@freedomofpress/sigstore-browser 0.1.0

package/src/tlog/dsse.ts

@@ -0,0 +1,147 @@
+/*
+ * DSSE transparency log entry verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/dsse.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle field comparison instead of SignatureContent abstraction
+ * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
+ * - Adds verifyDSSE002Body() - new functionality (reference only supports v0.0.1)
+ */
+
+import { base64ToUint8Array, hexToUint8Array, toArrayBuffer, uint8ArrayEqual } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+import type { SigstoreBundle } from "../bundle.js";
+import type { RekorEntry } from "./body.js";
+
+interface DSSESpec {
+  signatures?: Array<{
+    signature: string;
+    verifier?: string;
+    keyid?: string;
+  }>;
+  payloadHash?: {
+    algorithm: string;
+    value: string;
+  };
+  envelopeHash?: {
+    algorithm: string;
+    value: string;
+  };
+}
+
+interface DSSEEntry extends RekorEntry {
+  apiVersion: "0.0.1" | "0.0.2";
+  kind: "dsse";
+  spec: DSSESpec;
+}
+
+export async function verifyDSSEBody(
+  entry: RekorEntry,
+  bundle: SigstoreBundle
+): Promise<void> {
+  const dsseEntry = entry as DSSEEntry;
+
+  switch (dsseEntry.apiVersion) {
+    case "0.0.1":
+      return verifyDSSE001Body(dsseEntry, bundle);
+    case "0.0.2":
+      return verifyDSSE002Body(dsseEntry, bundle);
+    default:
+      throw new Error(
+        `Unsupported dsse version: ${dsseEntry.apiVersion}`
+      );
+  }
+}
+
+async function verifyDSSE001Body(
+  entry: DSSEEntry,
+  bundle: SigstoreBundle
+): Promise<void> {
+  if (!bundle.dsseEnvelope) {
+    throw new Error("Bundle missing dsseEnvelope for DSSE entry");
+  }
+
+  if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {
+    throw new Error("DSSE entry must have exactly one signature");
+  }
+
+  const tlogSig = entry.spec.signatures[0].signature;
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+
+  if (bundle.dsseEnvelope.signatures.length === 0) {
+    throw new Error("Bundle DSSE envelope missing signatures");
+  }
+
+  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("DSSE signature mismatch between TLog entry and bundle");
+  }
+
+  const tlogHash = entry.spec.payloadHash?.value || "";
+  if (!tlogHash) {
+    throw new Error("DSSE entry missing payloadHash");
+  }
+
+  const tlogHashBytes = hexToUint8Array(tlogHash);
+
+  const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+  const bundleHashBytes = new Uint8Array(
+    await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(payloadBytes))
+  );
+
+  if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+    throw new Error("DSSE payload hash mismatch between TLog entry and bundle");
+  }
+}
+
+// New functionality for DSSE v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
+async function verifyDSSE002Body(
+  entry: DSSEEntry,
+  bundle: SigstoreBundle
+): Promise<void> {
+  if (!bundle.dsseEnvelope) {
+    throw new Error("Bundle missing dsseEnvelope for DSSE v0.0.2 entry");
+  }
+
+  const spec = (entry.spec as any).dsseV002;
+  if (!spec) {
+    throw new Error("DSSE v0.0.2 entry missing dsseV002 spec");
+  }
+
+  if (!spec.signatures || spec.signatures.length !== 1) {
+    throw new Error("DSSE v0.0.2 entry must have exactly one signature");
+  }
+
+  const tlogSig = spec.signatures[0].content;
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+
+  if (bundle.dsseEnvelope.signatures.length === 0) {
+    throw new Error("Bundle DSSE envelope missing signatures");
+  }
+
+  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
+  }
+
+  const tlogHash = spec.payloadHash?.digest || "";
+  if (!tlogHash) {
+    throw new Error("DSSE v0.0.2 entry missing payloadHash");
+  }
+
+  const tlogHashBytes = base64ToUint8Array(tlogHash);
+
+  const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+  const bundleHashBytes = new Uint8Array(
+    await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(payloadBytes))
+  );
+
+  if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+    throw new Error("DSSE payload hash mismatch between TLog entry and bundle (v0.0.2)");
+  }
+}

