. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # grep ipa /var/log/yum.log >>>>>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:45:32 Installed: = >>>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:46:06 Updated: = >>>>>>>>>>>>>>> libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>>>> Jan 08 04:46:07 Updated: = >>>>>>>>>>>>>>> python-libipa_hbac-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>>>> Jan 08 04:46:08 Installed: = >>>>>>>>>>>>>>> python-ipaddress-1.0.16-2.el7.noarch >>>>>>>>>>>>>>> Jan 08 04:47:04 Installed: = >>>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:47:05 Updated: = >>>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:47:05 Installed: = >>>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:47:06 Installed: = >>>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:47:07 Updated: sssd-ipa-1.14.0-43.el7_3.4.x86_64 >>>>>>>>>>>>>>> Jan 08 04:47:17 Updated: = >>>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>>>>> Jan 08 04:47:23 Updated: = >>>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.1.1.x86_64 >>>>>>>>>>>>>>> Jan 08 04:47:27 Updated: = >>>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:47:36 Installed: = >>>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.1.1.noarch >>>>>>>>>>>>>>> Jan 08 04:50:07 Erased: = >>>>>>>>>>>>>>> ipa-python-4.2.0-15.0.1.el7.centos.19.x86_64 >>>>>>>>>>>>>>> Jul 28 09:55:41 Updated: = >>>>>>>>>>>>>>> ipa-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:42 Updated: = >>>>>>>>>>>>>>> ipa-client-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>>>>> ipa-server-common-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:43 Updated: = >>>>>>>>>>>>>>> python2-ipalib-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:44 Updated: = >>>>>>>>>>>>>>> python2-ipaclient-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>>>>> python2-ipaserver-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:45 Updated: = >>>>>>>>>>>>>>> ipa-admintools-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:46 Updated: = >>>>>>>>>>>>>>> ipa-client-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>>>> ipa-server-4.4.0-14.el7.centos.7.x86_64 >>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>>>> ipa-server-dns-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> Jul 28 09:55:48 Updated: = >>>>>>>>>>>>>>> ipa-python-compat-4.4.0-14.el7.centos.7.noarch >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # grep pki /var/log/yum.log >>>>>>>>>>>>>>> Jan 08 04:46:05 Updated: pki-base-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>>> Jan 08 04:46:09 Updated: krb5-pkinit-1.14.1-27.el7_3.x86_64 >>>>>>>>>>>>>>> Jan 08 04:47:19 Installed: = >>>>>>>>>>>>>>> pki-base-java-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>>> Jan 08 04:47:19 Updated: pki-tools-10.3.3-14.el7_3.x86_64 >>>>>>>>>>>>>>> Jan 08 04:47:21 Updated: pki-server-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-kra-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>>> Jan 08 04:47:22 Updated: pki-ca-10.3.3-14.el7_3.noarch >>>>>>>>>>>>>>> Jul 28 10:13:16 Updated: pki-base-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>>> Jul 28 10:13:17 Updated: = >>>>>>>>>>>>>>> pki-base-java-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>>> Jul 28 10:13:17 Updated: pki-tools-10.3.3-19.el7_3.x86_64 >>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-server-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-kra-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>>> Jul 28 10:13:21 Updated: pki-ca-10.3.3-19.el7_3.noarch >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Are you running in SELinux enforcing mode? >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # getenforce >>>>>>>>>>>>>>> Enforcing >>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> If so can you run: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # ausearch -m AVC >>>>>>>>>>>>>>> The NOLOG option to log_format is deprecated. Please use = >>>>>>>>>>>>>>> the write_logs option. >>>>>>>>>>>>>>> The NOLOG option is overriding the write_logs current = >>>>>>>>>>>>>>> setting. >>>>>>>>>>>>>>> ---- >>>>>>>>>>>>>>> time->Mon Mar 14 10:39:01 2016 >>>>>>>>>>>>>>> type=3DSYSCALL msg=3Daudit(1457977141.767:17537): = >>>>>>>>>>>>>>> arch=3Dc000003e syscall=3D2 success=3Dno exit=3D-13 = >>>>>>>>>>>>>>> a0=3D7fbcab038d10 a1=3D800 a2=3D1 a3=3D7fbca60f42e0 items= =3D0 = >>>>>>>>>>>>>>> ppid=3D1406 pid=3D12965 auid=3D4294967295 uid=3D0 gid=3D0 = >>>>>>>>>>>>>>> euid=3D581400001 suid=3D0 fsuid=3D581400001 egid=3D58140000= 1 = >>>>>>>>>>>>>>> sgid=3D0 fsgid=3D581400001 tty=3D(none) ses=3D4294967295 = >>>>>>>>>>>>>>> comm=3D"sshd" exe=3D"/usr/sbin/sshd" = >>>>>>>>>>>>>>> subj=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 key=3D(null) >>>>>>>>>>>>>>> type=3DAVC msg=3Daudit(1457977141.767:17537): avc: denied { = >>>>>>>>>>>>>>> read } for pid=3D12965 comm=3D"sshd" name=3D"authorized_key= s" = >>>>>>>>>>>>>>> dev=3D"dm-2" ino=3D116393517 = >>>>>>>>>>>>>>> scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 = >>>>>>>>>>>>>>> tcontext=3Dsystem_u:object_r:unlabeled_t:s0 tclass=3Dfile >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> I suspect that the subsystem cert was renewed and = >>>>>>>>>>>>>>>> everything wasn't >>>>>>>>>>>>>>>> updated properly. If I'm right this is unrelated to the = >>>>>>>>>>>>>>>> upgrade it just >>>>>>>>>>>>>>>> shone a spotlight on it. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Can you run these commands: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b >>>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate = >>>>>>>>>>>>>>>> description >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> This returns >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descr= iption >>>>>>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>>>>>> userCertificate:: = >>>>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAl= C = >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> ... stuff ... >>>>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>>>>>> description: 2;4;CN=3DCertificate = >>>>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> and >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>>>> 'subsystemCert >>>>>>>>>>>>>>>> cert-pki-ca' | grep Serial >>>>>>>>>>>>>>>> # certutil -L -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> These both return >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' | grep Serial >>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>>> certutil: problem listing keys: = >>>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> # certutil -K -d /etc/pki/pki-tomcat/alias -n = >>>>>>>>>>>>>>> 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>>>> certutil: Checking token "NSS Certificate DB" in slot = >>>>>>>>>>>>>>> "NSS User Private Key and Certificate Services" >>>>>>>>>>>>>>> Enter Password or Pin for "NSS Certificate DB": >>>>>>>>>>>>>>> certutil: problem listing keys: = >>>>>>>>>>>>>>> SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier. >>>>>>>>>>>>>>> >>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>> >>>>>>>>>>>>>> you made a typo and requested the keys (-K) instead of = >>>>>>>>>>>>>> the certs (-L). Please retry with -L and you should be = >>>>>>>>>>>>>> able to see the certificate serial. >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca = >>>>>>>>>>>>> userCertificate description >>>>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>>>> userCertificate:: = >>>>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>>>> ... >>>>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>>>> description: 2;4;CN=3DCertificate = >>>>>>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>>>>>>>>> >>>>>>>>>>>>> So the serial is 4? >>>>>>>>>>>>> >>>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>>>>>> grep Serial >>>>>>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>>>>>> >>>>>>>>>>>>> Which is NOT 4... >>>>>>>>>>>>> >>>>>>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a >>>>>>>>>>>>> -----BEGIN CERTIFICATE----- >>>>>>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKD= AlC = >>>>>>>>>>>>> >>>>>>>>>>>>> ... >>>>>>>>>>>>> sjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>>>>>>> -----END CERTIFICATE----- >>>>>>>>>>>>> >>>>>>>>>>>>> And this cert is NOT the same. >>>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> when certmonger renews a certificate, it runs pre-save and = >>>>>>>>>>>> post-save commands (which you can see in the output of = >>>>>>>>>>>> getcert list). In your case, the post-save command for = >>>>>>>>>>>> subsystemCert cert-pki-ca probably failed. >>>>>>>>>>>> >>>>>>>>>>>> This command (on the renewal master) is responsible for = >>>>>>>>>>>> copying the new cert from the NSS db to the LDAP server. = >>>>>>>>>>>> You need first to check which IPA server is the renewal = >>>>>>>>>>>> master (as the serial numbers are in a completely different = >>>>>>>>>>>> range, I assume that you have multiple IPA servers = >>>>>>>>>>>> configured with a CA instance): >>>>>>>>>>>> >>>>>>>>>>>> $ export BASEDN=3D`grep basedn /etc/ipa/default.conf | cut = >>>>>>>>>>>> -d=3D -f2-` >>>>>>>>>>>> $ kinit admin >>>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>>>>> dn: = >>>>>>>>>>>> cn=3DCA,cn=3Dvm-ipaserver.ipadomain.com,cn=3Dmasters,cn=3Dipa,= cn=3Detc,dc=3Dipadomain,dc=3Dcom = >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> In this example the renewal master is vm-ipaserver. >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> I get this >>>>>>>>>>> >>>>>>>>>>> $ ldapsearch -LLL -Q -h `hostname` -p 389 -Y GSSAPI -b = >>>>>>>>>>> "cn=3Dmasters,cn=3Dipa,cn=3Detc,$BASEDN" = >>>>>>>>>>> '(&(cn=3DCA)(ipaConfigString=3DcaRenewalMaster))' dn >>>>>>>>>>> dn: = >>>>>>>>>>> cn=3DCA,cn=3Dfreeipa-sea.bpt.rocks,cn=3Dmasters,cn=3Dipa,cn=3De= tc,dc=3Dbpt,dc=3Drocks = >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Which is the other FreeIPA server. >>>>>>>>>>> >>>>>>>>>> Hi Ian, >>>>>>>>>> >>>>>>>>>> it's getting difficult to follow this thread, so could we = >>>>>>>>>> step back and summarize? >>>>>>>>> Yes, it is. Sorry. >>>>>>>>>> >>>>>>>>>> - On server freeipa-sea (=3Drenewal master), the CA component = >>>>>>>>>> is installed and 'subsystemCert cert-pki-ca' has Serial = >>>>>>>>>> number 4 in the NSSDB /etc/pki/pki-tomcat/alias >>>>>>>>> No? >>>>>>>>> >>>>>>>>> [root(a)freeipa-sea ianh]# certutil -L -d = >>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>> grep Serial >>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>>> - On server seattlenfs (where PKI fails to restart), the CA = >>>>>>>>>> component is installed and 'subsystemCert cert-pki-ca' has = >>>>>>>>>> Serial number 1341718541 in the NSSDB /etc/pki/pki-tomcat/alias. >>>>>>>>> Yes >>>>>>>>> >>>>>>>>> [root(a)seattlenfs ianh]# certutil -L -d = >>>>>>>>> /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' | = >>>>>>>>> grep Serial >>>>>>>>> Serial Number: 1341718541 (0x4ff9000d) >>>>>>>>> >>>>>>>>>> >>>>>>>>>> - In the LDAP servers, the cert is stored in the entry = >>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca with Serial number 4 (i.e.= it = >>>>>>>>>> is the cert from freeipa-sea). >>>>>>>>> This is where the difference is. There are two certificates = >>>>>>>>> on the master and only one on the other. I wonder if this is = >>>>>>>>> a result of the slow motion replication trainwreck I have = >>>>>>>>> going on due to a zombie replica in the ldap database that no = >>>>>>>>> longer exists in the real world and I can't seem to get rid of. >>>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> the remaining issue is a replication problem. There is a = >>>>>>>> "Troubleshooting replication" section [1] in IdM Admin guide = >>>>>>>> that may help you. >>>>>>>> >>>>>>>> Regarding your zombie replica, which commands did you use to = >>>>>>>> try to remove it, and what was the output? >>>>>>>> >>>>>>>> Flo >>>>>>>> >>>>>>>> [1] = >>>>>>>> https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_L= inux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/trouble-g= en-replication.html >>>>>>>> >>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> To debug replication latency or problem we would need several = >>>>>>> info but starting with the results of the following commands >>>>>>> >>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>> manager' -W -b "uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca" nscpentrywsi >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> nscpentrywsi: = >>>>>> entryusn;adcsn-5938e688000104290005;vucsn-5938e688000104290005: >>>>>> 75274897 >>>>>> nscpentrywsi: = >>>>>> modifyTimestamp;adcsn-5938e688000104290004;vucsn-5938e6880001042 >>>>>> 90004: 20170608055334Z >>>>>> nscpentrywsi: = >>>>>> modifiersName;adcsn-5938e688000104290003;vucsn-5938e688000104290 >>>>>> 003: cn=3DDirectory Manager >>>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>>>>> nscpentrywsi: cn: pkidbuser >>>>>> nscpentrywsi: createTimestamp: 20150716125146Z >>>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>>>>> nscpentrywsi: description;vucsn-5938e688000104290001: = >>>>>> 2;1341718541;CN=3DCertific >>>>>> ate Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>> nscpentrywsi: description;vdcsn-5938e688000104290002;deleted: = >>>>>> 2;4;CN=3DCertifica >>>>>> te Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>> nscpentrywsi: mail: >>>>>> nscpentrywsi: objectClass: top >>>>>> nscpentrywsi: objectClass: person >>>>>> nscpentrywsi: objectClass: organizationalPerson >>>>>> nscpentrywsi: objectClass: inetOrgPerson >>>>>> nscpentrywsi: objectClass: cmsuser >>>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>> nscpentrywsi: sn: pkidbuser >>>>>> nscpentrywsi: uid: pkidbuser >>>>>> nscpentrywsi: userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>>>>> >>>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> nscpentrywsi: userCertificate;vucsn-5938e688000104290000:: = >>>>>> MIIDbjCCAlagAwIBAgI >>>>>> >>>>>> AR >>>>>> nscpentrywsi: userPassword:: >>>>>> nscpentrywsi: userstate: 1 >>>>>> nscpentrywsi: usertype: agentType >>>>>> nscpentrywsi: parentid: 2 >>>>>> nscpentrywsi: entryid: 51 >>>>>>> and >>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>>>>> >>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>>> -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca nscpentrywsi >>>>>> Enter LDAP Password: >>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> nscpentrywsi: dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>> nscpentrywsi: seeAlso: CN=3DCA Subsystem,O=3DBPT.ROCKS >>>>>> nscpentrywsi: userCertificate:: = >>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MR >>>>>> >>>>>> cBd4nOV4m9A+qRZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>> nscpentrywsi: description: 2;4;CN=3DCertificate = >>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subs >>>>>> ystem,O=3DBPT.ROCKS >>>>>> nscpentrywsi: entryid: 51 >>>>>> nscpentrywsi: parentid: 2 >>>>>> nscpentrywsi: modifyTimestamp: 20150716125146Z >>>>>> nscpentrywsi: createTimestamp: 20150716125146Z >>>>>> nscpentrywsi: modifiersName: cn=3Ddirectory manager >>>>>> nscpentrywsi: creatorsName: cn=3Ddirectory manager >>>>>> nscpentrywsi: userPassword:: >>>>>> nscpentrywsi: userstate: 1 >>>>>> nscpentrywsi: usertype: agentType >>>>>> nscpentrywsi: mail: >>>>>> nscpentrywsi: cn: pkidbuser >>>>>> nscpentrywsi: sn: pkidbuser >>>>>> nscpentrywsi: uid: pkidbuser >>>>>> nscpentrywsi: objectClass: top >>>>>> nscpentrywsi: objectClass: person >>>>>> nscpentrywsi: objectClass: organizationalPerson >>>>>> nscpentrywsi: objectClass: inetOrgPerson >>>>>> nscpentrywsi: objectClass: cmsuser >>>>>> nscpentrywsi: nsUniqueId: 48809b40-2bb911e5-96a0b8b8-1fdd8074 >>>>>> nscpentrywsi: entryusn: 86 >>>>>>> >>>>>>> From the output you may only copy/past the ones related to = >>>>>>> userCertificate >>>>>>> >>>>>>> >>>>>>> Also to dump the current replication status, send the result of >>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b = >>>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-f= fffffff-ffffffff-ffffffff))" >>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>> manager' -W -b "o=3Dipaca" = >>>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff= ff-ffffffff))" >>>>>> Enter LDAP Password: >>>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>>>>> cn: replica >>>>>> nsDS5Flags: 1 >>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>>>> cloneAgreement1-freeipa-sea.bpt.roc >>>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>>>> masterAgreement1-seattlenfs.bpt.roc >>>>>> ks-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>>>> nsDS5ReplicaId: 1065 >>>>>> nsDS5ReplicaName: b21a1f1e-627911e6-93e6ef4b-69dcc2d1 >>>>>> nsDS5ReplicaRoot: o=3Dipaca >>>>>> nsDS5ReplicaType: 3 >>>>>> nsState:: KQQAAAAAAAAhHIpZAAAAAAEAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D= =3D >>>>>> nsds5replicabinddngroup: cn=3Dreplication = >>>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>>>>> dc=3Drocks >>>>>> nsds5replicabinddngroupcheckinterval: 60 >>>>>> objectClass: top >>>>>> objectClass: nsDS5Replica >>>>>> objectClass: extensibleobject >>>>>> nsds50ruv: {replicageneration} 57c291d9000004290000 >>>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>>>>> 57f840bf00000429000 >>>>>> 0 598a1c40000104290000 >>>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} >>>>>> nsds5agmtmaxcsn: = >>>>>> o=3Dipaca;cloneAgreement1-freeipa-sea.bpt.rocks-pki-tomcat;seat >>>>>> tlenfs.bpt.rocks;389;unavailable >>>>>> nsds5agmtmaxcsn: = >>>>>> o=3Dipaca;masterAgreement1-seattlenfs.bpt.rocks-pki-tomcat;seat >>>>>> tlenfs.bpt.rocks;389;unavailable >>>>>> nsruvReplicaLastModified: {replica 1065 = >>>>>> ldap://freeipa-sea.bpt.rocks:389} 598a >>>>>> 1c16 >>>>>> nsruvReplicaLastModified: {replica 1290 = >>>>>> ldap://seattlenfs.bpt.rocks:389} 00000 >>>>>> 000 >>>>>> nsds5ReplicaChangeCount: 885 >>>>>> nsds5replicareapactive: 0 >>>>>>> and >>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>> manager' -W -b = >>>>>>> "o=3Dipaca"//"(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-f= fffffff-ffffffff-ffffffff))" >>>>>> >>>>>> >>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory manager= ' = >>>>>> -W -b "o=3Dipaca" = >>>>>> "(&(objectclass=3Dnstombstone)(nsUniqueId=3Dffffffff-ffffffff-ffffff= ff-ffffffff))" >>>>>> Enter LDAP Password: >>>>>> dn: cn=3Dreplica,cn=3Do\3Dipaca,cn=3Dmapping tree,cn=3Dconfig >>>>>> cn: replica >>>>>> nsDS5Flags: 1 >>>>>> nsDS5ReplicaBindDN: cn=3DReplication Manager = >>>>>> cloneAgreement1-seattlenfs.bpt.rock >>>>>> s-pki-tomcat,ou=3Dcsusers,cn=3Dconfig >>>>>> nsDS5ReplicaId: 1290 >>>>>> nsDS5ReplicaName: 8706ab1e-6a8311e6-a9bfdbbf-74dc7323 >>>>>> nsDS5ReplicaRoot: o=3Dipaca >>>>>> nsDS5ReplicaType: 3 >>>>>> nsState:: CgUAAAAAAAAKFYpZAAAAAAAAAAAAAAAAKgAAAAAAAAABAAAAAAAAAA=3D= =3D >>>>>> nsds5replicabinddngroup: cn=3Dreplication = >>>>>> managers,cn=3Dsysaccounts,cn=3Detc,dc=3Dbpt, >>>>>> dc=3Drocks >>>>>> nsds5replicabinddngroupcheckinterval: 60 >>>>>> objectClass: top >>>>>> objectClass: nsDS5Replica >>>>>> objectClass: extensibleobject >>>>>> nsds50ruv: {replicageneration} 55c8f3ae000000600000 >>>>>> nsds50ruv: {replica 1290 ldap://seattlenfs.bpt.rocks:389} = >>>>>> 57be804c0000050a0000 >>>>>> 587236150000050a0000 >>>>>> nsds50ruv: {replica 1065 ldap://freeipa-sea.bpt.rocks:389} = >>>>>> 57b103d400000429000 >>>>>> 0 57be8043000704290000 >>>>>> nsds5agmtmaxcsn: = >>>>>> o=3Dipaca;cloneAgreement1-seattlenfs.bpt.rocks-pki-tomcat;freei >>>>>> pa-sea.bpt.rocks;389;1065;587236150000050a0000 >>>>>> nsruvReplicaLastModified: {replica 1290 = >>>>>> ldap://seattlenfs.bpt.rocks:389} 00000 >>>>>> 000 >>>>>> nsruvReplicaLastModified: {replica 1065 = >>>>>> ldap://freeipa-sea.bpt.rocks:389} 0000 >>>>>> 0000 >>>>>> nsds5ReplicaChangeCount: 3 >>>>>> nsds5replicareapactive: 0 >>>>>>> >>>>>>> Regards >>>>>>> thierry >>>>>>>>> [root(a)freeipa-sea ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertific= ate = >>>>>>>>> description >>>>>>>>> Enter LDAP Password: >>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>> userCertificate:: = >>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>> >>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>> userCertificate:: = >>>>>>>>> MIIDbjCCAlagAwIBAgIET/kADTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQK >>>>>>>>> fuQQZmP1XrKkrfsjeiFbUFtoMnfmHLIYpe5QAR >>>>>>>>> description: 2;1341718541;CN=3DCertificate = >>>>>>>>> Authority,O=3DBPT.ROCKS;CN=3DCA Subsystem >>>>>>>>> ,O=3DBPT.ROCKS >>>>>>>>> >>>>>>>>> >>>>>>>>> [root(a)seattlenfs ianh]# ldapsearch -LLL -D 'cn=3Ddirectory = >>>>>>>>> manager' -W -b uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertific= ate = >>>>>>>>> description >>>>>>>>> Enter LDAP Password: >>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>> userCertificate:: = >>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>> >>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3DCA = >>>>>>>>> Subsystem,O=3DBPT.RO >>>>>>>>> CKS >>>>>>>>> >>>>>>>>>> If you check the certificates dates, I guess that the most = >>>>>>>>>> recent one is on server seattlenfs (because of serial = >>>>>>>>>> numbers). Can you confirm this (because our goal is to have = >>>>>>>>>> the most recent cert stored in all the NSSDBs and in LDAP)? >>>>>>>>>> >>>>>>>>>> Thanks, >>>>>>>>>> Flo >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>> If your renewal master is the machine on which the NSS DB = >>>>>>>>>>>> /etc/pki/pki-tomcat/alias contains the newer cert, then you = >>>>>>>>>>>> can manually run the scripts: >>>>>>>>>>> >>>>>>>>>>> If I'm interpreting this correctly, then it is... so I ran = >>>>>>>>>>> this on the broken machine (seattlenfs) >>>>>>>>>>> >>>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/stop_pkicad >>>>>>>>>>>> $ sudo /usr/libexec/ipa/certmonger/renew_ca_cert = >>>>>>>>>>>> "subsystemCert cert-pki-ca" >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> I ran this, it took a while, then I re-checked and the = >>>>>>>>>>> serial still seems to be 4 >>>>>>>>>>> >>>>>>>>>>> $ ldapsearch -LLL -D 'cn=3Ddirectory manager' -W -b = >>>>>>>>>>> uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca userCertificate descripti= on >>>>>>>>>>> Enter LDAP Password: >>>>>>>>>>> dn: uid=3Dpkidbuser,ou=3Dpeople,o=3Dipaca >>>>>>>>>>> userCertificate:: = >>>>>>>>>>> MIIDczCCAlugAwIBAgIBBDANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlC >>>>>>>>>>> ... >>>>>>>>>>> ZNo4eX7jNT8Aa23gDl6xuLVa1SxlyE8XEo8dfAPXMJoFc=3D >>>>>>>>>>> description: 2;4;CN=3DCertificate Authority,O=3DBPT.ROCKS;CN=3D= CA = >>>>>>>>>>> Subsystem,O=3DBPT.ROCKS >>>>>>>>>>> >>>>>>>>>>> Here's what was in /var/log/pki/pki-tomcat/ca/debug >>>>>>>>>>> >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: =3D=3D=3D=3D=3D = DEBUG = >>>>>>>>>>> SUBSYSTEM INITIALIZED =3D=3D=3D=3D=3D=3D=3D >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> restart at autoShutdown? false >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> autoShutdown crumb file path? = >>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> done init id=3Ddebug >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> initialized debug >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> initSubsystem id=3Dlog >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> ready to init id=3Dlog >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_a= udit) = >>>>>>>>>>> >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/system) >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>>> RollingLogFile(/var/lib/pki/pki-tomcat/logs/ca/transactions) >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> restart at autoShutdown? false >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> autoShutdown crumb file path? = >>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> done init id=3Dlog >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> initialized log >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> initSubsystem id=3Djss >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> ready to init id=3Djss >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> restart at autoShutdown? false >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> autoShutdown crumb file path? = >>>>>>>>>>> /var/lib/pki/pki-tomcat/logs/autoShutdown.crumb >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> about to look for cert for auto-shutdown = >>>>>>>>>>> support:auditSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> found cert:auditSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> done init id=3Djss >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> initialized jss >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> initSubsystem id=3Ddbs >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: CMSEngine: = >>>>>>>>>>> ready to init id=3Ddbs >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: DBSubsystem: = >>>>>>>>>>> init() mEnableSerialMgmt=3Dtrue >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Creating = >>>>>>>>>>> LdapBoundConnFactor(DBSubsystem) >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> LdapBoundConnFactory: init >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> LdapBoundConnFactory:doCloning true >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>>>> init() >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>>>> init begins >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: LdapAuthInfo: = >>>>>>>>>>> init ends >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: init: before = >>>>>>>>>>> makeConnection errorIfDown is true >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> makeConnection: errorIfDown true >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: TCP = >>>>>>>>>>> Keep-Alive: true >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> SSLClientCertificateSelectionCB: Setting desired cert = >>>>>>>>>>> nickname to: subsystemCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> LdapJssSSLSocket: set client auth cert nickname = >>>>>>>>>>> subsystemCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> SSLClientCertificatSelectionCB: Entering! >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate = >>>>>>>>>>> cert: ocspSigningCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: Candidate = >>>>>>>>>>> cert: subsystemCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> SSLClientCertificateSelectionCB: desired cert found in list: = >>>>>>>>>>> subsystemCert cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> SSLClientCertificateSelectionCB: returning: subsystemCert = >>>>>>>>>>> cert-pki-ca >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: SSL handshake = >>>>>>>>>>> happened >>>>>>>>>>> [03/Aug/2017:13:52:51][localhost-startStop-1]: = >>>>>>>>>>> CMSEngine.shutdown() >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> I really appreciate you sticking with me through this. I = >>>>>>>>>>> owe you. >>>>>>>>>>> >>>>>>>>>>> - Ian >>>>>>>>>>> >>>>>>>>>>>> After that, check that the LDAP entry has been updated. If = >>>>>>>>>>>> it is the case, you should be able to restart pki. >>>>>>>>>>>> >>>>>>>>>>>> Flo >>>>>>>>>>>> >>>>>>>>>>>>> Thank you again for your time! >>>>>>>>>>>>> >>>>>>>>>>>>> Ian >>>>>>>>>>>>> >>>>>>>>>>>>>> Flo. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> which seems weird. >>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> The description attribute in the ldapsearch output is = >>>>>>>>>>>>>>>> of the form 2;#;DN;DN >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> The # should match the serial number in the first = >>>>>>>>>>>>>>>> certutil output >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> The ASCII blob (minus the BEGIN/END headers) should = >>>>>>>>>>>>>>>> match one of the >>>>>>>>>>>>>>>> userCertificate attributes. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> rob >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>> _______________________________________________ >>>>>>>>> FreeIPA-users mailing list -- = >>>>>>>>> freeipa-users(a)lists.fedorahosted.org >>>>>>>>> To unsubscribe send an email to = >>>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>>>>> _______________________________________________ >>>>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.o= rg >>>>>>>> To unsubscribe send an email to = >>>>>>>> freeipa-users-leave(a)lists.fedorahosted.org >>>>>>> >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >>>>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahos= ted.org >>>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org >>>> To unsubscribe send an email tofreeipa-users-leave(a)lists.fedorahoste= d.org >>> >> > > > > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.= org --===============3500582530928333893== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl bnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPHA+T24gOC8xNi8xNyA1OjI0IEFNLCB0aGll cnJ5IGJvcmRheiB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICA8L3A+CiAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk5NDM5N0UuMjA0MDhAcmVkaGF0LmNvbSI+ CiAgICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIj4KICAgICAgSGkgSWFuPGJyPgogICAgICA8YnI+CiAgICAgIDxibG9j a3F1b3RlCiAgICAgICAgY2l0ZT0ibWlkOjdmYzIzNDMyLWUzMzktOWI3NS1iOWE2LWFlNDYyOGY3 ODRlMkBicm93bnBhcGVydGlja2V0cy5jb20iCiAgICAgICAgdHlwZT0iY2l0ZSI+IEhtbS4uIFRo aXMgbG9va3Mgb2RkLjxicj4KICAgICAgICA8YnI+CiAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBp YW5oXSMgaXBhLWNzcmVwbGljYS1tYW5hZ2UgcmUtaW5pdGlhbGl6ZQogICAgICAgIC0tZnJvbSBm cmVlaXBhLXNlYS5icHQucm9ja3M8YnI+CiAgICAgICAgRGlyZWN0b3J5IE1hbmFnZXIgcGFzc3dv cmQ6IDxicj4KICAgICAgICA8YnI+CiAgICAgICAgaXBhOiBFUlJPUjogRm91bmQgbXVsdGlwbGUg YWdyZWVtZW50cyBmb3Igc2VhdHRsZW5mcy5icHQucm9ja3MuCiAgICAgICAgT25seSBpbml0aWFs aXppbmcgdGhlIGZpcnN0IG9uZSByZXR1cm5lZDoKY249Y2xvbmVBZ3JlZW1lbnQxLWZyZWVpcGEt c2VhLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1w9aXBhY2EsY249bWFwcGlu ZwogICAgICAgIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgIFVwZGF0ZSBpbiBwcm9ncmVzcywg MTUgc2Vjb25kcyBlbGFwc2VkPGJyPgogICAgICAgIFtmcmVlaXBhLXNlYS5icHQucm9ja3NdIHJl cG9ydHM6IFVwZGF0ZSBmYWlsZWQhIFN0YXR1czogWzMywqAgLQogICAgICAgIExEQVAgZXJyb3I6 IE5vIHN1Y2ggb2JqZWN0XTxicj4KICAgICAgPC9ibG9ja3F1b3RlPgogICAgICA8YnI+CiAgICAg IEhlcmUgdGhlcmUgYXJlIHNldmVyYWwgcmVwbGljYSBhZ3JlZW1lbnQgZnJvbQogICAgICBmcmVl aXBhLXNlYS5icHQucm9ja3MtJmd0OyBzZWF0dGxlbmZzIChmb3Igbz1pcGFjYSBzdWZmaXgpLjxi cj4KICAgICAgSSBhbSBub3Qgc3VyZSBob3cgdGhpcyBjYW4gaGFwcGVuLiA8YnI+CiAgICAgIEl0 IGNvdWxkIGJlIHNvbWUgcmVtYWluaW5nIGVudHJpZXMgZnJvbSBwcmV2aW91cyBpbnN0YWxsL3Vu aW5zdGFsbAogICAgICBvciBtdWx0aXBsZSBpbml0aWFsaXphdGlvbiBmcm9tIGRpZmZlcmVudCBz b3VyY2VzLjxicj4KICAgIDwvYmxvY2txdW90ZT4KICAgIElmIGl0J3MgcG9zc2libGUgdG8gZG8g c29tZXRoaW5nIHdyb25nIEkgYW0gc3VyZSBJIGhhdmUgZG9uZSBpdC7CoCBJCiAgICBoYXZlIHRy aWVkIHRoZSB2YXJpb3VzIGNsZWFuLXJ1diBjb21tYW5kcyBmb3IgdGhlIGFwcGFyZW50bHkKICAg IGV4aXN0aW5nIGFncmVlbWVudHMgd2l0aCBub25leGlzdGVudCBzZXJ2ZXJzIG1hbnkgdGltZXMg YnV0IGl0IHNlZW1zCiAgICBvdCBoYXZlIG5vIGVmZmVjdC48YnI+CiAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIiBjaXRlPSJtaWQ6NTk5NDM5N0UuMjA0MDhAcmVkaGF0LmNvbSI+IDxicj4KICAg ICAgTG9va2luZyBhdCB0aGUgZXJyb3IgYmVsb3csIEkgd29uZGVyIGlmIHRoZXJlIHdlcmUgYWN0 dWFsbHkgMgogICAgICByZXBsaWNhIGFncmVlbWVudHMgZnJlZWlwYS1zZWEtJmd0O3NlYXR0bGVu ZnMgdGhhdCBhcmUgPGJyPgogICAgICA8dWw+CiAgICAgICAgPGxpPjx0dD5jbG9uZUFncmVlbWVu dDEtZnJlZWlwYS1zZWEuYnB0LnJvY2tzLXBraS10b21jYXQ8L3R0PjwvbGk+CiAgICAgICAgPGxp Pjx0dD5tYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ8L3R0 PjwvbGk+CiAgICAgIDwvdWw+CiAgICAgIDxwPldvdWxkIHlvdSBkdW1wIChvbiBhbGwgc2VydmVy cyBmcmVlaXBhLXNlYSwgc2VhdHRsZW5mcyBhbmQKICAgICAgICBmcmVlaXBhLWRhbCk6PGJyPgog ICAgICA8L3A+CiAgICAgIDxwPjx0dD5sZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBt YW5hZ2VyJyAtVyAtYgogICAgICAgICAgImNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBp bmcgdHJlZSxjbj1jb25maWciCiAgICAgICAgICBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgPC90 dD48L3A+CiAgICAgIDxwPjx0dD48YnI+CiAgICAgICAgPC90dD48L3A+CiAgICA8L2Jsb2NrcXVv dGU+CiAgICA8dHQ+ZnJlZWlwYS1kYWwgbm8gbG9uZ2VyIGV4aXN0cy7CoCBBbHNvLCBzaW5jZSB0 aGV5IGFsc28gYXBwZWFyCiAgICAgIGJlbG93Li4uIG5laXRoZXIgZG8gZWRpbmJ1cmdobmZzLCBm cmVtb250bmlzLCBiZWxsZXZ1ZW5mcyBvcgogICAgICBicHQtbnljMS1uZnMuwqAgVGhlIG9uZSBj YXVzaW5nIG1lIHRoZSBtb3N0IG9idmlvdXMgaGVhZGFjaGVzIGlzCiAgICAgIGZyZWVpcGEtZGFs Ljxicj4KICAgICAgPGJyPgogICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJj aCAtTExMIC1EICdjbj1kaXJlY3RvcnkgbWFuYWdlcicKICAgICAgLVcgLWIgImNuPXJlcGxpY2Es Y249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWciCiAgICAgIG5zY3BlbnRyeXdz aTxicj4KICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICBkbjogY249cmVwbGlj YSxjbj1vXDNEaXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBkbjogY249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFwcGluZwogICAgICB0cmVl LGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBjbjogcmVwbGljYTxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTYwODE0MjM0OTM5Wjxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAg ICBuc2NwZW50cnl3c2k6IG1vZGlmaWVyc05hbWU6IGNuPU11bHRpbWFzdGVyIFJlcGxpY2F0aW9u CiAgICAgIFBsdWdpbixjbj1wbHVnaW5zLGNuPWM8YnI+CiAgICAgIMKgb25maWc8YnI+CiAgICAg IG5zY3BlbnRyeXdzaTogbW9kaWZ5VGltZXN0YW1wOiAyMDE3MDgxNjE0MTYzNFo8YnI+CiAgICAg IG5zY3BlbnRyeXdzaTogbnNEUzVGbGFnczogMTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RT NVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgY2xvbmVBZ3JlZW1l bnQxLWZyZWVpPGJyPgogICAgICDCoHBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdCxvdT1jc3Vz ZXJzLGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FCaW5kRE46 IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgbWFzdGVyQWdyZWVtZW50MS1zZWF0PGJyPgog ICAgICDCoHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxi cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FJZDogMTA2NTxicj4KICAgICAgbnNj cGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FOYW1lOgogICAgICBiMjFhMWYxZS02Mjc5MTFlNi05M2U2 ZWY0Yi02OWRjYzJkMTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FSb290OiBv PWlwYWNhPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYVR5cGU6IDM8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogbnNTdGF0ZTo6CiAgICAgIEtRUUFBQUFBQUFEQVU1UlpBQUFBQUFB QUFBQUFBQUFBS2dBQUFBQUFBQUFBQUFBQUFBQUFBQTxicj4KICAgICAgwqA9PTxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAg ICAgbWFuYWdlcnMsY249c3lzYWNjb3VudHMsPGJyPgogICAgICDCoGNuPWV0YyxkYz1icHQsZGM9 cm9ja3M8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhYmluZGRuZ3JvdXBjaGVj a2ludGVydmFsOiA2MDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogdG9wPGJy PgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBuc0RTNVJlcGxpY2E8YnI+CiAgICAg IG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGV4dGVuc2libGVvYmplY3Q8YnI+CiAgICAgIG5z Y3BlbnRyeXdzaTogbnVtU3Vib3JkaW5hdGVzOiAyPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5z ZHM1UmVwbGljYUNoYW5nZUNvdW50OiA5NjE8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVy ZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgPGJyPgogICAgICBkbjoKY249Y2xvbmVBZ3Jl ZW1lbnQxLWZyZWVpcGEtc2VhLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LGNuPXJlcGxpY2EsY249b1wz