49566 2024-02-29 16:26:04 +0300 .NET 8: Не устанавливаются пакеты из NuGet в связи с отсутствием доверия к 2 корневым сертификатам 2024-12-09 04:00:04 +0300 1 1 4 Development Sisyphus dotnet-8.0 unstable x86_64 Linux CLOSED FIXED https://learn.microsoft.com/ru-ru/dotnet/core/tools/nuget-signed-package-verification P5 normal --- 1 varaksaaa lav basealt--p1ai lav qa-sisyphus oldest_to_newest 242374 0 15630 varaksaaa 2024-02-29 16:26:04 +0300 Created attachment 15630 Вывод $ dotnet add package Newtonsoft.Json Шаги ==== 1. # apt-get install -y dotnet-8.0 2. $ dotnet new web -o webapp 3. $ cd webapp 4. $ dotnet add package Newtonsoft.Json Фактический результат ===================== Ошибки вида (полный лог см. во вложении): > info : X.509 certificate chain validation will use the system certificate bundle at '/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem'. > info : X.509 certificate chain validation will use the fallback certificate bundle at '/usr/lib64/dotnet/sdk/8.0.102/trustedroots/timestampctl.pem'. > [...] > warn : NU3042: Package 'Newtonsoft.Json 13.0.3' from source 'https://api.nuget.org/v3/index.json': The following X.509 root certificate is untrusted because it is not present in the certificate bundle at /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem. For more information, see documentation for NU3042. > [...] > warn : Subject: CN=DigiCert CS RSA4096 Root G5, O="DigiCert, Inc.", C=US > warn : Fingerprint (SHA-256): 7353B6D6C2D6DA4247773F3F07D075DECB5134212BEAD0928EF1F46115260941 > [...] В /usr/lib64/dotnet/sdk/8.0.102/trustedroots/timestampctl.pem (как и в аналогичном файле для 7.0) искомые сертификаты есть. Возможно, проблема в том, что этот fallback не работает с .NET 8? В системном хранилище доверия этих сертификатов нет (# trust-list). Странно, что в конце вывода другая ошибка: > error: Value cannot be null. (Parameter 'path1') (последующий вывод справки об использовании - известная ошибка https://github.com/NuGet/Home/issues/13251) Тем не менее, если установить переменную среды DOTNET_NUGET_SIGNATURE_VERIFICATION=false, то установка работает, что указывает на проблему именно с сертификатами. Ожидаемый результат =================== Успешное добавление пакета, как с .NET 6 и 7. Дополнительно ============= Сертификаты: - https://crt.sh/?q=7353B6D6C2D6DA4247773F3F07D075DECB5134212BEAD0928EF1F46115260941 - https://crt.sh/?q=3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C Возможно, связанная ошибка: - https://github.com/NuGet/Home/issues/12033 Информация об ошибках NuGet: - https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu3042 - https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu3018 Воспроизводимость ================= Воспроизводится на виртуальной машине: [sisyphus] ALT Server 10.1 x86_64 dotnet-8.0-8.0.2-alt1.x86_64 В p10 .NET 8 ещё нет. 242390 1 lav 2024-02-29 18:01:23 +0300 Проблема воспроизводится при наличии файла /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem откуда он у вас в системе? 