package/src/tlog/hashedrekord.ts

@@ -0,0 +1,130 @@
+/*
+ * HashedRekord transparency log entry verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/hashedrekord.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle field comparison instead of SignatureContent abstraction
+ * - Adds verifyHashedRekordV002Body() - new functionality (reference only supports v0.0.1)
+ */
+
+import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "../encoding.js";
+import type { SigstoreBundle } from "../bundle.js";
+import type { RekorEntry } from "./body.js";
+
+interface HashedRekordSpec {
+  signature: {
+    content: string;
+    publicKey: {
+      content: string;
+    };
+  };
+  data: {
+    hash: {
+      algorithm: string;
+      value: string;
+    };
+  };
+}
+
+interface HashedRekordEntry extends RekorEntry {
+  apiVersion: "0.0.1" | "0.0.2";
+  kind: "hashedrekord";
+  spec: HashedRekordSpec | HashedRekordV002Spec;
+}
+
+interface HashedRekordV002Spec {
+  hashedRekordV002: {
+    signature: {
+      content: string;
+      verifier: {
+        x509Certificate: {
+          rawBytes: string;
+        };
+      };
+    };
+    data: {
+      algorithm: string;
+      digest: string;
+    };
+  };
+}
+
+export async function verifyHashedRekordBody(
+  entry: RekorEntry,
+  bundle: SigstoreBundle
+): Promise<void> {
+  const hashedRekordEntry = entry as HashedRekordEntry;
+
+  switch (hashedRekordEntry.apiVersion) {
+    case "0.0.1":
+      return verifyHashedRekordV001Body(hashedRekordEntry, bundle);
+    case "0.0.2":
+      return verifyHashedRekordV002Body(hashedRekordEntry, bundle);
+    default:
+      throw new Error(
+        `Unsupported hashedrekord version: ${hashedRekordEntry.apiVersion}`
+      );
+  }
+}
+
+function verifyHashedRekordV001Body(
+  entry: HashedRekordEntry,
+  bundle: SigstoreBundle
+): void {
+  const spec = entry.spec as HashedRekordSpec;
+  if (!bundle.messageSignature) {
+    throw new Error("Bundle missing messageSignature for hashedrekord entry");
+  }
+
+  const tlogSig = spec.signature.content || "";
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+  const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
+
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("Signature mismatch between TLog entry and bundle");
+  }
+
+  const tlogDigest = spec.data.hash?.value || "";
+  const tlogDigestBytes = hexToUint8Array(tlogDigest);
+  const bundleDigestBytes = base64ToUint8Array(
+    bundle.messageSignature.messageDigest.digest
+  );
+
+  if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {
+    throw new Error("Digest mismatch between TLog entry and bundle");
+  }
+}
+
+// New functionality for HashedRekord v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
+function verifyHashedRekordV002Body(
+  entry: HashedRekordEntry,
+  bundle: SigstoreBundle
+): void {
+  const spec = (entry.spec as HashedRekordV002Spec).hashedRekordV002;
+  if (!bundle.messageSignature) {
+    throw new Error("Bundle missing messageSignature for hashedrekord v0.0.2 entry");
+  }
+
+  // NOTE: HashedRekord v0.0.2 uses single base64 encoding (unlike intoto which is double-encoded)
+  // Verified against Sigstore conformance test suite bundles
+  const tlogSig = spec.signature.content || "";
+  const tlogSigBytes = base64ToUint8Array(tlogSig);
+  const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
+
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("Signature mismatch between TLog entry and bundle (v0.0.2)");
+  }
+
+  const tlogDigest = spec.data.digest || "";
+  const tlogDigestBytes = base64ToUint8Array(tlogDigest);
+  const bundleDigestBytes = base64ToUint8Array(
+    bundle.messageSignature.messageDigest.digest
+  );
+
+  if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {
+    throw new Error("Digest mismatch between TLog entry and bundle (v0.0.2)");
+  }
+}

