sliftutils 1.7.136 → 1.7.138

package/security/machines/machines.ts

@@ -3,11 +3,10 @@ import os from "os";
 import path from "path";
 import { resolveKeysRepo } from "../authorizedKeys/keysRepo";
 import { revokeRepo, syncRepoFiles } from "../authorizedKeys/daemon/repoFiles";
-import { listRepoDir, readRepoFile } from "../authorizedKeys/daemon/repoFiles";
-import { newRevocationId, pairKey, readRevocationFiles, readUnrevokes } from "../authorizedKeys/daemon/revocation";
+import { newRevocationId } from "../authorizedKeys/daemon/revocation";
 import { runGit, syncRepo } from "../authorizedKeys/daemon/git";
 import { ensureRevokeKey } from "../authorizedKeys/daemon/repoFiles";
-import { readSignedRepo } from "../authorizedKeys/daemon/trust";
+import { isIdentityFrozen, isPairRevoked, isPairUnrevoked, noteRevocation, readSignedRepo } from "../authorizedKeys/daemon/trust";
 import { revokeRepoPath, revokeRepoURL } from "../authorizedKeys/revokeSource";
 import { notify } from "../authorizedKeys/daemon/notify";
 import { areDiscordNotificationsConfigured, configureDiscordNotifications, DEFAULT_WEBHOOK_FILE_PATH } from "../notifications/discord";
@@ -81,8 +80,8 @@ export async function getMachines(repoPath?: string): Promise<MachineState[]> {
     read - an unsigned machines/*.json is not evidence of anything, so readSignedRepo has already
     left it out. */
 async function readTrustedMachines() {
-    let { repoPath } = await keysRepo();
-    let { files } = await readSignedRepo(repoPath);
+    let { repoPath, sourceURL } = await keysRepo();
+    let { files } = await readSignedRepo({ repoPath, sourceURL });
     let machines: MachineState[] = [];
     for (let [filePath, contents] of files) {
         let name = filePath.startsWith(`${MACHINES_DIR}/`) && filePath.slice(MACHINES_DIR.length + 1) || "";
@@ -237,43 +236,17 @@ async function readMachines(repoPath: string) {
 
 let lastRevokeSync = 0;
 
-/** Pulled at most once a REVOKE_SYNC_INTERVAL, because this is asked per request. A sync that
-    fails leaves the checkout we already have, which is the safe direction: revocations we know
-    about stay known. */
+/** Pulls the keys repo and its revoke repo, at most once a REVOKE_SYNC_INTERVAL, because this is
+    asked per request. Both, since either changing changes the answer: the keys repo carries the
+    machines and unrevokes, the revoke repo carries the revocations. A sync that fails leaves the
+    checkouts we already have. */
 async function syncRevocations(sourceURL: string) {
     if (Date.now() - lastRevokeSync < REVOKE_SYNC_INTERVAL) {
         return;
     }
     lastRevokeSync = Date.now();
-    try {
-        await syncRepoFiles(revokeRepo(sourceURL));
-    } catch (e) {
-        console.log(`Could not read ${revokeRepoURL(sourceURL)}, using the revocations already here. ${e}`);
-    }
-}
-
-/** Machine revocations, read out of the revoke repo the same way key revocations are. */
-async function readMachineRevocations(sourceURL: string) {
-    let repo = revokeRepo(sourceURL);
-    let revocations: { revocationId: string; machineId: string; ip: string }[] = [];
-    for (let name of await listRepoDir(repo, REVOCATIONS_DIR)) {
-        if (!name.endsWith(".json")) {
-            continue;
-        }
-        try {
-            let parsed = JSON.parse(await readRepoFile(repo, path.join(REVOCATIONS_DIR, name)) || "");
-            if (parsed.machineId) {
-                revocations.push({
-                    revocationId: parsed.revocationId || name.replace(/\.json$/, ""),
-                    machineId: parsed.machineId,
-                    ip: parsed.ip || "",
-                });
-            }
-        } catch (e) {
-            console.log(`Ignoring unreadable revocation ${name}. ${e}`);
-        }
-    }
-    return revocations;
+    await syncRepo(sourceURL).catch(e => console.log(`Could not sync ${sourceURL}, using the checkout already here. ${e}`));
+    await syncRepoFiles(revokeRepo(sourceURL)).catch(e => console.log(`Could not sync ${revokeRepoURL(sourceURL)}, using the revocations already absorbed. ${e}`));
 }
 
 /** What to run to trust a machine that has just been refused.
@@ -284,7 +257,7 @@ async function readMachineRevocations(sourceURL: string) {
     the machine that owns the repo, so telling them costs nothing. */
 export function addMachineCommand(config: { machineId: string; ip: string; domain?: string }) {
     let { machineId, ip, domain } = config;
-    return `To trust it, run: yarn addmachine ${domain || "<domain>"} ${machineId} ${ip} git`;
+    return `To trust ${machineId}, run: yarn addmachine ${domain || "<domain>"} ${machineId} ${ip} git`;
 }
 
 /** Sends the one notification this file is allowed to send, when it can.
@@ -342,19 +315,20 @@ async function recordMachineRevocation(config: {
         console.log(`Could not push the revocation of ${machineId} from ${ip}. ${(push.stdout + push.stderr).trim()}`);
         return;
     }
+    noteRevocation(revocationId, machineId, ip);
     console.log(`Revoked ${machineId} from ${ip}, ${revocationId}`);
 
     // Said by whoever wrote the revocation, once, the same as for an ssh key. Machines that only
     // read it later say nothing, or one event would be reported by every machine that saw it.
     await notifyBestEffort(
         `SUSPICIOUS IP ${ip} FROZE MACHINE ${machineId}`,
-        `A machine we trust talked to us from ${ip}, which is not an address it is allowed to talk`
-        + ` from. It proved it holds that machine's key, so either someone else has a copy of it,`
-        + ` or that machine's address changed.`
-        + `\n\nIt is frozen everywhere now, and nothing accepts it.`
+        `Trusted machine ${machineId} talked to us from ${ip}, an address ${machineId} is not`
+        + ` allowed from. The caller proved possession of ${machineId}'s key, so either someone`
+        + ` else has a copy of the key, or the machine's address changed.`
+        + `\n\nMachine ${machineId} is frozen everywhere now, and nothing accepts calls from ${machineId}.`
         + `\n\nIf this was an attack, remove \`machines/${machineId}.json\` from \`${sourceURL}\` now.`
-        + `\nIf it was legitimate, run \`yarn unrevoke git\` in that repo. It allows ${ip} for that`
-        + ` machine, and takes effect as each machine picks it up.`
+        + `\nIf the new address is legitimate, run \`yarn unrevoke git\` in \`${sourceURL}\`. The`
+        + ` unrevoke allows ${machineId} from ${ip}, and takes effect as each machine picks it up.`
         + `\n\nmachine: \`${machineId}\``
         + `\nfrozen by: \`${hostLabel}\``
     );
@@ -396,35 +370,15 @@ export async function isMachineAccepted(config: {
             return { verdict: { accepted: true, reason: "" }, froze: false };
         }
         let { sourceURL } = await keysRepo();
-        // Verified before it is believed, and cached, since this is asked once per request.
+        await syncRevocations(sourceURL);
+        // The list has revocations already applied - readSignedRepo drops frozen machines - so a
+        // machine in it is trusted, and a machine missing from it is either unknown or frozen.
         let machine = (await getTrustedMachines()).find(entry => entry.machineId === machineId);
         if (!machine) {
-            return { verdict: { accepted: false, reason: `that machine is not trusted. ${addMachineCommand({ machineId, ip, domain })}` }, froze: false };
-        }
-
-        await syncRevocations(sourceURL);
-        let unrevokes = await readUnrevokes(sourceURL).catch(() => ({ pairs: new Map(), legacyIds: new Map() }));
-        // An unrevoke counts as soon as it is seen. It is signed, so writing one already takes the
-        // hardware key, and anyone holding that can sign anything at all - a wait before honouring it
-        // guards against an attacker who has no need of it.
-        let allowedAgain = (pair: string) => !!unrevokes.pairs.get(pair)?.length;
-        let revocations = await readMachineRevocations(sourceURL);
-        // Any revocation nothing has undone keeps the machine out, from everywhere, the way a revoked
-        // ssh key is out everywhere rather than only from the address it was misused from.
-        let frozenFrom = "";
-        for (let revocation of revocations) {
-            if (revocation.machineId !== machineId) {
-                continue;
+            if (isIdentityFrozen(machineId)) {
+                return { verdict: { accepted: false, reason: `Machine ${machineId} is frozen, having been used from an unapproved address.` }, froze: false };
             }
-            if (!allowedAgain(pairKey({ fingerprint: revocation.machineId, ip: revocation.ip }))) {
-                frozenFrom = revocation.ip;
-            }
-        }
-        if (frozenFrom) {
-            return {
-                verdict: { accepted: false, reason: `that machine is frozen, it was used from ${frozenFrom} which it is not allowed from` },
-                froze: false,
-            };
+            return { verdict: { accepted: false, reason: `Machine ${machineId} is not trusted. ${addMachineCommand({ machineId, ip, domain })}` }, froze: false };
         }
 
         if (machine.ips.includes(ip)) {
@@ -433,14 +387,11 @@ export async function isMachineAccepted(config: {
 
         // Listed, but talking to us from somewhere it should not be. Recorded once for this machine
         // and address, so being talked to repeatedly does not write repeatedly.
-        let pair = pairKey({ fingerprint: machineId, ip });
-        let alreadyRecorded = revocations.some(revocation =>
-            pairKey({ fingerprint: revocation.machineId, ip: revocation.ip }) === pair);
-        if (!alreadyRecorded && !allowedAgain(pair)) {
+        if (!isPairRevoked(machineId, ip) && !isPairUnrevoked(machineId, ip)) {
             await recordMachineRevocation({ sourceURL, machineId, ip, hostLabel: os.hostname() });
-            return { verdict: { accepted: false, reason: `that machine is not allowed from ${ip}, so it is now frozen everywhere` }, froze: true };
+            return { verdict: { accepted: false, reason: `Machine ${machineId} is not allowed from ${ip}, and is now frozen everywhere.` }, froze: true };
         }
-        return { verdict: { accepted: false, reason: `that machine is not allowed from ${ip}` }, froze: false };
+        return { verdict: { accepted: false, reason: `Machine ${machineId} is not allowed from ${ip}.` }, froze: false };
     };
 
     let { verdict, froze } = await evaluate();

package/security/machines/printMachineId.ts

@@ -0,0 +1,19 @@
+import { DEV_listIdentityDomains, getOwnMachineId, loadIdentityCA } from "../../misc/https/certs";
+
+// Prints this machine's id under every domain it has an identity for. A machine has a different
+// identity, and so a different machine id, under every domain it runs under.
+async function main() {
+    let domains = DEV_listIdentityDomains();
+    if (!domains.length) {
+        throw new Error(`This machine has no identities`);
+    }
+    for (let domain of domains) {
+        await loadIdentityCA(domain);
+        console.log(`${domain} ${getOwnMachineId(domain)}`);
+    }
+}
+
+main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/security/signedFiles/dist/signFiles.ts.cache

