@super-protocol/addons-tee 2.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bindings/amd-sev-snp-napi-rs/amd-sev-snp-napi-rs.linux-x64-gnu.node +0 -0
- package/bindings/amd-sev-snp-napi-rs/index.d.ts +51 -0
- package/bindings/amd-sev-snp-napi-rs/index.js +339 -0
- package/bindings/nvidia-native/build/Release/libnvat.so.1.1.0 +0 -0
- package/bindings/nvidia-native/build/Release/nvidia_native.node +0 -0
- package/bindings/sgx-native/build/Release/libmbedcrypto_gramine.so.15 +0 -0
- package/bindings/sgx-native/build/Release/libmbedx509_gramine.so.6 +0 -0
- package/bindings/sgx-native/build/Release/libsgx_dcap_quoteverify.so.1 +0 -0
- package/bindings/sgx-native/build/Release/libtdx_attest.so.1 +0 -0
- package/bindings/sgx-native/build/Release/sgx_native.node +0 -0
- package/bindings/usr/lib/node_modules/node-addon-api/node_api.Makefile +6 -0
- package/bindings/usr/lib/node_modules/node-addon-api/nothing.target.mk +159 -0
- package/bindings/utils/virtee/LICENSE +201 -0
- package/bindings/utils/virtee/libsev.so +0 -0
- package/bindings/utils/virtee/snpguest +0 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.js +29 -1
- package/dist/nvidia-native-module/nvidia-attestation.d.ts +146 -0
- package/dist/nvidia-native-module/nvidia-attestation.js +374 -0
- package/dist/nvidia-native-module/nvidia-debug-state-policy.rego +45 -0
- package/dist/nvidia-native-module/nvidia-detailed-policy.rego +205 -0
- package/dist/proto/AmdSevSnp.d.ts +194 -0
- package/dist/proto/AmdSevSnp.js +363 -0
- package/dist/sgx-native-module/consts.d.ts +24 -0
- package/dist/sgx-native-module/consts.js +38 -0
- package/dist/sgx-native-module/dcap-quote-verify.service.d.ts +12 -0
- package/dist/sgx-native-module/dcap-quote-verify.service.js +84 -0
- package/dist/sgx-native-module/enclave.service.d.ts +93 -0
- package/dist/sgx-native-module/enclave.service.js +211 -0
- package/dist/sgx-native-module/errors.d.ts +19 -0
- package/dist/sgx-native-module/errors.js +69 -0
- package/dist/sgx-native-module/helpers.d.ts +1 -0
- package/dist/sgx-native-module/helpers.js +50 -0
- package/dist/sgx-native-module/index.d.ts +9 -0
- package/dist/sgx-native-module/index.js +26 -0
- package/dist/sgx-native-module/pki.service.d.ts +50 -0
- package/dist/sgx-native-module/pki.service.js +74 -0
- package/dist/sgx-native-module/sev-snp-mrenclave.d.ts +59 -0
- package/dist/sgx-native-module/sev-snp-mrenclave.js +322 -0
- package/dist/sgx-native-module/sev-snp-schema.d.ts +22 -0
- package/dist/sgx-native-module/sev-snp-schema.js +24 -0
- package/dist/sgx-native-module/sev-snp.d.ts +127 -0
- package/dist/sgx-native-module/sev-snp.js +513 -0
- package/package.json +1 -1
|
@@ -0,0 +1,513 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
19
|
+
if (mod && mod.__esModule) return mod;
|
|
20
|
+
var result = {};
|
|
21
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
22
|
+
__setModuleDefault(result, mod);
|
|
23
|
+
return result;
|
|
24
|
+
};
|
|
25
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
26
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
27
|
+
};
|
|
28
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
29
|
+
exports.SevSNP = exports.getDefaultArkHashes = exports.EMPTY_INITRD_SHA256_HASH = exports.AMD_EPYC_MILAN_CPUINFO = void 0;
|
|
30
|
+
const amd_sev_snp_napi_rs_1 = require("../../bindings/amd-sev-snp-napi-rs/");
|
|
31
|
+
const sdk_js_1 = require("@super-protocol/sdk-js");
|
|
32
|
+
const axios_1 = __importDefault(require("axios"));
|
|
33
|
+
const forge = __importStar(require("node-forge"));
|
|
34
|
+
const fs = __importStar(require("fs/promises"));
|
|
35
|
+
const path = __importStar(require("path"));
|
|
36
|
+
const os = __importStar(require("os"));
|
|
37
|
+
const child_process_1 = require("child_process");
|
|
38
|
+
const crypto_1 = require("crypto");
|
|
39
|
+
const helpers_1 = require("./helpers");
|
|
40
|
+
const AmdSevSnp_1 = require("../proto/AmdSevSnp");
|
|
41
|
+
const sev_snp_schema_1 = require("./sev-snp-schema");
|
|
42
|
+
const value_1 = require("@sinclair/typebox/value");
|
|
43
|
+
exports.AMD_EPYC_MILAN_CPUINFO = {
|
|
44
|
+
family: 25,
|
|
45
|
+
model: 1,
|
|
46
|
+
stepping: 1,
|
|
47
|
+
};
|
|
48
|
+
exports.EMPTY_INITRD_SHA256_HASH = Buffer.from("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "hex");
|
|
49
|
+
function getDefaultArkHashes() {
|
|
50
|
+
const ark_hashes = {};
|
|
51
|
+
ark_hashes["ARK-Milan"] = SevSNP.getCertHash({
|
|
52
|
+
format: AmdSevSnp_1.SevSnpCertificateFormat.PEM,
|
|
53
|
+
cert: Buffer.from(amd_sev_snp_napi_rs_1.ARK_MILAN_PEM),
|
|
54
|
+
type: AmdSevSnp_1.SevSNPCertType.ARK,
|
|
55
|
+
});
|
|
56
|
+
ark_hashes["ARK-Genoa"] = SevSNP.getCertHash({
|
|
57
|
+
format: AmdSevSnp_1.SevSnpCertificateFormat.PEM,
|
|
58
|
+
cert: Buffer.from(amd_sev_snp_napi_rs_1.ARK_GENOA_PEM),
|
|
59
|
+
type: AmdSevSnp_1.SevSNPCertType.ARK,
