sliftutils 1.7.124 → 1.7.126

package/security/authorizedKeys/daemon/trust.ts

@@ -0,0 +1,291 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+import { spawnPromise } from "../../helpers/spawn";
+import { normalizeKeys } from "../authorizedKeys";
+import { sourceRepoPath } from "../sources";
+import { MANIFEST_NAME, normalizeContent, SIGN_NAMESPACE, SIGNATURE_NAME } from "../../signedFiles/manifest";
+import { MAX_ERROR_BODY_LENGTH, SIGNER_CHANGE_DELAY } from "./paths";
+import { notify } from "./notify";
+import { saveState, sourceState } from "./state";
+
+// A source that has never been signed reads as this, so losing a signature counts as a change of
+// signer rather than as something to wave through.
+const UNSIGNED = "";
+// What fixes both of the signature problems we report, so the message can say so rather than
+// leaving someone to work it out.
+const SIGN_COMMAND = "yarn signfiles git";
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+function readSSHString(buffer: Buffer, offset: number) {
+    let length = buffer.readUInt32BE(offset);
+    return buffer.subarray(offset + 4, offset + 4 + length);
+}
+
+/** The signature carries the public key that made it, so the key itself can be reported rather
+    than only a fingerprint. Returns it in the usual "type base64" form. */
+export function publicKeyFromSignature(signatureText: string) {
+    let body = signatureText.split("\n").filter(line => line && !line.startsWith("-----")).join("");
+    let blob = Buffer.from(body, "base64");
+    if (blob.subarray(0, 6).toString() !== "SSHSIG") {
+        throw new Error(`Expected an SSHSIG signature, started with ${blob.subarray(0, 6).toString()}`);
+    }
+    // The magic, then a uint32 version, then the public key.
+    let publicKey = readSSHString(blob, 6 + 4);
+    let keyType = readSSHString(publicKey, 0).toString();
+    let fingerprint = "SHA256:" + crypto.createHash("sha256").update(publicKey).digest("base64").replace(/=+$/, "");
+    return { publicKey: `${keyType} ${publicKey.toString("base64")}`, fingerprint };
+}
+
+/** Reads one checkout's keys. Prefers a top level authorized_keys file and otherwise concatenates
+    every .pub at the top level. */
+export async function readCheckoutKeys(repoPath: string) {
+    let combinedPath = path.join(repoPath, "authorized_keys");
+    if (await pathExists(combinedPath)) {
+        return normalizeKeys(await fs.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = (await fs.readdir(repoPath)).filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys: string[] = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await fs.readFile(path.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}
+
+/** Every file in a checkout, other than git's own directory and the signature files, which cannot
+    describe themselves. */
+async function listCheckoutFiles(repoPath: string, prefix?: string): Promise<string[]> {
+    let files: string[] = [];
+    for (let entry of await fs.readdir(path.join(repoPath, prefix || ""), { withFileTypes: true })) {
+        let relativePath = prefix && `${prefix}/${entry.name}` || entry.name;
+        if (entry.name === ".git") {
+            continue;
+        }
+        if (!prefix && (entry.name === MANIFEST_NAME || entry.name === SIGNATURE_NAME)) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            files.push(...await listCheckoutFiles(repoPath, relativePath));
+            continue;
+        }
+        files.push(relativePath);
+    }
+    return files.sort();
+}
+
+/** The signature only covers the manifest, so the manifest has to be checked against what is
+    actually on disk. Both directions matter: a missing file changes what the keys mean, and an
+    extra unlisted file could add keys nobody signed for. */
+async function verifyManifestMatchesFiles(repoPath: string) {
+    let manifest = JSON.parse(await fs.readFile(path.join(repoPath, MANIFEST_NAME), "utf8"));
+    let listed = new Map<string, { path: string; size: number; sha256: string }>(
+        (manifest.files || []).map((file: { path: string }) => [file.path, file])
+    );
+    let actual = await listCheckoutFiles(repoPath);
+
+    let missing = [...listed.keys()].filter(filePath => !actual.includes(filePath));
+    if (missing.length) {
+        throw new Error(`Expected the signed files to be present, ${missing.length} missing, first ${missing[0]}`);
+    }
+    let extra = actual.filter(filePath => !listed.has(filePath));
+    if (extra.length) {
+        throw new Error(`Expected only signed files to be present, ${extra.length} extra, first ${extra[0]}`);
+    }
+    for (let filePath of actual) {
+        let expected = listed.get(filePath);
+        if (!expected) {
+            continue;
+        }
