sliftutils 1.7.133 → 1.7.134

package/security/authorizedKeys/daemon/dist/trust.ts.cache

@@ -1,295 +1,115 @@
-"use strict";
+"use strict"; var console = (function shimConsole() {             let baseConsole = globalThis.console;             if (typeof window !== "undefined")                 return baseConsole;             let name = __filename.replaceAll("\\", "/").split("/").pop();             let dirName = __dirname.replaceAll("\\", "/").split("/").pop();             let context = {                 __FILE__: __filename,                 __DIR__: __dirname,                 __NAME__: name,                 __DIRNAME__: dirName             };             let newConsole = {                 ...baseConsole             };             for (let shim of ["log", "info", "warn", "error"]) {                 newConsole[shim] = (...args) => {                     args.push(context);                     baseConsole[shim](...args);                 };             }             newConsole.__context = context;             return newConsole;         })(); "use strict";
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.resolveSourceKeys = exports.describeSigner = exports.verifyCheckout = exports.readCheckoutKeys = exports.publicKeyFromSignature = void 0;
+//exports.readSignedRepo = exports.SignedRepoError = exports.UNSIGNED = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
-const spawn_1 = require("../../helpers/spawn");
-const authorizedKeys_1 = require("../authorizedKeys");
-const sources_1 = require("../sources");
 const manifest_1 = require("../../signedFiles/manifest");
-const paths_1 = require("./paths");
-const notify_1 = require("./notify");
-const state_1 = require("./state");
+const sshsig_1 = require("../../signedFiles/sshsig");
 // A source that has never been signed reads as this, so losing a signature counts as a change of
 // signer rather than as something to wave through.
-const UNSIGNED = "";
+exports.UNSIGNED = "";
 // What fixes both of the signature problems we report, so the message can say so rather than
 // leaving someone to work it out.
 const SIGN_COMMAND = "yarn signfiles git";
-async function pathExists(filePath) {
-    try {
-        await promises_1.default.access(filePath);
-        return true;
-    }
-    catch (e) {
-        return false;
+/** A repo that cannot be trusted, with the message ready for whoever asked. Not every caller
+    treats these the same - a source keeps its last keys, a machine list is just refused - so the
+    kind is carried rather than acted on here. */
+class SignedRepoError extends Error {
+    constructor(problem, headline, body) {
+        super(`${headline}. ${body}`);
+        this.problem = problem;
+        this.headline = headline;
+        this.body = body;
     }
 }
-function readSSHString(buffer, offset) {
-    let length = buffer.readUInt32BE(offset);
-    return buffer.subarray(offset + 4, offset + 4 + length);
-}
-/** The signature carries the public key that made it, so the key itself can be reported rather
-    than only a fingerprint. Returns it in the usual "type base64" form. */
-function publicKeyFromSignature(signatureText) {
-    let body = signatureText.split("\n").filter(line => line && !line.startsWith("-----")).join("");
-    let blob = Buffer.from(body, "base64");
-    if (blob.subarray(0, 6).toString() !== "SSHSIG") {
-        throw new Error(`Expected an SSHSIG signature, started with ${blob.subarray(0, 6).toString()}`);
-    }
-    // The magic, then a uint32 version, then the public key.
-    let publicKey = readSSHString(blob, 6 + 4);
-    let keyType = readSSHString(publicKey, 0).toString();
-    let fingerprint = "SHA256:" + crypto_1.default.createHash("sha256").update(publicKey).digest("base64").replace(/=+$/, "");
-    return { publicKey: `${keyType} ${publicKey.toString("base64")}`, fingerprint };
-}
-exports.publicKeyFromSignature = publicKeyFromSignature;
-/** Reads one checkout's keys. Prefers a top level authorized_keys file and otherwise concatenates
-    every .pub at the top level. */
-async function readCheckoutKeys(repoPath) {
-    let combinedPath = path_1.default.join(repoPath, "authorized_keys");
-    if (await pathExists(combinedPath)) {
-        return (0, authorizedKeys_1.normalizeKeys)(await promises_1.default.readFile(combinedPath, "utf8"));
-    }
-    let pubFiles = (await promises_1.default.readdir(repoPath)).filter(name => name.endsWith(".pub")).sort();
-    if (!pubFiles.length) {
-        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+exports.SignedRepoError = SignedRepoError;
+/** Everything a signed checkout vouches for, in one call: who signed it, and the contents of every
+    file the signature actually covers.
+
+    UNSIGNED with no files when there is no signature at all. Throws a SignedRepoError when a
+    signature is present but does not hold up, or when a file it signed for was changed or removed
+    without re-signing - either way the caller keeps whatever it last accepted rather than believing
+    a repo that no longer matches what was signed. A file not in the manifest is just unsigned, so
+    it is left out and warned about rather than treated as tampering. */
+async function readSignedRepo(repoPath) {
+    let manifestBytes = await promises_1.default.readFile(path_1.default.join(repoPath, manifest_1.MANIFEST_NAME)).catch(() => undefined);
+    let signatureBytes = await promises_1.default.readFile(path_1.default.join(repoPath, manifest_1.SIGNATURE_NAME)).catch(() => undefined);
+    let manifestHash = manifestBytes && crypto_1.default.createHash("sha256").update(manifestBytes).digest("hex") || "";
+    let signatureHash = signatureBytes && crypto_1.default.createHash("sha256").update(signatureBytes).digest("hex") || "";
+    if (!manifestBytes && !signatureBytes) {
+        console.log(`${repoPath} is not signed, ignoring all of its files`);
+        return { signer: exports.UNSIGNED, manifestHash, signatureHash, files: new Map() };
+    }
+    let broken = (detail) => new SignedRepoError("corrupt", `KEY REPO SIGNATURE IS BROKEN`, `The signature on ${repoPath} does not check out, so everything in it is being ignored and`
+        + ` this machine keeps using what it last accepted.\n\n${detail}`
+        + `\n\nTo replace the signature, run in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``);
+    if (!manifestBytes || !signatureBytes) {
+        throw broken(`Only one of ${manifest_1.MANIFEST_NAME} and ${manifest_1.SIGNATURE_NAME} is present.`);
     }
-    let keys = [];
-    for (let name of pubFiles) {
-        keys.push(...(0, authorizedKeys_1.normalizeKeys)(await promises_1.default.readFile(path_1.default.join(repoPath, name), "utf8")));
+    let signer;
+    try {
+        // The signature covers the normalised bytes, so a checkout that arrived with CRLF still
+        // verifies rather than looking like tampering.
+        signer = (0, sshsig_1.verifySSHSIG)({
+            signature: signatureBytes.toString("utf8"),
+            message: (0, manifest_1.normalizeContent)(manifestBytes),
+            namespace: manifest_1.SIGN_NAMESPACE,
+        }).publicKey;
     }
-    return keys;
-}
-exports.readCheckoutKeys = readCheckoutKeys;
-/** Every file in a checkout, other than git's own directory and the signature files, which cannot
-    describe themselves. */
-async function listCheckoutFiles(repoPath, prefix) {
-    let files = [];
-    for (let entry of await promises_1.default.readdir(path_1.default.join(repoPath, prefix || ""), { withFileTypes: true })) {
-        let relativePath = prefix && `${prefix}/${entry.name}` || entry.name;
-        if (entry.name === ".git") {
-            continue;
-        }
-        if (!prefix && (entry.name === manifest_1.MANIFEST_NAME || entry.name === manifest_1.SIGNATURE_NAME)) {
-            continue;
-        }
-        if (entry.isDirectory()) {
-            files.push(...await listCheckoutFiles(repoPath, relativePath));
-            continue;
+    catch (e) {
+        throw broken(`${e}`);
+    }
+    let stale = (detail) => new SignedRepoError("stale", `KEY REPO CHANGED WITHOUT BEING SIGNED`, `${detail}, so the repo is being ignored and this machine keeps using what it last accepted.`
+        + `\n\nTo make the change take effect, run in that repo:\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``);
+    // Every file on disk, other than git's own directory and the two signature files, which cannot
+    // describe themselves.
+    let listCheckoutFiles = async (prefix) => {
+        let found = [];
+        for (let entry of await promises_1.default.readdir(path_1.default.join(repoPath, prefix || ""), { withFileTypes: true })) {
+            let relativePath = prefix && `${prefix}/${entry.name}` || entry.name;
+            if (entry.name === ".git")
+                continue;
+            if (!prefix && (entry.name === manifest_1.MANIFEST_NAME || entry.name === manifest_1.SIGNATURE_NAME))
+                continue;
+            if (entry.isDirectory()) {
+                found.push(...await listCheckoutFiles(relativePath));
+                continue;
+            }
+            found.push(relativePath);
         }
-        files.push(relativePath);
-    }
-    return files.sort();
-}
-/** The signature only covers the manifest, so the manifest has to be checked against what is
-    actually on disk. Both directions matter: a missing file changes what the keys mean, and an
-    extra unlisted file could add keys nobody signed for. */
-async function verifyManifestMatchesFiles(repoPath) {
-    let manifest = JSON.parse(await promises_1.default.readFile(path_1.default.join(repoPath, manifest_1.MANIFEST_NAME), "utf8"));
+        return found.sort();
+    };
+    let manifest = JSON.parse(manifestBytes.toString("utf8"));
     let listed = new Map((manifest.files || []).map((file) => [file.path, file]));
-    let actual = await listCheckoutFiles(repoPath);
-    let missing = [...listed.keys()].filter(filePath => !actual.includes(filePath));
-    if (missing.length) {
-        throw new Error(`Expected the signed files to be present, ${missing.length} missing, first ${missing[0]}`);
-    }
-    let extra = actual.filter(filePath => !listed.has(filePath));
-    if (extra.length) {
-        throw new Error(`Expected only signed files to be present, ${extra.length} extra, first ${extra[0]}`);
-    }
-    for (let filePath of actual) {
+    let files = new Map();
+    for (let filePath of await listCheckoutFiles()) {
         let expected = listed.get(filePath);
+        // A file the signature never mentioned is not tampering, it is just unsigned - left out
+        // rather than trusted. An extra file in a working tree is ordinary, so it is only a note.
         if (!expected) {
+            console.log(`Ignoring ${path_1.default.join(repoPath, filePath)}, it is not in the signed manifest`);
             continue;
         }
         let contents = (0, manifest_1.normalizeContent)(await promises_1.default.readFile(path_1.default.join(repoPath, filePath)));
-        if (contents.length !== expected.size) {
-            throw new Error(`Expected ${filePath} to be ${expected.size} bytes, was ${contents.length}`);
-        }
         let hash = crypto_1.default.createHash("sha256").update(contents).digest("hex");
-        if (hash !== expected.sha256) {
-            throw new Error(`Expected ${filePath} to hash to ${expected.sha256}, was ${hash}`);
-        }
-    }
-}
-/** The manifest and signature as they stand, whether or not they are any good. The hashes are
-    what tell a signature that was never updated apart from one that is broken. */
-async function readSignatureFiles(repoPath) {
-    let manifestPath = path_1.default.join(repoPath, manifest_1.MANIFEST_NAME);
-    let signaturePath = path_1.default.join(repoPath, manifest_1.SIGNATURE_NAME);
-    let manifest = await pathExists(manifestPath) && await promises_1.default.readFile(manifestPath) || undefined;
-    let signature = await pathExists(signaturePath) && await promises_1.default.readFile(signaturePath) || undefined;
-    return {
-        manifest,
-        signature,
-        manifestHash: manifest && crypto_1.default.createHash("sha256").update(manifest).digest("hex") || "",
-        signatureHash: signature && crypto_1.default.createHash("sha256").update(signature).digest("hex") || "",
-    };
-}
-/** Who signed this checkout. Returns UNSIGNED when there is no signature at all, and throws when
-    there is one that does not hold up - an unverifiable signature is never treated as an identity,
-    so it can never become something we accept. */
-async function verifyCheckoutSigner(config) {
-    let { repoPath, files } = config;
-    if (!files.manifest && !files.signature) {
-        return UNSIGNED;
-    }
-    if (!files.manifest || !files.signature) {
-        throw new Error(`Expected both ${manifest_1.MANIFEST_NAME} and ${manifest_1.SIGNATURE_NAME}, only one is present`);
-    }
-    let result = await (0, spawn_1.spawnPromise)({
-        command: "ssh-keygen",
-        args: ["-Y", "check-novalidate", "-n", manifest_1.SIGN_NAMESPACE, "-s", path_1.default.join(repoPath, manifest_1.SIGNATURE_NAME)],
-        // The signature covers the normalised bytes, so a checkout that arrived with CRLF still
-        // verifies rather than looking like tampering.
-        input: (0, manifest_1.normalizeContent)(files.manifest).toString("utf8"),
-    });
-    if (result.status !== 0) {
-        throw new Error(`the signature over ${manifest_1.MANIFEST_NAME} does not verify: `
-            + `${(result.stdout + result.stderr).trim().slice(0, paths_1.MAX_ERROR_BODY_LENGTH)}`);
-    }
-    let reported = `${result.stdout} ${result.stderr}`.match(/(SHA256:[A-Za-z0-9+/=]+)/);
-    if (!reported) {
-        throw new Error(`ssh-keygen reported no signer fingerprint, said ${result.stdout.slice(0, paths_1.MAX_ERROR_BODY_LENGTH)}`);
-    }
-    let { publicKey, fingerprint } = publicKeyFromSignature(files.signature.toString("utf8"));
-    // The key we read out of the signature has to be the one ssh-keygen just checked against,
-    // otherwise we would be reporting an identity that did not sign anything.
-    if (fingerprint !== reported[1]) {
-        throw new Error(`the signing key reads as ${fingerprint} but ssh-keygen verified ${reported[1]}`);
-    }
-    await verifyManifestMatchesFiles(repoPath);
-    return publicKey;
-}
-/** Proves a checkout on disk was signed, and that the files in it are the ones that were signed.