|
|
60
|
+
});
|
|
61
|
+
ark_hashes["ARK-Turin"] = SevSNP.getCertHash({
|
|
62
|
+
format: AmdSevSnp_1.SevSnpCertificateFormat.PEM,
|
|
63
|
+
cert: Buffer.from(amd_sev_snp_napi_rs_1.ARK_TURIN_PEM),
|
|
64
|
+
type: AmdSevSnp_1.SevSNPCertType.ARK,
|
|
65
|
+
});
|
|
66
|
+
return ark_hashes;
|
|
67
|
+
}
|
|
68
|
+
exports.getDefaultArkHashes = getDefaultArkHashes;
|
|
69
|
+
class SevSNP {
|
|
70
|
+
static serializeSNPReport(report) {
|
|
71
|
+
return Buffer.from(AmdSevSnp_1.SNPReportWithChain.encode(report).finish());
|
|
72
|
+
}
|
|
73
|
+
static deserializeSNPReport(serialized) {
|
|
74
|
+
return AmdSevSnp_1.SNPReportWithChain.decode(serialized);
|
|
75
|
+
}
|
|
76
|
+
static convertCertToPem(cert) {
|
|
77
|
+
const pemHeader = "-----BEGIN CERTIFICATE-----\n";
|
|
78
|
+
const pemFooter = "\n-----END CERTIFICATE-----";
|
|
79
|
+
if (cert.slice(0, pemHeader.length).compare(Buffer.from(pemHeader)) === 0) {
|
|
80
|
+
return cert.toString();
|
|
81
|
+
}
|
|
82
|
+
const formattedBase64 = cert
|
|
83
|
+
.toString("base64")
|
|
84
|
+
.match(/.{1,64}/g)
|
|
85
|
+
?.join("\n");
|
|
86
|
+
return pemHeader + formattedBase64 + pemFooter;
|
|
87
|
+
}
|
|
88
|
+
static convertPemToDer(cert) {
|
|
89
|
+
return Buffer.from(forge.pki.pemToDer(cert).getBytes(), "binary");
|
|
90
|
+
}
|
|
91
|
+
static splitCerts(certsPem) {
|
|
92
|
+
const certRegex = /-----BEGIN CERTIFICATE-----(?:\s|.)*?-----END CERTIFICATE-----/g;
|
|
93
|
+
const matches = certsPem.match(certRegex);
|
|
94
|
+
return Array.from(matches || []);
|
|
95
|
+
}
|
|
96
|
+
static async readCmdLine() {
|
|
97
|
+
const data = await fs.readFile("/proc/cmdline", "utf-8");
|
|
98
|
+
// Workaround: VM in direct boot mode sometimes adds to the end of the cmdline initrd=initrd, need to remove it
|
|
99
|
+
return data.replace(/initrd=initrd\s*/, "");
|
|
100
|
+
}
|
|
101
|
+
/**
|
|
102
|
+
* Method for generation AMD SEV-SNP Report
|
|
103
|
+
* @param userData - The data that will be included in the report and will be signed
|
|
104
|
+
* @param vmpl - Optional VMPL value to pass to the firmware when requesting a report (default: 0)
|
|
105
|
+
*/
|
|
106
|
+
static async generateSNPReport(userData, vmpl = 0) {
|
|
107
|
+
if (userData.length > amd_sev_snp_napi_rs_1.SNP_REPORT_DATA_SIZE) {
|
|
108
|
+
throw new Error(`userData cannot exceed ${amd_sev_snp_napi_rs_1.SNP_REPORT_DATA_SIZE} bytes.`);
|
|
109
|
+
}
|
|
110
|
+
if (vmpl < 0 || vmpl > 3) {
|
|
111
|
+
throw new Error(`vmpl must be in range [0..3], got: ${vmpl}`);
|
|
112
|
+
}
|
|
113
|
+
const paddedUserData = Buffer.alloc(amd_sev_snp_napi_rs_1.SNP_REPORT_DATA_SIZE);
|
|
114
|
+
userData.copy(paddedUserData);
|
|
115
|
+
const rawReport = (0, amd_sev_snp_napi_rs_1.getSnpReport)(paddedUserData, vmpl);
|
|
116
|
+
const cpuInfo = (0, amd_sev_snp_napi_rs_1.getCpuInfo)();
|
|
117
|
+
const cpuSig = (0, amd_sev_snp_napi_rs_1.getCpuSig)(cpuInfo);
|
|
118
|
+
const cores = (0, amd_sev_snp_napi_rs_1.getLogicalCoresCount)();
|
|
119
|
+
const cmdLine = await SevSNP.readCmdLine();
|
|
120
|
+
return {
|
|
121
|
+
rawReport,
|
|
122
|
+
cpuSig,
|
|
123
|
+
cores,
|
|
124
|
+
cmdLineHash: SevSNP.calculateCmdlineHash(cmdLine),
|
|
125
|
+
build: SevSNP.extractBuildFromCmdline(cmdLine),
|
|
126
|
+
};
|
|
127
|
+
}
|
|
128
|
+
/**
|
|
129
|
+
* Method for fetch certificates from AMD KDS
|
|
130
|
+
* @param report - report generated by the `generateSNPReport` method
|
|
131
|
+
* @param options - options for working with HTTP, allows you to configure repetitions and the interval between them,
|
|
132
|
+
* as well as the format of the returned certificates
|
|
133
|
+
*/
|
|
134
|
+
static async getReportChain(report, options) {
|
|
135
|
+
const retryMax = options?.retryMax ?? 50;
|
|
136
|
+
const retryInterval = options?.retryInterval ?? Math.floor(Math.random() * 10000) + 5000;
|
|
137
|
+
const certFormat = options?.certFormat ?? AmdSevSnp_1.SevSnpCertificateFormat.DER;
|
|
138
|
+
const certs = [];
|
|
139
|
+
const axiosInstance = axios_1.default.create({ timeout: options?.httpTimeoutMs ?? 10000 });
|
|
140
|
+
let vcek = Buffer.alloc(0);
|
|
141
|
+
let cpuGeneration = amd_sev_snp_napi_rs_1.WellKnownSnpCodeNames.Milan;
|
|
142
|
+
let generations = Object.values(amd_sev_snp_napi_rs_1.WellKnownSnpCodeNames);
|
|
143
|
+
// Try to detect CPU generation from the report itself. If detection
|
|
144
|
+
// succeeds, only attempt to fetch VCEK for the detected generation.
|
|
145
|
+
try {
|
|
146
|
+
const cpuInfo = await SevSNP.getReportCpuInfo(Buffer.from(report.rawReport));
|
|
147
|
+
const detected = await SevSNP.getCpuGeneration(cpuInfo);
|
|
148
|
+
generations = [detected];
|
|
149
|
+
}
|
|
150
|
+
catch (err) {
|
|
151
|
+
// Detection failed or report doesn't contain CPU info; fall back to
|
|
152
|
+
// trying all known generations.