242391 2 varaksaaa 2024-02-29 18:04:35 +0300 (Ответ для Vitaly Lipatov на комментарий #1) > Проблема воспроизводится при наличии файла > /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem > откуда он у вас в системе? > # rpm -qf /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem > ca-trust-0.1.4-alt1.noarch Пакет присутствует во всех дистрибутивах p10 https://packages.altlinux.org/ru/p10/srpms/ca-trust/images/?task_repo=p10. 242392 3 varaksaaa 2024-02-29 18:05:29 +0300 (Ответ для Artem Varaksa на комментарий #2) > > ca-trust-0.1.4-alt1.noarch В sisyphus 0.1.5-alt1. 242411 4 lav 2024-03-01 02:56:09 +0300 Насколько я понял логику поиска, при существовании файла /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem уже не будет принят в расчёт /usr/lib64/dotnet/sdk/8.0.102/trustedroots/timestampctl.pem Ещё более странно то, что не упоминается файл /usr/lib64/dotnet/sdk/8.0.102/trustedroots/codesignctl.pem который по логике и должен использоваться для проверки подписи. Так вот, при отсутствии файла /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem Надпись такая: info : X.509 certificate chain validation will use the fallback certificate bundle at '/usr/lib64/dotnet/sdk/8.0.102/trustedroots/codesignctl.pem'. info : X.509 certificate chain validation will use the fallback certificate bundle at '/usr/lib64/dotnet/sdk/8.0.102/trustedroots/timestampctl.pem'. то есть system certificate bundle уже нет, зато не потерялся codesignctl.pem В общем, код такой в NuGet.Client/src/NuGet.Core/NuGet.Packaging/Signing/TrustStore/X509TrustStore.cs public static void InitializeForDotNetSdk(ILogger logger) { _ = GetX509ChainFactory(X509StorePurpose.CodeSigning, logger, CreateX509ChainFactoryForDotNetSdk); _ = GetX509ChainFactory(X509StorePurpose.Timestamping, logger, CreateX509ChainFactoryForDotNetSdk); } А каждый CreateX509ChainFactoryForDotNetSdk возвращает успех, если найдено системное хранилище и использует только его! 242412 5 lav 2024-03-01 03:07:29 +0300 (Ответ для Artem Varaksa на комментарий #0) ... > > info : X.509 certificate chain validation will use the system certificate bundle at '/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem'. .. > В системном хранилище доверия этих сертификатов нет (# trust-list). ... > https://crt.sh/ > ?q=7353B6D6C2D6DA4247773F3F07D075DECB5134212BEAD0928EF1F46115260941 > - > https://crt.sh/ > ?q=3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C > Если у вас в системе есть файл /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem, то заполните его нужными сертификатами, чтобы nuget мог проверять подписи, или удалите этот пустой файл, если он не используется. 