RGlwYWM8YnI+CiAgICAgIMKgYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBu c2NwZW50cnl3c2k6IGRuOgogICAgICBjbj1jbG9uZUFncmVlbWVudDEtZnJlZWlwYS1zZWEuYnB0 LnJvY2tzLXBraS10b21jYXQsY249cmVwbGk8YnI+CiAgICAgIMKgY2EsY249b1wzRGlwYWNhLGNu PW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogY246IGNsb25l QWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdDxicj4KICAgICAgbnNj cGVudHJ5d3NpOiBjcmVhdGVUaW1lc3RhbXA6IDIwMTYwODE0MjM0OTQwWjxicj4KICAgICAgbnNj cGVudHJ5d3NpOiBjcmVhdG9yc05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICBu c2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uOgogICAgICBjbG9uZUFncmVlbWVudDEtZnJlZWlwYS1z ZWEuYnB0LnJvY2tzLXBraS10b21jYXQ8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbW9kaWZpZXJz TmFtZTogY249TXVsdGltYXN0ZXIgUmVwbGljYXRpb24KICAgICAgUGx1Z2luLGNuPXBsdWdpbnMs Y249Yzxicj4KICAgICAgwqBvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBtb2RpZnlUaW1l c3RhbXA6IDIwMTcwODEwMTgzNDM3Wjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxp Y2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgbWFzdGVyQWdyZWVtZW50MS1m cmVlPGJyPgogICAgICDCoGlwYS1zZWEuYnB0LnJvY2tzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxj bj1jb25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhQmluZE1ldGhvZDog U2ltcGxlPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUNyZWRlbnRpYWxzOgog ICAgICB7QUVTLVRVaE5SME5UY1VkVFNXSXpSRkZGUmtSVVFtMU5SVlZIUTE8YnI+CsKgTnhSMU5K WWpORVVVVkdSRVJCTkVKRFVYaE5lbXN5VGxSa2EwNVRNSGhaTWxFMVRUSktiQTBLVDFNd05VMUhU bTFQVjBWNlQxTXdNazU8YnI+CsKgcWF6Tk5WMFYzVG5kQlEwRlJTVU5CVTBGM1EyZFpTVXR2V2ts b2RtTk9RV2RqZDBoUldVcFpTVnBKUVZkVlJBMEtRa0ZGY1VKQ1EwZGE8YnI+CiAgICAgIMKgYkUx elkyTm9kMEZRZUZsWE1rRjBZM1JoVEE9PX1BSXVUbWIrbzMvTVdnbzBtYzhyOGZ3PT08YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhSG9zdDogc2VhdHRsZW5mcy5icHQucm9ja3M8 YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhUG9ydDogMzg5PGJyPgogICAgICBu c2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYVJvb3Q6IG89aXBhY2E8YnI+CiAgICAgIG5zY3BlbnRy eXdzaTogbnNEUzVSZXBsaWNhVHJhbnNwb3J0SW5mbzogVExTPGJyPgogICAgICBuc2NwZW50cnl3 c2k6IG5zZHM1MHJ1djoge3JlcGxpY2FnZW5lcmF0aW9ufSA1NWM4ZjNhZTAwMDAwMDYwMDAwMDxi cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhIDgxCiAgICAgIDxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y b2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fSA1NjhhYzQzMTxi cj4KICAgICAgwqAwMDAwMDA1MTAwMDAgNTdiMTAzY2UwMDA1MDA1MTAwMDA8YnI+CiAgICAgIG5z Y3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1CiAgICAgIDxhIGNsYXNzPSJtb3ot dHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5 Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDU3YjEwPGJyPgogICAgICDC oDNkNDAwMDAwNDI5MDAwMCA1N2IyNTRkZjAwMDAwNDI5MDAwMDxicj4KICAgICAgbnNjcGVudHJ5 d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhIDEwOTUKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6 Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0gNTc5YTk8YnI+CiAgICAgIMKgNjNjMDAw MDA0NDcwMDAwIDU3YTQyMzg5MDAwMTA0NDcwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5z ZHM1MHJ1djoge3JlcGxpY2EgOTYKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4 dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBh LXNlYS5icHQucm9ja3M6Mzg5PC9hPn0gNTVjOGYzYjxicj4KICAgICAgwqBkMDAwMDAwNjAwMDAw IDU3OTlhMDJlMDAwMDAwNjAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1UmVwbGlj YUVuYWJsZWQ6IG9uPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zcnV2UmVwbGljYUxhc3RNb2Rp ZmllZDoge3JlcGxpY2EgODEKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg aHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2siPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y b2NrPC9hPjxicj4KICAgICAgwqBzOjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdz aTogbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1CiAgICAgIDxhIGNsYXNz PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQuciI+ bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yPC9hPjxicj4KICAgICAgwqBvY2tzOjM4OX0gMDAwMDAw MDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVw bGljYSAxMDk1CiAgICAgIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imxk YXA6Ly9mcmVlaXBhLXNlYS5icHQuciI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yPC9hPjxicj4K ICAgICAgwqBvY2tzOjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNydXZS ZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSA5NgogICAgICA8YSBjbGFzcz0ibW96LXR4dC1s aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvYyI+bGRhcDovL2Zy ZWVpcGEtc2VhLmJwdC5yb2M8L2E+PGJyPgogICAgICDCoGtzOjM4OX0gMDAwMDAwMDA8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3Np OiBvYmplY3RDbGFzczogbnNkczVyZXBsaWNhdGlvbmFncmVlbWVudDxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6 IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGFydDogMTk3MDAxMDEwMDAwMDBaPGJyPgogICAgICBu c2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVFbmQ6IDE5NzAwMTAxMDAwMDAwWjxi cj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FDaGFuZ2VzU2VudFNpbmNlU3RhcnR1 cDo8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhTGFzdFVwZGF0ZVN0YXR1czog RXJyb3IgKDMyKSBQcm9ibGVtCiAgICAgIGNvbm5lY3RpbmcgdG8gcjxicj4KICAgICAgwqBlcGxp Y2EgLSBMREFQIGVycm9yOiBObyBzdWNoIG9iamVjdCAoY29ubmVjdGlvbiBlcnJvcik8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhVXBkYXRlSW5Qcm9ncmVzczogRkFMU0U8YnI+ CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhTGFzdEluaXRTdGFydDogMTk3MDAxMDEw MDAwMDBaPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RJbml0RW5kOiAx OTcwMDEwMTAwMDAwMFo8YnI+CiAgICAgIDxicj4KICAgICAgZG46CmNuPW1hc3RlckFncmVlbWVu dDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBsaWNhLGNuPW9cM0RpcGFj PGJyPgogICAgICDCoGEsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBkbjoKICAgICAgY249bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nr cy1wa2ktdG9tY2F0LGNuPXJlcGxpPGJyPgogICAgICDCoGNhLGNuPW9cM0RpcGFjYSxjbj1tYXBw aW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IGNuOiBtYXN0ZXJBZ3Jl ZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ8YnI+CiAgICAgIG5zY3BlbnRy eXdzaTogY3JlYXRlVGltZXN0YW1wOiAyMDE2MDgyNTA1MjAxMVo8YnI+CiAgICAgIG5zY3BlbnRy eXdzaTogY3JlYXRvcnNOYW1lOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhPGJyPgog ICAgICBuc2NwZW50cnl3c2k6IGRlc2NyaXB0aW9uOgogICAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNl YXR0bGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQ8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbW9k aWZpZXJzTmFtZTogY249TXVsdGltYXN0ZXIgUmVwbGljYXRpb24KICAgICAgUGx1Z2luLGNuPXBs dWdpbnMsY249Yzxicj4KICAgICAgwqBvbmZpZzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBtb2Rp ZnlUaW1lc3RhbXA6IDIwMTcwNzA2MjExMjIwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RT NVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAgICAgY2xvbmVBZ3JlZW1l bnQxLXNlYXR0PGJyPgogICAgICDCoGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LG91PWNzdXNl cnMsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUJpbmRNZXRo b2Q6IFNpbXBsZTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FDcmVkZW50aWFs czoKICAgICAge0FFUy1UVWhOUjBOVGNVZFRTV0l6UkZGRlJrUlVRbTFOUlZWSFExPGJyPgrCoE54 UjFOSllqTkVVVVZHUkVSQk5FSkRVWGhOZW1zeVRsUmthMDVUTUhoWk1sRTFUVEpLYkEwS1QxTXdO VTFIVG0xUFYwVjZUMU13TWs1PGJyPgrCoHFhek5OVjBWM1RuZEJRMEZSU1VOQlUwRjNRMmRaU1V0 dldrbG9kbU5PUVdkamQwaFJXVXBaU1ZwSlFWZFZSQTBLUWtGRmNVSkNRblo2PGJyPgogICAgICDC oFoydEdVekVyU2psdmRFVllSbEZKYVZReU1BPT19eWhFQUtLRWxxdWRxcWwzMS9rV3NVdz09PGJy PgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUhvc3Q6IHNlYXR0bGVuZnMuYnB0LnJv Y2tzPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYVBvcnQ6IDM4OTxicj4KICAg ICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICBuc2Nw ZW50cnl3c2k6IG5zRFM1UmVwbGljYVRyYW5zcG9ydEluZm86IFRMUzxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhZ2VuZXJhdGlvbn0gNTVjOGYzYWUwMDAwMDA2MDAw MDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwCiAgICAg IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZz LmJwdC5yb2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fSA1N2Jl ODA8YnI+CiAgICAgIMKgNGMwMDAwMDUwYTAwMDAgNTg3MjM2MTUwMDAwMDUwYTAwMDA8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1CiAgICAgIDxhIGNsYXNz PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j a3M6Mzg5Ij5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnJvY2tzOjM4OTwvYT59IDU3YjEwPGJyPgog ICAgICDCoDNkNDAwMDAwNDI5MDAwMCA1N2JlODA0MzAwMDcwNDI5MDAwMDxicj4KICAgICAgbnNj cGVudHJ5d3NpOiBuc2RzNTBydXY6IHtyZXBsaWNhIDEwNzAKICAgICAgPGEgY2xhc3M9Im1vei10 eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2JlbGxldnVlbmZzLmJwdC5yb2NrczozODki PmxkYXA6Ly9iZWxsZXZ1ZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0gNTdhNGY8YnI+CiAgICAgIMKg MjcwMDAwMDA0MmUwMDAwIDU3YTRmMjcwMDAwNzA0MmUwMDAwPGJyPgogICAgICBuc2NwZW50cnl3 c2k6IG5zZHM1MHJ1djoge3JlcGxpY2EgMTA3NQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5r LWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vYnB0LW55YzEtbmZzLmJwdC5yb2NrczozODkiPmxkYXA6 Ly9icHQtbnljMS1uZnMuYnB0LnJvY2tzOjM4OTwvYT59IDU3YTQ8YnI+CiAgICAgIMKgNzg2NTAw MDAwNDMzMDAwMCA1N2IxMTFjODAwMDQwNDMzMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBu c2RzNTBydXY6IHtyZXBsaWNhIDEwODUKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVl dGV4dCIgaHJlZj0ibGRhcDovL2ZyZW1vbnRuaXMuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZW1v bnRuaXMuYnB0LnJvY2tzOjM4OTwvYT59IDU3YTQwMzxicj4KICAgICAgwqBlNjAwMDAwNDNkMDAw MCA1N2E2NDNlYTAwMDAwNDNkMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNTBydXY6 IHtyZXBsaWNhIDEwOTAKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJl Zj0ibGRhcDovL2ZyZWVpcGEtZGFsLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLWRhbC5i cHQucm9ja3M6Mzg5PC9hPn0gNTdhMmQ8YnI+CiAgICAgIMKgZDM1MDAwMDA0NDIwMDAwIDU3YTJk ZDM1MDAwNDA0NDIwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1MHJ1djoge3JlcGxp Y2EgMTE5NQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFw Oi8vZWRpbmJ1cmdobmZzLmJwdC5yb2NrczozODkiPmxkYXA6Ly9lZGluYnVyZ2huZnMuYnB0LnJv Y2tzOjM4OTwvYT59IDU3YTQ8YnI+CiAgICAgIMKgMjM5MDAwMDAwNGFiMDAwMCA1N2E0MjM5MDAw MDQwNGFiMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc3J1dlJlcGxpY2FMYXN0TW9kaWZp ZWQ6IHtyZXBsaWNhIDEyOTAKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIg aHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm88 L2E+PGJyPgogICAgICDCoGNrczozODl9IDAwMDAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6 IG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA2NQogICAgICA8YSBjbGFzcz0i bW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnIiPmxk YXA6Ly9mcmVlaXBhLXNlYS5icHQucjwvYT48YnI+CiAgICAgIMKgb2NrczozODl9IDAwMDAwMDAw PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxp Y2EgMTA3MAogICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFw Oi8vYmVsbGV2dWVuZnMuYnB0LnIiPmxkYXA6Ly9iZWxsZXZ1ZW5mcy5icHQucjwvYT48YnI+CiAg ICAgIMKgb2NrczozODl9IDAwMDAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zcnV2UmVw bGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA3NQogICAgICA8YSBjbGFzcz0ibW96LXR4dC1s aW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vYnB0LW55YzEtbmZzLmJwdCI+bGRhcDovL2JwdC1u eWMxLW5mcy5icHQ8L2E+Ljxicj4KICAgICAgwqByb2NrczozODl9IDAwMDAwMDAwPGJyPgogICAg ICBuc2NwZW50cnl3c2k6IG5zcnV2UmVwbGljYUxhc3RNb2RpZmllZDoge3JlcGxpY2EgMTA4NQog ICAgICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlbW9u dG5pcy5icHQucm8iPmxkYXA6Ly9mcmVtb250bmlzLmJwdC5ybzwvYT48YnI+CiAgICAgIMKgY2tz OjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNydXZSZXBsaWNhTGFzdE1v ZGlmaWVkOiB7cmVwbGljYSAxMDkwCiAgICAgIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRl eHQiIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLWRhbC5icHQuciI+bGRhcDovL2ZyZWVpcGEtZGFsLmJw dC5yPC9hPjxicj4KICAgICAgwqBvY2tzOjM4OX0gMDAwMDAwMDA8YnI+CiAgICAgIG5zY3BlbnRy eXdzaTogbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMTk1CiAgICAgIDxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9lZGluYnVyZ2huZnMuYnB0 Ij5sZGFwOi8vZWRpbmJ1cmdobmZzLmJwdDwvYT4uPGJyPgogICAgICDCoHJvY2tzOjM4OX0gMDAw MDAwMDA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IHRvcDxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogbnNkczVyZXBsaWNhdGlvbmFncmVlbWVudDxicj4K ICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICBu c2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGFydDogMTk3MDAxMDEwMDAwMDBa PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVFbmQ6IDE5NzAw MTAxMDAwMDAwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FDaGFuZ2VzU2Vu dFNpbmNlU3RhcnR1cDo8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhTGFzdFVw ZGF0ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBsaWNhdGlvbgogICAgICBlcnJvciBhY3F1aTxicj4K ICAgICAgwqByaW5nIHJlcGxpY2E6IFJlcGxpY2EgaGFzIGRpZmZlcmVudCBkYXRhYmFzZSBnZW5l cmF0aW9uIElELAogICAgICByZW1vdGUgcmVwbGljYSBtYTxicj4KICAgICAgwqB5IG5lZWQgdG8g YmUgaW5pdGlhbGl6ZWQgKFJVViBlcnJvcik8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVy ZXBsaWNhVXBkYXRlSW5Qcm9ncmVzczogRkFMU0U8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNk czVyZXBsaWNhTGFzdEluaXRTdGFydDogMTk3MDAxMDEwMDAwMDBaPGJyPgogICAgICBuc2NwZW50 cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RJbml0RW5kOiAxOTcwMDEwMTAwMDAwMFo8YnI+CiAgICAg IDxicj4KICAgICAgPGJyPgogICAgICAjIyMjIyMjIyMjIyMjIyMjIyM8YnI+CiAgICAgIDxicj4K ICAgICAgPGJyPgogICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwg LUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJwogICAgICAtVyAtYiAiY249cmVwbGljYSxjbj1vXDNE aXBhY2EsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZyIKICAgICAgbnNjcGVudHJ5d3NpPGJyPgog ICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgIGRuOiBjbj1yZXBsaWNhLGNuPW9c M0RpcGFjYSxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6 IGRuOiBjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgIHRyZWUsY249Y29u ZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IGNuOiByZXBsaWNhPGJyPgogICAgICBuc2NwZW50 cnl3c2k6IGNyZWF0ZVRpbWVzdGFtcDogMjAxNjA4MjUwNTIwMTFaPGJyPgogICAgICBuc2NwZW50 cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgIG5zY3Bl bnRyeXdzaTogbW9kaWZpZXJzTmFtZTogY249TXVsdGltYXN0ZXIgUmVwbGljYXRpb24KICAgICAg UGx1Z2luLGNuPXBsdWdpbnMsY249Yzxicj4KICAgICAgwqBvbmZpZzxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBtb2RpZnlUaW1lc3RhbXA6IDIwMTcwODEwMTgyNzQ5Wjxicj4KICAgICAgbnNjcGVu dHJ5d3NpOiBuc0RTNUZsYWdzOiAxPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGlj YUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICBjbG9uZUFncmVlbWVudDEtc2Vh dHQ8YnI+CiAgICAgIMKgbGVuZnMuYnB0LnJvY2tzLXBraS10b21jYXQsb3U9Y3N1c2Vycyxjbj1j b25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhSWQ6IDEyOTA8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhTmFtZToKICAgICAgODcwNmFiMWUtNmE4MzEx ZTYtYTliZmRiYmYtNzRkYzczMjM8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNh Um9vdDogbz1pcGFjYTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FUeXBlOiAz PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zU3RhdGU6OgogICAgICBDZ1VBQUFBQUFBQ2twWXha QUFBQUFBQUFBQUFBQUFBQUtnQUFBQUFBQUFBQkFBQUFBQUFBQUE8YnI+CiAgICAgIMKgPT08YnI+ CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhYmluZGRuZ3JvdXA6IGNuPXJlcGxpY2F0 aW9uCiAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLDxicj4KICAgICAgwqBjbj1ldGMsZGM9 YnB0LGRjPXJvY2tzPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYWJpbmRkbmdy b3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6 IHRvcDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFzczogbnNEUzVSZXBsaWNhPGJy PgogICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBleHRlbnNpYmxlb2JqZWN0PGJyPgog ICAgICBuc2NwZW50cnl3c2k6IG51bVN1Ym9yZGluYXRlczogMTxicj4KICAgICAgbnNjcGVudHJ5 d3NpOiBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogMzxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBu c2RzNXJlcGxpY2FyZWFwYWN0aXZlOiAwPGJyPgogICAgICA8YnI+CiAgICAgIGRuOgpjbj1jbG9u ZUFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBsaWNhLGNu PW9cM0RpcGFjYTxicj4KICAgICAgwqAsY249bWFwcGluZyB0cmVlLGNuPWNvbmZpZzxicj4KICAg ICAgbnNjcGVudHJ5d3NpOiBkbjoKICAgICAgY249Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMu YnB0LnJvY2tzLXBraS10b21jYXQsY249cmVwbGljPGJyPgogICAgICDCoGEsY249b1wzRGlwYWNh LGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogY246IGNs b25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0PGJyPgogICAgICBu c2NwZW50cnl3c2k6IGNyZWF0ZVRpbWVzdGFtcDogMjAxNjA4MjUwNTIwMTFaPGJyPgogICAgICBu c2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAg IG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246CiAgICAgIGNsb25lQWdyZWVtZW50MS1zZWF0dGxl bmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0PGJyPgogICAgICBuc2NwZW50cnl3c2k6IG1vZGlmaWVy c05hbWU6IGNuPWRpcmVjdG9yeSBtYW5hZ2VyPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG1vZGlm eVRpbWVzdGFtcDogMjAxNzA4MTAxODM0MjJaPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1 UmVwbGljYUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICBtYXN0ZXJBZ3JlZW1l bnQxLXNlYXQ8YnI+CiAgICAgIMKgdGxlbmZzLmJwdC5yb2Nrcy1wa2ktdG9tY2F0LG91PWNzdXNl cnMsY249Y29uZmlnPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUJpbmRNZXRo b2Q6IFNpbXBsZTxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FDcmVkZW50aWFs czoKICAgICAge0FFUy1UVWhOUjBOVGNVZFRTV0l6UkZGRlJrUlVRbTFOUlZWSFExPGJyPgrCoE54 UjFOSllqTkVVVVZHUkVSQk5FSkRVWGhOZW1zeVRsUmthMDVUTUhoWk1sRTFUVEpLYkEwS1QxTXdO VTFIVG0xUFYwVjZUMU13TWs1PGJyPgrCoHFhek5OVjBWM1RuZEJRMEZSU1VOQlUwRjNRMmRaU1V0 dldrbG9kbU5PUVdkamQwaFJXVXBaU1ZwSlFWZFZSQTBLUWtGRmNVSkNRelpJPGJyPgogICAgICDC oGQyMHpjSE5NWVRaS1QzZFFWRGc0Ulc5WFJBPT19UHBlWnAwV1l5TmlBN0RXcXJzSmZCdz09PGJy PgogICAgICBuc2NwZW50cnl3c2k6IG5zRFM1UmVwbGljYUhvc3Q6IGZyZWVpcGEtc2VhLmJwdC5y b2Nrczxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FQb3J0OiAzODk8YnI+CiAg ICAgIG5zY3BlbnRyeXdzaTogbnNEUzVSZXBsaWNhUm9vdDogbz1pcGFjYTxicj4KICAgICAgbnNj cGVudHJ5d3NpOiBuc0RTNVJlcGxpY2FUcmFuc3BvcnRJbmZvOiBUTFM8YnI+CiAgICAgIG5zY3Bl bnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU3YzI5MWQ5MDAwMDA0Mjkw