@oneuptime/common 13.0.6 → 13.0.8

package/Server/Utils/SecurityEvent/GoogleSecOpsSeverityRepair.ts

@@ -0,0 +1,170 @@
+import OcsfSeverity, {
+  OCSF_SEVERITY_ALIASES,
+  OcsfSeverityId,
+} from "../../../Types/SecurityEvent/OcsfSeverity";
+import {
+  DETECTION_FINDING_CLASS_UID,
+  GOOGLE_SECOPS_PRODUCT_NAME,
+  GOOGLE_SECOPS_RISK_SCORE_BANDS,
+  GOOGLE_SECOPS_VENDOR_NAME,
+} from "../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer";
+
+/*
+ * Re-grades Google SecOps detections that were stored as Unknown before the
+ * normalizer learned to read a custom rule's severity.
+ *
+ * Every stored row keeps its source payload flattened into `attributes`
+ * (`detection.0.ruleLabels.2.key` = "severity", `...2.value` = "Medium"), so
+ * the grade the fixed GoogleSecOpsAlertNormalizer would give a row can be
+ * computed in SQL from the row itself. The expression below is that
+ * normalizer's resolveSeverity, written against the flattened keys:
+ *
+ *   1. detection[0].severity   (Google's grade on curated rules)
+ *   2. the Collection's severity
+ *   3. the first ruleLabels "severity" that names a grade (YARA-L meta)
+ *   4. the first outcomes "risk_score" that grades, on Google's bands
+ *
+ * Its text tables are generated from OCSF_SEVERITY_ALIASES and
+ * GOOGLE_SECOPS_RISK_SCORE_BANDS, the same tables the normalizer reads, so
+ * the two cannot drift apart. It reads the list form of ruleLabels and
+ * outcomes Google returns; a label map in a hand-built webhook body is
+ * graded at ingest but not here.
+ *
+ * Only rows that are still Unknown and that the expression grades are
+ * touched, so the repair is idempotent and never overrides a grade.
+ */
+export default class GoogleSecOpsSeverityRepair {
+  /*
+   * The OCSF severity name a stored row's attributes grade to, or '' when
+   * nothing in them grades.
+   */
+  public static gradeExpression(): string {
+    const detectionSeverity: string = `if(attributes['detection.0.severity'] != '', attributes['detection.0.severity'], attributes['detection.severity'])`;
+    const graded: Array<string> = [
+      GoogleSecOpsSeverityRepair.gradeText(detectionSeverity),
+      GoogleSecOpsSeverityRepair.gradeText("attributes['severity']"),
+      GoogleSecOpsSeverityRepair.firstKeyedGrade(
+        "(ruleLabels|rule_labels)",
+        "severity",
+        GoogleSecOpsSeverityRepair.gradeText,
+      ),
+      GoogleSecOpsSeverityRepair.firstKeyedGrade(
+        "outcomes",
+        "risk_score",
+        GoogleSecOpsSeverityRepair.gradeRiskScore,
+      ),
+    ];
+
+    // The first of the four grades that is set, in the normalizer's order.
+    return `arrayFirst(grade -> grade != '', [${graded.join(", ")}])`;
+  }
+
+  /*
+   * The async ON CLUSTER mutation. `storageTable` is the local storage
+   * table and `onCluster` the cluster clause, as every data mutation on
+   * the clustered analytics schema is written.
+   */
+  public static repairStatement(data: {
+    storageTable: string;
+    onCluster: string;
+  }): string {
+    const grade: string = GoogleSecOpsSeverityRepair.gradeExpression();
+    const names: Array<OcsfSeverity> = Object.keys(
+      OcsfSeverityId,
+    ) as Array<OcsfSeverity>;
+    const severityId: string = `transform(${grade}, [${names
+      .map((name: OcsfSeverity): string => {
+        return GoogleSecOpsSeverityRepair.literal(name);
+      })
+      .join(", ")}], [${names
+      .map((name: OcsfSeverity): string => {
+        return String(OcsfSeverityId[name]);
+      })
+      .join(", ")}], ${OcsfSeverityId[OcsfSeverity.Unknown]})`;
+
+    return `ALTER TABLE ${data.storageTable}${data.onCluster} UPDATE severityName = ${grade}, severityId = ${severityId} WHERE ${GoogleSecOpsSeverityRepair.condition()}`;
