net-sftp 4.0.0 → 4.1.0

data/lib/net/sftp/operations/upload.rb

@@ -1,3 +1,4 @@
+require 'pathname'
 require 'net/ssh/loggable'
 
 module Net; module SFTP; module Operations
@@ -50,9 +51,20 @@ module Net; module SFTP; module Operations
   #   higher might improve throughput. Reducing it will reduce throughput.
   # * <tt>:read_size</tt> - the maximum number of bytes to read at a time
   #   from the source. Increasing this value might improve throughput. It
-  #   defaults to 32,000 bytes.
+  #   defaults to 32,000 bytes. Each chunk is sent as one write request, so
+  #   it must stay within the server's packet limit (OpenSSH drops the
+  #   connection on packets over 256 KiB).
   # * <tt>:name</tt> - the filename to report to the progress monitor when
   #   an IO object is given as +local+. This defaults to "<memory>".
+  # * <tt>:preserve</tt> - if true, the remote files and directories get the
+  #   access and modification times of the local ones, and their permissions
+  #   are set even on files that already exist remotely.
+  #
+  # Like OpenSSH's sftp client, new remote files and directories are created
+  # with the permissions of the local ones, without setuid, setgid and sticky
+  # bits and subject to the server's umask. Nothing is set when +local+ is an
+  # IO object. If the server refuses to set the attributes after the data has
+  # been written, a warning is logged and the upload still succeeds.
   #
   # == Progress Monitoring
   #
@@ -141,6 +153,9 @@ module Net; module SFTP; module Operations
     # This will return immediately, and requires that the SSH event loop be
     # run in order to effect the upload. (See #wait.)
     def initialize(sftp, local, remote, options={}, &progress) #:nodoc:
+      local = local.to_path if local.is_a?(Pathname)
+      remote = remote.to_path if remote.is_a?(Pathname)
+
       @sftp = sftp
       @local = local
       @remote = remote
@@ -148,11 +163,14 @@ module Net; module SFTP; module Operations
       @options = options
       @properties = options[:properties] || {}
       @active = 0
+      @directories = []
 
       self.logger = sftp.logger
 
       @uploads = []
       @recursive = local.respond_to?(:read) ? false : ::File.directory?(local)
+      requests
+      read_size
 
       if recursive?
         @stack = [entries_for(local)]
@@ -161,10 +179,10 @@ module Net; module SFTP; module Operations
 
         @active += 1
         if @options[:mkdir]
-          sftp.mkdir(remote) do |response|
+          sftp.mkdir(remote, directory_attributes(local, remote)) do |response|
             @active -= 1
             raise StatusException.new(response, "mkdir `#{remote}'") unless response.ok?
-            (options[:requests] || RECURSIVE_READERS).to_i.times do
+            requests.times do
               break unless process_next_entry
             end
           end
@@ -225,9 +243,28 @@ module Net; module SFTP; module Operations
       # The progress handler for this instance. Possibly nil.
       def progress; @progress; end
 
+      def requests
+        @requests ||= positive_option(:requests, recursive? ? RECURSIVE_READERS : SINGLE_FILE_READERS)
+      end
+
+      def read_size
+        @read_size ||= positive_option(:read_size, DEFAULT_READ_SIZE)
+      end
+
+      def positive_option(name, default)
+        value = (options[name] || default).to_i
+        raise ArgumentError, ":#{name} must be positive" unless value > 0
+
+        value
+      end
+
+      def preserve?
+        options[:preserve]
+      end
+
       # A simple struct for recording metadata about the file currently being
       # uploaded.
-      LiveFile = Struct.new(:local, :remote, :io, :size, :handle)
+      LiveFile = Struct.new(:local, :remote, :io, :size, :handle, :attributes)
 
       # The default # of bytes to read from disk at a time.
       DEFAULT_READ_SIZE   = 32_000
@@ -245,7 +282,11 @@ module Net; module SFTP; module Operations
           if @uploads.any?
             write_next_chunk(@uploads.first)
           elsif !active?
-            update_progress(:finish)
+            if @directories.any?
+              set_directory_attributes
+            else
+              update_progress(:finish)
+            end
           end
           return false
         elsif @stack.last.empty?
@@ -265,7 +306,7 @@ module Net; module SFTP; module Operations
 