MDAwPGJyPgogICAgICBuc2NwZW50cnl3c2k6IG5zZHM1MHJ1djoge3JlcGxpY2EgMTA2NQogICAg ICA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IiBocmVmPSJsZGFwOi8vZnJlZWlwYS1z ZWEuYnB0LnJvY2tzOjM4OSI+bGRhcDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODk8L2E+fSA1 N2Y4NDxicj4KICAgICAgwqAwYmYwMDAwMDQyOTAwMDAgNTk4Y2EzMWYwMDAxMDQyOTAwMDA8YnI+ CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwCiAgICAgIDxhIGNs YXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9ImxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5y b2NrczozODkiPmxkYXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODk8L2E+fTxicj4KICAgICAg bnNjcGVudHJ5d3NpOiBuc3J1dlJlcGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEwNjUKICAg ICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0ibGRhcDovL2ZyZWVpcGEt c2VhLmJwdC5yIj5sZGFwOi8vZnJlZWlwYS1zZWEuYnB0LnI8L2E+PGJyPgogICAgICDCoG9ja3M6 Mzg5fSAwMDAwMDAwMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc3J1dlJlcGxpY2FMYXN0TW9k aWZpZWQ6IHtyZXBsaWNhIDEyOTAKICAgICAgPGEgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4 dCIgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQu cm88L2E+PGJyPgogICAgICDCoGNrczozODl9IDAwMDAwMDAwPGJyPgogICAgICBuc2NwZW50cnl3 c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6 IG5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQ8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVS ZXBsaWNhRW5hYmxlZDogb248YnI+CiAgICAgIG5zY3BlbnRyeXdzaTogbnNkczVyZXBsaWNhcmVh cGFjdGl2ZTogMDxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FMYXN0VXBkYXRl U3RhcnQ6IDE5NzAwMTAxMDAwMDAwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxp Y2FMYXN0VXBkYXRlRW5kOiAxOTcwMDEwMTAwMDAwMFo8YnI+CiAgICAgIG5zY3BlbnRyeXdzaTog bnNkczVyZXBsaWNhQ2hhbmdlc1NlbnRTaW5jZVN0YXJ0dXA6PGJyPgogICAgICBuc2NwZW50cnl3 c2k6IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM6IEVycm9yICgxOSkgUmVwbGljYXRpb24K ICAgICAgZXJyb3IgYWNxdWk8YnI+CiAgICAgIMKgcmluZyByZXBsaWNhOiBSZXBsaWNhIGhhcyBk aWZmZXJlbnQgZGF0YWJhc2UgZ2VuZXJhdGlvbiBJRCwKICAgICAgcmVtb3RlIHJlcGxpY2EgbWE8 YnI+CiAgICAgIMKgeSBuZWVkIHRvIGJlIGluaXRpYWxpemVkIChSVVYgZXJyb3IpPGJyPgogICAg ICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYVVwZGF0ZUluUHJvZ3Jlc3M6IEZBTFNFPGJyPgog ICAgICBuc2NwZW50cnl3c2k6IG5zZHM1cmVwbGljYUxhc3RJbml0U3RhcnQ6IDE5NzAwMTAxMDAw MDAwWjxicj4KICAgICAgbnNjcGVudHJ5d3NpOiBuc2RzNXJlcGxpY2FMYXN0SW5pdEVuZDogMTk3 MDAxMDEwMDAwMDBaPGJyPgogICAgICA8YnI+CiAgICAgIDxicj4KICAgICAgPGJyPgogICAgPC90 dD4KICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNpdGU9Im1pZDo1OTk0Mzk3RS4yMDQwOEBy ZWRoYXQuY29tIj4KICAgICAgPHA+PHR0PiBiZXN0IHJlZ2FyZHM8YnI+CiAgICAgICAgICB0aGll cnJ5PGJyPgogICAgICAgIDwvdHQ+PC9wPgogICAgICA8YmxvY2txdW90ZQogICAgICAgIGNpdGU9 Im1pZDo3ZmMyMzQzMi1lMzM5LTliNzUtYjlhNi1hZTQ2MjhmNzg0ZTJAYnJvd25wYXBlcnRpY2tl dHMuY29tIgogICAgICAgIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgPGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSIgY2l0ZT0ibWlkOjU5OEMyQjRGLjIwMDAyMDJAcmVkaGF0LmNvbSI+CiAgICAgICAg ICBPbiBmcmVlaXBhLXNlYSBhbmQgc2VhdHRsZW5mcyB5b3UgbWF5IGNoZWNrIHRoZSBpcGFjYSBy ZXBsaWNhCiAgICAgICAgICBhZ3JlZW1lbnRzIHN0YXR1cyBiZWZvcmUvYWZ0ZXIgcmVpbml0LiBJ IHdvdWxkIGd1ZXNzIHRoZXkgYXJlCiAgICAgICAgICBjdXJyZW50bHkgcmVwb3J0aW5nIGZhaWx1 cmVzIGJldHdlZW4gdGhlc2UgdHdvIHJlcGxpY2FzLjxicj4KICAgICAgICAgIDxicj4KICAgICAg ICAgIDx0dD5sZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYiAi PC90dD48dHQ+Y249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFwcGluZwogICAgICAgICAgICB0 cmVlLGNuPWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQiCiAg ICAgICAgICAgIG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM8YnI+CiAgICAgICAgICAgIDxi cj4KICAgICAgICAgIDwvdHQ+PC9ibG9ja3F1b3RlPgogICAgICAgIDx0dD5bcm9vdEBmcmVlaXBh LXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgIG1h bmFnZXInIC1XIC1iICJjbj1yZXBsaWNhLGNuPW9cM0RpcGFjYSxjbj1tYXBwaW5nCiAgICAgICAg ICB0cmVlLGNuPWNvbmZpZyIgIm9iamVjdENsYXNzPW5zZHM1cmVwbGljYXRpb25hZ3JlZW1lbnQi CiAgICAgICAgICBuc2RzNXJlcGxpY2FMYXN0VXBkYXRlU3RhdHVzPGJyPgogICAgICAgICAgRW50 ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgZG46CmNuPWNsb25lQWdyZWVtZW50MS1m cmVlaXBhLXNlYS5icHQucm9ja3MtcGtpLXRvbWNhdCxjbj1yZXBsaWNhLGNuPW9cM0RpcGFjPGJy PgogICAgICAgICAgwqBhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgICBu c2RzNXJlcGxpY2FMYXN0VXBkYXRlU3RhdHVzOiBFcnJvciAoMzIpIFByb2JsZW0gY29ubmVjdGlu ZyB0bwogICAgICAgICAgcmVwbGljYSAtIExEQVAgPGJyPgogICAgICAgICAgwqBlcnJvcjogTm8g c3VjaCBvYmplY3QgKGNvbm5lY3Rpb24gZXJyb3IpPGJyPgogICAgICAgICAgPGJyPgogICAgICAg ICAgZG46CmNuPW1hc3RlckFncmVlbWVudDEtc2VhdHRsZW5mcy5icHQucm9ja3MtcGtpLXRvbWNh dCxjbj1yZXBsaWNhLGNuPW9cM0RpcGFjPGJyPgogICAgICAgICAgwqBhLGNuPW1hcHBpbmcgdHJl ZSxjbj1jb25maWc8YnI+CiAgICAgICAgICBuc2RzNXJlcGxpY2FMYXN0VXBkYXRlU3RhdHVzOiBF cnJvciAoMTkpIFJlcGxpY2F0aW9uIGVycm9yCiAgICAgICAgICBhY3F1aXJpbmcgcmVwbGljYTog PGJyPgogICAgICAgICAgwqBSZXBsaWNhIGhhcyBkaWZmZXJlbnQgZGF0YWJhc2UgZ2VuZXJhdGlv biBJRCwgcmVtb3RlIHJlcGxpY2EKICAgICAgICAgIG1heSBuZWVkIHRvIGJlIGk8YnI+CiAgICAg ICAgICDCoG5pdGlhbGl6ZWQgKFJVViBlcnJvcik8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAg ICBhbmQ8YnI+CiAgICAgICAgICA8YnI+CiAgICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhd IyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAgICAgICAgbWFuYWdlcicgLVcg LWIgImNuPXJlcGxpY2EsY249b1wzRGlwYWNhLGNuPW1hcHBpbmcKICAgICAgICAgIHRyZWUsY249 Y29uZmlnIiAib2JqZWN0Q2xhc3M9bnNkczVyZXBsaWNhdGlvbmFncmVlbWVudCIKICAgICAgICAg IG5zZHM1cmVwbGljYUxhc3RVcGRhdGVTdGF0dXM8YnI+CiAgICAgICAgICBFbnRlciBMREFQIFBh c3N3b3JkOiA8YnI+CiAgICAgICAgICBkbjoKY249Y2xvbmVBZ3JlZW1lbnQxLXNlYXR0bGVuZnMu YnB0LnJvY2tzLXBraS10b21jYXQsY249cmVwbGljYSxjbj1vXDNEaXBhY2E8YnI+CiAgICAgICAg ICDCoCxjbj1tYXBwaW5nIHRyZWUsY249Y29uZmlnPGJyPgogICAgICAgICAgbnNkczVyZXBsaWNh TGFzdFVwZGF0ZVN0YXR1czogRXJyb3IgKDE5KSBSZXBsaWNhdGlvbiBlcnJvcgogICAgICAgICAg YWNxdWlyaW5nIHJlcGxpY2E6IDxicj4KICAgICAgICAgIMKgUmVwbGljYSBoYXMgZGlmZmVyZW50 IGRhdGFiYXNlIGdlbmVyYXRpb24gSUQsIHJlbW90ZSByZXBsaWNhCiAgICAgICAgICBtYXkgbmVl ZCB0byBiZSBpPGJyPgogICAgICAgICAgwqBuaXRpYWxpemVkIChSVVYgZXJyb3IpPGJyPgogICAg ICAgICAgPGJyPgogICAgICAgIDwvdHQ+PGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiIGNpdGU9Im1pZDo1OThDMkI0Ri4yMDAwMjAyQHJlZGhhdC5jb20iPjx0dD4KICAgICAgICAg IDwvdHQ+CiAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5 ZjMtYWU0YS04Mzg5LTU0MjUtOWI4NGIxMWI3MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAg ICAgICAgICAgdHlwZT0iY2l0ZSI+IDxicj4KICAgICAgICAgICAgc2V2ZXJhbCB0aW1lcyBvdmVy IHRoZSB5ZWFycyB3aGVuIHJlcGxpY2F0aW9uIGhhcyBzdG9wcGVkLsKgCiAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBSZXBsaWNhdGlvbiBhY3R1YWxseSBpcyB3 b3JraW5nLCBhcyBmYXIgYXMgdXNlciBhbmQgbWFjaGluZQogICAgICAgICAgICBhY2NvdW50cyBh bmQgYXR0cmlidXRlcyBhcmUgY29uY2VybmVkIGFueXdheSwgYW5kIGhhcyBiZWVuCiAgICAgICAg ICAgIGZvciBhIHdoaWxlLjxicj4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICBUaGVyZSBp cyBhIHpvbWJpZSBzZXJ2ZXIgZnJlZWlwYS1kYWwuYnB0LnJvY2tzIHRoYXQgSSBjYW4ndAogICAg ICAgICAgICBnZXQgcmlkIG9mLi4uIGl0IHNob3dzIHVwIGluIHRoZSBHVUkgb24gdGhlIFRvcG9s b2d5IHBhZ2UKICAgICAgICAgICAgYnV0IGdlbmVyYXRlcyBhIFNlcnZlciBub3QgZm91bmQgZXJy b3IuwqAgSSBkb24ndCBrbm93IGlmCiAgICAgICAgICAgIHRoYXQncyByZWxhdGVkLjxicj4KICAg ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgIDxicj4KICAgICAgICAgIFpvbWJpZSBzZXJ2 ZXJzIGhhdmUgYmVlbiBkaXNjdXNzZWQgYSBsb3Qgb24gdGhpcyBtYWlsaW5nIGxpc3QuCiAgICAg ICAgICBZb3UgbWF5IGdldCByaWQgb2YgdGhlbSB3aXRoIGxpc3QtcnV2L2NsZWFuLXJ1diBzdWJj b21tYW5kLgogICAgICAgICAgUmVwbGljYXRpb24gdXN1YWxseSBtYW5hZ2UgdG8gd29yayBmaW5l IGV2ZW4gaWYgc29tZSB6b21iaWUKICAgICAgICAgIGVudHJpZXMgZXhpc3QgYnV0IGl0IGlzIGEg Z29vZCBwcmFjdGljZSB0byBjbGVhbiB0aGVtLjxicj4KICAgICAgICA8L2Jsb2NrcXVvdGU+CiAg ICAgICAgWWVhaCwgSSd2ZSBiZWVuIHRocm91Z2ggZXZlcnkgcG9zc2libGUgY29tYmluYXRpb24g b2YKICAgICAgICBsaXN0LXJ1di9jbGVhbi1ydXYuwqAgSSBoYXZlIHNvbWV0aGluZyBvZGQgZ29p bmcgb24gaW4gdGhhdCBubwogICAgICAgIHJlcGxpY2F0aW9uIGFncmVlbWVudHMgc2hvdyB1cCBh bnl3aGVyZSBmb3IgZnJlZWlwYS1kYWwuPGJyPgogICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiIGNpdGU9Im1pZDo1OThDMkI0Ri4yMDAwMjAyQHJlZGhhdC5jb20iPgogICAgICAgICAgPGJy PgogICAgICAgICAgcmVnYXJkczxicj4KICAgICAgICAgIHRoaWVycnk8YnI+CiAgICAgICAgICA8 YmxvY2txdW90ZQogICAgICAgICAgICBjaXRlPSJtaWQ6ZmU1MjU5ZjMtYWU0YS04Mzg5LTU0MjUt OWI4NGIxMWI3MWQ1QGJyb3ducGFwZXJ0aWNrZXRzLmNvbSIKICAgICAgICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgY2l0 ZT0ibWlkOjU5OEFERTdGLjMwODAzMDhAcmVkaGF0LmNvbSI+IDxicj4KICAgICAgICAgICAgICA8 ZGl2IGNsYXNzPSJtb3otY2l0ZS1wcmVmaXgiPk9uIDA4LzA4LzIwMTcgMTA6MzMgUE0sIElhbgog ICAgICAgICAgICAgICAgSGFyZGluZyB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICAg ICAgICAgICAgPC9kaXY+CiAgICAgICAgICAgICAgPGJsb2NrcXVvdGUKICAgICAgICAgICAgICAg IGNpdGU9Im1pZDoyZjYwYzRhZi02ODBjLTQzODItOTcwNC00MWEyNGM4MTIxYTJAYnJvd25wYXBl cnRpY2tldHMuY29tIgogICAgICAgICAgICAgICAgdHlwZT0iY2l0ZSI+CiAgICAgICAgICAgICAg ICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsKICAg ICAgICAgICAgICAgICAgY2hhcnNldD11dGYtOCI+CiAgICAgICAgICAgICAgICA8cD5PbiA4Lzcv MTcgMTo0NCBBTSwgdGhpZXJyeSBib3JkYXogd3JvdGU6PGJyPgogICAgICAgICAgICAgICAgPC9w PgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAgICAgICAgICAg ICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+CiAgICAgICAgICAgICAg ICAgIDxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIKICAgICAgICAgICAg ICAgICAgICBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiPgogICAgICAgICAgICAgICAgICA8YnI+ CiAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPGRpdiBjbGFzcz0ibW96 LWNpdGUtcHJlZml4Ij5PbiAwOC8wNy8yMDE3IDA5OjIyIEFNLAogICAgICAgICAgICAgICAgICAg IEZsb3JlbmNlIEJsYW5jLVJlbmF1ZCB2aWEgRnJlZUlQQS11c2VycyB3cm90ZTo8YnI+CiAgICAg ICAgICAgICAgICAgIDwvZGl2PgogICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZQogICAgICAg ICAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIzNTAtMzQ3MC01ZDFhOWI5MjUy YzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgICAgICAgICB0eXBlPSJjaXRlIj5PbiAwOC8wNC8y MDE3IDExOjAyIFBNLCBJYW4gSGFyZGluZyB2aWEKICAgICAgICAgICAgICAgICAgICBGcmVlSVBB LXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0i Y2l0ZSI+T24gOC80LzE3IDI6MTYgQU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgICAgICBC bGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTE6 MTMgUE0sCiAgICAgICAgICAgICAgICAgICAgICAgIElhbiBIYXJkaW5nIHZpYSBGcmVlSVBBLXVz ZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiPk9uIDA4LzAzLzIwMTcgMTI6MjggQU0sCiAgICAgICAgICAgICAgICAgICAgICAgICAg RmxvcmVuY2UgQmxhbmMtUmVuYXVkIHdyb3RlOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNyAxMTo1MQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgUE0sIElhbiBIYXJkaW5nIHZpYSBGcmVlSVBBLXVzZXJzIHdyb3Rl OiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij5PbiAwOC8wMi8yMDE3IDEyOjExCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFNLCBG bG9yZW5jZSBCbGFuYy1SZW5hdWQgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24gMDgvMDIvMjAxNwogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDAxOjQzIEFNLCBJYW4gSGFyZGluZyB3cm90ZTogPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIDA4 LzAxLzIwMTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDEyOjAzIFBNLCBSb2Ig Q3JpdHRlbmRlbiB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+SWFuIEhhcmRpbmcKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgd3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+T24KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAwOC8wMS8yMDE3IDA3OjM5IEFNLCBGbG9yZW5jZQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9u CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwOC8wMS8yMDE3IDAzOjEx IFBNLCBJYW4gSGFyZGluZwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg d3JvdGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPk9uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDA4LzAxLzIwMTcgMDE6NDggQU0sIEZsb3JlbmNlCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEJsYW5jLVJlbmF1ZCB3cm90ZTogPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5P bgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDA4LzAxLzIwMTcg MDE6MzIgQU0sIElhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IEhhcmRpbmcgdmlhIEZyZWVJUEEtdXNlcnMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB3cm90ZTogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBPbiAwNy8zMS8yMDE3IDExOjM0IEFNLAogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUm9iIENyaXR0ZW5kZW4gd3Jv dGU6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi bG9ja3F1b3RlIHR5cGU9ImNpdGUiPklhbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBIYXJkaW5nIHZpYQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIHdyb3RlOiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNp dGUiPkkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBo YWQgYW4gdW5leHBlY3RlZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHJlc3RhcnQgb2YgYW4gSVBBCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgc2VydmVyIHRoYXQgaGFkCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXBwYXJlbnRseSBoYWQgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZGF0ZXMgcnVuIGJ1 dCBoYWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBu b3QgYmVlbiByZXN0YXJ0ZWQuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgaXBhY3RsIHNheXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBwa2ktdG9tY2F0ZCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgd291bGQgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vdCBzdGFydC4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdHJhbmdlbHksIHRoZSBhY3R1 YWwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzZXJ2 aWNlIGFwcGVhcnMgdG8gYmUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBydW5uaW5nOiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgZG9ndGFnIGlzIGFuIGFwcGxpY2F0aW9uCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGhpbiB0b21jYXQgc28gdG9tY2F0CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNhbiBydW4gd2l0 aG91dCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGRvZ3RhZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHJ1bm5pbmcuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBXZSBuZWVkIHRvIHNlZSBtb3JlIG9mCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHRoZSBkb2d0YWcgZGVidWcgbG9nIHRvCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlZSB3aGF0IGlzIGdvaW5nIG9uLiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90 ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEl0IGxvb2tzIGxpa2Ug YW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGF1dGhlbnRp Y2F0aW9uIHByb2JsZW0uLi4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KWzI4L0p1bC8yMDE3OjEwOjA4OjQ3XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOiBTU0wg aGFuZHNoYWtlIGhhcHBlbmVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIENvdWxkIG5vdCBjb25uZWN0IHRvIExEQVAKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlcnZlciBob3N0CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzZWF0dGxlbmZzLmJwdC5yb2NrcyBwb3J0CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA2MzYgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRXJyb3IKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5ldHNjYXBlLmxkYXAuTERBUEV4 Y2VwdGlvbjoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEF1 dGhlbnRpY2F0aW9uIGZhaWxlZCAoNDkpCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkb2d0YWcgc3RvcmVzIGl0cyBp bnRlcm5hbAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRhdGEg aW4gdGhlIExEQVAgc2VydmVyIGFuZAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIG5lZWRzIHRvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBlc3RhYmxpc2ggYSBzZWN1cmUgTERBUAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGNvbm5lY3Rpb24uIFlvdSBjYW4gY2hlY2sKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBob3cgdGhpcyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29ubmVjdGlvbiBpcyBjb25maWd1 cmVkIGluCi9ldGMvcGtpL3BraS10b21jYXQvY2EvQ1MuY2ZnLCBsb29rIGZvciA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdGhlIGxpbmVzOiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgppbnRlcm5hbGRi LmxkYXBhdXRoLmF1dGh0eXBlPVNzbENsaWVudEF1dGggPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRo LmJpbmRETj1jbj1EaXJlY3RvcnkgTWFuYWdlciA8YnI+CmludGVybmFsZGIubGRhcGF1dGguYmlu ZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRoLmNsaWVudENlcnRO aWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KaW50ZXJuYWxkYi5sZGFwY29u bi5ob3N0PXZtLS4uLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgaW50ZXJuYWxkYi5sZGFwY29ubi5wb3J0PTYzNgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KaW50ZXJuYWxkYi5sZGFwY29ubi5zZWN1cmVDb25u IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYXV0aHR5cGUgY2FuIGJl CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3NsQ2xpZW50QXV0 aAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIChhdXRoZW50aWNh dGlvbiB3aXRoIGEgc3NsIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBjZXJ0aWZpY2F0ZSkgb3IgQmFzaWNBdXRoCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgKGF1dGhlbnRpY2F0aW9uIHdpdGggYSBiaW5kCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRE4gYW5kIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwYXNzd29yZCBzdG9yZWQgaW4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFyL2xpYi9wa2kvcGtp LXRvbWNhdC9jb25mL3Bhc3N3b3JkLmNvbmYpLgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg WW91IGNhbiB1c2UgdGhpcyBpbmZvcm1hdGlvbgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHRvIG1hbnVhbGx5IGNoZWNrIHRoZQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGNyZWRlbnRpYWxzLiBGb3IgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGluc3RhbmNlIHdpdGggc3NsY2xpZW50 YXV0aDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4cG9ydAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIExEQVBUTFNfQ0FDRVJURElSPS9ldGMvcGtpL3Br aS10b21jYXQvYWxpYXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZXhwb3J0 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTERBUFRMU19DRVJU PSdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgY2VydC1wa2ktY2EnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg bGRhcHNlYXJjaCAtSCA8YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9ImxkYXBzOi8vIgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5sZGFw czovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIChwcm92aWRlIHRoZSBwYXNzd29yZCBmcm9tCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRv bWNhdC9hbGlhcy9wd2RmaWxlLnR4dCkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSSBmb3VuZCB0aGlzOiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KaW50ZXJuYWxk Yi5sZGFwYXV0aC5hdXRodHlwZT1Tc2xDbGllbnRBdXRoIDxicj4KaW50ZXJuYWxkYi5sZGFwYXV0 aC5iaW5kRE49dWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CmludGVybmFsZGIu bGRhcGF1dGguYmluZFBXUHJvbXB0PWludGVybmFsZGIgPGJyPgppbnRlcm5hbGRiLmxkYXBhdXRo LmNsaWVudENlcnROaWNrbmFtZT1zdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhIDxicj4KaW50ZXJu YWxkYi5sZGFwY29ubi5jbG9uZVJlcGxpY2F0aW9uUG9ydD0zODkgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGFuZCB3aGVuIEkgdHJ5IHRoZSBsZGFwc2VhcmNoCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEkgYW0gcHJlc2VudGVkIHdpdGggYSBwcm9tcHQK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdG8gcHJvdmlkZSA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEgcGluL3Bhc3N3b3Jk IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQbGVhc2UgZW50ZXIgcGluLCBw YXNzd29yZCwgb3IKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFz cyBwaHJhc2UgZm9yIHNlY3VyaXR5IHRva2VuCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGJ1dCB0aGVyZSBpcyBubyBwYXNzd29yZAogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBmaWxlLi4uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGks IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHlvdSBhcmUgcmlnaHQsIGluIDQuNC4g dGhlcmUgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG5vIHB3ZGZp bGUudHh0IGFuZCB0aGUgcGFzc3dvcmQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGNhbiBiZSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBmb3VuZCBpbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL3Zhci9s aWIvcGtpL3BraS10b21jYXQvY29uZi9wYXNzd29yZC5jb25mCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAod2l0aCB0aGUgdGFnIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGludGVybmFsPS4uLikgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgQ2FuIHlvdSBjaGVjayBpZiB0aGUgcGFzc3dvcmQKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHdpdGggdGhlIHRhZyBpbnRlcm5hbD0uLi4gYWxsb3dz CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0byByZWFkIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBrZXlzIGZyb20gdGhlIE5T UyBkYj8gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0 aWwgLUsgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtp L3BraS10b21jYXQvYWxpYXMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgKHByb3ZpZGUgcGFzc3dvcmQpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYXQgd29y a3MuLi4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1LIC1kCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlh cyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IENo ZWNraW5nIHRva2VuICJOU1MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBD ZXJ0aWZpY2F0ZSBEQiIgaW4gc2xvdCAiTlNTIFVzZXIKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBQcml2YXRlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBLZXkgYW5kIENlcnRpZmljYXRlIFNlcnZpY2VzIiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiOiA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmx0OyAwJmd0OyByc2EKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAwZjMyN2U3NjBhN2VlY2RjZjY5NzNm NWRjNTdjYTUzNjdjNTkyZDY0wqDCoAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIChvcnBoYW4pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAm bHQ7IDEmZ3Q7IHJzYQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGIxMjU4 MGM3YzY5NmNmY2Q4YWVmYzk0MDVhN2E4NzBiMjRiN2I5NmHCoMKgCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgTlNTIENlcnRpZmljYXRlIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBEQjphdWRpdFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDImZ3Q7IHJzYQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDg4MWI3MjU0YzQwZmE0MGJjNTA2 ODFiY2M4ZDM3YmIzZWI0OTkzN2UKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBjYVNpZ25pbmdDZXJ0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Jmx0OyAzJmd0OyByc2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmYTlh MjU1YTFkMTU1ODVhYzI4MDY0YzBmNDk4NmU0MTZiYzQ4NDAzwqDCoAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIE5TUyBDZXJ0aWZpY2F0ZSA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgREI6b2NzcFNpZ25pbmdDZXJ0IGNlcnQtcGtpLWNhIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAmbHQ7IDQmZ3Q7IHJzYQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDNmYjYwOWQwZjdkNzJjMmQzMjVk NmEyZGMxNjU3N2E3ZjdlNWEwMWYKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBTZXJ2ZXItQ2VydCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Y2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICZs dDsgNSZndDsgcnNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgMWU5NDc5 YTk1NTZhZjkzMzliYjVlNDU1MmNjYmQzODFkM2MzODg1NsKgwqAKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBOU1MgQ2VydGlmaWNhdGUgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIERCOnN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBCdXQgdGhpcyBkb2Vzbid0ICh3aXRoIHRoZSBzYW1lCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGFzc3dvcmQgZnJvbSBwYXNzd29y ZC5jb25mKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgbGRhcHNlYXJjaCAtSCA8YQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGlu ay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGhyZWY9 ImxkYXBzOi8vIgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRv LW5vdC1zZW5kPSJ0cnVlIj5sZGFwczovLzwvYT5gaG9zdG5hbWVgOjYzNgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC1iICIiIC1zIGJhc2UgLVkgRVhURVJOQUwgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBsZWFzZSBlbnRlciBwaW4sIHBh c3N3b3JkLCBvcgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBhc3MgcGhy YXNlIGZvciBzZWN1cml0eSB0b2tlbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICdsZGFwKDApJzogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFNBU0wvRVhURVJOQUwgYXV0aGVudGljYXRpb24KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBzdGFydGVkIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBsZGFwX3Nhc2xfaW50ZXJhY3RpdmVfYmluZF9zOgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEludmFsaWQgY3JlZGVudGlhbHMgKDQ5KSA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIFRoYXQgcGFzc3dvcmQgaXMgZ2V0dGluZyBtZQogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHNvbWV3aGVyZSB0aG91Z2gsIHNpbmNlIGlmIEkgcHV0CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaW4gYSA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgbm9uc2Vuc2Ugb3IgaW5jb3JyZWN0IHBhc3N3b3Jk IGl0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAganVzdCBwcm9tcHRzIG92 ZXIgYW5kIG92ZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9i bG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExldCdzIHN0ZXAgYmFjayBhIHNlY29uZC4g WW91CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVwZ3JhZGVkIGZyb20gd2hh dCB0byB3aGF0PyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBUaGVyZSB3YXNuJ3QgbXVjaCBvZiBhIGNoYW5nZS4uLiBJ CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqdXN0IGFzc3VtZWQgc29tZW9uZSBy YW4geXVtIHVwZ3JhZGUKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFuZCBkaWRu J3QgcmVzdGFydCwgdGhlbiB0aGUgcG93ZXIKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIG91dGFnZS4uLiBpdCBsb29rcyBsaWtlIG5vdCBtdWNoIG9mIGEKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHZlcnNpb24gY2hhbmdlIHRob3VnaC4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIyBncmVwIGlwYSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NTozMiBJbnN0YWxsZWQ6CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBpcGEtY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5v YXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ1OjMyIEluc3RhbGxlZDoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtY29tbW9uLTQuNC4wLTE0LmVsNy5j ZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ2OjA2IFVwZGF0ZWQ6 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsaWJpcGFfaGJhYy0xLjE0LjAtNDMu ZWw3XzMuNC54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFu IDA4IDA0OjQ2OjA3IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBw eXRob24tbGliaXBhX2hiYWMtMS4xNC4wLTQzLmVsN18zLjQueDg2XzY0CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBKYW4gMDggMDQ6NDY6MDggSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgcHl0aG9uLWlwYWRkcmVzcy0xLjAuMTYtMi5lbDcubm9hcmNoIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNCBJbnN0YWxsZWQ6CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWxpYi00LjQuMC0xNC5lbDcu Y2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzowNSBJbnN0YWxs ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00 LjQuMC0xNC5lbDcuY2VudG9zLjEuMS5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0 NzowNSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFkbWlu dG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4g MDggMDQ6NDc6MDUgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg aXBhLXNlcnZlci1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9hcmNoCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBKYW4gMDggMDQ6NDc6MDYgSW5zdGFsbGVkOgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgcHl0aG9uMi1pcGFzZXJ2ZXItNC40LjAtMTQuZWw3LmNlbnRvcy4xLjEubm9h cmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MDcgVXBkYXRlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHNzc2QtaXBhLTEuMTQuMC00My5lbDdfMy40Lng4Nl82NCA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MTcgVXBk YXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1jbGllbnQtNC40LjAt MTQuZWw3LmNlbnRvcy4xLjEueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6MjMg VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItNC40 LjAtMTQuZWw3LmNlbnRvcy4xLjEueDg2XzY0CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDc6 MjcgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXIt ZG5zLTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4 IDA0OjQ3OjM2IEluc3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlw YS1weXRob24tY29tcGF0LTQuNC4wLTE0LmVsNy5jZW50b3MuMS4xLm5vYXJjaAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgSmFuIDA4IDA0OjUwOjA3IEVyYXNlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIGlwYS1weXRob24tNC4yLjAtMTUuMC4xLmVsNy5jZW50b3MuMTkueDg2XzY0CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBKdWwgMjggMDk6NTU6NDEgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGlwYS1jb21tb24tNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQyIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBpcGEtY2xpZW50LWNvbW1vbi00LjQuMC0xNC5lbDcuY2VudG9zLjcubm9h cmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDMgVXBkYXRlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGlwYS1zZXJ2ZXItY29tbW9uLTQuNC4wLTE0LmVsNy5jZW50 b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAwOTo1NTo0MyBVcGRhdGVkOgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcHl0aG9uMi1pcGFsaWItNC40LjAtMTQuZWw3 LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDA5OjU1OjQ0IFVwZGF0ZWQ6 CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBweXRob24yLWlwYWNsaWVudC00LjQu MC0xNC5lbDcuY2VudG9zLjcubm9hcmNoCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBKdWwgMjggMDk6NTU6NDUg VXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB5dGhvbjItaXBhc2Vy dmVyLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAw OTo1NTo0NSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXBhLWFk bWludG9vbHMtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVs IDI4IDA5OjU1OjQ2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBp cGEtY2xpZW50LTQuNC4wLTE0LmVsNy5jZW50b3MuNy54ODZfNjQKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1 bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg aXBhLXNlcnZlci00LjQuMC0xNC5lbDcuY2VudG9zLjcueDg2XzY0CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBK dWwgMjggMDk6NTU6NDggVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IGlwYS1zZXJ2ZXItZG5zLTQuNC4wLTE0LmVsNy5jZW50b3MuNy5ub2FyY2gKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIEp1bCAyOCAwOTo1NTo0OCBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgaXBhLXB5dGhvbi1jb21wYXQtNC40LjAtMTQuZWw3LmNlbnRvcy43Lm5vYXJjaAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBncmVw IHBraSAvdmFyL2xvZy95dW0ubG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIEphbiAwOCAwNDo0NjowNSBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgcGtpLWJhc2UtMTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBKYW4gMDggMDQ6NDY6MDkgVXBkYXRlZDoKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGtyYjUtcGtpbml0LTEuMTQuMS0yNy5lbDdfMy54ODZfNjQg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSmFuIDA4IDA0OjQ3OjE5IElu c3RhbGxlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBraS1iYXNlLWphdmEt MTAuMy4zLTE0LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBKYW4gMDggMDQ6NDc6MTkgVXBkYXRlZDoKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHBraS10b29scy0xMC4zLjMtMTQuZWw3XzMueDg2XzY0IDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMSBVcGRhdGVkOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXNlcnZlci0xMC4zLjMtMTQuZWw3XzMubm9hcmNo IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEphbiAwOCAwNDo0NzoyMiBV cGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWtyYS0xMC4zLjMt MTQuZWw3XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEph biAwOCAwNDo0NzoyMiBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg cGtpLWNhLTEwLjMuMy0xNC5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjE2IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBwa2ktYmFzZS0xMC4zLjMtMTkuZWw3XzMubm9hcmNoIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAxMDoxMzoxNyBVcGRhdGVkOgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLWJhc2UtamF2YS0xMC4zLjMtMTkuZWw3 XzMubm9hcmNoIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bCAyOCAx MDoxMzoxNyBVcGRhdGVkOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcGtpLXRv b2xzLTEwLjMuMy0xOS5lbDdfMy54ODZfNjQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBwa2ktc2VydmVyLTEwLjMuMy0xOS5lbDdfMy5ub2FyY2ggPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIxIFVwZGF0ZWQ6CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2kta3JhLTEwLjMuMy0xOS5lbDdfMy5ub2Fy Y2ggPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVsIDI4IDEwOjEzOjIx IFVwZGF0ZWQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwa2ktY2EtMTAuMy4z LTE5LmVsN18zLm5vYXJjaCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBcmUgeW91IHJ1bm5pbmcgaW4gU0VMaW51eCBl bmZvcmNpbmcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbW9kZT8gPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIyBnZXRlbmZvcmNlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IEVuZm9yY2luZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4g PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJZiBzbyBjYW4geW91IHJ1 bjogPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgYXVzZWFyY2ggLW0gQVZDIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBhdXNlYXJjaCAtbSBB VkMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlIE5PTE9HIG9wdGlv biB0byBsb2dfZm9ybWF0IGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXBy ZWNhdGVkLiBQbGVhc2UgdXNlIHRoZSB3cml0ZV9sb2dzCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBvcHRpb24uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFRoZSBOT0xPRyBvcHRpb24gaXMgb3ZlcnJpZGluZyB0aGUKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHdyaXRlX2xvZ3MgY3VycmVudCBzZXR0aW5nLiA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAtLS0tIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHRpbWUtJmd0O01vbiBNYXIgMTQgMTA6Mzk6MDEgMjAxNiA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB0eXBlPVNZU0NBTEwKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIG1zZz1hdWRpdCgxNDU3OTc3MTQxLjc2NzoxNzUzNyk6CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBhcmNoPWMwMDAwMDNlIHN5c2NhbGw9MiBzdWNjZXNz PW5vCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBleGl0PS0xMyBhMD03ZmJjYWIw MzhkMTAgYTE9ODAwIGEyPTEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEzPTdm YmNhNjBmNDJlMCBpdGVtcz0wIHBwaWQ9MTQwNgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgcGlkPTEyOTY1IGF1aWQ9NDI5NDk2NzI5NSB1aWQ9MCBnaWQ9MAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgZXVpZD01ODE0MDAwMDEgc3VpZD0wIGZzdWlkPTU4MTQwMDAw MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZWdpZD01ODE0MDAwMDEgc2dpZD0w IGZzZ2lkPTU4MTQwMDAwMQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdHR5PShu b25lKSBzZXM9NDI5NDk2NzI5NSBjb21tPSJzc2hkIgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgZXhlPSIvdXNyL3NiaW4vc3NoZCIKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHN1Ymo9c3lzdGVtX3U6c3lzdGVtX3I6c3NoZF90OnMwLXMwOmMwLmMxMDIzCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrZXk9KG51bGwpIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHR5cGU9QVZDCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBtc2c9YXVkaXQoMTQ1Nzk3NzE0MS43Njc6MTc1MzcpOiBhdmM6wqAKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIGRlbmllZCB7IHJlYWQgfSBmb3IgcGlkPTEyOTY1CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb21tPSJzc2hkIiBuYW1lPSJhdXRob3Jp emVkX2tleXMiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXY9ImRtLTIiIGlu bz0xMTYzOTM1MTcKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNjb250ZXh0PXN5 c3RlbV91OnN5c3RlbV9yOnNzaGRfdDpzMC1zMDpjMC5jMTAyMwp0Y29udGV4dD1zeXN0ZW1fdTpv YmplY3Rfcjp1bmxhYmVsZWRfdDpzMCB0Y2xhc3M9ZmlsZSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj aXRlIj5JIHN1c3BlY3QgdGhhdAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0 