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule && mod.default) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true , configurable: true});
-//exports.main = exports.signRepo = void 0;
+//exports.signRepo = exports.DEFAULT_KEY_PATH = exports.DEFAULT_KEY_TYPE = void 0;
 const promises_1 = __importDefault(require("fs/promises"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
@@ -11,21 +11,14 @@ const runPromise_1 = require("socket-function/src/runPromise");
 const paths_1 = require("../helpers/paths");
 const spawn_1 = require("../helpers/spawn");
 const manifest_1 = require("./manifest");
+const sshsig_1 = require("./sshsig");
 const unrevoke_1 = require("../authorizedKeys/unrevoke");
-const keysRepo_1 = require("../authorizedKeys/keysRepo");
 const authorizedKeys_1 = require("../authorizedKeys/authorizedKeys");
 // A hardware backed key is the entire point. A key sitting on disk is compromised the moment the
 // machine is, and then the signature proves nothing, so this is what we make when asked to make one.
-const DEFAULT_KEY_TYPE = "ed25519-sk";
-const DEFAULT_KEY_PATH = "~/.ssh/signfiles_ed25519_sk";
-const GIT_KEYWORD = "git";
-const COMMIT_MESSAGE = "deploying signed files";
+exports.DEFAULT_KEY_TYPE = "ed25519-sk";
+exports.DEFAULT_KEY_PATH = "~/.ssh/signfiles_ed25519_sk";
 const MAX_ERROR_BODY_LENGTH = 500;
-const USAGE = `Usage: yarn signfiles [signing-key] [${GIT_KEYWORD}]
-
-Signs the files of the repo in the current directory. With no key, a hardware backed
-${DEFAULT_KEY_TYPE} key at ${DEFAULT_KEY_PATH} is used, and created if it does not exist.
-Pass ${GIT_KEYWORD} to also commit and push the result.`;
 /** runPromise takes a command line rather than an argument list, so anything holding a path has to
     survive the shell. Double quotes work on both cmd and posix shells. */
 function quote(value) {
@@ -42,14 +35,14 @@ async function pathExists(filePath) {
 }
 /** Creating this needs the security key plugged in, and a touch. */
 async function ensureDefaultKey() {
-    let keyPath = (0, paths_1.expandHome)(DEFAULT_KEY_PATH);
+    let keyPath = (0, paths_1.expandHome)(exports.DEFAULT_KEY_PATH);
     if (await pathExists(keyPath)) {
         return keyPath;
     }
-    console.log(`No signing key at ${keyPath}, creating an ${DEFAULT_KEY_TYPE} one.`);
+    console.log(`No signing key at ${keyPath}, creating an ${exports.DEFAULT_KEY_TYPE} one.`);
     console.log(`Plug your security key in - you will be asked to touch it.`);
     await promises_1.default.mkdir(path_1.default.dirname(keyPath), { recursive: true, mode: 0o700 });
-    await (0, runPromise_1.runPromise)(`ssh-keygen -t ${DEFAULT_KEY_TYPE} -f ${quote(keyPath)} -N "" -C signfiles`);
+    await (0, runPromise_1.runPromise)(`ssh-keygen -t ${exports.DEFAULT_KEY_TYPE} -f ${quote(keyPath)} -N "" -C signfiles`);
     return keyPath;
 }
 /** The public key in the form the daemon reports it, so what is printed here can be compared
@@ -112,14 +105,6 @@ async function refuseRevokedKeys(repoPath) {
         }).join("\n")
         + `\nDelete them from authorized_keys, or run "yarn unrevoke" here to allow them again.`);
 }
-function parseArgs(argv) {
-    let pushToGit = argv.includes(GIT_KEYWORD);
-    let positional = argv.filter(arg => arg !== GIT_KEYWORD);
-    if (positional.length > 1) {
-        throw new Error(`Expected at most a signing key, was ${positional.length} argument(s): ${positional.join(" ")}\n${USAGE}`);
-    }
-    return { keyPath: positional[0], pushToGit };
-}
 /** Writes the manifest and its signature into a repo. Separate from the command so anything that
     changes a keys repo can leave it signed, rather than telling someone to go and do it. */
 async function signRepo(config) {
@@ -141,39 +126,18 @@ async function signRepo(config) {
     await promises_1.default.writeFile(stagedManifest, (0, manifest_1.formatManifest)(manifest));
     // Signing happens before any git work, so a failed push never costs a second touch of the key.
     await (0, runPromise_1.runPromise)(`ssh-keygen -Y sign -f ${quote(signingKey)} -n ${manifest_1.SIGN_NAMESPACE} ${quote(stagedManifest)}`);
-    // Checked here rather than left for a machine that has already pulled it to discover.
-    await (0, runPromise_1.runPromise)(`ssh-keygen -Y check-novalidate -n ${manifest_1.SIGN_NAMESPACE} -s ${quote(stagedSignature)} < ${quote(stagedManifest)}`);
+    // Checked with the same code the daemon verifies with, over the same normalised bytes, so what
+    // is about to be committed is proven to pass the check every other machine will run on it.
+    (0, sshsig_1.verifySSHSIG)({
+        signature: await promises_1.default.readFile(stagedSignature, "utf8"),
+        message: (0, manifest_1.normalizeContent)(await promises_1.default.readFile(stagedManifest)),
+        namespace: manifest_1.SIGN_NAMESPACE,
+    });
     await promises_1.default.copyFile(stagedManifest, path_1.default.join(repoPath, manifest_1.MANIFEST_NAME));
     await promises_1.default.copyFile(stagedSignature, path_1.default.join(repoPath, manifest_1.SIGNATURE_NAME));
     await promises_1.default.rm(stagingDirectory, { recursive: true, force: true });
     console.log(`Signed with ${await publicKeyOf(signingKey)}`);
 }
 exports.signRepo = signRepo;
-async function main() {
-    let { keyPath, pushToGit } = parseArgs(process.argv.slice(2));
-    // The keys repo, which is this one when it holds keys and this machine's otherwise. Signing
-    // whatever repo the terminal happened to be in is how you end up signing something that is not
-    // a keys repo at all.
-    let { repoPath } = await (0, keysRepo_1.resolveKeysRepo)();
-    console.log(`Signing ${repoPath}`);
-    await signRepo({ repoPath, keyPath });
-    if (!pushToGit) {
-        console.log(`Commit and push ${manifest_1.MANIFEST_NAME} and ${manifest_1.SIGNATURE_NAME} for anything to see them.`);
-        return;
-    }
-    await (0, runPromise_1.runPromise)(`git add -A`, { cwd: repoPath });
-    // Nothing staged is not worth stopping on. git commit calls that a failure, but it only means
-    // the signature matches the one already committed, so there is nothing to deploy.
-    let status = await (0, spawn_1.spawnPromise)({ command: "git", args: ["status", "--porcelain"], cwd: repoPath });
-    let staged = status.stdout;
-    if (!staged.trim()) {
-        console.log(`Nothing changed, ${manifest_1.MANIFEST_NAME} and ${manifest_1.SIGNATURE_NAME} are already committed.`);
-        return;
-    }
-    await (0, runPromise_1.runPromise)(`git commit -m ${quote(COMMIT_MESSAGE)}`, { cwd: repoPath });
-    await (0, runPromise_1.runPromise)(`git push`, { cwd: repoPath });
-    console.log(`Committed and pushed.`);
-}
