From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AF25C072B1 for ; Tue, 12 Jan 2021 22:04:02 +0000 (UTC) Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B0129221FF for ; Tue, 12 Jan 2021 22:04:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B0129221FF Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ubuntu.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=containers-bounces@lists.linux-foundation.org Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 44FCE20493; Tue, 12 Jan 2021 22:04:01 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SYqG-kM4EwkF; Tue, 12 Jan 2021 22:03:56 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by silver.osuosl.org (Postfix) with ESMTP id 62DC220495; Tue, 12 Jan 2021 22:03:56 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 5BA71C0893; Tue, 12 Jan 2021 22:03:56 +0000 (UTC) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 85C49C013A for ; Tue, 12 Jan 2021 22:03:55 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 671E286044 for ; Tue, 12 Jan 2021 22:03:55 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1SILR8Gy2uQ for ; Tue, 12 Jan 2021 22:03:52 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 1D68885F8E for ; Tue, 12 Jan 2021 22:03:52 +0000 (UTC) Received: from ip5f5af0a0.dynamic.kabel-deutschland.de ([95.90.240.160] helo=wittgenstein.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1kzRkP-0003bd-Cd; Tue, 12 Jan 2021 22:02:41 +0000 From: Christian Brauner To: Alexander Viro , Christoph Hellwig , linux-fsdevel@vger.kernel.org Subject: [PATCH v5 00/42] idmapped mounts Date: Tue, 12 Jan 2021 23:00:42 +0100 Message-Id: <20210112220124.837960-1-christian.brauner@ubuntu.com> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 Cc: Lennart Poettering , Mimi Zohar , James Bottomley , Andreas Dilger , containers@lists.linux-foundation.org, Tycho Andersen , Paul Moore , Jonathan Corbet , smbarber@chromium.org, linux-ext4@vger.kernel.org, Mrunal Patel , Kees Cook , Arnd Bergmann , selinux@vger.kernel.org, Josh Triplett , Seth Forshee , Aleksa Sarai , Andy Lutomirski , OGAWA Hirofumi , Geoffrey Thomas , David Howells , John Johansen , Theodore Tso , Dmitry Kasatkin , Stephen Smalley , linux-xfs@vger.kernel.org, linux-security-module@vger.kernel.org, "Eric W. Biederman" , linux-api@vger.kernel.org, Casey Schaufler , Alban Crequy , linux-integrity@vger.kernel.org, Linus Torvalds , Todd Kjos X-BeenThere: containers@lists.linux-foundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux Containers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: containers-bounces@lists.linux-foundation.org Sender: "Containers" SGV5IGV2ZXJ5b25lLAoKVGhlIG9ubHkgbWFqb3IgY2hhbmdlIGlzIHRoZSBpbmNsdXNpb24gb2Yg aGNoJ3MgcGF0Y2ggdG8gcG9ydCBYRlMgdG8Kc3VwcG9ydCBpZG1hcHBlZCBtb3VudHMuIFRoYW5r cyB0byBDaHJpc3RvcGggZm9yIGRvaW5nIHRoYXQgd29yay4KKEZvciBhIGZ1bGwgbGlzdCBvZiBt YWpvciBjaGFuZ2VzIGJldHdlZW4gdmVyc2lvbnMgc2VlIHRoZSBlbmQgb2YgdGhpcwogY292ZXIg bGV0dGVyLgogUGxlYXNlIGFsc28gbm90ZSB0aGUgbGFyZ2UgeGZzdGVzdHMgdGVzdHN1aXRlIGlu IHBhdGNoIDQyIHRoYXQgaGFzIGJlZW4KIGtlcHQgYXMgcGFydCBvZiB0aGlzIHNlcmllcy4gSXQg dmVyaWZpZXMgY29ycmVjdCB2ZnMgYmVoYXZpb3Igd2l0aCBhbmQKIHdpdGhvdXQgaWRtYXBwZWQg bW91bnRzIGluY2x1ZGluZyBjb3ZlcmluZyBuZXdlciB2ZnMgZmVhdHVyZXMgc3VjaCBhcwogaW9f dXJpbmcuCiBJIGN1cnJlbnRseSBzdGlsbCBwbGFuIHRvIHRhcmdldCB0aGUgdjUuMTIgbWVyZ2Ug d2luZG93LikKCldpdGggdGhpcyBwYXRjaHNldCB3ZSBtYWtlIGl0IHBvc3NpYmxlIHRvIGF0dGFj aCBpZG1hcHBpbmdzIHRvIG1vdW50cywKaS5lLiBzaW1wbHkgcHV0IGRpZmZlcmVudCBiaW5kIG1v