             @active += 1
             update_progress(:mkdir, rpath)
-            request = sftp.mkdir(rpath, &method(:on_mkdir))
+            request = sftp.mkdir(rpath, directory_attributes(lpath, rpath), &method(:on_mkdir))
             request[:dir] = rpath
           else
             open_file(lpath, rpath)
@@ -294,10 +335,11 @@ module Net; module SFTP; module Operations
           size = file.size
         end
 
-        metafile = LiveFile.new(name, remote, file, size)
+        attributes = local.respond_to?(:read) ? {} : attributes_for(file.stat)
+        metafile = LiveFile.new(name, remote, file, size, nil, attributes)
         update_progress(:open, metafile)
 
-        request = sftp.open(remote, "w", &method(:on_open))
+        request = sftp.open(remote, "w", attributes, &method(:on_open))
         request[:file] = metafile
       end
 
@@ -326,7 +368,7 @@ module Net; module SFTP; module Operations
         write_next_chunk(file)
 
         if !recursive?
-          (options[:requests] || SINGLE_FILE_READERS).to_i.times { write_next_chunk(file) }
+          (requests - 1).times { write_next_chunk(file) }
         end
       end
 
@@ -350,6 +392,49 @@ module Net; module SFTP; module Operations
         process_next_entry
       end
 
+      # setuid, setgid and sticky bits are never sent, matching OpenSSH.
+      def attributes_for(stat)
+        attributes = { :permissions => stat.mode & 0777 }
+        attributes.update(:atime => stat.atime.to_i, :mtime => stat.mtime.to_i) if preserve?
+        attributes
+      end
+
+      # The directory is created writable and searchable by its owner so its
+      # contents can be uploaded; its real attributes are set once everything
+      # else is done (see #set_directory_attributes).
+      def directory_attributes(local, remote)
+        stat = ::File.stat(local)
+        @directories << [remote, attributes_for(stat)]
+        { :permissions => (stat.mode & 0777) | 0300 }
+      end
+
+      # Deepest directories first; setting attributes on a directory doesn't
+      # change its parent's modification time.
+      def set_directory_attributes
+        @directories.reverse_each do |path, attributes|
+          @active += 1
+          sftp.setstat(path, attributes) do |response|
+            @active -= 1
+            warn_unless_ok(response, "setstat #{path}")
+            process_next_entry
+          end
+        end
+        @directories.clear
+      end
+
+      # Called when the +fsetstat+ for :preserve finishes.
+      def on_fsetstat(response)
+        @active -= 1
+        file = response.request[:file]
+        warn_unless_ok(response, "fsetstat #{file.remote}")
+      end
+
+      # Like OpenSSH's sftp client, failing to set attributes only warns; the
+      # data has already been transferred.
+      def warn_unless_ok(response, operation)
+        lwarn { "#{operation} failed: #{response}" } unless response.ok?
+      end
+
       # Attempts to send the next chunk from the given file (where +file+ is
       # a LiveFile instance).
       def write_next_chunk(file)
@@ -358,12 +443,18 @@ module Net; module SFTP; module Operations
         else
           @active += 1
           offset = file.io.pos
-          data = file.io.read(options[:read_size] || DEFAULT_READ_SIZE)
+          data = file.io.read(read_size)
           if data.nil?
             update_progress(:close, file)
+            if preserve? && file.attributes.any?
+              @active += 1
+              request = sftp.fsetstat(file.handle, file.attributes, &method(:on_fsetstat))
+              request[:file] = file
+            end
             request = sftp.close(file.handle, &method(:on_close))
             request[:file] = file
-            file.io.close
+            # An IO passed in by the caller is theirs to close.
+            file.io.close unless file.io.equal?(local)
             file.io = nil
             @uploads.delete(file)
           else

data/lib/net/sftp/protocol/01/attributes.rb

@@ -1,4 +1,5 @@
 require 'net/ssh/buffer'
+require 'net/sftp/protocol/bounded_read'
 
 module Net; module SFTP; module Protocol; module V01
 
@@ -39,6 +40,8 @@ module Net; module SFTP; module Protocol; module V01
     T_BLOCK_DEVICE = 8
     T_FIFO         = 9
 