+  }
+
+  /*
+   * The rows the repair rewrites: Google SecOps detection findings still
+   * stored as Unknown whose attributes now grade. The cheap column checks
+   * come first so ClickHouse evaluates the attribute expression only for
+   * those rows.
+   */
+  public static condition(): string {
+    return [
+      `vendorName = ${GoogleSecOpsSeverityRepair.literal(GOOGLE_SECOPS_VENDOR_NAME)}`,
+      `productName = ${GoogleSecOpsSeverityRepair.literal(GOOGLE_SECOPS_PRODUCT_NAME)}`,
+      `classUid = ${DETECTION_FINDING_CLASS_UID}`,
+      `severityId = ${OcsfSeverityId[OcsfSeverity.Unknown]}`,
+      `${GoogleSecOpsSeverityRepair.gradeExpression()} != ''`,
+    ].join(" AND ");
+  }
+
+  // normalizeOcsfSeverity, minus Unknown: text that names no grade is ''.
+  private static gradeText(expression: string): string {
+    const graded: Array<[string, OcsfSeverity]> = Object.entries(
+      OCSF_SEVERITY_ALIASES,
+    ).filter((entry: [string, OcsfSeverity]): boolean => {
+      return entry[1] !== OcsfSeverity.Unknown;
+    });
+
+    const from: string = graded
+      .map((entry: [string, OcsfSeverity]): string => {
+        return GoogleSecOpsSeverityRepair.literal(entry[0]);
+      })
+      .join(", ");
+    const to: string = graded
+      .map((entry: [string, OcsfSeverity]): string => {
+        return GoogleSecOpsSeverityRepair.literal(entry[1]);
+      })
+      .join(", ");
+
+    return `transform(upperUTF8(${GoogleSecOpsSeverityRepair.trimmed(expression)}), [${from}], [${to}], '')`;
+  }
+
+  /*
+   * The normalizer's gradeRiskScore: a finite score above zero grades into
+   * the first band whose minimum it reaches.
+   */
+  private static gradeRiskScore(expression: string): string {
+    const bands: string = GOOGLE_SECOPS_RISK_SCORE_BANDS.map(
+      (band: { minimum: number; severity: OcsfSeverity }): string => {
+        return `score >= ${band.minimum}, ${GoogleSecOpsSeverityRepair.literal(band.severity)}`;
+      },
+    ).join(", ");
+
+    return `arrayMap(score -> multiIf(NOT isFinite(score) OR score <= 0, '', ${bands}, ''), [ifNull(toFloat64OrNull(${GoogleSecOpsSeverityRepair.trimmed(expression)}), 0)])[1]`;
+  }
+
+  /*
+   * The first grade among the entries of detection[0].<list> whose key is
+   * `key`, in list order: the normalizer's readKeyedValues + firstGrade.
+   * A flattened entry is `detection.0.<list>.<index>.key` / `.value`
+   * (`detection.<list>...` when the webhook sent detection as an object).
+   */
+  private static firstKeyedGrade(
+    listPattern: string,
+    key: string,
+    grade: (expression: string) => string,
+  ): string {
+    const keyPattern: string = `^detection[.](0[.])?${listPattern}[.][0-9]+[.]key$`;
+    const keys: string = `arraySort(entryKey -> toUInt64OrZero(extract(entryKey, '[.]([0-9]+)[.]key$')), arrayFilter(entryKey -> match(entryKey, ${GoogleSecOpsSeverityRepair.literal(keyPattern)}), mapKeys(attributes)))`;
+    const value: string =
+      "attributes[concat(substring(entryKey, 1, length(entryKey) - 3), 'value')]";
+
+    return `arrayFirst(entryGrade -> entryGrade != '', arrayMap(entryKey -> if(lowerUTF8(${GoogleSecOpsSeverityRepair.trimmed("attributes[entryKey]")}) = ${GoogleSecOpsSeverityRepair.literal(key)}, ${grade(value)}, ''), ${keys}))`;
+  }
+
+  /*
+   * JavaScript's String.trim strips all surrounding whitespace; ClickHouse's
+   * trim() strips spaces only.
+   */
+  private static trimmed(expression: string): string {
+    return `replaceRegexpAll(${expression}, '^[[:space:]]+|[[:space:]]+$', '')`;
+  }
+
+  private static literal(value: string): string {
+    return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+  }
+}