242413 6 lav 2024-03-01 03:17:04 +0300 «…в следующем расположении: /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem Если найден допустимый пакет сертификатов, NuGet предпочтет его пакету сертификатов пакета SDK для .NET для подписывания кода.» https://learn.microsoft.com/ru-ru/dotnet/core/tools/nuget-signed-package-verification Можно подключиться к Программе доверенных корневых сертификатов Майкрософт https://learn.microsoft.com/ru-ru/security/trusted-root/program-requirements 242430 7 lav 2024-03-01 13:32:15 +0300 Добавил пакет с нужными сертификатами ca-certificates-nuget.org.git=0.1-alt1 и зависимость на него в dotnet-sdk-8.0.git=8.0.102-alt2 251874 8 basealt--p1ai 2024-09-20 18:29:46 +0300 В июле был выпущен новый сертификат и ошибка вновь появилась. Нужно теперь добавить новый сертификат в указанный пакет 251880 9 basealt--p1ai 2024-09-21 03:21:11 +0300 У меня проблема решилась добавлением сертификата DigiCert Trusted Root G4 в файл /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem 255673 10 repository-robot 2024-12-09 04:00:04 +0300 ca-certificates-nuget.org-0.2-alt1 -> sisyphus: Mon Dec 09 2024 Vitaly Lipatov <lav@altlinux.ru> 0.2-alt1 - add DigiCertTrustedRootG4 (ALT bug 49566) 15630 2024-02-29 16:26:04 +0300 2024-02-29 16:26:04 +0300 Вывод $ dotnet add package Newtonsoft.Json file_49566.txt text/plain 12090 varaksaaa ICBEZXRlcm1pbmluZyBwcm9qZWN0cyB0byByZXN0b3JlLi4uDQogIFdyaXRpbmcgL3RtcC8ucHJp dmF0ZS9yb290L3RtcEh6Z2lxYy50bXANCmluZm8gOiBYLjUwOSBjZXJ0aWZpY2F0ZSBjaGFpbiB2 YWxpZGF0aW9uIHdpbGwgdXNlIHRoZSBzeXN0ZW0gY2VydGlmaWNhdGUgYnVuZGxlIGF0ICcvZXRj L3BraS9jYS10cnVzdC9leHRyYWN0ZWQvcGVtL29ianNpZ24tY2EtYnVuZGxlLnBlbScuDQppbmZv IDogWC41MDkgY2VydGlmaWNhdGUgY2hhaW4gdmFsaWRhdGlvbiB3aWxsIHVzZSB0aGUgZmFsbGJh Y2sgY2VydGlmaWNhdGUgYnVuZGxlIGF0ICcvdXNyL2xpYjY0L2RvdG5ldC9zZGsvOC4wLjEwMi90 cnVzdGVkcm9vdHMvdGltZXN0YW1wY3RsLnBlbScuDQppbmZvIDogQWRkaW5nIFBhY2thZ2VSZWZl cmVuY2UgZm9yIHBhY2thZ2UgJ05ld3RvbnNvZnQuSnNvbicgaW50byBwcm9qZWN0ICcvdG1wLy5w cml2YXRlL3Jvb3QvNE1ZRkRBdzUzcC93ZWJhcHAvd2ViYXBwLmNzcHJvaicuDQppbmZvIDogICBH RVQgaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL3JlZ2lzdHJhdGlvbjUtZ3otc2VtdmVyMi9uZXd0 b25zb2Z0Lmpzb24vaW5kZXguanNvbg0KaW5mbyA6ICAgT0sgaHR0cHM6Ly9hcGkubnVnZXQub3Jn L3YzL3JlZ2lzdHJhdGlvbjUtZ3otc2VtdmVyMi9uZXd0b25zb2Z0Lmpzb24vaW5kZXguanNvbiAx MzAxbXMNCmluZm8gOiBSZXN0b3JpbmcgcGFja2FnZXMgZm9yIC90bXAvLnByaXZhdGUvcm9vdC80 TVlGREF3NTNwL3dlYmFwcC93ZWJhcHAuY3Nwcm9qLi4uDQppbmZvIDogICBHRVQgaHR0cHM6Ly9h cGkubnVnZXQub3JnL3YzLWZsYXRjb250YWluZXIvbmV3dG9uc29mdC5qc29uL2luZGV4Lmpzb24N CmluZm8gOiAgIE9LIGh0dHBzOi8vYXBpLm51Z2V0Lm9yZy92My1mbGF0Y29udGFpbmVyL25ld3Rv bnNvZnQuanNvbi9pbmRleC5qc29uIDIyMG1zDQppbmZvIDogICBHRVQgaHR0cHM6Ly9hcGkubnVn ZXQub3JnL3YzLWZsYXRjb250YWluZXIvbmV3dG9uc29mdC5qc29uLzEzLjAuMy9uZXd0b25zb2Z0 Lmpzb24uMTMuMC4zLm51cGtnDQppbmZvIDogICBPSyBodHRwczovL2FwaS5udWdldC5vcmcvdjMt ZmxhdGNvbnRhaW5lci9uZXd0b25zb2Z0Lmpzb24vMTMuMC4zL25ld3RvbnNvZnQuanNvbi4xMy4w LjMubnVwa2cgMzFtcw0KaW5mbyA6IFBhY2thZ2UgJ05ld3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZy b20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcvdjMvaW5kZXguanNvbic6IFNpZ25hdHVy ZSBIYXNoIEFsZ29yaXRobTogU0hBMjU2DQpsb2cgIDogUGFja2FnZSAnTmV3dG9uc29mdC5Kc29u IDEzLjAuMycgZnJvbSBzb3VyY2UgJ2h0dHBzOi8vYXBpLm51Z2V0Lm9yZy92My9pbmRleC5qc29u