+        let contents = normalizeContent(await fs.readFile(path.join(repoPath, filePath)));
+        if (contents.length !== expected.size) {
+            throw new Error(`Expected ${filePath} to be ${expected.size} bytes, was ${contents.length}`);
+        }
+        let hash = crypto.createHash("sha256").update(contents).digest("hex");
+        if (hash !== expected.sha256) {
+            throw new Error(`Expected ${filePath} to hash to ${expected.sha256}, was ${hash}`);
+        }
+    }
+}
+
+/** The manifest and signature as they stand, whether or not they are any good. The hashes are
+    what tell a signature that was never updated apart from one that is broken. */
+async function readSignatureFiles(repoPath: string) {
+    let manifestPath = path.join(repoPath, MANIFEST_NAME);
+    let signaturePath = path.join(repoPath, SIGNATURE_NAME);
+    let manifest = await pathExists(manifestPath) && await fs.readFile(manifestPath) || undefined;
+    let signature = await pathExists(signaturePath) && await fs.readFile(signaturePath) || undefined;
+    return {
+        manifest,
+        signature,
+        manifestHash: manifest && crypto.createHash("sha256").update(manifest).digest("hex") || "",
+        signatureHash: signature && crypto.createHash("sha256").update(signature).digest("hex") || "",
+    };
+}
+
+/** Who signed this checkout. Returns UNSIGNED when there is no signature at all, and throws when
+    there is one that does not hold up - an unverifiable signature is never treated as an identity,
+    so it can never become something we accept. */
+async function verifyCheckoutSigner(config: {
+    repoPath: string;
+    files: { manifest?: Buffer; signature?: Buffer };
+}) {
+    let { repoPath, files } = config;
+    if (!files.manifest && !files.signature) {
+        return UNSIGNED;
+    }
+    if (!files.manifest || !files.signature) {
+        throw new Error(`Expected both ${MANIFEST_NAME} and ${SIGNATURE_NAME}, only one is present`);
+    }
+    let result = await spawnPromise({
+        command: "ssh-keygen",
+        args: ["-Y", "check-novalidate", "-n", SIGN_NAMESPACE, "-s", path.join(repoPath, SIGNATURE_NAME)],
+        // The signature covers the normalised bytes, so a checkout that arrived with CRLF still
+        // verifies rather than looking like tampering.
+        input: normalizeContent(files.manifest).toString("utf8"),
+    });
+    if (result.status !== 0) {
+        throw new Error(
+            `the signature over ${MANIFEST_NAME} does not verify: `
+            + `${(result.stdout + result.stderr).trim().slice(0, MAX_ERROR_BODY_LENGTH)}`
+        );
+    }
+    let reported = `${result.stdout} ${result.stderr}`.match(/(SHA256:[A-Za-z0-9+/=]+)/);
+    if (!reported) {
+        throw new Error(`ssh-keygen reported no signer fingerprint, said ${result.stdout.slice(0, MAX_ERROR_BODY_LENGTH)}`);
+    }
+    let { publicKey, fingerprint } = publicKeyFromSignature(files.signature.toString("utf8"));
+    // The key we read out of the signature has to be the one ssh-keygen just checked against,
+    // otherwise we would be reporting an identity that did not sign anything.
+    if (fingerprint !== reported[1]) {
+        throw new Error(`the signing key reads as ${fingerprint} but ssh-keygen verified ${reported[1]}`);
+    }
+    await verifyManifestMatchesFiles(repoPath);
+    return publicKey;
+}
+
+export function describeSigner(signer: string) {
+    return signer === UNSIGNED && "<no public key>" || signer;
+}
+
+/** Reports a problem with a source's signature, but only when it is not the same problem we
+    already reported, so a fault that persists does not repeat every check. */
+async function reportProblem(config: { repoURL: string; problem: string; message: string }) {
+    let { repoURL, problem, message } = config;
+    let sourceStateValue = sourceState(repoURL);
+    if (sourceStateValue.reportedProblem === problem) {
+        return;
+    }
+    sourceStateValue.reportedProblem = problem;
+    await saveState();
+    await notify(message);
+}
+
+/** The keys a source is allowed to contribute right now. A source signed by someone we have not
+    accepted keeps contributing the keys we last accepted, until the delay has passed. */
+export async function resolveSourceKeys(repoURL: string) {
+    let sourceStateValue = sourceState(repoURL);
+    let repoPath = sourceRepoPath(repoURL);
+    let files = await readSignatureFiles(repoPath);
+
+    let signer: string;
+    try {
+        signer = await verifyCheckoutSigner({ repoPath, files });
+    } catch (e) {
+        // Nothing here is trustworthy, so nothing here is used. Which of the two problems it is
+        // depends on whether the signature is simply the one we already accepted.