-exports.main = main;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbkZpbGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsic2lnbkZpbGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLDJEQUE2QjtBQUM3Qiw0Q0FBb0I7QUFDcEIsZ0RBQXdCO0FBQ3hCLCtEQUE0RDtBQUM1RCw0Q0FBOEM7QUFDOUMsNENBQWdEO0FBQ2hELHlDQUEwRztBQUMxRyx5REFBK0Q7QUFDL0QseURBQTZEO0FBQzdELHFFQUFrRjtBQUVsRixpR0FBaUc7QUFDakcscUdBQXFHO0FBQ3JHLE1BQU0sZ0JBQWdCLEdBQUcsWUFBWSxDQUFDO0FBQ3RDLE1BQU0sZ0JBQWdCLEdBQUcsNkJBQTZCLENBQUM7QUFDdkQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDO0FBQzFCLE1BQU0sY0FBYyxHQUFHLHdCQUF3QixDQUFDO0FBQ2hELE1BQU0scUJBQXFCLEdBQUcsR0FBRyxDQUFDO0FBQ2xDLE1BQU0sS0FBSyxHQUFHLHdDQUF3QyxXQUFXOzs7RUFHL0QsZ0JBQWdCLFdBQVcsZ0JBQWdCO09BQ3RDLFdBQVcsc0NBQXNDLENBQUM7QUFFekQ7MEVBQzBFO0FBQzFFLFNBQVMsS0FBSyxDQUFDLEtBQWE7SUFDeEIsT0FBTyxJQUFJLEtBQUssR0FBRyxDQUFDO0FBQ3hCLENBQUM7QUFFRCxLQUFLLFVBQVUsVUFBVSxDQUFDLFFBQWdCO0lBQ3RDLElBQUksQ0FBQztRQUNELE1BQU0sa0JBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQUM7SUFDaEIsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0FBQ0wsQ0FBQztBQUVELG9FQUFvRTtBQUNwRSxLQUFLLFVBQVUsZ0JBQWdCO0lBQzNCLElBQUksT0FBTyxHQUFHLElBQUEsa0JBQVUsRUFBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzNDLElBQUksTUFBTSxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUM1QixPQUFPLE9BQU8sQ0FBQztJQUNuQixDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsT0FBTyxpQkFBaUIsZ0JBQWdCLE9BQU8sQ0FBQyxDQUFDO0lBQ2xGLE9BQU8sQ0FBQyxHQUFHLENBQUMsNERBQTRELENBQUMsQ0FBQztJQUMxRSxNQUFNLGtCQUFFLENBQUMsS0FBSyxDQUFDLGNBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sSUFBQSx1QkFBVSxFQUFDLGlCQUFpQixnQkFBZ0IsT0FBTyxLQUFLLENBQUMsT0FBTyxDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDOUYsT0FBTyxPQUFPLENBQUM7QUFDbkIsQ0FBQztBQUVEO3VDQUN1QztBQUN2QyxLQUFLLFVBQVUsV0FBVyxDQUFDLE9BQWU7SUFDdEMsSUFBSSxRQUFRLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxHQUFHLE9BQU8sTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzNELElBQUksQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLEdBQUcsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN0RCxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyw0QkFBNEIsT0FBTyxhQUFhLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2hILENBQUM7SUFDRCxPQUFPLEdBQUcsT0FBTyxJQUFJLE9BQU8sRUFBRSxDQUFDO0FBQ25DLENBQUM7QUFFRDsrRkFDK0Y7QUFDL0YsS0FBSyxVQUFVLGtCQUFrQixDQUFDLFFBQWdCO0lBQzlDLElBQUksY0FBYyxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDcEMsT0FBTztJQUNYLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxJQUFBLGdDQUFlLEVBQUMsSUFBQSw4QkFBYSxFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN6RixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE9BQU87SUFDWCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDWCx5QkFBeUIsY0FBYyxnREFBZ0Q7VUFDckYsVUFBVSxRQUFRLENBQUMsTUFBTSxnQkFBZ0I7VUFDekMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sT0FBTyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO1VBQ3BELDJGQUEyRjtVQUMzRix5RkFBeUY7VUFDekYsOERBQThELENBQ25FLENBQUM7QUFDTixDQUFDO0FBRUQ7O3lEQUV5RDtBQUN6RCxLQUFLLFVBQVUsaUJBQWlCLENBQUMsUUFBZ0I7SUFDN0MsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVELE9BQU87SUFDWCxDQUFDO0lBQ0QsdUZBQXVGO0lBQ3ZGLElBQUksTUFBTSxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLElBQUksU0FBUyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckMsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3BDLE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUM7SUFDWixJQUFJLENBQUM7UUFDRCxPQUFPLEdBQUcsTUFBTSxJQUFBLDRCQUFpQixFQUFDLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsZ0ZBQWdGO1FBQ2hGLE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNsQixPQUFPO0lBQ1gsQ0FBQztJQUNELE1BQU0sSUFBSSxLQUFLLENBQ1gsWUFBWSxRQUFRLHNDQUFzQyxPQUFPLENBQUMsTUFBTSxLQUFLO1VBQzNFLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUU7O1lBQUMsT0FBQSxLQUFLLEtBQUssQ0FBQyxVQUFVLENBQUMsV0FBVyxlQUFlLEtBQUssQ0FBQyxVQUFVLENBQUMsU0FBUyxJQUFJLEdBQUcsRUFBRTtrQkFDcEcsbUJBQW1CLENBQUEsTUFBQSxLQUFLLENBQUMsVUFBVSxDQUFDLE9BQU8sMENBQUUsRUFBRSxLQUFJLEdBQUcsRUFBRSxDQUFBO1NBQUEsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7VUFDeEUsc0ZBQXNGLENBQzNGLENBQUM7QUFDTixDQUFDO0FBRUQsU0FBUyxTQUFTLENBQUMsSUFBYztJQUM3QixJQUFJLFNBQVMsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzNDLElBQUksVUFBVSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDekQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLFVBQVUsQ0FBQyxNQUFNLGlCQUFpQixVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDL0gsQ0FBQztJQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDO0FBQ2pELENBQUM7QUFFRDs0RkFDNEY7QUFDckYsS0FBSyxVQUFVLFFBQVEsQ0FBQyxNQUE4QztJQUN6RSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxDQUFDO0lBQzFCLElBQUksVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLElBQUksSUFBQSxrQkFBVSxFQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxNQUFNLGdCQUFnQixFQUFFLENBQUM7SUFDMUYsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyw2QkFBNkIsVUFBVSx1QkFBdUIsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFFRCxNQUFNLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLE1BQU0saUJBQWlCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFFbEMsSUFBSSxRQUFRLEdBQUcsTUFBTSxJQUFBLHdCQUFhLEVBQUMsUUFBUSxDQUFDLENBQUM7SUFDN0MsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLHdCQUFhLFdBQVcsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNLGVBQWUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUV2RiwwRkFBMEY7SUFDMUYsNkZBQTZGO0lBQzdGLDBEQUEwRDtJQUMxRCxJQUFJLGdCQUFnQixHQUFHLE1BQU0sa0JBQUUsQ0FBQyxPQUFPLENBQUMsY0FBSSxDQUFDLElBQUksQ0FBQyxZQUFFLENBQUMsTUFBTSxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM5RSxJQUFJLGNBQWMsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLHdCQUFhLENBQUMsQ0FBQztJQUNoRSxJQUFJLGVBQWUsR0FBRyxHQUFHLGNBQWMsTUFBTSxDQUFDO0lBQzlDLE1BQU0sa0JBQUUsQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLElBQUEseUJBQWMsRUFBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBRTdELCtGQUErRjtJQUMvRixNQUFNLElBQUEsdUJBQVUsRUFBQyx5QkFBeUIsS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFPLHlCQUFjLElBQUksS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RyxzRkFBc0Y7SUFDdEYsTUFBTSxJQUFBLHVCQUFVLEVBQ1oscUNBQXFDLHlCQUFjLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUNoSCxDQUFDO0lBQ0YsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEVBQUUsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsd0JBQWEsQ0FBQyxDQUFDLENBQUM7SUFDdEUsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsY0FBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUseUJBQWMsQ0FBQyxDQUFDLENBQUM7SUFDeEUsTUFBTSxrQkFBRSxDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDaEUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLE1BQU0sV0FBVyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUNoRSxDQUFDO0FBL0JELDRCQStCQztBQUVNLEtBQUssVUFBVSxJQUFJO0lBQ3RCLElBQUksRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFOUQsNEZBQTRGO0lBQzVGLCtGQUErRjtJQUMvRixzQkFBc0I7SUFDdEIsSUFBSSxFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sSUFBQSwwQkFBZSxHQUFFLENBQUM7SUFDM0MsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDbkMsTUFBTSxRQUFRLENBQUMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUV0QyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDYixPQUFPLENBQUMsR0FBRyxDQUFDLG1CQUFtQix3QkFBYSxRQUFRLHlCQUFjLDRCQUE0QixDQUFDLENBQUM7UUFDaEcsT0FBTztJQUNYLENBQUM7SUFDRCxNQUFNLElBQUEsdUJBQVUsRUFBQyxZQUFZLEVBQUUsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNsRCw4RkFBOEY7SUFDOUYsa0ZBQWtGO0lBQ2xGLElBQUksTUFBTSxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDcEcsSUFBSSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUMzQixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7UUFDakIsT0FBTyxDQUFDLEdBQUcsQ0FBQyxvQkFBb0Isd0JBQWEsUUFBUSx5QkFBYyx5QkFBeUIsQ0FBQyxDQUFDO1FBQzlGLE9BQU87SUFDWCxDQUFDO0lBQ0QsTUFBTSxJQUFBLHVCQUFVLEVBQUMsaUJBQWlCLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDOUUsTUFBTSxJQUFBLHVCQUFVLEVBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDaEQsT0FBTyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO0FBQ3pDLENBQUM7QUExQkQsb0JBMEJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IGZzIGZyb20gXCJmcy9wcm9taXNlc1wiO1xuaW1wb3J0IG9zIGZyb20gXCJvc1wiO1xuaW1wb3J0IHBhdGggZnJvbSBcInBhdGhcIjtcbmltcG9ydCB7IHJ1blByb21pc2UgfSBmcm9tIFwic29ja2V0LWZ1bmN0aW9uL3NyYy9ydW5Qcm9taXNlXCI7XG5pbXBvcnQgeyBleHBhbmRIb21lIH0gZnJvbSBcIi4uL2hlbHBlcnMvcGF0aHNcIjtcbmltcG9ydCB7IHNwYXduUHJvbWlzZSB9IGZyb20gXCIuLi9oZWxwZXJzL3NwYXduXCI7XG5pbXBvcnQgeyBidWlsZE1hbmlmZXN0LCBmb3JtYXRNYW5pZmVzdCwgTUFOSUZFU1RfTkFNRSwgU0lHTkFUVVJFX05BTUUsIFNJR05fTkFNRVNQQUNFIH0gZnJvbSBcIi4vbWFuaWZlc3RcIjtcbmltcG9ydCB7IHJldm9rZWRLZXlzSW5SZXBvIH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL3VucmV2b2tlXCI7XG5pbXBvcnQgeyByZXNvbHZlS2V5c1JlcG8gfSBmcm9tIFwiLi4vYXV0aG9yaXplZEtleXMva2V5c1JlcG9cIjtcbmltcG9ydCB7IGZpbmRLZXlQcm9ibGVtcywgbm9ybWFsaXplS2V5cyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy9hdXRob3JpemVkS2V5c1wiO1xuXG4vLyBBIGhhcmR3YXJlIGJhY2tlZCBrZXkgaXMgdGhlIGVudGlyZSBwb2ludC4gQSBrZXkgc2l0dGluZyBvbiBkaXNrIGlzIGNvbXByb21pc2VkIHRoZSBtb21lbnQgdGhlXG4vLyBtYWNoaW5lIGlzLCBhbmQgdGhlbiB0aGUgc2lnbmF0dXJlIHByb3ZlcyBub3RoaW5nLCBzbyB0aGlzIGlzIHdoYXQgd2UgbWFrZSB3aGVuIGFza2VkIHRvIG1ha2Ugb25lLlxuY29uc3QgREVGQVVMVF9LRVlfVFlQRSA9IFwiZWQyNTUxOS1za1wiO1xuY29uc3QgREVGQVVMVF9LRVlfUEFUSCA9IFwifi8uc3NoL3NpZ25maWxlc19lZDI1NTE5X3NrXCI7XG5jb25zdCBHSVRfS0VZV09SRCA9IFwiZ2l0XCI7XG5jb25zdCBDT01NSVRfTUVTU0FHRSA9IFwiZGVwbG95aW5nIHNpZ25lZCBmaWxlc1wiO1xuY29uc3QgTUFYX0VSUk9SX0JPRFlfTEVOR1RIID0gNTAwO1xuY29uc3QgVVNBR0UgPSBgVXNhZ2U6IHlhcm4gc2lnbmZpbGVzIFtzaWduaW5nLWtleV0gWyR7R0lUX0tFWVdPUkR9XVxuXG5TaWducyB0aGUgZmlsZXMgb2YgdGhlIHJlcG8gaW4gdGhlIGN1cnJlbnQgZGlyZWN0b3J5LiBXaXRoIG5vIGtleSwgYSBoYXJkd2FyZSBiYWNrZWRcbiR7REVGQVVMVF9LRVlfVFlQRX0ga2V5IGF0ICR7REVGQVVMVF9LRVlfUEFUSH0gaXMgdXNlZCwgYW5kIGNyZWF0ZWQgaWYgaXQgZG9lcyBub3QgZXhpc3QuXG5QYXNzICR7R0lUX0tFWVdPUkR9IHRvIGFsc28gY29tbWl0IGFuZCBwdXNoIHRoZSByZXN1bHQuYDtcblxuLyoqIHJ1blByb21pc2UgdGFrZXMgYSBjb21tYW5kIGxpbmUgcmF0aGVyIHRoYW4gYW4gYXJndW1lbnQgbGlzdCwgc28gYW55dGhpbmcgaG9sZGluZyBhIHBhdGggaGFzIHRvXG4gICAgc3Vydml2ZSB0aGUgc2hlbGwuIERvdWJsZSBxdW90ZXMgd29yayBvbiBib3RoIGNtZCBhbmQgcG9zaXggc2hlbGxzLiAqL1xuZnVuY3Rpb24gcXVvdGUodmFsdWU6IHN0cmluZykge1xuICAgIHJldHVybiBgXCIke3ZhbHVlfVwiYDtcbn1cblxuYXN5bmMgZnVuY3Rpb24gcGF0aEV4aXN0cyhmaWxlUGF0aDogc3RyaW5nKSB7XG4gICAgdHJ5IHtcbiAgICAgICAgYXdhaXQgZnMuYWNjZXNzKGZpbGVQYXRoKTtcbiAgICAgICAgcmV0dXJuIHRydWU7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICByZXR1cm4gZmFsc2U7XG4gICAgfVxufVxuXG4vKiogQ3JlYXRpbmcgdGhpcyBuZWVkcyB0aGUgc2VjdXJpdHkga2V5IHBsdWdnZWQgaW4sIGFuZCBhIHRvdWNoLiAqL1xuYXN5bmMgZnVuY3Rpb24gZW5zdXJlRGVmYXVsdEtleSgpIHtcbiAgICBsZXQga2V5UGF0aCA9IGV4cGFuZEhvbWUoREVGQVVMVF9LRVlfUEFUSCk7XG4gICAgaWYgKGF3YWl0IHBhdGhFeGlzdHMoa2V5UGF0aCkpIHtcbiAgICAgICAgcmV0dXJuIGtleVBhdGg7XG4gICAgfVxuICAgIGNvbnNvbGUubG9nKGBObyBzaWduaW5nIGtleSBhdCAke2tleVBhdGh9LCBjcmVhdGluZyBhbiAke0RFRkFVTFRfS0VZX1RZUEV9IG9uZS5gKTtcbiAgICBjb25zb2xlLmxvZyhgUGx1ZyB5b3VyIHNlY3VyaXR5IGtleSBpbiAtIHlvdSB3aWxsIGJlIGFza2VkIHRvIHRvdWNoIGl0LmApO1xuICAgIGF3YWl0IGZzLm1rZGlyKHBhdGguZGlybmFtZShrZXlQYXRoKSwgeyByZWN1cnNpdmU6IHRydWUsIG1vZGU6IDBvNzAwIH0pO1xuICAgIGF3YWl0IHJ1blByb21pc2UoYHNzaC1rZXlnZW4gLXQgJHtERUZBVUxUX0tFWV9UWVBFfSAtZiAke3F1b3RlKGtleVBhdGgpfSAtTiBcIlwiIC1DIHNpZ25maWxlc2ApO1xuICAgIHJldHVybiBrZXlQYXRoO1xufVxuXG4vKiogVGhlIHB1YmxpYyBrZXkgaW4gdGhlIGZvcm0gdGhlIGRhZW1vbiByZXBvcnRzIGl0LCBzbyB3aGF0IGlzIHByaW50ZWQgaGVyZSBjYW4gYmUgY29tcGFyZWRcbiAgICBhZ2FpbnN0IHdoYXQgYXJyaXZlcyBvbiBEaXNjb3JkLiAqL1xuYXN5bmMgZnVuY3Rpb24gcHVibGljS2V5T2Yoa2V5UGF0aDogc3RyaW5nKSB7XG4gICAgbGV0IGNvbnRlbnRzID0gYXdhaXQgZnMucmVhZEZpbGUoYCR7a2V5UGF0aH0ucHViYCwgXCJ1dGY4XCIpO1xuICAgIGxldCBba2V5VHlwZSwga2V5Qm9keV0gPSBjb250ZW50cy50cmltKCkuc3BsaXQoL1xccysvKTtcbiAgICBpZiAoIWtleVR5cGUgfHwgIWtleUJvZHkpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhIHB1YmxpYyBrZXkgaW4gJHtrZXlQYXRofS5wdWIsIHdhcyAke2NvbnRlbnRzLnNsaWNlKDAsIE1BWF9FUlJPUl9CT0RZX0xFTkdUSCl9YCk7XG4gICAgfVxuICAgIHJldHVybiBgJHtrZXlUeXBlfSAke2tleUJvZHl9YDtcbn1cblxuLyoqIEEga2V5cyByZXBvIGhhcyBydWxlcyB0aGUgcmVzdCBvZiB0aGlzIGNhbm5vdCBlbmZvcmNlIGFmdGVyd2FyZHMsIHNvIHRoZXkgYXJlIGVuZm9yY2VkIGJlZm9yZSBpdFxuICAgIGlzIHNpZ25lZC4gU2lnbmluZyBhbnl0aGluZyB0aGF0IGlzIG5vdCBhIGtleXMgcmVwbyBpcyBub25lIG9mIHRoaXMgZnVuY3Rpb24ncyBidXNpbmVzcy4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlZnVzZVVudXNhYmxlS2V5cyhyZXBvUGF0aDogc3RyaW5nKSB7XG4gICAgbGV0IGF1dGhvcml6ZWRQYXRoID0gcGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKTtcbiAgICBpZiAoIWF3YWl0IHBhdGhFeGlzdHMoYXV0aG9yaXplZFBhdGgpKSB7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgbGV0IHByb2JsZW1zID0gZmluZEtleVByb2JsZW1zKG5vcm1hbGl6ZUtleXMoYXdhaXQgZnMucmVhZEZpbGUoYXV0aG9yaXplZFBhdGgsIFwidXRmOFwiKSkpO1xuICAgIGlmICghcHJvYmxlbXMubGVuZ3RoKSB7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICBgRXhwZWN0ZWQgZXZlcnkga2V5IGluICR7YXV0aG9yaXplZFBhdGh9IHRvIGJlIHJlc3RyaWN0ZWQgYW5kIHRvIGJlbG9uZyB0byBvbmUgcGVyc29uLGBcbiAgICAgICAgKyBgIGZvdW5kICR7cHJvYmxlbXMubGVuZ3RofSBwcm9ibGVtKHMpOlxcbmBcbiAgICAgICAgKyBwcm9ibGVtcy5tYXAocHJvYmxlbSA9PiBgICAtICR7cHJvYmxlbX1gKS5qb2luKFwiXFxuXCIpXG4gICAgICAgICsgYFxcblxcbkV2ZXJ5IGtleSBuZWVkcyBhIGZyb209IG5hbWluZyB0aGUgYWRkcmVzc2VzIGl0IG1heSBiZSB1c2VkIGZyb20sIGFuZCBubyB0d28ga2V5cyBtYXlgXG4gICAgICAgICsgYFxcbm5hbWUgdGhlIHNhbWUgb25lcy4gUmV2b2tpbmcgYSBrZXkgdGhhdCBzaGFyZXMgaXRzIGFkZHJlc3NlcyB3aXRoIGFub3RoZXIgbGVhdmVzIHRoYXRgXG4gICAgICAgICsgYFxcbm90aGVyIGtleSB3b3JraW5nLCB3aGljaCBkZWZlYXRzIHRoZSBwb2ludCBvZiByZXZva2luZyBpdC5gXG4gICAgKTtcbn1cblxuLyoqIFNpZ25pbmcgYSBrZXlzIHJlcG8gdGhhdCBzdGlsbCBob2xkcyBhIHJldm9rZWQga2V5IHdvdWxkIHB1Ymxpc2ggaXQgYmFjayB0byBldmVyeSBtYWNoaW5lIHRoYXRcbiAgICB0b29rIGl0IG91dC4gT25seSBhcHBsaWVzIHRvIGEgcmVwbyB0aGF0IGhvbGRzIGtleXMgYW5kIGhhcyBhIHJldm9rZSByZXBvIHRvIGNoZWNrIC0gc2lnbmluZ1xuICAgIGFueXRoaW5nIGVsc2UgaXMgbm9uZSBvZiB0aGlzIGZ1bmN0aW9uJ3MgYnVzaW5lc3MuICovXG5hc3luYyBmdW5jdGlvbiByZWZ1c2VSZXZva2VkS2V5cyhyZXBvUGF0aDogc3RyaW5nKSB7XG4gICAgaWYgKCFhd2FpdCBwYXRoRXhpc3RzKHBhdGguam9pbihyZXBvUGF0aCwgXCJhdXRob3JpemVkX2tleXNcIikpKSB7XG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgLy8gUmVhZCBmb3IgaXRzIHZhbHVlLCBzbyBzdGRvdXQgaGFzIHRvIGJlIG9uIGl0cyBvd24uIHJ1blByb21pc2Ugam9pbnMgaXQgd2l0aCBzdGRlcnIuXG4gICAgbGV0IG9yaWdpbiA9IGF3YWl0IHNwYXduUHJvbWlzZSh7IGNvbW1hbmQ6IFwiZ2l0XCIsIGFyZ3M6IFtcInJlbW90ZVwiLCBcImdldC11cmxcIiwgXCJvcmlnaW5cIl0sIGN3ZDogcmVwb1BhdGggfSk7XG4gICAgbGV0IG9yaWdpblVSTCA9IG9yaWdpbi5zdGRvdXQudHJpbSgpO1xuICAgIGlmIChvcmlnaW4uc3RhdHVzICE9PSAwIHx8ICFvcmlnaW5VUkwpIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBsZXQgcmV2b2tlZDtcbiAgICB0cnkge1xuICAgICAgICByZXZva2VkID0gYXdhaXQgcmV2b2tlZEtleXNJblJlcG8oeyByZXBvUGF0aCwgc291cmNlVVJMOiBvcmlnaW5VUkwgfSk7XG4gICAgfSBjYXRjaCAoZSkge1xuICAgICAgICAvLyBObyByZXZva2UgcmVwbywgb3Igbm8gYWNjZXNzIHRvIGl0LiBOb3RoaW5nIGhhcyBiZWVuIHJldm9rZWQgdGhhdCB3ZSBjYW4gc2VlLlxuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIGlmICghcmV2b2tlZC5sZW5ndGgpIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgIGBFeHBlY3RlZCAke3JlcG9QYXRofSB0byBob2xkIG5vIHJldm9rZWQga2V5cywgaXQgaG9sZHMgJHtyZXZva2VkLmxlbmd0aH06XFxuYFxuICAgICAgICArIHJldm9rZWQubWFwKGVudHJ5ID0+IGAgICR7ZW50cnkucmV2b2NhdGlvbi5maW5nZXJwcmludH0gcmV2b2tlZCBieSAke2VudHJ5LnJldm9jYXRpb24ucmV2b2tlZEJ5IHx8IFwiP1wifWBcbiAgICAgICAgICAgICsgYCBhZnRlciB1c2UgZnJvbSAke2VudHJ5LnJldm9jYXRpb24uYXR0ZW1wdD8uaXAgfHwgXCI/XCJ9YCkuam9pbihcIlxcblwiKVxuICAgICAgICArIGBcXG5EZWxldGUgdGhlbSBmcm9tIGF1dGhvcml6ZWRfa2V5cywgb3IgcnVuIFwieWFybiB1bnJldm9rZVwiIGhlcmUgdG8gYWxsb3cgdGhlbSBhZ2Fpbi5gXG4gICAgKTtcbn1cblxuZnVuY3Rpb24gcGFyc2VBcmdzKGFyZ3Y6IHN0cmluZ1tdKSB7XG4gICAgbGV0IHB1c2hUb0dpdCA9IGFyZ3YuaW5jbHVkZXMoR0lUX0tFWVdPUkQpO1xuICAgIGxldCBwb3NpdGlvbmFsID0gYXJndi5maWx0ZXIoYXJnID0+IGFyZyAhPT0gR0lUX0tFWVdPUkQpO1xuICAgIGlmIChwb3NpdGlvbmFsLmxlbmd0aCA+IDEpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBFeHBlY3RlZCBhdCBtb3N0IGEgc2lnbmluZyBrZXksIHdhcyAke3Bvc2l0aW9uYWwubGVuZ3RofSBhcmd1bWVudChzKTogJHtwb3NpdGlvbmFsLmpvaW4oXCIgXCIpfVxcbiR7VVNBR0V9YCk7XG4gICAgfVxuICAgIHJldHVybiB7IGtleVBhdGg6IHBvc2l0aW9uYWxbMF0sIHB1c2hUb0dpdCB9O1xufVxuXG4vKiogV3JpdGVzIHRoZSBtYW5pZmVzdCBhbmQgaXRzIHNpZ25hdHVyZSBpbnRvIGEgcmVwby4gU2VwYXJhdGUgZnJvbSB0aGUgY29tbWFuZCBzbyBhbnl0aGluZyB0aGF0XG4gICAgY2hhbmdlcyBhIGtleXMgcmVwbyBjYW4gbGVhdmUgaXQgc2lnbmVkLCByYXRoZXIgdGhhbiB0ZWxsaW5nIHNvbWVvbmUgdG8gZ28gYW5kIGRvIGl0LiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHNpZ25SZXBvKGNvbmZpZzogeyByZXBvUGF0aDogc3RyaW5nOyBrZXlQYXRoPzogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyByZXBvUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBzaWduaW5nS2V5ID0gY29uZmlnLmtleVBhdGggJiYgZXhwYW5kSG9tZShjb25maWcua2V5UGF0aCkgfHwgYXdhaXQgZW5zdXJlRGVmYXVsdEtleSgpO1xuICAgIGlmICghYXdhaXQgcGF0aEV4aXN0cyhzaWduaW5nS2V5KSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgc2lnbmluZyBrZXkgYXQgJHtzaWduaW5nS2V5fSwgbm8gc3VjaCBmaWxlIGV4aXN0c2ApO1xuICAgIH1cblxuICAgIGF3YWl0IHJlZnVzZVVudXNhYmxlS2V5cyhyZXBvUGF0aCk7XG4gICAgYXdhaXQgcmVmdXNlUmV2b2tlZEtleXMocmVwb1BhdGgpO1xuXG4gICAgbGV0IG1hbmlmZXN0ID0gYXdhaXQgYnVpbGRNYW5pZmVzdChyZXBvUGF0aCk7XG4gICAgY29uc29sZS5sb2coYCR7TUFOSUZFU1RfTkFNRX0gY292ZXJzICR7bWFuaWZlc3QuZmlsZXMubGVuZ3RofSBmaWxlKHMpIGluICR7cmVwb1BhdGh9YCk7XG5cbiAgICAvLyBUaGUgbWFuaWZlc3QgaXMgYnVpbHQgYW5kIHNpZ25lZCBhd2F5IGZyb20gdGhlIHJlcG8sIGFuZCBvbmx5IG1vdmVkIGluIG9uY2UgYm90aCBleGlzdC5cbiAgICAvLyBMYW5kaW5nIGEgbmV3IG1hbmlmZXN0IG5leHQgdG8gYW4gb2xkIHNpZ25hdHVyZSBwcm9kdWNlcyBhIHBhaXIgdGhhdCBjYW4gbmV2ZXIgdmVyaWZ5LCBhbmRcbiAgICAvLyB0aGUgZGFlbW9uIHJlYWRpbmcgaXQgY2FuIG9ubHkgdHJlYXQgdGhhdCBhcyB0YW1wZXJpbmcuXG4gICAgbGV0IHN0YWdpbmdEaXJlY3RvcnkgPSBhd2FpdCBmcy5ta2R0ZW1wKHBhdGguam9pbihvcy50bXBkaXIoKSwgXCJzaWduZmlsZXMtXCIpKTtcbiAgICBsZXQgc3RhZ2VkTWFuaWZlc3QgPSBwYXRoLmpvaW4oc3RhZ2luZ0RpcmVjdG9yeSwgTUFOSUZFU1RfTkFNRSk7XG4gICAgbGV0IHN0YWdlZFNpZ25hdHVyZSA9IGAke3N0YWdlZE1hbmlmZXN0fS5zaWdgO1xuICAgIGF3YWl0IGZzLndyaXRlRmlsZShzdGFnZWRNYW5pZmVzdCwgZm9ybWF0TWFuaWZlc3QobWFuaWZlc3QpKTtcblxuICAgIC8vIFNpZ25pbmcgaGFwcGVucyBiZWZvcmUgYW55IGdpdCB3b3JrLCBzbyBhIGZhaWxlZCBwdXNoIG5ldmVyIGNvc3RzIGEgc2Vjb25kIHRvdWNoIG9mIHRoZSBrZXkuXG4gICAgYXdhaXQgcnVuUHJvbWlzZShgc3NoLWtleWdlbiAtWSBzaWduIC1mICR7cXVvdGUoc2lnbmluZ0tleSl9IC1uICR7U0lHTl9OQU1FU1BBQ0V9ICR7cXVvdGUoc3RhZ2VkTWFuaWZlc3QpfWApO1xuICAgIC8vIENoZWNrZWQgaGVyZSByYXRoZXIgdGhhbiBsZWZ0IGZvciBhIG1hY2hpbmUgdGhhdCBoYXMgYWxyZWFkeSBwdWxsZWQgaXQgdG8gZGlzY292ZXIuXG4gICAgYXdhaXQgcnVuUHJvbWlzZShcbiAgICAgICAgYHNzaC1rZXlnZW4gLVkgY2hlY2stbm92YWxpZGF0ZSAtbiAke1NJR05fTkFNRVNQQUNFfSAtcyAke3F1b3RlKHN0YWdlZFNpZ25hdHVyZSl9IDwgJHtxdW90ZShzdGFnZWRNYW5pZmVzdCl9YFxuICAgICk7XG4gICAgYXdhaXQgZnMuY29weUZpbGUoc3RhZ2VkTWFuaWZlc3QsIHBhdGguam9pbihyZXBvUGF0aCwgTUFOSUZFU1RfTkFNRSkpO1xuICAgIGF3YWl0IGZzLmNvcHlGaWxlKHN0YWdlZFNpZ25hdHVyZSwgcGF0aC5qb2luKHJlcG9QYXRoLCBTSUdOQVRVUkVfTkFNRSkpO1xuICAgIGF3YWl0IGZzLnJtKHN0YWdpbmdEaXJlY3RvcnksIHsgcmVjdXJzaXZlOiB0cnVlLCBmb3JjZTogdHJ1ZSB9KTtcbiAgICBjb25zb2xlLmxvZyhgU2lnbmVkIHdpdGggJHthd2FpdCBwdWJsaWNLZXlPZihzaWduaW5nS2V5KX1gKTtcbn1cblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIG1haW4oKSB7XG4gICAgbGV0IHsga2V5UGF0aCwgcHVzaFRvR2l0IH0gPSBwYXJzZUFyZ3MocHJvY2Vzcy5hcmd2LnNsaWNlKDIpKTtcblxuICAgIC8vIFRoZSBrZXlzIHJlcG8sIHdoaWNoIGlzIHRoaXMgb25lIHdoZW4gaXQgaG9sZHMga2V5cyBhbmQgdGhpcyBtYWNoaW5lJ3Mgb3RoZXJ3aXNlLiBTaWduaW5nXG4gICAgLy8gd2hhdGV2ZXIgcmVwbyB0aGUgdGVybWluYWwgaGFwcGVuZWQgdG8gYmUgaW4gaXMgaG93IHlvdSBlbmQgdXAgc2lnbmluZyBzb21ldGhpbmcgdGhhdCBpcyBub3RcbiAgICAvLyBhIGtleXMgcmVwbyBhdCBhbGwuXG4gICAgbGV0IHsgcmVwb1BhdGggfSA9IGF3YWl0IHJlc29sdmVLZXlzUmVwbygpO1xuICAgIGNvbnNvbGUubG9nKGBTaWduaW5nICR7cmVwb1BhdGh9YCk7XG4gICAgYXdhaXQgc2lnblJlcG8oeyByZXBvUGF0aCwga2V5UGF0aCB9KTtcblxuICAgIGlmICghcHVzaFRvR2l0KSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGBDb21taXQgYW5kIHB1c2ggJHtNQU5JRkVTVF9OQU1FfSBhbmQgJHtTSUdOQVRVUkVfTkFNRX0gZm9yIGFueXRoaW5nIHRvIHNlZSB0aGVtLmApO1xuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIGF3YWl0IHJ1blByb21pc2UoYGdpdCBhZGQgLUFgLCB7IGN3ZDogcmVwb1BhdGggfSk7XG4gICAgLy8gTm90aGluZyBzdGFnZWQgaXMgbm90IHdvcnRoIHN0b3BwaW5nIG9uLiBnaXQgY29tbWl0IGNhbGxzIHRoYXQgYSBmYWlsdXJlLCBidXQgaXQgb25seSBtZWFuc1xuICAgIC8vIHRoZSBzaWduYXR1cmUgbWF0Y2hlcyB0aGUgb25lIGFscmVhZHkgY29tbWl0dGVkLCBzbyB0aGVyZSBpcyBub3RoaW5nIHRvIGRlcGxveS5cbiAgICBsZXQgc3RhdHVzID0gYXdhaXQgc3Bhd25Qcm9taXNlKHsgY29tbWFuZDogXCJnaXRcIiwgYXJnczogW1wic3RhdHVzXCIsIFwiLS1wb3JjZWxhaW5cIl0sIGN3ZDogcmVwb1BhdGggfSk7XG4gICAgbGV0IHN0YWdlZCA9IHN0YXR1cy5zdGRvdXQ7XG4gICAgaWYgKCFzdGFnZWQudHJpbSgpKSB7XG4gICAgICAgIGNvbnNvbGUubG9nKGBOb3RoaW5nIGNoYW5nZWQsICR7TUFOSUZFU1RfTkFNRX0gYW5kICR7U0lHTkFUVVJFX05BTUV9IGFyZSBhbHJlYWR5IGNvbW1pdHRlZC5gKTtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBhd2FpdCBydW5Qcm9taXNlKGBnaXQgY29tbWl0IC1tICR7cXVvdGUoQ09NTUlUX01FU1NBR0UpfWAsIHsgY3dkOiByZXBvUGF0aCB9KTtcbiAgICBhd2FpdCBydW5Qcm9taXNlKGBnaXQgcHVzaGAsIHsgY3dkOiByZXBvUGF0aCB9KTtcbiAgICBjb25zb2xlLmxvZyhgQ29tbWl0dGVkIGFuZCBwdXNoZWQuYCk7XG59XG4iXX0=
- /* _JS_SOURCE_HASH = "e62739f311ed1c2d2b818032186647cfb19cc96beec3178194cb15bda564b243"; */
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbkZpbGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsic2lnbkZpbGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLDJEQUE2QjtBQUM3Qiw0Q0FBb0I7QUFDcEIsZ0RBQXdCO0FBQ3hCLCtEQUE0RDtBQUM1RCw0Q0FBOEM7QUFDOUMsNENBQWdEO0FBQ2hELHlDQUE0SDtBQUM1SCxxQ0FBd0M7QUFDeEMseURBQStEO0FBQy9ELHFFQUFrRjtBQUVsRixpR0FBaUc7QUFDakcscUdBQXFHO0FBQ3hGLFFBQUEsZ0JBQWdCLEdBQUcsWUFBWSxDQUFDO0FBQ2hDLFFBQUEsZ0JBQWdCLEdBQUcsNkJBQTZCLENBQUM7QUFDOUQsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLENBQUM7QUFFbEM7MEVBQzBFO0FBQzFFLFNBQVMsS0FBSyxDQUFDLEtBQWE7SUFDeEIsT0FBTyxJQUFJLEtBQUssR0FBRyxDQUFDO0FBQ3hCLENBQUM7QUFFRCxLQUFLLFVBQVUsVUFBVSxDQUFDLFFBQWdCO0lBQ3RDLElBQUksQ0FBQztRQUNELE1BQU0sa0JBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQUM7SUFDaEIsQ0FBQztJQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDVCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0FBQ0wsQ0FBQztBQUVELG9FQUFvRTtBQUNwRSxLQUFLLFVBQVUsZ0JBQWdCO0lBQzNCLElBQUksT0FBTyxHQUFHLElBQUEsa0JBQVUsRUFBQyx3QkFBZ0IsQ0FBQyxDQUFDO0lBQzNDLElBQUksTUFBTSxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUM1QixPQUFPLE9BQU8sQ0FBQztJQUNuQixDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsT0FBTyxpQkFBaUIsd0JBQWdCLE9BQU8sQ0FBQyxDQUFDO0lBQ2xGLE9BQU8sQ0FBQyxHQUFHLENBQUMsNERBQTRELENBQUMsQ0FBQztJQUMxRSxNQUFNLGtCQUFFLENBQUMsS0FBSyxDQUFDLGNBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sSUFBQSx1QkFBVSxFQUFDLGlCQUFpQix3QkFBZ0IsT0FBTyxLQUFLLENBQUMsT0FBTyxDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDOUYsT0FBTyxPQUFPLENBQUM7QUFDbkIsQ0FBQztBQUVEO3VDQUN1QztBQUN2QyxLQUFLLFVBQVUsV0FBVyxDQUFDLE9BQWU7SUFDdEMsSUFBSSxRQUFRLEdBQUcsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxHQUFHLE9BQU8sTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzNELElBQUksQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLEdBQUcsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN0RCxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyw0QkFBNEIsT0FBTyxhQUFhLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLHFCQUFxQixDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2hILENBQUM7SUFDRCxPQUFPLEdBQUcsT0FBTyxJQUFJLE9BQU8sRUFBRSxDQUFDO0FBQ25DLENBQUM7QUFFRDsrRkFDK0Y7QUFDL0YsS0FBSyxVQUFVLGtCQUFrQixDQUFDLFFBQWdCO0lBQzlDLElBQUksY0FBYyxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDcEMsT0FBTztJQUNYLENBQUM7SUFDRCxJQUFJLFFBQVEsR0FBRyxJQUFBLGdDQUFlLEVBQUMsSUFBQSw4QkFBYSxFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN6RixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE9BQU87SUFDWCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDWCx5QkFBeUIsY0FBYyxnREFBZ0Q7VUFDckYsVUFBVSxRQUFRLENBQUMsTUFBTSxnQkFBZ0I7VUFDekMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sT0FBTyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO1VBQ3BELDJGQUEyRjtVQUMzRix5RkFBeUY7VUFDekYsOERBQThELENBQ25FLENBQUM7QUFDTixDQUFDO0FBRUQ7O3lEQUV5RDtBQUN6RCxLQUFLLFVBQVUsaUJBQWlCLENBQUMsUUFBZ0I7SUFDN0MsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVELE9BQU87SUFDWCxDQUFDO0lBQ0QsdUZBQXVGO0lBQ3ZGLElBQUksTUFBTSxHQUFHLE1BQU0sSUFBQSxvQkFBWSxFQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQzFHLElBQUksU0FBUyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckMsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3BDLE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxPQUFPLENBQUM7SUFDWixJQUFJLENBQUM7UUFDRCxPQUFPLEdBQUcsTUFBTSxJQUFBLDRCQUFpQixFQUFDLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1QsZ0ZBQWdGO1FBQ2hGLE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNsQixPQUFPO0lBQ1gsQ0FBQztJQUNELE1BQU0sSUFBSSxLQUFLLENBQ1gsWUFBWSxRQUFRLHNDQUFzQyxPQUFPLENBQUMsTUFBTSxLQUFLO1VBQzNFLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUU7O1lBQUMsT0FBQSxLQUFLLEtBQUssQ0FBQyxVQUFVLENBQUMsV0FBVyxlQUFlLEtBQUssQ0FBQyxVQUFVLENBQUMsU0FBUyxJQUFJLEdBQUcsRUFBRTtrQkFDcEcsbUJBQW1CLENBQUEsTUFBQSxLQUFLLENBQUMsVUFBVSxDQUFDLE9BQU8sMENBQUUsRUFBRSxLQUFJLEdBQUcsRUFBRSxDQUFBO1NBQUEsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7VUFDeEUsc0ZBQXNGLENBQzNGLENBQUM7QUFDTixDQUFDO0FBRUQ7NEZBQzRGO0FBQ3JGLEtBQUssVUFBVSxRQUFRLENBQUMsTUFBOEM7SUFDekUsSUFBSSxFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUMxQixJQUFJLFVBQVUsR0FBRyxNQUFNLENBQUMsT0FBTyxJQUFJLElBQUEsa0JBQVUsRUFBQyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksTUFBTSxnQkFBZ0IsRUFBRSxDQUFDO0lBQzFGLElBQUksQ0FBQyxNQUFNLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLFVBQVUsdUJBQXVCLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBRUQsTUFBTSxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQyxNQUFNLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRWxDLElBQUksUUFBUSxHQUFHLE1BQU0sSUFBQSx3QkFBYSxFQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzdDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyx3QkFBYSxXQUFXLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxlQUFlLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFFdkYsMEZBQTBGO0lBQzFGLDZGQUE2RjtJQUM3RiwwREFBMEQ7SUFDMUQsSUFBSSxnQkFBZ0IsR0FBRyxNQUFNLGtCQUFFLENBQUMsT0FBTyxDQUFDLGNBQUksQ0FBQyxJQUFJLENBQUMsWUFBRSxDQUFDLE1BQU0sRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDOUUsSUFBSSxjQUFjLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSx3QkFBYSxDQUFDLENBQUM7SUFDaEUsSUFBSSxlQUFlLEdBQUcsR0FBRyxjQUFjLE1BQU0sQ0FBQztJQUM5QyxNQUFNLGtCQUFFLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxJQUFBLHlCQUFjLEVBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUU3RCwrRkFBK0Y7SUFDL0YsTUFBTSxJQUFBLHVCQUFVLEVBQUMseUJBQXlCLEtBQUssQ0FBQyxVQUFVLENBQUMsT0FBTyx5QkFBYyxJQUFJLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDN0csK0ZBQStGO0lBQy9GLDJGQUEyRjtJQUMzRixJQUFBLHFCQUFZLEVBQUM7UUFDVCxTQUFTLEVBQUUsTUFBTSxrQkFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDO1FBQ3JELE9BQU8sRUFBRSxJQUFBLDJCQUFnQixFQUFDLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDNUQsU0FBUyxFQUFFLHlCQUFjO0tBQzVCLENBQUMsQ0FBQztJQUNILE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsY0FBYyxFQUFFLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLHdCQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3RFLE1BQU0sa0JBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUFFLGNBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLHlCQUFjLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sa0JBQUUsQ0FBQyxFQUFFLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ2hFLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxNQUFNLFdBQVcsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDaEUsQ0FBQztBQWxDRCw0QkFrQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgZnMgZnJvbSBcImZzL3Byb21pc2VzXCI7XG5pbXBvcnQgb3MgZnJvbSBcIm9zXCI7XG5pbXBvcnQgcGF0aCBmcm9tIFwicGF0aFwiO1xuaW1wb3J0IHsgcnVuUHJvbWlzZSB9IGZyb20gXCJzb2NrZXQtZnVuY3Rpb24vc3JjL3J1blByb21pc2VcIjtcbmltcG9ydCB7IGV4cGFuZEhvbWUgfSBmcm9tIFwiLi4vaGVscGVycy9wYXRoc1wiO1xuaW1wb3J0IHsgc3Bhd25Qcm9taXNlIH0gZnJvbSBcIi4uL2hlbHBlcnMvc3Bhd25cIjtcbmltcG9ydCB7IGJ1aWxkTWFuaWZlc3QsIGZvcm1hdE1hbmlmZXN0LCBNQU5JRkVTVF9OQU1FLCBub3JtYWxpemVDb250ZW50LCBTSUdOQVRVUkVfTkFNRSwgU0lHTl9OQU1FU1BBQ0UgfSBmcm9tIFwiLi9tYW5pZmVzdFwiO1xuaW1wb3J0IHsgdmVyaWZ5U1NIU0lHIH0gZnJvbSBcIi4vc3Noc2lnXCI7XG5pbXBvcnQgeyByZXZva2VkS2V5c0luUmVwbyB9IGZyb20gXCIuLi9hdXRob3JpemVkS2V5cy91bnJldm9rZVwiO1xuaW1wb3J0IHsgZmluZEtleVByb2JsZW1zLCBub3JtYWxpemVLZXlzIH0gZnJvbSBcIi4uL2F1dGhvcml6ZWRLZXlzL2F1dGhvcml6ZWRLZXlzXCI7XG5cbi8vIEEgaGFyZHdhcmUgYmFja2VkIGtleSBpcyB0aGUgZW50aXJlIHBvaW50LiBBIGtleSBzaXR0aW5nIG9uIGRpc2sgaXMgY29tcHJvbWlzZWQgdGhlIG1vbWVudCB0aGVcbi8vIG1hY2hpbmUgaXMsIGFuZCB0aGVuIHRoZSBzaWduYXR1cmUgcHJvdmVzIG5vdGhpbmcsIHNvIHRoaXMgaXMgd2hhdCB3ZSBtYWtlIHdoZW4gYXNrZWQgdG8gbWFrZSBvbmUuXG5leHBvcnQgY29uc3QgREVGQVVMVF9LRVlfVFlQRSA9IFwiZWQyNTUxOS1za1wiO1xuZXhwb3J0IGNvbnN0IERFRkFVTFRfS0VZX1BBVEggPSBcIn4vLnNzaC9zaWduZmlsZXNfZWQyNTUxOV9za1wiO1xuY29uc3QgTUFYX0VSUk9SX0JPRFlfTEVOR1RIID0gNTAwO1xuXG4vKiogcnVuUHJvbWlzZSB0YWtlcyBhIGNvbW1hbmQgbGluZSByYXRoZXIgdGhhbiBhbiBhcmd1bWVudCBsaXN0LCBzbyBhbnl0aGluZyBob2xkaW5nIGEgcGF0aCBoYXMgdG9cbiAgICBzdXJ2aXZlIHRoZSBzaGVsbC4gRG91YmxlIHF1b3RlcyB3b3JrIG9uIGJvdGggY21kIGFuZCBwb3NpeCBzaGVsbHMuICovXG5mdW5jdGlvbiBxdW90ZSh2YWx1ZTogc3RyaW5nKSB7XG4gICAgcmV0dXJuIGBcIiR7dmFsdWV9XCJgO1xufVxuXG5hc3luYyBmdW5jdGlvbiBwYXRoRXhpc3RzKGZpbGVQYXRoOiBzdHJpbmcpIHtcbiAgICB0cnkge1xuICAgICAgICBhd2FpdCBmcy5hY2Nlc3MoZmlsZVBhdGgpO1xuICAgICAgICByZXR1cm4gdHJ1ZTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIHJldHVybiBmYWxzZTtcbiAgICB9XG59XG5cbi8qKiBDcmVhdGluZyB0aGlzIG5lZWRzIHRoZSBzZWN1cml0eSBrZXkgcGx1Z2dlZCBpbiwgYW5kIGEgdG91Y2guICovXG5hc3luYyBmdW5jdGlvbiBlbnN1cmVEZWZhdWx0S2V5KCkge1xuICAgIGxldCBrZXlQYXRoID0gZXhwYW5kSG9tZShERUZBVUxUX0tFWV9QQVRIKTtcbiAgICBpZiAoYXdhaXQgcGF0aEV4aXN0cyhrZXlQYXRoKSkge1xuICAgICAgICByZXR1cm4ga2V5UGF0aDtcbiAgICB9XG4gICAgY29uc29sZS5sb2coYE5vIHNpZ25pbmcga2V5IGF0ICR7a2V5UGF0aH0sIGNyZWF0aW5nIGFuICR7REVGQVVMVF9LRVlfVFlQRX0gb25lLmApO1xuICAgIGNvbnNvbGUubG9nKGBQbHVnIHlvdXIgc2VjdXJpdHkga2V5IGluIC0geW91IHdpbGwgYmUgYXNrZWQgdG8gdG91Y2ggaXQuYCk7XG4gICAgYXdhaXQgZnMubWtkaXIocGF0aC5kaXJuYW1lKGtleVBhdGgpLCB7IHJlY3Vyc2l2ZTogdHJ1ZSwgbW9kZTogMG83MDAgfSk7XG4gICAgYXdhaXQgcnVuUHJvbWlzZShgc3NoLWtleWdlbiAtdCAke0RFRkFVTFRfS0VZX1RZUEV9IC1mICR7cXVvdGUoa2V5UGF0aCl9IC1OIFwiXCIgLUMgc2lnbmZpbGVzYCk7XG4gICAgcmV0dXJuIGtleVBhdGg7XG59XG5cbi8qKiBUaGUgcHVibGljIGtleSBpbiB0aGUgZm9ybSB0aGUgZGFlbW9uIHJlcG9ydHMgaXQsIHNvIHdoYXQgaXMgcHJpbnRlZCBoZXJlIGNhbiBiZSBjb21wYXJlZFxuICAgIGFnYWluc3Qgd2hhdCBhcnJpdmVzIG9uIERpc2NvcmQuICovXG5hc3luYyBmdW5jdGlvbiBwdWJsaWNLZXlPZihrZXlQYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgY29udGVudHMgPSBhd2FpdCBmcy5yZWFkRmlsZShgJHtrZXlQYXRofS5wdWJgLCBcInV0ZjhcIik7XG4gICAgbGV0IFtrZXlUeXBlLCBrZXlCb2R5XSA9IGNvbnRlbnRzLnRyaW0oKS5zcGxpdCgvXFxzKy8pO1xuICAgIGlmICgha2V5VHlwZSB8fCAha2V5Qm9keSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgcHVibGljIGtleSBpbiAke2tleVBhdGh9LnB1Yiwgd2FzICR7Y29udGVudHMuc2xpY2UoMCwgTUFYX0VSUk9SX0JPRFlfTEVOR1RIKX1gKTtcbiAgICB9XG4gICAgcmV0dXJuIGAke2tleVR5cGV9ICR7a2V5Qm9keX1gO1xufVxuXG4vKiogQSBrZXlzIHJlcG8gaGFzIHJ1bGVzIHRoZSByZXN0IG9mIHRoaXMgY2Fubm90IGVuZm9yY2UgYWZ0ZXJ3YXJkcywgc28gdGhleSBhcmUgZW5mb3JjZWQgYmVmb3JlIGl0XG4gICAgaXMgc2lnbmVkLiBTaWduaW5nIGFueXRoaW5nIHRoYXQgaXMgbm90IGEga2V5cyByZXBvIGlzIG5vbmUgb2YgdGhpcyBmdW5jdGlvbidzIGJ1c2luZXNzLiAqL1xuYXN5bmMgZnVuY3Rpb24gcmVmdXNlVW51c2FibGVLZXlzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBsZXQgYXV0aG9yaXplZFBhdGggPSBwYXRoLmpvaW4ocmVwb1BhdGgsIFwiYXV0aG9yaXplZF9rZXlzXCIpO1xuICAgIGlmICghYXdhaXQgcGF0aEV4aXN0cyhhdXRob3JpemVkUGF0aCkpIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBsZXQgcHJvYmxlbXMgPSBmaW5kS2V5UHJvYmxlbXMobm9ybWFsaXplS2V5cyhhd2FpdCBmcy5yZWFkRmlsZShhdXRob3JpemVkUGF0aCwgXCJ1dGY4XCIpKSk7XG4gICAgaWYgKCFwcm9ibGVtcy5sZW5ndGgpIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgIGBFeHBlY3RlZCBldmVyeSBrZXkgaW4gJHthdXRob3JpemVkUGF0aH0gdG8gYmUgcmVzdHJpY3RlZCBhbmQgdG8gYmVsb25nIHRvIG9uZSBwZXJzb24sYFxuICAgICAgICArIGAgZm91bmQgJHtwcm9ibGVtcy5sZW5ndGh9IHByb2JsZW0ocyk6XFxuYFxuICAgICAgICArIHByb2JsZW1zLm1hcChwcm9ibGVtID0+IGAgIC0gJHtwcm9ibGVtfWApLmpvaW4oXCJcXG5cIilcbiAgICAgICAgKyBgXFxuXFxuRXZlcnkga2V5IG5lZWRzIGEgZnJvbT0gbmFtaW5nIHRoZSBhZGRyZXNzZXMgaXQgbWF5IGJlIHVzZWQgZnJvbSwgYW5kIG5vIHR3byBrZXlzIG1heWBcbiAgICAgICAgKyBgXFxubmFtZSB0aGUgc2FtZSBvbmVzLiBSZXZva2luZyBhIGtleSB0aGF0IHNoYXJlcyBpdHMgYWRkcmVzc2VzIHdpdGggYW5vdGhlciBsZWF2ZXMgdGhhdGBcbiAgICAgICAgKyBgXFxub3RoZXIga2V5IHdvcmtpbmcsIHdoaWNoIGRlZmVhdHMgdGhlIHBvaW50IG9mIHJldm9raW5nIGl0LmBcbiAgICApO1xufVxuXG4vKiogU2lnbmluZyBhIGtleXMgcmVwbyB0aGF0IHN0aWxsIGhvbGRzIGEgcmV2b2tlZCBrZXkgd291bGQgcHVibGlzaCBpdCBiYWNrIHRvIGV2ZXJ5IG1hY2hpbmUgdGhhdFxuICAgIHRvb2sgaXQgb3V0LiBPbmx5IGFwcGxpZXMgdG8gYSByZXBvIHRoYXQgaG9sZHMga2V5cyBhbmQgaGFzIGEgcmV2b2tlIHJlcG8gdG8gY2hlY2sgLSBzaWduaW5nXG4gICAgYW55dGhpbmcgZWxzZSBpcyBub25lIG9mIHRoaXMgZnVuY3Rpb24ncyBidXNpbmVzcy4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlZnVzZVJldm9rZWRLZXlzKHJlcG9QYXRoOiBzdHJpbmcpIHtcbiAgICBpZiAoIWF3YWl0IHBhdGhFeGlzdHMocGF0aC5qb2luKHJlcG9QYXRoLCBcImF1dGhvcml6ZWRfa2V5c1wiKSkpIHtcbiAgICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICAvLyBSZWFkIGZvciBpdHMgdmFsdWUsIHNvIHN0ZG91dCBoYXMgdG8gYmUgb24gaXRzIG93bi4gcnVuUHJvbWlzZSBqb2lucyBpdCB3aXRoIHN0ZGVyci5cbiAgICBsZXQgb3JpZ2luID0gYXdhaXQgc3Bhd25Qcm9taXNlKHsgY29tbWFuZDogXCJnaXRcIiwgYXJnczogW1wicmVtb3RlXCIsIFwiZ2V0LXVybFwiLCBcIm9yaWdpblwiXSwgY3dkOiByZXBvUGF0aCB9KTtcbiAgICBsZXQgb3JpZ2luVVJMID0gb3JpZ2luLnN0ZG91dC50cmltKCk7XG4gICAgaWYgKG9yaWdpbi5zdGF0dXMgIT09IDAgfHwgIW9yaWdpblVSTCkge1xuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIGxldCByZXZva2VkO1xuICAgIHRyeSB7XG4gICAgICAgIHJldm9rZWQgPSBhd2FpdCByZXZva2VkS2V5c0luUmVwbyh7IHJlcG9QYXRoLCBzb3VyY2VVUkw6IG9yaWdpblVSTCB9KTtcbiAgICB9IGNhdGNoIChlKSB7XG4gICAgICAgIC8vIE5vIHJldm9rZSByZXBvLCBvciBubyBhY2Nlc3MgdG8gaXQuIE5vdGhpbmcgaGFzIGJlZW4gcmV2b2tlZCB0aGF0IHdlIGNhbiBzZWUuXG4gICAgICAgIHJldHVybjtcbiAgICB9XG4gICAgaWYgKCFyZXZva2VkLmxlbmd0aCkge1xuICAgICAgICByZXR1cm47XG4gICAgfVxuICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgYEV4cGVjdGVkICR7cmVwb1BhdGh9IHRvIGhvbGQgbm8gcmV2b2tlZCBrZXlzLCBpdCBob2xkcyAke3Jldm9rZWQubGVuZ3RofTpcXG5gXG4gICAgICAgICsgcmV2b2tlZC5tYXAoZW50cnkgPT4gYCAgJHtlbnRyeS5yZXZvY2F0aW9uLmZpbmdlcnByaW50fSByZXZva2VkIGJ5ICR7ZW50cnkucmV2b2NhdGlvbi5yZXZva2VkQnkgfHwgXCI/XCJ9YFxuICAgICAgICAgICAgKyBgIGFmdGVyIHVzZSBmcm9tICR7ZW50cnkucmV2b2NhdGlvbi5hdHRlbXB0Py5pcCB8fCBcIj9cIn1gKS5qb2luKFwiXFxuXCIpXG4gICAgICAgICsgYFxcbkRlbGV0ZSB0aGVtIGZyb20gYXV0aG9yaXplZF9rZXlzLCBvciBydW4gXCJ5YXJuIHVucmV2b2tlXCIgaGVyZSB0byBhbGxvdyB0aGVtIGFnYWluLmBcbiAgICApO1xufVxuXG4vKiogV3JpdGVzIHRoZSBtYW5pZmVzdCBhbmQgaXRzIHNpZ25hdHVyZSBpbnRvIGEgcmVwby4gU2VwYXJhdGUgZnJvbSB0aGUgY29tbWFuZCBzbyBhbnl0aGluZyB0aGF0XG4gICAgY2hhbmdlcyBhIGtleXMgcmVwbyBjYW4gbGVhdmUgaXQgc2lnbmVkLCByYXRoZXIgdGhhbiB0ZWxsaW5nIHNvbWVvbmUgdG8gZ28gYW5kIGRvIGl0LiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHNpZ25SZXBvKGNvbmZpZzogeyByZXBvUGF0aDogc3RyaW5nOyBrZXlQYXRoPzogc3RyaW5nIH0pIHtcbiAgICBsZXQgeyByZXBvUGF0aCB9ID0gY29uZmlnO1xuICAgIGxldCBzaWduaW5nS2V5ID0gY29uZmlnLmtleVBhdGggJiYgZXhwYW5kSG9tZShjb25maWcua2V5UGF0aCkgfHwgYXdhaXQgZW5zdXJlRGVmYXVsdEtleSgpO1xuICAgIGlmICghYXdhaXQgcGF0aEV4aXN0cyhzaWduaW5nS2V5KSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYEV4cGVjdGVkIGEgc2lnbmluZyBrZXkgYXQgJHtzaWduaW5nS2V5fSwgbm8gc3VjaCBmaWxlIGV4aXN0c2ApO1xuICAgIH1cblxuICAgIGF3YWl0IHJlZnVzZVVudXNhYmxlS2V5cyhyZXBvUGF0aCk7XG4gICAgYXdhaXQgcmVmdXNlUmV2b2tlZEtleXMocmVwb1BhdGgpO1xuXG4gICAgbGV0IG1hbmlmZXN0ID0gYXdhaXQgYnVpbGRNYW5pZmVzdChyZXBvUGF0aCk7XG4gICAgY29uc29sZS5sb2coYCR7TUFOSUZFU1RfTkFNRX0gY292ZXJzICR7bWFuaWZlc3QuZmlsZXMubGVuZ3RofSBmaWxlKHMpIGluICR7cmVwb1BhdGh9YCk7XG5cbiAgICAvLyBUaGUgbWFuaWZlc3QgaXMgYnVpbHQgYW5kIHNpZ25lZCBhd2F5IGZyb20gdGhlIHJlcG8sIGFuZCBvbmx5IG1vdmVkIGluIG9uY2UgYm90aCBleGlzdC5cbiAgICAvLyBMYW5kaW5nIGEgbmV3IG1hbmlmZXN0IG5leHQgdG8gYW4gb2xkIHNpZ25hdHVyZSBwcm9kdWNlcyBhIHBhaXIgdGhhdCBjYW4gbmV2ZXIgdmVyaWZ5LCBhbmRcbiAgICAvLyB0aGUgZGFlbW9uIHJlYWRpbmcgaXQgY2FuIG9ubHkgdHJlYXQgdGhhdCBhcyB0YW1wZXJpbmcuXG4gICAgbGV0IHN0YWdpbmdEaXJlY3RvcnkgPSBhd2FpdCBmcy5ta2R0ZW1wKHBhdGguam9pbihvcy50bXBkaXIoKSwgXCJzaWduZmlsZXMtXCIpKTtcbiAgICBsZXQgc3RhZ2VkTWFuaWZlc3QgPSBwYXRoLmpvaW4oc3RhZ2luZ0RpcmVjdG9yeSwgTUFOSUZFU1RfTkFNRSk7XG4gICAgbGV0IHN0YWdlZFNpZ25hdHVyZSA9IGAke3N0YWdlZE1hbmlmZXN0fS5zaWdgO1xuICAgIGF3YWl0IGZzLndyaXRlRmlsZShzdGFnZWRNYW5pZmVzdCwgZm9ybWF0TWFuaWZlc3QobWFuaWZlc3QpKTtcblxuICAgIC8vIFNpZ25pbmcgaGFwcGVucyBiZWZvcmUgYW55IGdpdCB3b3JrLCBzbyBhIGZhaWxlZCBwdXNoIG5ldmVyIGNvc3RzIGEgc2Vjb25kIHRvdWNoIG9mIHRoZSBrZXkuXG4gICAgYXdhaXQgcnVuUHJvbWlzZShgc3NoLWtleWdlbiAtWSBzaWduIC1mICR7cXVvdGUoc2lnbmluZ0tleSl9IC1uICR7U0lHTl9OQU1FU1BBQ0V9ICR7cXVvdGUoc3RhZ2VkTWFuaWZlc3QpfWApO1xuICAgIC8vIENoZWNrZWQgd2l0aCB0aGUgc2FtZSBjb2RlIHRoZSBkYWVtb24gdmVyaWZpZXMgd2l0aCwgb3ZlciB0aGUgc2FtZSBub3JtYWxpc2VkIGJ5dGVzLCBzbyB3aGF0XG4gICAgLy8gaXMgYWJvdXQgdG8gYmUgY29tbWl0dGVkIGlzIHByb3ZlbiB0byBwYXNzIHRoZSBjaGVjayBldmVyeSBvdGhlciBtYWNoaW5lIHdpbGwgcnVuIG9uIGl0LlxuICAgIHZlcmlmeVNTSFNJRyh7XG4gICAgICAgIHNpZ25hdHVyZTogYXdhaXQgZnMucmVhZEZpbGUoc3RhZ2VkU2lnbmF0dXJlLCBcInV0ZjhcIiksXG4gICAgICAgIG1lc3NhZ2U6IG5vcm1hbGl6ZUNvbnRlbnQoYXdhaXQgZnMucmVhZEZpbGUoc3RhZ2VkTWFuaWZlc3QpKSxcbiAgICAgICAgbmFtZXNwYWNlOiBTSUdOX05BTUVTUEFDRSxcbiAgICB9KTtcbiAgICBhd2FpdCBmcy5jb3B5RmlsZShzdGFnZWRNYW5pZmVzdCwgcGF0aC5qb2luKHJlcG9QYXRoLCBNQU5JRkVTVF9OQU1FKSk7XG4gICAgYXdhaXQgZnMuY29weUZpbGUoc3RhZ2VkU2lnbmF0dXJlLCBwYXRoLmpvaW4ocmVwb1BhdGgsIFNJR05BVFVSRV9OQU1FKSk7XG4gICAgYXdhaXQgZnMucm0oc3RhZ2luZ0RpcmVjdG9yeSwgeyByZWN1cnNpdmU6IHRydWUsIGZvcmNlOiB0cnVlIH0pO1xuICAgIGNvbnNvbGUubG9nKGBTaWduZWQgd2l0aCAke2F3YWl0IHB1YmxpY0tleU9mKHNpZ25pbmdLZXkpfWApO1xufVxuIl19
+ /* _JS_SOURCE_HASH = "4a0362e3ebb2c3e38ab98fe24ab7f151737c241a4186d0e880713fb9d14fa48f"; */