aGUgc3Vic3lzdGVtIGNlcnQgd2FzIHJlbmV3ZWQgYW5kCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGV2ZXJ5dGhpbmcgd2Fzbid0IDxicj4KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgdXBkYXRlZCBwcm9wZXJseS4gSWYgSSdtIHJpZ2h0IHRoaXMKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaXMgdW5yZWxhdGVkIHRvIHRoZSB1cGdyYWRl IGl0IGp1c3QKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzaG9uZSBhIHNwb3RsaWdodCBvbiBpdC4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIENhbiB5b3UgcnVuIHRoZXNlIGNvbW1hbmRzOiA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9yeQogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtYW5hZ2VyJyAtVyAtYiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89 aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRl IGRlc2NyaXB0aW9uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgVGhpcyByZXR1cm5zIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAt TExMIC1EICdjbj1kaXJlY3RvcnkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1h bmFnZXInIC1XIC1iCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1aWQ9cGtpZGJ1 c2VyLG91PXBlb3BsZSxvPWlwYWNhCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1 c2VyQ2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJna3Foa2lH OXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIHN0dWZmIC4u LiA8YnI+ClpObzRlWDdqTlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtDTj1D ZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89 QlBULlJPQ0tTO0NOPUNBCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBTdWJzeXN0 ZW0sTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0 ZSI+YW5kIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIGNlcnR1dGlsIC1MIC1kCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ3N1YnN5c3RlbUNlcnQgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYScgfCBncmVwIFNl cmlhbCA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgY2VydHV0aWwg LUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtpLXRv bWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lz dGVtQ2VydCBjZXJ0LXBraS1jYScgLWEgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv dGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBUaGVzZSBib3RoIHJldHVybiA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj L3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAnc3Vic3lzdGVtQ2VydCBjZXJ0LXBraS1jYScgfCBncmVwCiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBTZXJpYWwgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgRW50ZXIgUGFzc3dvcmQgb3IgUGluIGZvciAiTlNTCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBDZXJ0aWZpY2F0ZSBEQiI6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGNlcnR1dGlsOiBwcm9ibGVtIGxpc3Rpbmcga2V5czoKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIFNFQ19FUlJPUl9VTlJFQ09HTklaRURfT0lEOgogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgVW5yZWNvZ25pemVkIE9iamVjdCBJZGVudGlmaWVyLiA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAjIGNlcnR1dGlsIC1LIC1kCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvZXRj L3BraS9wa2ktdG9tY2F0L2FsaWFzwqAgLW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBjZXJ0dXRpbDogQ2hlY2tpbmcgdG9rZW4gIk5TUwogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgQ2VydGlmaWNhdGUgREIiIGluIHNsb3QgIk5TUyBVc2Vy CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcml2YXRlIEtleSBhbmQgQ2VydGlm aWNhdGUgU2VydmljZXMiCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBQYXNzd29yZCBvciBQaW4gZm9y ICJOU1MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENlcnRpZmljYXRlIERCIjog PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydHV0aWw6IHByb2JsZW0g bGlzdGluZyBrZXlzOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU0VDX0VSUk9S X1VOUkVDT0dOSVpFRF9PSUQ6CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBVbnJl Y29nbml6ZWQgT2JqZWN0IElkZW50aWZpZXIuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVv dGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSGksIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg eW91IG1hZGUgYSB0eXBvIGFuZCByZXF1ZXN0ZWQgdGhlIGtleXMKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAoLUspIGluc3RlYWQgb2YgdGhlIGNlcnRzICgtTCkuIFBsZWFzZQogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHJ5IHdpdGggLUwgYW5kIHlvdSBzaG91bGQg YmUgYWJsZSB0bwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHNlZSB0aGUgY2VydGlm aWNhdGUgc2VyaWFsLiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RA c2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNh IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlOjoKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgTUlJRGN6Q0NBbHVnQXdJQkFnSUJCREFOQmdrcWhr aUc5dzBCQVFzRkFEQTBNUkl3RUFZRFZRUUtEQWxDCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KWk5vNGVYN2pO VDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiAyOzQ7Q049Q2VydGlmaWNhdGUKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NLUyA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg U28gdGhlIHNlcmlhbCBpcyA0PyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMg Y2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgL2V0Yy9wa2kvcGtp LXRvbWNhdC9hbGlhcyAtbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnc3Vic3lzdGVt Q2VydCBjZXJ0LXBraS1jYScgfCBncmVwIFNlcmlhbAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIMKgwqDCoMKgwqDCoMKgwqAg U2VyaWFsIE51bWJlcjogMTM0MTcxODU0MQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAo MHg0ZmY5MDAwZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFdoaWNoIGlzIE5PVCA0Li4uIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBb cm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIC1uCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICdzdWJzeXN0ZW1DZXJ0IGNlcnQtcGtpLWNhJyAtYSA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLSA8YnI+Ck1J SURiakNDQWxhZ0F3SUJBZ0lFVC9rQURUQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFR S0RBbEMgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuLi4gPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAtLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBBbmQgdGhpcyBjZXJ0IGlzIE5PVCB0aGUgc2FtZS4gPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hlbiBjZXJ0 bW9uZ2VyIHJlbmV3cyBhIGNlcnRpZmljYXRlLCBpdAogICAgICAgICAgICAgICAgICAgICAgICAg ICAgcnVucyBwcmUtc2F2ZSBhbmQgcG9zdC1zYXZlIGNvbW1hbmRzICh3aGljaAogICAgICAgICAg ICAgICAgICAgICAgICAgICAgeW91IGNhbiBzZWUgaW4gdGhlIG91dHB1dCBvZiBnZXRjZXJ0IGxp c3QpLgogICAgICAgICAgICAgICAgICAgICAgICAgICAgSW4geW91ciBjYXNlLCB0aGUgcG9zdC1z YXZlIGNvbW1hbmQgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBzdWJzeXN0ZW1DZXJ0 IGNlcnQtcGtpLWNhIHByb2JhYmx5IGZhaWxlZC4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhpcyBjb21tYW5kIChvbiB0 aGUgcmVuZXdhbCBtYXN0ZXIpIGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICByZXNwb25z aWJsZSBmb3IgY29weWluZyB0aGUgbmV3IGNlcnQgZnJvbQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgdGhlIE5TUyBkYiB0byB0aGUgTERBUCBzZXJ2ZXIuIFlvdSBuZWVkCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICBmaXJzdCB0byBjaGVjayB3aGljaCBJUEEgc2VydmVyIGlzIHRoZQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgcmVuZXdhbCBtYXN0ZXIgKGFzIHRoZSBzZXJpYWwg bnVtYmVycyBhcmUgaW4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIGEgY29tcGxldGVseSBk aWZmZXJlbnQgcmFuZ2UsIEkgYXNzdW1lIHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICAg IHlvdSBoYXZlIG11bHRpcGxlIElQQSBzZXJ2ZXJzIGNvbmZpZ3VyZWQKICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHdpdGggYSBDQSBpbnN0YW5jZSk6IDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICQgZXhwb3J0IEJBU0VE Tj1gZ3JlcCBiYXNlZG4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9ldGMvaXBhL2RlZmF1 bHQuY29uZiB8IGN1dCAtZD0gLWYyLWAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAg JCBraW5pdCBhZG1pbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAkIGxkYXBzZWFy Y2ggLUxMTCAtUSAtaCBgaG9zdG5hbWVgIC1wIDM4OSAtWQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgR1NTQVBJIC1iICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VETiIKJygmYW1w Oyhjbj1DQSkoaXBhQ29uZmlnU3RyaW5nPWNhUmVuZXdhbE1hc3RlcikpJyBkbiA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICBkbjoKY249Q0EsY249dm0taXBhc2VydmVyLmlwYWRvbWFp bi5jb20sY249bWFzdGVycyxjbj1pcGEsY249ZXRjLGRjPWlwYWRvbWFpbixkYz1jb20KICAgICAg ICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIEluIHRoaXMgZXhhbXBsZSB0aGUgcmVuZXdh bCBtYXN0ZXIgaXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZtLWlwYXNlcnZlci4gPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgICAgICAgICAgSSBnZXQgdGhpcyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICQgbGRhcHNlYXJjaCAtTExMIC1RIC1o IGBob3N0bmFtZWAgLXAgMzg5IC1ZCiAgICAgICAgICAgICAgICAgICAgICAgICAgR1NTQVBJIC1i ICJjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsJEJBU0VETiIKICAgICAgICAgICAgICAgICAgICAg ICAgICAnKCZhbXA7KGNuPUNBKShpcGFDb25maWdTdHJpbmc9Y2FSZW5ld2FsTWFzdGVyKSknCiAg ICAgICAgICAgICAgICAgICAgICAgICAgZG4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg IGRuOgogICAgICAgICAgICAgICAgICAgICAgICAgIGNuPUNBLGNuPWZyZWVpcGEtc2VhLmJwdC5y b2Nrcyxjbj1tYXN0ZXJzLGNuPWlwYSxjbj1ldGMsZGM9YnB0LGRjPXJvY2tzCiAgICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICBXaGljaCBpcyB0aGUgb3RoZXIgRnJlZUlQQSBzZXJ2ZXIuIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgICAgSGkgSWFuLCA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgaXQncyBnZXR0 aW5nIGRpZmZpY3VsdCB0byBmb2xsb3cgdGhpcyB0aHJlYWQsIHNvCiAgICAgICAgICAgICAgICAg ICAgICAgIGNvdWxkIHdlIHN0ZXAgYmFjayBhbmQgc3VtbWFyaXplPyA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICBZZXMsIGl0IGlz LsKgIFNvcnJ5LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJj aXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAtIE9uIHNlcnZlciBmcmVlaXBhLXNl YSAoPXJlbmV3YWwgbWFzdGVyKSwgdGhlCiAgICAgICAgICAgICAgICAgICAgICAgIENBIGNvbXBv bmVudCBpcyBpbnN0YWxsZWQgYW5kICdzdWJzeXN0ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAg ICAgIGNlcnQtcGtpLWNhJyBoYXMgU2VyaWFsIG51bWJlciA0IGluIHRoZSBOU1NEQgogICAgICAg ICAgICAgICAgICAgICAgICAvZXRjL3BraS9wa2ktdG9tY2F0L2FsaWFzIDxicj4KICAgICAgICAg ICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIE5vPyA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBbcm9vdEBm cmVlaXBhLXNlYSBpYW5oXSMgY2VydHV0aWwgLUwgLWQKICAgICAgICAgICAgICAgICAgICAgIC9l dGMvcGtpL3BraS10b21jYXQvYWxpYXMgLW4gJ3N1YnN5c3RlbUNlcnQKICAgICAgICAgICAgICAg ICAgICAgIGNlcnQtcGtpLWNhJyB8IGdyZXAgU2VyaWFsIDxicj4KICAgICAgICAgICAgICAgICAg ICAgIMKgwqDCoMKgwqDCoMKgwqAgU2VyaWFsIE51bWJlcjogMTM0MTcxODU0MSAoMHg0ZmY5MDAw ZCkgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+LSBP biBzZXJ2ZXIgc2VhdHRsZW5mcwogICAgICAgICAgICAgICAgICAgICAgICAod2hlcmUgUEtJIGZh aWxzIHRvIHJlc3RhcnQpLCB0aGUgQ0EgY29tcG9uZW50CiAgICAgICAgICAgICAgICAgICAgICAg IGlzIGluc3RhbGxlZCBhbmQgJ3N1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EnIGhhcwogICAgICAg ICAgICAgICAgICAgICAgICBTZXJpYWwgbnVtYmVyIDEzNDE3MTg1NDEgaW4gdGhlIE5TU0RCCiAg ICAgICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMuIDxicj4KICAg ICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAgICAgIFll cyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBb cm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBjZXJ0dXRpbCAtTCAtZAogICAgICAgICAgICAgICAgICAg ICAgL2V0Yy9wa2kvcGtpLXRvbWNhdC9hbGlhcyAtbiAnc3Vic3lzdGVtQ2VydAogICAgICAgICAg ICAgICAgICAgICAgY2VydC1wa2ktY2EnIHwgZ3JlcCBTZXJpYWwgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgwqDCoMKgwqDCoMKgwqDCoCBTZXJpYWwgTnVtYmVyOiAxMzQxNzE4NTQxICgweDRm ZjkwMDBkKSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAtIEluIHRoZSBMREFQIHNlcnZlcnMsIHRoZSBjZXJ0IGlzIHN0b3JlZCBpbiB0aGUKICAgICAg ICAgICAgICAgICAgICAgICAgZW50cnkgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSB3 aXRoCiAgICAgICAgICAgICAgICAgICAgICAgIFNlcmlhbCBudW1iZXIgNCAoaS5lLiBpdCBpcyB0 aGUgY2VydCBmcm9tCiAgICAgICAgICAgICAgICAgICAgICAgIGZyZWVpcGEtc2VhKS4gPGJyPgog ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg VGhpcyBpcyB3aGVyZSB0aGUgZGlmZmVyZW5jZSBpcy7CoCBUaGVyZSBhcmUgdHdvCiAgICAgICAg ICAgICAgICAgICAgICBjZXJ0aWZpY2F0ZXMgb24gdGhlIG1hc3RlciBhbmQgb25seSBvbmUgb24g dGhlCiAgICAgICAgICAgICAgICAgICAgICBvdGhlci7CoCBJIHdvbmRlciBpZiB0aGlzIGlzIGEg cmVzdWx0IG9mIHRoZSBzbG93CiAgICAgICAgICAgICAgICAgICAgICBtb3Rpb24gcmVwbGljYXRp b24gdHJhaW53cmVjayBJIGhhdmUgZ29pbmcgb24gZHVlCiAgICAgICAgICAgICAgICAgICAgICB0 byBhIHpvbWJpZSByZXBsaWNhIGluIHRoZSBsZGFwIGRhdGFiYXNlIHRoYXQgbm8KICAgICAgICAg ICAgICAgICAgICAgIGxvbmdlciBleGlzdHMgaW4gdGhlIHJlYWwgd29ybGQgYW5kIEkgY2FuJ3Qg c2VlbQogICAgICAgICAgICAgICAgICAgICAgdG8gZ2V0IHJpZCBvZi4gPGJyPgogICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAg ICAgICAgICAgICAgICBIaSwgPGJyPgogICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAg ICAgICAgICAgICB0aGUgcmVtYWluaW5nIGlzc3VlIGlzIGEgcmVwbGljYXRpb24gcHJvYmxlbS4g VGhlcmUKICAgICAgICAgICAgICAgICAgICBpcyBhICJUcm91Ymxlc2hvb3RpbmcgcmVwbGljYXRp b24iIHNlY3Rpb24gWzFdIGluCiAgICAgICAgICAgICAgICAgICAgSWRNIEFkbWluIGd1aWRlIHRo YXQgbWF5IGhlbHAgeW91LiA8YnI+CiAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg ICAgICAgICAgIFJlZ2FyZGluZyB5b3VyIHpvbWJpZSByZXBsaWNhLCB3aGljaCBjb21tYW5kcyBk aWQKICAgICAgICAgICAgICAgICAgICB5b3UgdXNlIHRvIHRyeSB0byByZW1vdmUgaXQsIGFuZCB3 aGF0IHdhcyB0aGUKICAgICAgICAgICAgICAgICAgICBvdXRwdXQ/IDxicj4KICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgWzFdIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst ZnJlZXRleHQiCmhyZWY9Imh0dHBzOi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9l bi1VUy9SZWRfSGF0X0VudGVycHJpc2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0 eV9BdXRoZW50aWNhdGlvbl9hbmRfUG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9u Lmh0bWwiCiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmh0dHBz Oi8vYWNjZXNzLnJlZGhhdC5jb20vZG9jdW1lbnRhdGlvbi9lbi1VUy9SZWRfSGF0X0VudGVycHJp c2VfTGludXgvNy9odG1sL0xpbnV4X0RvbWFpbl9JZGVudGl0eV9BdXRoZW50aWNhdGlvbl9hbmRf UG9saWN5X0d1aWRlL3Ryb3VibGUtZ2VuLXJlcGxpY2F0aW9uLmh0bWw8L2E+PGJyPgogICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIEhpLDxicj4KICAgICAgICAgICAgICAg ICAgPGJyPgogICAgICAgICAgICAgICAgICBUbyBkZWJ1ZyByZXBsaWNhdGlvbiBsYXRlbmN5IG9y IHByb2JsZW0gd2Ugd291bGQgbmVlZAogICAgICAgICAgICAgICAgICBzZXZlcmFsIGluZm8gYnV0 IHN0YXJ0aW5nIHdpdGggdGhlIHJlc3VsdHMgb2YgdGhlCiAgICAgICAgICAgICAgICAgIGZvbGxv d2luZyBjb21tYW5kczxicj4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAgICAg ICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAgICAgICAgInVp ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EiIG5zY3BlbnRyeXdzaTxicj4KICAgICAgICAg ICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlh bmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFu YWdlcicgLVcgLWIKICAgICAgICAgICAgICAgICJ1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlw YWNhIiBuc2NwZW50cnl3c2k8YnI+CiAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3Jk OiA8YnI+CiAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFj YTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogZG46IHVpZD1wa2lkYnVzZXIsb3U9 cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAg ICAgICAgICBlbnRyeXVzbjthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwNTt2dWNzbi01OTM4ZTY4 ODAwMDEwNDI5MDAwNToKICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIMKgNzUy NzQ4OTc8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6CiAgICAgICAgICAgICAgICBt b2RpZnlUaW1lc3RhbXA7YWRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDQ7dnVjc24tNTkzOGU2ODgw MDAxMDQyPGJyPgogICAgICAgICAgICAgICAgwqA5MDAwNDogMjAxNzA2MDgwNTUzMzRaPGJyPgog ICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICAgICAgbW9kaWZpZXJzTmFt ZTthZGNzbi01OTM4ZTY4ODAwMDEwNDI5MDAwMzt2dWNzbi01OTM4ZTY4ODAwMDEwNDI5MDxicj4K ICAgICAgICAgICAgICAgIMKgMDAzOiBjbj1EaXJlY3RvcnkgTWFuYWdlcjxicj4KICAgICAgICAg ICAgICAgIG5zY3BlbnRyeXdzaTogbnNVbmlxdWVJZDoKICAgICAgICAgICAgICAgIDQ4ODA5YjQw LTJiYjkxMWU1LTk2YTBiOGI4LTFmZGQ4MDc0PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiBjbjogcGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVh dGVUaW1lc3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRy eXdzaTogY3JlYXRvcnNOYW1lOiBjbj1kaXJlY3RvcnkgbWFuYWdlcjxicj4KICAgICAgICAgICAg ICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb247dnVjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDE6 CiAgICAgICAgICAgICAgICAyOzEzNDE3MTg1NDE7Q049Q2VydGlmaWM8YnI+CiAgICAgICAgICAg ICAgICDCoGF0ZSBBdXRob3JpdHksTz1CUFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJP Q0tTPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICAgICAgZGVz Y3JpcHRpb247dmRjc24tNTkzOGU2ODgwMDAxMDQyOTAwMDI7ZGVsZXRlZDoKICAgICAgICAgICAg ICAgIDI7NDtDTj1DZXJ0aWZpY2E8YnI+CiAgICAgICAgICAgICAgICDCoHRlIEF1dGhvcml0eSxP PUJQVC5ST0NLUztDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+CiAgICAgICAgICAgICAg ICBuc2NwZW50cnl3c2k6IG1haWw6PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBv YmplY3RDbGFzczogdG9wPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RD bGFzczogcGVyc29uPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBvYmplY3RDbGFz czogb3JnYW5pemF0aW9uYWxQZXJzb248YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6 IG9iamVjdENsYXNzOiBpbmV0T3JnUGVyc29uPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiBvYmplY3RDbGFzczogY21zdXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdz aTogc2VlQWxzbzogQ049Q0EgU3Vic3lzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICAg ICAgbnNjcGVudHJ5d3NpOiBzbjogcGtpZGJ1c2VyPGJyPgogICAgICAgICAgICAgICAgbnNjcGVu dHJ5d3NpOiB1aWQ6IHBraWRidXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog dXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRB TkJna3Foa2lHOXcwQkFRc0ZBREEwTVI8YnI+CiAgICAgICAgICAgICAgICAmbHQ7c25pcCZndDs8 YnI+CsKgY0JkNG5PVjRtOUErcVJaTm80ZVg3ak5UOEFhMjNnRGw2eHVMVmExU3hseUU4WEVvOGRm QVBYTUpvRmM9PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOgogICAgICAgICAgICAg ICAgdXNlckNlcnRpZmljYXRlO3Z1Y3NuLTU5MzhlNjg4MDAwMTA0MjkwMDAwOjoKICAgICAgICAg ICAgICAgIE1JSURiakNDQWxhZ0F3SUJBZ0k8YnI+CiAgICAgICAgICAgICAgICAmbHQ7c25pcCZn dDs8YnI+CiAgICAgICAgICAgICAgICDCoEFSPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5 d3NpOiB1c2VyUGFzc3dvcmQ6OiAmbHQ7c25pcCZndDs8YnI+CiAgICAgICAgICAgICAgICBuc2Nw