|
|
153
|
+
}
|
|
154
|
+
for (const generation of generations) {
|
|
155
|
+
cpuGeneration = generation;
|
|
156
|
+
const vcekUrl = (0, amd_sev_snp_napi_rs_1.getVcekKdsUrl)(Buffer.from(report.rawReport), generation);
|
|
157
|
+
try {
|
|
158
|
+
const response = await sdk_js_1.helpers.tryWithInterval({
|
|
159
|
+
checkResult(response) {
|
|
160
|
+
return { isResultOk: response.status === 200 };
|
|
161
|
+
},
|
|
162
|
+
handler() {
|
|
163
|
+
return axiosInstance.get(vcekUrl, {
|
|
164
|
+
responseType: "arraybuffer",
|
|
165
|
+
});
|
|
166
|
+
},
|
|
167
|
+
checkError(err) {
|
|
168
|
+
if (axios_1.default.isAxiosError(err) && err.response) {
|
|
169
|
+
const status = err.response.status;
|
|
170
|
+
return { retryable: status == 429 };
|
|
171
|
+
}
|
|
172
|
+
return { retryable: axios_1.default.isAxiosError(err) };
|
|
173
|
+
},
|
|
174
|
+
retryInterval,
|
|
175
|
+
retryMax,
|
|
176
|
+
});
|
|
177
|
+
vcek = response.data;
|
|
178
|
+
break;
|
|
179
|
+
}
|
|
180
|
+
catch (err) {
|
|
181
|
+
const isLast = generation === generations[generations.length - 1];
|
|
182
|
+
if (isLast) {
|
|
183
|
+
throw err;
|
|
184
|
+
}
|
|
185
|
+
}
|
|
186
|
+
}
|
|
187
|
+
const pemVcek = SevSNP.convertCertToPem(vcek);
|
|
188
|
+
certs.push({
|
|
189
|
+
type: AmdSevSnp_1.SevSNPCertType.VCEK,
|
|
190
|
+
format: certFormat,
|
|
191
|
+
cert: certFormat === AmdSevSnp_1.SevSnpCertificateFormat.PEM ? Buffer.from(pemVcek) : SevSNP.convertPemToDer(pemVcek),
|
|
192
|
+
});
|
|
193
|
+
const caUrl = `${amd_sev_snp_napi_rs_1.KDS_CERT_SITE}/${amd_sev_snp_napi_rs_1.KDS_VCEK}/${cpuGeneration}/cert_chain`;
|
|
194
|
+
const response = await sdk_js_1.helpers.tryWithInterval({
|
|
195
|
+
checkResult(response) {
|
|
196
|
+
return { isResultOk: response.status === 200 };
|
|
197
|
+
},
|
|
198
|
+
handler() {
|
|
199
|
+
return axiosInstance.get(caUrl, {
|
|
200
|
+
responseType: "arraybuffer",
|
|
201
|
+
});
|
|
202
|
+
},
|
|
203
|
+
checkError(err) {
|
|
204
|
+
if (axios_1.default.isAxiosError(err) && err.response) {
|
|
205
|
+
const status = err.response.status;
|
|
206
|
+
return { retryable: status == 429 };
|
|
207
|
+
}
|
|
208
|
+
return { retryable: axios_1.default.isAxiosError(err) };
|
|
209
|
+
},
|
|
210
|
+
retryInterval,
|
|
211
|
+
retryMax,
|
|
212
|
+
});
|
|
213
|
+
const CAChain = SevSNP.splitCerts(response.data.toString());
|
|
214
|
+
if (CAChain.length !== 2) {
|
|
215
|
+
throw new Error("Cert chain must have 2 certificates");
|
|
216
|
+
}
|
|
217
|
+
certs.push({
|
|
218
|
+
type: AmdSevSnp_1.SevSNPCertType.ARK,
|
|
219
|
+
format: certFormat,
|
|
220
|
+
cert: certFormat === AmdSevSnp_1.SevSnpCertificateFormat.PEM
|
|
221
|
+
? Buffer.from(CAChain[1])
|
|
222
|
+
: SevSNP.convertPemToDer(CAChain[1]),
|
|
223
|
+
});
|
|
224
|
+
certs.push({
|
|
225
|
+
type: AmdSevSnp_1.SevSNPCertType.ASK,
|
|
226
|
+
format: certFormat,
|
|
227
|
+
cert: certFormat === AmdSevSnp_1.SevSnpCertificateFormat.PEM
|
|
228
|
+
? Buffer.from(CAChain[0])
|
|
229
|
+
: SevSNP.convertPemToDer(CAChain[0]),
|
|
230
|
+
});
|
|
231
|
+
return certs;
|
|
232
|
+
}
|
|
233
|
+
/**
|
|
234
|
+
* Method for generation AMD SEV-SNP Report and fetching certificates
|
|
235
|
+
* @param userData - @see generateSNPReport
|
|
236
|
+
* @param options - @see getReportChain
|
|
237
|
+
*/
|
|
238
|
+
static async generateSNPReportWithChain(userData, options) {
|
|
239
|
+
const snpReport = await SevSNP.generateSNPReport(userData);
|
|
240
|
+
const certs = await SevSNP.getReportChain(snpReport, options);
|
|
241
|
+
return {
|
|
242
|
+
snpReport,
|
|
243
|
+
certs: certs,
|
|
244
|
+
};
|
|
245
|
+
}
|
|
246
|
+
static async runSubProcess(binaryPath, args = [], options = {}) {
|
|
247
|
+
return new Promise((resolve, reject) => {
|
|
248
|
+
const subprocess = (0, child_process_1.spawn)(binaryPath, args, {
|
|
249
|
+
cwd: options.cwd,
|
|
250
|
+
stdio: "pipe",
|
|
251
|
+
});
|
|
252
|
+
let stdout = "";
|
|
253
|
+
let stderr = "";
|
|
254
|
+
subprocess.stdout?.on("data", (chunk) => (stdout += chunk.toString()));
|
|
255
|
+
subprocess.stderr?.on("data", (chunk) => (stderr += chunk.toString()));
|
|
256
|
+
let timeoutId;
|
|
257
|
+
if (options.timeoutMs && options.timeoutMs > 0) {
|
|
258
|
+
timeoutId = setTimeout(() => {
|
|
259
|
+
subprocess.kill();
|
|
260
|
+
reject(new Error(`Process timed out after ${options.timeoutMs}ms`));
|
|
261
|
+
}, options.timeoutMs);
|
|
262
|
+
}
|
|
263
|
+
subprocess.on("close", (exitCode) => {
|
|
264
|
+
if (timeoutId)
|
|
265
|
+
clearTimeout(timeoutId);
|
|
266
|
+
resolve({
|
|
267
|
+
exitCode: exitCode || 0,
|
|
268
|
+
stdout,
|
|
269
|
+
stderr,
|
|
270
|
+
});
|
|
271
|
+
});
|
|
272
|
+
subprocess.on("error", (error) => {
|
|
273
|
+
if (timeoutId)
|
|
274
|
+
clearTimeout(timeoutId);
|
|
275
|
+
reject(new Error(`Failed to start process: ${error.message}`));
|
|
276
|
+
});
|
|
277
|
+
});
|
|
278
|
+
}
|
|
279
|
+
static getCertHash(cert) {
|
|
280
|
+
const hash = (0, crypto_1.createHash)("sha256");
|
|
281
|
+
if (cert.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM) {
|
|
282
|
+
hash.update(SevSNP.convertPemToDer(cert.cert.toString()));
|
|
283
|
+
}
|
|
284
|
+
else {
|
|
285
|
+
hash.update(cert.cert);
|
|
286
|
+
}
|
|
287
|
+
return hash.digest();
|
|
288
|
+
}
|
|
289
|
+
static isValidArk(ARK, trustedHashes) {
|
|
290
|
+
const ArkCert = forge.pki.certificateFromPem(ARK.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM
|
|
291
|
+
? ARK.cert.toString()
|
|
292
|
+
: SevSNP.convertCertToPem(Buffer.from(ARK.cert)));
|
|
293
|
+
const ArkCN = ArkCert.subject.attributes.find((attr) => attr.name === "commonName")?.value;
|
|
294
|
+
if (!ArkCN) {
|
|
295
|
+
throw new Error("Can't extract CN from ARK certificate");
|
|
296
|
+
}
|
|
297
|
+
const ArkHash = SevSNP.getCertHash(ARK);
|
|
298
|
+