dW50cyBjYW4gZXhwb3NlIHRoZSBzYW1lIGZpbGUgb3IKZGlyZWN0b3J5IHdpdGggZGlmZmVyZW50 IG93bmVyc2hpcC4KU2hpZnRpbmcgb2Ygb3duZXJzaGlwIG9uIGEgcGVyLW1vdW50IGJhc2lzIGhh bmRsZXMgYSB3aWRlIHJhbmdlIG9mCmxvbmcgc3RhbmRpbmcgdXNlLWNhc2VzLiBIZXJlIGFyZSBq dXN0IGEgZmV3OgotIFNoaWZ0aW5nIG9mIGEgc3Vic2V0IG9mIG93bmVyc2hpcC1sZXNzIGZpbGVz eXN0ZW1zICh2ZmF0KSBmb3IgdXNlIGJ5CiAgbXVsdGlwbGUgdXNlcnMsIGVmZmVjdGl2ZWx5IGFs bG93aW5nIGZvciBEQUMgb24gc3VjaCBkZXZpY2VzCiAgKHN5c3RlbWQsIEFuZHJvaWQsIC4uLikK LSBBbGxvdyByZW1hcHBpbmcgdWlkL2dpZCBvbiBleHRlcm5hbCBmaWxlc3lzdGVtcyBvciBwYXRo cyAoVVNCIHN0aWNrcywKICBuZXR3b3JrIGZpbGVzeXN0ZW0sIC4uLikgdG8gbWF0Y2ggdGhlIGxv Y2FsIHN5c3RlbSdzIHVzZXIgYW5kIGdyb3Vwcy4KICAoRGF2aWQgSG93ZWxscyBpbnRlbmRzIHRv IHBvcnQgQUZTIGFzIGEgZmlyc3QgY2FuZGlkYXRlLikKLSBTaGlmdGluZyBvZiBhIGNvbnRhaW5l ciByb290ZnMgb3IgYmFzZSBpbWFnZSB3aXRob3V0IGhhdmluZyB0byBtYW5nbGUKICBldmVyeSBm aWxlIChydW5jLCBEb2NrZXIsIGNvbnRhaW5lcmQsIGs4cywgTFhELCBzeXN0ZW1kIC4uLikKLSBT aGFyaW5nIG9mIGRhdGEgYmV0d2VlbiBob3N0IG9yIHByaXZpbGVnZWQgY29udGFpbmVycyB3aXRo CiAgdW5wcml2aWxlZ2VkIGNvbnRhaW5lcnMgKHJ1bkMsIERvY2tlciwgY29udGFpbmVyZCwgazhz LCBMWEQsIC4uLikKLSBEYXRhIHNoYXJpbmcgYmV0d2VlbiBtdWx0aXBsZSB1c2VyIG5hbWVzcGFj ZXMgd2l0aCBpbmNvbXBhdGlibGUgbWFwcwogIChMWEQsIGs4cywgLi4uKQoKVGhlcmUgaGFzIGJl ZW4gc2lnbmlmaWNhbnQgaW50ZXJlc3QgaW4gdGhpcyBwYXRjaHNldCBhcyBldmlkZW5jZWQgYnkK dXNlciBjb21tZW50aW5nIG9uIHByZXZpb3VzIHZlcnNpb24gb2YgdGhpcyBwYXRjaHNldC4gVGhl eSBpbmNsdWRlCmNvbnRhaW5lcmQsIENocm9tZU9TLCBzeXN0ZW1kLCBMWEQgYW5kIGEgcmFuZ2Ug b2Ygb3RoZXJzLiBUaGVyZSBpcwphbHJlYWR5IGEgcGF0Y2hzZXQgdXAgZm9yIGNvbnRhaW5lcmQs IHRoZSBkZWZhdWx0IEt1YmVybmV0ZXMgY29udGFpbmVyCnJ1bnRpbWUgaHR0cHM6Ly9naXRodWIu Y29tL2NvbnRhaW5lcmQvY29udGFpbmVyZC9wdWxsLzQ3MzQKdG8gbWFrZSB1c2Ugb2YgdGhpcy4g c3lzdGVtZCBpbnRlbmRzIHRvIHVzZSBpdCBpbiB0aGVpciBzeXN0ZW1kLWhvbWVkCmltcGxlbWVu dGF0aW9uIGZvciBwb3J0YWJsZSBob21lIGRpcmVjdG9yaWVzLiBDaHJvbWVPUyB3YW50cyB0byBt YWtlIHVzZQpvZiBpdCB0byBzaGFyZSBkYXRhIGJldHdlZW4gdGhlIGhvc3QgYW5kIHRoZSBMaW51 eCBjb250YWluZXJzIHRoZXkgcnVuCm9uIENocm9tZS0gYW5kIFBpeGVsYm9va3MuCihGd2l3LCBm b3IgZnVuIGFuZCBzaW5jZSBJIHdhbnRlZCB0byBkbyB0aGlzIGZvciBhIGxvbmcgdGltZSBJJ3Zl IHBvcnRlZAogbXkgaG9tZSBkaXJlY3RvcnkgdG8gYmUgY29tcGxldGVseSBwb3J0YWJsZSB3aXRo IGEgc2ltcGxlIHNlcnZpY2UgZmlsZQogdGhhdCBub3cgbW91bnRzIG15IGhvbWUgZGlyZWN0b3J5 IG9uIGFuIGV4dDQgZm9ybWF0dGVkIHVzYiBzdGljayB3aXRoCiBhbiBpZCBtYXBwaW5nIG1hcHBp bmcgYWxsIGZpbGVzIHRvIHRoZSByYW5kb20gdWlkIEknbSBhc3NpZ25lZCBhdAogbG9naW4uKQoK TWFraW5nIGl0IHBvc3NpYmxlIHRvIHNoYXJlIGRpcmVjdG9yaWVzIGFuZCBtb3VudHMgYmV0d2Vl biB1c2VycyB3aXRoCmRpZmZlcmVudCB1aWRzIGFuZCBnaWRzIGlzIGl0c2VsZiBxdWl0ZSBhbiBp bXBvcnRhbnQgdXNlLWNhc2UgaW4KZGlzdHJpYnV0ZWQgc3lzdGVtcyBlbnZpcm9ubWVudHMuIEl0 J3Mgb2YgY291cnNlIGVzcGVjaWFsbHkgdXNlZnVsIGluCmdlbmVyYWwgZm9yIHBvcnRhYmxlIHVz YiBzdGlja3MsIHNoYXJpbmcgZGF0YSBiZXR3ZWVuIG11bHRpcGxlIHVzZXJzIGluLAphbmQgc2hh cmluZyBob21lIGRpcmVjdG9yaWVzIGJldHdlZW4gbXVsdGlwbGUgdXNlcnMuIFRoZSBsYXN0IGV4 YW1wbGUgaXMKbm93IGVsZWdhbnRseSBleHByZXNzZWQgaW4gc3lzdGVtZCdzIGhvbWVkIGNvbmNl cHQgZm9yIHBvcnRhYmxlIGhvbWUKZGlyZWN0b3JpZXMuIEFzIG1lbnRpb25lZCBhYm92ZSwgaWRt YXBwZWQgbW91bnRzIGFsc28gYWxsb3cgZGF0YSBmcm9tCnRoZSBob3N0IHRvIGJlIHNoYXJlZCB3 aXRoIHVucHJpdmlsZWdlZCBjb250YWluZXJzLCBiZXR3ZWVuIHByaXZpbGVnZWQKYW5kIHVucHJp dmlsZWdlZCBjb250YWluZXJzIHNpbXVsdGFuZW91c2x5IGFuZCBpbiBhZGRpdGlvbiBhbHNvIGJl dHdlZW4KdW5wcml2aWxlZ2VkIGNvbnRhaW5lcnMgd2l0aCBkaWZmZXJlbnQgaWRtYXBwaW5ncyB3 aGVuZXZlciB0aGV5IGFyZSB1c2VkCnRvIGlzb2xhdGUgb25lIGNvbnRhaW5lciBjb21wbGV0ZWx5 IGZyb20gYW5vdGhlciBjb250YWluZXIuCgpXZSBoYXZlIGltcGxlbWVudGVkIGFuZCBwcm9wb3Nl ZCBtdWx0aXBsZSBzb2x1dGlvbnMgdG8gdGhpcyBiZWZvcmUuIFRoaXMKaW5jbHVkZWQgdGhlIGlu dHJvZHVjdGlvbiBvZiBmc2lkIG1hcHBpbmdzLCBhIHRpbnkgZmlsZXN5c3RlbSBJJ3ZlCmF1dGhv cmVkIHdpdGggU2V0aCBGb3JzaGVlIHRoYXQgaXMgY3VycmVudGx5IGNhcnJpZWQgaW4gVWJ1bnR1 IHRoYXQgaGFzCnNob3duIHRvIGJlIHRoZSB3cm9uZyBhcHByb2FjaCwgYW5kIHRoZSBjb25jZXB0 dWFsIGhhY2sgb2YgY2FsbGluZwpvdmVycmlkZSBjcmVkcyBkaXJlY3RseSBpbiB0aGUgdmZzLiBJ biBhZGRpdGlvbiwgdG8gc29tZSBvZiB0aGVzZQpzb2x1dGlvbnMgYmVpbmcgaGFja3kgbm9uZSBv ZiB0aGVzZSBzb2x1dGlvbnMgaGF2ZSBjb3ZlcmVkIGFsbCBvZiB0aGUKYWJvdmUgdXNlLWNhc2Vz LgoKSWRtYXBwaW5ncyBiZWNvbWUgYSBwcm9wZXJ0eSBvZiBzdHJ1Y3QgdmZzbW91bnQgaW5zdGVh ZCBvZiB0eWluZyBpdCB0byBhCnByb2Nlc3MgYmVpbmcgaW5zaWRlIG9mIGEgdXNlciBuYW1lc3Bh Y2Ugd2hpY2ggaGFzIGJlZW4gdGhlIGNhc2UgZm9yIGFsbApvdGhlciBwcm9wb3NlZCBhcHByb2Fj aGVzLiBJdCBhbHNvIGFsbG93cyB0byBwYXNzIGRvd24gdGhlIHVzZXIKbmFtZXNwYWNlIGludG8g dGhlIGZpbGVzeXN0ZW1zIHdoaWNoIGlzIGEgY2xlYW4gd2F5IGluc3RlYWQgb2YgdmlvbGF0aW5n CmNhbGxpbmcgY29udmVudGlvbnMgYnkgc3RyYXBwaW5nIHRoZSB1c2VyIG5hbWVzcGFjZSBpbmZv cm1hdGlvbiB0aGF0IGlzCmEgcHJvcGVydHkgb2YgdGhlIG1vdW50IHRvIHRoZSBjYWxsZXIncyBj cmVkZW50aWFscyBvciBzaW1pbGFyIGhhY2tzLgpFYWNoIG1vdW50IGNhbiBoYXZlIGEgc2VwYXJh dGUgaWRtYXBwaW5nIGFuZCBpZG1hcHBlZCBtb3VudHMgY2FuIGV2ZW4gYmUKY3JlYXRlZCBpbiB0 aGUgaW5pdGlhbCB1c2VyIG5hbWVzcGFjZSB1bmJsb2NraW5nIGEgcmFuZ2Ugb2YgdXNlLWNhc2Vz LgoKVG8gdGhpcyBlbmQgdGhlIHZmc21vdW50IHN0cnVjdCBnYWlucyBhIG5ldyBzdHJ1Y3QgdXNl cl9uYW1lc3BhY2UKbWVtYmVyLiBUaGUgaWRtYXBwaW5nIG9mIHRoZSB1c2VyIG5hbWVzcGFjZSBi ZWNvbWVzIHRoZSBpZG1hcHBpbmcgb2YgdGhlCm1vdW50LiBBIGNhbGxlciB0aGF0IGlzIHByaXZp bGVnZWQgd2l0aCByZXNwZWN0IHRvIHRoZSB1c2VyIG5hbWVzcGFjZSBvZgp0aGUgc3VwZXJibG9j ayBvZiB0aGUgdW5kZXJseWluZyBmaWxlc3lzdGVtIGNhbiBjcmVhdGUgYW4gaWRtYXBwZWQKbW91 bnQuIEluIHRoZSBmdXR1cmUsIHdlIGNhbiBlbmFibGUgdW5wcml2aWxlZ2VkIHVzZS1jYXNlcyBi eSBjaGVja2luZwp3aGV0aGVyIHRoZSBjYWxsZXIgaXMgcHJpdmlsZWdlZCB3cnQgdG8gdGhlIHVz ZXIgbmFtZXNwYWNlIHRoYXQgYW4KYWxyZWFkeSBpZG1hcHBlZCBtb3VudCBoYXMgYmVlbiBtYXJr ZWQgd2l0aCwgYWxsb3dpbmcgdGhlbSB0byBjaGFuZ2UgdGhlCmlkbWFwcGluZy4gRm9yIG5vdywg a2VlcCB0aGluZ3Mgc2ltcGxlIHVudGlsIHRoZSBuZWVkIGFyaXNlcy4KTm90ZSwgdGhhdCB3aXRo IHN5c2NhbGwgaW50ZXJjZXB0aW9uIGl0IGlzIGFscmVhZHkgcG9zc2libGUgdG8gaW50ZXJjZXB0 CmlkbWFwcGVkIG1vdW50IHJlcXVlc3RzIGZyb20gdW5wcml2aWxlZ2VkIGNvbnRhaW5lcnMgYW5k IGhhbmRsZSB0aGVtIGluCmEgc3VmZmljaWVudGx5IHByaXZpbGVnZWQgY29udGFpbmVyIG1hbmFn ZXIuIFN1cHBvcnQgZm9yIHRoaXMgaXMgYWxyZWFkeQphdmFpbGFibGUgaW4gTFhEIGFuZCB3aWxs IGJlIGF2YWlsYWJsZSBpbiBydW5DIHdoZXJlIHN5c2NhbGwKaW50ZXJjZXB0aW9uIGlzIGN1cnJl bnRseSBpbiB0aGUgcHJvY2VzcyBvZiBiZWNvbWluZyBwYXJ0IG9mIHRoZSBydW50aW1lCnNwZWM6 IGh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuY29udGFpbmVycy9ydW50aW1lLXNwZWMvcHVsbC8xMDc0 LgoKVGhlIHVzZXIgbmFtZXNwYWNlIHRoZSBtb3VudCB3aWxsIGJlIG1hcmtlZCB3aXRoIGNhbiBi ZSBzcGVjaWZpZWQgYnkKcGFzc2luZyBhIGZpbGUgZGVzY3JpcHRvciByZWZlcmluZyB0byB0aGUg dXNlciBuYW1lc3BhY2UgYXMgYW4gYXJndW1lbnQKdG8gdGhlIG5ldyBtb3VudF9zZXRhdHRyKCkg c3lzY2FsbCB0b2dldGhlciB3aXRoIHRoZSBuZXcKTU9VTlRfQVRUUl9JRE1BUCBmbGFnLiBCeSBk ZWZhdWx0IHZmc21vdW50cyBhcmUgbWFya2VkIHdpdGggdGhlIGluaXRpYWwKdXNlciBuYW1lc3Bh Y2UgYW5kIG5vIGJlaGF2aW9yYWwgb3IgcGVyZm9ybWFuY2UgY2hhbmdlcyBhcmUgb2JzZXJ2ZWQu CkFsbCBtYXBwaW5nIG9wZXJhdGlvbnMgYXJlIG5vcHMgZm9yIHRoZSBpbml0aWFsIHVzZXIgbmFt ZXNwYWNlLiBXaGVuIGEKZmlsZS9pbm9kZSBpcyBhY2Nlc3NlZCB0aHJvdWdoIGFuIGlkbWFwcGVk IG1vdW50IHRoZSBpX3VpZCBhbmQgaV9naWQgb2YKdGhlIGlub2RlIHdpbGwgYmUgcmVtYXBwZWQg YWNjb3JkaW5nIHRvIHRoZSB1c2VyIG5hbWVzcGFjZSB0aGUgbW91bnQgaGFzCmJlZW4gbWFya2Vk IHdpdGguCgpJbiBvcmRlciB0byBzdXBwb3J0IGlkbWFwcGVkIG1vdW50cywgZmlsZXN5c3RlbXMg bmVlZCB0byBiZSBjaGFuZ2VkIGFuZAptYXJrIHRoZW1zZWx2ZXMgd2l0aCB0aGUgRlNfQUxMT1df