+    extend Net::SFTP::Protocol::BoundedRead
+
     class <<self
       # Returns the array of attribute meta-data that defines the structure of
       # the attributes packet as described by this version of the protocol.
@@ -106,7 +109,8 @@ module Net; module SFTP; module Protocol; module V01
         # Parse the hash of extended data from the buffer.
         def parse_extended(buffer)
           extended = Hash.new
-          buffer.read_long.times do
+          # Each pair is two strings, at least 8 bytes.
+          read_bounded_count!(buffer, 8, "extended attribute").times do
             extended[buffer.read_string] = buffer.read_string
           end
           extended
@@ -150,7 +154,7 @@ module Net; module SFTP; module Protocol; module V01
     # * :mtime:: the modification time of the file (integer, seconds since epoch)
     # * :extended:: a hash of name/value pairs identifying extended info
     def initialize(attributes={})
-      @attributes = attributes
+      @attributes = attributes.dup
     end
 
     # Returns the user-id of the user that owns the file, or +nil+ if that

data/lib/net/sftp/protocol/01/base.rb

@@ -54,7 +54,8 @@ module Net; module SFTP; module Protocol; module V01
     def parse_name_packet(packet)
       names = []
 
-      packet.read_long.times do
+      # Each entry is two strings and the attribute flags, at least 12 bytes.
+      read_bounded_count!(packet, 12, "name").times do
         filename = packet.read_string
         longname = packet.read_string
         attrs    = attribute_factory.from_buffer(packet)

data/lib/net/sftp/protocol/01/name.rb

@@ -5,7 +5,7 @@ module Net; module SFTP; module Protocol; module V01
   # for use when displaying directory data, and has no specified format.
   class Name
     # The name of the item on the remote server.
-    attr_reader :name
+    attr_accessor :name
 
     # The display-ready name of the item, possibly with other attributes.
     attr_reader :longname

data/lib/net/sftp/protocol/03/base.rb

@@ -18,6 +18,16 @@ module Net; module SFTP; module Protocol; module V03
       3
     end
 
+    # Version 3 adds a message and language tag to status responses.
+    def parse_status_packet(packet)
+      data = super
+      unless packet.eof?
+        data[:message] = packet.read_string
+        data[:language] = packet.read_string
+      end
+      data
+    end
+
     # Sends a FXP_READLINK packet to the server to request that the target of
     # the given symlink on the remote host (+path+) be returned.
     def readlink(path)
@@ -32,4 +42,4 @@ module Net; module SFTP; module Protocol; module V03
 
   end
 
-end; end; end; end
+end; end; end; end

data/lib/net/sftp/protocol/04/attributes.rb

@@ -69,7 +69,8 @@ module Net; module SFTP; module Protocol; module V04
         def parse_acl(buffer)
           acl_buf = Net::SSH::Buffer.new(buffer.read_string)
           acl = []
-          acl_buf.read_long.times do
+          # Each entry is three longs and a string, at least 16 bytes.
+          read_bounded_count!(acl_buf, 16, "ACL").times do
             acl << ACL.new(acl_buf.read_long, acl_buf.read_long, acl_buf.read_long, acl_buf.read_string)
           end
           acl
@@ -123,7 +124,7 @@ module Net; module SFTP; module Protocol; module V04
     # to T_REGULAR.
     def initialize(attributes={})
       super
-      attributes[:type] ||= T_REGULAR
+      self.type ||= T_REGULAR
     end
 
     private
@@ -134,6 +135,15 @@ module Net; module SFTP; module Protocol; module V04
         # were given on instantiation
         owner
         group
+
+        # The subsecond flag applies to every timestamp present in the packet.
+        subseconds = self.class.elements.select { |_name, _type, flags| flags & F_SUBSECOND_TIMES != 0 }
+        if subseconds.any? { |name, _type, _flags| attributes[name] }
+          subseconds.each do |name, _type, _flags|
+            seconds = name.to_s.sub(/_nseconds\z/, "").to_sym
+            attributes[name] ||= 0 if attributes[seconds]
+          end
+        end
       end
 
       # Performs protocol-version-specific encoding of the access control

data/lib/net/sftp/protocol/04/base.rb

@@ -28,7 +28,8 @@ module Net; module SFTP; module Protocol; module V04
     def parse_name_packet(packet)
       names = []
 