const TrustedHash = (trustedHashes && trustedHashes[ArkCN]) || Buffer.alloc(0);
|
|
299
|
+
return ArkHash.equals(TrustedHash);
|
|
300
|
+
}
|
|
301
|
+
/**
|
|
302
|
+
* AMD SEV-SNP verification method
|
|
303
|
+
* @param report - report with full certificate chain
|
|
304
|
+
* @param options - trustedHashes - map of trusted AMD ARK Certificates (CommonName as Key, Sha256 Hash of Der Certificate as Value) - optional
|
|
305
|
+
* timeoutMs - timeout of the utility snpnost in ms
|
|
306
|
+
* snpGuestBinaryPath - path for snpguest util
|
|
307
|
+
*/
|
|
308
|
+
static async verifyReport(report, options) {
|
|
309
|
+
const trustedHashes = options?.trustedHashes ?? getDefaultArkHashes();
|
|
310
|
+
const timeoutMs = options?.timeoutMs ?? 10000;
|
|
311
|
+
const snpGuestBinaryPath = options?.snpGuestBinaryPath ?? path.resolve(__dirname, "../../bindings/utils/virtee/snpguest");
|
|
312
|
+
const tmpDirTemplate = options?.tmpDirTemplate ?? path.join(os.tmpdir(), "temp-");
|
|
313
|
+
if (!path.isAbsolute(snpGuestBinaryPath)) {
|
|
314
|
+
throw new Error("snpGuestBinaryPath must be an absolute path");
|
|
315
|
+
}
|
|
316
|
+
const ARK = report.certs.find((cert) => cert.type === AmdSevSnp_1.SevSNPCertType.ARK);
|
|
317
|
+
if (!ARK) {
|
|
318
|
+
throw new Error("Can't find ARK certificate in certificate chain");
|
|
319
|
+
}
|
|
320
|
+
if (!SevSNP.isValidArk(ARK, trustedHashes)) {
|
|
321
|
+
throw new Error("The supplied certificate chain contains an untrusted root certificate");
|
|
322
|
+
}
|
|
323
|
+
const tempDir = await fs.mkdtemp(tmpDirTemplate);
|
|
324
|
+
try {
|
|
325
|
+
for (const certEntry of report.certs) {
|
|
326
|
+
const fileName = (0, AmdSevSnp_1.sevSNPCertTypeToJSON)(certEntry.type).toLowerCase();
|
|
327
|
+
const extension = certEntry.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM ? "pem" : "der";
|
|
328
|
+
await fs.writeFile(`${tempDir}/${fileName}.${extension}`, certEntry.cert, certEntry.format === AmdSevSnp_1.SevSnpCertificateFormat.PEM ? "utf8" : undefined);
|
|
329
|
+
}
|
|
330
|
+
const reportPath = `${tempDir}/report.bin`;
|
|
331
|
+
await fs.writeFile(reportPath, Buffer.from(report.snpReport.rawReport));
|
|
332
|
+
const snpguestRes = await SevSNP.runSubProcess(snpGuestBinaryPath, ["verify", "attestation", tempDir, reportPath], { timeoutMs });
|
|
333
|
+
if (snpguestRes.exitCode != 0) {
|
|
334
|
+
throw new Error(`Error validating report. Output: ${snpguestRes.stdout}\n${snpguestRes.stderr}`);
|
|
335
|
+
}
|
|
336
|
+
}
|
|
337
|
+
finally {
|
|
338
|
+
await (0, helpers_1.gramineCompatibleRmDir)(tempDir);
|
|
339
|
+
}
|
|
340
|
+
}
|
|
341
|
+
static calcMrEnclave(measure, vmpl, policy) {
|
|
342
|
+
const hash = (0, crypto_1.createHash)("sha256");
|
|
343
|
+
hash.update(measure);
|
|
344
|
+
const vmplBuf = Buffer.alloc(4);
|
|
345
|
+
vmplBuf.writeUInt32LE(vmpl, 0);
|
|
346
|
+
hash.update(vmplBuf);
|
|
347
|
+
const policyBuf = Buffer.alloc(8);
|
|
348
|
+
policyBuf.writeBigUint64LE(policy, 0);
|
|
349
|
+
hash.update(policyBuf);
|
|
350
|
+
return hash.digest();
|
|
351
|
+
}
|
|
352
|
+
/**
|
|
353
|
+
* Method for obtaining mrEnclave from report. MrEnclave includes report measure, report vmpl and report policy
|
|
354
|
+
* @param report - report without certificates
|
|
355
|
+
*/
|
|
356
|
+
static getMrEnclave(report) {
|
|
357
|
+
const measure = (0, amd_sev_snp_napi_rs_1.getReportMeasure)(report);
|
|
358
|
+
const vmpl = (0, amd_sev_snp_napi_rs_1.getReportVmpl)(report);
|
|
359
|
+
const policy = (0, amd_sev_snp_napi_rs_1.getReportPolicy)(report);
|
|
360
|
+
return SevSNP.calcMrEnclave(measure, vmpl, policy);
|
|
361
|
+
}
|
|
362
|
+
/**
|
|
363
|
+
* Method for obtaining reportData. This data was passed when generating the report
|
|
364
|
+
* @param report - report without certificates
|
|
365
|
+
*/
|
|
366
|
+
static async getReportData(report) {
|
|
367
|
+
return (0, amd_sev_snp_napi_rs_1.getReportData)(report);
|
|
368
|
+
}
|
|
369
|
+
/**
|
|
370
|
+
* Method for obtaining measure. Please do not confuse with mrenclave. Report measure is part of mrEnclave.
|
|
371
|
+
* @param report - report without certificates
|
|
372
|
+
*/
|
|
373
|
+
static async getReportMeasure(report) {
|
|
374
|
+
return (0, amd_sev_snp_napi_rs_1.getReportMeasure)(report);
|
|
375
|
+
}
|
|
376
|
+
static async calculateFileSha256(filePath) {
|
|
377
|
+
const fileData = await fs.readFile(filePath);
|
|
378
|
+
const hash = (0, crypto_1.createHash)("sha256");
|
|
379
|
+
hash.update(fileData);
|
|
380
|
+
return hash.digest();
|
|
381
|
+
}
|
|
382
|
+
static calculateCmdlineHash(cmdLine) {
|
|
383
|
+
const cmdLineBytes = Buffer.concat([Buffer.from(cmdLine.trim(), "utf-8"), Buffer.from([0])]);
|
|
384
|
+
const hash = (0, crypto_1.createHash)("sha256");
|
|
385
|
+
hash.update(cmdLineBytes);
|
|
386
|
+
return hash.digest();
|
|
387
|
+
}
|
|
388
|
+
/**
|
|
389
|
+
* The method allows to get the expected mrEnclave without generating a report
|
|
390
|
+
* @param params - @see CalcSnpMrEnclaveParams
|
|
391
|
+
*/
|
|
392
|
+
static async calcSnpMrEnclave(params) {
|
|
393
|
+
const measure = (0, amd_sev_snp_napi_rs_1.calcSnpMeasure)(params.ovmfPath, params.kernelHash, params.initrdHash ?? exports.EMPTY_INITRD_SHA256_HASH, params.cmdLineHash, params.vcpuSig, params.vcpuCount);
|
|
394
|
+
return SevSNP.calcMrEnclave(measure, params.vmpl ?? 0, params.policy ?? BigInt(0x30000));
|
|
395
|
+
}
|
|
396
|
+
static extractBuildFromCmdline(cmdLine, paramName = "build") {
|
|
397
|
+
const regex = new RegExp(`${paramName}=([^\\s]+)`);
|
|
398
|
+
const match = cmdLine.match(regex);
|
|
399
|
+
if (match) {
|
|
400
|
+
return match[1];
|
|
401
|
+
}
|
|
402
|
+
else {
|
|
403
|
+
throw new Error(`${paramName} parameter not found`);
|
|
404
|
+
}
|
|
405
|
+
}
|
|
406
|
+
/**
|
|
407
|
+
* Compute the 32-bit CPUID signature from family, model, and stepping.