SURNQVAgZmxhZyBpbiBmc19mbGFncy4gVGhlIGluaXRpYWwKdmVyc2lvbiBjb250YWlucyBmYXQs IGV4dDQsIGFuZCB4ZnMgaW5jbHVkaW5nIGEgbGlzdCBvZiBleGFtcGxlcy4KQnV0IHBhdGNoZXMg Zm9yIG90aGVyIGZpbGVzeXN0ZW1zIGFyZSBhY3RpdmVseSB3b3JrZWQgb24gYW5kIHdpbGwgYmUK c2VudCBvdXQgc2VwYXJhdGVseS4gV2UgYXJlIGhlcmUgdG8gc2VlIHRoaXMgdGhyb3VnaCBhbmQg dGhlcmUgYXJlCm11bHRpcGxlIHBlb3BsZSBpbnZvbHZlZCBpbiBjb252ZXJ0aW5nIGZpbGVzeXN0 ZW1zLiBTbyBmaWxlc3lzdGVtCmRldmVsb3BlcnMgYXJlIG5vdCBsZWZ0IGFsb25lIHdpdGggdGhp cyBhbmQgYXJlIHByb3ZpZGVkIHdpdGggYSBsYXJnZQp0ZXN0c3VpdGUgdG8gdmVyaWZ5IHRoYXQg dGhlaXIgcG9ydCBpcyBjb3JyZWN0LgoKVGhlcmUgaXMgYSBzaW1wbGUgdG9vbCBhdmFpbGFibGUg YXQKaHR0cHM6Ly9naXRodWIuY29tL2JyYXVuZXIvbW91bnQtaWRtYXBwZWQgdGhhdCBhbGxvd3Mg dG8gY3JlYXRlIGlkbWFwcGVkCm1vdW50cyBzbyBwZW9wbGUgY2FuIHBsYXkgd2l0aCB0aGlzIHBh dGNoIHNlcmllcy4gSGVyZSBhcmUgYSBmZXcKaWxsdXN0cmF0aW9uczoKCjEuIENyZWF0ZSBhIHNp bXBsZSBpZG1hcHBlZCBtb3VudCBvZiBhbm90aGVyIHVzZXIncyBob21lIGRpcmVjdG9yeQoKdTEw MDFAZjItdm06LyQgc3VkbyAuL21vdW50LWlkbWFwcGVkIC0tbWFwLW1vdW50IGI6MTAwMDoxMDAx OjEgL2hvbWUvdWJ1bnR1LyAvbW50CnUxMDAxQGYyLXZtOi8kIGxzIC1hbCAvaG9tZS91YnVudHUv CnRvdGFsIDI4CmRyd3hyLXhyLXggMiB1YnVudHUgdWJ1bnR1IDQwOTYgT2N0IDI4IDIyOjA3IC4K ZHJ3eHIteHIteCA0IHJvb3QgICByb290ICAgNDA5NiBPY3QgMjggMDQ6MDAgLi4KLXJ3LS0tLS0t LSAxIHVidW50dSB1YnVudHUgMzE1NCBPY3QgMjggMjI6MTIgLmJhc2hfaGlzdG9yeQotcnctci0t ci0tIDEgdWJ1bnR1IHVidW50dSAgMjIwIEZlYiAyNSAgMjAyMCAuYmFzaF9sb2dvdXQKLXJ3LXIt LXItLSAxIHVidW50dSB1YnVudHUgMzc3MSBGZWIgMjUgIDIwMjAgLmJhc2hyYwotcnctci0tci0t IDEgdWJ1bnR1IHVidW50dSAgODA3IEZlYiAyNSAgMjAyMCAucHJvZmlsZQotcnctci0tci0tIDEg dWJ1bnR1IHVidW50dSAgICAwIE9jdCAxNiAxNjoxMSAuc3Vkb19hc19hZG1pbl9zdWNjZXNzZnVs Ci1ydy0tLS0tLS0gMSB1YnVudHUgdWJ1bnR1IDExNDQgT2N0IDI4IDAwOjQzIC52aW1pbmZvCnUx MDAxQGYyLXZtOi8kIGxzIC1hbCAvbW50Lwp0b3RhbCAyOApkcnd4ci14ci14ICAyIHUxMDAxIHUx MDAxIDQwOTYgT2N0IDI4IDIyOjA3IC4KZHJ3eHIteHIteCAyOSByb290ICByb290ICA0MDk2IE9j dCAyOCAyMjowMSAuLgotcnctLS0tLS0tICAxIHUxMDAxIHUxMDAxIDMxNTQgT2N0IDI4IDIyOjEy IC5iYXNoX2hpc3RvcnkKLXJ3LXItLXItLSAgMSB1MTAwMSB1MTAwMSAgMjIwIEZlYiAyNSAgMjAy MCAuYmFzaF9sb2dvdXQKLXJ3LXItLXItLSAgMSB1MTAwMSB1MTAwMSAzNzcxIEZlYiAyNSAgMjAy MCAuYmFzaHJjCi1ydy1yLS1yLS0gIDEgdTEwMDEgdTEwMDEgIDgwNyBGZWIgMjUgIDIwMjAgLnBy b2ZpbGUKLXJ3LXItLXItLSAgMSB1MTAwMSB1MTAwMSAgICAwIE9jdCAxNiAxNjoxMSAuc3Vkb19h c19hZG1pbl9zdWNjZXNzZnVsCi1ydy0tLS0tLS0gIDEgdTEwMDEgdTEwMDEgMTE0NCBPY3QgMjgg MDA6NDMgLnZpbWluZm8KdTEwMDFAZjItdm06LyQgdG91Y2ggL21udC9teS1maWxlCnUxMDAxQGYy LXZtOi8kIHNldGZhY2wgLW0gdToxMDAxOnJ3eCAvbW50L215LWZpbGUKdTEwMDFAZjItdm06LyQg c3VkbyBzZXRjYXAgLW4gMTAwMSBjYXBfbmV0X3JhdytlcCAvbW50L215LWZpbGUKdTEwMDFAZjIt dm06LyQgbHMgLWFsIC9tbnQvbXktZmlsZQotcnctcnd4ci0tKyAxIHUxMDAxIHUxMDAxIDAgT2N0 IDI4IDIyOjE0IC9tbnQvbXktZmlsZQp1MTAwMUBmMi12bTovJCBscyAtYWwgL2hvbWUvdWJ1bnR1 L215LWZpbGUKLXJ3LXJ3eHItLSsgMSB1YnVudHUgdWJ1bnR1IDAgT2N0IDI4IDIyOjE0IC9ob21l L3VidW50dS9teS1maWxlCnUxMDAxQGYyLXZtOi8kIGdldGZhY2wgL21udC9teS1maWxlCmdldGZh Y2w6IFJlbW92aW5nIGxlYWRpbmcgJy8nIGZyb20gYWJzb2x1dGUgcGF0aCBuYW1lcwojIGZpbGU6 IG1udC9teS1maWxlCiMgb3duZXI6IHUxMDAxCiMgZ3JvdXA6IHUxMDAxCnVzZXI6OnJ3LQp1c2Vy OnUxMDAxOnJ3eApncm91cDo6cnctCm1hc2s6OnJ3eApvdGhlcjo6ci0tCnUxMDAxQGYyLXZtOi8k IGdldGZhY2wgL2hvbWUvdWJ1bnR1L215LWZpbGUKZ2V0ZmFjbDogUmVtb3ZpbmcgbGVhZGluZyAn LycgZnJvbSBhYnNvbHV0ZSBwYXRoIG5hbWVzCiMgZmlsZTogaG9tZS91YnVudHUvbXktZmlsZQoj IG93bmVyOiB1YnVudHUKIyBncm91cDogdWJ1bnR1CnVzZXI6OnJ3LQp1c2VyOnVidW50dTpyd3gK Z3JvdXA6OnJ3LQptYXNrOjpyd3gKb3RoZXI6OnItLQoKMi4gQ3JlYXRlIG1hcHBpbmcgb2YgdGhl IHdob2xlIGV4dDQgcm9vdGZzIHdpdGhvdXQgYSBtYXBwaW5nIGZvciB1aWQgYW5kIGdpZCAwCgp1 