-    Returns the signer, and throws if anything about that does not hold.
-
-    Anything reading a repo for something other than ssh keys goes through this first: the whole
-    checkout is covered by one manifest, so a machine list is exactly as trustworthy as the keys
-    beside it, and neither is worth reading unsigned. */
-async function verifyCheckout(repoPath) {
-    return await verifyCheckoutSigner({ repoPath, files: await readSignatureFiles(repoPath) });
-}
-exports.verifyCheckout = verifyCheckout;
-function describeSigner(signer) {
-    return signer === UNSIGNED && "<no public key>" || signer;
-}
-exports.describeSigner = describeSigner;
-/** Reports a problem with a source's signature, but only when it is not the same problem we
-    already reported, so a fault that persists does not repeat every check. */
-async function reportProblem(config) {
-    let { repoURL, problem, headline, body } = config;
-    let sourceStateValue = (0, state_1.sourceState)(repoURL);
-    if (sourceStateValue.reportedProblem === problem) {
-        return;
-    }
-    sourceStateValue.reportedProblem = problem;
-    await (0, state_1.saveState)();
-    await (0, notify_1.notify)(headline, body);
-}
-/** The keys a source is allowed to contribute right now. A source signed by someone we have not
-    accepted keeps contributing the keys we last accepted, until the delay has passed. */
-async function resolveSourceKeys(repoURL) {
-    let sourceStateValue = (0, state_1.sourceState)(repoURL);
-    let repoPath = (0, sources_1.sourceRepoPath)(repoURL);
-    let files = await readSignatureFiles(repoPath);
-    let signer;
-    try {
-        signer = await verifyCheckoutSigner({ repoPath, files });
-    }
-    catch (e) {
-        // Nothing here is trustworthy, so nothing here is used. Which of the two problems it is
-        // depends on whether the signature is simply the one we already accepted.
-        let unchanged = files.manifestHash === sourceStateValue.acceptedManifestHash
-            && files.signatureHash === sourceStateValue.acceptedSignatureHash;
-        if (unchanged) {
-            await reportProblem({
-                repoURL,
-                problem: "stale",
-                headline: `KEY REPO CHANGED WITHOUT BEING SIGNED`,
-                body: `\`${repoURL}\` changed, but nobody signed the change, so it is being ignored`
-                    + ` and this machine is still using the keys signed by`
-                    + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
-                    + `\n\nTo make the change take effect, run this in that repo:`
-                    + `\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
-            });
-        }
-        else {
-            await reportProblem({
-                repoURL,
-                problem: "corrupt",
-                headline: `KEY REPO SIGNATURE IS BROKEN`,
-                body: `The signature on \`${repoURL}\` does not check out, so everything in it is`
-                    + ` being ignored and this machine is still using the keys signed by`
-                    + ` \`${describeSigner(sourceStateValue.acceptedSigner)}\`.`
-                    + `\n\n${e}`
-                    + `\n\nTo replace the signature, run this in that repo:`
-                    + `\n\`\`\`\n${SIGN_COMMAND}\n\`\`\``,
-            });
+        // A file the manifest DOES name, but whose content no longer matches, is a signed file
+        // changed without re-signing - the repo being edited out from under its signature.
+        if (contents.length !== expected.size || hash !== expected.sha256) {
+            throw stale(`${path_1.default.join(repoPath, filePath)} was changed after it was signed`);
         }
-        return sourceStateValue.acceptedKeys;
+        files.set(filePath, contents);
     }
-    if (sourceStateValue.reportedProblem) {
-        sourceStateValue.reportedProblem = "";
-        await (0, state_1.saveState)();
-    }
-    let checkoutKeys = await readCheckoutKeys(repoPath);
-    let accept = async () => {
-        sourceStateValue.accepted = true;
-        sourceStateValue.acceptedSigner = signer;
-        sourceStateValue.acceptedKeys = checkoutKeys;
-        sourceStateValue.acceptedManifestHash = files.manifestHash;
-        sourceStateValue.acceptedSignatureHash = files.signatureHash;
-        sourceStateValue.pendingSigner = UNSIGNED;
-        sourceStateValue.pendingSince = 0;
-        await (0, state_1.saveState)();
-        return checkoutKeys;
-    };
-    // Nothing has ever been accepted from this source, so this is what we start trusting.
-    if (!sourceStateValue.accepted) {
-        console.log(`Trusting ${repoURL} as signed by ${describeSigner(signer)}`);
-        return await accept();
-    }
-    if (signer === sourceStateValue.acceptedSigner) {
-        // Back to the signer we already trust, so anything we were waiting on is moot.
-        if (sourceStateValue.pendingSince) {
-            console.log(`${repoURL} is signed by its accepted key again, dropping the pending change`);
+    for (let filePath of listed.keys()) {
+        if (!files.has(filePath)) {
+            throw stale(`${path_1.default.join(repoPath, filePath)} is signed for but missing`);
         }
-        return await accept();
-    }
-    // Going from nothing to something signed is only ever an improvement, so it does not wait.
-    if (sourceStateValue.acceptedSigner === UNSIGNED) {
-        await (0, notify_1.notify)(`KEY REPO IS NOW SIGNED`, `\`${repoURL}\` was not signed at all before, so this is an improvement and its keys`
-            + ` are being applied right away.`
-            + `\n\nsigned by: \`${signer}\``);
-        return await accept();
-    }
-    // A signer we have not accepted. Anything new restarts the wait, so publishing twice in a row
-    // gains an attacker nothing. pendingSince is what marks a wait as running, because an unsigned
-    // checkout is itself a signer value and cannot double as "nothing pending".
-    if (!sourceStateValue.pendingSince || signer !== sourceStateValue.pendingSigner) {
-        sourceStateValue.pendingSigner = signer;
-        sourceStateValue.pendingSince = Date.now();
-        await (0, state_1.saveState)();
-        await (0, notify_1.notify)(`KEY REPO SIGNED BY A DIFFERENT KEY`, `Somebody else is signing \`${repoURL}\` now. Its keys are NOT being applied, and this`
-            + ` machine is still using the ones it already had. If nothing changes, the new signer`
-            + ` is accepted in 24 hours.`
-            + `\n\nIf that was not you, fix the repo before the 24 hours are up.`
-            + `\n\nsigned by now: \`${describeSigner(signer)}\``
-            + `\nsigned by before: \`${describeSigner(sourceStateValue.acceptedSigner)}\``);
-        return sourceStateValue.acceptedKeys;
-    }
-    if (Date.now() - sourceStateValue.pendingSince < paths_1.SIGNER_CHANGE_DELAY) {
-        return sourceStateValue.acceptedKeys;
     }
-    // Same new signer, 24 hours later, and nobody stopped it.
-    console.log(`Accepting ${describeSigner(signer)} for ${repoURL} after the ${paths_1.SIGNER_CHANGE_DELAY}ms wait`);
-    return await accept();
+    return { signer, manifestHash, signatureHash, files };
 }
-exports.resolveSourceKeys = resolveSourceKeys;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJ1c3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0cnVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUN4QiwrQ0FBbUQ7QUFDbkQsc0RBQWtEO0FBQ2xELHdDQUE0QztBQUM1Qyx5REFBNkc7QUFDN0csbUNBQXFFO0FBQ3JFLHFDQUFrQztBQUNsQyxtQ0FBaUQ7QUFFakQsaUdBQWlHO0FBQ2pHLG1EQUFtRDtBQUNuRCxNQUFNLFFBQVEsR0FBRyxFQUFFLENBQUM7QUFDcEIsNkZBQTZGO0FBQzdGLGtDQUFrQztBQUNsQyxNQUFNLFlBQVksR0FBRyxvQkFBb0IsQ0FBQztBQUUxQyxLQUFLLFVBQVUsVUFBVSxDQUFDLFFBQWdCO0lBQ3RDLElBQUksQ0FBQztRQUNELE1BQU0sa0JBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQUM7SUFDaEIsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUFDLE1BQWMsRUFBRSxNQUFjO0lBQ2pELElBQUksTUFBTSxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDekMsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsTUFBTSxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQztBQUM1RCxDQUFDO0FBRUQ7MkVBQzJFO0FBQzNFLFNBQWdCLHNCQUFzQixDQUFDLGFBQXFCO0lBQ3hELElBQUksSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNoRyxJQUFJLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN2QyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzlDLE1BQU0sSUFBSSxLQUFLLENBQUMsOENBQThDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBQ0QseURBQXlEO0lBQ3pELElBQUksU0FBUyxHQUFHLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzNDLElBQUksT0FBTyxHQUFHLGFBQWEsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDckQsSUFBSSxXQUFXLEdBQUcsU0FBUyxHQUFHLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNoSCxPQUFPLEVBQUUsU0FBUyxFQUFFLEdBQUcsT0FBTyxJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUNwRixDQUFDO0FBWEQsd0RBV0M7QUFFRDttQ0FDbUM7QUFDNUIsS0FBSyxVQUFVLGdCQUFnQixDQUFDLFFBQWdCO0lBQ25ELElBQUksWUFBWSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDMUQsSUFBSSxNQUFNLFVBQVUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ2pDLE9BQU8sSUFBQSw4QkFBYSxFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELElBQUksUUFBUSxHQUFHLENBQUMsTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN6RixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELFFBQVEsaUJBQWlCLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQWEsRUFBRSxDQUFDO0lBQ3hCLEtBQUssSUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEsOEJBQWEsRUFBQyxNQUFNLGtCQUFFLENBQUMsUUFBUSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQztBQWRELDRDQWNDO0FBRUQ7MkJBQzJCO0FBQzNCLEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxRQUFnQixFQUFFLE1BQWU7SUFDOUQsSUFBSSxLQUFLLEdBQWEsRUFBRSxDQUFDO0lBQ3pCLEtBQUssSUFBSSxLQUFLLElBQUksTUFBTSxrQkFBRSxDQUFDLE9BQU8sQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLElBQUksRUFBRSxDQUFDLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzdGLElBQUksWUFBWSxHQUFHLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQztRQUNyRSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDeEIsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyx3QkFBYSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUsseUJBQWMsQ0FBQyxFQUFFLENBQUM7WUFDN0UsU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO1lBQ3RCLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLGlCQUFpQixDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO1lBQy9ELFNBQVM7UUFDYixDQUFDO1FBQ0QsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUM3QixDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7QUFDeEIsQ0FBQztBQUVEOzs0REFFNEQ7QUFDNUQsS0FBSyxVQUFVLDBCQUEwQixDQUFDLFFBQWdCO0lBQ3RELElBQUksUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSx3QkFBYSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN6RixJQUFJLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FDaEIsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQXNCLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUM1RSxDQUFDO0lBQ0YsSUFBSSxNQUFNLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUUvQyxJQUFJLE9BQU8sR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDaEYsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQyw0Q0FBNEMsT0FBTyxDQUFDLE1BQU0sbUJBQW1CLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDL0csQ0FBQztJQUNELElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM3RCxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLEtBQUssQ0FBQyxNQUFNLGlCQUFpQixLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxLQUFLLElBQUksUUFBUSxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQzFCLElBQUksUUFBUSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDcEMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ1osU0FBUztRQUNiLENBQUM7UUFDRCxJQUFJLFFBQVEsR0FBRyxJQUFBLDJCQUFnQixFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xGLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDcEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxZQUFZLFFBQVEsVUFBVSxRQUFRLENBQUMsSUFBSSxlQUFlLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ2pHLENBQUM7UUFDRCxJQUFJLElBQUksR0FBRyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3RFLElBQUksSUFBSSxLQUFLLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMzQixNQUFNLElBQUksS0FBSyxDQUFDLFlBQVksUUFBUSxlQUFlLFFBQVEsQ0FBQyxNQUFNLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN2RixDQUFDO0lBQ0wsQ0FBQztBQUNMLENBQUM7QUFFRDtrRkFDa0Y7QUFDbEYsS0FBSyxVQUFVLGtCQUFrQixDQUFDLFFBQWdCO0lBQzlDLElBQUksWUFBWSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLHdCQUFhLENBQUMsQ0FBQztJQUN0RCxJQUFJLGFBQWEsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSx5QkFBYyxDQUFDLENBQUM7SUFDeEQsSUFBSSxRQUFRLEdBQUcsTUFBTSxVQUFVLENBQUMsWUFBWSxDQUFDLElBQUksTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDOUYsSUFBSSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsYUFBYSxDQUFDLElBQUksTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxTQUFTLENBQUM7SUFDakcsT0FBTztRQUNILFFBQVE7UUFDUixTQUFTO1FBQ1QsWUFBWSxFQUFFLFFBQVEsSUFBSSxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUU7UUFDMUYsYUFBYSxFQUFFLFNBQVMsSUFBSSxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUU7S0FDaEcsQ0FBQztBQUNOLENBQUM7QUFFRDs7a0RBRWtEO0FBQ2xELEtBQUssVUFBVSxvQkFBb0IsQ0FBQyxNQUduQztJQUNHLElBQUksRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQ2pDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sUUFBUSxDQUFDO0lBQ3BCLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLGlCQUFpQix3QkFBYSxRQUFRLHlCQUFjLHVCQUF1QixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksTUFBTSxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDO1FBQzVCLE9BQU8sRUFBRSxZQUFZO1FBQ3JCLElBQUksRUFBRSxDQUFDLElBQUksRUFBRSxrQkFBa0IsRUFBRSxJQUFJLEVBQUUseUJBQWMsRUFBRSxJQUFJLEVBQUUsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUseUJBQWMsQ0FBQyxDQUFDO1FBQ2pHLHdGQUF3RjtRQUN4RiwrQ0FBK0M7UUFDL0MsS0FBSyxFQUFFLElBQUEsMkJBQWdCLEVBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7S0FDM0QsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQ1gsc0JBQXNCLHdCQUFhLG9CQUFvQjtjQUNyRCxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSw2QkFBcUIsQ0FBQyxFQUFFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSxRQUFRLEdBQUcsR0FBRyxNQUFNLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUNyRixJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsNkJBQXFCLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEgsQ0FBQztJQUNELElBQUksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLEdBQUcsc0JBQXNCLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMxRiwwRkFBMEY7SUFDMUYsMEVBQTBFO0lBQzFFLElBQUksV0FBVyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlCLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLFdBQVcsNEJBQTRCLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdEcsQ0FBQztJQUNELE1BQU0sMEJBQTBCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0MsT0FBTyxTQUFTLENBQUM7QUFDckIsQ0FBQztBQUVEOzs7Ozt3REFLd0Q7QUFDakQsS0FBSyxVQUFVLGNBQWMsQ0FBQyxRQUFnQjtJQUNqRCxPQUFPLE1BQU0sb0JBQW9CLENBQUMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLE1BQU0sa0JBQWtCLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQy9GLENBQUM7QUFGRCx3Q0FFQztBQUVELFNBQWdCLGNBQWMsQ0FBQyxNQUFjO0lBQ3pDLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxpQkFBaUIsSUFBSSxNQUFNLENBQUM7QUFDOUQsQ0FBQztBQUZELHdDQUVDO0FBRUQ7OEVBQzhFO0FBQzlFLEtBQUssVUFBVSxhQUFhLENBQUMsTUFBNEU7SUFDckcsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNsRCxJQUFJLGdCQUFnQixHQUFHLElBQUEsbUJBQVcsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUM1QyxJQUFJLGdCQUFnQixDQUFDLGVBQWUsS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUMvQyxPQUFPO0lBQ1gsQ0FBQztJQUNELGdCQUFnQixDQUFDLGVBQWUsR0FBRyxPQUFPLENBQUM7SUFDM0MsTUFBTSxJQUFBLGlCQUFTLEdBQUUsQ0FBQztJQUNsQixNQUFNLElBQUEsZUFBTSxFQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUNqQyxDQUFDO0FBRUQ7eUZBQ3lGO0FBQ2xGLEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxPQUFlO0lBQ25ELElBQUksZ0JBQWdCLEdBQUcsSUFBQSxtQkFBVyxFQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzVDLElBQUksUUFBUSxHQUFHLElBQUEsd0JBQWMsRUFBQyxPQUFPLENBQUMsQ0FBQztJQUN2QyxJQUFJLEtBQUssR0FBRyxNQUFNLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRS9DLElBQUksTUFBYyxDQUFDO0lBQ25CLElBQUksQ0FBQztRQUNELE1BQU0sR0FBRyxNQUFNLG9CQUFvQixDQUFDLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCx3RkFBd0Y7UUFDeEYsMEVBQTBFO1FBQzFFLElBQUksU0FBUyxHQUFHLEtBQUssQ0FBQyxZQUFZLEtBQUssZ0JBQWdCLENBQUMsb0JBQW9CO2VBQ3JFLEtBQUssQ0FBQyxhQUFhLEtBQUssZ0JBQWdCLENBQUMscUJBQXFCLENBQUM7UUFDdEUsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNaLE1BQU0sYUFBYSxDQUFDO2dCQUNoQixPQUFPO2dCQUNQLE9BQU8sRUFBRSxPQUFPO2dCQUNoQixRQUFRLEVBQUUsdUNBQXVDO2dCQUNqRCxJQUFJLEVBQUUsS0FBSyxPQUFPLGtFQUFrRTtzQkFDOUUscURBQXFEO3NCQUNyRCxNQUFNLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUMsS0FBSztzQkFDMUQsNERBQTREO3NCQUM1RCxhQUFhLFlBQVksVUFBVTthQUM1QyxDQUFDLENBQUM7UUFDUCxDQUFDO2FBQU0sQ0FBQztZQUNKLE1BQU0sYUFBYSxDQUFDO2dCQUNoQixPQUFPO2dCQUNQLE9BQU8sRUFBRSxTQUFTO2dCQUNsQixRQUFRLEVBQUUsOEJBQThCO2dCQUN4QyxJQUFJLEVBQUUsc0JBQXNCLE9BQU8sK0NBQStDO3NCQUM1RSxtRUFBbUU7c0JBQ25FLE1BQU0sY0FBYyxDQUFDLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxLQUFLO3NCQUMxRCxPQUFPLENBQUMsRUFBRTtzQkFDVixzREFBc0Q7c0JBQ3RELGFBQWEsWUFBWSxVQUFVO2FBQzVDLENBQUMsQ0FBQztRQUNQLENBQUM7UUFDRCxPQUFPLGdCQUFnQixDQUFDLFlBQVksQ0FBQztJQUN6QyxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNuQyxnQkFBZ0IsQ0FBQyxlQUFlLEdBQUcsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sSUFBQSxpQkFBUyxHQUFFLENBQUM7SUFDdEIsQ0FBQztJQUNELElBQUksWUFBWSxHQUFHLE1BQU0sZ0JBQWdCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFFcEQsSUFBSSxNQUFNLEdBQUcsS0FBSyxJQUFJLEVBQUU7UUFDcEIsZ0JBQWdCLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztRQUNqQyxnQkFBZ0IsQ0FBQyxjQUFjLEdBQUcsTUFBTSxDQUFDO1FBQ3pDLGdCQUFnQixDQUFDLFlBQVksR0FBRyxZQUFZLENBQUM7UUFDN0MsZ0JBQWdCLENBQUMsb0JBQW9CLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQztRQUMzRCxnQkFBZ0IsQ0FBQyxxQkFBcUIsR0FBRyxLQUFLLENBQUMsYUFBYSxDQUFDO1FBQzdELGdCQUFnQixDQUFDLGFBQWEsR0FBRyxRQUFRLENBQUM7UUFDMUMsZ0JBQWdCLENBQUMsWUFBWSxHQUFHLENBQUMsQ0FBQztRQUNsQyxNQUFNLElBQUEsaUJBQVMsR0FBRSxDQUFDO1FBQ2xCLE9BQU8sWUFBWSxDQUFDO0lBQ3hCLENBQUMsQ0FBQztJQUVGLHNGQUFzRjtJQUN0RixJQUFJLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDN0IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLE9BQU8saUJBQWlCLGNBQWMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDMUUsT0FBTyxNQUFNLE1BQU0sRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFRCxJQUFJLE1BQU0sS0FBSyxnQkFBZ0IsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUM3QywrRUFBK0U7UUFDL0UsSUFBSSxnQkFBZ0IsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNoQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsT0FBTyxtRUFBbUUsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFDRCxPQUFPLE1BQU0sTUFBTSxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVELDJGQUEyRjtJQUMzRixJQUFJLGdCQUFnQixDQUFDLGNBQWMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUEsZUFBTSxFQUFDLHdCQUF3QixFQUNqQyxLQUFLLE9BQU8seUVBQXlFO2NBQ25GLGdDQUFnQztjQUNoQyxvQkFBb0IsTUFBTSxJQUFJLENBQ25DLENBQUM7UUFDRixPQUFPLE1BQU0sTUFBTSxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVELDhGQUE4RjtJQUM5RiwrRkFBK0Y7SUFDL0YsNEVBQTRFO0lBQzVFLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLElBQUksTUFBTSxLQUFLLGdCQUFnQixDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzlFLGdCQUFnQixDQUFDLGFBQWEsR0FBRyxNQUFNLENBQUM7UUFDeEMsZ0JBQWdCLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUMzQyxNQUFNLElBQUEsaUJBQVMsR0FBRSxDQUFDO1FBQ2xCLE1BQU0sSUFBQSxlQUFNLEVBQUMsb0NBQW9DLEVBQzdDLDhCQUE4QixPQUFPLGtEQUFrRDtjQUNyRixxRkFBcUY7Y0FDckYsMkJBQTJCO2NBQzNCLG1FQUFtRTtjQUNuRSx3QkFBd0IsY0FBYyxDQUFDLE1BQU0sQ0FBQyxJQUFJO2NBQ2xELHlCQUF5QixjQUFjLENBQUMsZ0JBQWdCLENBQUMsY0FBYyxDQUFDLElBQUksQ0FDakYsQ0FBQztRQUNGLE9BQU8sZ0JBQWdCLENBQUMsWUFBWSxDQUFDO0lBQ3pDLENBQUM7SUFFRCxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxnQkFBZ0IsQ0FBQyxZQUFZLEdBQUcsMkJBQW1CLEVBQUUsQ0FBQztRQUNuRSxPQUFPLGdCQUFnQixDQUFDLFlBQVksQ0FBQztJQUN6QyxDQUFDO0lBRUQsMERBQTBEO0lBQzFELE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxjQUFjLENBQUMsTUFBTSxDQUFDLFFBQVEsT0FBTyxjQUFjLDJCQUFtQixTQUFTLENBQUMsQ0FBQztJQUMxRyxPQUFPLE1BQU0sTUFBTSxFQUFFLENBQUM7QUFDMUIsQ0FBQztBQTFHRCw4Q0EwR0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgY3J5cHRvIGZyb20gXCJjcnlwdG9cIjtcbmltcG9ydCBmcyBmcm9tIFwiZnMvcHJvbWlzZXNcIjtcbmltcG9ydCBwYXRoIGZyb20gXCJwYXRoXCI7XG5pbXBvcnQgeyBzcGF3blByb21pc2UgfSBmcm9tIFwiLi4vLi4vaGVscGVycy9zcGF3blwiO1xuaW1wb3J0IHsgbm9ybWFsaXplS2V5cyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5c1wiO1xuaW1wb3J0IHsgc291cmNlUmVwb1BhdGggfSBmcm9tIFwiLi4vc291cmNlc1wiO1xuaW1wb3J0IHsgTUFOSUZFU1RfTkFNRSwgbm9ybWFsaXplQ29udGVudCwgU0lHTl9OQU1FU1BBQ0UsIFNJR05BVFVSRV9OQU1FIH0gZnJvbSBcIi4uLy4uL3NpZ25lZEZpbGVzL21hbmlmZXN0XCI7XG5pbXBvcnQgeyBNQVhfRVJST1JfQk9EWV9MRU5HVEgsIFNJR05FUl9DSEFOR0VfREVMQVkgfSBmcm9tIFwiLi9wYXRoc1wiO1xuaW1wb3J0IHsgbm90aWZ5IH0gZnJvbSBcIi4vbm90aWZ5XCI7XG5pbXBvcnQgeyBzYXZlU3RhdGUsIHNvdXJjZVN0YXRlIH0gZnJvbSBcIi4vc3RhdGVcIjtcblxuLy8gQSBzb3VyY2UgdGhhdCBoYXMgbmV2ZXIgYmVlbiBzaWduZWQgcmVhZHMgYXMgdGhpcywgc28gbG9zaW5nIGEgc2lnbmF0dXJlIGNvdW50cyBhcyBhIGNoYW5nZSBvZlxuLy8gc2lnbmVyIHJhdGhlciB0aGFuIGFzIHNvbWV0aGluZyB0byB3YXZlIHRocm91Z2guXG5jb25zdCBVTlNJR05FRCA9IFwiXCI7XG4vLyBXaGF0IGZpeGVzIGJvdGggb2YgdGhlIHNpZ25hdHVyZSBwcm9ibGVtcyB3ZSByZXBvcnQsIHNvIHRoZSBtZXNzYWdlIGNhbiBzYXkgc28gcmF0aGVyIHRoYW5cbi8vIGxlYXZpbmcgc29tZW9uZSB0byB3b3JrIGl0IG91dC5cbmNvbnN0IFNJR05fQ09NTUFORCA9IFwieWFybiBzaWduZmlsZXMgZ2l0XCI7XG5cbmFzeW5jIGZ1bmN0aW9uIHBhdGhFeGlzdHMoZmlsZVBhdGg6IHN0cmluZykge1xuICAgIHRyeSB7XG4gICAgICAgIGF3YWl0IGZzLmFjY2VzcyhmaWxlUGF0aCk7XG4gICAgICAgIHJldHVybiB0cnVlO1xuICAgIH0gY2F0Y2ggKGUpIHtcbiAgICAgICAgcmV0dXJuIGZhbHNlO1xuICAgIH1cbn1cblxuZnVuY3Rpb24gcmVhZFNTSFN0cmluZyhidWZmZXI6IEJ1ZmZlciwgb2Zmc2V0OiBudW1iZXIpIHtcbiAgICBsZXQgbGVuZ3RoID0gYnVmZmVyLnJlYWRVSW50MzJCRShvZmZzZXQpO1xuICAgIHJldHVybiBidWZmZXIuc3ViYXJyYXkob2Zmc2V0ICsgNCwgb2Zmc2V0ICsgNCArIGxlbmd0aCk7XG59XG5cbi8qKiBUaGUgc2lnbmF0dXJlIGNhcnJpZXMgdGhlIHB1YmxpYyBrZXkgdGhhdCBtYWRlIGl0LCBzbyB0aGUga2V5IGl0c2VsZiBjYW4gYmUgcmVwb3J0ZWQgcmF0aGVyXG4gICAgdGhhbiBvbmx5IGEgZmluZ2VycHJpbnQuIFJldHVybnMgaXQgaW4gdGhlIHVzdWFsIFwidHlwZSBiYXNlNjRcIiBmb3JtLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHB1YmxpY0tleUZyb21TaWduYXR1cmUoc2lnbmF0dXJlVGV4dDogc3RyaW5nKSB7XG4gICAgbGV0IGJvZHkgPSBzaWduYXR1cmVUZXh0LnNwbGl0KFwiXFxuXCIpLmZpbHRlcihsaW5lID0+IGxpbmUgJiYgIWxpbmUuc3RhcnRzV2l0aChcIi0tLS0tXCIpKS5qb2luKFwiXCIpO1xuICAgIGxldCBibG9iID0gQnVmZmVyLmZyb20oYm9keSwgXCJiYXNlNjRcIik7XG4gICAgaWYgKGJsb2Iuc3ViYXJyYXkoMCwgNikudG9TdHJpbmcoKSAhPT0gXCJTU0hTSUdcIikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGFuIFNTSFNJRyBzaWduYXR1cmUsIHN0YXJ0ZWQgd2l0aCAke2Jsb2Iuc3ViYXJyYXkoMCwgNikudG9TdHJpbmcoKX1gKTtcbiAgICB9XG4gICAgLy8gVGhlIG1hZ2ljLCB0aGVuIGEgdWludDMyIHZlcnNpb24sIHRoZW4gdGhlIHB1YmxpYyBrZXkuXG4gICAgbGV0IHB1YmxpY0tleSA9IHJlYWRTU0hTdHJpbmcoYmxvYiwgNiArIDQpO1xuICAgIGxldCBrZXlUeXBlID0gcmVhZFNTSFN0cmluZyhwdWJsaWNLZXksIDApLnRvU3RyaW5nKCk7XG4gICAgbGV0IGZpbmdlcnByaW50ID0gXCJTSEEyNTY6XCIgKyBjcnlwdG8uY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUocHVibGljS2V5KS5kaWdlc3QoXCJiYXNlNjRcIikucmVwbGFjZSgvPSskLywgXCJcIik7XG4gICAgcmV0dXJuIHsgcHVibGljS2V5OiBgJHtrZXlUeXBlfSAke3B1YmxpY0tleS50b1N0cmluZyhcImJhc2U2NFwiKX1gLCBmaW5nZXJwcmludCB9O1xufVxuXG4vKiogUmVhZHMgb25lIGNoZWNrb3V0J3Mga2V5cy4gUHJlZmVycyBhIHRvcCBsZXZlbCBhdXRob3JpemVkX2tleXMgZmlsZSBhbmQgb3RoZXJ3aXNlIGNvbmNhdGVuYXRlc1xuICAgIGV2ZXJ5IC5wdWIgYXQgdGhlIHRvcCBsZXZlbC4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiByZWFkQ2hlY2tvdXRLZXlzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgY29tYmluZWRQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKTtcbiAgICBpZiAoYXdhaXQgcGF0aEV4aXN0cyhjb21iaW5lZFBhdGgpKSB7XG4gICAgICAgIHJldHVybiBub3JtYWxpemVLZXlzKGF3YWl0IGZzLnJlYWRGaWxlKGNvbWJpbmVkUGF0aCwgXCJ1dGY4XCIpKTtcbiAgICB9XG4gICAgbGV0IHB1YkZpbGVzID0gKGF3YWl0IGZzLnJlYWRkaXIocmVwb1BhdGgpKS5maWx0ZXIobmFtZSA9PiBuYW1lLmVuZHNXaXRoKFwiLnB1YlwiKSkuc29ydCgpO1xuICAgIGlmICghcHViRmlsZXMubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYXV0aG9yaXplZF9rZXlzIG9yIGF0IGxlYXN0IG9uZSAucHViIGZpbGUgaW4gJHtyZXBvUGF0aH0sIGZvdW5kIG5laXRoZXJgKTtcbiAgICB9XG4gICAgbGV0IGtleXM6IHN0cmluZ1tdID0gW107XG4gICAgZm9yIChsZXQgbmFtZSBvZiBwdWJGaWxlcykge1xuICAgICAgICBrZXlzLnB1c2goLi4ubm9ybWFsaXplS2V5cyhhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4ocmVwb1BhdGgsIG5hbWUpLCBcInV0ZjhcIikpKTtcbiAgICB9XG4gICAgcmV0dXJuIGtleXM7XG59XG5cbi8qKiBFdmVyeSBmaWxlIGluIGEgY2hlY2tvdXQsIG90aGVyIHRoYW4gZ2l0J3Mgb3duIGRpcmVjdG9yeSBhbmQgdGhlIHNpZ25hdHVyZSBmaWxlcywgd2hpY2ggY2Fubm90XG4gICAgZGVzY3JpYmUgdGhlbXNlbHZlcy4gKi9cbmFzeW5jIGZ1bmN0aW9uIGxpc3RDaGVja291dEZpbGVzKHJlcG9QYXRoOiBzdHJpbmcsIHByZWZpeD86IHN0cmluZyk6IFByb21pc2U8c3RyaW5nW10+IHtcbiAgICBsZXQgZmlsZXM6IHN0cmluZ1tdID0gW107XG4gICAgZm9yIChsZXQgZW50cnkgb2YgYXdhaXQgZnMucmVhZGRpcihwYXRoLmpvaW4ocmVwb1BhdGgsIHByZWZpeCB8fCBcIlwiKSwgeyB3aXRoRmlsZVR5cGVzOiB0cnVlIH0pKSB7XG4gICAgICAgIGxldCByZWxhdGl2ZVBhdGggPSBwcmVmaXggJiYgYCR7cHJlZml4fS8ke2VudHJ5Lm5hbWV9YCB8fCBlbnRyeS5uYW1lO1xuICAgICAgICBpZiAoZW50cnkubmFtZSA9PT0gXCIuZ2l0XCIpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGlmICghcHJlZml4ICYmIChlbnRyeS5uYW1lID09PSBNQU5JRkVTVF9OQU1FIHx8IGVudHJ5Lm5hbWUgPT09IFNJR05BVFVSRV9OQU1FKSkge1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgaWYgKGVudHJ5LmlzRGlyZWN0b3J5KCkpIHtcbiAgICAgICAgICAgIGZpbGVzLnB1c2goLi4uYXdhaXQgbGlzdENoZWNrb3V0RmlsZXMocmVwb1BhdGgsIHJlbGF0aXZlUGF0aCkpO1xuICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgIH1cbiAgICAgICAgZmlsZXMucHVzaChyZWxhdGl2ZVBhdGgpO1xuICAgIH1cbiAgICByZXR1cm4gZmlsZXMuc29ydCgpO1xufVxuXG4vKiogVGhlIHNpZ25hdHVyZSBvbmx5IGNvdmVycyB0aGUgbWFuaWZlc3QsIHNvIHRoZSBtYW5pZmVzdCBoYXMgdG8gYmUgY2hlY2tlZCBhZ2FpbnN0IHdoYXQgaXNcbiAgICBhY3R1YWxseSBvbiBkaXNrLiBCb3RoIGRpcmVjdGlvbnMgbWF0dGVyOiBhIG1pc3NpbmcgZmlsZSBjaGFuZ2VzIHdoYXQgdGhlIGtleXMgbWVhbiwgYW5kIGFuXG4gICAgZXh0cmEgdW5saXN0ZWQgZmlsZSBjb3VsZCBhZGQga2V5cyBub2JvZHkgc2lnbmVkIGZvci4gKi9cbmFzeW5jIGZ1bmN0aW9uIHZlcmlmeU1hbmlmZXN0TWF0Y2hlc0ZpbGVzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgbWFuaWZlc3QgPSBKU09OLnBhcnNlKGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgTUFOSUZFU1RfTkFNRSksIFwidXRmOFwiKSk7XG4gICAgbGV0IGxpc3RlZCA9IG5ldyBNYXA8c3RyaW5nLCB7IHBhdGg6IHN0cmluZzsgc2l6ZTogbnVtYmVyOyBzaGEyNTY6IHN0cmluZyB9PihcbiAgICAgICAgKG1hbmlmZXN0LmZpbGVzIHx8IFtdKS5tYXAoKGZpbGU6IHsgcGF0aDogc3RyaW5nIH0pID0+IFtmaWxlLnBhdGgsIGZpbGVdKVxuICAgICk7XG4gICAgbGV0IGFjdHVhbCA9IGF3YWl0IGxpc3RDaGVja291dEZpbGVzKHJlcG9QYXRoKTtcblxuICAgIGxldCBtaXNzaW5nID0gWy4uLmxpc3RlZC5rZXlzKCldLmZpbHRlcihmaWxlUGF0aCA9PiAhYWN0dWFsLmluY2x1ZGVzKGZpbGVQYXRoKSk7XG4gICAgaWYgKG1pc3NpbmcubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgdGhlIHNpZ25lZCBmaWxlcyB0byBiZSBwcmVzZW50LCAke21pc3NpbmcubGVuZ3RofSBtaXNzaW5nLCBmaXJzdCAke21pc3NpbmdbMF19YCk7XG4gICAgfVxuICAgIGxldCBleHRyYSA9IGFjdHVhbC5maWx0ZXIoZmlsZVBhdGggPT4gIWxpc3RlZC5oYXMoZmlsZVBhdGgpKTtcbiAgICBpZiAoZXh0cmEubGVuZ3RoKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgb25seSBzaWduZWQgZmlsZXMgdG8gYmUgcHJlc2VudCwgJHtleHRyYS5sZW5ndGh9IGV4dHJhLCBmaXJzdCAke2V4dHJhWzBdfWApO1xuICAgIH1cbiAgICBmb3IgKGxldCBmaWxlUGF0aCBvZiBhY3R1YWwpIHtcbiAgICAgICAgbGV0IGV4cGVjdGVkID0gbGlzdGVkLmdldChmaWxlUGF0aCk7XG4gICAgICAgIGlmICghZXhwZWN0ZWQpIHtcbiAgICAgICAgICAgIGNvbnRpbnVlO1xuICAgICAgICB9XG4gICAgICAgIGxldCBjb250ZW50cyA9IG5vcm1hbGl6ZUNvbnRlbnQoYXdhaXQgZnMucmVhZEZpbGUocGF0aC5qb2luKHJlcG9QYXRoLCBmaWxlUGF0aCkpKTtcbiAgICAgICAgaWYgKGNvbnRlbnRzLmxlbmd0aCAhPT0gZXhwZWN0ZWQuc2l6ZSkge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2ZpbGVQYXRofSB0byBiZSAke2V4cGVjdGVkLnNpemV9IGJ5dGVzLCB3YXMgJHtjb250ZW50cy5sZW5ndGh9YCk7XG4gICAgICAgIH1cbiAgICAgICAgbGV0IGhhc2ggPSBjcnlwdG8uY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUoY29udGVudHMpLmRpZ2VzdChcImhleFwiKTtcbiAgICAgICAgaWYgKGhhc2ggIT09IGV4cGVjdGVkLnNoYTI1Nikge1xuICAgICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCAke2ZpbGVQYXRofSB0byBoYXNoIHRvICR7ZXhwZWN0ZWQuc2hhMjU2fSwgd2FzICR7aGFzaH1gKTtcbiAgICAgICAgfVxuICAgIH1cbn1cblxuLyoqIFRoZSBtYW5pZmVzdCBhbmQgc2lnbmF0dXJlIGFzIHRoZXkgc3RhbmQsIHdoZXRoZXIgb3Igbm90IHRoZXkgYXJlIGFueSBnb29kLiBUaGUgaGFzaGVzIGFyZVxuICAgIHdoYXQgdGVsbCBhIHNpZ25hdHVyZSB0aGF0IHdhcyBuZXZlciB1cGRhdGVkIGFwYXJ0IGZyb20gb25lIHRoYXQgaXMgYnJva2VuLiAqL1xuYXN5bmMgZnVuY3Rpb24gcmVhZFNpZ25hdHVyZUZpbGVzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgbWFuaWZlc3RQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBNQU5JRkVTVF9OQU1FKTtcbiAgICBsZXQgc2lnbmF0dXJlUGF0aCA9IHBhdGguam9pbihyZXBvUGF0aCwgU0lHTkFUVVJFX05BTUUpO1xuICAgIGxldCBtYW5pZmVzdCA9IGF3YWl0IHBhdGhFeGlzdHMobWFuaWZlc3RQYXRoKSAmJiBhd2FpdCBmcy5yZWFkRmlsZShtYW5pZmVzdFBhdGgpIHx8IHVuZGVmaW5lZDtcbiAgICBsZXQgc2lnbmF0dXJlID0gYXdhaXQgcGF0aEV4aXN0cyhzaWduYXR1cmVQYXRoKSAmJiBhd2FpdCBmcy5yZWFkRmlsZShzaWduYXR1cmVQYXRoKSB8fCB1bmRlZmluZWQ7XG4gICAgcmV0dXJuIHtcbiAgICAgICAgbWFuaWZlc3QsXG4gICAgICAgIHNpZ25hdHVyZSxcbiAgICAgICAgbWFuaWZlc3RIYXNoOiBtYW5pZmVzdCAmJiBjcnlwdG8uY3JlYXRlSGFzaChcInNoYTI1NlwiKS51cGRhdGUobWFuaWZlc3QpLmRpZ2VzdChcImhleFwiKSB8fCBcIlwiLFxuICAgICAgICBzaWduYXR1cmVIYXNoOiBzaWduYXR1cmUgJiYgY3J5cHRvLmNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKHNpZ25hdHVyZSkuZGlnZXN0KFwiaGV4XCIpIHx8IFwiXCIsXG4gICAgfTtcbn1cblxuLyoqIFdobyBzaWduZWQgdGhpcyBjaGVja291dC4gUmV0dXJucyBVTlNJR05FRCB3aGVuIHRoZXJlIGlzIG5vIHNpZ25hdHVyZSBhdCBhbGwsIGFuZCB0aHJvd3Mgd2hlblxuICAgIHRoZXJlIGlzIG9uZSB0aGF0IGRvZXMgbm90IGhvbGQgdXAgLSBhbiB1bnZlcmlmaWFibGUgc2lnbmF0dXJlIGlzIG5ldmVyIHRyZWF0ZWQgYXMgYW4gaWRlbnRpdHksXG4gICAgc28gaXQgY2FuIG5ldmVyIGJlY29tZSBzb21ldGhpbmcgd2UgYWNjZXB0LiAqL1xuYXN5bmMgZnVuY3Rpb24gdmVyaWZ5Q2hlY2tvdXRTaWduZXIoY29uZmlnOiB7XG4gICAgcmVwb1BhdGg6IHN0cmluZztcbiAgICBmaWxlczogeyBtYW5pZmVzdD86IEJ1ZmZlcjsgc2lnbmF0dXJlPzogQnVmZmVyIH07XG59KSB7XG4gICAgbGV0IHsgcmVwb1BhdGgsIGZpbGVzIH0gPSBjb25maWc7XG4gICAgaWYgKCFmaWxlcy5tYW5pZmVzdCAmJiAhZmlsZXMuc2lnbmF0dXJlKSB7XG4gICAgICAgIHJldHVybiBVTlNJR05FRDtcbiAgICB9XG4gICAgaWYgKCFmaWxlcy5tYW5pZmVzdCB8fCAhZmlsZXMuc2lnbmF0dXJlKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgRXhwZWN0ZWQgYm90aCAke01BTklGRVNUX05BTUV9IGFuZCAke1NJR05BVFVSRV9OQU1FfSwgb25seSBvbmUgaXMgcHJlc2VudGApO1xuICAgIH1cbiAgICBsZXQgcmVzdWx0ID0gYXdhaXQgc3Bhd25Qcm9taXNlKHtcbiAgICAgICAgY29tbWFuZDogXCJzc2gta2V5Z2VuXCIsXG4gICAgICAgIGFyZ3M6IFtcIi1ZXCIsIFwiY2hlY2stbm92YWxpZGF0ZVwiLCBcIi1uXCIsIFNJR05fTkFNRVNQQUNFLCBcIi1zXCIsIHBhdGguam9pbihyZXBvUGF0aCwgU0lHTkFUVVJFX05BTUUpXSxcbiAgICAgICAgLy8gVGhlIHNpZ25hdHVyZSBjb3ZlcnMgdGhlIG5vcm1hbGlzZWQgYnl0ZXMsIHNvIGEgY2hlY2tvdXQgdGhhdCBhcnJpdmVkIHdpdGggQ1JMRiBzdGlsbFxuICAgICAgICAvLyB2ZXJpZmllcyByYXRoZXIgdGhhbiBsb29raW5nIGxpa2UgdGFtcGVyaW5nLlxuICAgICAgICBpbnB1dDogbm9ybWFsaXplQ29udGVudChmaWxlcy5tYW5pZmVzdCkudG9TdHJpbmcoXCJ1dGY4XCIpLFxuICAgIH0pO1xuICAgIGlmIChyZXN1bHQuc3RhdHVzICE9PSAwKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAgIGB0aGUgc2lnbmF0dXJlIG92ZXIgJHtNQU5JRkVTVF9OQU1FfSBkb2VzIG5vdCB2ZXJpZnk6IGBcbiAgICAgICAgICAgICsgYCR7KHJlc3VsdC5zdGRvdXQgKyByZXN1bHQuc3RkZXJyKS50cmltKCkuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gXG4gICAgICAgICk7XG4gICAgfVxuICAgIGxldCByZXBvcnRlZCA9IGAke3Jlc3VsdC5zdGRvdXR9ICR7cmVzdWx0LnN0ZGVycn1gLm1hdGNoKC8oU0hBMjU2OltBLVphLXowLTkrLz1dKykvKTtcbiAgICBpZiAoIXJlcG9ydGVkKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgc3NoLWtleWdlbiByZXBvcnRlZCBubyBzaWduZXIgZmluZ2VycHJpbnQsIHNhaWQgJHtyZXN1bHQuc3Rkb3V0LnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YCk7XG4gICAgfVxuICAgIGxldCB7IHB1YmxpY0tleSwgZmluZ2VycHJpbnQgfSA9IHB1YmxpY0tleUZyb21TaWduYXR1cmUoZmlsZXMuc2lnbmF0dXJlLnRvU3RyaW5nKFwidXRmOFwiKSk7XG4gICAgLy8gVGhlIGtleSB3ZSByZWFkIG91dCBvZiB0aGUgc2lnbmF0dXJlIGhhcyB0byBiZSB0aGUgb25lIHNzaC1rZXlnZW4ganVzdCBjaGVja2VkIGFnYWluc3QsXG4gICAgLy8gb3RoZXJ3aXNlIHdlIHdvdWxkIGJlIHJlcG9ydGluZyBhbiBpZGVudGl0eSB0aGF0IGRpZCBub3Qgc2lnbiBhbnl0aGluZy5cbiAgICBpZiAoZmluZ2VycHJpbnQgIT09IHJlcG9ydGVkWzFdKSB7XG4gICAgICAgIHRocm93IG5ldyBFcnJvcihgdGhlIHNpZ25pbmcga2V5IHJlYWRzIGFzICR7ZmluZ2VycHJpbnR9IGJ1dCBzc2gta2V5Z2VuIHZlcmlmaWVkICR7cmVwb3J0ZWRbMV19YCk7XG4gICAgfVxuICAgIGF3YWl0IHZlcmlmeU1hbmlmZXN0TWF0Y2hlc0ZpbGVzKHJlcG9QYXRoKTtcbiAgICByZXR1cm4gcHVibGljS2V5O1xufVxuXG4vKiogUHJvdmVzIGEgY2hlY2tvdXQgb24gZGlzayB3YXMgc2lnbmVkLCBhbmQgdGhhdCB0aGUgZmlsZXMgaW4gaXQgYXJlIHRoZSBvbmVzIHRoYXQgd2VyZSBzaWduZWQuXG4gICAgUmV0dXJucyB0aGUgc2lnbmVyLCBhbmQgdGhyb3dzIGlmIGFueXRoaW5nIGFib3V0IHRoYXQgZG9lcyBub3QgaG9sZC5cblxuICAgIEFueXRoaW5nIHJlYWRpbmcgYSByZXBvIGZvciBzb21ldGhpbmcgb3RoZXIgdGhhbiBzc2gga2V5cyBnb2VzIHRocm91Z2ggdGhpcyBmaXJzdDogdGhlIHdob2xlXG4gICAgY2hlY2tvdXQgaXMgY292ZXJlZCBieSBvbmUgbWFuaWZlc3QsIHNvIGEgbWFjaGluZSBsaXN0IGlzIGV4YWN0bHkgYXMgdHJ1c3R3b3J0aHkgYXMgdGhlIGtleXNcbiAgICBiZXNpZGUgaXQsIGFuZCBuZWl0aGVyIGlzIHdvcnRoIHJlYWRpbmcgdW5zaWduZWQuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gdmVyaWZ5Q2hlY2tvdXQocmVwb1BhdGg6IHN0cmluZykge1xuICAgIHJldHVybiBhd2FpdCB2ZXJpZnlDaGVja291dFNpZ25lcih7IHJlcG9QYXRoLCBmaWxlczogYXdhaXQgcmVhZFNpZ25hdHVyZUZpbGVzKHJlcG9QYXRoKSB9KTtcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGRlc2NyaWJlU2lnbmVyKHNpZ25lcjogc3RyaW5nKSB7XG4gICAgcmV0dXJuIHNpZ25lciA9PT0gVU5TSUdORUQgJiYgXCI8bm8gcHVibGljIGtleT5cIiB8fCBzaWduZXI7XG59XG5cbi8qKiBSZXBvcnRzIGEgcHJvYmxlbSB3aXRoIGEgc291cmNlJ3Mgc2lnbmF0dXJlLCBidXQgb25seSB3aGVuIGl0IGlzIG5vdCB0aGUgc2FtZSBwcm9ibGVtIHdlXG4gICAgYWxyZWFkeSByZXBvcnRlZCwgc28gYSBmYXVsdCB0aGF0IHBlcnNpc3RzIGRvZXMgbm90IHJlcGVhdCBldmVyeSBjaGVjay4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlcG9ydFByb2JsZW0oY29uZmlnOiB7IHJlcG9VUkw6IHN0cmluZzsgcHJvYmxlbTogc3RyaW5nOyBoZWFkbGluZTogc3RyaW5nOyBib2R5OiBzdHJpbmcgfSkge1xuICAgIGxldCB7IHJlcG9VUkwsIHByb2JsZW0sIGhlYWRsaW5lLCBib2R5IH0gPSBjb25maWc7XG4gICAgbGV0IHNvdXJjZVN0YXRlVmFsdWUgPSBzb3VyY2VTdGF0ZShyZXBvVVJMKTtcbiAgICBpZiAoc291cmNlU3RhdGVWYWx1ZS5yZXBvcnRlZFByb2JsZW0gPT09IHByb2JsZW0pIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBzb3VyY2VTdGF0ZVZhbHVlLnJlcG9ydGVkUHJvYmxlbSA9IHByb2JsZW07XG4gICAgYXdhaXQgc2F2ZVN0YXRlKCk7XG4gICAgYXdhaXQgbm90aWZ5KGhlYWRsaW5lLCBib2R5KTtcbn1cblxuLyoqIFRoZSBrZXlzIGEgc291cmNlIGlzIGFsbG93ZWQgdG8gY29udHJpYnV0ZSByaWdodCBub3cuIEEgc291cmNlIHNpZ25lZCBieSBzb21lb25lIHdlIGhhdmUgbm90XG4gICAgYWNjZXB0ZWQga2VlcHMgY29udHJpYnV0aW5nIHRoZSBrZXlzIHdlIGxhc3QgYWNjZXB0ZWQsIHVudGlsIHRoZSBkZWxheSBoYXMgcGFzc2VkLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlc29sdmVTb3VyY2VLZXlzKHJlcG9VUkw6IHN0cmluZykge1xuICAgIGxldCBzb3VyY2VTdGF0ZVZhbHVlID0gc291cmNlU3RhdGUocmVwb1VSTCk7XG4gICAgbGV0IHJlcG9QYXRoID0gc291cmNlUmVwb1BhdGgocmVwb1VSTCk7XG4gICAgbGV0IGZpbGVzID0gYXdhaXQgcmVhZFNpZ25hdHVyZUZpbGVzKHJlcG9QYXRoKTtcblxuICAgIGxldCBzaWduZXI6IHN0cmluZztcbiAgICB0cnkge1xuICAgICAgICBzaWduZXIgPSBhd2FpdCB2ZXJpZnlDaGVja291dFNpZ25lcih7IHJlcG9QYXRoLCBmaWxlcyB9KTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIE5vdGhpbmcgaGVyZSBpcyB0cnVzdHdvcnRoeSwgc28gbm90aGluZyBoZXJlIGlzIHVzZWQuIFdoaWNoIG9mIHRoZSB0d28gcHJvYmxlbXMgaXQgaXNcbiAgICAgICAgLy8gZGVwZW5kcyBvbiB3aGV0aGVyIHRoZSBzaWduYXR1cmUgaXMgc2ltcGx5IHRoZSBvbmUgd2UgYWxyZWFkeSBhY2NlcHRlZC5cbiAgICAgICAgbGV0IHVuY2hhbmdlZCA9IGZpbGVzLm1hbmlmZXN0SGFzaCA9PT0gc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZE1hbmlmZXN0SGFzaFxuICAgICAgICAgICAgJiYgZmlsZXMuc2lnbmF0dXJlSGFzaCA9PT0gc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZFNpZ25hdHVyZUhhc2g7XG4gICAgICAgIGlmICh1bmNoYW5nZWQpIHtcbiAgICAgICAgICAgIGF3YWl0IHJlcG9ydFByb2JsZW0oe1xuICAgICAgICAgICAgICAgIHJlcG9VUkwsXG4gICAgICAgICAgICAgICAgcHJvYmxlbTogXCJzdGFsZVwiLFxuICAgICAgICAgICAgICAgIGhlYWRsaW5lOiBgS0VZIFJFUE8gQ0hBTkdFRCBXSVRIT1VUIEJFSU5HIFNJR05FRGAsXG4gICAgICAgICAgICAgICAgYm9keTogYFxcYCR7cmVwb1VSTH1cXGAgY2hhbmdlZCwgYnV0IG5vYm9keSBzaWduZWQgdGhlIGNoYW5nZSwgc28gaXQgaXMgYmVpbmcgaWdub3JlZGBcbiAgICAgICAgICAgICAgICAgICAgKyBgIGFuZCB0aGlzIG1hY2hpbmUgaXMgc3RpbGwgdXNpbmcgdGhlIGtleXMgc2lnbmVkIGJ5YFxuICAgICAgICAgICAgICAgICAgICArIGAgXFxgJHtkZXNjcmliZVNpZ25lcihzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyKX1cXGAuYFxuICAgICAgICAgICAgICAgICAgICArIGBcXG5cXG5UbyBtYWtlIHRoZSBjaGFuZ2UgdGFrZSBlZmZlY3QsIHJ1biB0aGlzIGluIHRoYXQgcmVwbzpgXG4gICAgICAgICAgICAgICAgICAgICsgYFxcblxcYFxcYFxcYFxcbiR7U0lHTl9DT01NQU5EfVxcblxcYFxcYFxcYGAsXG4gICAgICAgICAgICB9KTtcbiAgICAgICAgfSBlbHNlIHtcbiAgICAgICAgICAgIGF3YWl0IHJlcG9ydFByb2JsZW0oe1xuICAgICAgICAgICAgICAgIHJlcG9VUkwsXG4gICAgICAgICAgICAgICAgcHJvYmxlbTogXCJjb3JydXB0XCIsXG4gICAgICAgICAgICAgICAgaGVhZGxpbmU6IGBLRVkgUkVQTyBTSUdOQVRVUkUgSVMgQlJPS0VOYCxcbiAgICAgICAgICAgICAgICBib2R5OiBgVGhlIHNpZ25hdHVyZSBvbiBcXGAke3JlcG9VUkx9XFxgIGRvZXMgbm90IGNoZWNrIG91dCwgc28gZXZlcnl0aGluZyBpbiBpdCBpc2BcbiAgICAgICAgICAgICAgICAgICAgKyBgIGJlaW5nIGlnbm9yZWQgYW5kIHRoaXMgbWFjaGluZSBpcyBzdGlsbCB1c2luZyB0aGUga2V5cyBzaWduZWQgYnlgXG4gICAgICAgICAgICAgICAgICAgICsgYCBcXGAke2Rlc2NyaWJlU2lnbmVyKHNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWRTaWduZXIpfVxcYC5gXG4gICAgICAgICAgICAgICAgICAgICsgYFxcblxcbiR7ZX1gXG4gICAgICAgICAgICAgICAgICAgICsgYFxcblxcblRvIHJlcGxhY2UgdGhlIHNpZ25hdHVyZSwgcnVuIHRoaXMgaW4gdGhhdCByZXBvOmBcbiAgICAgICAgICAgICAgICAgICAgKyBgXFxuXFxgXFxgXFxgXFxuJHtTSUdOX0NPTU1BTkR9XFxuXFxgXFxgXFxgYCxcbiAgICAgICAgICAgIH0pO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkS2V5cztcbiAgICB9XG4gICAgaWYgKHNvdXJjZVN0YXRlVmFsdWUucmVwb3J0ZWRQcm9ibGVtKSB7XG4gICAgICAgIHNvdXJjZVN0YXRlVmFsdWUucmVwb3J0ZWRQcm9ibGVtID0gXCJcIjtcbiAgICAgICAgYXdhaXQgc2F2ZVN0YXRlKCk7XG4gICAgfVxuICAgIGxldCBjaGVja291dEtleXMgPSBhd2FpdCByZWFkQ2hlY2tvdXRLZXlzKHJlcG9QYXRoKTtcblxuICAgIGxldCBhY2NlcHQgPSBhc3luYyAoKSA9PiB7XG4gICAgICAgIHNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWQgPSB0cnVlO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyID0gc2lnbmVyO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkS2V5cyA9IGNoZWNrb3V0S2V5cztcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZE1hbmlmZXN0SGFzaCA9IGZpbGVzLm1hbmlmZXN0SGFzaDtcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZFNpZ25hdHVyZUhhc2ggPSBmaWxlcy5zaWduYXR1cmVIYXNoO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLnBlbmRpbmdTaWduZXIgPSBVTlNJR05FRDtcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2luY2UgPSAwO1xuICAgICAgICBhd2FpdCBzYXZlU3RhdGUoKTtcbiAgICAgICAgcmV0dXJuIGNoZWNrb3V0S2V5cztcbiAgICB9O1xuXG4gICAgLy8gTm90aGluZyBoYXMgZXZlciBiZWVuIGFjY2VwdGVkIGZyb20gdGhpcyBzb3VyY2UsIHNvIHRoaXMgaXMgd2hhdCB3ZSBzdGFydCB0cnVzdGluZy5cbiAgICBpZiAoIXNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWQpIHtcbiAgICAgICAgY29uc29sZS5sb2coYFRydXN0aW5nICR7cmVwb1VSTH0gYXMgc2lnbmVkIGJ5ICR7ZGVzY3JpYmVTaWduZXIoc2lnbmVyKX1gKTtcbiAgICAgICAgcmV0dXJuIGF3YWl0IGFjY2VwdCgpO1xuICAgIH1cblxuICAgIGlmIChzaWduZXIgPT09IHNvdXJjZVN0YXRlVmFsdWUuYWNjZXB0ZWRTaWduZXIpIHtcbiAgICAgICAgLy8gQmFjayB0byB0aGUgc2lnbmVyIHdlIGFscmVhZHkgdHJ1c3QsIHNvIGFueXRoaW5nIHdlIHdlcmUgd2FpdGluZyBvbiBpcyBtb290LlxuICAgICAgICBpZiAoc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2luY2UpIHtcbiAgICAgICAgICAgIGNvbnNvbGUubG9nKGAke3JlcG9VUkx9IGlzIHNpZ25lZCBieSBpdHMgYWNjZXB0ZWQga2V5IGFnYWluLCBkcm9wcGluZyB0aGUgcGVuZGluZyBjaGFuZ2VgKTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gYXdhaXQgYWNjZXB0KCk7XG4gICAgfVxuXG4gICAgLy8gR29pbmcgZnJvbSBub3RoaW5nIHRvIHNvbWV0aGluZyBzaWduZWQgaXMgb25seSBldmVyIGFuIGltcHJvdmVtZW50LCBzbyBpdCBkb2VzIG5vdCB3YWl0LlxuICAgIGlmIChzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyID09PSBVTlNJR05FRCkge1xuICAgICAgICBhd2FpdCBub3RpZnkoYEtFWSBSRVBPIElTIE5PVyBTSUdORURgLFxuICAgICAgICAgICAgYFxcYCR7cmVwb1VSTH1cXGAgd2FzIG5vdCBzaWduZWQgYXQgYWxsIGJlZm9yZSwgc28gdGhpcyBpcyBhbiBpbXByb3ZlbWVudCBhbmQgaXRzIGtleXNgXG4gICAgICAgICAgICArIGAgYXJlIGJlaW5nIGFwcGxpZWQgcmlnaHQgYXdheS5gXG4gICAgICAgICAgICArIGBcXG5cXG5zaWduZWQgYnk6IFxcYCR7c2lnbmVyfVxcYGBcbiAgICAgICAgKTtcbiAgICAgICAgcmV0dXJuIGF3YWl0IGFjY2VwdCgpO1xuICAgIH1cblxuICAgIC8vIEEgc2lnbmVyIHdlIGhhdmUgbm90IGFjY2VwdGVkLiBBbnl0aGluZyBuZXcgcmVzdGFydHMgdGhlIHdhaXQsIHNvIHB1Ymxpc2hpbmcgdHdpY2UgaW4gYSByb3dcbiAgICAvLyBnYWlucyBhbiBhdHRhY2tlciBub3RoaW5nLiBwZW5kaW5nU2luY2UgaXMgd2hhdCBtYXJrcyBhIHdhaXQgYXMgcnVubmluZywgYmVjYXVzZSBhbiB1bnNpZ25lZFxuICAgIC8vIGNoZWNrb3V0IGlzIGl0c2VsZiBhIHNpZ25lciB2YWx1ZSBhbmQgY2Fubm90IGRvdWJsZSBhcyBcIm5vdGhpbmcgcGVuZGluZ1wiLlxuICAgIGlmICghc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2luY2UgfHwgc2lnbmVyICE9PSBzb3VyY2VTdGF0ZVZhbHVlLnBlbmRpbmdTaWduZXIpIHtcbiAgICAgICAgc291cmNlU3RhdGVWYWx1ZS5wZW5kaW5nU2lnbmVyID0gc2lnbmVyO1xuICAgICAgICBzb3VyY2VTdGF0ZVZhbHVlLnBlbmRpbmdTaW5jZSA9IERhdGUubm93KCk7XG4gICAgICAgIGF3YWl0IHNhdmVTdGF0ZSgpO1xuICAgICAgICBhd2FpdCBub3RpZnkoYEtFWSBSRVBPIFNJR05FRCBCWSBBIERJRkZFUkVOVCBLRVlgLFxuICAgICAgICAgICAgYFNvbWVib2R5IGVsc2UgaXMgc2lnbmluZyBcXGAke3JlcG9VUkx9XFxgIG5vdy4gSXRzIGtleXMgYXJlIE5PVCBiZWluZyBhcHBsaWVkLCBhbmQgdGhpc2BcbiAgICAgICAgICAgICsgYCBtYWNoaW5lIGlzIHN0aWxsIHVzaW5nIHRoZSBvbmVzIGl0IGFscmVhZHkgaGFkLiBJZiBub3RoaW5nIGNoYW5nZXMsIHRoZSBuZXcgc2lnbmVyYFxuICAgICAgICAgICAgKyBgIGlzIGFjY2VwdGVkIGluIDI0IGhvdXJzLmBcbiAgICAgICAgICAgICsgYFxcblxcbklmIHRoYXQgd2FzIG5vdCB5b3UsIGZpeCB0aGUgcmVwbyBiZWZvcmUgdGhlIDI0IGhvdXJzIGFyZSB1cC5gXG4gICAgICAgICAgICArIGBcXG5cXG5zaWduZWQgYnkgbm93OiBcXGAke2Rlc2NyaWJlU2lnbmVyKHNpZ25lcil9XFxgYFxuICAgICAgICAgICAgKyBgXFxuc2lnbmVkIGJ5IGJlZm9yZTogXFxgJHtkZXNjcmliZVNpZ25lcihzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkU2lnbmVyKX1cXGBgXG4gICAgICAgICk7XG4gICAgICAgIHJldHVybiBzb3VyY2VTdGF0ZVZhbHVlLmFjY2VwdGVkS2V5cztcbiAgICB9XG5cbiAgICBpZiAoRGF0ZS5ub3coKSAtIHNvdXJjZVN0YXRlVmFsdWUucGVuZGluZ1NpbmNlIDwgU0lHTkVSX0NIQU5HRV9ERUxBWSkge1xuICAgICAgICByZXR1cm4gc291cmNlU3RhdGVWYWx1ZS5hY2NlcHRlZEtleXM7XG4gICAgfVxuXG4gICAgLy8gU2FtZSBuZXcgc2lnbmVyLCAyNCBob3VycyBsYXRlciwgYW5kIG5vYm9keSBzdG9wcGVkIGl0LlxuICAgIGNvbnNvbGUubG9nKGBBY2NlcHRpbmcgJHtkZXNjcmliZVNpZ25lcihzaWduZXIpfSBmb3IgJHtyZXBvVVJMfSBhZnRlciB0aGUgJHtTSUdORVJfQ0hBTkdFX0RFTEFZfW1zIHdhaXRgKTtcbiAgICByZXR1cm4gYXdhaXQgYWNjZXB0KCk7XG59XG4iXX0=
- /* _JS_SOURCE_HASH = "2791d2b7398a863c4757a111c3f83e155ece380b6fa541c5bb7384f2c2829041"; */
+exports.readSignedRepo = readSignedRepo;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJ1c3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ0cnVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxvREFBNEI7QUFDNUIsMkRBQTZCO0FBQzdCLGdEQUF3QjtBQUN4Qix5REFBNkc7QUFDN0cscURBQXdEO0FBRXhELGlHQUFpRztBQUNqRyxtREFBbUQ7QUFDdEMsUUFBQSxRQUFRLEdBQUcsRUFBRSxDQUFDO0FBQzNCLDZGQUE2RjtBQUM3RixrQ0FBa0M7QUFDbEMsTUFBTSxZQUFZLEdBQUcsb0JBQW9CLENBQUM7QUFFMUM7O2lEQUVpRDtBQUNqRCxNQUFhLGVBQWdCLFNBQVEsS0FBSztJQUN0QyxZQUFtQixPQUFlLEVBQVMsUUFBZ0IsRUFBUyxJQUFZO1FBQzVFLEtBQUssQ0FBQyxHQUFHLFFBQVEsS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBRGYsWUFBTyxHQUFQLE9BQU8sQ0FBUTtRQUFTLGFBQVEsR0FBUixRQUFRLENBQVE7UUFBUyxTQUFJLEdBQUosSUFBSSxDQUFRO0lBRWhGLENBQUM7Q0FDSjtBQUpELDBDQUlDO0FBRUQ7Ozs7Ozs7d0VBT3dFO0FBQ2pFLEtBQUssVUFBVSxjQUFjLENBQUMsUUFBZ0I7SUFNakQsSUFBSSxhQUFhLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSx3QkFBYSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakcsSUFBSSxjQUFjLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSx5QkFBYyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkcsSUFBSSxZQUFZLEdBQUcsYUFBYSxJQUFJLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzFHLElBQUksYUFBYSxHQUFHLGNBQWMsSUFBSSxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUU3RyxJQUFJLENBQUMsYUFBYSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDcEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLFFBQVEsMkNBQTJDLENBQUMsQ0FBQztRQUNwRSxPQUFPLEVBQUUsTUFBTSxFQUFFLGdCQUFRLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUsSUFBSSxHQUFHLEVBQUUsRUFBRSxDQUFDO0lBQy9FLENBQUM7SUFFRCxJQUFJLE1BQU0sR0FBRyxDQUFDLE1BQWMsRUFBRSxFQUFFLENBQUMsSUFBSSxlQUFlLENBQ2hELFNBQVMsRUFDVCw4QkFBOEIsRUFDOUIsb0JBQW9CLFFBQVEsK0RBQStEO1VBQ3pGLHVEQUF1RCxNQUFNLEVBQUU7VUFDL0QsNERBQTRELFlBQVksVUFBVSxDQUN2RixDQUFDO0lBQ0YsSUFBSSxDQUFDLGFBQWEsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sTUFBTSxDQUFDLGVBQWUsd0JBQWEsUUFBUSx5QkFBYyxjQUFjLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBRUQsSUFBSSxNQUFjLENBQUM7SUFDbkIsSUFBSSxDQUFDO1FBQ0Qsd0ZBQXdGO1FBQ3hGLCtDQUErQztRQUMvQyxNQUFNLEdBQUcsSUFBQSxxQkFBWSxFQUFDO1lBQ2xCLFNBQVMsRUFBRSxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztZQUMxQyxPQUFPLEVBQUUsSUFBQSwyQkFBZ0IsRUFBQyxhQUFhLENBQUM7WUFDeEMsU0FBUyxFQUFFLHlCQUFjO1NBQzVCLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDakIsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxNQUFNLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDekIsQ0FBQztJQUVELElBQUksS0FBSyxHQUFHLENBQUMsTUFBYyxFQUFFLEVBQUUsQ0FBQyxJQUFJLGVBQWUsQ0FDL0MsT0FBTyxFQUNQLHVDQUF1QyxFQUN2QyxHQUFHLE1BQU0sb0ZBQW9GO1VBQzNGLGtFQUFrRSxZQUFZLFVBQVUsQ0FDN0YsQ0FBQztJQUVGLCtGQUErRjtJQUMvRix1QkFBdUI7SUFDdkIsSUFBSSxpQkFBaUIsR0FBRyxLQUFLLEVBQUUsTUFBZSxFQUFxQixFQUFFO1FBQ2pFLElBQUksS0FBSyxHQUFhLEVBQUUsQ0FBQztRQUN6QixLQUFLLElBQUksS0FBSyxJQUFJLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxJQUFJLEVBQUUsQ0FBQyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQztZQUM3RixJQUFJLFlBQVksR0FBRyxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUM7WUFDckUsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLE1BQU07Z0JBQUUsU0FBUztZQUNwQyxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyx3QkFBYSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUsseUJBQWMsQ0FBQztnQkFBRSxTQUFTO1lBQ3pGLElBQUksS0FBSyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7Z0JBQ3RCLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7Z0JBQ3JELFNBQVM7WUFDYixDQUFDO1lBQ0QsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUM3QixDQUFDO1FBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDeEIsQ0FBQyxDQUFDO0lBRUYsSUFBSSxRQUFRLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDMUQsSUFBSSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQ2hCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFvRCxFQUFFLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FDMUcsQ0FBQztJQUVGLElBQUksS0FBSyxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO0lBQ3RDLEtBQUssSUFBSSxRQUFRLElBQUksTUFBTSxpQkFBaUIsRUFBRSxFQUFFLENBQUM7UUFDN0MsSUFBSSxRQUFRLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNwQyx3RkFBd0Y7UUFDeEYsMEZBQTBGO1FBQzFGLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNaLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWSxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsb0NBQW9DLENBQUMsQ0FBQztZQUMzRixTQUFTO1FBQ2IsQ0FBQztRQUNELElBQUksUUFBUSxHQUFHLElBQUEsMkJBQWdCLEVBQUMsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEYsSUFBSSxJQUFJLEdBQUcsZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN0RSx1RkFBdUY7UUFDdkYsbUZBQW1GO1FBQ25GLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsSUFBSSxJQUFJLElBQUksS0FBSyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDaEUsTUFBTSxLQUFLLENBQUMsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsa0NBQWtDLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUNELEtBQUssSUFBSSxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7UUFDakMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLEtBQUssQ0FBQyxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO1FBQzlFLENBQUM7SUFDTCxDQUFDO0lBRUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLEtBQUssRUFBRSxDQUFDO0FBQzFELENBQUM7QUE5RkQsd0NBOEZDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGNyeXB0byBmcm9tIFwiY3J5cHRvXCI7XG5pbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuaW1wb3J0IHsgTUFOSUZFU1RfTkFNRSwgbm9ybWFsaXplQ29udGVudCwgU0lHTl9OQU1FU1BBQ0UsIFNJR05BVFVSRV9OQU1FIH0gZnJvbSBcIi4uLy4uL3NpZ25lZEZpbGVzL21hbmlmZXN0XCI7XG5pbXBvcnQgeyB2ZXJpZnlTU0hTSUcgfSBmcm9tIFwiLi4vLi4vc2lnbmVkRmlsZXMvc3Noc2lnXCI7XG5cbi8vIEEgc291cmNlIHRoYXQgaGFzIG5ldmVyIGJlZW4gc2lnbmVkIHJlYWRzIGFzIHRoaXMsIHNvIGxvc2luZyBhIHNpZ25hdHVyZSBjb3VudHMgYXMgYSBjaGFuZ2Ugb2Zcbi8vIHNpZ25lciByYXRoZXIgdGhhbiBhcyBzb21ldGhpbmcgdG8gd2F2ZSB0aHJvdWdoLlxuZXhwb3J0IGNvbnN0IFVOU0lHTkVEID0gXCJcIjtcbi8vIFdoYXQgZml4ZXMgYm90aCBvZiB0aGUgc2lnbmF0dXJlIHByb2JsZW1zIHdlIHJlcG9ydCwgc28gdGhlIG1lc3NhZ2UgY2FuIHNheSBzbyByYXRoZXIgdGhhblxuLy8gbGVhdmluZyBzb21lb25lIHRvIHdvcmsgaXQgb3V0LlxuY29uc3QgU0lHTl9DT01NQU5EID0gXCJ5YXJuIHNpZ25maWxlcyBnaXRcIjtcblxuLyoqIEEgcmVwbyB0aGF0IGNhbm5vdCBiZSB0cnVzdGVkLCB3aXRoIHRoZSBtZXNzYWdlIHJlYWR5IGZvciB3aG9ldmVyIGFza2VkLiBOb3QgZXZlcnkgY2FsbGVyXG4gICAgdHJlYXRzIHRoZXNlIHRoZSBzYW1lIC0gYSBzb3VyY2Uga2VlcHMgaXRzIGxhc3Qga2V5cywgYSBtYWNoaW5lIGxpc3QgaXMganVzdCByZWZ1c2VkIC0gc28gdGhlXG4gICAga2luZCBpcyBjYXJyaWVkIHJhdGhlciB0aGFuIGFjdGVkIG9uIGhlcmUuICovXG5leHBvcnQgY2xhc3MgU2lnbmVkUmVwb0Vycm9yIGV4dGVuZHMgRXJyb3Ige1xuICAgIGNvbnN0cnVjdG9yKHB1YmxpYyBwcm9ibGVtOiBzdHJpbmcsIHB1YmxpYyBoZWFkbGluZTogc3RyaW5nLCBwdWJsaWMgYm9keTogc3RyaW5nKSB7XG4gICAgICAgIHN1cGVyKGAke2hlYWRsaW5lfS4gJHtib2R5fWApO1xuICAgIH1cbn1cblxuLyoqIEV2ZXJ5dGhpbmcgYSBzaWduZWQgY2hlY2tvdXQgdm91Y2hlcyBmb3IsIGluIG9uZSBjYWxsOiB3aG8gc2lnbmVkIGl0LCBhbmQgdGhlIGNvbnRlbnRzIG9mIGV2ZXJ5XG4gICAgZmlsZSB0aGUgc2lnbmF0dXJlIGFjdHVhbGx5IGNvdmVycy5cblxuICAgIFVOU0lHTkVEIHdpdGggbm8gZmlsZXMgd2hlbiB0aGVyZSBpcyBubyBzaWduYXR1cmUgYXQgYWxsLiBUaHJvd3MgYSBTaWduZWRSZXBvRXJyb3Igd2hlbiBhXG4gICAgc2lnbmF0dXJlIGlzIHByZXNlbnQgYnV0IGRvZXMgbm90IGhvbGQgdXAsIG9yIHdoZW4gYSBmaWxlIGl0IHNpZ25lZCBmb3Igd2FzIGNoYW5nZWQgb3IgcmVtb3ZlZFxuICAgIHdpdGhvdXQgcmUtc2lnbmluZyAtIGVpdGhlciB3YXkgdGhlIGNhbGxlciBrZWVwcyB3aGF0ZXZlciBpdCBsYXN0IGFjY2VwdGVkIHJhdGhlciB0aGFuIGJlbGlldmluZ1xuICAgIGEgcmVwbyB0aGF0IG5vIGxvbmdlciBtYXRjaGVzIHdoYXQgd2FzIHNpZ25lZC4gQSBmaWxlIG5vdCBpbiB0aGUgbWFuaWZlc3QgaXMganVzdCB1bnNpZ25lZCwgc29cbiAgICBpdCBpcyBsZWZ0IG91dCBhbmQgd2FybmVkIGFib3V0IHJhdGhlciB0aGFuIHRyZWF0ZWQgYXMgdGFtcGVyaW5nLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHJlYWRTaWduZWRSZXBvKHJlcG9QYXRoOiBzdHJpbmcpOiBQcm9taXNlPHtcbiAgICBzaWduZXI6IHN0cmluZztcbiAgICBtYW5pZmVzdEhhc2g6IHN0cmluZztcbiAgICBzaWduYXR1cmVIYXNoOiBzdHJpbmc7XG4gICAgZmlsZXM6IE1hcDxzdHJpbmcsIEJ1ZmZlcj47XG59PiB7XG4gICAgbGV0IG1hbmlmZXN0Qnl0ZXMgPSBhd2FpdCBmcy5yZWFkRmlsZShwYXRoLmpvaW4ocmVwb1BhdGgsIE1BTklGRVNUX05BTUUpKS5jYXRjaCgoKSA9PiB1bmRlZmluZWQpO1xuICAgIGxldCBzaWduYXR1cmVCeXRlcyA9IGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgU0lHTkFUVVJFX05BTUUpKS5jYXRjaCgoKSA9PiB1bmRlZmluZWQpO1xuICAgIGxldCBtYW5pZmVzdEhhc2ggPSBtYW5pZmVzdEJ5dGVzICYmIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShtYW5pZmVzdEJ5dGVzKS5kaWdlc3QoXCJoZXhcIikgfHwgXCJcIjtcbiAgICBsZXQgc2lnbmF0dXJlSGFzaCA9IHNpZ25hdHVyZUJ5dGVzICYmIGNyeXB0by5jcmVhdGVIYXNoKFwic2hhMjU2XCIpLnVwZGF0ZShzaWduYXR1cmVCeXRlcykuZGlnZXN0KFwiaGV4XCIpIHx8IFwiXCI7XG5cbiAgICBpZiAoIW1hbmlmZXN0Qnl0ZXMgJiYgIXNpZ25hdHVyZUJ5dGVzKSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGAke3JlcG9QYXRofSBpcyBub3Qgc2lnbmVkLCBpZ25vcmluZyBhbGwgb2YgaXRzIGZpbGVzYCk7XG4gICAgICAgIHJldHVybiB7IHNpZ25lcjogVU5TSUdORUQsIG1hbmlmZXN0SGFzaCwgc2lnbmF0dXJlSGFzaCwgZmlsZXM6IG5ldyBNYXAoKSB9O1xuICAgIH1cblxuICAgIGxldCBicm9rZW4gPSAoZGV0YWlsOiBzdHJpbmcpID0+IG5ldyBTaWduZWRSZXBvRXJyb3IoXG4gICAgICAgIFwiY29ycnVwdFwiLFxuICAgICAgICBgS0VZIFJFUE8gU0lHTkFUVVJFIElTIEJST0tFTmAsXG4gICAgICAgIGBUaGUgc2lnbmF0dXJlIG9uICR7cmVwb1BhdGh9IGRvZXMgbm90IGNoZWNrIG91dCwgc28gZXZlcnl0aGluZyBpbiBpdCBpcyBiZWluZyBpZ25vcmVkIGFuZGBcbiAgICAgICAgKyBgIHRoaXMgbWFjaGluZSBrZWVwcyB1c2luZyB3aGF0IGl0IGxhc3QgYWNjZXB0ZWQuXFxuXFxuJHtkZXRhaWx9YFxuICAgICAgICArIGBcXG5cXG5UbyByZXBsYWNlIHRoZSBzaWduYXR1cmUsIHJ1biBpbiB0aGF0IHJlcG86XFxuXFxgXFxgXFxgXFxuJHtTSUdOX0NPTU1BTkR9XFxuXFxgXFxgXFxgYFxuICAgICk7XG4gICAgaWYgKCFtYW5pZmVzdEJ5dGVzIHx8ICFzaWduYXR1cmVCeXRlcykge1xuICAgICAgICB0aHJvdyBicm9rZW4oYE9ubHkgb25lIG9mICR7TUFOSUZFU1RfTkFNRX0gYW5kICR7U0lHTkFUVVJFX05BTUV9IGlzIHByZXNlbnQuYCk7XG4gICAgfVxuXG4gICAgbGV0IHNpZ25lcjogc3RyaW5nO1xuICAgIHRyeSB7XG4gICAgICAgIC8vIFRoZSBzaWduYXR1cmUgY292ZXJzIHRoZSBub3JtYWxpc2VkIGJ5dGVzLCBzbyBhIGNoZWNrb3V0IHRoYXQgYXJyaXZlZCB3aXRoIENSTEYgc3RpbGxcbiAgICAgICAgLy8gdmVyaWZpZXMgcmF0aGVyIHRoYW4gbG9va2luZyBsaWtlIHRhbXBlcmluZy5cbiAgICAgICAgc2lnbmVyID0gdmVyaWZ5U1NIU0lHKHtcbiAgICAgICAgICAgIHNpZ25hdHVyZTogc2lnbmF0dXJlQnl0ZXMudG9TdHJpbmcoXCJ1dGY4XCIpLFxuICAgICAgICAgICAgbWVzc2FnZTogbm9ybWFsaXplQ29udGVudChtYW5pZmVzdEJ5dGVzKSxcbiAgICAgICAgICAgIG5hbWVzcGFjZTogU0lHTl9OQU1FU1BBQ0UsXG4gICAgICAgIH0pLnB1YmxpY0tleTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIHRocm93IGJyb2tlbihgJHtlfWApO1xuICAgIH1cblxuICAgIGxldCBzdGFsZSA9IChkZXRhaWw6IHN0cmluZykgPT4gbmV3IFNpZ25lZFJlcG9FcnJvcihcbiAgICAgICAgXCJzdGFsZVwiLFxuICAgICAgICBgS0VZIFJFUE8gQ0hBTkdFRCBXSVRIT1VUIEJFSU5HIFNJR05FRGAsXG4gICAgICAgIGAke2RldGFpbH0sIHNvIHRoZSByZXBvIGlzIGJlaW5nIGlnbm9yZWQgYW5kIHRoaXMgbWFjaGluZSBrZWVwcyB1c2luZyB3aGF0IGl0IGxhc3QgYWNjZXB0ZWQuYFxuICAgICAgICArIGBcXG5cXG5UbyBtYWtlIHRoZSBjaGFuZ2UgdGFrZSBlZmZlY3QsIHJ1biBpbiB0