-      packet.read_long.times do
+      # Each entry is a string, the attribute flags and the type, at least 9 bytes.
+      read_bounded_count!(packet, 9, "name").times do
         filename = packet.read_string
         attrs    = attribute_factory.from_buffer(packet)
         names   << name_factory.new(filename, attrs)

data/lib/net/sftp/protocol/04/name.rb

@@ -9,7 +9,7 @@ module Net; module SFTP; module Protocol; module V04
   # a directory listing.
   class Name
     # The name of the item on the remote server.
-    attr_reader :name
+    attr_accessor :name
 
     # Attributes instance describing this item.
     attr_reader :attributes
@@ -44,24 +44,33 @@ module Net; module SFTP; module Protocol; module V04
           "l"
         else
           "-"
-        end
+        end.dup
 
-        longname << (attributes.permissions & 0400 != 0 ? "r" : "-")
-        longname << (attributes.permissions & 0200 != 0 ? "w" : "-")
-        longname << (attributes.permissions & 0100 != 0 ? "x" : "-")
-        longname << (attributes.permissions & 0040 != 0 ? "r" : "-")
-        longname << (attributes.permissions & 0020 != 0 ? "w" : "-")
-        longname << (attributes.permissions & 0010 != 0 ? "x" : "-")
-        longname << (attributes.permissions & 0004 != 0 ? "r" : "-")
-        longname << (attributes.permissions & 0002 != 0 ? "w" : "-")
-        longname << (attributes.permissions & 0001 != 0 ? "x" : "-")
+        # Fields the server omitted are shown as "?", like GNU ls -l does for entries it cannot stat.
+        if (permissions = attributes.permissions)
+          longname << (permissions & 0400 != 0 ? "r" : "-")
+          longname << (permissions & 0200 != 0 ? "w" : "-")
+          longname << (permissions & 0100 != 0 ? "x" : "-")
+          longname << (permissions & 0040 != 0 ? "r" : "-")
+          longname << (permissions & 0020 != 0 ? "w" : "-")
+          longname << (permissions & 0010 != 0 ? "x" : "-")
+          longname << (permissions & 0004 != 0 ? "r" : "-")
+          longname << (permissions & 0002 != 0 ? "w" : "-")
+          longname << (permissions & 0001 != 0 ? "x" : "-")
+        else
+          longname << "?" * 9
+        end
 
-        longname << (" %-8s %-8s %8d " % [attributes.owner, attributes.group, attributes.size])
+        longname << (" %-8s %-8s %8s " % [attributes.owner || "?", attributes.group || "?", attributes.size || "?"])
 
-        longname << Time.at(attributes.mtime).strftime("%b %e %H:%M ")
+        longname << if attributes.mtime
+          Time.at(attributes.mtime).strftime("%b %e %H:%M ")
+        else
+          "%12s " % "?"
+        end
         longname << name
       end
     end
   end
 
-end; end; end; end
+end; end; end; end

data/lib/net/sftp/protocol/05/base.rb

@@ -35,25 +35,28 @@ module Net; module SFTP; module Protocol; module V05
     def open(path, flags, options)
       flags = normalize_open_flags(flags)
 
-      sftp_flags, desired_access = if flags & (IO::WRONLY | IO::RDWR) != 0
-          open = if flags & (IO::CREAT | IO::EXCL) == (IO::CREAT | IO::EXCL)
+      sftp_flags = if flags & (IO::CREAT | IO::EXCL) == (IO::CREAT | IO::EXCL)
             FV5::CREATE_NEW
           elsif flags & (IO::CREAT | IO::TRUNC) == (IO::CREAT | IO::TRUNC)
             FV5::CREATE_TRUNCATE
           elsif flags & IO::CREAT == IO::CREAT
             FV5::OPEN_OR_CREATE
+          elsif flags & IO::TRUNC == IO::TRUNC
+            FV5::TRUNCATE_EXISTING
           else
             FV5::OPEN_EXISTING
           end
+
+      desired_access = if flags & (IO::WRONLY | IO::RDWR) != 0
           access = ACE::Mask::WRITE_DATA | ACE::Mask::WRITE_ATTRIBUTES
           access |= ACE::Mask::READ_DATA | ACE::Mask::READ_ATTRIBUTES if (flags & IO::RDWR) == IO::RDWR
           if flags & IO::APPEND == IO::APPEND
-            open |= FV5::APPEND_DATA
+            sftp_flags |= FV5::APPEND_DATA
             access |= ACE::Mask::APPEND_DATA
           end
-          [open, access]
+          access
         else
-          [FV5::OPEN_EXISTING, ACE::Mask::READ_DATA | ACE::Mask::READ_ATTRIBUTES]
+          ACE::Mask::READ_DATA | ACE::Mask::READ_ATTRIBUTES
         end
 