package/src/tlog/intoto.ts

@@ -0,0 +1,102 @@
+/*
+ * Intoto transparency log entry verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/intoto.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle field comparison instead of SignatureContent abstraction
+ * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
+ */
+
+import { base64Decode, base64ToUint8Array, hexToUint8Array, toArrayBuffer, uint8ArrayEqual } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+import type { SigstoreBundle } from "../bundle.js";
+import type { RekorEntry } from "./body.js";
+
+interface IntotoEnvelope {
+  payload: string;
+  payloadType: string;
+  signatures: Array<{
+    keyid?: string;
+    sig: string;
+    publicKey?: string;
+  }>;
+}
+
+interface IntotoSpec {
+  content: {
+    envelope: IntotoEnvelope;
+    hash?: {
+      algorithm: string;
+      value: string;
+    };
+    payloadHash?: {
+      algorithm: string;
+      value: string;
+    };
+  };
+  publicKey?: string;
+}
+
+interface IntotoEntry extends RekorEntry {
+  apiVersion: "0.0.2";
+  kind: "intoto";
+  spec: IntotoSpec;
+}
+
+export async function verifyIntotoBody(
+  entry: RekorEntry,
+  bundle: SigstoreBundle
+): Promise<void> {
+  const intotoEntry = entry as IntotoEntry;
+
+  if (intotoEntry.apiVersion !== "0.0.2") {
+    throw new Error(
+      `Unsupported intoto version: ${intotoEntry.apiVersion}`
+    );
+  }
+
+  if (!bundle.dsseEnvelope) {
+    throw new Error("Bundle missing dsseEnvelope for intoto entry");
+  }
+
+  const tlogEnvelope = intotoEntry.spec.content.envelope;
+
+  if (!tlogEnvelope.signatures || tlogEnvelope.signatures.length !== 1) {
+    throw new Error("Intoto entry must have exactly one signature");
+  }
+
+  // The signature in the intoto tlog entry is double-base64-encoded:
+  // 1. Raw signature bytes are base64-encoded (normal)
+  // 2. That base64 string is base64-encoded again (for storage in JSON)
+  // So we decode twice: base64 -> string -> base64 -> bytes
+  const tlogSigBase64 = tlogEnvelope.signatures[0].sig;
+  const tlogSigDecoded = base64Decode(tlogSigBase64); // First decode: base64 -> UTF-8 string (which contains base64)
+  const tlogSigBytes = base64ToUint8Array(tlogSigDecoded); // Second decode: base64 string -> raw bytes
+
+  if (bundle.dsseEnvelope.signatures.length === 0) {
+    throw new Error("Bundle DSSE envelope missing signatures");
+  }
+
+  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
+
+  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
+    throw new Error("Intoto signature mismatch between TLog entry and bundle");
+  }
+
+  if (intotoEntry.spec.content.payloadHash) {
+    const tlogHash = intotoEntry.spec.content.payloadHash.value;
+    const tlogHashBytes = hexToUint8Array(tlogHash);
+
+    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+    const bundleHashBytes = new Uint8Array(
+      await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(payloadBytes))
+    );
+
+    if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
+      throw new Error("Intoto payload hash mismatch between TLog entry and bundle");
+    }
+  }
+}