package/storage/remoteStorage/ArchivesRemote.d.ts

@@ -36,9 +36,9 @@ export declare class ArchivesRemote implements IArchives {
     private authenticate;
     private callAuthed;
     waitingForAccess(): Promise<{
-        link: string;
         machineId: string;
         ip: string;
+        reason: string;
     } | undefined>;
     hasWriteAccess(): Promise<boolean>;
     private registerAccessRequest;

package/storage/remoteStorage/ArchivesRemote.ts

@@ -1,7 +1,7 @@
 import { SocketFunction } from "socket-function/SocketFunction";
 import { timeInMinute } from "socket-function/src/misc";
 import { delay } from "socket-function/src/batching";
-import { getIdentityCA, loadIdentityCA, sign } from "../../misc/https/certs";
+import { getIdentityCA, getThreadKeyCert, loadIdentityCA, sign } from "../../misc/https/certs";
 import { IArchives, ArchiveFileInfo, ArchivesConfig, ArchivesSyncStatus, ChangesAfterConfig, DelConfig, FindConfig, GetConfig, GetInfoConfig, MoveFileConfig, SourceConfig, SetConfig, SetLargeFileConfig, LARGE_SET_THRESHOLD, bufferChunkStream } from "../IArchives";
 import { parseHostedUrl, getBucketBaseUrl, buildFileUrl } from "./remoteConfig";
 import {
@@ -41,14 +41,20 @@ export async function authenticateStorage(config: { address: string; port: numbe
     SocketFunction.ENABLE_CLIENT_MODE = true;
     let rootDomain = config.address.split(".").slice(-2).join(".");
     await loadIdentityCA(rootDomain);
-    let ca = getIdentityCA(rootDomain);
+    let threadKeyCert = getThreadKeyCert(rootDomain);
+    let issuer = getIdentityCA(rootDomain);
     let data = {
         purpose: STORAGE_AUTH_PURPOSE,
         time: Date.now(),
         server: `${config.address}:${config.port}`,
     };
-    let signature = sign({ key: ca.key }, data);
-    return await RemoteStorageController.nodes[config.nodeId].authenticate({ certPem: ca.cert.toString(), signature, data });
+    let signature = sign(threadKeyCert, data);
+    return await RemoteStorageController.nodes[config.nodeId].authenticate({
+        certPem: threadKeyCert.cert.toString(),
+        issuerPem: issuer.cert.toString(),
+        signature,
+        data,
+    });
 }
 
 export class ArchivesRemote implements IArchives {
@@ -99,14 +105,14 @@ export class ArchivesRemote implements IArchives {
         }
     }
 
-    // Returns undefined if this machine has access to the account. Otherwise returns our machineId + ip as the server sees them, and the link to the access page - which shows the single command that grants access.
-    public async waitingForAccess(): Promise<{ link: string; machineId: string; ip: string } | undefined> {
+    // Returns undefined if this machine has access to the account. Otherwise returns our machineId + ip as the server sees them, why we were refused, and the exact command that grants access.
+    public async waitingForAccess(): Promise<{ machineId: string; ip: string; reason: string } | undefined> {
         let state = await this.callAuthed(() => this.controller.getAccessState({ account: this.account }));
         if (state.hasAccess) return undefined;
         return {
-            link: `https://${this.parsed.address}:${this.parsed.port}/${this.account}`,
             machineId: state.machineId,
             ip: state.ip,
+            reason: state.reason || "",
         };
     }
 
@@ -120,7 +126,7 @@ export class ArchivesRemote implements IArchives {
         if (Date.now() - this.lastDeniedLog < timeInMinute) return;
         let state = await this.callAuthed(() => this.controller.getAccessState({ account: this.account }));
         this.lastDeniedLog = Date.now();
-        console.log(`No access to storage account ${JSON.stringify(this.account)} on ${this.parsed.address}:${this.parsed.port} (our machine ${state.machineId}, ip ${state.ip}). ${state.reason || ""} Grant it with: ${state.addMachineCommand || ""}`);
+        console.log(`No access to storage account ${JSON.stringify(this.account)} on ${this.parsed.address}:${this.parsed.port}. ${state.reason || ""}`);
     }
 
     // Runs a call, authenticating (and re-authenticating after reconnects) and waiting for account access as needed. With waitForAccess false, denied calls throw immediately instead - but the access request is still registered (in the background), so the denial is grantable.

package/storage/remoteStorage/accessPage.tsx

@@ -1,131 +1,12 @@
 process.env.NODE_ENV = "production";
 
 import preact from "preact";
-import { observable } from "mobx";
-import { observer } from "../../render-utils/observer";
 import { isNode } from "socket-function/src/misc";
 import { css } from "typesafecss";
-import { SocketFunction } from "socket-function/SocketFunction";
-import { RemoteStorageController, AccessState } from "./storageController";
-import { authenticateStorage } from "./ArchivesRemote";
 
-// The storage server's access page. Visit https://<storageDomain>:<port>/<accountName> to see whether this browser's machine identity has access, and if not, the one command that grants it. Nothing is requested or approved here: trust lives in the signed authorized_keys repo, so access is granted by someone running addmachine there with the hardware key, and this page only reports what that repo says.
-
-const REFRESH_INTERVAL = 1000 * 15;
-const COPIED_RESET_DELAY = 2000;
-
-@observer
-class CopyableCommand extends preact.Component<{ command: string }> {
-    synced = observable({
-        copied: false,
-    });
-
-    render() {
-        let command = this.props.command;
-        return <div className={css.hbox(8).alignItems("flex-start")}>
-            <button onClick={async () => {
-                await navigator.clipboard.writeText(command);
-                this.synced.copied = true;
-                setTimeout(() => { this.synced.copied = false; }, COPIED_RESET_DELAY);
-            }}>
-                {this.synced.copied && "Copied!" || "Copy"}
-            </button>
-            <code className={css.fontFamily("monospace").whiteSpace("pre-wrap")
-                .hsl(0, 0, 92).pad2(8, 4).borderRadius(4)
-            }>
-                {command}
-            </code>
-        </div>;
-    }
-}
-
-@observer
-class AccessPage extends preact.Component {
-    synced = observable({
-        account: "",
-        state: undefined as AccessState | undefined,
-        error: "",
-    });
-
-    componentDidMount() {
-        let account = decodeURIComponent(location.pathname.split("/")[1] || "");
-        this.synced.account = account;
-        if (!account) return;
-        void (async () => {
-            while (true) {
-                try {
-                    await this.refresh(account);
-                } catch (e) {
-                    this.synced.error = String(e);
-                }
-                if (this.synced.state?.hasAccess) break;
-                await new Promise(resolve => setTimeout(resolve, REFRESH_INTERVAL));
-            }
-        })();
-    }
-
-    private authenticated = false;
-    private async controller() {
-        let address = location.hostname;
-        let port = +location.port || 443;
-        let nodeId = SocketFunction.connect({ address, port });
-        if (!this.authenticated) {
-            await authenticateStorage({ address, port, nodeId });
-            this.authenticated = true;
-        }
-        return RemoteStorageController.nodes[nodeId];
-    }
-    private async refresh(account: string) {
-        let controller = await this.controller();
-        this.synced.state = await controller.getAccessState({ account });
-        this.synced.error = "";
-    }
-
-    render() {
-        let synced = this.synced;
-        let { account, state, error } = synced;
-        if (!account) {
-            return <div className={css.vbox(8).pad2(16)}>
-                <div>Remote storage server.</div>
-                <div>Visit /(account name) to see whether this browser's machine has access to an account.</div>
-            </div>;
-        }
-        return <div className={css.vbox(12).pad2(16)}>
-            <div>Storage account: {account}</div>
-            {error && <div>Error: {error}</div>}
-            {!state && !error && <div>Checking access...</div>}
-            {state && !state.hasAccess && <div className={css.vbox(8)}>
-                <div>This machine ({state.machineId}, ip {state.ip}) does NOT have access.</div>
-                {state.reason && <div>{state.reason}</div>}
-                <div>Run this in the authorized_keys repo, on a machine with the signing key:</div>
-                {state.addMachineCommand && <CopyableCommand command={state.addMachineCommand} />}
-                <div>This page rechecks every {REFRESH_INTERVAL / 1000} seconds.</div>
-            </div>}
-            {state && state.hasAccess && <div className={css.vbox(16)}>
-                <div>This machine ({state.machineId}, ip {state.ip}) has access.</div>
-                <div className={css.vbox(6)}>
-                    <div>Trusted machines:</div>
-                    <table>
-                        <thead>
-                            <tr>
-                                <th className={css.pad2(8, 2).textAlign("left")}>Machine</th>
-                                <th className={css.pad2(8, 2).textAlign("left")}>Allowed from</th>
-                                <th className={css.pad2(8, 2).textAlign("left")}>Added</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                            {(state.trustedMachines || []).map(m => <tr key={m.machineId}>
-                                <td className={css.pad2(8, 2)}>{m.machineId}</td>
-                                <td className={css.pad2(8, 2)}>{m.ips.join(", ")}</td>
-                                <td className={css.pad2(8, 2)}>{m.addedAt}</td>
-                            </tr>)}
-                        </tbody>
-                    </table>
-                </div>
-            </div>}
-        </div>;
-    }
-}
+// The storage server's fallback page. There is no access-granting page any more: access errors in
+// the console say exactly why a machine was refused and the addmachine command that fixes it. This
+// only remains for the cert-trust flow (?trustCert=1, see certTrustModal.tsx).
 
 // Reached via the cert-trust flow (showCertTrustModal links here as ?trustCert=1). The browser only loads this page if it has ACCEPTED the certificate - so the mere fact that it rendered is the confirmation. Once accepted, the app's background connection to this same server works, so the user just returns.
 function CertTrustedPage() {
@@ -141,7 +22,10 @@ async function main() {
         preact.render(<CertTrustedPage />, document.body);
         return;
     }
-    preact.render(<AccessPage />, document.body);
+    preact.render(<div className={css.vbox(8).pad2(16)}>
+        <div>Remote storage server.</div>
+        <div>Access is granted by adding a machine to the authorized_keys repo (yarn addmachine). Denied requests print the exact command in their error.</div>
+    </div>, document.body);
 }
 
 main().catch(console.error);

package/storage/remoteStorage/createArchives.d.ts

@@ -23,9 +23,9 @@ export declare class ArchivesChain implements IArchives {
     private prepareWrongTargetRetry;
     private request;
     waitingForAccess(): Promise<{
-        link: string;
         machineId: string;
         ip: string;
+        reason: string;
     } | undefined>;
     /** The sources that can serve a file right now, in dispatch order - the first is the write node, the one a plain read asks first. Each entry's url is what GetConfig.sourceUrl / GetInfoConfig.sourceUrl accept, so listing these and then reading with sourceUrl compares the copies the sources actually hold. */
     getFileSources(fileName: string): Promise<SourceConfig[]>;

package/storage/remoteStorage/createArchives.ts

@@ -319,7 +319,7 @@ export class ArchivesChain implements IArchives {
         return await this.run(state, config, run);
     }
 
-    public async waitingForAccess(): Promise<{ link: string; machineId: string; ip: string } | undefined> {
+    public async waitingForAccess(): Promise<{ machineId: string; ip: string; reason: string } | undefined> {
         let state = await this.state.getState();
         for (let source of state.sources) {
             // A source whose window has passed is never read or written again, so its access state is irrelevant - and asking a dead intermediate would just hang or throw. Future windows DO matter: access should be granted before their window starts.