aGF0IHJlcG86XFxuXFxgXFxgXFxgXFxuJHtTSUdOX0NPTU1BTkR9XFxuXFxgXFxgXFxgYFxuICAgICk7XG5cbiAgICAvLyBFdmVyeSBmaWxlIG9uIGRpc2ssIG90aGVyIHRoYW4gZ2l0J3Mgb3duIGRpcmVjdG9yeSBhbmQgdGhlIHR3byBzaWduYXR1cmUgZmlsZXMsIHdoaWNoIGNhbm5vdFxuICAgIC8vIGRlc2NyaWJlIHRoZW1zZWx2ZXMuXG4gICAgbGV0IGxpc3RDaGVja291dEZpbGVzID0gYXN5bmMgKHByZWZpeD86IHN0cmluZyk6IFByb21pc2U8c3RyaW5nW10+ID0+IHtcbiAgICAgICAgbGV0IGZvdW5kOiBzdHJpbmdbXSA9IFtdO1xuICAgICAgICBmb3IgKGxldCBlbnRyeSBvZiBhd2FpdCBmcy5yZWFkZGlyKHBhdGguam9pbihyZXBvUGF0aCwgcHJlZml4IHx8IFwiXCIpLCB7IHdpdGhGaWxlVHlwZXM6IHRydWUgfSkpIHtcbiAgICAgICAgICAgIGxldCByZWxhdGl2ZVBhdGggPSBwcmVmaXggJiYgYCR7cHJlZml4fS8ke2VudHJ5Lm5hbWV9YCB8fCBlbnRyeS5uYW1lO1xuICAgICAgICAgICAgaWYgKGVudHJ5Lm5hbWUgPT09IFwiLmdpdFwiKSBjb250aW51ZTtcbiAgICAgICAgICAgIGlmICghcHJlZml4ICYmIChlbnRyeS5uYW1lID09PSBNQU5JRkVTVF9OQU1FIHx8IGVudHJ5Lm5hbWUgPT09IFNJR05BVFVSRV9OQU1FKSkgY29udGludWU7XG4gICAgICAgICAgICBpZiAoZW50cnkuaXNEaXJlY3RvcnkoKSkge1xuICAgICAgICAgICAgICAgIGZvdW5kLnB1c2goLi4uYXdhaXQgbGlzdENoZWNrb3V0RmlsZXMocmVsYXRpdmVQYXRoKSk7XG4gICAgICAgICAgICAgICAgY29udGludWU7XG4gICAgICAgICAgICB9XG4gICAgICAgICAgICBmb3VuZC5wdXNoKHJlbGF0aXZlUGF0aCk7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIGZvdW5kLnNvcnQoKTtcbiAgICB9O1xuXG4gICAgbGV0IG1hbmlmZXN0ID0gSlNPTi5wYXJzZShtYW5pZmVzdEJ5dGVzLnRvU3RyaW5nKFwidXRmOFwiKSk7XG4gICAgbGV0IGxpc3RlZCA9IG5ldyBNYXA8c3RyaW5nLCB7IHNpemU6IG51bWJlcjsgc2hhMjU2OiBzdHJpbmcgfT4oXG4gICAgICAgIChtYW5pZmVzdC5maWxlcyB8fCBbXSkubWFwKChmaWxlOiB7IHBhdGg6IHN0cmluZzsgc2l6ZTogbnVtYmVyOyBzaGEyNTY6IHN0cmluZyB9KSA9PiBbZmlsZS5wYXRoLCBmaWxlXSlcbiAgICApO1xuXG4gICAgbGV0IGZpbGVzID0gbmV3IE1hcDxzdHJpbmcsIEJ1ZmZlcj4oKTtcbiAgICBmb3IgKGxldCBmaWxlUGF0aCBvZiBhd2FpdCBsaXN0Q2hlY2tvdXRGaWxlcygpKSB7XG4gICAgICAgIGxldCBleHBlY3RlZCA9IGxpc3RlZC5nZXQoZmlsZVBhdGgpO1xuICAgICAgICAvLyBBIGZpbGUgdGhlIHNpZ25hdHVyZSBuZXZlciBtZW50aW9uZWQgaXMgbm90IHRhbXBlcmluZywgaXQgaXMganVzdCB1bnNpZ25lZCAtIGxlZnQgb3V0XG4gICAgICAgIC8vIHJhdGhlciB0aGFuIHRydXN0ZWQuIEFuIGV4dHJhIGZpbGUgaW4gYSB3b3JraW5nIHRyZWUgaXMgb3JkaW5hcnksIHNvIGl0IGlzIG9ubHkgYSBub3RlLlxuICAgICAgICBpZiAoIWV4cGVjdGVkKSB7XG4gICAgICAgICAgICBjb25zb2xlLmxvZyhgSWdub3JpbmcgJHtwYXRoLmpvaW4ocmVwb1BhdGgsIGZpbGVQYXRoKX0sIGl0IGlzIG5vdCBpbiB0aGUgc2lnbmVkIG1hbmlmZXN0YCk7XG4gICAgICAgICAgICBjb250aW51ZTtcbiAgICAgICAgfVxuICAgICAgICBsZXQgY29udGVudHMgPSBub3JtYWxpemVDb250ZW50KGF3YWl0IGZzLnJlYWRGaWxlKHBhdGguam9pbihyZXBvUGF0aCwgZmlsZVBhdGgpKSk7XG4gICAgICAgIGxldCBoYXNoID0gY3J5cHRvLmNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKGNvbnRlbnRzKS5kaWdlc3QoXCJoZXhcIik7XG4gICAgICAgIC8vIEEgZmlsZSB0aGUgbWFuaWZlc3QgRE9FUyBuYW1lLCBidXQgd2hvc2UgY29udGVudCBubyBsb25nZXIgbWF0Y2hlcywgaXMgYSBzaWduZWQgZmlsZVxuICAgICAgICAvLyBjaGFuZ2VkIHdpdGhvdXQgcmUtc2lnbmluZyAtIHRoZSByZXBvIGJlaW5nIGVkaXRlZCBvdXQgZnJvbSB1bmRlciBpdHMgc2lnbmF0dXJlLlxuICAgICAgICBpZiAoY29udGVudHMubGVuZ3RoICE9PSBleHBlY3RlZC5zaXplIHx8IGhhc2ggIT09IGV4cGVjdGVkLnNoYTI1Nikge1xuICAgICAgICAgICAgdGhyb3cgc3RhbGUoYCR7cGF0aC5qb2luKHJlcG9QYXRoLCBmaWxlUGF0aCl9IHdhcyBjaGFuZ2VkIGFmdGVyIGl0IHdhcyBzaWduZWRgKTtcbiAgICAgICAgfVxuICAgICAgICBmaWxlcy5zZXQoZmlsZVBhdGgsIGNvbnRlbnRzKTtcbiAgICB9XG4gICAgZm9yIChsZXQgZmlsZVBhdGggb2YgbGlzdGVkLmtleXMoKSkge1xuICAgICAgICBpZiAoIWZpbGVzLmhhcyhmaWxlUGF0aCkpIHtcbiAgICAgICAgICAgIHRocm93IHN0YWxlKGAke3BhdGguam9pbihyZXBvUGF0aCwgZmlsZVBhdGgpfSBpcyBzaWduZWQgZm9yIGJ1dCBtaXNzaW5nYCk7XG4gICAgICAgIH1cbiAgICB9XG5cbiAgICByZXR1cm4geyBzaWduZXIsIG1hbmlmZXN0SGFzaCwgc2lnbmF0dXJlSGFzaCwgZmlsZXMgfTtcbn1cbiJdfQ==
+ /* _JS_SOURCE_HASH = "7efe11ad80e1fd0da4255a229551a7973443a58b48163d836cf32e330cced446"; */

package/security/authorizedKeys/daemon/git.d.ts

@@ -25,6 +25,14 @@ export declare function currentBranch(config: {
     repoPath: string;
     keyPath: string;
 }): Promise<string>;
+/** Forces a checkout's working tree to a ref. Anything local - an edited file, or a stray untracked
+    one - is staged and stashed rather than deleted, so the tree comes out clean but nothing is lost
+    for good: it sits in a stash if it is ever wanted. */
+export declare function setGitRef(config: {
+    repoPath: string;
+    gitRef: string;
+    keyPath: string;
+}): Promise<void>;
 /** Returns what changed, so the caller can report it. A rewritten history is called out
     separately - it means the remote no longer contains the commits we already had. */
 export declare function syncRepo(repoURL: string): Promise<{

package/security/authorizedKeys/daemon/git.ts

@@ -66,6 +66,25 @@ export async function currentBranch(config: { repoPath: string; keyPath: string
     return (await runGit({ args: ["rev-parse", "--abbrev-ref", "HEAD"], ...config })).stdout.trim();
 }
 
+/** Forces a checkout's working tree to a ref. Anything local - an edited file, or a stray untracked
+    one - is staged and stashed rather than deleted, so the tree comes out clean but nothing is lost
+    for good: it sits in a stash if it is ever wanted. */
+export async function setGitRef(config: { repoPath: string; gitRef: string; keyPath: string }) {
+    let { repoPath, gitRef, keyPath } = config;
+    // Staging the untracked files first is what lets the stash carry them off, so the reset lands
+    // on a genuinely clean tree.
+    await runGit({ args: ["add", "--all"], cwd: repoPath, keyPath, allowFailure: true });
+    // A checkout with nothing to stash makes git stash exit non-zero, which is harmless here - the
+    // reset below is what actually forces the tree.
+    await runGit({ args: ["stash"], cwd: repoPath, keyPath, allowFailure: true });
+    await runGit({ args: ["fetch", "--prune", "origin"], cwd: repoPath, keyPath });
+    await runGit({ args: ["reset", "--hard", gitRef], cwd: repoPath, keyPath });
+    // Drops objects nothing references any more, so a file committed by mistake cannot bloat the
+    // checkout forever. Reflogs keep the just-replaced commit reachable, so a history rewrite is
+    // still detectable right after this.
+    await runGit({ args: ["prune"], cwd: repoPath, keyPath, allowFailure: true });
+}
+
 async function ensureSourceRepo(repoURL: string) {
     let repoPath = sourceRepoPath(repoURL);
     let keyPath = await findSourceKey(repoURL) || sourceKeyPath(repoURL);
@@ -97,10 +116,11 @@ export async function syncRepo(repoURL: string) {
         return { changed: false, historyRewritten: false, remoteSha, previousSha: localSha };
     }
 
-    await runGit({ args: ["fetch", "--prune", "origin", branch], cwd: repoPath, keyPath });
+    // The remote has moved, or we have not applied it yet, so force the checkout to it.
+    let previousSha = sourceState(repoURL).lastSha || localSha;
+    await setGitRef({ repoPath, gitRef: `origin/${branch}`, keyPath });
     remoteSha = (await runGit({ args: ["rev-parse", `origin/${branch}`], cwd: repoPath, keyPath })).stdout.trim();
 
-    let previousSha = sourceState(repoURL).lastSha || localSha;
     let historyRewritten = false;
     if (previousSha && previousSha !== remoteSha) {
         // If what we already had is no longer an ancestor of the remote tip, commits were removed
@@ -113,7 +133,5 @@ export async function syncRepo(repoURL: string) {
         });
         historyRewritten = ancestry.status !== 0;
     }
-    await runGit({ args: ["reset", "--hard", `origin/${branch}`], cwd: repoPath, keyPath });
-    await runGit({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
     return { changed: true, historyRewritten, remoteSha, previousSha };
 }

package/security/authorizedKeys/daemon/repoFiles.ts

@@ -2,7 +2,7 @@ import fs from "fs/promises";
 import path from "path";
 import { deriveRevokeKey, findRevokeKey, REVOKE_KEY_LABEL, revokeKeyPath, revokeRepoPath, revokeRepoURL } from "../revokeSource";
 import { findSourceKey, sourceKeyPath, sourceRepoPath } from "../sources";
-import { cloneRepo, repoIsUsable, runGit } from "./git";
+import { cloneRepo, repoIsUsable, runGit, setGitRef } from "./git";
 
 /** Reading a repo, made to look like reading a directory. A caller asks for a file and gets its
     contents; keeping a checkout on disk, cloning it once and pulling it since, is this module's
@@ -84,9 +84,7 @@ export async function syncRepoFiles(repo: RepoRef) {
     if (remoteSha && remoteSha === localHead.stdout.trim()) {
         return;
     }
-    await runGit({ args: ["fetch", "--prune", "origin"], cwd: repoPath, keyPath });
-    await runGit({ args: ["reset", "--hard", `origin/${branch}`], cwd: repoPath, keyPath });
-    await runGit({ args: ["clean", "-fdx"], cwd: repoPath, keyPath });
+    await setGitRef({ repoPath, gitRef: `origin/${branch}`, keyPath });
 }
 
 /** Throws when there is no checkout at all. "I have never managed to read this repo" and "this