package/src/tlog/merkle.ts

@@ -0,0 +1,152 @@
+/*
+Adapted from sigstore-js for browser compatibility:
+https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/merkle.ts
+
+Key differences:
+- Uses Uint8Array instead of Buffer
+- Uses async Web Crypto API (crypto.subtle.digest) instead of sync Node.js crypto
+- Base64 decoding via custom base64ToUint8Array instead of Buffer.from
+- Custom uint8ArrayEqual instead of crypto.bufferEqual
+*/
+import { base64ToUint8Array, toArrayBuffer, uint8ArrayEqual } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+import type { TLogEntry } from "../bundle.js";
+
+const RFC6962_LEAF_HASH_PREFIX = new Uint8Array([0x00]);
+const RFC6962_NODE_HASH_PREFIX = new Uint8Array([0x01]);
+
+export async function verifyMerkleInclusion(
+  entry: TLogEntry
+): Promise<void> {
+  if (!entry.inclusionProof) {
+    throw new Error("Missing inclusion proof");
+  }
+
+  const inclusionProof = entry.inclusionProof;
+  const logIndex = BigInt(inclusionProof.logIndex);
+  const treeSize = BigInt(inclusionProof.treeSize);
+
+  if (logIndex < 0n || logIndex >= treeSize) {
+    throw new Error(`Invalid log index: ${logIndex}`);
+  }
+
+  // Figure out which subset of hashes corresponds to the inner and border
+  // nodes
+  const { inner, border } = decompInclProof(logIndex, treeSize);
+
+  if (inclusionProof.hashes.length !== inner + border) {
+    throw new Error("Invalid hash count in inclusion proof");
+  }
+
+  const innerHashes = inclusionProof.hashes
+    .slice(0, inner)
+    .map((h) => base64ToUint8Array(h));
+  const borderHashes = inclusionProof.hashes
+    .slice(inner)
+    .map((h) => base64ToUint8Array(h));
+
+  // The entry's hash is the leaf hash
+  const leafHash = await hashLeaf(base64ToUint8Array(entry.canonicalizedBody));
+
+  // Chain the hashes belonging to the inner and border portions
+  const calculatedHash = await chainBorderRight(
+    await chainInner(leafHash, innerHashes, logIndex),
+    borderHashes
+  );
+
+  const rootHash = base64ToUint8Array(inclusionProof.rootHash);
+
+  // Calculated hash should match the root hash in the inclusion proof
+  if (!uint8ArrayEqual(calculatedHash, rootHash)) {
+    throw new Error("Calculated root hash does not match inclusion proof");
+  }
+}
+
+// Breaks down inclusion proof for a leaf at the specified index in a tree of
+// the specified size. The split point is where paths to the index leaf and
+// the (size - 1) leaf diverge. Returns lengths of the bottom and upper proof
+// parts.
+function decompInclProof(
+  index: bigint,
+  size: bigint
+): { inner: number; border: number } {
+  const inner = innerProofSize(index, size);
+  const border = onesCount(index >> BigInt(inner));
+  return { inner, border };
+}
+
+// Computes a subtree hash for a node on or below the tree's right border.
+// Assumes the provided proof hashes are ordered from lower to higher levels
+// and seed is the initial hash of the node specified by the index.
+async function chainInner(
+  seed: Uint8Array,
+  hashes: Uint8Array[],
+  index: bigint
+): Promise<Uint8Array> {
+  let acc = seed;
+  for (let i = 0; i < hashes.length; i++) {
+    const h = hashes[i];
+    if ((index >> BigInt(i)) & BigInt(1)) {
+      acc = await hashChildren(h, acc);
+    } else {
+      acc = await hashChildren(acc, h);
+    }
+  }
+  return acc;
+}
+
+// Computes a subtree hash for nodes along the tree's right border.
+async function chainBorderRight(
+  seed: Uint8Array,
+  hashes: Uint8Array[]
+): Promise<Uint8Array> {
+  let acc = seed;
+  for (const h of hashes) {
+    acc = await hashChildren(h, acc);
+  }
+  return acc;
+}
+
+function innerProofSize(index: bigint, size: bigint): number {
+  return bitLength(index ^ (size - BigInt(1)));
+}
+
+// Counts the number of ones in the binary representation of the given number.
+// https://en.wikipedia.org/wiki/Hamming_weight
+function onesCount(num: bigint): number {
+  return num.toString(2).split("1").length - 1;
+}
+
+// Returns the number of bits necessary to represent an integer in binary.
+function bitLength(n: bigint): number {
+  if (n === 0n) {
+    return 0;
+  }
+  return n.toString(2).length;
+}
+
+// Hashing logic according to RFC6962.
+// https://datatracker.ietf.org/doc/html/rfc6962#section-2
+async function hashChildren(
+  left: Uint8Array,
+  right: Uint8Array
+): Promise<Uint8Array> {
+  const data = new Uint8Array(
+    RFC6962_NODE_HASH_PREFIX.length + left.length + right.length
+  );
+  data.set(RFC6962_NODE_HASH_PREFIX, 0);
+  data.set(left, RFC6962_NODE_HASH_PREFIX.length);
+  data.set(right, RFC6962_NODE_HASH_PREFIX.length + left.length);
+
+  const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(data));
+  return new Uint8Array(hash);
+}
+
+async function hashLeaf(leaf: Uint8Array): Promise<Uint8Array> {
+  const data = new Uint8Array(RFC6962_LEAF_HASH_PREFIX.length + leaf.length);
+  data.set(RFC6962_LEAF_HASH_PREFIX, 0);
+  data.set(leaf, RFC6962_LEAF_HASH_PREFIX.length);
+
+  const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, toArrayBuffer(data));
+  return new Uint8Array(hash);
+}