YnVudHVAZjItdm06fiQgc3VkbyAvbW91bnQtaWRtYXBwZWQgLS1tYXAtbW91bnQgYjoxOjE6NjU1 MzYgLyAvbW50Lwp1YnVudHVAZjItdm06fiQgZmluZG1udCB8IGdyZXAgbW50CuKUlOKUgC9tbnQg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC9kZXYvc2RhMiAgZXh0NCAgICAgICBydyxy ZWxhdGltZQogIOKUlOKUgC9tbnQvbW50ICAgICAgICAgICAgICAgICAgICAgICAgICAvZGV2L3Nk YTIgIGV4dDQgICAgICAgcncscmVsYXRpbWUKdWJ1bnR1QGYyLXZtOn4kIHN1ZG8gbWtkaXIgL0FT LVJPT1QtQ0FOLUNSRUFURQp1YnVudHVAZjItdm06fiQgc3VkbyBta2RpciAvbW50L0FTLVJPT1Qt Q0FOVC1DUkVBVEUKbWtkaXI6IGNhbm5vdCBjcmVhdGUgZGlyZWN0b3J5IOKAmC9tbnQvQVMtUk9P VC1DQU5ULUNSRUFUReKAmTogVmFsdWUgdG9vIGxhcmdlIGZvciBkZWZpbmVkIGRhdGEgdHlwZQp1 YnVudHVAZjItdm06fiQgbWtkaXIgL21udC9ob21lL3VidW50dS9BUy1VU0VSLTEwMDAtQ0FOLUNS RUFURQoKMy4gQ3JlYXRlIGEgdmZhdCB1c2IgbW91bnQgYW5kIGV4cG9zZSB0byB1c2VyIDEwMDEg YW5kIDUwMDAKCnVidW50dUBmMi12bTovJCBzdWRvIG1vdW50IC9kZXYvc2RiIC9tbnQKdWJ1bnR1 QGYyLXZtOi8kIGZpbmRtbnQgIHwgZ3JlcCBtbnQK4pSU4pSAL21udCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgL2Rldi9zZGIgdmZhdCAgICAgICBydyxyZWxhdGltZSxmbWFzaz0wMDIy LGRtYXNrPTAwMjIsY29kZXBhZ2U9NDM3LGlvY2hhcnNldD1pc284ODU5LTEsc2hvcnRuYW1lPW1p eGVkLGVycm9ycz1yZW1vdW50LXJvCnVidW50dUBmMi12bTovJCBscyAtYWwgL21udAp0b3RhbCAx Mgpkcnd4ci14ci14ICAyIHJvb3Qgcm9vdCA0MDk2IEphbiAgMSAgMTk3MCAuCmRyd3hyLXhyLXgg MzQgcm9vdCByb290IDQwOTYgT2N0IDI4IDIyOjI0IC4uCi1yd3hyLXhyLXggIDEgcm9vdCByb290 ICAgIDQgT2N0IDI4IDAzOjQ0IGFhYQotcnd4ci14ci14ICAxIHJvb3Qgcm9vdCAgICAwIE9jdCAy OCAwMTowOSBiYmIKdWJ1bnR1QGYyLXZtOi8kIHN1ZG8gL21vdW50LWlkbWFwcGVkIC0tbWFwLW1v dW50IGI6MDoxMDAxOjEgL21udCAvbW50LTEwMDEvCnVidW50dUBmMi12bTovJCBscyAtYWwgL21u dC0xMDAxLwp0b3RhbCAxMgpkcnd4ci14ci14ICAyIHUxMDAxIHUxMDAxIDQwOTYgSmFuICAxICAx OTcwIC4KZHJ3eHIteHIteCAzNCByb290ICByb290ICA0MDk2IE9jdCAyOCAyMjoyNCAuLgotcnd4 ci14ci14ICAxIHUxMDAxIHUxMDAxICAgIDQgT2N0IDI4IDAzOjQ0IGFhYQotcnd4ci14ci14ICAx IHUxMDAxIHUxMDAxICAgIDAgT2N0IDI4IDAxOjA5IGJiYgp1YnVudHVAZjItdm06LyQgc3VkbyAv bW91bnQtaWRtYXBwZWQgLS1tYXAtbW91bnQgYjowOjUwMDA6MSAvbW50IC9tbnQtNTAwMC8KdWJ1 bnR1QGYyLXZtOi8kIGxzIC1hbCAvbW50LTUwMDAvCnRvdGFsIDEyCmRyd3hyLXhyLXggIDIgNTAw MCA1MDAwIDQwOTYgSmFuICAxICAxOTcwIC4KZHJ3eHIteHIteCAzNCByb290IHJvb3QgNDA5NiBP Y3QgMjggMjI6MjQgLi4KLXJ3eHIteHIteCAgMSA1MDAwIDUwMDAgICAgNCBPY3QgMjggMDM6NDQg YWFhCi1yd3hyLXhyLXggIDEgNTAwMCA1MDAwICAgIDAgT2N0IDI4IDAxOjA5IGJiYgoKNC4gQ3Jl YXRlIGFuIGlkbWFwcGVkIHJvb3RmcyBtb3VudCBmb3IgYSBjb250YWluZXIKCnJvb3RAZjItdm06 fiMgbHMgLWFsIC92YXIvbGliL2x4Yy9mMi9yb290ZnMvCnRvdGFsIDY4CmRyd3hyLXhyLXggMTcg MjAwMDAgMjAwMDAgNDA5NiBTZXAgMjQgMDc6NDggLgpkcnd4cnd4LS0tICAzIDIwMDAwIDIwMDAw IDQwOTYgT2N0IDE2IDE5OjI2IC4uCmxyd3hyd3hyd3ggIDEgMjAwMDAgMjAwMDAgICAgNyBTZXAg MjQgMDc6NDMgYmluIC0+IHVzci9iaW4KZHJ3eHIteHIteCAgMiAyMDAwMCAyMDAwMCA0MDk2IEFw ciAxNSAgMjAyMCBib290CmRyd3hyLXhyLXggIDMgMjAwMDAgMjAwMDAgNDA5NiBPY3QgMTYgMTk6 MjYgZGV2CmRyd3hyLXhyLXggNjEgMjAwMDAgMjAwMDAgNDA5NiBPY3QgMTYgMTk6MjYgZXRjCmRy d3hyLXhyLXggIDMgMjAwMDAgMjAwMDAgNDA5NiBTZXAgMjQgMDc6NDUgaG9tZQpscnd4cnd4cnd4 ICAxIDIwMDAwIDIwMDAwICAgIDcgU2VwIDI0IDA3OjQzIGxpYiAtPiB1c3IvbGliCmxyd3hyd3hy d3ggIDEgMjAwMDAgMjAwMDAgICAgOSBTZXAgMjQgMDc6NDMgbGliMzIgLT4gdXNyL2xpYjMyCmxy d3hyd3hyd3ggIDEgMjAwMDAgMjAwMDAgICAgOSBTZXAgMjQgMDc6NDMgbGliNjQgLT4gdXNyL2xp YjY0Cmxyd3hyd3hyd3ggIDEgMjAwMDAgMjAwMDAgICAxMCBTZXAgMjQgMDc6NDMgbGlieDMyIC0+ IHVzci9saWJ4MzIKZHJ3eHIteHIteCAgMiAyMDAwMCAyMDAwMCA0MDk2IFNlcCAyNCAwNzo0MyBt ZWRpYQpkcnd4ci14ci14ICAyIDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQzIG1udApkcnd4 ci14ci14ICAyIDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQzIG9wdApkcnd4ci14ci14ICAy IDIwMDAwIDIwMDAwIDQwOTYgQXByIDE1ICAyMDIwIHByb2MKZHJ3eC0tLS0tLSAgMiAyMDAwMCAy