sliftutils 1.7.127 → 1.7.129

package/security/authorizedKeys/daemon/dist/sessions.ts.cache

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.describeEndedSessions = exports.describeAllEnded = exports.endAllSSHSessions = exports.endSessionsUsingKey = exports.parseAcceptedSessions = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const spawn_1 = require("../../helpers/spawn");
+const paths_1 = require("./paths");
+// Taking a key out of authorized_keys only stops the next login. Whoever is already connected with
+// it stays connected for as long as they like, which would make revoking a key that is being
+// actively misused close to pointless.
+//
+// sshd names the key it accepted and the process handling that connection on the same line, so the
+// sessions belonging to one key can be ended without touching anyone else's.
+const ACCEPTED = /(?:sshd|sshd-session)\[(\d+)\]:\s+Accepted publickey for (\S+) from (\S+) port (\d+) ssh2: \S+ (SHA256:[A-Za-z0-9+/=]+)/;
+function parseAcceptedSessions(contents, fingerprint) {
+    let sessions = [];
+    for (let line of contents.split("\n")) {
+        let match = line.match(ACCEPTED);
+        if (!match || match[5] !== fingerprint) {
+            continue;
+        }
+        sessions.push({ processId: Number(match[1]), user: match[2], ip: match[3], port: match[4] });
+    }
+    return sessions;
+}
+exports.parseAcceptedSessions = parseAcceptedSessions;
+/** Process ids are reused, so one is only killed when it is still an ssh session. Killing whatever
+    happens to hold that number now would be far worse than missing a session. */
+async function isSSHSession(processId) {
+    try {
+        let name = await promises_1.default.readFile(`/proc/${processId}/comm`, "utf8");
+        return name.trim().startsWith("sshd");
+    }
+    catch (e) {
+        return false;
+    }
+}
+/** The whole log, not only what is new, because the session being ended may have been established
+    long before the key was misused. */
+async function readWholeAuthLog() {
+    try {
+        return await promises_1.default.readFile(paths_1.AUTH_LOG_PATH, "utf8");
+    }
+    catch (e) {
+        let result = await (0, spawn_1.spawnPromise)({
+            command: "journalctl",
+            args: ["-u", "ssh", "-u", "sshd", "--no-pager", "--since", "-30days"],
+        });
+        return result.status === 0 && result.stdout || "";
+    }
+}
+/** Ends every live session that authenticated with this key. Returns what was ended, so the
+    revocation can say so rather than leaving it to be discovered. */
+async function endSessionsUsingKey(fingerprint) {
+    let ended = [];
+    for (let session of parseAcceptedSessions(await readWholeAuthLog(), fingerprint)) {
+        if (session.processId <= 1 || session.processId === process.pid) {
+            continue;
+        }
+        if (!await isSSHSession(session.processId)) {
+            continue;
+        }
+        try {
+            process.kill(session.processId, "SIGKILL");
+            ended.push(session);
+            console.log(`Ended ssh session ${session.processId} (${session.user} from ${session.ip}), it used ${fingerprint}`);
+        }
+        catch (e) {
+            // Gone between looking and killing, which is the outcome we wanted anyway.
+        }
+    }
+    return ended;
+}
+exports.endSessionsUsingKey = endSessionsUsingKey;
+/** Whether this process is one connection. The listener is not a connection - it is the process
+    that accepts them - so it is not a candidate here at all.
+
+    Every openssh since 9.8 runs each connection as its own sshd-session. On older ones connections
+    are named sshd too, and the listener is the one systemd started directly with -D. */
+async function isConnectionProcess(processId) {
+    var _a;
+    let name;
+    try {
+        name = (await promises_1.default.readFile(`/proc/${processId}/comm`, "utf8")).trim();
+    }
+    catch (e) {
+        return false;
+    }
+    if (name === "sshd-session") {
+        return true;
+    }
+    if (name !== "sshd") {
+        return false;
+    }
+    let commandLine = await promises_1.default.readFile(`/proc/${processId}/cmdline`, "utf8").catch(() => "");
+    let parentId = Number(((_a = (await promises_1.default.readFile(`/proc/${processId}/stat`, "utf8").catch(() => "")).split(") ")[1]) === null || _a === void 0 ? void 0 : _a.split(" ")[1]) || 0);
+    return !commandLine.includes("-D") && parentId !== 1;
+}
+/** Disconnects every ssh session on the machine.
+
+    Not only the ones using the key that was just taken away: a session that predates the key being
+    removed is exactly as dangerous, and working out which sessions are still entitled to be here
+    is guesswork. Anyone who still has access can reconnect in a second, and anyone who does not
+    should not be here. */
+async function endAllSSHSessions() {
+    let ended = [];
+    for (let entry of await promises_1.default.readdir("/proc")) {
+        let processId = Number(entry);
+        if (!processId || processId <= 1 || processId === process.pid) {
+            continue;
+        }
+        if (!await isConnectionProcess(processId)) {
+            continue;
+        }
+        try {
+            process.kill(processId, "SIGKILL");
+            ended.push(processId);
+        }
+        catch (e) {
+            // Gone between looking and killing, which is the outcome we wanted anyway.
+        }
+    }
+    if (ended.length) {
+        console.log(`Disconnected ${ended.length} ssh session(s): ${ended.join(", ")}`);
+    }
+    return ended;
+}
+exports.endAllSSHSessions = endAllSSHSessions;
+function describeAllEnded(ended) {
+    if (!ended.length) {
+        return " Nothing was connected.";
+    }
+    return ` Every ssh session on this machine was disconnected, ${ended.length} of them.`;
+}
+exports.describeAllEnded = describeAllEnded;
+function describeEndedSessions(ended) {
+    if (!ended.length) {
+        return " Nothing was connected with it.";
+    }
+    return ` ${ended.length} live session(s) using it were killed: `
+        + ended.map(session => `${session.user}@${session.ip}:${session.port}`).join(", ") + ".";
+}
+exports.describeEndedSessions = describeEndedSessions;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Vzc2lvbnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJzZXNzaW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBNkI7QUFDN0IsK0NBQW1EO0FBQ25ELG1DQUF3QztBQUV4QyxtR0FBbUc7QUFDbkcsNkZBQTZGO0FBQzdGLHVDQUF1QztBQUN2QyxFQUFFO0FBQ0YsbUdBQW1HO0FBQ25HLDZFQUE2RTtBQUM3RSxNQUFNLFFBQVEsR0FBRyx5SEFBeUgsQ0FBQztBQUkzSSxTQUFnQixxQkFBcUIsQ0FBQyxRQUFnQixFQUFFLFdBQW1CO0lBQ3ZFLElBQUksUUFBUSxHQUFpQixFQUFFLENBQUM7SUFDaEMsS0FBSyxJQUFJLElBQUksSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDcEMsSUFBSSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqQyxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxXQUFXLEVBQUUsQ0FBQztZQUNyQyxTQUFTO1FBQ2IsQ0FBQztRQUNELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDcEIsQ0FBQztBQVZELHNEQVVDO0FBRUQ7aUZBQ2lGO0FBQ2pGLEtBQUssVUFBVSxZQUFZLENBQUMsU0FBaUI7SUFDekMsSUFBSSxDQUFDO1FBQ0QsSUFBSSxJQUFJLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLFNBQVMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ2hFLE9BQU8sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDO0FBRUQ7dUNBQ3VDO0FBQ3ZDLEtBQUssVUFBVSxnQkFBZ0I7SUFDM0IsSUFBSSxDQUFDO1FBQ0QsT0FBTyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLHFCQUFhLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQVksRUFBQztZQUM1QixPQUFPLEVBQUUsWUFBWTtZQUNyQixJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUM7U0FDeEUsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUN0RCxDQUFDO0FBQ0wsQ0FBQztBQUVEO3FFQUNxRTtBQUM5RCxLQUFLLFVBQVUsbUJBQW1CLENBQUMsV0FBbUI7SUFDekQsSUFBSSxLQUFLLEdBQWlCLEVBQUUsQ0FBQztJQUM3QixLQUFLLElBQUksT0FBTyxJQUFJLHFCQUFxQixDQUFDLE1BQU0sZ0JBQWdCLEVBQUUsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQy9FLElBQUksT0FBTyxDQUFDLFNBQVMsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsS0FBSyxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDOUQsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxZQUFZLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDekMsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDRCxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDM0MsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUNwQixPQUFPLENBQUMsR0FBRyxDQUFDLHFCQUFxQixPQUFPLENBQUMsU0FBUyxLQUFLLE9BQU8sQ0FBQyxJQUFJLFNBQVMsT0FBTyxDQUFDLEVBQUUsY0FBYyxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZILENBQUM7UUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1QsMkVBQTJFO1FBQy9FLENBQUM7SUFDTCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDakIsQ0FBQztBQWxCRCxrREFrQkM7QUFFRDs7Ozt3RkFJd0Y7QUFDeEYsS0FBSyxVQUFVLG1CQUFtQixDQUFDLFNBQWlCOztJQUNoRCxJQUFJLElBQVksQ0FBQztJQUNqQixJQUFJLENBQUM7UUFDRCxJQUFJLEdBQUcsQ0FBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLFNBQVMsU0FBUyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN6RSxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFDRCxJQUFJLElBQUksS0FBSyxjQUFjLEVBQUUsQ0FBQztRQUMxQixPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxJQUFJLEtBQUssTUFBTSxFQUFFLENBQUM7UUFDbEIsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztJQUNELElBQUksV0FBVyxHQUFHLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxTQUFTLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDMUYsSUFBSSxRQUFRLEdBQUcsTUFBTSxDQUFDLENBQUEsTUFBQSxDQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxTQUFTLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLDBDQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLEtBQUksQ0FBQyxDQUFDLENBQUM7SUFDakksT0FBTyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksUUFBUSxLQUFLLENBQUMsQ0FBQztBQUN6RCxDQUFDO0FBRUQ7Ozs7OzBCQUswQjtBQUNuQixLQUFLLFVBQVUsaUJBQWlCO0lBQ25DLElBQUksS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUN6QixLQUFLLElBQUksS0FBSyxJQUFJLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUMxQyxJQUFJLFNBQVMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDOUIsSUFBSSxDQUFDLFNBQVMsSUFBSSxTQUFTLElBQUksQ0FBQyxJQUFJLFNBQVMsS0FBSyxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDNUQsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3hDLFNBQVM7UUFDYixDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0QsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDbkMsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMxQixDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNULDJFQUEyRTtRQUMvRSxDQUFDO0lBQ0wsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2YsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsS0FBSyxDQUFDLE1BQU0sb0JBQW9CLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQztBQUNqQixDQUFDO0FBckJELDhDQXFCQztBQUVELFNBQWdCLGdCQUFnQixDQUFDLEtBQWU7SUFDNUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNoQixPQUFPLHlCQUF5QixDQUFDO0lBQ3JDLENBQUM7SUFDRCxPQUFPLHdEQUF3RCxLQUFLLENBQUMsTUFBTSxXQUFXLENBQUM7QUFDM0YsQ0FBQztBQUxELDRDQUtDO0FBRUQsU0FBZ0IscUJBQXFCLENBQUMsS0FBbUI7SUFDckQsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNoQixPQUFPLGlDQUFpQyxDQUFDO0lBQzdDLENBQUM7SUFDRCxPQUFPLElBQUksS0FBSyxDQUFDLE1BQU0seUNBQXlDO1VBQzFELEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxJQUFJLElBQUksT0FBTyxDQUFDLEVBQUUsSUFBSSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsR0FBRyxDQUFDO0FBQ2pHLENBQUM7QUFORCxzREFNQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCB7IHNwYXduUHJvbWlzZSB9IGZyb20gXCIuLi8uLi9oZWxwZXJzL3NwYXduXCI7XG5pbXBvcnQgeyBBVVRIX0xPR19QQVRIIH0gZnJvbSBcIi4vcGF0aHNcIjtcblxuLy8gVGFraW5nIGEga2V5IG91dCBvZiBhdXRob3JpemVkX2tleXMgb25seSBzdG9wcyB0aGUgbmV4dCBsb2dpbi4gV2hvZXZlciBpcyBhbHJlYWR5IGNvbm5lY3RlZCB3aXRoXG4vLyBpdCBzdGF5cyBjb25uZWN0ZWQgZm9yIGFzIGxvbmcgYXMgdGhleSBsaWtlLCB3aGljaCB3b3VsZCBtYWtlIHJldm9raW5nIGEga2V5IHRoYXQgaXMgYmVpbmdcbi8vIGFjdGl2ZWx5IG1pc3VzZWQgY2xvc2UgdG8gcG9pbnRsZXNzLlxuLy9cbi8vIHNzaGQgbmFtZXMgdGhlIGtleSBpdCBhY2NlcHRlZCBhbmQgdGhlIHByb2Nlc3MgaGFuZGxpbmcgdGhhdCBjb25uZWN0aW9uIG9uIHRoZSBzYW1lIGxpbmUsIHNvIHRoZVxuLy8gc2Vzc2lvbnMgYmVsb25naW5nIHRvIG9uZSBrZXkgY2FuIGJlIGVuZGVkIHdpdGhvdXQgdG91Y2hpbmcgYW55b25lIGVsc2Uncy5cbmNvbnN0IEFDQ0VQVEVEID0gLyg/OnNzaGR8c3NoZC1zZXNzaW9uKVxcWyhcXGQrKVxcXTpcXHMrQWNjZXB0ZWQgcHVibGlja2V5IGZvciAoXFxTKykgZnJvbSAoXFxTKykgcG9ydCAoXFxkKykgc3NoMjogXFxTKyAoU0hBMjU2OltBLVphLXowLTkrLz1dKykvO1xuXG5leHBvcnQgdHlwZSBLZXlTZXNzaW9uID0geyBwcm9jZXNzSWQ6IG51bWJlcjsgdXNlcjogc3RyaW5nOyBpcDogc3RyaW5nOyBwb3J0OiBzdHJpbmcgfTtcblxuZXhwb3J0IGZ1bmN0aW9uIHBhcnNlQWNjZXB0ZWRTZXNzaW9ucyhjb250ZW50czogc3RyaW5nLCBmaW5nZXJwcmludDogc3RyaW5nKSB7XG4gICAgbGV0IHNlc3Npb25zOiBLZXlTZXNzaW9uW10gPSBbXTtcbiAgICBmb3IgKGxldCBsaW5lIG9mIGNvbnRlbnRzLnNwbGl0KFwiXFxuXCIpKSB7XG4gICAgICAgIGxldCBtYXRjaCA9IGxpbmUubWF0Y2goQUNDRVBURUQpO1xuICAgICAgICBpZiAoIW1hdGNoIHx8IG1hdGNoWzVdICE9PSBmaW5nZXJwcmludCkge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgc2Vzc2lvbnMucHVzaCh7IHByb2Nlc3NJZDogTnVtYmVyKG1hdGNoWzFdKSwgdXNlcjogbWF0Y2hbMl0sIGlwOiBtYXRjaFszXSwgcG9ydDogbWF0Y2hbNF0gfSk7XG4gICAgfVxuICAgIHJldHVybiBzZXNzaW9ucztcbn1cblxuLyoqIFByb2Nlc3MgaWRzIGFyZSByZXVzZWQsIHNvIG9uZSBpcyBvbmx5IGtpbGxlZCB3aGVuIGl0IGlzIHN0aWxsIGFuIHNzaCBzZXNzaW9uLiBLaWxsaW5nIHdoYXRldmVyXG4gICAgaGFwcGVucyB0byBob2xkIHRoYXQgbnVtYmVyIG5vdyB3b3VsZCBiZSBmYXIgd29yc2UgdGhhbiBtaXNzaW5nIGEgc2Vzc2lvbi4gKi9cbmFzeW5jIGZ1bmN0aW9uIGlzU1NIU2Vzc2lvbihwcm9jZXNzSWQ6IG51bWJlcikge1xuICAgIHRyeSB7XG4gICAgICAgIGxldCBuYW1lID0gYXdhaXQgZnMucmVhZEZpbGUoYC9wcm9jLyR7cHJvY2Vzc0lkfS9jb21tYCwgXCJ1dGY4XCIpO1xuICAgICAgICByZXR1cm4gbmFtZS50cmltKCkuc3RhcnRzV2l0aChcInNzaGRcIik7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICByZXR1cm4gZmFsc2U7XG4gICAgfVxufVxuXG4vKiogVGhlIHdob2xlIGxvZywgbm90IG9ubHkgd2hhdCBpcyBuZXcsIGJlY2F1c2UgdGhlIHNlc3Npb24gYmVpbmcgZW5kZWQgbWF5IGhhdmUgYmVlbiBlc3RhYmxpc2hlZFxuICAgIGxvbmcgYmVmb3JlIHRoZSBrZXkgd2FzIG1pc3VzZWQuICovXG5hc3luYyBmdW5jdGlvbiByZWFkV2hvbGVBdXRoTG9nKCkge1xuICAgIHRyeSB7XG4gICAgICAgIHJldHVybiBhd2FpdCBmcy5yZWFkRmlsZShBVVRIX0xPR19QQVRILCBcInV0ZjhcIik7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgICAgIGNvbW1hbmQ6IFwiam91cm5hbGN0bFwiLFxuICAgICAgICAgICAgYXJnczogW1wiLXVcIiwgXCJzc2hcIiwgXCItdVwiLCBcInNzaGRcIiwgXCItLW5vLXBhZ2VyXCIsIFwiLS1zaW5jZVwiLCBcIi0zMGRheXNcIl0sXG4gICAgICAgIH0pO1xuICAgICAgICByZXR1cm4gcmVzdWx0LnN0YXR1cyA9PT0gMCAmJiByZXN1bHQuc3Rkb3V0IHx8IFwiXCI7XG4gICAgfVxufVxuXG4vKiogRW5kcyBldmVyeSBsaXZlIHNlc3Npb24gdGhhdCBhdXRoZW50aWNhdGVkIHdpdGggdGhpcyBrZXkuIFJldHVybnMgd2hhdCB3YXMgZW5kZWQsIHNvIHRoZVxuICAgIHJldm9jYXRpb24gY2FuIHNheSBzbyByYXRoZXIgdGhhbiBsZWF2aW5nIGl0IHRvIGJlIGRpc2NvdmVyZWQuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZW5kU2Vzc2lvbnNVc2luZ0tleShmaW5nZXJwcmludDogc3RyaW5nKSB7XG4gICAgbGV0IGVuZGVkOiBLZXlTZXNzaW9uW10gPSBbXTtcbiAgICBmb3IgKGxldCBzZXNzaW9uIG9mIHBhcnNlQWNjZXB0ZWRTZXNzaW9ucyhhd2FpdCByZWFkV2hvbGVBdXRoTG9nKCksIGZpbmdlcnByaW50KSkge1xuICAgICAgICBpZiAoc2Vzc2lvbi5wcm9jZXNzSWQgPD0gMSB8fCBzZXNzaW9uLnByb2Nlc3NJZCA9PT0gcHJvY2Vzcy5waWQpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGlmICghYXdhaXQgaXNTU0hTZXNzaW9uKHNlc3Npb24ucHJvY2Vzc0lkKSkge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgdHJ5IHtcbiAgICAgICAgICAgIHByb2Nlc3Mua2lsbChzZXNzaW9uLnByb2Nlc3NJZCwgXCJTSUdLSUxMXCIpO1xuICAgICAgICAgICAgZW5kZWQucHVzaChzZXNzaW9uKTtcbiAgICAgICAgICAgIGNvbnNvbGUubG9nKGBFbmRlZCBzc2ggc2Vzc2lvbiAke3Nlc3Npb24ucHJvY2Vzc0lkfSAoJHtzZXNzaW9uLnVzZXJ9IGZyb20gJHtzZXNzaW9uLmlwfSksIGl0IHVzZWQgJHtmaW5nZXJwcmludH1gKTtcbiAgICAgICAgfSBjYXRjaCAoZSkge1xuICAgICAgICAgICAgLy8gR29uZSBiZXR3ZWVuIGxvb2tpbmcgYW5kIGtpbGxpbmcsIHdoaWNoIGlzIHRoZSBvdXRjb21lIHdlIHdhbnRlZCBhbnl3YXkuXG4gICAgICAgIH1cbiAgICB9XG4gICAgcmV0dXJuIGVuZGVkO1xufVxuXG4vKiogV2hldGhlciB0aGlzIHByb2Nlc3MgaXMgb25lIGNvbm5lY3Rpb24uIFRoZSBsaXN0ZW5lciBpcyBub3QgYSBjb25uZWN0aW9uIC0gaXQgaXMgdGhlIHByb2Nlc3NcbiAgICB0aGF0IGFjY2VwdHMgdGhlbSAtIHNvIGl0IGlzIG5vdCBhIGNhbmRpZGF0ZSBoZXJlIGF0IGFsbC5cblxuICAgIEV2ZXJ5IG9wZW5zc2ggc2luY2UgOS44IHJ1bnMgZWFjaCBjb25uZWN0aW9uIGFzIGl0cyBvd24gc3NoZC1zZXNzaW9uLiBPbiBvbGRlciBvbmVzIGNvbm5lY3Rpb25zXG4gICAgYXJlIG5hbWVkIHNzaGQgdG9vLCBhbmQgdGhlIGxpc3RlbmVyIGlzIHRoZSBvbmUgc3lzdGVtZCBzdGFydGVkIGRpcmVjdGx5IHdpdGggLUQuICovXG5hc3luYyBmdW5jdGlvbiBpc0Nvbm5lY3Rpb25Qcm9jZXNzKHByb2Nlc3NJZDogbnVtYmVyKSB7XG4gICAgbGV0IG5hbWU6IHN0cmluZztcbiAgICB0cnkge1xuICAgICAgICBuYW1lID0gKGF3YWl0IGZzLnJlYWRGaWxlKGAvcHJvYy8ke3Byb2Nlc3NJZH0vY29tbWAsIFwidXRmOFwiKSkudHJpbSgpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbiAgICBpZiAobmFtZSA9PT0gXCJzc2hkLXNlc3Npb25cIikge1xuICAgICAgICByZXR1cm4gdHJ1ZTtcbiAgICB9XG4gICAgaWYgKG5hbWUgIT09IFwic3NoZFwiKSB7XG4gICAgICAgIHJldHVybiBmYWxzZTtcbiAgICB9XG4gICAgbGV0IGNvbW1hbmRMaW5lID0gYXdhaXQgZnMucmVhZEZpbGUoYC9wcm9jLyR7cHJvY2Vzc0lkfS9jbWRsaW5lYCwgXCJ1dGY4XCIpLmNhdGNoKCgpID0+IFwiXCIpO1xuICAgIGxldCBwYXJlbnRJZCA9IE51bWJlcigoYXdhaXQgZnMucmVhZEZpbGUoYC9wcm9jLyR7cHJvY2Vzc0lkfS9zdGF0YCwgXCJ1dGY4XCIpLmNhdGNoKCgpID0+IFwiXCIpKS5zcGxpdChcIikgXCIpWzFdPy5zcGxpdChcIiBcIilbMV0gfHwgMCk7XG4gICAgcmV0dXJuICFjb21tYW5kTGluZS5pbmNsdWRlcyhcIi1EXCIpICYmIHBhcmVudElkICE9PSAxO1xufVxuXG4vKiogRGlzY29ubmVjdHMgZXZlcnkgc3NoIHNlc3Npb24gb24gdGhlIG1hY2hpbmUuXG5cbiAgICBOb3Qgb25seSB0aGUgb25lcyB1c2luZyB0aGUga2V5IHRoYXQgd2FzIGp1c3QgdGFrZW4gYXdheTogYSBzZXNzaW9uIHRoYXQgcHJlZGF0ZXMgdGhlIGtleSBiZWluZ1xuICAgIHJlbW92ZWQgaXMgZXhhY3RseSBhcyBkYW5nZXJvdXMsIGFuZCB3b3JraW5nIG91dCB3aGljaCBzZXNzaW9ucyBhcmUgc3RpbGwgZW50aXRsZWQgdG8gYmUgaGVyZVxuICAgIGlzIGd1ZXNzd29yay4gQW55b25lIHdobyBzdGlsbCBoYXMgYWNjZXNzIGNhbiByZWNvbm5lY3QgaW4gYSBzZWNvbmQsIGFuZCBhbnlvbmUgd2hvIGRvZXMgbm90XG4gICAgc2hvdWxkIG5vdCBiZSBoZXJlLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGVuZEFsbFNTSFNlc3Npb25zKCkge1xuICAgIGxldCBlbmRlZDogbnVtYmVyW10gPSBbXTtcbiAgICBmb3IgKGxldCBlbnRyeSBvZiBhd2FpdCBmcy5yZWFkZGlyKFwiL3Byb2NcIikpIHtcbiAgICAgICAgbGV0IHByb2Nlc3NJZCA9IE51bWJlcihlbnRyeSk7XG4gICAgICAgIGlmICghcHJvY2Vzc0lkIHx8IHByb2Nlc3NJZCA8PSAxIHx8IHByb2Nlc3NJZCA9PT0gcHJvY2Vzcy5waWQpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGlmICghYXdhaXQgaXNDb25uZWN0aW9uUHJvY2Vzcyhwcm9jZXNzSWQpKSB7XG4gICAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICB0cnkge1xuICAgICAgICAgICAgcHJvY2Vzcy5raWxsKHByb2Nlc3NJZCwgXCJTSUdLSUxMXCIpO1xuICAgICAgICAgICAgZW5kZWQucHVzaChwcm9jZXNzSWQpO1xuICAgICAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgICAgICAvLyBHb25lIGJldHdlZW4gbG9va2luZyBhbmQga2lsbGluZywgd2hpY2ggaXMgdGhlIG91dGNvbWUgd2Ugd2FudGVkIGFueXdheS5cbiAgICAgICAgfVxuICAgIH1cbiAgICBpZiAoZW5kZWQubGVuZ3RoKSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGBEaXNjb25uZWN0ZWQgJHtlbmRlZC5sZW5ndGh9IHNzaCBzZXNzaW9uKHMpOiAke2VuZGVkLmpvaW4oXCIsIFwiKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIGVuZGVkO1xufVxuXG5leHBvcnQgZnVuY3Rpb24gZGVzY3JpYmVBbGxFbmRlZChlbmRlZDogbnVtYmVyW10pIHtcbiAgICBpZiAoIWVuZGVkLmxlbmd0aCkge1xuICAgICAgICByZXR1cm4gXCIgTm90aGluZyB3YXMgY29ubmVjdGVkLlwiO1xuICAgIH1cbiAgICByZXR1cm4gYCBFdmVyeSBzc2ggc2Vzc2lvbiBvbiB0aGlzIG1hY2hpbmUgd2FzIGRpc2Nvbm5lY3RlZCwgJHtlbmRlZC5sZW5ndGh9IG9mIHRoZW0uYDtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGRlc2NyaWJlRW5kZWRTZXNzaW9ucyhlbmRlZDogS2V5U2Vzc2lvbltdKSB7XG4gICAgaWYgKCFlbmRlZC5sZW5ndGgpIHtcbiAgICAgICAgcmV0dXJuIFwiIE5vdGhpbmcgd2FzIGNvbm5lY3RlZCB3aXRoIGl0LlwiO1xuICAgIH1cbiAgICByZXR1cm4gYCAke2VuZGVkLmxlbmd0aH0gbGl2ZSBzZXNzaW9uKHMpIHVzaW5nIGl0IHdlcmUga2lsbGVkOiBgXG4gICAgICAgICsgZW5kZWQubWFwKHNlc3Npb24gPT4gYCR7c2Vzc2lvbi51c2VyfUAke3Nlc3Npb24uaXB9OiR7c2Vzc2lvbi5wb3J0fWApLmpvaW4oXCIsIFwiKSArIFwiLlwiO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "cf2ea8f23e7beb7a09486c083165a234b4ab5ff28fd30dc6d6a9f582ff201eaf"; */

package/security/authorizedKeys/daemon/dist/state.ts.cache

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.saveState = exports.loadState = exports.sourceState = exports.getState = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("./paths");
+let state = {
+    sources: {},
+    userKeyHashes: {},
+    revocations: {},
+    unrevokeFirstSeen: {},
+    pendingRevocations: [],
+    appliedKeys: [],
+    authLogOffset: 0,
+    authLogSignature: "",
+};
+function getState() {
+    return state;
+}
+exports.getState = getState;
+/** Per source progress, created on first use so a newly added source starts clean. */
+function sourceState(repoURL) {
+    let existing = state.sources[repoURL];
+    if (existing) {
+        return existing;
+    }
+    let created = {
+        lastSha: "",
+        branch: "",
+        accepted: false,
+        acceptedSigner: "",
+        acceptedKeys: [],
+        acceptedManifestHash: "",
+        acceptedSignatureHash: "",
+        pendingSigner: "",
+        pendingSince: 0,
+        reportedProblem: "",
+    };
+    state.sources[repoURL] = created;
+    return created;
+}
+exports.sourceState = sourceState;
+async function loadState() {
+    let contents;
+    try {
+        contents = await promises_1.default.readFile(paths_1.STATE_PATH, "utf8");
+    }
+    catch (e) {
+        return;
+    }
+    try {
+        let loaded = JSON.parse(contents);
+        // Revocations are held in memory only, so whatever an older version left on disk is not
+        // read back in. Starting the daemon is what forgets them.
+        delete loaded.revocations;
+        state = Object.assign(state, loaded);
+    }
+    catch (e) {
+        // Corrupt state only costs us one duplicate notification, so it is not worth failing over.