package/src/trust/README.md

@@ -0,0 +1,38 @@
+# Trust Material
+
+This directory contains trust material for Sigstore verification.
+
+## tuf-root.json
+
+**Source**: Extracted from [sigstore-js/packages/tuf/seeds.json](https://github.com/sigstore/sigstore-js/blob/main/packages/tuf/seeds.json)
+
+**Purpose**: Bootstrap TUF (The Update Framework) client with a pinned root of trust for the Sigstore TUF repository.
+
+**Content**: Base64-encoded TUF `root.json` metadata for `https://tuf-repo-cdn.sigstore.dev`
+- Type: TUF root metadata (version 13)
+- Expires: 2026-01-22
+- Contains: 5 root signing keys with threshold signature requirement
+
+**Security**: This file prevents MITM attacks during TUF initialization by embedding the initial root metadata instead of fetching it from the network. The TUF client uses this to verify all subsequent TUF metadata updates.
+
+**Updates**: Should be updated when sigstore-js updates its embedded TUF root. Check the sigstore-js repository for the latest version.
+
+## Trust Material Flow
+
+1. **TUF Bootstrap**: `tuf-root.json` → TUF client initialization
+2. **TUF Metadata Updates**: TUF client fetches and verifies latest metadata
+3. **Sigstore Trust Material**: TUF delivers `trusted_root.json` (CAs, CT logs, TLogs, TSAs)
+4. **Verification**: Sigstore verifier uses the trust material to verify signatures
+
+This matches the sigstore-js architecture: TUF provides always up-to-date trust material rather than using static embedded files that can become outdated.
+
+## Why No Static `trusted_root.json`?
+
+Unlike some implementations, we do **not** embed a static `trusted_root.json` file. Here's why:
+
+- **Outdated Material**: Static trust roots become outdated (e.g., expired certificates, new CAs, rotated keys)
+- **Reviewer Issues**: Previous embedded files had incorrect `validFor` dates and mismatched certificate subjects
+- **TUF Purpose**: TUF exists specifically to deliver fresh, verified trust material - using it is the correct approach
+- **Matches Reference**: sigstore-js uses TUF exclusively, with no static fallback
+
+The CLI always uses TUF to fetch `trusted_root.json`, ensuring correctness and freshness.

package/src/trust/tuf-root.json

@@ -0,0 +1 @@
+"ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9"