package/Server/Utils/SecurityEvent/Sigma/SigmaClickhouseCompiler.ts

@@ -64,7 +64,7 @@ const ARRAY_COLUMNS: Set<string> = new Set<string>([
  * under its original spelling — which is exactly the flattened source
  * payload key, so rules written against raw UDM/OCSF field paths work.
  */
-const FIELD_ALIASES: Record<string, string> = {
+export const FIELD_ALIASES: Record<string, string> = {
   user: "principalUser",
   username: "principalUser",
   "user.name": "principalUser",

package/Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelFeedPoller.ts

@@ -3,7 +3,10 @@ import LIMIT_MAX from "../../../../Types/Database/LimitMax";
 import OneUptimeDate from "../../../../Types/Date";
 import { JSONObject } from "../../../../Types/JSON";
 import ObjectID from "../../../../Types/ObjectID";
-import { THREAT_INTEL_DEFAULT_VALID_DAYS } from "../../../../Types/SecurityEvent/ThreatIntelConstants";
+import {
+  THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES,
+  THREAT_INTEL_DEFAULT_VALID_DAYS,
+} from "../../../../Types/SecurityEvent/ThreatIntelConstants";
 import StixPatternParser, {
   ParsedIndicatorValue,
 } from "../../../../Utils/SecurityEvent/ThreatIntel/StixPatternParser";
@@ -146,7 +149,8 @@ export default class ThreatIntelFeedPoller {
     for (const feed of feeds) {
       const intervalInMinutes: number = Math.max(
         1,
-        feed.pollIntervalInMinutes || 60,
+        feed.pollIntervalInMinutes ||
+          THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES,
       );
 
       if (feed.lastPolledAt) {

package/Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelMatcher.ts

@@ -18,6 +18,9 @@ import {
   THREAT_INDICATOR_ID_ATTRIBUTE,
   THREAT_INDICATOR_TYPE_ATTRIBUTE,
   THREAT_INDICATOR_VALUE_ATTRIBUTE,
+  THREAT_INTEL_FIRST_MATCH_WINDOW_IN_MINUTES,
+  THREAT_INTEL_MATCH_MAX_LOOKBACK_IN_MINUTES,
+  THREAT_INTEL_MAX_INDICATORS_PER_EVALUATION,
   THREAT_INTEL_PRODUCT_NAME,
   THREAT_INTEL_SERVICE_NAME,
   THREAT_MATCH_COUNT_ATTRIBUTE,
@@ -64,14 +67,9 @@ import {
  * only moves forward.
  */
 
-// Cap on one evaluation's scan, whatever lastEvaluatedAt says.
-const MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
-
-// First-ever evaluation window for a feed.
-const DEFAULT_WINDOW_IN_MINUTES: number = 15;
-
 // One alert per distinct indicator value per cycle, at most.
-export const MAX_GROUPS_PER_EVALUATION: number = 100;
+export const MAX_GROUPS_PER_EVALUATION: number =
+  THREAT_INTEL_MAX_INDICATORS_PER_EVALUATION;
 
 export interface ThreatIntelMatchResult {
   feedId: string;
@@ -157,12 +155,15 @@ export default class ThreatIntelMatcher {
 
     const earliestAllowed: Date = OneUptimeDate.addRemoveMinutes(
       endTime,
-      -MAX_LOOKBACK_IN_MINUTES,
+      -THREAT_INTEL_MATCH_MAX_LOOKBACK_IN_MINUTES,
     );
 
     let startTime: Date = feed.lastEvaluatedAt
       ? feed.lastEvaluatedAt
-      : OneUptimeDate.addRemoveMinutes(endTime, -DEFAULT_WINDOW_IN_MINUTES);
+      : OneUptimeDate.addRemoveMinutes(
+          endTime,
+          -THREAT_INTEL_FIRST_MATCH_WINDOW_IN_MINUTES,
+        );
 
     if (OneUptimeDate.isBefore(startTime, earliestAllowed)) {
       startTime = earliestAllowed;

package/Server/Utils/Telemetry/TelemetryEntity.ts

@@ -3,6 +3,11 @@ import {
   canonicalizeEntityValue,
   setSha256Provider,
 } from "../../../Utils/Telemetry/EntityKey";
+import {
+  MAX_INVENTORY_HOST_IP_ADDRESSES_LENGTH,
+  MAX_INVENTORY_HOST_IP_ADDRESS_COUNT,
+  normalizeHostIpAddresses,
+} from "../../../Utils/Telemetry/HostIpAddresses";
 import EntityType from "../../../Types/Telemetry/EntityType";
 import Dictionary from "../../../Types/Dictionary";
 import logger from "../Logger";
@@ -46,6 +51,26 @@ setSha256Provider((input: string): string => {
 /** Scalar attribute value as seen after `TelemetryUtil.getAttributes`. */
 export type EntityAttributeValue = string | number | boolean | null | undefined;
 