ZW50cnl3c2k6IHVzZXJzdGF0ZTogMTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog dXNlcnR5cGU6IGFnZW50VHlwZTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogcGFy ZW50aWQ6IDI8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IGVudHJ5aWQ6IDUxPGJy PgogICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKICAgICAgICAgICAgICAg ICAgY2l0ZT0ibWlkOjU5ODgyODcxLjEwMDAxMDZAcmVkaGF0LmNvbSI+IGFuZDxicj4KICAgICAg ICAgICAgICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAg ICAgICAgICAgICAgICAgICdjbj1kaXJlY3RvcnkgbWFuYWdlcicgLVcgLWIKICAgICAgICAgICAg ICAgICAgdWlkPXBraWRidXNlcixvdT1wZW9wbGUsbz1pcGFjYSBuc2NwZW50cnl3c2k8YnI+CiAg ICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRp cmVjdG9yeQogICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgdWlkPXBraWRidXNlcixvdT1w ZW9wbGUsbz1pcGFjYQogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpPGJyPgogICAgICAgICAg ICAgICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgZG46IHVpZD1w a2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2E8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3 c2k6IGRuOiB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhPGJyPgogICAgICAgICAgICAg ICAgbnNjcGVudHJ5d3NpOiBzZWVBbHNvOiBDTj1DQSBTdWJzeXN0ZW0sTz1CUFQuUk9DS1M8YnI+ CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJDZXJ0aWZpY2F0ZTo6CiAgICAgICAg ICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJQkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SPGJy PgogICAgICAgICAgICAgICAgJmx0O3NuaXAmZ3Q7PGJyPgrCoGNCZDRuT1Y0bTlBK3FSWk5vNGVY N2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhkZkFQWE1Kb0ZjPTxicj4KICAgICAgICAgICAg ICAgIG5zY3BlbnRyeXdzaTogZGVzY3JpcHRpb246IDI7NDtDTj1DZXJ0aWZpY2F0ZQogICAgICAg ICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnM8YnI+CiAgICAgICAgICAg ICAgICDCoHlzdGVtLE89QlBULlJPQ0tTPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3Np OiBlbnRyeWlkOiA1MTxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogcGFyZW50aWQ6 IDI8YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG1vZGlmeVRpbWVzdGFtcDogMjAx NTA3MTYxMjUxNDZaPGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBjcmVhdGVUaW1l c3RhbXA6IDIwMTUwNzE2MTI1MTQ2Wjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog bW9kaWZpZXJzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAgICAgICAgICAgICBu c2NwZW50cnl3c2k6IGNyZWF0b3JzTmFtZTogY249ZGlyZWN0b3J5IG1hbmFnZXI8YnI+CiAgICAg ICAgICAgICAgICBuc2NwZW50cnl3c2k6IHVzZXJQYXNzd29yZDo6ICZsdDtzbmlwJmd0Ozxicj4K ICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdXNlcnN0YXRlOiAxPGJyPgogICAgICAgICAg ICAgICAgbnNjcGVudHJ5d3NpOiB1c2VydHlwZTogYWdlbnRUeXBlPGJyPgogICAgICAgICAgICAg ICAgbnNjcGVudHJ5d3NpOiBtYWlsOjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTog Y246IHBraWRidXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogc246IHBraWRi dXNlcjxicj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogdWlkOiBwa2lkYnVzZXI8YnI+ CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiB0b3A8YnI+CiAgICAg ICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBwZXJzb248YnI+CiAgICAgICAg ICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBvcmdhbml6YXRpb25hbFBlcnNvbjxi cj4KICAgICAgICAgICAgICAgIG5zY3BlbnRyeXdzaTogb2JqZWN0Q2xhc3M6IGluZXRPcmdQZXJz b248YnI+CiAgICAgICAgICAgICAgICBuc2NwZW50cnl3c2k6IG9iamVjdENsYXNzOiBjbXN1c2Vy PGJyPgogICAgICAgICAgICAgICAgbnNjcGVudHJ5d3NpOiBuc1VuaXF1ZUlkOgogICAgICAgICAg ICAgICAgNDg4MDliNDAtMmJiOTExZTUtOTZhMGI4YjgtMWZkZDgwNzQ8YnI+CiAgICAgICAgICAg ICAgICBuc2NwZW50cnl3c2k6IGVudHJ5dXNuOiA4Njxicj4KICAgICAgICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiCiAgICAgICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3MS4x MDAwMTA2QHJlZGhhdC5jb20iPiA8YnI+CiAgICAgICAgICAgICAgICAgIEZyb20gdGhlIG91dHB1 dCB5b3UgbWF5IG9ubHkgY29weS9wYXN0IHRoZSBvbmVzCiAgICAgICAgICAgICAgICAgIHJlbGF0 ZWQgdG8gdXNlckNlcnRpZmljYXRlPGJyPgogICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgQWxzbyB0byBkdW1wIHRoZSBjdXJyZW50 IHJlcGxpY2F0aW9uIHN0YXR1cywgc2VuZCB0aGUKICAgICAgICAgICAgICAgICAgcmVzdWx0wqAg b2Y8YnI+CiAgICAgICAgICAgICAgICAgIFtyb290QGZyZWVpcGEtc2VhIGlhbmhdIyBsZGFwc2Vh cmNoIC1MTEwgLUQKICAgICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAt YiAibz1pcGFjYSI8Zm9udCBzaXplPSItMSI+PGk+CiAgICAgICAgICAgICAgICAgICAgPC9pPiIo JmFtcDsob2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZm ZmYtZmZmZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgICAgIDwvZm9udD48L2Js b2NrcXVvdGU+CiAgICAgICAgICAgICAgICBbcm9vdEBmcmVlaXBhLXNlYSBpYW5oXSMgbGRhcHNl YXJjaCAtTExMIC1ECiAgICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1i ICJvPWlwYWNhIgoiKCZhbXA7KG9iamVjdGNsYXNzPW5zdG9tYnN0b25lKShuc1VuaXF1ZUlkPWZm ZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmLWZmZmZmZmZmKSkiPGJyPgogICAgICAgICAgICAgICAg RW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgZG46IGNuPXJlcGxpY2Es Y249b1wzRGlwYWNhLGNuPW1hcHBpbmcgdHJlZSxjbj1jb25maWc8YnI+CiAgICAgICAgICAgICAg ICBjbjogcmVwbGljYTxicj4KICAgICAgICAgICAgICAgIG5zRFM1RmxhZ3M6IDE8YnI+CiAgICAg ICAgICAgICAgICBuc0RTNVJlcGxpY2FCaW5kRE46IGNuPVJlcGxpY2F0aW9uIE1hbmFnZXIKICAg ICAgICAgICAgICAgIGNsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQucm9jPGJyPgogICAg ICAgICAgICAgICAgwqBrcy1wa2ktdG9tY2F0LG91PWNzdXNlcnMsY249Y29uZmlnPGJyPgogICAg ICAgICAgICAgICAgbnNEUzVSZXBsaWNhQmluZEROOiBjbj1SZXBsaWNhdGlvbiBNYW5hZ2VyCiAg ICAgICAgICAgICAgICBtYXN0ZXJBZ3JlZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvYzxicj4KICAg ICAgICAgICAgICAgIMKga3MtcGtpLXRvbWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAg ICAgICAgICAgICAgIG5zRFM1UmVwbGljYUlkOiAxMDY1PGJyPgogICAgICAgICAgICAgICAgbnNE UzVSZXBsaWNhTmFtZTogYjIxYTFmMWUtNjI3OTExZTYtOTNlNmVmNGItNjlkY2MyZDE8YnI+CiAg ICAgICAgICAgICAgICBuc0RTNVJlcGxpY2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAg ICAgbnNEUzVSZXBsaWNhVHlwZTogMzxicj4KICAgICAgICAgICAgICAgIG5zU3RhdGU6OgogICAg ICAgICAgICAgICAgS1FRQUFBQUFBQUFoSElwWkFBQUFBQUVBQUFBQUFBQUFLZ0FBQUFBQUFBQUJB QUFBQUFBQUFBPT08YnI+CiAgICAgICAgICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDog Y249cmVwbGljYXRpb24KICAgICAgICAgICAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLGNu PWV0YyxkYz1icHQsPGJyPgogICAgICAgICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAg ICAgICAgIG5zZHM1cmVwbGljYWJpbmRkbmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICAg ICAgICAgICAgICBvYmplY3RDbGFzczogdG9wPGJyPgogICAgICAgICAgICAgICAgb2JqZWN0Q2xh c3M6IG5zRFM1UmVwbGljYTxicj4KICAgICAgICAgICAgICAgIG9iamVjdENsYXNzOiBleHRlbnNp Ymxlb2JqZWN0PGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRp b259IDU3YzI5MWQ5MDAwMDA0MjkwMDAwPGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7 cmVwbGljYSAxMDY1IDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAg Y2xhc3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRh cDovL2ZyZWVpcGEtc2VhLmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9j a3M6Mzg5PC9hPn0KICAgICAgICAgICAgICAgIDU3Zjg0MGJmMDAwMDA0MjkwMDA8YnI+CiAgICAg ICAgICAgICAgICDCoDAgNTk4YTFjNDAwMDAxMDQyOTAwMDA8YnI+CiAgICAgICAgICAgICAgICBu c2RzNTBydXY6IHtyZXBsaWNhIDEyOTAgPGEgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIgogICAgICAg ICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1saW5rLWZyZWV0ZXh0IgogICAgICAgICAgICAgICAg ICBocmVmPSJsZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5Ij5sZGFwOi8vc2VhdHRsZW5m cy5icHQucm9ja3M6Mzg5PC9hPn08YnI+CiAgICAgICAgICAgICAgICBuc2RzNWFnbXRtYXhjc246 CiAgICAgICAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1mcmVlaXBhLXNlYS5icHQu cm9ja3MtcGtpLXRvbWNhdDtzZWF0PGJyPgogICAgICAgICAgICAgICAgwqB0bGVuZnMuYnB0LnJv Y2tzOzM4OTt1bmF2YWlsYWJsZTxicj4KICAgICAgICAgICAgICAgIG5zZHM1YWdtdG1heGNzbjoK ICAgICAgICAgICAgICAgIG89aXBhY2E7bWFzdGVyQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5y b2Nrcy1wa2ktdG9tY2F0O3NlYXQ8YnI+CiAgICAgICAgICAgICAgICDCoHRsZW5mcy5icHQucm9j a3M7Mzg5O3VuYXZhaWxhYmxlPGJyPgogICAgICAgICAgICAgICAgbnNydXZSZXBsaWNhTGFzdE1v ZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAgICAgICAgICAgIGNsYXNzPSJtb3otdHh0 LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgIGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNl YS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi PmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAgICAgICAgIDU5 OGE8YnI+CiAgICAgICAgICAgICAgICDCoDFjMTY8YnI+CiAgICAgICAgICAgICAgICBuc3J1dlJl cGxpY2FMYXN0TW9kaWZpZWQ6IHtyZXBsaWNhIDEyOTAgPGEKICAgICAgICAgICAgICAgICAgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcDov L3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OSIKICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1z ZW5kPSJ0cnVlIj5sZGFwOi8vc2VhdHRsZW5mcy5icHQucm9ja3M6Mzg5PC9hPn0KICAgICAgICAg ICAgICAgIDAwMDAwPGJyPgogICAgICAgICAgICAgICAgwqAwMDA8YnI+CiAgICAgICAgICAgICAg ICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogODg1PGJyPgogICAgICAgICAgICAgICAgbnNkczVy ZXBsaWNhcmVhcGFjdGl2ZTogMDxicj4KICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9 ImNpdGUiCiAgICAgICAgICAgICAgICAgIGNpdGU9Im1pZDo1OTg4Mjg3MS4xMDAwMTA2QHJlZGhh dC5jb20iPjxmb250IHNpemU9Ii0xIj4KICAgICAgICAgICAgICAgICAgICBhbmQ8YnI+CiAgICAg ICAgICAgICAgICAgIDwvZm9udD5bcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1M TEwgLUQKICAgICAgICAgICAgICAgICAgJ2NuPWRpcmVjdG9yeSBtYW5hZ2VyJyAtVyAtYiAibz1p cGFjYSI8Zm9udCBzaXplPSItMSI+PGk+CiAgICAgICAgICAgICAgICAgICAgPC9pPiIoJmFtcDso b2JqZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZm ZmZmZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgICAgIDwvZm9udD48L2Jsb2NrcXVv dGU+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICBbcm9vdEBzZWF0dGxlbmZzIGlhbmhdIyBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVj dG9yeQogICAgICAgICAgICAgICAgbWFuYWdlcicgLVcgLWIgIm89aXBhY2EiCiIoJmFtcDsob2Jq ZWN0Y2xhc3M9bnN0b21ic3RvbmUpKG5zVW5pcXVlSWQ9ZmZmZmZmZmYtZmZmZmZmZmYtZmZmZmZm ZmYtZmZmZmZmZmYpKSI8YnI+CiAgICAgICAgICAgICAgICBFbnRlciBMREFQIFBhc3N3b3JkOiA8 YnI+CiAgICAgICAgICAgICAgICBkbjogY249cmVwbGljYSxjbj1vXDNEaXBhY2EsY249bWFwcGlu ZyB0cmVlLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgICAgIGNuOiByZXBsaWNhPGJyPgogICAg ICAgICAgICAgICAgbnNEUzVGbGFnczogMTxicj4KICAgICAgICAgICAgICAgIG5zRFM1UmVwbGlj YUJpbmRETjogY249UmVwbGljYXRpb24gTWFuYWdlcgogICAgICAgICAgICAgICAgY2xvbmVBZ3Jl ZW1lbnQxLXNlYXR0bGVuZnMuYnB0LnJvY2s8YnI+CiAgICAgICAgICAgICAgICDCoHMtcGtpLXRv bWNhdCxvdT1jc3VzZXJzLGNuPWNvbmZpZzxicj4KICAgICAgICAgICAgICAgIG5zRFM1UmVwbGlj YUlkOiAxMjkwPGJyPgogICAgICAgICAgICAgICAgbnNEUzVSZXBsaWNhTmFtZTogODcwNmFiMWUt NmE4MzExZTYtYTliZmRiYmYtNzRkYzczMjM8YnI+CiAgICAgICAgICAgICAgICBuc0RTNVJlcGxp Y2FSb290OiBvPWlwYWNhPGJyPgogICAgICAgICAgICAgICAgbnNEUzVSZXBsaWNhVHlwZTogMzxi cj4KICAgICAgICAgICAgICAgIG5zU3RhdGU6OgogICAgICAgICAgICAgICAgQ2dVQUFBQUFBQUFL RllwWkFBQUFBQUFBQUFBQUFBQUFLZ0FBQUFBQUFBQUJBQUFBQUFBQUFBPT08YnI+CiAgICAgICAg ICAgICAgICBuc2RzNXJlcGxpY2FiaW5kZG5ncm91cDogY249cmVwbGljYXRpb24KICAgICAgICAg ICAgICAgIG1hbmFnZXJzLGNuPXN5c2FjY291bnRzLGNuPWV0YyxkYz1icHQsPGJyPgogICAgICAg ICAgICAgICAgwqBkYz1yb2Nrczxicj4KICAgICAgICAgICAgICAgIG5zZHM1cmVwbGljYWJpbmRk bmdyb3VwY2hlY2tpbnRlcnZhbDogNjA8YnI+CiAgICAgICAgICAgICAgICBvYmplY3RDbGFzczog dG9wPGJyPgogICAgICAgICAgICAgICAgb2JqZWN0Q2xhc3M6IG5zRFM1UmVwbGljYTxicj4KICAg ICAgICAgICAgICAgIG9iamVjdENsYXNzOiBleHRlbnNpYmxlb2JqZWN0PGJyPgogICAgICAgICAg ICAgICAgbnNkczUwcnV2OiB7cmVwbGljYWdlbmVyYXRpb259IDU1YzhmM2FlMDAwMDAwNjAwMDAw PGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMjkwIDxhIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1mcmVl dGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tz OjM4OSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAgICAgICAgICAg ICA1N2JlODA0YzAwMDAwNTBhMDAwMDxicj4KICAgICAgICAgICAgICAgIMKgIDU4NzIzNjE1MDAw MDA1MGEwMDAwPGJyPgogICAgICAgICAgICAgICAgbnNkczUwcnV2OiB7cmVwbGljYSAxMDY1IDxh IG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIKICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQt bGluay1mcmVldGV4dCIKICAgICAgICAgICAgICAgICAgaHJlZj0ibGRhcDovL2ZyZWVpcGEtc2Vh LmJwdC5yb2NrczozODkiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5PC9hPn0KICAg ICAgICAgICAgICAgIDU3YjEwM2Q0MDAwMDA0MjkwMDA8YnI+CiAgICAgICAgICAgICAgICDCoDAg NTdiZTgwNDMwMDA3MDQyOTAwMDA8YnI+CiAgICAgICAgICAgICAgICBuc2RzNWFnbXRtYXhjc246 CiAgICAgICAgICAgICAgICBvPWlwYWNhO2Nsb25lQWdyZWVtZW50MS1zZWF0dGxlbmZzLmJwdC5y b2Nrcy1wa2ktdG9tY2F0O2ZyZWVpPGJyPgogICAgICAgICAgICAgICAgwqBwYS1zZWEuYnB0LnJv Y2tzOzM4OTsxMDY1OzU4NzIzNjE1MDAwMDA1MGEwMDAwPGJyPgogICAgICAgICAgICAgICAgbnNy dXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMjkwIDxhCiAgICAgICAgICAgICAgICAg IGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAgIGhyZWY9Imxk YXA6Ly9zZWF0dGxlbmZzLmJwdC5yb2NrczozODkiCiAgICAgICAgICAgICAgICAgIG1vei1kby1u b3Qtc2VuZD0idHJ1ZSI+bGRhcDovL3NlYXR0bGVuZnMuYnB0LnJvY2tzOjM4OTwvYT59CiAgICAg ICAgICAgICAgICAwMDAwMDxicj4KICAgICAgICAgICAgICAgIMKgMDAwPGJyPgogICAgICAgICAg ICAgICAgbnNydXZSZXBsaWNhTGFzdE1vZGlmaWVkOiB7cmVwbGljYSAxMDY1IDxhCiAgICAgICAg ICAgICAgICAgIGNsYXNzPSJtb3otdHh0LWxpbmstZnJlZXRleHQiCiAgICAgICAgICAgICAgICAg IGhyZWY9ImxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5IgogICAgICAgICAgICAgICAg ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmxkYXA6Ly9mcmVlaXBhLXNlYS5icHQucm9ja3M6Mzg5 PC9hPn0KICAgICAgICAgICAgICAgIDAwMDA8YnI+CiAgICAgICAgICAgICAgICDCoDAwMDA8YnI+ CiAgICAgICAgICAgICAgICBuc2RzNVJlcGxpY2FDaGFuZ2VDb3VudDogMzxicj4KICAgICAgICAg ICAgICAgIG5zZHM1cmVwbGljYXJlYXBhY3RpdmU6IDA8YnI+CiAgICAgICAgICAgICAgICA8Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIgogICAgICAgICAgICAgICAgICBjaXRlPSJtaWQ6NTk4ODI4NzEu MTAwMDEwNkByZWRoYXQuY29tIj48Zm9udCBzaXplPSItMSI+CiAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgIFJlZ2FyZHM8YnI+CiAgICAgICAgICAgICAgICAgICAg dGhpZXJyeTxicj4KICAgICAgICAgICAgICAgICAgPC9mb250PgogICAgICAgICAgICAgICAgICA8 YmxvY2txdW90ZQogICAgICAgICAgICAgICAgICAgIGNpdGU9Im1pZDozMzFlZmI2Ny1kZDNiLTIz NTAtMzQ3MC01ZDFhOWI5MjUyYzNAcmVkaGF0LmNvbSIKICAgICAgICAgICAgICAgICAgICB0eXBl PSJjaXRlIj4KICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5bcm9v dEBmcmVlaXBhLXNlYSBpYW5oXSMKICAgICAgICAgICAgICAgICAgICAgIGxkYXBzZWFyY2ggLUxM TCAtRCAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgICAgICAgICAgICB1 aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQogICAgICAgICAg ICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgRW50ZXIg TERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46IHVpZD1wa2lkYnVz ZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRp ZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJBZ0lCQkRBTkJn a3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4bHlFOFhFbzhk ZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNhdGU6Ogog ICAgICAgICAgICAgICAgICAgICAgTUlJRGJqQ0NBbGFnQXdJQkFnSUVUL2tBRFRBTkJna3Foa2lH OXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLCiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAmbHQ7dHJ1bmNhdGVkJmd0OwogICAgICAgICAgICAgICAgICAgICAg ZnVRUVptUDFYcktrcmZzamVpRmJVRnRvTW5mbUhMSVlwZTVRQVIgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgZGVzY3JpcHRpb246IDI7MTM0MTcxODU0MTtDTj1DZXJ0aWZpY2F0ZQogICAgICAg ICAgICAgICAgICAgICAgQXV0aG9yaXR5LE89QlBULlJPQ0tTO0NOPUNBIFN1YnN5c3RlbSA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICDCoCAsTz1CUFQuUk9DS1MgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgW3Jvb3RAc2VhdHRsZW5mcyBpYW5oXSMgbGRhcHNlYXJjaCAtTExMIC1ECiAgICAgICAg ICAgICAgICAgICAgICAnY249ZGlyZWN0b3J5IG1hbmFnZXInIC1XIC1iCiAgICAgICAgICAgICAg ICAgICAgICB1aWQ9cGtpZGJ1c2VyLG91PXBlb3BsZSxvPWlwYWNhIHVzZXJDZXJ0aWZpY2F0ZQog ICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAg ICAgRW50ZXIgTERBUCBQYXNzd29yZDogPGJyPgogICAgICAgICAgICAgICAgICAgICAgZG46IHVp ZD1wa2lkYnVzZXIsb3U9cGVvcGxlLG89aXBhY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg dXNlckNlcnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgIE1JSURjekNDQWx1Z0F3SUJB Z0lCQkRBTkJna3Foa2lHOXcwQkFRc0ZBREEwTVJJd0VBWURWUVFLREFsQwogICAgICAgICAgICAg ICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgJmx0O3RydW5jYXRlZCZndDsg PGJyPgogICAgICAgICAgICAgICAgICAgICAgwqAgWk5vNGVYN2pOVDhBYTIzZ0RsNnh1TFZhMVN4 bHlFOFhFbzhkZkFQWE1Kb0ZjPSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlv bjogMjs0O0NOPUNlcnRpZmljYXRlCiAgICAgICAgICAgICAgICAgICAgICBBdXRob3JpdHksTz1C UFQuUk9DS1M7Q049Q0EgU3Vic3lzdGVtLE89QlBULlJPIDxicj4KICAgICAgICAgICAgICAgICAg ICAgIMKgIENLUyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRlIj5JZiB5b3UgY2hlY2sgdGhlCiAgICAgICAg ICAgICAgICAgICAgICAgIGNlcnRpZmljYXRlcyBkYXRlcywgSSBndWVzcyB0aGF0IHRoZSBtb3N0 IHJlY2VudAogICAgICAgICAgICAgICAgICAgICAgICBvbmUgaXMgb24gc2VydmVyIHNlYXR0bGVu ZnMgKGJlY2F1c2Ugb2Ygc2VyaWFsCiAgICAgICAgICAgICAgICAgICAgICAgIG51bWJlcnMpLiBD YW4geW91IGNvbmZpcm0gdGhpcyAoYmVjYXVzZSBvdXIgZ29hbAogICAgICAgICAgICAgICAgICAg ICAgICBpcyB0byBoYXZlIHRoZSBtb3N0IHJlY2VudCBjZXJ0IHN0b3JlZCBpbiBhbGwKICAgICAg ICAgICAgICAgICAgICAgICAgdGhlIE5TU0RCcyBhbmQgaW4gTERBUCk/IDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICBUaGFua3MsIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg IDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9j a3F1b3RlIHR5cGU9ImNpdGUiPklmIHlvdXIgcmVuZXdhbCBtYXN0ZXIKICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGlzIHRoZSBtYWNoaW5lIG9uIHdoaWNoIHRoZSBOU1MgREIKICAgICAgICAg ICAgICAgICAgICAgICAgICAgIC9ldGMvcGtpL3BraS10b21jYXQvYWxpYXMgY29udGFpbnMgdGhl IG5ld2VyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LCB0aGVuIHlvdSBjYW4gbWFu dWFsbHkgcnVuIHRoZSBzY3JpcHRzOgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgSWYgSSdtIGludGVycHJldGlu ZyB0aGlzIGNvcnJlY3RseSwgdGhlbiBpdAogICAgICAgICAgICAgICAgICAgICAgICAgIGlzLi4u IHNvIEkgcmFuIHRoaXMgb24gdGhlIGJyb2tlbiBtYWNoaW5lCiAgICAgICAgICAgICAgICAgICAg ICAgICAgKHNlYXR0bGVuZnMpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+JCBzdWRvCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvc3Rv cF9wa2ljYWQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgJCBzdWRvCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAvdXNyL2xpYmV4ZWMvaXBhL2NlcnRtb25nZXIvcmVuZXdfY2Ff Y2VydAogICAgICAgICAgICAgICAgICAgICAgICAgICAgInN1YnN5c3RlbUNlcnQgY2VydC1wa2kt Y2EiIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIEkgcmFuIHRoaXMsIGl0IHRvb2sgYSB3aGlsZSwgdGhl biBJIHJlLWNoZWNrZWQKICAgICAgICAgICAgICAgICAgICAgICAgICBhbmQgdGhlIHNlcmlhbCBz dGlsbCBzZWVtcyB0byBiZSA0IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgJCBsZGFwc2VhcmNoIC1MTEwgLUQgJ2NuPWRpcmVjdG9y eSBtYW5hZ2VyJyAtVwogICAgICAgICAgICAgICAgICAgICAgICAgIC1iIHVpZD1wa2lkYnVzZXIs b3U9cGVvcGxlLG89aXBhY2EKICAgICAgICAgICAgICAgICAgICAgICAgICB1c2VyQ2VydGlmaWNh dGUgZGVzY3JpcHRpb24gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIEVudGVyIExEQVAg UGFzc3dvcmQ6IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBkbjogdWlkPXBraWRidXNl cixvdT1wZW9wbGUsbz1pcGFjYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNl cnRpZmljYXRlOjoKICAgICAgICAgICAgICAgICAgICAgICAgICBNSUlEY3pDQ0FsdWdBd0lCQWdJ QkJEQU5CZ2txaGtpRzl3MEJBUXNGQURBME1SSXdFQVlEVlFRS0RBbEMKICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgLi4uIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICDCoAogICAgICAgICAgICAgICAgICAgICAgICAgIFpObzRlWDdq TlQ4QWEyM2dEbDZ4dUxWYTFTeGx5RThYRW84ZGZBUFhNSm9GYz0KICAgICAgICAgICAgICAgICAg ICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgZGVzY3JpcHRpb246IDI7NDtD Tj1DZXJ0aWZpY2F0ZQogICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhvcml0eSxPPUJQVC5S T0NLUztDTj1DQQogICAgICAgICAgICAgICAgICAgICAgICAgIFN1YnN5c3RlbSxPPUJQVC5ST0NL UyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAg ICAgICAgIEhlcmUncyB3aGF0IHdhcyBpbgogICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIv bG9nL3BraS9wa2ktdG9tY2F0L2NhL2RlYnVnIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVts b2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgID09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09IDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 CiAgICAgICAgICAgICAgICAgICAgICAgICAgPT09PT3CoCBERUJVRyBTVUJTWVNURU0gSU5JVElB TElaRUTCoMKgID09PT09PT0gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAg ICAgICAgICA9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PSA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogcmVz dGFydCBhdCBhdXRvU2h1dGRvd24/IGZhbHNlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAg ICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAg ICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBhdXRvU2h1dGRvd24gY3J1bWIgZmlsZSBwYXRo PwogICAgICAgICAgICAgICAgICAgICAgICAgIC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3Mv YXV0b1NodXRkb3duLmNydW1iCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0 U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGFib3V0IHRvIGxv b2sgZm9yIGNlcnQgZm9yCiAgICAgICAgICAgICAgICAgICAgICAgICAgYXV0by1zaHV0ZG93biBz dXBwb3J0OmF1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBr aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0Vu Z2luZTogZm91bmQgY2VydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAgICAgICAgICAgICAgICAg ICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAx NzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAg ICAgICBDTVNFbmdpbmU6IGRvbmUgaW5pdCBpZD1kZWJ1ZyA8YnI+CiAgICAgICAgICAgICAgICAg ICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgog ICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgZGVidWcgPGJy PgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxo b3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGlu aXRTdWJzeXN0ZW0gaWQ9bG9nIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVn LzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAg ICAgICAgICAgQ01TRW5naW5lOiByZWFkeSB0byBpbml0IGlkPWxvZyA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9w LTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAgICAgICAg ICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9jYS9z aWduZWRBdWRpdC9jYV9hdWRpdCkKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3Rh cnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nCiAgICAgICAgICAg ICAgICAgICAgICAgICAgUm9sbGluZ0xvZ0ZpbGUoL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9n cy9jYS9zeXN0ZW0pCiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0x XToKICAgICAgICAgICAgICAgICAgICAgICAgICBDcmVhdGluZwogICAgICAgICAgICAgICAgICAg ICAgICAgIFJvbGxpbmdMb2dGaWxlKC92YXIvbGliL3BraS9wa2ktdG9tY2F0L2xvZ3MvY2EvdHJh bnNhY3Rpb25zKQogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06 CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZXN0YXJ0IGF0IGF1dG9TaHV0 ZG93bj8gZmFsc2UgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzox Mzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAg ICBDTVNFbmdpbmU6IGF1dG9TaHV0ZG93biBjcnVtYiBmaWxlIHBhdGg/CiAgICAgICAgICAgICAg ICAgICAgICAgICAgL3Zhci9saWIvcGtpL3BraS10b21jYXQvbG9ncy9hdXRvU2h1dGRvd24uY3J1 bWIKICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAg ICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAg ICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYWJvdXQgdG8gbG9vayBmb3IgY2VydCBmb3IK ICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRvLXNodXRkb3duIHN1cHBvcnQ6YXVkaXRTaWdu aW5nQ2VydAogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAg ICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFy dFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBmb3VuZCBjZXJ0 OmF1ZGl0U2lnbmluZ0NlcnQKICAgICAgICAgICAgICAgICAgICAgICAgICBjZXJ0LXBraS1jYSA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog ZG9uZSBpbml0IGlkPWxvZyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8y MDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAg ICAgICAgIENNU0VuZ2luZTogaW5pdGlhbGl6ZWQgbG9nIDxicj4KICAgICAgICAgICAgICAgICAg ICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAg ICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBpbml0U3Vic3lzdGVtIGlkPWpzcyA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTog cmVhZHkgdG8gaW5pdCBpZD1qc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg ICAgICAgICAgICBDTVNFbmdpbmU6IHJlc3RhcnQgYXQgYXV0b1NodXRkb3duPyBmYWxzZSA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENNU0VuZ2luZTogYXV0 b1NodXRkb3duIGNydW1iIGZpbGUgcGF0aD8KICAgICAgICAgICAgICAgICAgICAgICAgICAvdmFy L2xpYi9wa2kvcGtpLXRvbWNhdC9sb2dzL2F1dG9TaHV0ZG93bi5jcnVtYgogICAgICAgICAgICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6 MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAg ICAgQ01TRW5naW5lOiBhYm91dCB0byBsb29rIGZvciBjZXJ0IGZvcgogICAgICAgICAgICAgICAg ICAgICAgICAgIGF1dG8tc2h1dGRvd24gc3VwcG9ydDphdWRpdFNpZ25pbmdDZXJ0CiAgICAgICAg ICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmU6IGZvdW5kIGNlcnQ6YXVkaXRTaWduaW5nQ2Vy dAogICAgICAgICAgICAgICAgICAgICAgICAgIGNlcnQtcGtpLWNhIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiBkb25lIGluaXQgaWQ9anNz IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xv Y2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5l OiBpbml0aWFsaXplZCBqc3MgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcv MjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAg ICAgICAgICBDTVNFbmdpbmU6IGluaXRTdWJzeXN0ZW0gaWQ9ZGJzIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgQ01TRW5naW5lOiByZWFkeSB0byBpbml0IGlk PWRicyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIERCU3Vi c3lzdGVtOiBpbml0KCkgbUVuYWJsZVNlcmlhbE1nbXQ9dHJ1ZSA8YnI+CiAgICAgICAgICAgICAg ICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFd OgogICAgICAgICAgICAgICAgICAgICAgICAgIENyZWF0aW5nIExkYXBCb3VuZENvbm5GYWN0b3Io REJTdWJzeXN0ZW0pIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6 MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAg ICAgTGRhcEJvdW5kQ29ubkZhY3Rvcnk6IGluaXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgICAgICAgICAgICBMZGFwQm91bmRDb25uRmFjdG9yeTpkb0Nsb25pbmcgdHJ1ZSA8 YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2Nh bGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIExkYXBBdXRoSW5m bzogaW5pdCgpIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6 NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAgICAg TGRhcEF1dGhJbmZvOiBpbml0IGJlZ2lucyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAg WzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAg ICAgICAgICAgICAgICAgIExkYXBBdXRoSW5mbzogaW5pdCBlbmRzIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3At MV06CiAgICAgICAgICAgICAgICAgICAgICAgICAgaW5pdDogYmVmb3JlIG1ha2VDb25uZWN0aW9u IGVycm9ySWZEb3duIGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgdHJ1ZSA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3Rh cnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIG1ha2VDb25uZWN0aW9uOiBlcnJv cklmRG93biB0cnVlIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICBbMDMvQXVnLzIwMTc6 MTM6NTI6NTFdW2xvY2FsaG9zdC1zdGFydFN0b3AtMV06CiAgICAgICAgICAgICAgICAgICAgICAg ICAgVENQIEtlZXAtQWxpdmU6IHRydWUgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFsw My9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAg ICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0ZVNlbGVjdGlvbkNCOiBTZXR0aW5nCiAg ICAgICAgICAgICAgICAgICAgICAgICAgZGVzaXJlZCBjZXJ0IG5pY2tuYW1lIHRvOiBzdWJzeXN0 ZW1DZXJ0CiAgICAgICAgICAgICAgICAgICAgICAgICAgY2VydC1wa2ktY2EgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0 U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBMZGFwSnNzU1NMU29ja2V0OiBzZXQg Y2xpZW50IGF1dGggY2VydAogICAgICAgICAgICAgICAgICAgICAgICAgIG5pY2tuYW1lIHN1YnN5 c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9B dWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAg ICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZpY2F0U2VsZWN0aW9uQ0I6IEVudGVyaW5nISA8YnI+ CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhv c3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIENhbmRpZGF0ZSBjZXJ0 OiBvY3NwU2lnbmluZ0NlcnQgY2VydC1wa2ktY2EgPGJyPgogICAgICAgICAgICAgICAgICAgICAg ICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToKICAgICAg ICAgICAgICAgICAgICAgICAgICBDYW5kaWRhdGUgY2VydDogc3Vic3lzdGVtQ2VydCBjZXJ0LXBr aS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAzL0F1Zy8yMDE3OjEzOjUyOjUx XVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAgICAgICAgICAgICAgIFNTTENs aWVudENlcnRpZmljYXRlU2VsZWN0aW9uQ0I6IGRlc2lyZWQgY2VydAogICAgICAgICAgICAgICAg ICAgICAgICAgIGZvdW5kIGluIGxpc3Q6IHN1YnN5c3RlbUNlcnQgY2VydC1wa2ktY2EgPGJyPgog ICAgICAgICAgICAgICAgICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0 LXN0YXJ0U3RvcC0xXToKICAgICAgICAgICAgICAgICAgICAgICAgICBTU0xDbGllbnRDZXJ0aWZp Y2F0ZVNlbGVjdGlvbkNCOiByZXR1cm5pbmc6CiAgICAgICAgICAgICAgICAgICAgICAgICAgc3Vi c3lzdGVtQ2VydCBjZXJ0LXBraS1jYSA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgWzAz L0F1Zy8yMDE3OjEzOjUyOjUxXVtsb2NhbGhvc3Qtc3RhcnRTdG9wLTFdOgogICAgICAgICAgICAg ICAgICAgICAgICAgIFNTTCBoYW5kc2hha2UgaGFwcGVuZWQgPGJyPgogICAgICAgICAgICAgICAg ICAgICAgICAgIFswMy9BdWcvMjAxNzoxMzo1Mjo1MV1bbG9jYWxob3N0LXN0YXJ0U3RvcC0xXToK ICAgICAgICAgICAgICAgICAgICAgICAgICBDTVNFbmdpbmUuc2h1dGRvd24oKSA8YnI+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICBJIHJlYWxseSBhcHByZWNpYXRlIHlvdSBzdGlja2lu ZyB3aXRoIG1lCiAgICAgICAgICAgICAgICAgICAgICAgICAgdGhyb3VnaCB0aGlzLsKgIEkgb3dl IHlvdS4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAg ICAgICAgICAgICAtIElhbiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAg ICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPkFmdGVyIHRoYXQs IGNoZWNrIHRoYXQKICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRoZSBMREFQIGVudHJ5IGhh cyBiZWVuIHVwZGF0ZWQuIElmIGl0IGlzCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aGUg Y2FzZSwgeW91IHNob3VsZCBiZSBhYmxlIHRvIHJlc3RhcnQgcGtpLgogICAgICAgICAgICAgICAg ICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgRmxvIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAg IDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PlRoYW5rIHlvdSBhZ2FpbiBmb3IKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeW91ciB0 aW1lISA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgSWFuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg PGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij5GbG8uIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj4gPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd2hpY2gg c2VlbXMgd2VpcmQuIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxicj4K ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PlRoZQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkZXNjcmlwdGlvbiBhdHRy aWJ1dGUgaW4gdGhlCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxkYXBzZWFy Y2ggb3V0cHV0IGlzIG9mIHRoZSBmb3JtCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDI7IztETjtETiA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhlICMgc2hvdWxkIG1hdGNo IHRoZSBzZXJpYWwgbnVtYmVyCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlu IHRoZSBmaXJzdCBjZXJ0dXRpbCBvdXRwdXQgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoZSBB U0NJSSBibG9iIChtaW51cyB0aGUgQkVHSU4vRU5ECiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGhlYWRlcnMpIHNob3VsZCBtYXRjaCBvbmUgb2YgdGhlIDxicj4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgdXNlckNlcnRpZmljYXRlIGF0dHJpYnV0ZXMuIDxi cj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICByb2IgPGJyPgogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2Nr cXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAg ICAgICAgICA8L2Jsb2NrcXVvdGU+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAgICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgICA8L2Jsb2NrcXVvdGU+ CiAgICAgICAgICAgICAgICAgICAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXyA8YnI+CiAgICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIG1h aWxpbmcgbGlzdCAtLSA8YQogICAgICAgICAgICAgICAgICAgICAgICBjbGFzcz0ibW96LXR4dC1s aW5rLWFiYnJldmlhdGVkIgogICAgICAgICAgICAgICAgICAgICAgICBocmVmPSJtYWlsdG86ZnJl ZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIgogICAgICAgICAgICAgICAgICAgICAg ICBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVk Lm9yZzwvYT4KICAgICAgICAgICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgICAgICAg IFRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEKICAgICAgICAgICAgICAgICAgICAg ICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAgICAgICAgICAgICAgICAgICAg ICAgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZyIKICAgICAgICAgICAgICAgICAgICAgICAgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBh LXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CiAgICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICAg ICAgICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIDxi cj4KICAgICAgICAgICAgICAgICAgICBGcmVlSVBBLXVzZXJzIG1haWxpbmcgbGlzdCAtLSA8YQog ICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZpYXRlZCIKICAg ICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9y YWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8tbm90LXNlbmQ9InRydWUi PmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KICAgICAgICAgICAgICAg ICAgICA8YnI+CiAgICAgICAgICAgICAgICAgICAgVG8gdW5zdWJzY3JpYmUgc2VuZCBhbiBlbWFp bCB0byA8YQogICAgICAgICAgICAgICAgICAgICAgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZp YXRlZCIKICAgICAgICAgICAgICAgICAgICAgIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzLWxl YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciCiAgICAgICAgICAgICAgICAgICAgICBtb3otZG8t bm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3JhaG9zdGVkLm9y ZzwvYT4KICAgICAgICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgICAgIDwvYmxvY2tx dW90ZT4KICAgICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPC9ibG9ja3F1b3Rl PgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAgICAgPGJyPgogICAgICAgICAgICAg ICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlciI+PC9maWVsZHNldD4KICAg ICAgICAgICAgICAgIDxicj4KICAgICAgICAgICAgICAgIDxwcmUgd3JhcD0iIj5fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpGcmVlSVBBLXVzZXJzIG1haWxp bmcgbGlzdCAtLSA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVkIiBocmVmPSJtYWls dG86ZnJlZWlwYS11c2Vyc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnIiBtb3otZG8tbm90LXNlbmQ9 InRydWUiPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJz Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn IiBtb3otZG8tbm90LXNlbmQ9InRydWUiPmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMuZmVkb3Jh aG9zdGVkLm9yZzwvYT4KPC9wcmU+CiAgICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAg ICAgICAgIDxicj4KICAgICAgICAgICAgPC9ibG9ja3F1b3RlPgogICAgICAgICAgICA8YnI+CiAg ICAgICAgICAgIDxicj4KICAgICAgICAgICAgPGZpZWxkc2V0IGNsYXNzPSJtaW1lQXR0YWNobWVu dEhlYWRlciI+PC9maWVsZHNldD4KICAgICAgICAgICAgPGJyPgogICAgICAgICAgICA8cHJlIHdy YXA9IiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KRnJl ZUlQQS11c2VycyBtYWlsaW5nIGxpc3QgLS0gPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJyZXZp YXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyIg bW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3RlZC5v cmc8L2E+ClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gPGEgY2xhc3M9Im1vei10eHQt bGluay1hYmJyZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmZyZWVpcGEtdXNlcnMtbGVhdmVAbGlzdHMu ZmVkb3JhaG9zdGVkLm9yZyIgbW96LWRvLW5vdC1zZW5kPSJ0cnVlIj5mcmVlaXBhLXVzZXJzLWxl YXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjwvcHJlPgogICAgICAgICAgPC9ibG9ja3F1 b3RlPgogICAgICAgICAgPGJyPgogICAgICAgIDwvYmxvY2txdW90ZT4KICAgICAgICA8YnI+CiAg ICAgIDwvYmxvY2txdW90ZT4KICAgICAgPGJyPgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBj bGFzcz0ibWltZUF0dGFjaG1lbnRIZWFkZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAg PHByZSB3cmFwPSIiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCkZyZWVJUEEtdXNlcnMgbWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpmcmVlaXBhLXVzZXJzQGxpc3RzLmZlZG9yYWhvc3Rl ZC5vcmciPmZyZWVpcGEtdXNlcnNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT4KVG8gdW5zdWJz Y3JpYmUgc2VuZCBhbiBlbWFpbCB0byA8YSBjbGFzcz0ibW96LXR4dC1saW5rLWFiYnJldmlhdGVk IiBocmVmPSJtYWlsdG86ZnJlZWlwYS11c2Vycy1sZWF2ZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn Ij5mcmVlaXBhLXVzZXJzLWxlYXZlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+CjwvcHJlPgog ICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogIDwvYm9keT4KPC9odG1sPgo= --===============3500582530928333893==--