JzogDQpsb2cgIDogU2lnbmF0dXJlIHR5cGU6IEF1dGhvcg0KaW5mbyA6IFBhY2thZ2UgJ05ld3Rv bnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcvdjMv aW5kZXguanNvbic6IFZlcmlmeWluZyB0aGUgYXV0aG9yIHByaW1hcnkgc2lnbmF0dXJlIHdpdGgg Y2VydGlmaWNhdGU6IA0KbG9nICA6IFBhY2thZ2UgJ05ld3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZy b20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcvdjMvaW5kZXguanNvbic6ICAgU3ViamVj dCBOYW1lOiBDTj1Kc29uLk5FVCAoLk5FVCBGb3VuZGF0aW9uKSwgTz1Kc29uLk5FVCAoLk5FVCBG b3VuZGF0aW9uKSwgTD1SZWRtb25kLCBTPVdhc2hpbmd0b24sIEM9VVMsIFNFUklBTE5VTUJFUj02 MDMgMzg5IDA2OCwganVyaXNkaWN0aW9uU3RhdGVPclByb3ZpbmNlTmFtZT1XYXNoaW5ndG9uLCBq dXJpc2RpY3Rpb25Db3VudHJ5TmFtZT1VUywgYnVzaW5lc3NDYXRlZ29yeT1Qcml2YXRlIE9yZ2Fu aXphdGlvbg0KaW5mbyA6IFBhY2thZ2UgJ05ld3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291 cmNlICdodHRwczovL2FwaS5udWdldC5vcmcvdjMvaW5kZXguanNvbic6ICAgU0hBMSBoYXNoOiA2 NjdFODc0MzhEOTM4MjRBODA0MkQxRTdDOTM0QkREN0Y1MTlDNDRFDQpsb2cgIDogUGFja2FnZSAn TmV3dG9uc29mdC5Kc29uIDEzLjAuMycgZnJvbSBzb3VyY2UgJ2h0dHBzOi8vYXBpLm51Z2V0Lm9y Zy92My9pbmRleC5qc29uJzogICBTSEEyNTYgaGFzaDogRDYwRjlBOUJEMzU4MjlDQ0Y0Njg0RDRC MUUwQjYyRUIzRDk4MkZDRDU1MTU5RjMzNzM0OEJCMThFQTI1QjhBNw0KaW5mbyA6IFBhY2thZ2Ug J05ld3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5v cmcvdjMvaW5kZXguanNvbic6ICAgSXNzdWVkIGJ5OiBDTj0uTkVUIEZvdW5kYXRpb24gUHJvamVj dHMgQ29kZSBTaWduaW5nIENBMiwgTz0uTkVUIEZvdW5kYXRpb24sIEM9VVMNCmxvZyAgOiBQYWNr YWdlICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4zJyBmcm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVn ZXQub3JnL3YzL2luZGV4Lmpzb24nOiAgIFZhbGlkIGZyb206IDgvMTMvMjAyMSAzOjAwOjAw4oCv QU0gdG8gMTAvMzAvMjAyNCAyOjU5OjU54oCvQU0NCndhcm4gOiBOVTMwNDI6IFBhY2thZ2UgJ05l d3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcv djMvaW5kZXguanNvbic6IFRoZSBmb2xsb3dpbmcgWC41MDkgcm9vdCBjZXJ0aWZpY2F0ZSBpcyB1 bnRydXN0ZWQgYmVjYXVzZSBpdCBpcyBub3QgcHJlc2VudCBpbiB0aGUgY2VydGlmaWNhdGUgYnVu ZGxlIGF0IC9ldGMvcGtpL2NhLXRydXN0L2V4dHJhY3RlZC9wZW0vb2Jqc2lnbi1jYS1idW5kbGUu cGVtLiAgRm9yIG1vcmUgaW5mb3JtYXRpb24sIHNlZSBkb2N1bWVudGF0aW9uIGZvciBOVTMwNDIu DQp3YXJuIDogICAgIFN1YmplY3Q6ICBDTj1EaWdpQ2VydCBDUyBSU0E0MDk2IFJvb3QgRzUsIE89 IkRpZ2lDZXJ0LCBJbmMuIiwgQz1VUw0Kd2FybiA6ICAgICBGaW5nZXJwcmludCAoU0hBLTI1Nik6 ICA3MzUzQjZENkMyRDZEQTQyNDc3NzNGM0YwN0QwNzVERUNCNTEzNDIxMkJFQUQwOTI4RUYxRjQ2 MTE1MjYwOTQxDQp3YXJuIDogICAgIENlcnRpZmljYXRlIChQRU0pOg0Kd2FybiA6IC0tLS0tQkVH SU4gQ0VSVElGSUNBVEUtLS0tLQ0Kd2FybiA6IE1JSUZaRENDQTB5Z0F3SUJBZ0lRQnM3aE1iNXRW Y2dIOThESCswVG1JREFOQmdrcWhraUc5dzBCQVF3RkFEQk0NCndhcm4gOiBNUXN3Q1FZRFZRUUdF d0pWVXpFWE1CVUdBMVVFQ2hNT1JHbG5hVU5sY25Rc0lFbHVZeTR4SkRBaUJnTlZCQU1UDQp3YXJu IDogRzBScFoybERaWEowSUVOVElGSlRRVFF3T1RZZ1VtOXZkQ0JITlRBZUZ3MHlNVEF4TVRVd01E QXdNREJhRncwMA0Kd2FybiA6IE5qQXhNVFF5TXpVNU5UbGFNRXd4Q3pBSkJnTlZCQVlUQWxWVE1S Y3dGUVlEVlFRS0V3NUVhV2RwUTJWeWRDd2cNCndhcm4gOiBTVzVqTGpFa01DSUdBMVVFQXhNYlJH bG5hVU5sY25RZ1ExTWdVbE5CTkRBNU5pQlNiMjkwSUVjMU1JSUNJakFODQp3YXJuIDogQmdrcWhr aUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBdGpOemdOaGlBM0FVTEJFY09WNThybnlEaGgz