+        let unchanged = files.manifestHash === sourceStateValue.acceptedManifestHash
+            && files.signatureHash === sourceStateValue.acceptedSignatureHash;
+        if (unchanged) {
+            await reportProblem({
+                repoURL,
+                problem: "stale",
+                message: `\`${repoURL}\` changed but its signature was not updated, so the changes are being`
+                    + ` ignored. Still using the keys signed by \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\nTo deploy the change, run this in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+            });
+        } else {
+            await reportProblem({
+                repoURL,
+                problem: "corrupt",
+                message: `\`${repoURL}\` has a corrupted signature, so its contents are being ignored:`
+                    + ` ${e}.\nStill using the keys signed by \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\nTo replace it, run this in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+            });
+        }
+        return sourceStateValue.acceptedKeys;
+    }
+    if (sourceStateValue.reportedProblem) {
+        sourceStateValue.reportedProblem = "";
+        await saveState();
+    }
+    let checkoutKeys = await readCheckoutKeys(repoPath);
+
+    let accept = async () => {
+        sourceStateValue.accepted = true;
+        sourceStateValue.acceptedSigner = signer;
+        sourceStateValue.acceptedKeys = checkoutKeys;
+        sourceStateValue.acceptedManifestHash = files.manifestHash;
+        sourceStateValue.acceptedSignatureHash = files.signatureHash;
+        sourceStateValue.pendingSigner = UNSIGNED;
+        sourceStateValue.pendingSince = 0;
+        await saveState();
+        return checkoutKeys;
+    };
+
+    // Nothing has ever been accepted from this source, so this is what we start trusting.
+    if (!sourceStateValue.accepted) {
+        console.log(`Trusting ${repoURL} as signed by ${describeSigner(signer)}`);
+        return await accept();
+    }
+
+    if (signer === sourceStateValue.acceptedSigner) {
+        // Back to the signer we already trust, so anything we were waiting on is moot.
+        if (sourceStateValue.pendingSince) {
+            console.log(`${repoURL} is signed by its accepted key again, dropping the pending change`);
+        }
+        return await accept();
+    }
+
+    // Going from nothing to something signed is only ever an improvement, so it does not wait.
+    if (sourceStateValue.acceptedSigner === UNSIGNED) {
+        await notify(
+            `\`${repoURL}\` is now signed, by \`${signer}\`. It was not signed before, so its keys are`
+            + ` being applied right away.`
+        );
+        return await accept();
+    }
+
+    // A signer we have not accepted. Anything new restarts the wait, so publishing twice in a row
+    // gains an attacker nothing. pendingSince is what marks a wait as running, because an unsigned
+    // checkout is itself a signer value and cannot double as "nothing pending".
+    if (!sourceStateValue.pendingSince || signer !== sourceStateValue.pendingSigner) {
+        sourceStateValue.pendingSigner = signer;
+        sourceStateValue.pendingSince = Date.now();
+        await saveState();
+        await notify(
+            `\`${repoURL}\` is now signed by \`${describeSigner(signer)}\`, where it was signed by`
+            + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`. Its keys are NOT being applied.`
+            + ` If nothing changes they will be applied in 24 hours.`
+        );
+        return sourceStateValue.acceptedKeys;
+    }
+
+    if (Date.now() - sourceStateValue.pendingSince < SIGNER_CHANGE_DELAY) {
+        return sourceStateValue.acceptedKeys;
+    }
+
+    // Same new signer, 24 hours later, and nobody stopped it.
+    console.log(`Accepting ${describeSigner(signer)} for ${repoURL} after the ${SIGNER_CHANGE_DELAY}ms wait`);
+    return await accept();
+}

package/security/authorizedKeys/daemon/userKeys.ts

@@ -0,0 +1,76 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+import { summarizeKey } from "../authorizedKeys";
+import { PASSWD_PATH, ROOT_AUTHORIZED_KEYS } from "./paths";
+import { notify } from "./notify";
+import { getState, saveState } from "./state";
+import { readAuthorizedKeysFile } from "./rootKeys";
+
+async function pathExists(filePath: string) {
+    try {
+        await fs.access(filePath);
+        return true;
+    } catch (e) {
+        return false;
+    }
+}
+
+export async function listUserAuthorizedKeyFiles() {
+    let entries: { name: string; filePath: string }[] = [];
+    let passwd = await fs.readFile(PASSWD_PATH, "utf8");
+    for (let line of passwd.split("\n")) {
+        let fields = line.split(":");
+        if (fields.length < 7) {
+            continue;
+        }
+        let [name, , , , , home] = fields;
+        if (!home || !await pathExists(home)) {
+            continue;
+        }
+        let filePath = path.join(home, ".ssh", "authorized_keys");
+        if (filePath === ROOT_AUTHORIZED_KEYS) {
+            continue;
+        }
+        entries.push({ name, filePath });
+    }
+    return entries;
+}
+
+function hashKeys(keys: string[]) {
+    return crypto.createHash("sha256").update(keys.join("\n")).digest("hex");
+}
+
+/** Seeds the per user hashes without reporting every existing file as a change. */
+export async function seedUserKeys() {
+    let state = getState();
+    if (Object.keys(state.userKeyHashes).length) {
+        return;
+    }
+    for (let entry of await listUserAuthorizedKeyFiles()) {
+        state.userKeyHashes[entry.name] = hashKeys(await readAuthorizedKeysFile(entry.filePath));
+    }
+    await saveState();
+}
+
+/** Root is enforced elsewhere, every other account is watched and reported on. */
+export async function checkOtherUserKeys() {
+    let state = getState();
+    let hashes: { [name: string]: string } = {};
+    for (let entry of await listUserAuthorizedKeyFiles()) {
+        let keys = await readAuthorizedKeysFile(entry.filePath);
+        let hash = hashKeys(keys);
+        hashes[entry.name] = hash;
+        let previousHash = state.userKeyHashes[entry.name];
+        if (previousHash === undefined || previousHash === hash) {
+            continue;
+        }
+        await notify(
+            `authorized_keys for user \`${entry.name}\` changed (\`${entry.filePath}\`).`
+            + ` portsecure does not manage this account, so the change was left in place.`
+            + `\n\`\`\`\n${keys.map(summarizeKey).join("\n") || "(now empty)"}\n\`\`\``
+        );
+    }
+    state.userKeyHashes = hashes;
+    await saveState();
+}

package/security/authorizedKeys/dist/authorizedKeys.ts.cache

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.readRepoKeys = exports.summarizeKey = exports.keyRestriction = exports.keyFingerprint = exports.normalizeKeys = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of normalizeKeys,
+// summarizeKey and readRepoKeys, so it can resolve the same keys with no dependencies. The two
+// must agree on which keys a repo produces - if you change one, make the matching change in the
+// other.