+        console.log(`Ignoring unreadable state file ${paths_1.STATE_PATH}. ${e}`);
+    }
+}
+exports.loadState = loadState;
+async function saveState() {
+    let { revocations, ...persisted } = state;
+    await promises_1.default.mkdir(path_1.default.dirname(paths_1.STATE_PATH), { recursive: true });
+    await promises_1.default.writeFile(paths_1.STATE_PATH, JSON.stringify(persisted, undefined, 4), { mode: 0o600 });
+}
+exports.saveState = saveState;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJzdGF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBNkI7QUFDN0IsZ0RBQXdCO0FBQ3hCLG1DQUFxQztBQTZFckMsSUFBSSxLQUFLLEdBQWdCO0lBQ3JCLE9BQU8sRUFBRSxFQUFFO0lBQ1gsYUFBYSxFQUFFLEVBQUU7SUFDakIsV0FBVyxFQUFFLEVBQUU7SUFDZixpQkFBaUIsRUFBRSxFQUFFO0lBQ3JCLGtCQUFrQixFQUFFLEVBQUU7SUFDdEIsV0FBVyxFQUFFLEVBQUU7SUFDZixhQUFhLEVBQUUsQ0FBQztJQUNoQixnQkFBZ0IsRUFBRSxFQUFFO0NBQ3ZCLENBQUM7QUFFRixTQUFnQixRQUFRO0lBQ3BCLE9BQU8sS0FBSyxDQUFDO0FBQ2pCLENBQUM7QUFGRCw0QkFFQztBQUVELHNGQUFzRjtBQUN0RixTQUFnQixXQUFXLENBQUMsT0FBZTtJQUN2QyxJQUFJLFFBQVEsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3RDLElBQUksUUFBUSxFQUFFLENBQUM7UUFDWCxPQUFPLFFBQVEsQ0FBQztJQUNwQixDQUFDO0lBQ0QsSUFBSSxPQUFPLEdBQWdCO1FBQ3ZCLE9BQU8sRUFBRSxFQUFFO1FBQ1gsTUFBTSxFQUFFLEVBQUU7UUFDVixRQUFRLEVBQUUsS0FBSztRQUNmLGNBQWMsRUFBRSxFQUFFO1FBQ2xCLFlBQVksRUFBRSxFQUFFO1FBQ2hCLG9CQUFvQixFQUFFLEVBQUU7UUFDeEIscUJBQXFCLEVBQUUsRUFBRTtRQUN6QixhQUFhLEVBQUUsRUFBRTtRQUNqQixZQUFZLEVBQUUsQ0FBQztRQUNmLGVBQWUsRUFBRSxFQUFFO0tBQ3RCLENBQUM7SUFDRixLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLE9BQU8sQ0FBQztJQUNqQyxPQUFPLE9BQU8sQ0FBQztBQUNuQixDQUFDO0FBbkJELGtDQW1CQztBQUVNLEtBQUssVUFBVSxTQUFTO0lBQzNCLElBQUksUUFBUSxDQUFDO0lBQ2IsSUFBSSxDQUFDO1FBQ0QsUUFBUSxHQUFHLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsa0JBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNULE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsSUFBSSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNsQyx3RkFBd0Y7UUFDeEYsMERBQTBEO1FBQzFELE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQztRQUMxQixLQUFLLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCwyRkFBMkY7UUFDM0YsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQ0FBa0Msa0JBQVUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7QUFDTCxDQUFDO0FBakJELDhCQWlCQztBQUVNLEtBQUssVUFBVSxTQUFTO0lBQzNCLElBQUksRUFBRSxXQUFXLEVBQUUsR0FBRyxTQUFTLEVBQUUsR0FBRyxLQUFLLENBQUM7SUFDMUMsTUFBTSxrQkFBRSxDQUFDLEtBQUssQ0FBQyxjQUFJLENBQUMsT0FBTyxDQUFDLGtCQUFVLENBQUMsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlELE1BQU0sa0JBQUUsQ0FBQyxTQUFTLENBQUMsa0JBQVUsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztBQUM3RixDQUFDO0FBSkQsOEJBSUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuaW1wb3J0IHsgU1RBVEVfUEFUSCB9IGZyb20gXCIuL3BhdGhzXCI7XG5cbi8qKiBXaGF0IHdlIGxhc3QgZGVjaWRlZCB0byB0cnVzdCBmb3Igb25lIHNvdXJjZSwga2VwdCBvbiBkaXNrIHNvIG5vYm9keSBjYW4gdGVsbCB1cyBhIGRpZmZlcmVudFxuICAgIHN0b3J5IGFib3V0IHdoYXQgd2Ugc2F3IGxhc3QgdGltZS4gKi9cbmV4cG9ydCB0eXBlIFNvdXJjZVN0YXRlID0ge1xuICAgIGxhc3RTaGE6IHN0cmluZztcbiAgICBicmFuY2g6IHN0cmluZztcbiAgICBhY2NlcHRlZDogYm9vbGVhbjtcbiAgICBhY2NlcHRlZFNpZ25lcjogc3RyaW5nO1xuICAgIGFjY2VwdGVkS2V5czogc3RyaW5nW107XG4gICAgYWNjZXB0ZWRNYW5pZmVzdEhhc2g6IHN0cmluZztcbiAgICBhY2NlcHRlZFNpZ25hdHVyZUhhc2g6IHN0cmluZztcbiAgICBwZW5kaW5nU2lnbmVyOiBzdHJpbmc7XG4gICAgcGVuZGluZ1NpbmNlOiBudW1iZXI7XG4gICAgcmVwb3J0ZWRQcm9ibGVtOiBzdHJpbmc7XG59O1xuXG4vKiogT25lIHJldm9jYXRpb24gZXZlbnQ6IHRoaXMga2V5LCB1c2VkIGZyb20gdGhpcyBhZGRyZXNzLCBzbyBpdCBpcyBubyBsb25nZXIgYWNjZXB0ZWQuIEtlcHQgZXZlblxuICAgIHdoZW4gdGhlIHJldm9rZSByZXBvIG5vIGxvbmdlciBsaXN0cyBpdDogdGhlIGRlcGxveSBrZXkgdGhhdCB3cml0ZXMgcmV2b2NhdGlvbnMgbGl2ZXMgb24gZXZlcnlcbiAgICBzZXJ2ZXIsIHNvIGFuIGF0dGFja2VyIHdobyB0b29rIG9uZSBjb3VsZCBvdGhlcndpc2UgZGVsZXRlIHRoZSByZXZvY2F0aW9uIHRoYXQgbG9ja2VkIHRoZW0gb3V0LlxuXG4gICAgVGhlIGlkIGlzIHVuaXF1ZSB0byB0aGUgZXZlbnQsIG5ldmVyIGRlcml2ZWQgZnJvbSB0aGUga2V5LiBBIGtleSB0aGF0IGhhcyBiZWVuIGZvcmdpdmVuIGZvciBvbmVcbiAgICBhZGRyZXNzIGlzIHN0aWxsIGFuIG9yZGluYXJ5IGtleSwgYW5kIHVzaW5nIGl0IGZyb20gc29tZSBvdGhlciBhZGRyZXNzIHJldm9rZXMgaXQgYWdhaW4sIHdpdGggYVxuICAgIG5ldyBpZCB0aGF0IG5vIGV4aXN0aW5nIHVucmV2b2tlIG5hbWVzLiAqL1xuZXhwb3J0IHR5cGUgUmV2b2NhdGlvblN0YXRlID0ge1xuICAgIHJldm9jYXRpb25JZDogc3RyaW5nO1xuICAgIGZpbmdlcnByaW50OiBzdHJpbmc7XG4gICAgLy8gVGhlIGFkZHJlc3MgaXQgd2FzIHVzZWQgZnJvbS4gSGFsZiBvZiB3aGF0IGEgcmV2b2NhdGlvbiBzYXlzLCBhbmQgdGhlIGhhbGYgYW4gdW5yZXZva2UgaGFzXG4gICAgLy8gdG8gbmFtZSB0byB1bmRvIGl0LlxuICAgIGlwOiBzdHJpbmc7XG4gICAgLy8gV2h5IHRoaXMga2V5IHdhcyByZXZva2VkLCBjYXJyaWVkIGZyb20gdGhlIHJldm9jYXRpb24gZmlsZSBzbyBhIG1hY2hpbmUgdGhhdCByZWFkcyBvbmVcbiAgICAvLyB3cml0dGVuIGVsc2V3aGVyZSBjYW4gc2F5IHdoYXQgaGFwcGVuZWQgcmF0aGVyIHRoYW4gb25seSB0aGF0IHNvbWV0aGluZyBkaWQuXG4gICAgcmV2b2tlZEF0OiBzdHJpbmc7XG4gICAgcmV2b2tlZEJ5OiBzdHJpbmc7XG4gICAgcmVhc29uOiBzdHJpbmc7XG4gICAgLy8gV2hpY2ggdW5yZXZva2UgYWxsb3dlZCB0aGlzIGtleSBmcm9tIHRoaXMgYWRkcmVzcywgb25jZSBvbmUgaGFzIGJlZW4gc2Vlbi4gV2hlbiB0aGUgd2FpdCBpdFxuICAgIC8vIHN0YXJ0ZWQgcnVucyBvdXQgaXMgaW4gdW5yZXZva2VGaXJzdFNlZW4sIHdoaWNoIG91dGxpdmVzIHRoZSBkYWVtb24uXG4gICAgdW5yZXZva2VJZDogc3RyaW5nO1xuICAgIHVucmV2b2tlZDogYm9vbGVhbjtcbiAgICAvLyBXaGV0aGVyIHdlIGhhdmUgc2FpZCB0aGF0IHRoaXMga2V5IGFjdHVhbGx5IGxlZnQgcm9vdCdzIGF1dGhvcml6ZWRfa2V5cy4gVGhlIHJlbW92YWwgaXMgdGhlXG4gICAgLy8gdGhpbmcgd29ydGggcmVwb3J0aW5nLCBhbmQgaXQgaXMgd29ydGggcmVwb3J0aW5nIGV4YWN0bHkgb25jZS5cbiAgICByZXBvcnRlZFJlbW92ZWQ6IGJvb2xlYW47XG59O1xuXG4vKiogQSByZWZ1c2FsIHdlIHNhdyBidXQgY291bGQgbm90IHdyaXRlIGRvd24geWV0LiBIZWxkIHVudGlsIGl0IGlzIHJlY29yZGVkLCBiZWNhdXNlIHRoZSBsb2cgaXNcbiAgICByZWFkIG9uY2UgYW5kIG1vdmVzIG9uOiBsb3Npbmcgb25lIG9mIHRoZXNlIHRvIGEgcmVwbyB0aGF0IGhhcHBlbmVkIHRvIGJlIHVucmVhY2hhYmxlIHdvdWxkXG4gICAgbGVhdmUgYSBrZXkgdGhhdCB3YXMgbWlzdXNlZCBhY2NlcHRlZCBmb3JldmVyLiAqL1xuZXhwb3J0IHR5cGUgUGVuZGluZ1Jldm9jYXRpb24gPSB7XG4gICAgZmluZ2VycHJpbnQ6IHN0cmluZztcbiAgICBrZXlMaW5lOiBzdHJpbmc7XG4gICAgc291cmNlVVJMOiBzdHJpbmc7XG4gICAgYXR0ZW1wdDogeyBpcDogc3RyaW5nOyB1c2VyOiBzdHJpbmc7IHBvcnQ6IHN0cmluZzsgcmVxdWlyZWQ6IHN0cmluZzsgbGluZTogc3RyaW5nIH07XG59O1xuXG5leHBvcnQgdHlwZSBEYWVtb25TdGF0ZSA9IHtcbiAgICBzb3VyY2VzOiB7IFtyZXBvVVJMOiBzdHJpbmddOiBTb3VyY2VTdGF0ZSB9O1xuICAgIHVzZXJLZXlIYXNoZXM6IHsgW3VzZXJOYW1lOiBzdHJpbmddOiBzdHJpbmcgfTtcbiAgICAvLyBIZWxkIGluIG1lbW9yeSBvbmx5LCBuZXZlciB3cml0dGVuIHRvIGRpc2suIERlbGV0aW5nIGEgcmV2b2NhdGlvbiBmcm9tIHRoZSByZXZva2UgcmVwbyBkb2VzXG4gICAgLy8gbm90IGJyaW5nIGEga2V5IGJhY2ssIGJlY2F1c2UgdGhpcyBtYWNoaW5lIHN0aWxsIHJlbWVtYmVycyBpdCAtIHRoZSBrZXkgdGhhdCB3cml0ZXNcbiAgICAvLyByZXZvY2F0aW9ucyBpcyBvbiBldmVyeSBzZXJ2ZXIsIHNvIHdob2V2ZXIgc3RvbGUgb25lIGNvdWxkIG90aGVyd2lzZSBlcmFzZSB0aGUgcmVjb3JkIHRoYXRcbiAgICAvLyBzaHV0IHRoZW0gb3V0LiBSZXN0YXJ0aW5nIHRoZSBkYWVtb24gZG9lcyBjbGVhciBpdCwgd2hpY2ggaXMgdGhlIHdheSBiYWNrIGZyb20gYSByZXZvY2F0aW9uXG4gICAgLy8gdGhhdCBzaG91bGQgbm90IGhhdmUgaGFwcGVuZWQuXG4gICAgcmV2b2NhdGlvbnM6IHsgW3Jldm9jYXRpb25JZDogc3RyaW5nXTogUmV2b2NhdGlvblN0YXRlIH07XG4gICAgLy8gV2hlbiB0aGlzIG1hY2hpbmUgZmlyc3Qgc2F3IGVhY2ggdW5yZXZva2UsIGJ5IHVucmV2b2tlIGlkLiBPbiBkaXNrLCB1bmxpa2UgdGhlIHJldm9jYXRpb25zXG4gICAgLy8gdGhlbXNlbHZlcywgYmVjYXVzZSBpdCBpcyB3aGF0IHRoZSBob3VyIGxvbmcgd2FpdCBpcyBjb3VudGVkIGZyb206IG1lYXN1cmluZyBmcm9tIGEgdGltZSB0aGVcbiAgICAvLyB1bnJldm9rZSBmaWxlIHN0YXRlcyB3b3VsZCBsZXQgd2hvZXZlciB3cm90ZSBpdCBiYWNrZGF0ZSB0aGUgZmlsZSBhbmQgc2tpcCB0aGUgd2FpdCwgYW5kXG4gICAgLy8gbWVhc3VyaW5nIGZyb20gcHJvY2VzcyBzdGFydCB3b3VsZCByZXN0YXJ0IHRoZSB3YWl0IG9uIGV2ZXJ5IHJlc3RhcnQuXG4gICAgdW5yZXZva2VGaXJzdFNlZW46IHsgW3VucmV2b2tlSWQ6IHN0cmluZ106IG51bWJlciB9O1xuICAgIHBlbmRpbmdSZXZvY2F0aW9uczogUGVuZGluZ1Jldm9jYXRpb25bXTtcbiAgICAvLyBUaGUga2V5cyB3ZSBsYXN0IHdyb3RlIG91dC4gV2hhdCB0ZWxscyBhIGNoYW5nZSB3ZSBtYWRlIGFwYXJ0IGZyb20gb25lIHNvbWVib2R5IGVsc2UgbWFkZTpcbiAgICAvLyBpZiB0aGlzIHN0aWxsIG1hdGNoZXMgd2hhdCB3ZSB3YW50LCBhbmQgdGhlIGZpbGUgZG9lcyBub3QsIHRoZSBmaWxlIHdhcyBlZGl0ZWQgYmVoaW5kIHVzLlxuICAgIGFwcGxpZWRLZXlzOiBzdHJpbmdbXTtcbiAgICAvLyBXaGVyZSB3ZSBoYWQgcmVhZCB1cCB0byBpbiB0aGUgYXV0aCBsb2csIHNvIGEgcmVzdGFydCBkb2VzIG5vdCByZS1yZXBvcnQgb2xkIGF0dGVtcHRzLlxuICAgIGF1dGhMb2dPZmZzZXQ6IG51bWJlcjtcbiAgICBhdXRoTG9nU2lnbmF0dXJlOiBzdHJpbmc7XG59O1xuXG5sZXQgc3RhdGU6IERhZW1vblN0YXRlID0ge1xuICAgIHNvdXJjZXM6IHt9LFxuICAgIHVzZXJLZXlIYXNoZXM6IHt9LFxuICAgIHJldm9jYXRpb25zOiB7fSxcbiAgICB1bnJldm9rZUZpcnN0U2Vlbjoge30sXG4gICAgcGVuZGluZ1Jldm9jYXRpb25zOiBbXSxcbiAgICBhcHBsaWVkS2V5czogW10sXG4gICAgYXV0aExvZ09mZnNldDogMCxcbiAgICBhdXRoTG9nU2lnbmF0dXJlOiBcIlwiLFxufTtcblxuZXhwb3J0IGZ1bmN0aW9uIGdldFN0YXRlKCkge1xuICAgIHJldHVybiBzdGF0ZTtcbn1cblxuLyoqIFBlciBzb3VyY2UgcHJvZ3Jlc3MsIGNyZWF0ZWQgb24gZmlyc3QgdXNlIHNvIGEgbmV3bHkgYWRkZWQgc291cmNlIHN0YXJ0cyBjbGVhbi4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzb3VyY2VTdGF0ZShyZXBvVVJMOiBzdHJpbmcpIHtcbiAgICBsZXQgZXhpc3RpbmcgPSBzdGF0ZS5zb3VyY2VzW3JlcG9VUkxdO1xuICAgIGlmIChleGlzdGluZykge1xuICAgICAgICByZXR1cm4gZXhpc3Rpbmc7XG4gICAgfVxuICAgIGxldCBjcmVhdGVkOiBTb3VyY2VTdGF0ZSA9IHtcbiAgICAgICAgbGFzdFNoYTogXCJcIixcbiAgICAgICAgYnJhbmNoOiBcIlwiLFxuICAgICAgICBhY2NlcHRlZDogZmFsc2UsXG4gICAgICAgIGFjY2VwdGVkU2lnbmVyOiBcIlwiLFxuICAgICAgICBhY2NlcHRlZEtleXM6IFtdLFxuICAgICAgICBhY2NlcHRlZE1hbmlmZXN0SGFzaDogXCJcIixcbiAgICAgICAgYWNjZXB0ZWRTaWduYXR1cmVIYXNoOiBcIlwiLFxuICAgICAgICBwZW5kaW5nU2lnbmVyOiBcIlwiLFxuICAgICAgICBwZW5kaW5nU2luY2U6IDAsXG4gICAgICAgIHJlcG9ydGVkUHJvYmxlbTogXCJcIixcbiAgICB9O1xuICAgIHN0YXRlLnNvdXJjZXNbcmVwb1VSTF0gPSBjcmVhdGVkO1xuICAgIHJldHVybiBjcmVhdGVkO1xufVxuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gbG9hZFN0YXRlKCkge1xuICAgIGxldCBjb250ZW50cztcbiAgICB0cnkge1xuICAgICAgICBjb250ZW50cyA9IGF3YWl0IGZzLnJlYWRGaWxlKFNUQVRFX1BBVEgsIFwidXRmOFwiKTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgdHJ5IHtcbiAgICAgICAgbGV0IGxvYWRlZCA9IEpTT04ucGFyc2UoY29udGVudHMpO1xuICAgICAgICAvLyBSZXZvY2F0aW9ucyBhcmUgaGVsZCBpbiBtZW1vcnkgb25seSwgc28gd2hhdGV2ZXIgYW4gb2xkZXIgdmVyc2lvbiBsZWZ0IG9uIGRpc2sgaXMgbm90XG4gICAgICAgIC8vIHJlYWQgYmFjayBpbi4gU3RhcnRpbmcgdGhlIGRhZW1vbiBpcyB3aGF0IGZvcmdldHMgdGhlbS5cbiAgICAgICAgZGVsZXRlIGxvYWRlZC5yZXZvY2F0aW9ucztcbiAgICAgICAgc3RhdGUgPSBPYmplY3QuYXNzaWduKHN0YXRlLCBsb2FkZWQpO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgLy8gQ29ycnVwdCBzdGF0ZSBvbmx5IGNvc3RzIHVzIG9uZSBkdXBsaWNhdGUgbm90aWZpY2F0aW9uLCBzbyBpdCBpcyBub3Qgd29ydGggZmFpbGluZyBvdmVyLlxuICAgICAgICBjb25zb2xlLmxvZyhgSWdub3JpbmcgdW5yZWFkYWJsZSBzdGF0ZSBmaWxlICR7U1RBVEVfUEFUSH0uICR7ZX1gKTtcbiAgICB9XG59XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBzYXZlU3RhdGUoKSB7XG4gICAgbGV0IHsgcmV2b2NhdGlvbnMsIC4uLnBlcnNpc3RlZCB9ID0gc3RhdGU7XG4gICAgYXdhaXQgZnMubWtkaXIocGF0aC5kaXJuYW1lKFNUQVRFX1BBVEgpLCB7IHJlY3Vyc2l2ZTogdHJ1ZSB9KTtcbiAgICBhd2FpdCBmcy53cml0ZUZpbGUoU1RBVEVfUEFUSCwgSlNPTi5zdHJpbmdpZnkocGVyc2lzdGVkLCB1bmRlZmluZWQsIDQpLCB7IG1vZGU6IDBvNjAwIH0pO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "3030766f08724eecf78cccf54e061c2d6de08041d697e10af564a5ada8171569"; */

package/security/authorizedKeys/daemon/dist/trust.ts.cache

@@ -0,0 +1,295 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
+//exports.resolveSourceKeys = exports.describeSigner = exports.verifyCheckout = exports.readCheckoutKeys = exports.publicKeyFromSignature = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const promises_1 = __importDefault(require("fs/promises"));
+const path_1 = __importDefault(require("path"));
+const spawn_1 = require("../../helpers/spawn");
+const authorizedKeys_1 = require("../authorizedKeys");
+const sources_1 = require("../sources");
+const manifest_1 = require("../../signedFiles/manifest");
+const paths_1 = require("./paths");
+const notify_1 = require("./notify");
+const state_1 = require("./state");
+// A source that has never been signed reads as this, so losing a signature counts as a change of
+// signer rather than as something to wave through.
+const UNSIGNED = "";
+// What fixes both of the signature problems we report, so the message can say so rather than
+// leaving someone to work it out.
+const SIGN_COMMAND = "yarn signfiles git";
+async function pathExists(filePath) {
+    try {
+        await promises_1.default.access(filePath);
+        return true;
+    }
+    catch (e) {
+        return false;
+    }
+}
+function readSSHString(buffer, offset) {
+    let length = buffer.readUInt32BE(offset);
+    return buffer.subarray(offset + 4, offset + 4 + length);
+}
+/** The signature carries the public key that made it, so the key itself can be reported rather
+    than only a fingerprint. Returns it in the usual "type base64" form. */
+function publicKeyFromSignature(signatureText) {
+    let body = signatureText.split("\n").filter(line => line && !line.startsWith("-----")).join("");
+    let blob = Buffer.from(body, "base64");
+    if (blob.subarray(0, 6).toString() !== "SSHSIG") {
+        throw new Error(`Expected an SSHSIG signature, started with ${blob.subarray(0, 6).toString()}`);
+    }
+    // The magic, then a uint32 version, then the public key.
+    let publicKey = readSSHString(blob, 6 + 4);
+    let keyType = readSSHString(publicKey, 0).toString();
+    let fingerprint = "SHA256:" + crypto_1.default.createHash("sha256").update(publicKey).digest("base64").replace(/=+$/, "");
+    return { publicKey: `${keyType} ${publicKey.toString("base64")}`, fingerprint };
+}
+exports.publicKeyFromSignature = publicKeyFromSignature;
+/** Reads one checkout's keys. Prefers a top level authorized_keys file and otherwise concatenates
+    every .pub at the top level. */
+async function readCheckoutKeys(repoPath) {
+    let combinedPath = path_1.default.join(repoPath, "authorized_keys");
+    if (await pathExists(combinedPath)) {
+        return (0, authorizedKeys_1.normalizeKeys)(await promises_1.default.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = (await promises_1.default.readdir(repoPath)).filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys = [];
+    for (let name of pubFiles) {
+        keys.push(...(0, authorizedKeys_1.normalizeKeys)(await promises_1.default.readFile(path_1.default.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}
+exports.readCheckoutKeys = readCheckoutKeys;
+/** Every file in a checkout, other than git's own directory and the signature files, which cannot
+    describe themselves. */
+async function listCheckoutFiles(repoPath, prefix) {
+    let files = [];
+    for (let entry of await promises_1.default.readdir(path_1.default.join(repoPath, prefix || ""), { withFileTypes: true })) {
+        let relativePath = prefix && `${prefix}/${entry.name}` || entry.name;
+        if (entry.name === ".git") {
+            continue;
+        }
+        if (!prefix && (entry.name === manifest_1.MANIFEST_NAME || entry.name === manifest_1.SIGNATURE_NAME)) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            files.push(...await listCheckoutFiles(repoPath, relativePath));
+            continue;
+        }
+        files.push(relativePath);
+    }
+    return files.sort();
+}
+/** The signature only covers the manifest, so the manifest has to be checked against what is
+    actually on disk. Both directions matter: a missing file changes what the keys mean, and an
+    extra unlisted file could add keys nobody signed for. */
+async function verifyManifestMatchesFiles(repoPath) {
+    let manifest = JSON.parse(await promises_1.default.readFile(path_1.default.join(repoPath, manifest_1.MANIFEST_NAME), "utf8"));
+    let listed = new Map((manifest.files || []).map((file) => [file.path, file]));
+    let actual = await listCheckoutFiles(repoPath);
+    let missing = [...listed.keys()].filter(filePath => !actual.includes(filePath));
+    if (missing.length) {
+        throw new Error(`Expected the signed files to be present, ${missing.length} missing, first ${missing[0]}`);
+    }
+    let extra = actual.filter(filePath => !listed.has(filePath));
+    if (extra.length) {
+        throw new Error(`Expected only signed files to be present, ${extra.length} extra, first ${extra[0]}`);
+    }
+    for (let filePath of actual) {
+        let expected = listed.get(filePath);
+        if (!expected) {
+            continue;
+        }
+        let contents = (0, manifest_1.normalizeContent)(await promises_1.default.readFile(path_1.default.join(repoPath, filePath)));
+        if (contents.length !== expected.size) {
+            throw new Error(`Expected ${filePath} to be ${expected.size} bytes, was ${contents.length}`);
+        }
+        let hash = crypto_1.default.createHash("sha256").update(contents).digest("hex");
+        if (hash !== expected.sha256) {
+            throw new Error(`Expected ${filePath} to hash to ${expected.sha256}, was ${hash}`);
+        }
+    }
+}
+/** The manifest and signature as they stand, whether or not they are any good. The hashes are
+    what tell a signature that was never updated apart from one that is broken. */
+async function readSignatureFiles(repoPath) {
+    let manifestPath = path_1.default.join(repoPath, manifest_1.MANIFEST_NAME);
+    let signaturePath = path_1.default.join(repoPath, manifest_1.SIGNATURE_NAME);
+    let manifest = await pathExists(manifestPath) && await promises_1.default.readFile(manifestPath) || undefined;
+    let signature = await pathExists(signaturePath) && await promises_1.default.readFile(signaturePath) || undefined;
+    return {
+        manifest,
+        signature,
+        manifestHash: manifest && crypto_1.default.createHash("sha256").update(manifest).digest("hex") || "",
+        signatureHash: signature && crypto_1.default.createHash("sha256").update(signature).digest("hex") || "",
+    };
+}
+/** Who signed this checkout. Returns UNSIGNED when there is no signature at all, and throws when
+    there is one that does not hold up - an unverifiable signature is never treated as an identity,
+    so it can never become something we accept. */
+async function verifyCheckoutSigner(config) {
+    let { repoPath, files } = config;
+    if (!files.manifest && !files.signature) {
+        return UNSIGNED;
+    }
+    if (!files.manifest || !files.signature) {
+        throw new Error(`Expected both ${manifest_1.MANIFEST_NAME} and ${manifest_1.SIGNATURE_NAME}, only one is present`);
+    }
+    let result = await (0, spawn_1.spawnPromise)({
+        command: "ssh-keygen",
+        args: ["-Y", "check-novalidate", "-n", manifest_1.SIGN_NAMESPACE, "-s", path_1.default.join(repoPath, manifest_1.SIGNATURE_NAME)],
+        // The signature covers the normalised bytes, so a checkout that arrived with CRLF still
+        // verifies rather than looking like tampering.
+        input: (0, manifest_1.normalizeContent)(files.manifest).toString("utf8"),
+    });
+    if (result.status !== 0) {
+        throw new Error(`the signature over ${manifest_1.MANIFEST_NAME} does not verify: `
+            + `${(result.stdout + result.stderr).trim().slice(0, paths_1.MAX_ERROR_BODY_LENGTH)}`);
+    }
+    let reported = `${result.stdout} ${result.stderr}`.match(/(SHA256:[A-Za-z0-9+/=]+)/);
+    if (!reported) {
+        throw new Error(`ssh-keygen reported no signer fingerprint, said ${result.stdout.slice(0, paths_1.MAX_ERROR_BODY_LENGTH)}`);
+    }
+    let { publicKey, fingerprint } = publicKeyFromSignature(files.signature.toString("utf8"));
+    // The key we read out of the signature has to be the one ssh-keygen just checked against,
+    // otherwise we would be reporting an identity that did not sign anything.
+    if (fingerprint !== reported[1]) {
+        throw new Error(`the signing key reads as ${fingerprint} but ssh-keygen verified ${reported[1]}`);
+    }
+    await verifyManifestMatchesFiles(repoPath);
+    return publicKey;
+}
+/** Proves a checkout on disk was signed, and that the files in it are the ones that were signed.
+    Returns the signer, and throws if anything about that does not hold.
+
+    Anything reading a repo for something other than ssh keys goes through this first: the whole
+    checkout is covered by one manifest, so a machine list is exactly as trustworthy as the keys
+    beside it, and neither is worth reading unsigned. */
+async function verifyCheckout(repoPath) {
+    return await verifyCheckoutSigner({ repoPath, files: await readSignatureFiles(repoPath) });
+}
+exports.verifyCheckout = verifyCheckout;
+function describeSigner(signer) {
+    return signer === UNSIGNED && "<no public key>" || signer;
+}
+exports.describeSigner = describeSigner;
+/** Reports a problem with a source's signature, but only when it is not the same problem we
+    already reported, so a fault that persists does not repeat every check. */
+async function reportProblem(config) {
+    let { repoURL, problem, headline, body } = config;
+    let sourceStateValue = (0, state_1.sourceState)(repoURL);
+    if (sourceStateValue.reportedProblem === problem) {
+        return;
+    }
+    sourceStateValue.reportedProblem = problem;
+    await (0, state_1.saveState)();
+    await (0, notify_1.notify)(headline, body);
+}
+/** The keys a source is allowed to contribute right now. A source signed by someone we have not
+    accepted keeps contributing the keys we last accepted, until the delay has passed. */
+async function resolveSourceKeys(repoURL) {
+    let sourceStateValue = (0, state_1.sourceState)(repoURL);
+    let repoPath = (0, sources_1.sourceRepoPath)(repoURL);
+    let files = await readSignatureFiles(repoPath);
+    let signer;
+    try {
+        signer = await verifyCheckoutSigner({ repoPath, files });
+    }
+    catch (e) {
+        // Nothing here is trustworthy, so nothing here is used. Which of the two problems it is
+        // depends on whether the signature is simply the one we already accepted.