+/**
+ * Longest descriptive attribute value we persist.
+ *
+ * Descriptive attributes are display metadata for one row of a definition
+ * list, but several of them now come from the collector's `env` resource
+ * detector — i.e. straight from a customer-controlled environment variable
+ * of unbounded length — into a `jsonb` bag that is merged additively and
+ * never prunes a key (`InventoryItemService.buildDescriptiveUpdate`).
+ * Nothing below this point bounds them: `getMaxLengthFromTableColumnType`
+ * returns undefined for a JSON column, so `DatabaseService`'s length check
+ * and truncation both skip it. So bound them here, at the one place both
+ * producers pass through.
+ *
+ * One value is bounded elsewhere instead: a joined `host.ip` list carries
+ * its own cap (`MAX_INVENTORY_HOST_IP_ADDRESSES_LENGTH`, 512) because it
+ * has to truncate on whole addresses rather than mid-string. So 512, not
+ * this, is the true ceiling for that one key.
+ */
+export const MAX_DESCRIPTIVE_ATTRIBUTE_VALUE_LENGTH: number = 256;
+
 /**
  * A flat resource-attribute map keyed by the *raw* semconv attribute name
  * (e.g. `service.name`, `host.id`, `k8s.pod.name`) — i.e. NOT prefixed
@@ -395,7 +420,10 @@ export default class InventoryItem {
         if (typeof key !== "string" || key.trim().length === 0) {
           continue;
         }
-        const value: string | null = this.strOrFirst(data.attributes, key);
+        const value: string | null = this.descriptiveValueFor(
+          data.attributes,
+          key,
+        );
         if (value) {
           descriptiveAttributes[key] = value;
         }
@@ -1010,17 +1038,40 @@ export default class InventoryItem {
     ]);
 
   /*
-   * Per-type descriptive allowlists (heuristic path). Deliberately tiny
-   * (<= ~6 keys each): the registry merges these last-writer-wins, so
-   * only stable, dashboard-worthy metadata belongs here. Types not
-   * listed emit no descriptive attributes.
+   * Per-type descriptive allowlists (heuristic path). The registry merges
+   * these last-writer-wins and never prunes a key, so only stable
+   * metadata that is worth a row on the item's Attributes card belongs
+   * here. Types not listed emit no descriptive attributes.
+   *
+   * Keep every list tiny — roughly six keys — with ONE deliberate
+   * exception. `host` is the type people export into a CMDB (issue
+   * #3866), and a CMDB row wants the machine's asset facts, not a
+   * sample of them. Its list is therefore the catalogue of what a
+   * host's Attributes card can show, and it is allowed to be longer.
+   * That is a reason for this one type, not a licence to grow the rest.
    */
   private static readonly descriptiveAttributeKeysByType: Partial<
     Record<EntityType, Array<string>>
   > = {
+    /*
+     * `os.type` / `os.description` / `host.arch` / `host.id` / `host.ip`
+     * all come free from the collector's `system` resource detector, and
+     * the config OneUptime generates on the host's Documentation tab
+     * already enables every one of them.
+     *
+     * No detector can produce a serial number, make or model — those are
+     * read from WMI (Windows) or DMI (Linux) at provisioning time and
+     * stamped onto the resource, which is what the docs now describe.
+     */
     [EntityType.Host]: [
       "os.type",
+      "os.description",
       "host.arch",
+      "host.id",
+      "host.ip",
+      "host.serial_number",
+      "device.manufacturer",
+      "device.model.name",
       "cloud.provider",
       "cloud.region",
       "cloud.availability_zone",
@@ -1067,6 +1118,46 @@ export default class InventoryItem {
     ],
   };
 