Kw0Kd2FybiA6IEppOU1KSzJMNm9OZnFidzlXL3dMbUV3Q1J6RHM0djdzNkRSYlpsNi9POWNzcGlY L2pGbXozK3JhZkNuWlJsQnkNCndhcm4gOiBDQjF1MFJzSzNSL05tWW42RHc5enhPR2NIWFV5elcr WDJpcHFsYkpzeVFuUTZndDdmUmNHU1pudjF0N2d5RlBVDQp3YXJuIDogcnNaMzhZYTdJeHk0d045 Wjk0NTkwZStDNWlhTFdqaTEvM1hWc3RsUENmTTNpRkRhRWFTS0ZCVFJVd1FBZmZOcQ0Kd2FybiA6 IFJCaitVSEF5Qnh5b21nNDZIY1VLSDI0TEptbTNQS0pYY0N5RytreHVsYWxZUTdtc0V0Yi9QKzNY UXhkclRNNmUNCndhcm4gOiB4SkNyLy9vUVVKcWprRmZXNTR3UXJwOFdHczgxSFgvWGR1MktuRFdu S0xpblhTSDhNRGZkM2dnWlR4WEc1NmJhDQp3YXJuIDoga0VlTzk1UlRUSTVUQXI3OW1lWHFodEN2 QXdMVG02cVQ4YXNvamlBQi8wejd6TGNwUVBXSHBCSVRCUjlEYnRkUg0Kd2FybiA6IFVKODR0Q0R0 RndrU2o4eTVHYStmemI1cEVkT3ZWUkJ0RjRaNWxsTEdzZ0NkNWE4NHNEWDBpR3VQRGdROWZPNnYN Cndhcm4gOiB6ZE5xRUVyR3pZYktJajJoU2x6N0R2K0kzMXhpcDhDNUh0bXNiSDQ0Ti81M2t5WENo WXBQdFRjR1dnYUJGUEhPDQp3YXJuIDogbEoyWmtlb3lXczVuUFc0RVpxME1UeTJqTHZlZTlYaWQ5 d3I5Zm8valFvcFZscnp4bnpjdC9KNWZsZjZNR0J2OA0Kd2FybiA6IGp2MUxrSy9YQTJnU1k2emlr NmVpeXdUbFQyVE9BL3JHRkovWmkrak0xR0tNYStRQUxCbWZHZ2JHTVlGVSsxTWsNCndhcm4gOiBt cTlWbWJxZGRhNjR3dDBDQXdFQUFhTkNNRUF3SFFZRFZSME9CQllFRkdnQms3SFNTa0JDYVpSR0xC eGFpS2tsDQp3YXJuIDogdEVkUE1BNEdBMVVkRHdFQi93UUVBd0lCaGpBUEJnTlZIUk1CQWY4RUJU QURBUUgvTUEwR0NTcUdTSWIzRFFFQg0Kd2FybiA6IERBVUFBNElDQVFDUy9PNjRBbmtYQWxGOUlj VkpaNmVrOGFna09Pc01hT3BhUW11YzlIUEJhVW90c3pjRlVFS1kNCndhcm4gOiBrcDRHZVN3dUJw bjI3OThyb00yemtnR0R0YURMSjdVOEl4cVlTYUxzTFptbFdVT3MwckdUMWxmWEhMeVQxc1pBDQp3 YXJuIDogNGJOdkdWVzNFOWZsUXpPa3Rhdkwyc0V4WkExMDFpenR3NDF1Njd1dkdVZGhZUzNBOUFX NWIzamNPdmRDUUdWVA0Kd2FybiA6IGtiMlpEWk9TVkthcE4xa3JtOHVaeHJ3OTl3U0U4SlF6SFEr Q1dqbkxMa1hES0JtanNwdVl5UHd4YTJDUDl1bUcNCndhcm4gOiBLTHpnUEgxMFhSYUpXMmtreHhD THhFdTdOay9VV1QvRHNLU1JtZmd1MFVvQm5mV0lFdSsvV2hGcVdVOVphMXBuDQp3YXJuIDogODQr MEV3L0EyQzg5S0hLcUdYOFJmV3BibjVYblg3ZVVUL0Urb1ZyL0xjeWQzeWQzanpKekhHY0tkdlA2 WExHLw0Kd2FybiA6IHZCMjlEQ2lic3NjWFp3c3pEOE85TnR6N3VrSUxxKzJFdzJMV2hCYXBzUWRy cVc3dXhzL21zRVFwd3ZDellZQXENCndhcm4gOiBpMi9TRkZ3bGgxUms4NlJNd2FINHAydnEvdW82 L0huYkRvL2N4dlBKMUd6ZTZZT2hqaDBpN01rNnNnQjczRHVuDQp3YXJuIDogUWhwLzNJdXBFVDJP cDhBZ2IxMEpYVU5FNW85bXpLbGJCL0h2bTNvT3MxVGhsUDBPTE1hVDExWDljWmcxdUFsSw0Kd2Fy biA6IC84WXBLQ3oyVWkzYkZCaVNKK0lXZm96SzFHRytnb2VSNjVnM1A3OWZYWGMvTkt3Yk9FT3Jh SEtaTWg0NkdobWwNCndhcm4gOiBvemhNSTllajU4elZLcElYa0F0YVM3MFd2ZnVHYXVLSm1lemtv RlVZeWFNSUh4UGdNZ2h5MEE9PQ0Kd2FybiA6IC0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCmVy cm9yOiBOVTMwMTg6IFBhY2thZ2UgJ05ld3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNl ICdodHRwczovL2FwaS5udWdldC5vcmcvdjMvaW5kZXguanNvbic6IFRoZSBhdXRob3IgcHJpbWFy eSBzaWduYXR1cmUncyBzaWduaW5nIGNlcnRpZmljYXRlIGlzIG5vdCB0cnVzdGVkIGJ5IHRoZSB0 cnVzdCBwcm92aWRlci4NCmluZm8gOiBQYWNrYWdlICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4zJyBm cm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL2luZGV4Lmpzb24nOiBUaW1lc3Rh bXA6IDMvOC8yMDIzIDEwOjA5OjU24oCvQU0NCmluZm8gOiBQYWNrYWdlICdOZXd0b25zb2Z0Lkpz b24gMTMuMC4zJyBmcm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL2luZGV4Lmpz