+        let unchanged = files.manifestHash === sourceStateValue.acceptedManifestHash
+            && files.signatureHash === sourceStateValue.acceptedSignatureHash;
+        if (unchanged) {
+            await reportProblem({
+                repoURL,
+                problem: "stale",
+                headline: `KEY REPO CHANGED WITHOUT BEING SIGNED`,
+                body: `\`${repoURL}\` changed, but nobody signed the change, so it is being ignored`
+                    + ` and this machine is still using the keys signed by`
+                    + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\n\nTo make the change take effect, run this in that repo:`
+                    + `\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+            });
+        }
+        else {
+            await reportProblem({
+                repoURL,
+                problem: "corrupt",
+                headline: `KEY REPO SIGNATURE IS BROKEN`,
+                body: `The signature on \`${repoURL}\` does not check out, so everything in it is`
+                    + ` being ignored and this machine is still using the keys signed by`
+                    + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
+                    + `\n\n${e}`
+                    + `\n\nTo replace the signature, run this in that repo:`
+                    + `\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
+            });
+        }
+        return sourceStateValue.acceptedKeys;
+    }
+    if (sourceStateValue.reportedProblem) {
+        sourceStateValue.reportedProblem = "";
+        await (0, state_1.saveState)();
+    }
+    let checkoutKeys = await readCheckoutKeys(repoPath);
+    let accept = async () => {
+        sourceStateValue.accepted = true;
+        sourceStateValue.acceptedSigner = signer;
+        sourceStateValue.acceptedKeys = checkoutKeys;
+        sourceStateValue.acceptedManifestHash = files.manifestHash;
+        sourceStateValue.acceptedSignatureHash = files.signatureHash;
+        sourceStateValue.pendingSigner = UNSIGNED;
+        sourceStateValue.pendingSince = 0;
+        await (0, state_1.saveState)();
+        return checkoutKeys;
+    };
+    // Nothing has ever been accepted from this source, so this is what we start trusting.
+    if (!sourceStateValue.accepted) {
+        console.log(`Trusting ${repoURL} as signed by ${describeSigner(signer)}`);
+        return await accept();
+    }
+    if (signer === sourceStateValue.acceptedSigner) {
+        // Back to the signer we already trust, so anything we were waiting on is moot.
+        if (sourceStateValue.pendingSince) {
+            console.log(`${repoURL} is signed by its accepted key again, dropping the pending change`);
+        }
+        return await accept();
+    }
+    // Going from nothing to something signed is only ever an improvement, so it does not wait.
+    if (sourceStateValue.acceptedSigner === UNSIGNED) {
+        await (0, notify_1.notify)(`KEY REPO IS NOW SIGNED`, `\`${repoURL}\` was not signed at all before, so this is an improvement and its keys`
+            + ` are being applied right away.`
+            + `\n\nsigned by: \`${signer}\``);
+        return await accept();
+    }
+    // A signer we have not accepted. Anything new restarts the wait, so publishing twice in a row
+    // gains an attacker nothing. pendingSince is what marks a wait as running, because an unsigned
+    // checkout is itself a signer value and cannot double as "nothing pending".
+    if (!sourceStateValue.pendingSince || signer !== sourceStateValue.pendingSigner) {
+        sourceStateValue.pendingSigner = signer;
+        sourceStateValue.pendingSince = Date.now();
+        await (0, state_1.saveState)();
+        await (0, notify_1.notify)(`KEY REPO SIGNED BY A DIFFERENT KEY`, `Somebody else is signing \`${repoURL}\` now. Its keys are NOT being applied, and this`
+            + ` machine is still using the ones it already had. If nothing changes, the new signer`
+            + ` is accepted in 24 hours.`
+            + `\n\nIf that was not you, fix the repo before the 24 hours are up.`
+            + `\n\nsigned by now: \`${describeSigner(signer)}\``
+            + `\nsigned by before: \`${describeSigner(sourceStateValue.acceptedSigner)}\``);
+        return sourceStateValue.acceptedKeys;
+    }
+    if (Date.now() - sourceStateValue.pendingSince < paths_1.SIGNER_CHANGE_DELAY) {
+        return sourceStateValue.acceptedKeys;
+    }
+    // Same new signer, 24 hours later, and nobody stopped it.
+    console.log(`Accepting ${describeSigner(signer)} for ${repoURL} after the ${paths_1.SIGNER_CHANGE_DELAY}ms wait`);
+    return await accept();
+}
+exports.resolveSourceKeys = resolveSourceKeys;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJ1c3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0cnVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUN4QiwrQ0FBbUQ7QUFDbkQsc0RBQWtEO0FBQ2xELHdDQUE0QztBQUM1Qyx5REFBNkc7QUFDN0csbUNBQXFFO0FBQ3JFLHFDQUFrQztBQUNsQyxtQ0FBaUQ7QUFFakQsaUdBQWlHO0FBQ2pHLG1EQUFtRDtBQUNuRCxNQUFNLFFBQVEsR0FBRyxFQUFFLENBQUM7QUFDcEIsNkZBQTZGO0FBQzdGLGtDQUFrQztBQUNsQyxNQUFNLFlBQVksR0FBRyxvQkFBb0IsQ0FBQztBQUUxQyxLQUFLLFVBQVUsVUFBVSxDQUFDLFFBQWdCO0lBQ3RDLElBQUksQ0FBQztRQUNELE1BQU0sa0JBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQUM7SUFDaEIsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUFDLE1BQWMsRUFBRSxNQUFjO0lBQ2pELElBQUksTUFBTSxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDekMsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsTUFBTSxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQztBQUM1RCxDQUFDO0FBRUQ7MkVBQzJFO0FBQzNFLFNBQWdCLHNCQUFzQixDQUFDLGFBQXFCO0lBQ3hELElBQUksSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNoRyxJQUFJLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN2QyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzlDLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBQ0QseURBQXlEO0lBQ3pELElBQUksU0FBUyxHQUFHLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzNDLElBQUksT0FBTyxHQUFHLGFBQWEsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDckQsSUFBSSxXQUFXLEdBQUcsU0FBUyxHQUFHLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoSCxPQUFPLEVBQUUsU0FBUyxFQUFFLEdBQUcsT0FBTyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUNwRixDQUFDO0FBWEQsd0RBV0M7QUFFRDttQ0FDbUM7QUFDNUIsS0FBSyxVQUFVLGdCQUFnQixDQUFDLFFBQWdCO0lBQ25ELElBQUksWUFBWSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDMUQsSUFBSSxNQUFNLFVBQVUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ2pDLE9BQU8sSUFBQSw4QkFBYSxFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELElBQUksUUFBUSxHQUFHLENBQUMsTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN6RixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELFFBQVEsaUJBQWlCLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQWEsRUFBRSxDQUFDO0lBQ3hCLEtBQUssSUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEsOEJBQWEsRUFBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQztBQWRELDRDQWNDO0FBRUQ7MkJBQzJCO0FBQzNCLEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxRQUFnQixFQUFFLE1BQWU7SUFDOUQsSUFBSSxLQUFLLEdBQWEsRUFBRSxDQUFDO0lBQ3pCLEtBQUssSUFBSSxLQUFLLElBQUksTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLElBQUksRUFBRSxDQUFDLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzdGLElBQUksWUFBWSxHQUFHLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQztRQUNyRSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDeEIsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyx3QkFBYSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUsseUJBQWMsQ0FBQyxFQUFFLENBQUM7WUFDN0UsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO1lBQ3RCLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLGlCQUFpQixDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO1lBQy9ELFNBQVM7UUFDYixDQUFDO1FBQ0QsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUM3QixDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7QUFDeEIsQ0FBQztBQUVEOzs0REFFNEQ7QUFDNUQsS0FBSyxVQUFVLDBCQUEwQixDQUFDLFFBQWdCO0lBQ3RELElBQUksUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSx3QkFBYSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN6RixJQUFJLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FDaEIsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQXNCLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUM1RSxDQUFDO0lBQ0YsSUFBSSxNQUFNLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUUvQyxJQUFJLE9BQU8sR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDaEYsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsT0FBTyxDQUFDLE1BQU0sbUJBQW1CLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDL0csQ0FBQztJQUNELElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM3RCxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLEtBQUssQ0FBQyxNQUFNLGlCQUFpQixLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxLQUFLLElBQUksUUFBUSxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQzFCLElBQUksUUFBUSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDcEMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ1osU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLFFBQVEsR0FBRyxJQUFBLDJCQUFnQixFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xGLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDcEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxZQUFZLFFBQVEsVUFBVSxRQUFRLENBQUMsSUFBSSxlQUFlLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2pHLENBQUM7UUFDRCxJQUFJLElBQUksR0FBRyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3RFLElBQUksSUFBSSxLQUFLLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksUUFBUSxlQUFlLFFBQVEsQ0FBQyxNQUFNLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN2RixDQUFDO0lBQ0wsQ0FBQztBQUNMLENBQUM7QUFFRDtrRkFDa0Y7QUFDbEYsS0FBSyxVQUFVLGtCQUFrQixDQUFDLFFBQWdCO0lBQzlDLElBQUksWUFBWSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLHdCQUFhLENBQUMsQ0FBQztJQUN0RCxJQUFJLGFBQWEsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSx5QkFBYyxDQUFDLENBQUM7SUFDeEQsSUFBSSxRQUFRLEdBQUcsTUFBTSxVQUFVLENBQUMsWUFBWSxDQUFDLElBQUksTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDOUYsSUFBSSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsYUFBYSxDQUFDLElBQUksTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDakcsT0FBTztRQUNILFFBQVE7UUFDUixTQUFTO1FBQ1QsWUFBWSxFQUFFLFFBQVEsSUFBSSxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUU7UUFDMUYsYUFBYSxFQUFFLFNBQVMsSUFBSSxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUU7S0FDaEcsQ0FBQztBQUNOLENBQUM7QUFFRDs7a0RBRWtEO0FBQ2xELEtBQUssVUFBVSxvQkFBb0IsQ0FBQyxNQUduQztJQUNHLElBQUksRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2pDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sUUFBUSxDQUFDO0lBQ3BCLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLGlCQUFpQix3QkFBYSxRQUFRLHlCQUFjLHVCQUF1QixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksTUFBTSxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDO1FBQzVCLE9BQU8sRUFBRSxZQUFZO1FBQ3JCLElBQUksRUFBRSxDQUFDLElBQUksRUFBRSxrQkFBa0IsRUFBRSxJQUFJLEVBQUUseUJBQWMsRUFBRSxJQUFJLEVBQUUsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUseUJBQWMsQ0FBQyxDQUFDO1FBQ2pHLHdGQUF3RjtRQUN4RiwrQ0FBK0M7UUFDL0MsS0FBSyxFQUFFLElBQUEsMkJBQWdCLEVBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7S0FDM0QsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQ1gsc0JBQXNCLHdCQUFhLG9CQUFvQjtjQUNyRCxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSw2QkFBcUIsQ0FBQyxFQUFFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsR0FBRyxNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUNyRixJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsNkJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEgsQ0FBQztJQUNELElBQUksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLEdBQUcsc0JBQXNCLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMxRiwwRkFBMEY7SUFDMUYsMEVBQTBFO0lBQzFFLElBQUksV0FBVyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlCLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLFdBQVcsNEJBQTRCLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdEcsQ0FBQztJQUNELE1BQU0sMEJBQTBCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0MsT0FBTyxTQUFTLENBQUM7QUFDckIsQ0FBQztBQUVEOzs7Ozt3REFLd0Q7QUFDakQsS0FBSyxVQUFVLGNBQWMsQ0FBQyxRQUFnQjtJQUNqRCxPQUFPLE1BQU0sb0JBQW9CLENBQUMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLE1BQU0sa0JBQWtCLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQy9GLENBQUM7QUFGRCx3Q0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxNQUFjO0lBQ3pDLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxpQkFBaUIsSUFBSSxNQUFNLENBQUM7QUFDOUQsQ0FBQztBQUZELHdDQUVDO0FBRUQ7OEVBQzhFO0FBQzlFLEtBQUssVUFBVSxhQUFhLENBQUMsTUFBNEU7SUFDckcsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNsRCxJQUFJLGdCQUFnQixHQUFHLElBQUEsbUJBQVcsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUM1QyxJQUFJLGdCQUFnQixDQUFDLGVBQWUsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUMvQyxPQUFPO0lBQ1gsQ0FBQztJQUNELGdCQUFnQixDQUFDLGVBQWUsR0FBRyxPQUFPLENBQUM7SUFDM0MsTUFBTSxJQUFBLGlCQUFTLEdBQUUsQ0FBQztJQUNsQixNQUFNLElBQUEsZUFBTSxFQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUNqQyxDQUFDO0FBRUQ7eUZBQ3lGO0FBQ2xGLEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxPQUFlO0lBQ25ELElBQUksZ0JBQWdCLEdBQUcsSUFBQSxtQkFBVyxFQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzVDLElBQUksUUFBUSxHQUFHLElBQUEsd0JBQWMsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUN2QyxJQUFJLEtBQUssR0FBRyxNQUFNLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRS9DLElBQUksTUFBYyxDQUFDO0lBQ25CLElBQUksQ0FBQztRQUNELE1BQU0sR0FBRyxNQUFNLG9CQUFvQixDQUFDLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCx3RkFBd0Y7UUFDeEYsMEVBQTBFO1FBQzFFLElBQUksU0FBUyxHQUFHLEtBQUssQ0FBQyxZQUFZLEtBQUssZ0JBQWdCLENBQUMsb0JBQW9CO2VBQ3JFLEtBQUssQ0FBQyxhQUFhLEtBQUssZ0JBQWdCLENBQUMscUJBQXFCLENBQUM7UUFDdEUsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNaLE1BQU0sYUFBYSxDQUFDO2dCQUNoQixPQUFPO2dCQUNQLE9BQU8sRUFBRSxPQUFPO2dCQUNoQixRQUFRLEVBQUUsdUNBQXVDO2dCQUNqRCxJQUFJLEVBQUUsS0FBSyxPQUFPLGtFQUFrRTtzQkFDOUUscURBQXFEO3NCQUNyRCxNQUFNLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUMsS0FBSztzQkFDMUQsNERBQTREO3NCQUM1RCxhQUFhLFlBQVksVUFBVTthQUM1QyxDQUFDLENBQUM7UUFDUCxDQUFDO2FBQU0sQ0FBQztZQUNKLE1BQU0sYUFBYSxDQUFDO2dCQUNoQixPQUFPO2dCQUNQLE9BQU8sRUFBRSxTQUFTO2dCQUNsQixRQUFRLEVBQUUsOEJBQThCO2dCQUN4QyxJQUFJLEVBQUUsc0JBQXNCLE9BQU8sK0NBQStDO3NCQUM1RSxtRUFBbUU7c0JBQ25FLE1BQU0sY0FBYyxDQUFDLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxLQUFLO3NCQUMxRCxPQUFPLENBQUMsRUFBRTtzQkFDVixzREFBc0Q7c0JBQ3RELGFBQWEsWUFBWSxVQUFVO2FBQzVDLENBQUMsQ0FBQztRQUNQLENBQUM7UUFDRCxPQUFPLGdCQUFnQixDQUFDLFlBQVksQ0FBQztJQUN6QyxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNuQyxnQkFBZ0IsQ0FBQyxlQUFlLEdBQUcsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sSUFBQSxpQkFBUyxHQUFFLENBQUM7SUFDdEIsQ0FBQztJQUNELElBQUksWUFBWSxHQUFHLE1BQU0sZ0JBQWdCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFFcEQsSUFBSSxNQUFNLEdBQUcsS0FBSyxJQUFJLEVBQUU7UUFDcEIsZ0JBQWdCLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztRQUNqQyxnQkFBZ0IsQ0FBQyxjQUFjLEdBQUcsTUFBTSxDQUFDO1FBQ3pDLGdCQUFnQixDQUFDLFlBQVksR0FBRyxZQUFZLENBQUM7UUFDN0MsZ0JBQWdCLENBQUMsb0JBQW9CLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQztRQUMzRCxnQkFBZ0IsQ0FBQyxxQkFBcUIsR0FBRyxLQUFLLENBQUMsYUFBYSxDQUFDO1FBQzdELGdCQUFnQixDQUFDLGFBQWEsR0FBRyxRQUFRLENBQUM7UUFDMUMsZ0JBQWdCLENBQUMsWUFBWSxHQUFHLENBQUMsQ0FBQztRQUNsQyxNQUFNLElBQUEsaUJBQVMsR0FBRSxDQUFDO1FBQ2xCLE9BQU8sWUFBWSxDQUFDO0lBQ3hCLENBQUMsQ0FBQztJQUVGLHNGQUFzRjtJQUN0RixJQUFJLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDN0IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLE9BQU8saUJBQWlCLGNBQWMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDMUUsT0FBTyxNQUFNLE1BQU0sRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFRCxJQUFJLE1BQU0sS0FBSyxnQkFBZ0IsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUM3QywrRUFBK0U7UUFDL0UsSUFBSSxnQkFBZ0IsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNoQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsT0FBTyxtRUFBbUUsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFDRCxPQUFPLE1BQU0sTUFBTSxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVELDJGQUEyRjtJQUMzRixJQUFJLGdCQUFnQixDQUFDLGNBQWMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUEsZUFBTSxFQUFDLHdCQUF3QixFQUNqQyxLQUFLLE9BQU8seUVBQXlFO2NBQ25GLGdDQUFnQztjQUNoQyxvQkFBb0IsTUFBTSxJQUFJLENBQ25DLENBQUM7UUFDRixPQUFPLE1BQU0sTUFBTSxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVELDhGQUE4RjtJQUM5RiwrRkFBK0Y7SUFDL0YsNEVBQTRFO0lBQzVFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLElBQUksTUFBTSxLQUFLLGdCQUFnQixDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzlFLGdCQUFnQixDQUFDLGFBQWEsR0FBRyxNQUFNLENBQUM7UUFDeEMsZ0JBQWdCLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUMzQyxNQUFNLElBQUEsaUJBQVMsR0FBRSxDQUFDO1FBQ2xCLE1BQU0sSUFBQSxlQUFNLEVBQUMsb0NBQW9DLEVBQzdDLDhCQUE4QixPQUFPLGtEQUFrRDtjQUNyRixxRkFBcUY7Y0FDckYsMkJBQTJCO2NBQzNCLG1FQUFtRTtjQUNuRSx3QkFBd0IsY0FBYyxDQUFDLE1BQU0sQ0FBQyxJQUFJO2NBQ2xELHlCQUF5QixjQUFjLENBQUMsZ0JBQWdCLENBQUMsY0FBYyxDQUFDLElBQUksQ0FDakYsQ0FBQztRQUNGLE9BQU8sZ0JBQWdCLENBQUMsWUFBWSxDQUFDO0lBQ3pDLENBQUM7SUFFRCxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxnQkFBZ0IsQ0FBQyxZQUFZLEdBQUcsMkJBQW1CLEVBQUUsQ0FBQztRQUNuRSxPQUFPLGdCQUFnQixDQUFDLFlBQVksQ0FBQztJQUN6QyxDQUFDO0lBRUQsMERBQTBEO0lBQzFELE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxjQUFjLENBQUMsTUFBTSxDQUFDLFFBQVEsT0FBTyxjQUFjLDJCQUFtQixTQUFTLENBQUMsQ0FBQztJQUMxRyxPQUFPLE1BQU0sTUFBTSxFQUFFLENBQUM7QUFDMUIsQ0FBQztBQTFHRCw4Q0EwR0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgY3J5cHRvIGZyb20gXCJjcnlwdG9cIjtcbmltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5pbXBvcnQgeyBzcGF3blByb21pc2UgfSBmcm9tIFwiLi4vLi4vaGVscGVycy9zcGF3blwiO1xuaW1wb3J0IHsgbm9ybWFsaXplS2V5cyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5c1wiO1xuaW1wb3J0IHsgc291cmNlUmVwb1BhdGggfSBmcm9tIFwiLi4vc291cmNlc1wiO1xuaW1wb3J0IHsgTUFOSUZFU1RfTkFNRSwgbm9ybWFsaXplQ29udGVudCwgU0lHTl9OQU1FU1BBQ0UsIFNJR05BVFVSRV9OQU1FIH0gZnJvbSBcIi4uLy4uL3NpZ25lZEZpbGVzL21hbmlmZXN0XCI7XG5pbXBvcnQgeyBNQVhfRVJST1JfQk9EWV9MRU5HVEgsIFNJR05FUl9DSEFOR0VfREVMQVkgfSBmcm9tIFwiLi9wYXRoc1wiO1xuaW1wb3J0IHsgbm90aWZ5IH0gZnJvbSBcIi4vbm90aWZ5XCI7XG5pbXBvcnQgeyBzYXZlU3RhdGUsIHNvdXJjZVN0YXRlIH0gZnJvbSBcIi4vc3RhdGVcIjtcblxuLy8gQSBzb3VyY2UgdGhhdCBoYXMgbmV2ZXIgYmVlbiBzaWduZWQgcmVhZHMgYXMgdGhpcywgc28gbG9zaW5nIGEgc2lnbmF0dXJlIGNvdW50cyBhcyBhIGNoYW5nZSBvZlxuLy8gc2lnbmVyIHJhdGhlciB0aGFuIGFzIHNvbWV0aGluZyB0byB3YXZlIHRocm91Z2guXG5jb25zdCBVTlNJR05FRCA9IFwiXCI7XG4vLyBXaGF0IGZpeGVzIGJvdGggb2YgdGhlIHNpZ25hdHVyZSBwcm9ibGVtcyB3ZSByZXBvcnQsIHNvIHRoZSBtZXNzYWdlIGNhbiBzYXkgc28gcmF0aGVyIHRoYW5cbi8vIGxlYXZpbmcgc29tZW9uZSB0byB3b3JrIGl0IG91dC5cbmNvbnN0IFNJR05fQ09NTUFORCA9IFwieWFybiBzaWduZmlsZXMgZ2l0XCI7XG5cbmFzeW5jIGZ1bmN0aW9uIHBhdGhFeGlzdHMoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IGZzLmFjY2VzcyhmaWxlUGF0aCk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbn1cblxuZnVuY3Rpb24gcmVhZFNTSFN0cmluZyhidWZmZXI6IEJ1ZmZlciwgb2Zmc2V0OiBudW1iZXIpIHtcbiAgICBsZXQgbGVuZ3RoID0gYnVmZmVyLnJlYWRVSW50MzJCRShvZmZzZXQpO1xuICAgIHJldHVybiBidWZmZXIuc3ViYXJyYXkob2Zmc2V0ICsgNCwgb2Zmc2V0ICsgNCArIGxlbmd0aCk7XG59XG5cbi8qKiBUaGUgc2lnbmF0dXJlIGNhcnJpZXMgdGhlIHB1YmxpYyBrZXkgdGhhdCBtYWRlIGl0LCBzbyB0aGUga2V5IGl0c2VsZiBjYW4gYmUgcmVwb3J0ZWQgcmF0aGVyXG4gICAgdGhhbiBvbmx5IGEgZmluZ2VycHJpbnQuIFJldHVybnMgaXQgaW4gdGhlIHVzdWFsIFwidHlwZSBiYXNlNjRcIiBmb3JtLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHB1YmxpY0tleUZyb21TaWduYXR1cmUoc2lnbmF0dXJlVGV4dDogc3RyaW5nKSB7XG4gICAgbGV0IGJvZHkgPSBzaWduYXR1cmVUZXh0LnNwbGl0KFwiXFxuXCIpLmZpbHRlcihsaW5lID0+IGxpbmUgJiYgIWxpbmUuc3RhcnRzV2l0aChcIi0tLS0tXCIpKS5qb2luKFwiXCIpO1xuICAgIGxldCBibG9iID0gQnVmZmVyLmZyb20oYm9keSwgXCJiYXNlNjRcIik7XG4gICAgaWYgKGJsb2Iuc3ViYXJyYXkoMCwgNikudG9TdHJpbmcoKSAhPT0gXCJTU0hTSUdcIikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGFuIFNTSFNJRyBzaWduYXR1cmUsIHN0YXJ0ZWQgd2l0aCAke2Jsb2Iuc3ViYXJyYXkoMCwgNikudG9TdHJpbmcoKX1gKTtcbiAgICB9XG4gICAgLy8gVGhlIG1hZ2ljLCB0aGVuIGEgdWludDMyIHZlcnNpb24sIHRoZW4gdGhlIHB1YmxpYyBrZXkuXG4gICAgbGV0IHB1YmxpY0tleSA9IHJlYWRTU0hTdHJpbmcoYmxvYiwgNiArIDQpO1xuICAgIGxldCBrZXlUeXBlID0gcmVhZFNTSFN0cmluZyhwdWJsaWNLZXksIDApLnRvU3RyaW5nKCk7XG4gICAgbGV0IGZpbmdlcnByaW50ID0gXCJTSEEyNTY6XCIgKyBjcnlwdG8uY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUocHVibGljS2V5KS5kaWdlc3QoXCJiYXNlNjRcIikucmVwbGFjZSgvPSskLywgXCJcIik7XG4gICAgcmV0dXJuIHsgcHVibGljS2V5OiBgJHtrZXlUeXBlfSAke3B1YmxpY0tleS50b1N0cmluZyhcImJhc2U2NFwiKX1gLCBmaW5nZXJwcmludCB9O1xufVxuXG4vKiogUmVhZHMgb25lIGNoZWNrb3V0J3Mga2V5cy4gUHJlZmVycyBhIHRvcCBsZXZlbCBhdXRob3JpemVkX2tleXMgZmlsZSBhbmQgb3RoZXJ3aXNlIGNvbmNhdGVuYXRlc1xuICAgIGV2ZXJ5IC5wdWIgYXQgdGhlIHRvcCBsZXZlbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkQ2hlY2tvdXRLZXlzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgY29tYmluZWRQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKTtcbiAgICBpZiAoYXdhaXQgcGF0aEV4aXN0cyhjb21iaW5lZFBhdGgpKSB7XG4gICAgICAgIHJldHVybiBub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKGNvbWJpbmVkUGF0aCwgXCJ1dGY4XCIpKTtcbiAgICB9XG4gICAgbGV0IHB1YkZpbGVzID0gKGF3YWl0IGZzLnJlYWRkaXIocmVwb1BhdGgpKS5maWx0ZXIobmFtZSA9PiBuYW1lLmVuZHNXaXRoKFwiLnB1YlwiKSkuc29ydCgpO1xuICAgIGlmICghcHViRmlsZXMubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYXV0aG9yaXplZF9rZXlzIG9yIGF0IGxlYXN0IG9uZSAucHViIGZpbGUgaW4gJHtyZXBvUGF0aH0sIGZvdW5kIG5laXRoZXJgKTtcbiAgICB9XG4gICAgbGV0IGtleXM6IHN0cmluZ1tdID0gW107XG4gICAgZm9yIChsZXQgbmFtZSBvZiBwdWJGaWxlcykge1xuICAgICAgICBrZXlzLnB1c2goLi4ubm9ybWFsaXplS2V5cyhhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4ocmVwb1BhdGgsIG5hbWUpLCBcInV0ZjhcIikpKTtcbiAgICB9XG4gICAgcmV0dXJuIGtleXM7XG59XG5cbi8qKiBFdmVyeSBmaWxlIGluIGEgY2hlY2tvdXQsIG90aGVyIHRoYW4gZ2l0J3Mgb3duIGRpcmVjdG9yeSBhbmQgdGhlIHNpZ25hdHVyZSBmaWxlcywgd2hpY2ggY2Fubm90XG4gICAgZGVzY3JpYmUgdGhlbXNlbHZlcy4gKi9cbmFzeW5jIGZ1bmN0aW9uIGxpc3RDaGVja291dEZpbGVzKHJlcG9QYXRoOiBzdHJpbmcsIHByZWZpeD86IHN0cmluZyk6IFByb21pc2U8c3RyaW5nW10+IHtcbiAgICBsZXQgZmlsZXM6IHN0cmluZ1tdID0gW107XG4gICAgZm9yIChsZXQgZW50cnkgb2YgYXdhaXQgZnMucmVhZGRpcihwYXRoLmpvaW4ocmVwb1BhdGgsIHByZWZpeCB8fCBcIlwiKSwgeyB3aXRoRmlsZVR5cGVzOiB0cnVlIH0pKSB7XG4gICAgICAgIGxldCByZWxhdGl2ZVBhdGggPSBwcmVmaXggJiYgYCR7cHJlZml4fS8ke2VudHJ5Lm5hbWV9YCB8fCBlbnRyeS5uYW1lO1xuICAgICAgICBpZiAoZW50cnkubmFtZSA9PT0gXCIuZ2l0XCIpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGlmICghcHJlZml4ICYmIChlbnRyeS5uYW1lID09PSBNQU5JRkVTVF9OQU1FIHx8IGVudHJ5Lm5hbWUgPT09IFNJR05BVFVSRV9OQU1FKSkge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKGVudHJ5LmlzRGlyZWN0b3J5KCkpIHtcbiAgICAgICAgICAgIGZpbGVzLnB1c2goLi4uYXdhaXQgbGlzdENoZWNrb3V0RmlsZXMocmVwb1BhdGgsIHJlbGF0aXZlUGF0aCkpO1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgZmlsZXMucHVzaChyZWxhdGl2ZVBhdGgpO1xuICAgIH1cbiAgICByZXR1cm4gZmlsZXMuc29ydCgpO1xufVxuXG4vKiogVGhlIHNpZ25hdHVyZSBvbmx5IGNvdmVycyB0aGUgbWFuaWZlc3QsIHNvIHRoZSBtYW5pZmVzdCBoYXMgdG8gYmUgY2hlY2tlZCBhZ2FpbnN0IHdoYXQgaXNcbiAgICBhY3R1YWxseSBvbiBkaXNrLiBCb3RoIGRpcmVjdGlvbnMgbWF0dGVyOiBhIG1pc3NpbmcgZmlsZSBjaGFuZ2VzIHdoYXQgdGhlIGtleXMgbWVhbiwgYW5kIGFuXG4gICAgZXh0cmEgdW5saXN0ZWQgZmlsZSBjb3VsZCBhZGQga2V5cyBub2JvZHkgc2lnbmVkIGZvci4gKi9cbmFzeW5jIGZ1bmN0aW9uIHZlcmlmeU1hbmlmZXN0TWF0Y2hlc0ZpbGVzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgbWFuaWZlc3QgPSBKU09OLnBhcnNlKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgTUFOSUZFU1RfTkFNRSksIFwidXRmOFwiKSk7XG4gICAgbGV0IGxpc3RlZCA9IG5ldyBNYXA8c3RyaW5nLCB7IHBhdGg6IHN0cmluZzsgc2l6ZTogbnVtYmVyOyBzaGEyNTY6IHN0cmluZyB9PihcbiAgICAgICAgKG1hbmlmZXN0LmZpbGVzIHx8IFtdKS5tYXAoKGZpbGU6IHsgcGF0aDogc3RyaW5nIH0pID0+IFtmaWxlLnBhdGgsIGZpbGVdKVxuICAgICk7XG4gICAgbGV0IGFjdHVhbCA9IGF3YWl0IGxpc3RDaGVja291dEZpbGVzKHJlcG9QYXRoKTtcblxuICAgIGxldCBtaXNzaW5nID0gWy4uLmxpc3RlZC5rZXlzKCldLmZpbHRlcihmaWxlUGF0aCA9PiAhYWN0dWFsLmluY2x1ZGVzKGZpbGVQYXRoKSk7XG4gICAgaWYgKG1pc3NpbmcubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgdGhlIHNpZ25lZCBmaWxlcyB0byBiZSBwcmVzZW50LCAke21pc3NpbmcubGVuZ3RofSBtaXNzaW5nLCBmaXJzdCAke21pc3NpbmdbMF19YCk7XG4gICAgfVxuICAgIGxldCBleHRyYSA9IGFjdHVhbC5maWx0ZXIoZmlsZVBhdGggPT4gIWxpc3RlZC5oYXMoZmlsZVBhdGgpKTtcbiAgICBpZiAoZXh0cmEubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgb25seSBzaWduZWQgZmlsZXMgdG8gYmUgcHJlc2VudCwgJHtleHRyYS5sZW5ndGh9IGV4dHJhLCBmaXJzdCAke2V4dHJhWzBdfWApO1xuICAgIH1cbiAgICBmb3IgKGxldCBmaWxlUGF0aCBvZiBhY3R1YWwpIHtcbiAgICAgICAgbGV0IGV4cGVjdGVkID0gbGlzdGVkLmdldChmaWxlUGF0aCk7XG4gICAgICAgIGlmICghZXhwZWN0ZWQpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGxldCBjb250ZW50cyA9IG5vcm1hbGl6ZUNvbnRlbnQoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKHJlcG9QYXRoLCBmaWxlUGF0aCkpKTtcbiAgICAgICAgaWYgKGNvbnRlbnRzLmxlbmd0aCAhPT0gZXhwZWN0ZWQuc2l6ZSkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2ZpbGVQYXRofSB0byBiZSAke2V4cGVjdGVkLnNpemV9IGJ5dGVzLCB3YXMgJHtjb250ZW50cy5sZW5ndGh9YCk7XG4gICAgICAgIH1cbiAgICAgICAgbGV0IGhhc2ggPSBjcnlwdG8uY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUoY29udGVudHMpLmRpZ2VzdChcImhleFwiKTtcbiAgICAgICAgaWYgKGhhc2ggIT09IGV4cGVjdGVkLnNoYTI1Nikge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2ZpbGVQYXRofSB0byBoYXNoIHRvICR7ZXhwZWN0ZWQuc2hhMjU2fSwgd2FzICR7aGFzaH1gKTtcbiAgICAgICAgfVxuICAgIH1cbn1cblxuLyoqIFRoZSBtYW5pZmVzdCBhbmQgc2lnbmF0dXJlIGFzIHRoZXkgc3RhbmQsIHdoZXRoZXIgb3Igbm90IHRoZXkgYXJlIGFueSBnb29kLiBUaGUgaGFzaGVzIGFyZVxuICAgIHdoYXQgdGVsbCBhIHNpZ25hdHVyZSB0aGF0IHdhcyBuZXZlciB1cGRhdGVkIGFwYXJ0IGZyb20gb25lIHRoYXQgaXMgYnJva2VuLiAqL1xuYXN5bmMgZnVuY3Rpb24gcmVhZFNpZ25hdHVyZUZpbGVzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgbWFuaWZlc3RQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBNQU5JRkVTVF9OQU1FKTtcbiAgICBsZXQgc2lnbmF0dXJlUGF0aCA9IHBhdGguam9pbihyZXBvUGF0aCwgU0lHTkFUVVJFX05BTUUpO1xuICAgIGxldCBtYW5pZmVzdCA9IGF3YWl0IHBhdGhFeGlzdHMobWFuaWZlc3RQYXRoKSAmJiBhd2FpdCBmcy5yZWFkRmlsZShtYW5pZmVzdFBhdGgpIHx8IHVuZGVmaW5lZDtcbiAgICBsZXQgc2lnbmF0dXJlID0gYXdhaXQgcGF0aEV4aXN0cyhzaWduYXR1cmVQYXRoKSAmJiBhd2FpdCBmcy5yZWFkRmlsZShzaWduYXR1cmVQYXRoKSB8fCB1bmRlZmluZWQ7XG4gICAgcmV0dXJuIHtcbiAgICAgICAgbWFuaWZlc3QsXG4gICAgICAgIHNpZ25hdHVyZSxcbiAgICAgICAgbWFuaWZlc3RIYXNoOiBtYW5pZmVzdCAmJiBjcnlwdG8uY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUobWFuaWZlc3QpLmRpZ2VzdChcImhleFwiKSB8fCBcIlwiLFxuICAgICAgICBzaWduYXR1cmVIYXNoOiBzaWduYXR1cmUgJiYgY3J5cHRvLmNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKHNpZ25hdHVyZSkuZGlnZXN0KFwiaGV4XCIpIHx8IFwiXCIsXG4gICAgfTtcbn1cblxuLyoqIFdobyBzaWduZWQgdGhpcyBjaGVja291dC4gUmV0dXJucyBVTlNJR05FRCB3aGVuIHRoZXJlIGlzIG5vIHNpZ25hdHVyZSBhdCBhbGwsIGFuZCB0aHJvd3Mgd2hlblxuICAgIHRoZXJlIGlzIG9uZSB0aGF0IGRvZXMgbm90IGhvbGQgdXAgLSBhbiB1bnZlcmlmaWFibGUgc2lnbmF0dXJlIGlzIG5ldmVyIHRyZWF0ZWQgYXMgYW4gaWRlbnRpdHksXG4gICAgc28gaXQgY2FuIG5ldmVyIGJlY29tZSBzb21ldGhpbmcgd2UgYWNjZXB0LiAqL1xuYXN5bmMgZnVuY3Rpb24gdmVyaWZ5Q2hlY2tvdXRTaWduZXIoY29uZmlnOiB7XG4gICAgcmVwb1BhdGg6IHN0cmluZztcbiAgICBmaWxlczogeyBtYW5pZmVzdD86IEJ1ZmZlcjsgc2lnbmF0dXJlPzogQnVmZmVyIH07XG59KSB7XG4gICAgbGV0IHsgcmVwb1BhdGgsIGZpbGVzIH0gPSBjb25maWc7XG4gICAgaWYgKCFmaWxlcy5tYW5pZmVzdCAmJiAhZmlsZXMuc2lnbmF0dXJlKSB7XG4gICAgICAgIHJldHVybiBVTlNJR05FRDtcbiAgICB9XG4gICAgaWYgKCFmaWxlcy5tYW5pZmVzdCB8fCAhZmlsZXMuc2lnbmF0dXJlKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYm90aCAke01BTklGRVNUX05BTUV9IGFuZCAke1NJR05BVFVSRV9OQU1FfSwgb25seSBvbmUgaXMgcHJlc2VudGApO1xuICAgIH1cbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogXCJzc2gta2V5Z2VuXCIsXG4gICAgICAgIGFyZ3M6IFtcIi1ZXCIsIFwiY2hlY2stbm92YWxpZGF0ZVwiLCBcIi1uXCIsIFNJR05fTkFNRVNQQUNFLCBcIi1zXCIsIHBhdGguam9pbihyZXBvUGF0aCwgU0lHTkFUVVJFX05BTUUpXSxcbiAgICAgICAgLy8gVGhlIHNpZ25hdHVyZSBjb3ZlcnMgdGhlIG5vcm1hbGlzZWQgYnl0ZXMsIHNvIGEgY2hlY2tvdXQgdGhhdCBhcnJpdmVkIHdpdGggQ1JMRiBzdGlsbFxuICAgICAgICAvLyB2ZXJpZmllcyByYXRoZXIgdGhhbiBsb29raW5nIGxpa2UgdGFtcGVyaW5nLlxuICAgICAgICBpbnB1dDogbm9ybWFsaXplQ29udGVudChmaWxlcy5tYW5pZmVzdCkudG9TdHJpbmcoXCJ1dGY4XCIpLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGB0aGUgc2lnbmF0dXJlIG92ZXIgJHtNQU5JRkVTVF9OQU1FfSBkb2VzIG5vdCB2ZXJpZnk6IGBcbiAgICAgICAgICAgICsgYCR7KHJlc3VsdC5zdGRvdXQgKyByZXN1bHQuc3RkZXJyKS50cmltKCkuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gXG4gICAgICAgICk7XG4gICAgfVxuICAgIGxldCByZXBvcnRlZCA9IGAke3Jlc3VsdC5zdGRvdXR9ICR7cmVzdWx0LnN0ZGVycn1gLm1hdGNoKC8oU0hBMjU2OltBLVphLXowLTkrLz1dKykvKTtcbiAgICBpZiAoIXJlcG9ydGVkKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgc3NoLWtleWdlbiByZXBvcnRlZCBubyBzaWduZXIgZmluZ2VycHJpbnQsIHNhaWQgJHtyZXN1bHQuc3Rkb3V0LnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YCk7XG4gICAgfVxuICAgIGxldCB7IHB1YmxpY0tleSwgZmluZ2VycHJpbnQgfSA9IHB1YmxpY0tleUZyb21TaWduYXR1cmUoZmlsZXMuc2lnbmF0dXJlLnRvU3RyaW5nKFwidXRmOFwiKSk7XG4gICAgLy8gVGhlIGtleSB3ZSByZWFkIG91dCBvZiB0aGUgc2lnbmF0dXJlIGhhcyB0byBiZSB0aGUgb25lIHNzaC1rZXlnZW4ganVzdCBjaGVja2VkIGFnYWluc3QsXG4gICAgLy8gb3RoZXJ3aXNlIHdlIHdvdWxkIGJlIHJlcG9ydGluZyBhbiBpZGVudGl0eSB0aGF0IGRpZCBub3Qgc2lnbiBhbnl0aGluZy5cbiAgICBpZiAoZmluZ2VycHJpbnQgIT09IHJlcG9ydGVkWzFdKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgdGhlIHNpZ25pbmcga2V5IHJlYWRzIGFzICR7ZmluZ2VycHJpbnR9IGJ1dCBzc2gta2V5Z2VuIHZlcmlmaWVkICR7cmVwb3J0ZWRbMV19YCk7XG4gICAgfVxuICAgIGF3YWl0IHZlcmlmeU1hbmlmZXN0TWF0Y2hlc0ZpbGVzKHJlcG9QYXRoKTtcbiAgICByZXR1cm4gcHVibGljS2V5O1xufVxuXG4vKiogUHJvdmVzIGEgY2hlY2tvdXQgb24gZGlzayB3YXMgc2lnbmVkLCBhbmQgdGhhdCB0aGUgZmlsZXMgaW4gaXQgYXJlIHRoZSBvbmVzIHRoYXQgd2VyZSBzaWduZWQuXG4gICAgUmV0dXJucyB0aGUgc2lnbmVyLCBhbmQgdGhyb3dzIGlmIGFueXRoaW5nIGFib3V0IHRoYXQgZG9lcyBub3QgaG9sZC5cblxuICAgIEFueXRoaW5nIHJlYWRpbmcgYSByZXBvIGZvciBzb21ldGhpbmcgb3RoZXIgdGhhbiBzc2gga2V5cyBnb2VzIHRocm91Z2ggdGhpcyBmaXJzdDogdGhlIHdob2xlXG4gICAgY2hlY2tvdXQgaXMgY292ZXJlZCBieSBvbmUgbWFuaWZlc3QsIHNvIGEgbWFjaGluZSBsaXN0IGlzIGV4YWN0bHkgYXMgdHJ1c3R3b3J0aHkgYXMgdGhlIGtleXNcbiAgICBiZXNpZGUgaXQsIGFuZCBuZWl0aGVyIGlzIHdvcnRoIHJlYWRpbmcgdW5zaWduZWQuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gdmVyaWZ5Q2hlY2tvdXQocmVwb1BhdGg6IHN0cmluZykge1xuICAgIHJldHVybiBhd2FpdCB2ZXJpZnlDaGVja291dFNpZ25lcih7IHJlcG9QYXRoLCBmaWxlczogYXdhaXQgcmVhZFNpZ25hdHVyZUZpbGVzKHJlcG9QYXRoKSB9KTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGRlc2NyaWJlU2lnbmVyKHNpZ25lcjogc3RyaW5nKSB7XG4gICAgcmV0dXJuIHNpZ25lciA9PT0gVU5TSUdORUQgJiYgXCI8bm8gcHVibGljIGtleT5cIiB8fCBzaWduZXI7XG59XG5cbi8qKiBSZXBvcnRzIGEgcHJvYmxlbSB3aXRoIGEgc291cmNlJ3Mgc2lnbmF0dXJlLCBidXQgb25seSB3aGVuIGl0IGlzIG5vdCB0aGUgc2FtZSBwcm9ibGVtIHdlXG4gICAgYWxyZWFkeSByZXBvcnRlZCwgc28gYSBmYXVsdCB0aGF0IHBlcnNpc3RzIGRvZXMgbm90IHJlcGVhdCBldmVyeSBjaGVjay4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlcG9ydFByb2JsZW0oY29uZmlnOiB7IHJlcG9VUkw6IHN0cmluZzsgcHJvYmxlbTogc3RyaW5nOyBoZWFkbGluZTogc3RyaW5nOyBib2R5OiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHJlcG9VUkwsIHByb2JsZW0sIGhlYWRsaW5lLCBib2R5IH0gPSBjb25maWc7XG4gICAgbGV0IHNvdXJjZVN0YXRlVmFsdWUgPSBzb3VyY2VTdGF0ZShyZXBvVVJMKTtcbiAgICBpZiAoc291cmNlU3RhdGVWYWx1ZS5yZXBvcnRlZFByb2JsZW0gPT09IHByb2JsZW0pIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBzb3VyY2VTdGF0ZVZhbHVlLnJlcG9ydGVkUHJvYmxlbSA9IHByb2JsZW07XG4gICAgYXdhaXQgc2F2ZVN0YXRlKCk7XG4gICAgYXdhaXQgbm90aWZ5KGhlYWRsaW5lLCBib2R5KTtcbn1cblxuLyoqIFRoZSBrZXlzIGEgc291cmNlIGlzIGFsbG93ZWQgdG8gY29udHJpYnV0ZSByaWdodCBub3cuIEEgc291cmNlIHNpZ25lZCBieSBzb21lb25lIHdlIGhhdmUgbm90XG4gICAgYWNjZXB0ZWQga2VlcHMgY29udHJpYnV0aW5nIHRoZSBrZXlzIHdlIGxhc3QgYWNjZXB0ZWQsIHVudGlsIHRoZSBkZWxheSBoYXMgcGFzc2VkLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVTb3VyY2VLZXlzKHJlcG9VUkw6IHN0cmluZykge1xuICAgIGxldCBzb3VyY2VTdGF0ZVZhbHVlID0gc291cmNlU3RhdGUocmVwb1VSTCk7XG4gICAgbGV0IHJlcG9QYXRoID0gc291cmNlUmVwb1BhdGgocmVwb1VSTCk7XG4gICAgbGV0IGZpbGVzID0gYXdhaXQgcmVhZFNpZ25hdHVyZUZpbGVzKHJlcG9QYXRoKTtcblxuICAgIGxldCBzaWduZXI6IHN0cmluZztcbiAgICB0cnkge1xuICAgICAgICBzaWduZXIgPSBhd2FpdCB2ZXJpZnlDaGVja291dFNpZ25lcih7IHJlcG9QYXRoLCBmaWxlcyB9KTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIE5vdGhpbmcgaGVyZSBpcyB0cnVzdHdvcnRoeSwgc28gbm90aGluZyBoZXJlIGlzIHVzZWQuIFdoaWNoIG9mIHRoZSB0d28gcHJvYmxlbXMgaXQgaXNcbiAgICAgICAgLy8gZGVwZW5kcyBvbiB3aGV0aGVyIHRoZSBzaWduYXR1cmUgaXMgc2ltcGx5IHRoZSBvbmUgd2UgYWxyZWFkeSBhY2NlcHRlZC5cbiAgICAgICAgbGV0IHVuY2hhbmdlZCA9IGZpbGVzLm1hbmlmZXN0SGFzaCA9PT0gc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZE1hbmlmZXN0SGFzaFxuICAgICAgICAgICAgJiYgZmlsZXMuc2lnbmF0dXJlSGFzaCA9PT0gc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZFNpZ25hdHVyZUhhc2g7XG4gICAgICAgIGlmICh1bmNoYW5nZWQpIHtcbiAgICAgICAgICAgIGF3YWl0IHJlcG9ydFByb2JsZW0oe1xuICAgICAgICAgICAgICAgIHJlcG9VUkwsXG4gICAgICAgICAgICAgICAgcHJvYmxlbTogXCJzdGFsZVwiLFxuICAgICAgICAgICAgICAgIGhlYWRsaW5lOiBgS0VZIFJFUE8gQ0hBTkdFRCBXSVRIT1VUIEJFSU5HIFNJR05FRGAsXG4gICAgICAgICAgICAgICAgYm9keTogYFxcYCR7cmVwb1VSTH1cXGAgY2hhbmdlZCwgYnV0IG5vYm9keSBzaWduZWQgdGhlIGNoYW5nZSwgc28gaXQgaXMgYmVpbmcgaWdub3JlZGBcbiAgICAgICAgICAgICAgICAgICAgKyBgIGFuZCB0aGlzIG1hY2hpbmUgaXMgc3RpbGwgdXNpbmcgdGhlIGtleXMgc2lnbmVkIGJ5YFxuICAgICAgICAgICAgICAgICAgICArIGAgXFxgJHtkZXNjcmliZVNpZ25lcihzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyKX1cXGAuYFxuICAgICAgICAgICAgICAgICAgICArIGBcXG5cXG5UbyBtYWtlIHRoZSBjaGFuZ2UgdGFrZSBlZmZlY3QsIHJ1biB0aGlzIGluIHRoYXQgcmVwbzpgXG4gICAgICAgICAgICAgICAgICAgICsgYFxcblxcYFxcYFxcYFxcbiR7U0lHTl9DT01NQU5EfVxcblxcYFxcYFxcYGAsXG4gICAgICAgICAgICB9KTtcbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICAgIGF3YWl0IHJlcG9ydFByb2JsZW0oe1xuICAgICAgICAgICAgICAgIHJlcG9VUkwsXG4gICAgICAgICAgICAgICAgcHJvYmxlbTogXCJjb3JydXB0XCIsXG4gICAgICAgICAgICAgICAgaGVhZGxpbmU6IGBLRVkgUkVQTyBTSUdOQVRVUkUgSVMgQlJPS0VOYCxcbiAgICAgICAgICAgICAgICBib2R5OiBgVGhlIHNpZ25hdHVyZSBvbiBcXGAke3JlcG9VUkx9XFxgIGRvZXMgbm90IGNoZWNrIG91dCwgc28gZXZlcnl0aGluZyBpbiBpdCBpc2BcbiAgICAgICAgICAgICAgICAgICAgKyBgIGJlaW5nIGlnbm9yZWQgYW5kIHRoaXMgbWFjaGluZSBpcyBzdGlsbCB1c2luZyB0aGUga2V5cyBzaWduZWQgYnlgXG4gICAgICAgICAgICAgICAgICAgICsgYCBcXGAke2Rlc2NyaWJlU2lnbmVyKHNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWRTaWduZXIpfVxcYC5gXG4gICAgICAgICAgICAgICAgICAgICsgYFxcblxcbiR7ZX1gXG4gICAgICAgICAgICAgICAgICAgICsgYFxcblxcblRvIHJlcGxhY2UgdGhlIHNpZ25hdHVyZSwgcnVuIHRoaXMgaW4gdGhhdCByZXBvOmBcbiAgICAgICAgICAgICAgICAgICAgKyBgXFxuXFxgXFxgXFxgXFxuJHtTSUdOX0NPTU1BTkR9XFxuXFxgXFxgXFxgYCxcbiAgICAgICAgICAgIH0pO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkS2V5cztcbiAgICB9XG4gICAgaWYgKHNvdXJjZVN0YXRlVmFsdWUucmVwb3J0ZWRQcm9ibGVtKSB7XG4gICAgICAgIHNvdXJjZVN0YXRlVmFsdWUucmVwb3J0ZWRQcm9ibGVtID0gXCJcIjtcbiAgICAgICAgYXdhaXQgc2F2ZVN0YXRlKCk7XG4gICAgfVxuICAgIGxldCBjaGVja291dEtleXMgPSBhd2FpdCByZWFkQ2hlY2tvdXRLZXlzKHJlcG9QYXRoKTtcblxuICAgIGxldCBhY2NlcHQgPSBhc3luYyAoKSA9PiB7XG4gICAgICAgIHNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWQgPSB0cnVlO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyID0gc2lnbmVyO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkS2V5cyA9IGNoZWNrb3V0S2V5cztcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZE1hbmlmZXN0SGFzaCA9IGZpbGVzLm1hbmlmZXN0SGFzaDtcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZFNpZ25hdHVyZUhhc2ggPSBmaWxlcy5zaWduYXR1cmVIYXNoO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLnBlbmRpbmdTaWduZXIgPSBVTlNJR05FRDtcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2luY2UgPSAwO1xuICAgICAgICBhd2FpdCBzYXZlU3RhdGUoKTtcbiAgICAgICAgcmV0dXJuIGNoZWNrb3V0S2V5cztcbiAgICB9O1xuXG4gICAgLy8gTm90aGluZyBoYXMgZXZlciBiZWVuIGFjY2VwdGVkIGZyb20gdGhpcyBzb3VyY2UsIHNvIHRoaXMgaXMgd2hhdCB3ZSBzdGFydCB0cnVzdGluZy5cbiAgICBpZiAoIXNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWQpIHtcbiAgICAgICAgY29uc29sZS5sb2coYFRydXN0aW5nICR7cmVwb1VSTH0gYXMgc2lnbmVkIGJ5ICR7ZGVzY3JpYmVTaWduZXIoc2lnbmVyKX1gKTtcbiAgICAgICAgcmV0dXJuIGF3YWl0IGFjY2VwdCgpO1xuICAgIH1cblxuICAgIGlmIChzaWduZXIgPT09IHNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWRTaWduZXIpIHtcbiAgICAgICAgLy8gQmFjayB0byB0aGUgc2lnbmVyIHdlIGFscmVhZHkgdHJ1c3QsIHNvIGFueXRoaW5nIHdlIHdlcmUgd2FpdGluZyBvbiBpcyBtb290LlxuICAgICAgICBpZiAoc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2luY2UpIHtcbiAgICAgICAgICAgIGNvbnNvbGUubG9nKGAke3JlcG9VUkx9IGlzIHNpZ25lZCBieSBpdHMgYWNjZXB0ZWQga2V5IGFnYWluLCBkcm9wcGluZyB0aGUgcGVuZGluZyBjaGFuZ2VgKTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gYXdhaXQgYWNjZXB0KCk7XG4gICAgfVxuXG4gICAgLy8gR29pbmcgZnJvbSBub3RoaW5nIHRvIHNvbWV0aGluZyBzaWduZWQgaXMgb25seSBldmVyIGFuIGltcHJvdmVtZW50LCBzbyBpdCBkb2VzIG5vdCB3YWl0LlxuICAgIGlmIChzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyID09PSBVTlNJR05FRCkge1xuICAgICAgICBhd2FpdCBub3RpZnkoYEtFWSBSRVBPIElTIE5PVyBTSUdORURgLFxuICAgICAgICAgICAgYFxcYCR7cmVwb1VSTH1cXGAgd2FzIG5vdCBzaWduZWQgYXQgYWxsIGJlZm9yZSwgc28gdGhpcyBpcyBhbiBpbXByb3ZlbWVudCBhbmQgaXRzIGtleXNgXG4gICAgICAgICAgICArIGAgYXJlIGJlaW5nIGFwcGxpZWQgcmlnaHQgYXdheS5gXG4gICAgICAgICAgICArIGBcXG5cXG5zaWduZWQgYnk6IFxcYCR7c2lnbmVyfVxcYGBcbiAgICAgICAgKTtcbiAgICAgICAgcmV0dXJuIGF3YWl0IGFjY2VwdCgpO1xuICAgIH1cblxuICAgIC8vIEEgc2lnbmVyIHdlIGhhdmUgbm90IGFjY2VwdGVkLiBBbnl0aGluZyBuZXcgcmVzdGFydHMgdGhlIHdhaXQsIHNvIHB1Ymxpc2hpbmcgdHdpY2UgaW4gYSByb3dcbiAgICAvLyBnYWlucyBhbiBhdHRhY2tlciBub3RoaW5nLiBwZW5kaW5nU2luY2UgaXMgd2hhdCBtYXJrcyBhIHdhaXQgYXMgcnVubmluZywgYmVjYXVzZSBhbiB1bnNpZ25lZFxuICAgIC8vIGNoZWNrb3V0IGlzIGl0c2VsZiBhIHNpZ25lciB2YWx1ZSBhbmQgY2Fubm90IGRvdWJsZSBhcyBcIm5vdGhpbmcgcGVuZGluZ1wiLlxuICAgIGlmICghc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2luY2UgfHwgc2lnbmVyICE9PSBzb3VyY2VTdGF0ZVZhbHVlLnBlbmRpbmdTaWduZXIpIHtcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2lnbmVyID0gc2lnbmVyO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLnBlbmRpbmdTaW5jZSA9IERhdGUubm93KCk7XG4gICAgICAgIGF3YWl0IHNhdmVTdGF0ZSgpO1xuICAgICAgICBhd2FpdCBub3RpZnkoYEtFWSBSRVBPIFNJR05FRCBCWSBBIERJRkZFUkVOVCBLRVlgLFxuICAgICAgICAgICAgYFNvbWVib2R5IGVsc2UgaXMgc2lnbmluZyBcXGAke3JlcG9VUkx9XFxgIG5vdy4gSXRzIGtleXMgYXJlIE5PVCBiZWluZyBhcHBsaWVkLCBhbmQgdGhpc2BcbiAgICAgICAgICAgICsgYCBtYWNoaW5lIGlzIHN0aWxsIHVzaW5nIHRoZSBvbmVzIGl0IGFscmVhZHkgaGFkLiBJZiBub3RoaW5nIGNoYW5nZXMsIHRoZSBuZXcgc2lnbmVyYFxuICAgICAgICAgICAgKyBgIGlzIGFjY2VwdGVkIGluIDI0IGhvdXJzLmBcbiAgICAgICAgICAgICsgYFxcblxcbklmIHRoYXQgd2FzIG5vdCB5b3UsIGZpeCB0aGUgcmVwbyBiZWZvcmUgdGhlIDI0IGhvdXJzIGFyZSB1cC5gXG4gICAgICAgICAgICArIGBcXG5cXG5zaWduZWQgYnkgbm93OiBcXGAke2Rlc2NyaWJlU2lnbmVyKHNpZ25lcil9XFxgYFxuICAgICAgICAgICAgKyBgXFxuc2lnbmVkIGJ5IGJlZm9yZTogXFxgJHtkZXNjcmliZVNpZ25lcihzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyKX1cXGBgXG4gICAgICAgICk7XG4gICAgICAgIHJldHVybiBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkS2V5cztcbiAgICB9XG5cbiAgICBpZiAoRGF0ZS5ub3coKSAtIHNvdXJjZVN0YXRlVmFsdWUucGVuZGluZ1NpbmNlIDwgU0lHTkVSX0NIQU5HRV9ERUxBWSkge1xuICAgICAgICByZXR1cm4gc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZEtleXM7XG4gICAgfVxuXG4gICAgLy8gU2FtZSBuZXcgc2lnbmVyLCAyNCBob3VycyBsYXRlciwgYW5kIG5vYm9keSBzdG9wcGVkIGl0LlxuICAgIGNvbnNvbGUubG9nKGBBY2NlcHRpbmcgJHtkZXNjcmliZVNpZ25lcihzaWduZXIpfSBmb3IgJHtyZXBvVVJMfSBhZnRlciB0aGUgJHtTSUdORVJfQ0hBTkdFX0RFTEFZfW1zIHdhaXRgKTtcbiAgICByZXR1cm4gYXdhaXQgYWNjZXB0KCk7XG59XG4iXX0=
+ /* _JS_SOURCE_HASH = "2791d2b7398a863c4757a111c3f83e155ece380b6fa541c5bb7384f2c2829041"; */