       attributes = attribute_factory.new(options)
@@ -63,4 +66,4 @@ module Net; module SFTP; module Protocol; module V05
 
   end
 
-end; end; end; end
+end; end; end; end

data/lib/net/sftp/protocol/base.rb

@@ -1,5 +1,6 @@
 require 'net/ssh/loggable'
 require 'net/sftp/constants'
+require 'net/sftp/protocol/bounded_read'
 
 module Net; module SFTP; module Protocol
 
@@ -10,6 +11,7 @@ module Net; module SFTP; module Protocol
     include Net::SSH::Loggable
     include Net::SFTP::Constants
     include Net::SFTP::Constants::PacketTypes
+    include Net::SFTP::Protocol::BoundedRead
 
     # The SFTP session object that acts as client to this protocol instance
     attr_reader :session
@@ -19,6 +21,7 @@ module Net; module SFTP; module Protocol
       @session = session
       self.logger = session.logger
       @request_id_counter = -1
+      @request_ids_wrapped = false
     end
 
     # Attept to parse the given packet. If the packet is of an unsupported
@@ -41,10 +44,15 @@ module Net; module SFTP; module Protocol
       # A new request identifier will be allocated to this request, and will
       # be returned.
       def send_request(type, *args)
-        @request_id_counter += 1
+        begin
+          previous_request_id = @request_id_counter
+          @request_id_counter = (@request_id_counter + 1) & 0xffffffff
+          @request_ids_wrapped = true if previous_request_id == 0xffffffff
+        end while @request_ids_wrapped && session.pending_requests.key?(@request_id_counter)
+
         session.send_packet(type, :long, @request_id_counter, *args)
         return @request_id_counter
       end
   end
 
-end; end; end
+end; end; end

data/lib/net/sftp/protocol/bounded_read.rb

@@ -0,0 +1,25 @@
+require 'net/sftp/errors'
+
+module Net; module SFTP; module Protocol
+
+  # Several SFTP structures are a 32-bit item count followed by that many
+  # items. Net::SSH::Buffer returns nil instead of raising when a read runs
+  # past the end of the data, so a loop over an unchecked count from the
+  # server keeps allocating long after the packet is exhausted.
+  module BoundedRead
+    # Reads an item count from +buffer+ and raises Net::SFTP::Exception if it
+    # is missing, or larger than the remaining bytes could hold given that
+    # each item takes at least +min_item_size+ bytes.
+    def read_bounded_count!(buffer, min_item_size, what)
+      count = buffer.read_long
+      raise Net::SFTP::Exception, "truncated packet: missing #{what} count" if count.nil?
+
+      if count > buffer.available / min_item_size
+        raise Net::SFTP::Exception, "server sent #{count} #{what} entries in only #{buffer.available} bytes"
+      end
+
+      count
+    end
+  end
+
+end; end; end

data/lib/net/sftp/session.rb

@@ -68,6 +68,10 @@ module Net; module SFTP
     # the server has not yet responded to will be represented here.
     attr_reader :pending_requests
 
+    # The extensions the server advertised in its FXP_VERSION packet, as a
+    # hash of name => data (e.g. "posix-rename@openssh.com" => "1").
+    attr_reader :extensions
+
     # Creates a new Net::SFTP instance atop the given Net::SSH connection.
     # This will return immediately, before the SFTP connection has been properly
     # initialized. Once the connection is ready, the given block will be called.
@@ -81,6 +85,7 @@ module Net; module SFTP
       @input      = Net::SSH::Buffer.new
       self.logger = session.logger
       @state      = :closed
+      @extensions = {}
       @pending_requests = {}
 