b24nOiBWZXJpZnlpbmcgYXV0aG9yIHByaW1hcnkgc2lnbmF0dXJlJ3MgdGltZXN0YW1wIHdpdGgg dGltZXN0YW1waW5nIHNlcnZpY2UgY2VydGlmaWNhdGU6IA0KaW5mbyA6ICAgU3ViamVjdCBOYW1l OiBDTj1EaWdpQ2VydCBUaW1lc3RhbXAgMjAyMiAtIDIsIE89RGlnaUNlcnQsIEM9VVMNCmluZm8g OiAgIFNIQTEgaGFzaDogRjM4NzIyNEQ4NjMzODI5MjM1QTk5NEJDQkQ4Rjk2RTlGRTFDN0M3Mw0K aW5mbyA6ICAgU0hBMjU2IGhhc2g6IEM3RjRFMUJFMzIyODg5MjBBQkUyMjYzQUJFMUFDNEZDNEZF Njc4MUMyRDY0RDA0QzgwNzU1N0EwMjNCNUI2RkENCmluZm8gOiAgIElzc3VlZCBieTogQ049RGln aUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNIQTI1NiBUaW1lU3RhbXBpbmcgQ0EsIE89IkRpZ2lD ZXJ0LCBJbmMuIiwgQz1VUw0KaW5mbyA6ICAgVmFsaWQgZnJvbTogOS8yMS8yMDIyIDM6MDA6MDDi gK9BTSB0byAxMS8yMi8yMDMzIDI6NTk6NTnigK9BTQ0KbG9nICA6IFBhY2thZ2UgJ05ld3RvbnNv ZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcvdjMvaW5k ZXguanNvbic6IA0KbG9nICA6IFNpZ25hdHVyZSB0eXBlOiBSZXBvc2l0b3J5DQppbmZvIDogUGFj a2FnZSAnTmV3dG9uc29mdC5Kc29uIDEzLjAuMycgZnJvbSBzb3VyY2UgJ2h0dHBzOi8vYXBpLm51 Z2V0Lm9yZy92My9pbmRleC5qc29uJzogU2VydmljZSBpbmRleDogaHR0cHM6Ly9hcGkubnVnZXQu b3JnL3YzL2luZGV4Lmpzb24NCmluZm8gOiBQYWNrYWdlICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4z JyBmcm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL2luZGV4Lmpzb24nOiBPd25l cnM6IGRvdG5ldGZvdW5kYXRpb24sIGphbWVzbmssIG5ld3RvbnNvZnQNCmluZm8gOiBQYWNrYWdl ICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4zJyBmcm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQu b3JnL3YzL2luZGV4Lmpzb24nOiBWZXJpZnlpbmcgdGhlIHJlcG9zaXRvcnkgY291bnRlcnNpZ25h dHVyZSB3aXRoIGNlcnRpZmljYXRlOiANCmxvZyAgOiBQYWNrYWdlICdOZXd0b25zb2Z0Lkpzb24g MTMuMC4zJyBmcm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL2luZGV4Lmpzb24n OiAgIFN1YmplY3QgTmFtZTogQ049TnVHZXQub3JnIFJlcG9zaXRvcnkgYnkgTWljcm9zb2Z0LCBP PU51R2V0Lm9yZyBSZXBvc2l0b3J5IGJ5IE1pY3Jvc29mdCwgTD1SZWRtb25kLCBTPVdhc2hpbmd0 b24sIEM9VVMNCmluZm8gOiBQYWNrYWdlICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4zJyBmcm9tIHNv dXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL2luZGV4Lmpzb24nOiAgIFNIQTEgaGFzaDog NjhGQzM3Q0NDMjkzNzY2QTYwN0RCQzI2QTI2REYzNzFCMDI0OTMyOA0KbG9nICA6IFBhY2thZ2Ug J05ld3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5v cmcvdjMvaW5kZXguanNvbic6ICAgU0hBMjU2IGhhc2g6IDVBMjkwMUQ2QURBM0QxODI2MEI5QzZE RkUyMTMzQzk1RDc0QjlFRUY2QUUwRTVEQzMzNEM4NDU0RDE0NzdERjQNCmluZm8gOiBQYWNrYWdl ICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4zJyBmcm9tIHNvdXJjZSAnaHR0cHM6Ly9hcGkubnVnZXQu b3JnL3YzL2luZGV4Lmpzb24nOiAgIElzc3VlZCBieTogQ049RGlnaUNlcnQgU0hBMiBBc3N1cmVk IElEIENvZGUgU2lnbmluZyBDQSwgT1U9d3d3LmRpZ2ljZXJ0LmNvbSwgTz1EaWdpQ2VydCBJbmMs IEM9VVMNCmxvZyAgOiBQYWNrYWdlICdOZXd0b25zb2Z0Lkpzb24gMTMuMC4zJyBmcm9tIHNvdXJj ZSAnaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzL2luZGV4Lmpzb24nOiAgIFZhbGlkIGZyb206IDIv MTYvMjAyMSAzOjAwOjAw4oCvQU0gdG8gNS8xNi8yMDI0IDI6NTk6NTnigK9BTQ0Kd2FybiA6IE5V MzA0MjogUGFja2FnZSAnTmV3dG9uc29mdC5Kc29uIDEzLjAuMycgZnJvbSBzb3VyY2UgJ2h0dHBz Oi8vYXBpLm51Z2V0Lm9yZy92My9pbmRleC5qc29uJzogVGhlIGZvbGxvd2luZyBYLjUwOSByb290 IGNlcnRpZmljYXRlIGlzIHVudHJ1c3RlZCBiZWNhdXNlIGl0IGlzIG5vdCBwcmVzZW50IGluIHRo