|
|
408
|
+
* This computation is described in AMD's CPUID Specification, publication #25481
|
|
409
|
+
* https://www.amd.com/system/files/TechDocs/25481.pdf
|
|
410
|
+
* See section: CPUID Fn0000_0001_EAX Family, Model, Stepping Identifiers
|
|
411
|
+
* @param cpuInfo - Structure containing family, model and stepping @see CpuInfo
|
|
412
|
+
*/
|
|
413
|
+
static getCpuSig(cpuInfo) {
|
|
414
|
+
return (0, amd_sev_snp_napi_rs_1.getCpuSig)(cpuInfo);
|
|
415
|
+
}
|
|
416
|
+
static async getReportImportantSecurityFields(report) {
|
|
417
|
+
return (0, amd_sev_snp_napi_rs_1.getReportImportantSecurityFields)(report);
|
|
418
|
+
}
|
|
419
|
+
static async getReportCpuInfo(report) {
|
|
420
|
+
return (0, amd_sev_snp_napi_rs_1.getReportCpuInfo)(report);
|
|
421
|
+
}
|
|
422
|
+
static async getCpuGeneration(cpuInfo) {
|
|
423
|
+
return (0, amd_sev_snp_napi_rs_1.getCpuGeneration)(cpuInfo);
|
|
424
|
+
}
|
|
425
|
+
/**
|
|
426
|
+
* Parse and validate policy
|
|
427
|
+
* @param input - Raw policy as json-text or object
|
|
428
|
+
*/
|
|
429
|
+
static parsePolicySet(input) {
|
|
430
|
+
let parsed;
|
|
431
|
+
if (typeof input === "string") {
|
|
432
|
+
if (input.trim().length === 0) {
|
|
433
|
+
return {};
|
|
434
|
+
}
|
|
435
|
+
try {
|
|
436
|
+
parsed = JSON.parse(input);
|
|
437
|
+
}
|
|
438
|
+
catch (error) {
|
|
439
|
+
throw new Error(`Failed to parse policy JSON: ${error instanceof Error ? error.message : String(error)}`);
|
|
440
|
+
}
|
|
441
|
+
}
|
|
442
|
+
else {
|
|
443
|
+
parsed = input;
|
|
444
|
+
}
|
|
445
|
+
const { isValid } = (0, sdk_js_1.validateBySchema)(parsed, sev_snp_schema_1.PolicySetSchema);
|
|
446
|
+
if (!isValid) {
|
|
447
|
+
const validationErrors = Array.from(value_1.Value.Errors(sev_snp_schema_1.PolicySetSchema, parsed));
|
|
448
|
+
const details = validationErrors.map((e) => e.message).join(", ");
|
|
449
|
+
throw new Error(`Failed to validate policy JSON${details ? `: ${details}` : ""}`);
|
|
450
|
+
}
|
|
451
|
+
return parsed;
|
|
452
|
+
}
|
|
453
|
+
static checkRule(rule, fields) {
|
|
454
|
+
const fieldValue = fields[rule.name];
|
|
455
|
+
const isBoolean = typeof fieldValue === "boolean";
|
|
456
|
+
const isNumber = typeof fieldValue === "number";
|
|
457
|
+
if (isBoolean) {
|
|
458
|
+
if (rule.operator !== sev_snp_schema_1.RuleOperator.Eq) {
|
|
459
|
+
throw new Error(`Invalid operator "${rule.operator}" for boolean field "${rule.name}". Only "eq" is allowed for boolean fields.`);
|
|
460
|
+
}
|
|
461
|
+
const expectedBoolean = typeof rule.value === "boolean" ? rule.value : Boolean(rule.value);
|
|
462
|
+
return fieldValue === expectedBoolean;
|
|
463
|
+
}
|
|
464
|
+
if (isNumber) {
|
|
465
|
+
switch (rule.operator) {
|
|
466
|
+
case sev_snp_schema_1.RuleOperator.Le:
|
|
467
|
+
return fieldValue <= rule.value;
|
|
468
|
+
case sev_snp_schema_1.RuleOperator.Eq:
|
|
469
|
+
return fieldValue === rule.value;
|
|
470
|
+
case sev_snp_schema_1.RuleOperator.Ge:
|
|
471
|
+
return fieldValue >= rule.value;
|
|
472
|
+
default:
|
|
473
|
+
throw new Error(`Unknown rule operator: ${rule.operator}`);
|
|
474
|
+
}
|
|
475
|
+
}
|
|
476
|
+
throw new Error(`Unsupported field type for "${rule.name}": ${typeof fieldValue}`);
|
|
477
|
+
}
|
|
478
|
+
/**
|
|
479
|
+
* Verify SNP report against a PolicySet.
|
|
480
|
+
* Throws an error if any rule fails.
|
|
481
|
+
* @param report - SNPReport
|
|
482
|
+
* @param policySet - PolicySet containing rules
|
|
483
|
+
*/
|
|
484
|
+
static async verifyPolicy(report, policySet) {
|
|
485
|
+
if (Object.keys(policySet).length === 0) {
|
|
486
|
+
return; // No policy set provided, consider it valid
|
|
487
|
+
}
|
|
488
|
+
const fields = await this.getReportImportantSecurityFields(report);
|
|
489
|
+
const commonPolicy = policySet[sev_snp_schema_1.CommonPolicyKeyName];
|
|
490
|
+
if (commonPolicy) {
|
|
491
|
+
for (const rule of commonPolicy) {
|
|
492
|
+
if (!this.checkRule(rule, fields)) {
|
|
493
|
+
const fieldValue = fields[rule.name];
|
|
494
|
+
throw new Error(`Policy violation in "commonPolicy": field "${rule.name}" has value ${JSON.stringify(fieldValue)}, ` +
|
|
495
|
+
`expected ${rule.operator} ${JSON.stringify(rule.value)}`);
|
|
496
|
+
}
|
|
497
|
+
}
|
|
498
|
+
}
|
|
499
|
+
const cpuGen = await this.getCpuGeneration(await this.getReportCpuInfo(report));
|
|
500
|
+
const cpuPolicy = policySet[cpuGen];
|
|
501
|
+
if (cpuPolicy) {
|
|
502
|
+
for (const rule of cpuPolicy) {
|
|
503
|
+
if (!this.checkRule(rule, fields)) {
|
|
504
|
+
const fieldValue = fields[rule.name];
|
|
505
|
+
throw new Error(`Policy violation in "${cpuGen}": field "${rule.name}" has value ${JSON.stringify(fieldValue)}, ` +
|
|
506
|
+
`expected ${rule.operator} ${JSON.stringify(rule.value)}`);
|
|
507
|
+
}
|
|
508
|
+
}
|
|
509
|
+
}
|
|
510
|
+
}
|
|
511
|
+
}
|
|
512
|
+
exports.SevSNP = SevSNP;
|
|
513
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V2LXNucC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZ3gtbmF0aXZlLW1vZHVsZS9zZXYtc25wLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkVBdUI2QztBQUU3QyxtREFBaUY7QUFDakYsa0RBQTZDO0FBQzdDLGtEQUFvQztBQUVwQyxnREFBa0M7QUFDbEMsMkNBQTZCO0FBQzdCLHVDQUF5QjtBQUN6QixpREFBc0M7QUFDdEMsbUNBQW9DO0FBQ3BDLHVDQUFtRDtBQUNuRCxrREFPNEI7QUFDNUIscURBQTZHO0FBQzdHLG1EQUFnRDtBQWFuQyxRQUFBLHNCQUFzQixHQUFZO0lBQzNDLE1BQU0sRUFBRSxFQUFFO0lBQ1YsS0FBSyxFQUFFLENBQUM7SUFDUixRQUFRLEVBQUUsQ0FBQztDQUNkLENBQUM7QUFFVyxRQUFBLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQy9DLGtFQUFrRSxFQUNsRSxLQUFLLENBQ1IsQ0FBQztBQUlGLFNBQWdCLG1CQUFtQjtJQUMvQixNQUFNLFVBQVUsR0FBOEIsRUFBRSxDQUFDO0lBRWpELFVBQVUsQ0FBQyxXQUFXLENBQUMsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDO1FBQ3pDLE1BQU0sRUFBRSxtQ0FBdUIsQ0FBQyxHQUFHO1FBQ25DLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFhLENBQUM7UUFDaEMsSUFBSSxFQUFFLDBCQUFjLENBQUMsR0FBRztLQUMzQixDQUFDLENBQUM7SUFFSCxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQztRQUN6QyxNQUFNLEVBQUUsbUNBQXVCLENBQUMsR0FBRztRQUNuQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxtQ0FBYSxDQUFDO1FBQ2hDLElBQUksRUFBRSwwQkFBYyxDQUFDLEdBQUc7S0FDM0IsQ0FBQyxDQUFDO0lBRUgsVUFBVSxDQUFDLFdBQVcsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDekMsTUFBTSxFQUFFLG1DQUF1QixDQUFDLEdBQUc7UUFDbkMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUNBQWEsQ0FBQztRQUNoQyxJQUFJLEVBQUUsMEJBQWMsQ0FBQyxHQUFHO0tBQzNCLENBQUMsQ0FBQztJQUVILE9BQU8sVUFBVSxDQUFDO0