       connect(&block)
@@ -269,6 +274,10 @@ module Net; module SFTP
       # Request object. If a block is given, it will be invoked when the
       # server responds.
       #
+      # +data+ is sent as a single request, so it must stay within the
+      # server's packet limit (OpenSSH drops the connection on packets over
+      # 256 KiB). Net::SFTP::Operations::File#write splits large data for you.
+      #
       #   request = sftp.write(handle, 0, "hello, world!\n")
       #   request.wait
       def write(handle, offset, data, &callback)
@@ -772,6 +781,7 @@ module Net; module SFTP
         when :closed
           @state = :opening
           @channel = session.open_channel(&method(:when_channel_confirmed))
+          @input = Net::SSH::Buffer.new
           @packet_length = nil
           @protocol = nil
           @on_ready = Array(block)
@@ -919,19 +929,27 @@ module Net; module SFTP
       # version negotiation, instantiating the appropriate Protocol instance
       # and invoking the callback given to #connect, if any.
       def do_version(packet)
+        # Negotiation happens once. A later FXP_VERSION would swap the protocol
+        # driver and drop every pending request.
+        unless state == :init
+          raise Net::SFTP::Exception, "unexpected FXP_VERSION packet while session is #{state}"
+        end
+
         debug { "negotiating sftp protocol version, mine is #{HIGHEST_PROTOCOL_VERSION_SUPPORTED}" }
 
         server_version = packet.read_long
         debug { "server reports sftp version #{server_version}" }
 
-        negotiated_version = [server_version, HIGHEST_PROTOCOL_VERSION_SUPPORTED].min
+        # Servers reply with their own version whatever we offered (OpenSSH
+        # always says 3), so cap at the version we offered as well.
+        negotiated_version = [server_version, @version, HIGHEST_PROTOCOL_VERSION_SUPPORTED].compact.min
         info { "negotiated version is #{negotiated_version}" }
 
-        extensions = {}
+        @extensions = {}
         until packet.eof?
           name = packet.read_string
           data = packet.read_string
-          extensions[name] = data
+          @extensions[name] = data
         end
 
         @protocol = Protocol.load(self, negotiated_version)

data/lib/net/sftp/version.rb

@@ -49,7 +49,7 @@ module Net
       MAJOR = 4
 
       # The minor component of this version of the Net::SFTP library
-      MINOR = 0
+      MINOR = 1
 
       # The tiny component of this version of the Net::SFTP library
       TINY  = 0

data/lib/net/sftp.rb

@@ -34,18 +34,24 @@ module Net
     #   set the SFTP protocol version to be used)
     def self.start(host, user, ssh_options={}, sftp_options={}, &block)
       session = Net::SSH.start(host, user, ssh_options)
-      # We only use a single option here, but this leaves room for more later
-      # without breaking the external API.
-      version = sftp_options.fetch(:version, nil)
-      sftp = Net::SFTP::Session.new(session, version, &block).connect!
+      begin
+        # We only use a single option here, but this leaves room for more later
+        # without breaking the external API.
+        version = sftp_options.fetch(:version, nil)
+        sftp = Net::SFTP::Session.new(session, version, &block).connect!
 
-      if block_given?
-        sftp.loop
-        session.close
-        return nil
-      end
+        if block_given?
+          sftp.loop
+          return nil
+        end
 
-      sftp
+        sftp
+      rescue Object
+        failed = true
+        raise
+      ensure
+        session.close if block_given? && !failed
+      end
     rescue Object => anything
       begin
         session.shutdown!