ZSBjZXJ0aWZpY2F0ZSBidW5kbGUgYXQgL2V0Yy9wa2kvY2EtdHJ1c3QvZXh0cmFjdGVkL3BlbS9v YmpzaWduLWNhLWJ1bmRsZS5wZW0uICBGb3IgbW9yZSBpbmZvcm1hdGlvbiwgc2VlIGRvY3VtZW50 YXRpb24gZm9yIE5VMzA0Mi4NCndhcm4gOiAgICAgU3ViamVjdDogIENOPURpZ2lDZXJ0IEFzc3Vy ZWQgSUQgUm9vdCBDQSwgT1U9d3d3LmRpZ2ljZXJ0LmNvbSwgTz1EaWdpQ2VydCBJbmMsIEM9VVMN Cndhcm4gOiAgICAgRmluZ2VycHJpbnQgKFNIQS0yNTYpOiAgM0U5MDk5QjUwMTVFOEY0ODZDMDBC Q0VBOUQxMTFFRTcyMUZBQkEzNTVBODlCQ0YxREY2OTU2MUUzREM2MzI1Qw0Kd2FybiA6ICAgICBD ZXJ0aWZpY2F0ZSAoUEVNKToNCndhcm4gOiAtLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0NCndh cm4gOiBNSUlEdHpDQ0FwK2dBd0lCQWdJUURPZmc1UmZZUnY2UDVXRDhHL0F3T1RBTkJna3Foa2lH OXcwQkFRVUZBREJsDQp3YXJuIDogTVFzd0NRWURWUVFHRXdKVlV6RVZNQk1HQTFVRUNoTU1SR2xu YVVObGNuUWdTVzVqTVJrd0Z3WURWUVFMRXhCMw0Kd2FybiA6IGQzY3VaR2xuYVdObGNuUXVZMjl0 TVNRd0lnWURWUVFERXh0RWFXZHBRMlZ5ZENCQmMzTjFjbVZrSUVsRUlGSnYNCndhcm4gOiBiM1Fn UTBFd0hoY05NRFl4TVRFd01EQXdNREF3V2hjTk16RXhNVEV3TURBd01EQXdXakJsTVFzd0NRWURW UVFHDQp3YXJuIDogRXdKVlV6RVZNQk1HQTFVRUNoTU1SR2xuYVVObGNuUWdTVzVqTVJrd0Z3WURW UVFMRXhCM2QzY3VaR2xuYVdObA0Kd2FybiA6IGNuUXVZMjl0TVNRd0lnWURWUVFERXh0RWFXZHBR MlZ5ZENCQmMzTjFjbVZrSUVsRUlGSnZiM1FnUTBFd2dnRWkNCndhcm4gOiBNQTBHQ1NxR1NJYjNE UUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUN0RGhYTzVFT0FYTEdIODdkZytYRVNwYTdjDQp3YXJu IDogSnBTSXF2VE85U0E1S0ZoZ0RQaUEycWtWbFRKaFBMV3hLSVNLaXR5ZkNneURGM3FQa0t5SzUz bFRYREdFS3ZZUA0Kd2FybiA6IG1ESTJkc3plM1R5b291OXEreUh5VW1IZm55RFhIK0t4MmY0WVpO SVNXMS81V0JnMXZFZk5vVGI1YTMvVXNEZysNCndhcm4gOiB3UnZEakRQWjJDOFkvaWdQczZlRDFz TnVSTUJoTlpZVy9sbWNpM1p0MS9HaVN3MHIvd3R5MnA1ZzBJNlFOY1o0DQp3YXJuIDogVlljZ29j L2xiUXJJU1h3eG1ETnNJdW1IMERKYW9yb1RnaEh0T1JlZG1UcHlvZWI2cE5uVkZ6RjFyb1Y5SXE0 Lw0Kd2FybiA6IEFVYUc5aWg1eUxIYTVGY1h4SDRjRHJDMGtxWldzNzJ5bCsycXAvQzN4YWcvbFJi US82R1c2d2hmR0hkUEFnTUINCndhcm4gOiBBQUdqWXpCaE1BNEdBMVVkRHdFQi93UUVBd0lCaGpB UEJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1FXDQp3YXJuIDogQkJSRjY2S3Y5SkxMZ2pF dFVZdW5weUdkODIzSUR6QWZCZ05WSFNNRUdEQVdnQlJGNjZLdjlKTExnakV0VVl1bg0Kd2FybiA6 IHB5R2Q4MjNJRHpBTkJna3Foa2lHOXcwQkFRVUZBQU9DQVFFQW9nNjgzK0x0OE9OeWMzcGtsTC8z Y21iWU11UkMNCndhcm4gOiBkV0t1aCt2eTFkbmVWck9mek00VUtMa05sMkJjRWt4WTVOTTlnMGxG V0pjMWFScW9SK3BXeG5tckV0aG5nWVRmDQp3YXJuIDogZndrOGxPYTRKaXdndlQyektJbjNYLzhp NHBlRUgrbGw3NGZnMzhGblNiTmQ2N0lKS3VzbTdYaStmVDhyODdjbQ0Kd2FybiA6IE5XMWZpUUcy U1Z1ZkFRV2JxejBsd2N5MmY4THhiNGJHK21SbzY0RXRsT3RDdC9xTUh0MWk4YjVRWjdkc3ZmUHgN Cndhcm4gOiBIMnNNTmdjV2Z6ZDhxVnR0ZXZFU1JtQ0QxeWNFdmt2T2w3N0RaeXBvRWQrQTV3d3pa cjhURFJSdTgzOGZZeEFlDQp3YXJuIDogK28wYkpXMXNqNlczWVFHeDBxTW1vUkJ4bmEzaXcvbkRt VkczS3djSXppN21VTEtuK2dwRkw2THc4Zz09DQp3YXJuIDogLS0tLS1FTkQgQ0VSVElGSUNBVEUt LS0tLQ0KZXJyb3I6IE5VMzAxODogUGFja2FnZSAnTmV3dG9uc29mdC5Kc29uIDEzLjAuMycgZnJv bSBzb3VyY2UgJ2h0dHBzOi8vYXBpLm51Z2V0Lm9yZy92My9pbmRleC5qc29uJzogVGhlIHJlcG9z aXRvcnkgY291bnRlcnNpZ25hdHVyZSdzIHNpZ25pbmcgY2VydGlmaWNhdGUgaXMgbm90IHRydXN0 ZWQgYnkgdGhlIHRydXN0IHByb3ZpZGVyLg0KaW5mbyA6IFBhY2thZ2UgJ05ld3RvbnNvZnQuSnNv biAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcvdjMvaW5kZXguanNv bic6IFRpbWVzdGFtcDogMy84LzIwMjMgMTA6NDM6MjLigK9BTQ0KaW5mbyA6IFBhY2thZ2UgJ05l d3RvbnNvZnQuSnNvbiAxMy4wLjMnIGZyb20gc291cmNlICdodHRwczovL2FwaS5udWdldC5vcmcv djMvaW5kZXguanNvbic6IFZlcmlmeWluZyByZXBvc2l0b3J5IGNvdW50ZXJzaWduYXR1cmUncyB0 aW1lc3RhbXAgd2l0aCB0aW1lc3RhbXBpbmcgc2VydmljZSBjZXJ0aWZpY2F0ZTogDQppbmZvIDog ICBTdWJqZWN0IE5hbWU6IENOPURpZ2lDZXJ0IFRpbWVzdGFtcCAyMDIyIC0gMiwgTz1EaWdpQ2Vy dCwgQz1VUw0KaW5mbyA6ICAgU0hBMSBoYXNoOiBGMzg3MjI0RDg2MzM4MjkyMzVBOTk0QkNCRDhG OTZFOUZFMUM3QzczDQppbmZvIDogICBTSEEyNTYgaGFzaDogQzdGNEUxQkUzMjI4ODkyMEFCRTIy NjNBQkUxQUM0RkM0RkU2NzgxQzJENjREMDRDODA3NTU3QTAyM0I1QjZGQQ0KaW5mbyA6ICAgSXNz dWVkIGJ5OiBDTj1EaWdpQ2VydCBUcnVzdGVkIEc0IFJTQTQwOTYgU0hBMjU2IFRpbWVTdGFtcGlu ZyBDQSwgTz0iRGlnaUNlcnQsIEluYy4iLCBDPVVTDQppbmZvIDogICBWYWxpZCBmcm9tOiA5LzIx LzIwMjIgMzowMDowMOKAr0FNIHRvIDExLzIyLzIwMzMgMjo1OTo1OeKAr0FNDQppbmZvIDogICBD QUNIRSBodHRwczovL2FwaS5udWdldC5vcmcvdjMvdnVsbmVyYWJpbGl0aWVzL2luZGV4Lmpzb24N CmluZm8gOiAgIENBQ0hFIGh0dHBzOi8vYXBpLm51Z2V0Lm9yZy92My12dWxuZXJhYmlsaXRpZXMv MjAyNC4wMi4yOS4wNS4yOC4yNy92dWxuZXJhYmlsaXR5LmJhc2UuanNvbg0KaW5mbyA6ICAgQ0FD SEUgaHR0cHM6Ly9hcGkubnVnZXQub3JnL3YzLXZ1bG5lcmFiaWxpdGllcy8yMDI0LjAyLjI5LjA1 LjI4LjI3LzIwMjQuMDIuMjkuMDUuMjguMjcvdnVsbmVyYWJpbGl0eS51cGRhdGUuanNvbg0KaW5m byA6IFBhY2thZ2UgJ05ld3RvbnNvZnQuSnNvbicgaXMgY29tcGF0aWJsZSB3aXRoIGFsbCB0aGUg c3BlY2lmaWVkIGZyYW1ld29ya3MgaW4gcHJvamVjdCAnL3RtcC8ucHJpdmF0ZS9yb290LzRNWUZE QXc1M3Avd2ViYXBwL3dlYmFwcC5jc3Byb2onLg0KZXJyb3I6IFZhbHVlIGNhbm5vdCBiZSBudWxs LiAoUGFyYW1ldGVyICdwYXRoMScpDQoNCg0KVXNhZ2U6IE51R2V0LkNvbW1hbmRMaW5lLlhQbGF0 LmRsbCBwYWNrYWdlIGFkZCBbb3B0aW9uc10NCg0KT3B0aW9uczoNCiAgLWh8LS1oZWxwICAgICAg ICAgICAgICAgU2hvdyBoZWxwIGluZm9ybWF0aW9uDQogIC0tZm9yY2UtZW5nbGlzaC1vdXRwdXQg IEZvcmNlcyB0aGUgYXBwbGljYXRpb24gdG8gcnVuIHVzaW5nIGFuIGludmFyaWFudCwgRW5nbGlz aC1iYXNlZCBjdWx0dXJlLg0KICAtLXBhY2thZ2UgICAgICAgICAgICAgICBJZCBvZiB0aGUgcGFj a2FnZSB0byBiZSBhZGRlZC4NCiAgLS12ZXJzaW9uICAgICAgICAgICAgICAgVmVyc2lvbiBvZiB0 aGUgcGFja2FnZSB0byBiZSBhZGRlZC4NCiAgLWR8LS1kZy1maWxlICAgICAgICAgICAgUGF0aCB0 byB0aGUgZGVwZW5kZW5jeSBncmFwaCBmaWxlIHRvIGJlIHVzZWQgdG8gcmVzdG9yZSBwcmV2aWV3 IGFuZCBjb21wYXRpYmlsaXR5IGNoZWNrLg0KICAtcHwtLXByb2plY3QgICAgICAgICAgICBQYXRo IHRvIHRoZSBwcm9qZWN0IGZpbGUuDQogIC1mfC0tZnJhbWV3b3JrICAgICAgICAgIEZyYW1ld29y a3MgZm9yIHdoaWNoIHRoZSBwYWNrYWdlIHJlZmVyZW5jZSBzaG91bGQgYmUgYWRkZWQuDQogIC1u fC0tbm8tcmVzdG9yZSAgICAgICAgIERvIG5vdCBwZXJmb3JtIHJlc3RvcmUgcHJldmlldyBhbmQg Y29tcGF0aWJpbGl0eSBjaGVjay4gVGhlIGFkZGVkIHBhY2thZ2UgcmVmZXJlbmNlIHdpbGwgYmUg dW5jb25kaXRpb25hbC4NCiAgLXN8LS1zb3VyY2UgICAgICAgICAgICAgU3BlY2lmaWVzIE51R2V0 IHBhY2thZ2Ugc291cmNlcyB0byB1c2UgZHVyaW5nIHRoZSByZXN0b3JlLg0KICAtLXBhY2thZ2Ut ZGlyZWN0b3J5ICAgICBEaXJlY3RvcnkgdG8gcmVzdG9yZSBwYWNrYWdlcyBpbi4NCiAgLS1pbnRl cmFjdGl2ZSAgICAgICAgICAgQWxsb3cgdGhlIGNvbW1hbmQgdG8gYmxvY2sgYW5kIHJlcXVpcmUg bWFudWFsIGFjdGlvbiBmb3Igb3BlcmF0aW9ucyBsaWtlIGF1dGhlbnRpY2F0aW9uLg0KICAtLXBy ZXJlbGVhc2UgICAgICAgICAgICBBbGxvd3MgcHJlcmVsZWFzZSBwYWNrYWdlcyB0byBiZSBpbnN0 YWxsZWQu