+function normalizeKeys(contents) {
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+exports.normalizeKeys = normalizeKeys;
+/** The fingerprint ssh itself reports for a key, which is what the sshd log names and therefore
+    what a revocation is keyed by. Returns "" for a line that holds no key. */
+function keyFingerprint(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    let blob = typeIndex >= 0 && parts[typeIndex + 1] || "";
+    if (!blob) {
+        return "";
+    }
+    return "SHA256:" + crypto_1.default.createHash("sha256").update(Buffer.from(blob, "base64")).digest("base64").replace(/=+$/, "");
+}
+exports.keyFingerprint = keyFingerprint;
+/** The addresses a key may be used from, which is the part of an authorized_keys line that
+    decides how much a stolen key is worth. A key with no restriction says so loudly. */
+function keyRestriction(keyLine) {
+    let match = keyLine.match(/from="([^"]*)"/);
+    if (!match) {
+        return "ANY ADDRESS (no from= restriction)";
+    }
+    return match[1];
+}
+exports.keyRestriction = keyRestriction;
+/** Enough to recognise whose key this is without printing the whole blob. */
+function summarizeKey(keyLine) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    if (typeIndex < 0) {
+        return keyLine.slice(0, 60);
+    }
+    let type = parts[typeIndex];
+    let blob = parts[typeIndex + 1] || "";
+    let comment = parts.slice(typeIndex + 2).join(" ");
+    return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
+}
+exports.summarizeKey = summarizeKey;
+/** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
+    file and otherwise concatenates every .pub at the top level. */
+async function readRepoKeys(repoPath) {
+    let combinedPath = path_1.default.join(repoPath, "authorized_keys");
+    let entries = await promises_1.default.readdir(repoPath);
+    if (entries.includes("authorized_keys")) {
+        return normalizeKeys(await promises_1.default.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = entries.filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await promises_1.default.readFile(path_1.default.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}
+exports.readRepoKeys = readRepoKeys;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplZEtleXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhdXRob3JpemVkS2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUV4Qiw2R0FBNkc7QUFDN0csK0ZBQStGO0FBQy9GLGdHQUFnRztBQUNoRyxTQUFTO0FBRVQsU0FBZ0IsYUFBYSxDQUFDLFFBQWdCO0lBQzFDLE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDdkcsQ0FBQztBQUZELHNDQUVDO0FBRUQ7OEVBQzhFO0FBQzlFLFNBQWdCLGNBQWMsQ0FBQyxPQUFlO0lBQzFDLElBQUksS0FBSyxHQUFHLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEMsSUFBSSxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLElBQUksSUFBSSxHQUFHLFNBQVMsSUFBSSxDQUFDLElBQUksS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDeEQsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1IsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxTQUFTLEdBQUcsZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDM0gsQ0FBQztBQVJELHdDQVFDO0FBRUQ7d0ZBQ3dGO0FBQ3hGLFNBQWdCLGNBQWMsQ0FBQyxPQUFlO0lBQzFDLElBQUksS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUM1QyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDVCxPQUFPLG9DQUFvQyxDQUFDO0lBQ2hELENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNwQixDQUFDO0FBTkQsd0NBTUM7QUFFRCw2RUFBNkU7QUFDN0UsU0FBZ0IsWUFBWSxDQUFDLE9BQWU7SUFDeEMsSUFBSSxLQUFLLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4QyxJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDekUsSUFBSSxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEIsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoQyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzVCLElBQUksSUFBSSxHQUFHLEtBQUssQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3RDLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuRCxPQUFPLEdBQUcsSUFBSSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsR0FBRyxPQUFPLElBQUksSUFBSSxPQUFPLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztBQUM1RSxDQUFDO0FBVkQsb0NBVUM7QUFFRDttRUFDbUU7QUFDNUQsS0FBSyxVQUFVLFlBQVksQ0FBQyxRQUFnQjtJQUMvQyxJQUFJLFlBQVksR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQzFELElBQUksT0FBTyxHQUFHLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLGFBQWEsQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ3BFLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FBQyx5REFBeUQsUUFBUSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hHLENBQUM7SUFDRCxJQUFJLElBQUksR0FBYSxFQUFFLENBQUM7SUFDeEIsS0FBSyxJQUFJLElBQUksSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUN4QixJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsYUFBYSxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNoQixDQUFDO0FBZkQsb0NBZUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgY3J5cHRvIGZyb20gXCJjcnlwdG9cIjtcbmltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5cbi8vIFBPUlRFRCBDT0RFOiBzZWN1cml0eS9hdXRob3JpemVkS2V5cy9kYWVtb24vcG9ydHNlY3VyZURhZW1vbi5qcyBjb250YWlucyBhIHBsYWluIEpTIHBvcnQgb2Ygbm9ybWFsaXplS2V5cyxcbi8vIHN1bW1hcml6ZUtleSBhbmQgcmVhZFJlcG9LZXlzLCBzbyBpdCBjYW4gcmVzb2x2ZSB0aGUgc2FtZSBrZXlzIHdpdGggbm8gZGVwZW5kZW5jaWVzLiBUaGUgdHdvXG4vLyBtdXN0IGFncmVlIG9uIHdoaWNoIGtleXMgYSByZXBvIHByb2R1Y2VzIC0gaWYgeW91IGNoYW5nZSBvbmUsIG1ha2UgdGhlIG1hdGNoaW5nIGNoYW5nZSBpbiB0aGVcbi8vIG90aGVyLlxuXG5leHBvcnQgZnVuY3Rpb24gbm9ybWFsaXplS2V5cyhjb250ZW50czogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpLm1hcChsaW5lID0+IGxpbmUudHJpbSgpKS5maWx0ZXIobGluZSA9PiBsaW5lICYmICFsaW5lLnN0YXJ0c1dpdGgoXCIjXCIpKTtcbn1cblxuLyoqIFRoZSBmaW5nZXJwcmludCBzc2ggaXRzZWxmIHJlcG9ydHMgZm9yIGEga2V5LCB3aGljaCBpcyB3aGF0IHRoZSBzc2hkIGxvZyBuYW1lcyBhbmQgdGhlcmVmb3JlXG4gICAgd2hhdCBhIHJldm9jYXRpb24gaXMga2V5ZWQgYnkuIFJldHVybnMgXCJcIiBmb3IgYSBsaW5lIHRoYXQgaG9sZHMgbm8ga2V5LiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGtleUZpbmdlcnByaW50KGtleUxpbmU6IHN0cmluZykge1xuICAgIGxldCBwYXJ0cyA9IGtleUxpbmUudHJpbSgpLnNwbGl0KC9cXHMrLyk7XG4gICAgbGV0IHR5cGVJbmRleCA9IHBhcnRzLmZpbmRJbmRleChwYXJ0ID0+IC9eKHNzaC18ZWNkc2EtfHNrLSkvLnRlc3QocGFydCkpO1xuICAgIGxldCBibG9iID0gdHlwZUluZGV4ID49IDAgJiYgcGFydHNbdHlwZUluZGV4ICsgMV0gfHwgXCJcIjtcbiAgICBpZiAoIWJsb2IpIHtcbiAgICAgICAgcmV0dXJuIFwiXCI7XG4gICAgfVxuICAgIHJldHVybiBcIlNIQTI1NjpcIiArIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShCdWZmZXIuZnJvbShibG9iLCBcImJhc2U2NFwiKSkuZGlnZXN0KFwiYmFzZTY0XCIpLnJlcGxhY2UoLz0rJC8sIFwiXCIpO1xufVxuXG4vKiogVGhlIGFkZHJlc3NlcyBhIGtleSBtYXkgYmUgdXNlZCBmcm9tLCB3aGljaCBpcyB0aGUgcGFydCBvZiBhbiBhdXRob3JpemVkX2tleXMgbGluZSB0aGF0XG4gICAgZGVjaWRlcyBob3cgbXVjaCBhIHN0b2xlbiBrZXkgaXMgd29ydGguIEEga2V5IHdpdGggbm8gcmVzdHJpY3Rpb24gc2F5cyBzbyBsb3VkbHkuICovXG5leHBvcnQgZnVuY3Rpb24ga2V5UmVzdHJpY3Rpb24oa2V5TGluZTogc3RyaW5nKSB7XG4gICAgbGV0IG1hdGNoID0ga2V5TGluZS5tYXRjaCgvZnJvbT1cIihbXlwiXSopXCIvKTtcbiAgICBpZiAoIW1hdGNoKSB7XG4gICAgICAgIHJldHVybiBcIkFOWSBBRERSRVNTIChubyBmcm9tPSByZXN0cmljdGlvbilcIjtcbiAgICB9XG4gICAgcmV0dXJuIG1hdGNoWzFdO1xufVxuXG4vKiogRW5vdWdoIHRvIHJlY29nbmlzZSB3aG9zZSBrZXkgdGhpcyBpcyB3aXRob3V0IHByaW50aW5nIHRoZSB3aG9sZSBibG9iLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHN1bW1hcml6ZUtleShrZXlMaW5lOiBzdHJpbmcpIHtcbiAgICBsZXQgcGFydHMgPSBrZXlMaW5lLnRyaW0oKS5zcGxpdCgvXFxzKy8pO1xuICAgIGxldCB0eXBlSW5kZXggPSBwYXJ0cy5maW5kSW5kZXgocGFydCA9PiAvXihzc2gtfGVjZHNhLXxzay0pLy50ZXN0KHBhcnQpKTtcbiAgICBpZiAodHlwZUluZGV4IDwgMCkge1xuICAgICAgICByZXR1cm4ga2V5TGluZS5zbGljZSgwLCA2MCk7XG4gICAgfVxuICAgIGxldCB0eXBlID0gcGFydHNbdHlwZUluZGV4XTtcbiAgICBsZXQgYmxvYiA9IHBhcnRzW3R5cGVJbmRleCArIDFdIHx8IFwiXCI7XG4gICAgbGV0IGNvbW1lbnQgPSBwYXJ0cy5zbGljZSh0eXBlSW5kZXggKyAyKS5qb2luKFwiIFwiKTtcbiAgICByZXR1cm4gYCR7dHlwZX0gLi4uJHtibG9iLnNsaWNlKC0xMil9JHtjb21tZW50ICYmIGAgJHtjb21tZW50fWAgfHwgXCJcIn1gO1xufVxuXG4vKiogUmVhZHMgdGhlIGF1dGhvcml6ZWQga2V5cyBhIHJlcG8gY2hlY2tvdXQgd2FudHMgYXBwbGllZC4gUHJlZmVycyBhIHRvcCBsZXZlbCBhdXRob3JpemVkX2tleXNcbiAgICBmaWxlIGFuZCBvdGhlcndpc2UgY29uY2F0ZW5hdGVzIGV2ZXJ5IC5wdWIgYXQgdGhlIHRvcCBsZXZlbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkUmVwb0tleXMocmVwb1BhdGg6IHN0cmluZykge1xuICAgIGxldCBjb21iaW5lZFBhdGggPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFwiYXV0aG9yaXplZF9rZXlzXCIpO1xuICAgIGxldCBlbnRyaWVzID0gYXdhaXQgZnMucmVhZGRpcihyZXBvUGF0aCk7XG4gICAgaWYgKGVudHJpZXMuaW5jbHVkZXMoXCJhdXRob3JpemVkX2tleXNcIikpIHtcbiAgICAgICAgcmV0dXJuIG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUoY29tYmluZWRQYXRoLCBcInV0ZjhcIikpO1xuICAgIH1cbiAgICBsZXQgcHViRmlsZXMgPSBlbnRyaWVzLmZpbHRlcihuYW1lID0+IG5hbWUuZW5kc1dpdGgoXCIucHViXCIpKS5zb3J0KCk7XG4gICAgaWYgKCFwdWJGaWxlcy5sZW5ndGgpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhdXRob3JpemVkX2tleXMgb3IgYXQgbGVhc3Qgb25lIC5wdWIgZmlsZSBpbiAke3JlcG9QYXRofSwgZm91bmQgbmVpdGhlcmApO1xuICAgIH1cbiAgICBsZXQga2V5czogc3RyaW5nW10gPSBbXTtcbiAgICBmb3IgKGxldCBuYW1lIG9mIHB1YkZpbGVzKSB7XG4gICAgICAgIGtleXMucHVzaCguLi5ub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgbmFtZSksIFwidXRmOFwiKSkpO1xuICAgIH1cbiAgICByZXR1cm4ga2V5cztcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "acd843c08a7ede6419089a90a105d6fbe56220931b66deb6b231678bdebe43cf"; */

package/security/authorizedKeys/dist/revokeSource.ts.cache

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.deriveRevokeKey = exports.revokeRepoPath = exports.revokeKeyPath = exports.revokeRepoURL = exports.REVOKE_KEY_LABEL = void 0;
+const deriveKey_1 = require("../keys/deriveKey");
+const sshKeyFile_1 = require("../keys/sshKeyFile");
+const sources_1 = require("./sources");
+// A source's revocations live in a repo beside it. Derived rather than configured, so adding a
+// source brings its revoke repo with it and there is nothing extra to pass on the command line.
+const REVOKED_SUFFIX = "_revoked";
+// GitHub will not take the same public key as a deploy key on two repos, so the revoke repo is
+// reached with a key derived from the source's, under this label.