data/net-sftp-public_cert.pem

@@ -1,20 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIIDQDCCAiigAwIBAgIBATANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDDBpuZXRz
-c2gvREM9c29sdXRpb3VzL0RDPWNvbTAeFw0yMjA5MjIxMTUwMDJaFw0yMzA5MjIx
-MTUwMDJaMCUxIzAhBgNVBAMMGm5ldHNzaC9EQz1zb2x1dGlvdXMvREM9Y29tMIIB
-IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxieE22fR/qmdPKUHyYTyUx2g
-wskLwrCkxay+Tvc97ZZUOwf85LDDDPqhQaTWLvRwnIOMgQE2nBPzwalVclK6a+pW
-x/18KDeZY15vm3Qn5p42b0wi9hUxOqPm3J2hdCLCcgtENgdX21nVzejn39WVqFJO
-lntgSDNW5+kCS8QaRsmIbzj17GKKkrsw39kiQw7FhWfJFeTjddzoZiWwc59KA/Bx
-fBbmDnsMLAtAtauMOxORrbx3EOY7sHku/kSrMg3FXFay7jc6BkbbUij+MjJ/k82l
-4o8o0YO4BAnya90xgEmgOG0LCCxRhuXQFnMDuDjK2XnUe0h4/6NCn94C+z9GsQID
-AQABo3sweTAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQUBfKiwO2e
-M4NEiRrVG793qEPLYyMwHwYDVR0RBBgwFoEUbmV0c3NoQHNvbHV0aW91cy5jb20w
-HwYDVR0SBBgwFoEUbmV0c3NoQHNvbHV0aW91cy5jb20wDQYJKoZIhvcNAQELBQAD
-ggEBABI2ORK5kzUL7uOF0EHI4ECMWxQMiN+pURyGp9u7DU0H8eSdZN52jbUGHzSB
-j7bB6GpqElEWjOe0IbH3vR52IVXq2bOF4P4vFchGAb4OuzJD8aJmrC/SPLHbWBuV
-2GpbRQRJyYPWN6Rt/4EHOxoFnhXOBEB6CGIy0dt7YezycVbzqtHoiI2Qf/bIFJQZ
-mpJAAUBkRiWksE7zrsE5DGK8kL2GVos7f8kdM71zT8p7VBwkMdY277T29TG2xD0D
-66Oev0C3/x89NXqCHkl1JElSzEFbOoxan16z7xNEf2MKcBKGhsYfzWVNyEtJm785
-g+97rn/AuO6dcxJnW2qBGYQa7pQ=
+MIIDeDCCAmCgAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMQ8wDQYDVQQDDAZuZXRz
+c2gxGTAXBgoJkiaJk/IsZAEZFglzb2x1dGlvdXMxEzARBgoJkiaJk/IsZAEZFgNj
+b20wHhcNMjYxMDIyMDk1NDI1WhcNMjcxMDIyMDk1NDI1WjBBMQ8wDQYDVQQDDAZu
+ZXRzc2gxGTAXBgoJkiaJk/IsZAEZFglzb2x1dGlvdXMxEzARBgoJkiaJk/IsZAEZ
+FgNjb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGJ4TbZ9H+qZ08
+pQfJhPJTHaDCyQvCsKTFrL5O9z3tllQ7B/zksMMM+qFBpNYu9HCcg4yBATacE/PB
+qVVyUrpr6lbH/XwoN5ljXm+bdCfmnjZvTCL2FTE6o+bcnaF0IsJyC0Q2B1fbWdXN
+6Off1ZWoUk6We2BIM1bn6QJLxBpGyYhvOPXsYoqSuzDf2SJDDsWFZ8kV5ON13Ohm
+JbBzn0oD8HF8FuYOewwsC0C1q4w7E5GtvHcQ5juweS7+RKsyDcVcVrLuNzoGRttS
+KP4yMn+TzaXijyjRg7gECfJr3TGASaA4bQsILFGG5dAWcwO4OMrZedR7SHj/o0Kf
+3gL7P0axAgMBAAGjezB5MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQW
+BBQF8qLA7Z4zg0SJGtUbv3eoQ8tjIzAfBgNVHREEGDAWgRRuZXRzc2hAc29sdXRp
+b3VzLmNvbTAfBgNVHRIEGDAWgRRuZXRzc2hAc29sdXRpb3VzLmNvbTANBgkqhkiG
+9w0BAQsFAAOCAQEAbVrRpiCFmHDMLNU+SCjpg43snWYksQOtejPPTEMdOc9cCmmv
+ctJbaPIySLUgzwFbQDZStDPbLJmIujh0fm5dHp/sDJpvPZ3Mm3FfzWQMJqzBx4uk
+OMx00yJK8VeFrwUViE3zO5raWvw85dUybp25pgaKGW4AA5mJ/2UHqYLc4lefKFKK
+9xFsyYSciMEKyAsUNSNTJzPKUo2vn7TNF/pS0ZL+h8Qkr0A0F0ncfj7uM1kOWjO0
+mMdUtmMoVbjbik3hqkY/18G03c3PoFNpL38VLKuyyROYz1DaCqOaRju3sbOoirD+
+piQTZDCWxeKuX0Iuxq02uxkYHfoGB6In0y3OOQ==
 -----END CERTIFICATE-----