FBQ3RCLENBQUM7QUF0QkQsa0RBc0JDO0FBRUQsTUFBYSxNQUFNO0lBQ1IsTUFBTSxDQUFDLGtCQUFrQixDQUFDLE1BQTBCO1FBQ3ZELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBa0IsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRU0sTUFBTSxDQUFDLG9CQUFvQixDQUFDLFVBQWtCO1FBQ2pELE9BQU8sOEJBQWtCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFFUyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsSUFBWTtRQUMxQyxNQUFNLFNBQVMsR0FBRywrQkFBK0IsQ0FBQztRQUNsRCxNQUFNLFNBQVMsR0FBRyw2QkFBNkIsQ0FBQztRQUVoRCxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE9BQU8sSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQzNCLENBQUM7UUFDRCxNQUFNLGVBQWUsR0FBRyxJQUFJO2FBQ3ZCLFFBQVEsQ0FBQyxRQUFRLENBQUM7YUFDbEIsS0FBSyxDQUFDLFVBQVUsQ0FBQztZQUNsQixFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVqQixPQUFPLFNBQVMsR0FBRyxlQUFlLEdBQUcsU0FBUyxDQUFDO0lBQ25ELENBQUM7SUFFUyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQVk7UUFDekMsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFFUyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQWdCO1FBQ3hDLE1BQU0sU0FBUyxHQUFHLGlFQUFpRSxDQUFDO1FBQ3BGLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7UUFFMUMsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBRVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxXQUFXO1FBQzlCLE1BQU0sSUFBSSxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDekQsK0dBQStHO1FBQy9HLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsUUFBZ0IsRUFBRSxPQUFlLENBQUM7UUFDcEUsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLDBDQUFvQixFQUFFLENBQUM7WUFDekMsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsMENBQW9CLFNBQVMsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFFRCxJQUFJLElBQUksR0FBRyxDQUFDLElBQUksSUFBSSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsMENBQW9CLENBQUMsQ0FBQztRQUMxRCxRQUFRLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBRTlCLE1BQU0sU0FBUyxHQUFHLElBQUEsa0NBQVksRUFBQyxjQUFjLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDckQsTUFBTSxPQUFPLEdBQUcsSUFBQSxnQ0FBVSxHQUFFLENBQUM7UUFDN0IsTUFBTSxNQUFNLEdBQUcsSUFBQSwrQkFBUyxFQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLElBQUEsMENBQW9CLEdBQUUsQ0FBQztRQUNyQyxNQUFNLE9BQU8sR0FBRyxNQUFNLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUUzQyxPQUFPO1lBQ0gsU0FBUztZQUNULE1BQU07WUFDTixLQUFLO1lBQ0wsV0FBVyxFQUFFLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUM7WUFDakQsS0FBSyxFQUFFLE1BQU0sQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUM7U0FDakQsQ0FBQztJQUNOLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUM5QixNQUFpQixFQUNqQixPQUtDO1FBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxFQUFFLFFBQVEsSUFBSSxFQUFFLENBQUM7UUFDekMsTUFBTSxhQUFhLEdBQUcsT0FBTyxFQUFFLGFBQWEsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUMsR0FBRyxJQUFJLENBQUM7UUFDekYsTUFBTSxVQUFVLEdBQUcsT0FBTyxFQUFFLFVBQVUsSUFBSSxtQ0FBdUIsQ0FBQyxHQUFHLENBQUM7UUFDdEUsTUFBTSxLQUFLLEdBQWMsRUFBRSxDQUFDO1FBRTVCLE1BQU0sYUFBYSxHQUFHLGVBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLGFBQWEsSUFBSSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ2pGLElBQUksSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDM0IsSUFBSSxhQUFhLEdBQUcsMkNBQXFCLENBQUMsS0FBSyxDQUFDO1FBQ2hELElBQUksV0FBVyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsMkNBQXFCLENBQUMsQ0FBQztRQUV2RCxvRUFBb0U7UUFDcEUsb0VBQW9FO1FBQ3BFLElBQUksQ0FBQztZQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDN0UsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDeEQsV0FBVyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDN0IsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDWCxvRUFBb0U7WUFDcEUsZ0NBQWdDO1FBQ3BDLENBQUM7UUFFRCxLQUFLLE1BQU0sVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ25DLGFBQWEsR0FBRyxVQUFVLENBQUM7WUFDM0IsTUFBTSxPQUFPLEdBQUcsSUFBQSxtQ0FBYSxFQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQ3pFLElBQUksQ0FBQztnQkFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFVLENBQUMsZUFBZSxDQUFnQjtvQkFDN0QsV0FBVyxDQUFDLFFBQVE7d0JBQ2hCLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQztvQkFDbkQsQ0FBQztvQkFDRCxPQUFPO3dCQUNILE9BQU8sYUFBYSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUU7NEJBQzlCLFlBQVksRUFBRSxhQUFhO3lCQUM5QixDQUFDLENBQUM7b0JBQ1AsQ0FBQztvQkFDRCxVQUFVLENBQUMsR0FBRzt3QkFDVixJQUFJLGVBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDOzRCQUMxQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQzs0QkFFbkMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLElBQUksR0FBRyxFQUFFLENBQUM7d0JBQ3hDLENBQUM7d0JBRUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxlQUFLLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ2xELENBQUM7b0JBQ0QsYUFBYTtvQkFDYixRQUFRO2lCQUNYLENBQUMsQ0FBQztnQkFDSCxJQUFJLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztnQkFDckIsTUFBTTtZQUNWLENBQUM7WUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO2dCQUNYLE1BQU0sTUFBTSxHQUFHLFVBQVUsS0FBSyxXQUFXLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDbEUsSUFBSSxNQUFNLEVBQUUsQ0FBQztvQkFDVCxNQUFNLEdBQUcsQ0FBQztnQkFDZCxDQUFDO1lBQ0wsQ0FBQztRQUNMLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDOUMsS0FBSyxDQUFDLElBQUksQ0FBQztZQUNQLElBQUksRUFBRSwwQkFBYyxDQUFDLElBQUk7WUFDekIsTUFBTSxFQUFFLFVBQVU7WUFDbEIsSUFBSSxFQUFFLFVBQVUsS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDO1NBQzVHLENBQUMsQ0FBQztRQUVILE1BQU0sS0FBSyxHQUFHLEdBQUcsbUNBQWEsSUFBSSw4QkFBUSxJQUFJLGFBQWEsYUFBYSxDQUFDO1FBQ3pFLE1BQU0sUUFBUSxHQUFHLE1BQU0sZ0JBQVUsQ0FBQyxlQUFlLENBQWdCO1lBQzdELFdBQVcsQ0FBQyxRQUFRO2dCQUNoQixPQUFPLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDbkQsQ0FBQztZQUNELE9BQU87Z0JBQ0gsT0FBTyxhQUFhLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRTtvQkFDNUIsWUFBWSxFQUFFLGFBQWE7aUJBQzlCLENBQUMsQ0FBQztZQUNQLENBQUM7WUFDRCxVQUFVLENBQUMsR0FBRztnQkFDVixJQUFJLGVBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDO29CQUMxQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztvQkFFbkMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLElBQUksR0FBRyxFQUFFLENBQUM7Z0JBQ3hDLENBQUM7Z0JBRUQsT0FBTyxFQUFFLFNBQVMsRUFBRSxlQUFLLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbEQsQ0FBQztZQUNELGFBQWE7WUFDYixRQUFRO1NBQ1gsQ0FBQyxDQUFDO1FBRUgsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDNUQsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBRUQsS0FBSyxDQUFDLElBQUksQ0FBQztZQUNQLElBQUksRUFBRSwwQkFBYyxDQUFDLEdBQUc7WUFDeEIsTUFBTSxFQUFFLFVBQVU7WUFDbEIsSUFBSSxFQUNBLFVBQVUsS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHO2dCQUN0QyxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ3pCLENBQUMsQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztTQUMvQyxDQUFDLENBQUM7UUFDSCxLQUFLLENBQUMsSUFBSSxDQUFDO1lBQ1AsSUFBSSxFQUFFLDBCQUFjLENBQUMsR0FBRztZQUN4QixNQUFNLEVBQUUsVUFBVTtZQUNsQixJQUFJLEVBQ0EsVUFBVSxLQUFLLG1DQUF1QixDQUFDLEdBQUc7Z0JBQ3RDLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDekIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO1NBQy9DLENBQUMsQ0FBQztRQUVILE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQywwQkFBMEIsQ0FDMUMsUUFBZ0IsRUFDaEIsT0FJQztRQUVELE1BQU0sU0FBUyxHQUFHLE1BQU0sTUFBTSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzNELE1BQU0sS0FBSyxHQUFHLE1BQU0sTUFBTSxDQUFDLGNBQWMsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFFOUQsT0FBTztZQUNILFNBQVM7WUFDVCxLQUFLLEVBQUUsS0FBSztTQUNmLENBQUM7SUFDTixDQUFDO0lBRVMsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQ2hDLFVBQWtCLEVBQ2xCLE9BQWlCLEVBQUUsRUFDbkIsVUFBZ0QsRUFBRTtRQUVsRCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ25DLE1BQU0sVUFBVSxHQUFHLElBQUEscUJBQUssRUFBQyxVQUFVLEVBQUUsSUFBSSxFQUFFO2dCQUN2QyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUc7Z0JBQ2hCLEtBQUssRUFBRSxNQUFNO2FBQ2hCLENBQUMsQ0FBQztZQUVILElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztZQUNoQixJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7WUFFaEIsVUFBVSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3ZFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUV2RSxJQUFJLFNBQXFDLENBQUM7WUFDMUMsSUFBSSxPQUFPLENBQUMsU0FBUyxJQUFJLE9BQU8sQ0FBQyxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzdDLFNBQVMsR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFO29CQUN4QixVQUFVLENBQUMsSUFBSSxFQUFFLENBQUM7b0JBQ2xCLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQywyQkFBMkIsT0FBTyxDQUFDLFNBQVMsSUFBSSxDQUFDLENBQUMsQ0FBQztnQkFDeEUsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUMxQixDQUFDO1lBRUQsVUFBVSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsRUFBRTtnQkFDaEMsSUFBSSxTQUFTO29CQUFFLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsT0FBTyxDQUFDO29CQUNKLFFBQVEsRUFBRSxRQUFRLElBQUksQ0FBQztvQkFDdkIsTUFBTTtvQkFDTixNQUFNO2lCQUNULENBQUMsQ0FBQztZQUNQLENBQUMsQ0FBQyxDQUFDO1lBRUgsVUFBVSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRTtnQkFDN0IsSUFBSSxTQUFTO29CQUFFLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLDRCQUE0QixLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ25FLENBQUMsQ0FBQyxDQUFDO1FBQ1AsQ0FBQyxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRU0sTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFhO1FBQ25DLE1BQU0sSUFBSSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUNsQyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssbUNBQXVCLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDOUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQzlELENBQUM7YUFBTSxDQUFDO1lBQ0osSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBYyxDQUFDLENBQUM7UUFDckMsQ0FBQztRQUVELE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFUyxNQUFNLENBQUMsVUFBVSxDQUFDLEdBQVksRUFBRSxhQUF3QjtRQUM5RCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUN4QyxHQUFHLENBQUMsTUFBTSxLQUFLLG1DQUF1QixDQUFDLEdBQUc7WUFDdEMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFO1lBQ3JCLENBQUMsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FDdkQsQ0FBQztRQUNGLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksS0FBSyxZQUFZLENBQUMsRUFBRSxLQUV0RSxDQUFDO1FBQ2hCLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBRUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN4QyxNQUFNLFdBQVcsR0FBRyxDQUFDLGFBQWEsSUFBSSxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBRS9FLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQzVCLE1BQTBCLEVBQzFCLE9BS0M7UUFFRCxNQUFNLGFBQWEsR0FBRyxPQUFPLEVBQUUsYUFBYSxJQUFJLG1CQUFtQixFQUFFLENBQUM7UUFDdEUsTUFBTSxTQUFTLEdBQUcsT0FBTyxFQUFFLFNBQVMsSUFBSSxLQUFLLENBQUM7UUFDOUMsTUFBTSxrQkFBa0IsR0FDcEIsT0FBTyxFQUFFLGtCQUFrQixJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLHNDQUFzQyxDQUFDLENBQUM7UUFDbkcsTUFBTSxjQUFjLEdBQUcsT0FBTyxFQUFFLGNBQWMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUVsRixJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLENBQUM7WUFDdkMsTUFBTSxJQUFJLEtBQUssQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksS0FBSywwQkFBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzFFLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNQLE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsQ0FBQztRQUN2RSxDQUFDO1FBRUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDekMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO1FBQzdGLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLEVBQUUsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFakQsSUFBSSxDQUFDO1lBQ0QsS0FBSyxNQUFNLFNBQVMsSUFBSSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQ25DLE1BQU0sUUFBUSxHQUFHLElBQUEsZ0NBQW9CLEVBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNwRSxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsTUFBTSxLQUFLLG1DQUF1QixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7Z0JBQ25GLE1BQU0sRUFBRSxDQUFDLFNBQVMsQ0FDZCxHQUFHLE9BQU8sSUFBSSxRQUFRLElBQUksU0FBUyxFQUFFLEVBQ3JDLFNBQVMsQ0FBQyxJQUFJLEVBQ2QsU0FBUyxDQUFDLE1BQU0sS0FBSyxtQ0FBdUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUN4RSxDQUFDO1lBQ04sQ0FBQztZQUNELE1BQU0sVUFBVSxHQUFHLEdBQUcsT0FBTyxhQUFhLENBQUM7WUFFM0MsTUFBTSxFQUFFLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFVLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUV6RSxNQUFNLFdBQVcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxhQUFhLENBQzFDLGtCQUFrQixFQUNsQixDQUFDLFFBQVEsRUFBRSxhQUFhLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxFQUM5QyxFQUFFLFNBQVMsRUFBRSxDQUNoQixDQUFDO1lBQ0YsSUFBSSxXQUFXLENBQUMsUUFBUSxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxXQUFXLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBQ3JHLENBQUM7UUFDTCxDQUFDO2dCQUFTLENBQUM7WUFDUCxNQUFNLElBQUEsZ0NBQXNCLEVBQUMsT0FBTyxDQUFDLENBQUM7UUFDMUMsQ0FBQztJQUNMLENBQUM7SUFFUyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQWUsRUFBRSxJQUFZLEVBQUUsTUFBYztRQUN4RSxNQUFNLElBQUksR0FBRyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUVyQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hDLE9BQU8sQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQy9CLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFckIsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNsQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3RDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFFdkIsT0FBTyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDekIsQ0FBQztJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxZQUFZLENBQUMsTUFBYztRQUNyQyxNQUFNLE9BQU8sR0FBRyxJQUFBLHNDQUFnQixFQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLE1BQU0sSUFBSSxHQUFHLElBQUEsbUNBQWEsRUFBQyxNQUFNLENBQUMsQ0FBQztRQUNuQyxNQUFNLE1BQU0sR0FBRyxJQUFBLHFDQUFlLEVBQUMsTUFBTSxDQUFDLENBQUM7UUFFdkMsT0FBTyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLE1BQWM7UUFDNUMsT0FBTyxJQUFBLG1DQUFhLEVBQUMsTUFBTSxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsTUFBYztRQUMvQyxPQUFPLElBQUEsc0NBQWdCLEVBQUMsTUFBTSxDQUFDLENBQUM7SUFDcEMsQ0FBQztJQUVTLE1BQU0sQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsUUFBZ0I7UUFDdkQsTUFBTSxRQUFRLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzdDLE1BQU0sSUFBSSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXRCLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFUyxNQUFNLENBQUMsb0JBQW9CLENBQUMsT0FBZTtRQUNqRCxNQUFNLFlBQVksR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQUUsT0FBTyxDQUFDLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzdGLE1BQU0sSUFBSSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBRTFCLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLE1BQThCO1FBQy9ELE1BQU0sT0FBTyxHQUFHLElBQUEsb0NBQWMsRUFDMUIsTUFBTSxDQUFDLFFBQVEsRUFDZixNQUFNLENBQUMsVUFBVSxFQUNqQixNQUFNLENBQUMsVUFBVSxJQUFJLGdDQUF3QixFQUM3QyxNQUFNLENBQUMsV0FBVyxFQUNsQixNQUFNLENBQUMsT0FBTyxFQUNkLE1BQU0sQ0FBQyxTQUFTLENBQ25CLENBQUM7UUFFRixPQUFPLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxJQUFJLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUVTLE1BQU0sQ0FBQyx1QkFBdUIsQ0FBQyxPQUFlLEVBQUUsU0FBUyxHQUFHLE9BQU87UUFDekUsTUFBTSxLQUFLLEdBQUcsSUFBSSxNQUFNLENBQUMsR0FBRyxTQUFTLFlBQVksQ0FBQyxDQUFDO1FBQ25ELE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkMsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNSLE9BQU8sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3BCLENBQUM7YUFBTSxDQUFDO1lBQ0osTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFNBQVMsc0JBQXNCLENBQUMsQ0FBQztRQUN4RCxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBZ0I7UUFDcEMsT0FBTyxJQUFBLCtCQUFTLEVBQUMsT0FBTyxDQUFDLENBQUM7SUFDOUIsQ0FBQztJQUVNLE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLENBQUMsTUFBYztRQUMvRCxPQUFPLElBQUEsc0RBQWdDLEVBQUMsTUFBTSxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUVNLE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsTUFBYztRQUMvQyxPQUFPLElBQUEsc0NBQWdCLEVBQUMsTUFBTSxDQUFDLENBQUM7SUFDcEMsQ0FBQztJQUVNLE1BQU0sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsT0FBZ0I7UUFDakQsT0FBTyxJQUFBLHNDQUFnQixFQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3JDLENBQUM7SUFDRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQXVDO1FBQ2hFLElBQUksTUFBK0IsQ0FBQztRQUNwQyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzVCLElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDNUIsT0FBTyxFQUFlLENBQUM7WUFDM0IsQ0FBQztZQUNELElBQUksQ0FBQztnQkFDRCxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMvQixDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDYixNQUFNLElBQUksS0FBSyxDQUNYLGdDQUFnQyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDM0YsQ0FBQztZQUNOLENBQUM7UUFDTCxDQUFDO2FBQU0sQ0FBQztZQUNKLE1BQU0sR0FBRyxLQUFLLENBQUM7UUFDbkIsQ0FBQztRQUVELE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFBLHlCQUFnQixFQUFDLE1BQU0sRUFBRSxnQ0FBZSxDQUFDLENBQUM7UUFDOUQsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ1gsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLGFBQUssQ0FBQyxNQUFNLENBQUMsZ0NBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBQzNFLE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNsRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUVELE9BQU8sTUFBbUIsQ0FBQztJQUMvQixDQUFDO0lBRU8sTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFnQixFQUFFLE1BQStCO1FBQ3RFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDckMsTUFBTSxTQUFTLEdBQUcsT0FBTyxVQUFVLEtBQUssU0FBUyxDQUFDO1FBQ2xELE1BQU0sUUFBUSxHQUFHLE9BQU8sVUFBVSxLQUFLLFFBQVEsQ0FBQztRQUVoRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ1osSUFBSSxJQUFJLENBQUMsUUFBUSxLQUFLLDZCQUFZLENBQUMsRUFBRSxFQUFFLENBQUM7Z0JBQ3BDLE1BQU0sSUFBSSxLQUFLLENBQ1gscUJBQXFCLElBQUksQ0FBQyxRQUFRLHdCQUF3QixJQUFJLENBQUMsSUFBSSw2Q0FBNkMsQ0FDbkgsQ0FBQztZQUNOLENBQUM7WUFDRCxNQUFNLGVBQWUsR0FBRyxPQUFPLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBRTNGLE9BQU8sVUFBVSxLQUFLLGVBQWUsQ0FBQztRQUMxQyxDQUFDO1FBRUQsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNYLFFBQVEsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNwQixLQUFLLDZCQUFZLENBQUMsRUFBRTtvQkFDaEIsT0FBTyxVQUFVLElBQUssSUFBSSxDQUFDLEtBQWdCLENBQUM7Z0JBQ2hELEtBQUssNkJBQVksQ0FBQyxFQUFFO29CQUNoQixPQUFPLFVBQVUsS0FBSyxJQUFJLENBQUMsS0FBSyxDQUFDO2dCQUNyQyxLQUFLLDZCQUFZLENBQUMsRUFBRTtvQkFDaEIsT0FBTyxVQUFVLElBQUssSUFBSSxDQUFDLEtBQWdCLENBQUM7Z0JBQ2hEO29CQUNJLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ25FLENBQUM7UUFDTCxDQUFDO1FBRUQsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsSUFBSSxDQUFDLElBQUksTUFBTSxPQUFPLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsTUFBYyxFQUFFLFNBQW9CO1FBQ2pFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEMsT0FBTyxDQUFDLDRDQUE0QztRQUN4RCxDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0NBQWdDLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkUsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLG9DQUFtQixDQUFpQixDQUFDO1FBQ3BFLElBQUksWUFBWSxFQUFFLENBQUM7WUFDZixLQUFLLE1BQU0sSUFBSSxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUM5QixJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztvQkFDaEMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFDckMsTUFBTSxJQUFJLEtBQUssQ0FDWCw4Q0FBOEMsSUFBSSxDQUFDLElBQUksZUFBZSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxJQUFJO3dCQUNoRyxZQUFZLElBQUksQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDaEUsQ0FBQztnQkFDTixDQUFDO1lBQ0wsQ0FBQztRQUNMLENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxNQUFNLENBQWlCLENBQUM7UUFDcEQsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNaLEtBQUssTUFBTSxJQUFJLElBQUksU0FBUyxFQUFFLENBQUM7Z0JBQzNCLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO29CQUNoQyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO29CQUNyQyxNQUFNLElBQUksS0FBSyxDQUNYLHdCQUF3QixNQUFNLGFBQWEsSUFBSSxDQUFDLElBQUksZUFBZSxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxJQUFJO3dCQUM3RixZQUFZLElBQUksQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDaEUsQ0FBQztnQkFDTixDQUFDO1lBQ0wsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0NBQ0o7QUFwakJELHdCQW9qQkMifQ==
|