+  /*
+   * Extra source spellings accepted for a canonical descriptive key, in
+   * fallback order. The canonical key always wins when both are present,
+   * and the canonical key is what gets stored — so a CMDB export has one
+   * column per fact no matter which spelling the collector sent.
+   *
+   * Make and model are the case this exists for. `device.manufacturer` /
+   * `device.model.name` are the OpenTelemetry attributes and what issue
+   * #3866 asks for, so they are canonical here. But `host.*` is the
+   * namespace an operator reaches for when describing a machine, and a
+   * config written that way should not silently produce nothing.
+   *
+   * A Map rather than an object literal, deliberately. The lookup key can
+   * come from a producer's `entity_refs` `description_keys`, so an object
+   * would resolve `"constructor"` or `"toString"` to something inherited
+   * from Object.prototype — truthy but not iterable, and spreading it threw
+   * a TypeError out of extraction for the whole batch.
+   */
+  private static readonly descriptiveAttributeAliases: ReadonlyMap<
+    string,
+    ReadonlyArray<string>
+  > = new Map<string, ReadonlyArray<string>>([
+    ["device.manufacturer", ["host.manufacturer"]],
+    ["device.model.name", ["host.model.name", "host.model"]],
+  ]);
+
+  /*
+   * Descriptive keys whose OpenTelemetry value is a LIST, where the list
+   * itself is the fact.
+   *
+   * `strOrFirst` keeps the first element, which is right for
+   * `container.image.tags` (any tag names the same image) and wrong for
+   * `host.ip` (one arbitrary NIC address is not "the host's IP" — on a
+   * Docker host it is as likely to be a veth as the LAN address). These
+   * keys are deduped and comma-joined through the same helper that fills
+   * `Host.hostIpAddresses`, so the two surfaces read identically.
+   */
+  private static readonly joinedListDescriptiveKeys: ReadonlySet<string> =
+    new Set<string>(["host.ip"]);
+
   private static descriptiveAttributesFor(
     entityType: EntityType,
     attrs: EntityAttributes,
@@ -1080,7 +1171,7 @@ export default class InventoryItem {
     }
 
     for (const key of keys) {
-      const value: string | null = this.strOrFirst(attrs, key);
+      const value: string | null = this.descriptiveValueFor(attrs, key);
       if (value) {
         out[key] = value;
       }
@@ -1089,6 +1180,114 @@ export default class InventoryItem {
     return out;
   }
 
+  /**
+   * Resolve one descriptive value under its canonical key.
+   *
+   * Both descriptive producers — the heuristic allowlist and the
+   * producer-declared `entity_refs` `description_keys` — go through here,
+   * so the aliases, the list policy and the length cap cannot fork
+   * between them.
+   */
+  private static descriptiveValueFor(
+    attrs: EntityAttributes,
+    key: string,
+  ): string | null {
+    const sources: Array<string> = [
+      key,
+      ...(this.descriptiveAttributeAliases.get(key) || []),
+    ];
+
+    // The policy belongs to the canonical key, so it is fixed for every source.
+    const isJoinedList: boolean = this.joinedListDescriptiveKeys.has(key);
+
+    for (const source of sources) {
+      if (isJoinedList) {
+        const joined: string | null = normalizeHostIpAddresses(
+          this.descriptiveList(attrs, source),
+          {
+            maxCount: MAX_INVENTORY_HOST_IP_ADDRESS_COUNT,
+            maxLength: MAX_INVENTORY_HOST_IP_ADDRESSES_LENGTH,
+          },
+        );
+        if (joined) {
+          return joined;
+        }
+        continue;
+      }
+
+      const value: string | null = this.strOrFirst(attrs, source);
+      if (value) {
+        return this.truncateDescriptiveValue(value);
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Read an attribute as a list of strings.
+   *
+   * Two shapes arrive for the same fact. A collector that detects
+   * `host.ip` sends an OTLP array, which reaches us as a real JS array.
+   * The `env` detector can only express scalars, so the same list set
+   * through `OTEL_RESOURCE_ATTRIBUTES` arrives as one comma-separated
+   * string. Splitting on the comma makes both routes produce the same
+   * attribute, and is safe because no IPv4 or IPv6 literal contains one.
+   */
+  private static descriptiveList(
+    attrs: EntityAttributes,
+    key: string,
+  ): Array<string> {
+    const value: EntityAttributeValue | Array<EntityAttributeValue> = attrs
+      ? attrs[key]
+      : undefined;
+
+    if (Array.isArray(value)) {
+      const out: Array<string> = [];
+      for (const item of value) {
+        if (typeof item === "string") {
+          out.push(...item.split(","));
+        } else if (typeof item === "number" || typeof item === "boolean") {
+          out.push(String(item));
+        }
+      }
+      return out;
+    }
+
+    if (typeof value === "string") {
+      return value.split(",");
+    }
+
+    return [];
+  }
+
+  /**
+   * Bound one descriptive value. Truncation is silent by design: the
+   * alternative is dropping the attribute entirely, and a truncated
+   * manufacturer string still identifies the manufacturer.
+   *
+   * The cut steps back off a lone surrogate. `substring` counts UTF-16
+   * code units, so a cut that lands inside a surrogate pair leaves an
+   * unpaired half; `JSON.stringify` emits that as a bare `\uD83D`, which
+   * Postgres rejects when the value reaches the `jsonb` column. Reconcile
+   * swallows its errors, so the symptom would be an inventory row that
+   * silently stops updating rather than anything that surfaces.
+   */
+  private static truncateDescriptiveValue(value: string): string {
+    if (value.length <= MAX_DESCRIPTIVE_ATTRIBUTE_VALUE_LENGTH) {
+      return value;
+    }
+
+    let end: number = MAX_DESCRIPTIVE_ATTRIBUTE_VALUE_LENGTH;
+    const lastUnit: number = value.charCodeAt(end - 1);
+    const isHighSurrogate: boolean = lastUnit >= 0xd800 && lastUnit <= 0xdbff;
+    if (isHighSurrogate) {
+      end -= 1;
+    }
+
+    return value.substring(0, end);
+  }
+
   /**
    * Like `str`, but additionally accepts an array-valued attribute by
    * taking its first scalar element (e.g. semconv `container.image.tags`