MDAwMCA0MDk2IFNlcCAyNCAwNzo0MyByb290CmRyd3hyLXhyLXggIDIgMjAwMDAgMjAwMDAgNDA5 NiBTZXAgMjQgMDc6NDUgcnVuCmxyd3hyd3hyd3ggIDEgMjAwMDAgMjAwMDAgICAgOCBTZXAgMjQg MDc6NDMgc2JpbiAtPiB1c3Ivc2Jpbgpkcnd4ci14ci14ICAyIDIwMDAwIDIwMDAwIDQwOTYgU2Vw IDI0IDA3OjQzIHNydgpkcnd4ci14ci14ICAyIDIwMDAwIDIwMDAwIDQwOTYgQXByIDE1ICAyMDIw IHN5cwpkcnd4cnd4cnd0ICAyIDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQ0IHRtcApkcnd4 ci14ci14IDEzIDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQzIHVzcgpkcnd4ci14ci14IDEy IDIwMDAwIDIwMDAwIDQwOTYgU2VwIDI0IDA3OjQ0IHZhcgpyb290QGYyLXZtOn4jIC9tb3VudC1p ZG1hcHBlZCAtLW1hcC1tb3VudCBiOjIwMDAwOjEwMDAwOjEwMDAwMCAvdmFyL2xpYi9seGMvZjIv cm9vdGZzLyAvbW50CnJvb3RAZjItdm06fiMgbHMgLWFsIC9tbnQKdG90YWwgNjgKZHJ3eHIteHIt eCAxNyAxMDAwMCAxMDAwMCA0MDk2IFNlcCAyNCAwNzo0OCAuCmRyd3hyLXhyLXggMzQgcm9vdCAg cm9vdCAgNDA5NiBPY3QgMjggMjI6MjQgLi4KbHJ3eHJ3eHJ3eCAgMSAxMDAwMCAxMDAwMCAgICA3 IFNlcCAyNCAwNzo0MyBiaW4gLT4gdXNyL2Jpbgpkcnd4ci14ci14ICAyIDEwMDAwIDEwMDAwIDQw OTYgQXByIDE1ICAyMDIwIGJvb3QKZHJ3eHIteHIteCAgMyAxMDAwMCAxMDAwMCA0MDk2IE9jdCAx NiAxOToyNiBkZXYKZHJ3eHIteHIteCA2MSAxMDAwMCAxMDAwMCA0MDk2IE9jdCAxNiAxOToyNiBl dGMKZHJ3eHIteHIteCAgMyAxMDAwMCAxMDAwMCA0MDk2IFNlcCAyNCAwNzo0NSBob21lCmxyd3hy d3hyd3ggIDEgMTAwMDAgMTAwMDAgICAgNyBTZXAgMjQgMDc6NDMgbGliIC0+IHVzci9saWIKbHJ3 eHJ3eHJ3eCAgMSAxMDAwMCAxMDAwMCAgICA5IFNlcCAyNCAwNzo0MyBsaWIzMiAtPiB1c3IvbGli MzIKbHJ3eHJ3eHJ3eCAgMSAxMDAwMCAxMDAwMCAgICA5IFNlcCAyNCAwNzo0MyBsaWI2NCAtPiB1 c3IvbGliNjQKbHJ3eHJ3eHJ3eCAgMSAxMDAwMCAxMDAwMCAgIDEwIFNlcCAyNCAwNzo0MyBsaWJ4 MzIgLT4gdXNyL2xpYngzMgpkcnd4ci14ci14ICAyIDEwMDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3 OjQzIG1lZGlhCmRyd3hyLXhyLXggIDIgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDMgbW50 CmRyd3hyLXhyLXggIDIgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDMgb3B0CmRyd3hyLXhy LXggIDIgMTAwMDAgMTAwMDAgNDA5NiBBcHIgMTUgIDIwMjAgcHJvYwpkcnd4LS0tLS0tICAyIDEw MDAwIDEwMDAwIDQwOTYgU2VwIDI0IDA3OjQzIHJvb3QKZHJ3eHIteHIteCAgMiAxMDAwMCAxMDAw MCA0MDk2IFNlcCAyNCAwNzo0NSBydW4KbHJ3eHJ3eHJ3eCAgMSAxMDAwMCAxMDAwMCAgICA4IFNl cCAyNCAwNzo0MyBzYmluIC0+IHVzci9zYmluCmRyd3hyLXhyLXggIDIgMTAwMDAgMTAwMDAgNDA5 NiBTZXAgMjQgMDc6NDMgc3J2CmRyd3hyLXhyLXggIDIgMTAwMDAgMTAwMDAgNDA5NiBBcHIgMTUg IDIwMjAgc3lzCmRyd3hyd3hyd3QgIDIgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDQgdG1w CmRyd3hyLXhyLXggMTMgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDMgdXNyCmRyd3hyLXhy LXggMTIgMTAwMDAgMTAwMDAgNDA5NiBTZXAgMjQgMDc6NDQgdmFyCnJvb3RAZjItdm06fiMgbHhj LXN0YXJ0IGYyICMgdXNlcyAvbW50IGFzIHJvb3Rmcwpyb290QGYyLXZtOn4jIGx4Yy1hdHRhY2gg ZjIgLS0gY2F0IC9wcm9jLzEvdWlkX21hcAogICAgICAgICAwICAgICAgMTAwMDAgICAgICAxMDAw MApyb290QGYyLXZtOn4jIGx4Yy1hdHRhY2ggZjIgLS0gY2F0IC9wcm9jLzEvZ2lkX21hcAogICAg ICAgICAwICAgICAgMTAwMDAgICAgICAxMDAwMApyb290QGYyLXZtOn4jIGx4Yy1hdHRhY2ggZjIg LS0gbHMgLWFsIC8KdG90YWwgNTIKZHJ3eHIteHIteCAgMTcgcm9vdCAgIHJvb3QgICAgNDA5NiBT ZXAgMjQgMDc6NDggLgpkcnd4ci14ci14ICAxNyByb290ICAgcm9vdCAgICA0MDk2IFNlcCAyNCAw Nzo0OCAuLgpscnd4cnd4cnd4ICAgMSByb290ICAgcm9vdCAgICAgICA3IFNlcCAyNCAwNzo0MyBi aW4gLT4gdXNyL2Jpbgpkcnd4ci14ci14ICAgMiByb290ICAgcm9vdCAgICA0MDk2IEFwciAxNSAg MjAyMCBib290CmRyd3hyLXhyLXggICA1IHJvb3QgICByb290ICAgICA1MDAgT2N0IDI4IDIzOjM5 IGRldgpkcnd4ci14ci14ICA2MSByb290ICAgcm9vdCAgICA0MDk2IE9jdCAyOCAyMzozOSBldGMK ZHJ3eHIteHIteCAgIDMgcm9vdCAgIHJvb3QgICAgNDA5NiBTZXAgMjQgMDc6NDUgaG9tZQpscnd4 cnd4cnd4ICAgMSByb290ICAgcm9vdCAgICAgICA3IFNlcCAyNCAwNzo0MyBsaWIgLT4gdXNyL2xp Ygpscnd4cnd4cnd4ICAgMSByb290ICAgcm9vdCAgICAgICA5IFNlcCAyNCAwNzo0MyBsaWIzMiAt PiB1c3IvbGliMzIKbHJ3eHJ3eHJ3eCAgIDEgcm9vdCAgIHJvb3QgICAgICAgOSBTZXAgMjQgMDc6 