+exports.REVOKE_KEY_LABEL = "revokegithubkey";
+function revokeRepoURL(sourceURL) {
+    let withoutGit = sourceURL.replace(/\.git$/, "");
+    return `${withoutGit}${REVOKED_SUFFIX}.git`;
+}
+exports.revokeRepoURL = revokeRepoURL;
+function revokeKeyPath(sourceURL) {
+    return `${sources_1.REPO_KEYS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.revokeKeyPath = revokeKeyPath;
+function revokeRepoPath(sourceURL) {
+    return `${sources_1.REPOS_DIR}/${(0, sources_1.sourceName)(sourceURL)}${REVOKED_SUFFIX}`;
+}
+exports.revokeRepoPath = revokeRepoPath;
+/** The revoke repo's key, worked out from the source repo's key. Anything holding the source key
+    can produce it, so it never has to be stored anywhere separately or handed around. */
+function deriveRevokeKey(sourcePrivateKey) {
+    let source = (0, sshKeyFile_1.parseOpenSSHPrivateKey)(sourcePrivateKey);
+    let derived = (0, deriveKey_1.deriveEd25519Key)({ seed: source.seed, label: exports.REVOKE_KEY_LABEL });
+    return {
+        publicKey: `ssh-ed25519 ${Buffer.concat([
+            Buffer.from([0, 0, 0, 11]), Buffer.from("ssh-ed25519"),
+            Buffer.from([0, 0, 0, 32]), derived.publicKey,
+        ]).toString("base64")}`,
+        privateKeyFile: (0, sshKeyFile_1.formatOpenSSHPrivateKey)({
+            seed: derived.seed,
+            comment: `${source.comment || "portsecure"} ${exports.REVOKE_KEY_LABEL}`,
+        }),
+    };
+}
+exports.deriveRevokeKey = deriveRevokeKey;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlU291cmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicmV2b2tlU291cmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLGlEQUFxRDtBQUNyRCxtREFBcUY7QUFDckYsdUNBQWlFO0FBRWpFLCtGQUErRjtBQUMvRixnR0FBZ0c7QUFDaEcsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDO0FBQ2xDLCtGQUErRjtBQUMvRixrRUFBa0U7QUFDckQsUUFBQSxnQkFBZ0IsR0FBRyxpQkFBaUIsQ0FBQztBQUVsRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsSUFBSSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDakQsT0FBTyxHQUFHLFVBQVUsR0FBRyxjQUFjLE1BQU0sQ0FBQztBQUNoRCxDQUFDO0FBSEQsc0NBR0M7QUFFRCxTQUFnQixhQUFhLENBQUMsU0FBaUI7SUFDM0MsT0FBTyxHQUFHLHVCQUFhLElBQUksSUFBQSxvQkFBVSxFQUFDLFNBQVMsQ0FBQyxHQUFHLGNBQWMsRUFBRSxDQUFDO0FBQ3hFLENBQUM7QUFGRCxzQ0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxTQUFpQjtJQUM1QyxPQUFPLEdBQUcsbUJBQVMsSUFBSSxJQUFBLG9CQUFVLEVBQUMsU0FBUyxDQUFDLEdBQUcsY0FBYyxFQUFFLENBQUM7QUFDcEUsQ0FBQztBQUZELHdDQUVDO0FBRUQ7eUZBQ3lGO0FBQ3pGLFNBQWdCLGVBQWUsQ0FBQyxnQkFBd0I7SUFDcEQsSUFBSSxNQUFNLEdBQUcsSUFBQSxtQ0FBc0IsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3RELElBQUksT0FBTyxHQUFHLElBQUEsNEJBQWdCLEVBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsd0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQy9FLE9BQU87UUFDSCxTQUFTLEVBQUUsZUFBZSxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1lBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1NBQ2hELENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDdkIsY0FBYyxFQUFFLElBQUEsb0NBQXVCLEVBQUM7WUFDcEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1lBQ2xCLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksWUFBWSxJQUFJLHdCQUFnQixFQUFFO1NBQ25FLENBQUM7S0FDTCxDQUFDO0FBQ04sQ0FBQztBQWJELDBDQWFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZGVyaXZlRWQyNTUxOUtleSB9IGZyb20gXCIuLi9rZXlzL2Rlcml2ZUtleVwiO1xuaW1wb3J0IHsgZm9ybWF0T3BlblNTSFByaXZhdGVLZXksIHBhcnNlT3BlblNTSFByaXZhdGVLZXkgfSBmcm9tIFwiLi4va2V5cy9zc2hLZXlGaWxlXCI7XG5pbXBvcnQgeyBSRVBPX0tFWVNfRElSLCBSRVBPU19ESVIsIHNvdXJjZU5hbWUgfSBmcm9tIFwiLi9zb3VyY2VzXCI7XG5cbi8vIEEgc291cmNlJ3MgcmV2b2NhdGlvbnMgbGl2ZSBpbiBhIHJlcG8gYmVzaWRlIGl0LiBEZXJpdmVkIHJhdGhlciB0aGFuIGNvbmZpZ3VyZWQsIHNvIGFkZGluZyBhXG4vLyBzb3VyY2UgYnJpbmdzIGl0cyByZXZva2UgcmVwbyB3aXRoIGl0IGFuZCB0aGVyZSBpcyBub3RoaW5nIGV4dHJhIHRvIHBhc3Mgb24gdGhlIGNvbW1hbmQgbGluZS5cbmNvbnN0IFJFVk9LRURfU1VGRklYID0gXCJfcmV2b2tlZFwiO1xuLy8gR2l0SHViIHdpbGwgbm90IHRha2UgdGhlIHNhbWUgcHVibGljIGtleSBhcyBhIGRlcGxveSBrZXkgb24gdHdvIHJlcG9zLCBzbyB0aGUgcmV2b2tlIHJlcG8gaXNcbi8vIHJlYWNoZWQgd2l0aCBhIGtleSBkZXJpdmVkIGZyb20gdGhlIHNvdXJjZSdzLCB1bmRlciB0aGlzIGxhYmVsLlxuZXhwb3J0IGNvbnN0IFJFVk9LRV9LRVlfTEFCRUwgPSBcInJldm9rZWdpdGh1YmtleVwiO1xuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlUmVwb1VSTChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIGxldCB3aXRob3V0R2l0ID0gc291cmNlVVJMLnJlcGxhY2UoL1xcLmdpdCQvLCBcIlwiKTtcbiAgICByZXR1cm4gYCR7d2l0aG91dEdpdH0ke1JFVk9LRURfU1VGRklYfS5naXRgO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gcmV2b2tlS2V5UGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPX0tFWVNfRElSfS8ke3NvdXJjZU5hbWUoc291cmNlVVJMKX0ke1JFVk9LRURfU1VGRklYfWA7XG59XG5cbmV4cG9ydCBmdW5jdGlvbiByZXZva2VSZXBvUGF0aChzb3VyY2VVUkw6IHN0cmluZykge1xuICAgIHJldHVybiBgJHtSRVBPU19ESVJ9LyR7c291cmNlTmFtZShzb3VyY2VVUkwpfSR7UkVWT0tFRF9TVUZGSVh9YDtcbn1cblxuLyoqIFRoZSByZXZva2UgcmVwbydzIGtleSwgd29ya2VkIG91dCBmcm9tIHRoZSBzb3VyY2UgcmVwbydzIGtleS4gQW55dGhpbmcgaG9sZGluZyB0aGUgc291cmNlIGtleVxuICAgIGNhbiBwcm9kdWNlIGl0LCBzbyBpdCBuZXZlciBoYXMgdG8gYmUgc3RvcmVkIGFueXdoZXJlIHNlcGFyYXRlbHkgb3IgaGFuZGVkIGFyb3VuZC4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXJpdmVSZXZva2VLZXkoc291cmNlUHJpdmF0ZUtleTogc3RyaW5nKSB7XG4gICAgbGV0IHNvdXJjZSA9IHBhcnNlT3BlblNTSFByaXZhdGVLZXkoc291cmNlUHJpdmF0ZUtleSk7XG4gICAgbGV0IGRlcml2ZWQgPSBkZXJpdmVFZDI1NTE5S2V5KHsgc2VlZDogc291cmNlLnNlZWQsIGxhYmVsOiBSRVZPS0VfS0VZX0xBQkVMIH0pO1xuICAgIHJldHVybiB7XG4gICAgICAgIHB1YmxpY0tleTogYHNzaC1lZDI1NTE5ICR7QnVmZmVyLmNvbmNhdChbXG4gICAgICAgICAgICBCdWZmZXIuZnJvbShbMCwgMCwgMCwgMTFdKSwgQnVmZmVyLmZyb20oXCJzc2gtZWQyNTUxOVwiKSxcbiAgICAgICAgICAgIEJ1ZmZlci5mcm9tKFswLCAwLCAwLCAzMl0pLCBkZXJpdmVkLnB1YmxpY0tleSxcbiAgICAgICAgXSkudG9TdHJpbmcoXCJiYXNlNjRcIil9YCxcbiAgICAgICAgcHJpdmF0ZUtleUZpbGU6IGZvcm1hdE9wZW5TU0hQcml2YXRlS2V5KHtcbiAgICAgICAgICAgIHNlZWQ6IGRlcml2ZWQuc2VlZCxcbiAgICAgICAgICAgIGNvbW1lbnQ6IGAke3NvdXJjZS5jb21tZW50IHx8IFwicG9ydHNlY3VyZVwifSAke1JFVk9LRV9LRVlfTEFCRUx9YCxcbiAgICAgICAgfSksXG4gICAgfTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "9f16cd6aea6e1f1a646eda715ac4cac70dc67579ce23c1e473bd371b7985b229"; */