package/SslCertificates/GlobalSign.crt

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIETjCCAzagAwIBAgINAe5fIh38YjvUMzqFVzANBgkqhkiG9w0BAQsFADBMMSAw
+HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFs
+U2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjAeFw0xODExMjEwMDAwMDBaFw0yODEx
+MjEwMDAwMDBaMFAxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52
+LXNhMSYwJAYDVQQDEx1HbG9iYWxTaWduIFJTQSBPViBTU0wgQ0EgMjAxODCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKdaydUMGCEAI9WXD+uu3Vxoa2uP
+UGATeoHLl+6OimGUSyZ59gSnKvuk2la77qCk8HuKf1UfR5NhDW5xUTolJAgvjOH3
+idaSz6+zpz8w7bXfIa7+9UQX/dhj2S/TgVprX9NHsKzyqzskeU8fxy7quRU6fBhM
+abO1IFkJXinDY+YuRluqlJBJDrnw9UqhCS98NE3QvADFBlV5Bs6i0BDxSEPouVq1
+lVW9MdIbPYa+oewNEtssmSStR8JvA+Z6cLVwzM0nLKWMjsIYPJLJLnNvBhBWk0Cq
+o8VS++XFBdZpaFwGue5RieGKDkFNm5KQConpFmvv73W+eka440eKHRwup08CAwEA
+AaOCASkwggElMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
+A1UdDgQWBBT473/yzXhnqN5vjySNiPGHAwKz6zAfBgNVHSMEGDAWgBSP8Et/qC5F
+JK5NUPpjmove4t0bvDA+BggrBgEFBQcBAQQyMDAwLgYIKwYBBQUHMAGGImh0dHA6
+Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9yb290cjMwNgYDVR0fBC8wLTAroCmgJ4Yl
+aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIzLmNybDBHBgNVHSAEQDA+
+MDwGBFUdIAAwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5j
+b20vcmVwb3NpdG9yeS8wDQYJKoZIhvcNAQELBQADggEBAJmQyC1fQorUC2bbmANz
+EdSIhlIoU4r7rd/9c446ZwTbw1MUcBQJfMPg+NccmBqixD7b6QDjynCy8SIwIVbb
+0615XoFYC20UgDX1b10d65pHBf9ZjQCxQNqQmJYaumxtf4z1s4DfjGRzNpZ5eWl0
+6r/4ngGPoJVpjemEuunl1Ig423g7mNA2eymw0lIYkN5SQwCuaifIFJ6GlazhgDEw
+fpolu4usBCOmmQDo8dIm7A9+O4orkjgTHY+GzYZSR+Y0fFukAj6KYXwidlNalFMz
+hriSqHKvoflShx8xpfywgVcvzfTO3PYkz6fiNJBonf6q8amaEsybwMbDqKWwIX7e
+SPY=
+-----END CERTIFICATE-----

package/SslCertificates/Readme.md

@@ -0,0 +1,3 @@
+# SSL Certificates 
+
+If there are missing SSL Certificates in the distro, then add them here. They will be added to Docker images.