NDMgbGliNjQgLT4gdXNyL2xpYjY0Cmxyd3hyd3hyd3ggICAxIHJvb3QgICByb290ICAgICAgMTAg U2VwIDI0IDA3OjQzIGxpYngzMiAtPiB1c3IvbGlieDMyCmRyd3hyLXhyLXggICAyIHJvb3QgICBy b290ICAgIDQwOTYgU2VwIDI0IDA3OjQzIG1lZGlhCmRyd3hyLXhyLXggICAyIHJvb3QgICByb290 ICAgIDQwOTYgU2VwIDI0IDA3OjQzIG1udApkcnd4ci14ci14ICAgMiByb290ICAgcm9vdCAgICA0 MDk2IFNlcCAyNCAwNzo0MyBvcHQKZHIteHIteHIteCAyMzIgbm9ib2R5IG5vZ3JvdXAgICAgMCBP Y3QgMjggMjM6MzkgcHJvYwpkcnd4LS0tLS0tICAgMiByb290ICAgcm9vdCAgICA0MDk2IE9jdCAy OCAyMzo0MSByb290CmRyd3hyLXhyLXggIDEyIHJvb3QgICByb290ICAgICAzNjAgT2N0IDI4IDIz OjM5IHJ1bgpscnd4cnd4cnd4ICAgMSByb290ICAgcm9vdCAgICAgICA4IFNlcCAyNCAwNzo0MyBz YmluIC0+IHVzci9zYmluCmRyd3hyLXhyLXggICAyIHJvb3QgICByb290ICAgIDQwOTYgU2VwIDI0 IDA3OjQzIHNydgpkci14ci14ci14ICAxMyBub2JvZHkgbm9ncm91cCAgICAwIE9jdCAyOCAyMzoz OSBzeXMKZHJ3eHJ3eHJ3dCAgMTEgcm9vdCAgIHJvb3QgICAgNDA5NiBPY3QgMjggMjM6NDAgdG1w CmRyd3hyLXhyLXggIDEzIHJvb3QgICByb290ICAgIDQwOTYgU2VwIDI0IDA3OjQzIHVzcgpkcnd4 ci14ci14ICAxMiByb290ICAgcm9vdCAgICA0MDk2IFNlcCAyNCAwNzo0NCB2YXIKcm9vdEBmMi12 bTp+IyBseGMtYXR0YWNoIGYyIC0tIGxzIC1hbCAvbXktZmlsZQotcnctci0tci0tIDEgcm9vdCBy b290IDAgT2N0IDI4IDIzOjQzIC9teS1maWxlCnJvb3RAZjItdm06fiMgbHMgLWFsIC92YXIvbGli L2x4Yy9mMi9yb290ZnMvbXktZmlsZQotcnctci0tci0tIDEgMjAwMDAgMjAwMDAgMCBPY3QgMjgg MjM6NDMgL3Zhci9saWIvbHhjL2YyL3Jvb3Rmcy9teS1maWxlCgpJJ2QgbGlrZSB0byBzYXkgdGhh bmtzIHRvOgpBbCBmb3IgcG9pbnRpbmcgbWUgaW50byB0aGUgZGlyZWN0aW9uIHRvIGF2b2lkIGlu b2RlIGFsaWFzIGlzc3VlcyBkdXJpbmcKbG9va3VwLiBEYXZpZCBmb3IgdmFyaW91cyBkaXNjdXNz aW9ucyBhcm91bmQgdGhpcy4gQ2hyaXN0b3BoIGZvciBwb3J0aW5nCnhmcywgcHJvdmlkaW5nIGdv b2QgcmV2aWV3cyBhbmQgZm9yIGJlaW5nIGludm9sdmVkIGluIHRoZSBvcmlnaW5hbCBpZGVhLgpU eWNobyBmb3IgaGVscGluZyB3aXRoIHRoaXMgc2VyaWVzIGFuZCBvbiBmdXR1cmUgcGF0Y2hlcyB0 byBjb252ZXJ0CmZpbGVzeXN0ZW1zLiBBbGJhbiBDcmVxdXkgYW5kIHRoZSBLaW52b2xrIHBlZXBz IGxvY2F0ZWQganVzdCBhIGZldwpzdHJlZXRzIGF3YXkgZnJvbSBtZSBpbiBCZXJsaW4gZm9yIHBy b3ZpZGluZyB1c2UtY2FzZSBkaXNjdXNzaW9ucyBhbmQKd3JpdGluZyBwYXRjaGVzIGZvciBjb250 YWluZXJkLiBTdMOpcGhhbmUgZm9yIGhpcyBpbnZhbHVhYmxlIGlucHV0IG9uCm1hbnkgdGhpbmdz IGFuZCBsZXZlbCBoZWFkIGFuZCBlbmFibGluZyBtZSB0byB3b3JrIG9uIHRoaXMuIEFtaXIgZm9y CmV4cGxhaW5pbmcgYW5kIGRpc2N1c3NpbmcgYXNwZWN0cyBvZiBvdmVybGF5ZnMgd2l0aCBtZS4g SSdkIGxpa2UgdG8KZXNwZWNpYWxseSB0aGFuayBTZXRoIEZvcnNoZWUuIEhlIHByb3ZpZGVkIGEg bG90IG9mIGdvb2QgYW5hbHlzaXMsCnN1Z2dlc3Rpb25zLCBhbmQgcGFydGljaXBhdGVkIGluIHNo b3J0LW5vdGljZSBkaXNjdXNzaW9ucyBpbiBib3RoIGNoYXQKYW5kIHZpZGVvIGZvciBzb21lIG5p dHR5LWdyaXR0eSB0ZWNobmljYWwgZGV0YWlscy4KClRoaXMgc2VyaWVzIGNhbiBiZSBmb3VuZCBh bmQgcHVsbGVkIGZyb20gdGhlIHRocmVlIHVzdWFsIGxvY2F0aW9uczoKaHR0cHM6Ly9naXQua2Vy bmVsLm9yZy9wdWIvc2NtL2xpbnV4L2tlcm5lbC9naXQvYnJhdW5lci9saW51eC5naXQvbG9nLz9o PWlkbWFwcGVkX21vdW50cwpodHRwczovL2dpdGh1Yi5jb20vYnJhdW5lci9saW51eC90cmVlL2lk bWFwcGVkX21vdW50cwpodHRwczovL2dpdGxhYi5jb20vYnJhdW5lci9saW51eC8tL2NvbW1pdHMv aWRtYXBwZWRfbW91bnRzCgovKiB2NSAqLwotIEFkcmVzcyBDaHJpc3RvcGgncyBmZWVkYmFjay4K LSBVc2UgdjUuMTEtcmMzIGFzIG5ldyBiYXNlLgotIEFkZCBDaHJpc3RvcGgncyB4ZnMgcG9ydC4K Ci8qIHY0ICovCi0gU3BsaXQgb3V0IHNldmVyYWwgcHJlcGFyYXRvcnkgcGF0Y2hlcyBmcm9tIHRo ZSBpbml0aWFsIG1vdW50X3NldGF0dHIKICBwYXRjaCBhcyByZXF1ZXN0ZWQgYnkgQ2hyaXN0b3Bo LgotIEFkZCBuZXcgdGVzdHMgZm9yIGZpbGUvZGlyZWN0b3J5IGNyZWF0aW9uIGluIGRpcmVjdG9y aWVzIHdpdGggdGhlCiAgc2V0Z2lkIGJpdCBzZXQuIFNwZWNpZmljYWxseSwgdmVyaWZ5IHRoYXQg dGhlIHNldGdpZCBiaXQgaXMgY29ycmVjdGx5CiAgaWdub3JlZCB3aGVuIGNyZWF0aW5nIGEgZmls ZSB3aXRoIHRoZSBzZXRnaWQgYml0IGFuZCB0aGUgcGFyZW50CiAgZGlyZWN0b3J5J3MgaV9naWQg aXNuJ3QgaW5fZ3JvdXBfcCgpIGFuZCB0aGUgY2FsbGVyIGlzbid0CiAgY2FwYWJsZV93cnRfaW5v ZGVfdWlkZ2lkKCkgb3ZlciB0aGUgcGFyZW50IGRpcmVjdG9yeSdzIGlub2RlIHdoZW4KICBpbm9k ZV9pbml0X293bmVyKCkgaXMgY2FsbGVkLgogIENvbnZlcnNlbHksIHZlcmlmeSB0aGF0IHRoZSBz ZXRnaWQgYml0IGlzIHNldCB3aGVuIGNyZWF0aW5nIGEgZmlsZQogIHdpdGggdGhlIHNldGdpZCBi aXQgYW5kIHRoZSBwYXJlbnQncyBpX2dpZCBpcyBlaXRoZXIgaW5fZ3JvdXBfcCgpIG9yCiAgdGhl IGNhbGxlciBpcyBjYXBhYmxlX3dydF9pbm9kZV91aWRnaWQoKSBvdmVyIHRoZSBwYXJlbnQgZGly ZWN0b3J5J3MKICBpbm9kZS4gSW4gYWRkaXRpb25hLCB2ZXJpZnkgdGhhdCB0aGUgc2V0Z2lkIGJp dCBpcyBhbHdheXMgaW5oZXJpdGVkCiAgd2hlbiBjcmVhdGluZyBkaXJlY3Rvcmllcy4KICBUZXN0 IGFsbCBvZiB0aGlzIG9uIHJlZ3VsYXIgbW91bnRzLCBpZG1hcHBlZCBtb3VudHMsIGFuZCBvbiBp ZG1hcHBlZAogIG1vdW50cyBpbiB1c2VyIG5hbWVzcGFjZXMuCi0gQWRkIG5ldyB0ZXN0cyB0byB2 ZXJpZnkgdGhhdCB0aGUgaV9naWQgb2YgbmV3bHkgY3JlYXRlZCBmaWxlcyBvcgogIGRpcmVjdG9y aWVzIGlzIGNvcnJlY3RseSBzZXQgdG8gdGhlIHBhcmVudCBkaXJlY3RvcnkncyBpX2dpZCB3aGVu IHRoZQogIHBhcmVudCBkaXJlY3RvcnkgaGFzIHRoZSBzZXRnaWQgYml0IHNldC4KLSBVc2UgIm1u dF91c2VybnMiIGFzIHRoZSBkZSBmYWN0byBuYW1lIGZvciBhIHZmc21vdW50J3MgdXNlciBuYW1l c3BhY2UKICBldmVyeXdoZXJlIGFzIHN1Z2dlc3RlZCBieSBTZXJnZS4KLSBSZXVzZSBleGlzdGlu ZyBwcm9wYWdhdGlvbiBmbGFncyBpbnN0ZWFkIG9mIGludHJvZHVjaW5nIG5ldyBvbmVzIGFzCiAg c3VnZ2VzdGVkIGJ5IENocmlzdG9waC4gKFRoaXMgaXMgaW4gbGluZSB3aXRoIExpbnVzIHJlcXVl c3QgdG8gbm90CiAgaW50cm9kdWNlIHRvbyBtYW55IG5ldyBmbGFncyBhcyBldmlkZW5jZWQgYnkg cHJpb3IgZGlzY3Vzc2lvbnMgb24KICBvdGhlciBwYXRjaHNldHMgc3VjaCBhcyBvcGVuYXQyKCku KQotIEFkZCBmaXJzdCBzZXQgb2YgQWNrZWQtYnlzIGZyb20gU2VyZ2UgYW5kIFJldmlld2VkLWJ5 cyBmcm9tIENocmlzdG9waC4KLSBGaXggY29tbWl0IG1lc3NhZ2VzIHRvIHJlZmxlY3QgdGhlIGZh Y3QgdGhhdCB3ZSBtb2RpZnkgZXhpc3RpbmcKICB2ZnMgaGVscGVycyBidXQgZG8gbm90IGludHJv ZHVjZSBuZXcgb25lcyBsaWtlIHdlIGRpZCBpbiB0aGUgZmlyc3QKICB2ZXJzaW9uLiBTb21lIGNv bW1pdCBtZXNzYWdlcyBzdGlsbCBpbXBsaWVkIHdlIHdlcmUgYWRkaW5nIG5ldwogIGhlbHBlcnMu Ci0gUmVmb3JtYXQgYWxsIGNvbW1pdCBtZXNzYWdlcyB0byBhZGhlcmUgdG8gNzMgY2hhciBsZW5n dGggbGltaXQgYW5kCiAgd3JhcCBhbGwgbGluZXMgaW4gY29tbWl0cyBhdCA4MCBjaGFycyB3aGVu ZXZlciB0aGlzIGRvZXNuJ3QgaGluZGVyCiAgbGVnaWJpbGl0eS4KLSBTaW1wbGlmeSB2YXJpb3Vz IGNvZGVwYXRocyB3aXRoIENocmlzdG9waCdzIHN1Z2dlc3Rpb25zLgoKLyogdjMgKi8KLSBUaGUg bWFqb3IgY2hhbmdlIGlzIHRoZSBwb3J0IG9mIHRoZSB0ZXN0LXN1aXRlIGZyb20gdGhlCiAga2Vy bmVsLWludGVybmFsIHNlbGZ0ZXN0cyBmcmFtZXdvcmsgdG8geGZzdGVzdHMgYXMgcmVxdWVzdGVk IGJ5CiAgRGFycmljayBhbmQgQ2hyaXN0b3BoLiBUaGUgdGVzdC1zdWl0ZSBmb3IgeGZzdGVzdHMg aXMgcGF0Y2ggMzggaW4gdGhpcwogIHNlcmllcy4gSXQgaGFzIGJlZW4ga2VwdCBhcyBwYXJ0IG9m IHRoaXMgc2VyaWVzIGV2ZW4gdGhvdWdoIGl0IGJlbG9uZ3MKICB0byB4ZnN0ZXN0cyBzbyBpdCdz IGVhc2llciB0byBzZWUgd2hhdCBpcyB0ZXN0ZWQgYW5kIHRvIGtlZXAgaXQKICBpbi1zeW5jLgot IE5vdGUsIHRoZSB0ZXN0LXN1aXRlIG5vdyBoYXMgYmVlbiBleHRlbmRlZCB0byBjb3ZlciBpb191 cmluZyBhbmQKICBpZG1hcHBlZCBtb3VudHMuIFRoZSBJT1JJTkdfUkVHSVNURVJfUEVSU09OQUxJ VFkgZmVhdHVyZSBhbGxvd3MgdG8KICByZWdpc3RlciB0aGUgY2FsbGVyJ3MgY3JlZGVudGlhbHMg d2l0aCBpb191cmluZyBhbmQgcmV0dXJucyBhbiBpZAogIGFzc29jaWF0ZWQgd2l0aCB0aGVzZSBj cmVkZW50aWFscy4gVGhpcyBpcyB1c2VmdWwgZm9yIGFwcGxpY2F0aW9ucwogIHRoYXQgd2lzaCB0 byBzaGFyZSBhIHJpbmcgYmV0d2VlbiBzZXBhcmF0ZSB1c2Vycy9wcm9jZXNzZXMuIENhbGxlcnMK ICBjYW4gcGFzcyBpbiB0aGUgY3JlZGVudGlhbCBpZCBpbiB0aGUgc3FlIHBlcnNvbmFsaXR5IGZp ZWxkLiBJZiBzZXQsCiAgdGhhdCBwYXJ0aWN1bGFyIHNxZSB3aWxsIGJlIGlzc3VlZCB3aXRoIHRo ZXNlIGNyZWRlbnRpYWxzLgogIFRoZSB0ZXN0LXN1aXRlIG5vdyB0ZXN0cyB0aGF0IHRoZSBvcGVu YXQqIG9wZXJhdGlvbnMgd2l0aCBkaWZmZXJlbnQKICByZWdpc3RlcmVkIGNyZWRlbnRpYWxzIHdv cmsgY29ycmVjdGx5IGFuZCBzYWZlbHkgb24gcmVndWxhciBtb3VudHMsIG9uCiAgcmVndWxhciBt b3VudHMgaW5zaWRlIHVzZXIgbmFtZXNwYWNlcywgb24gaWRtYXBwZWQgbW91bnRzLCBhbmQgb24K ICBpZG1hcHBlZCBtb3VudHMgaW5zaWRlIHVzZXIgbmFtZXNwYWNlcy4KCi8qIHYyICovCi0gVGhl IG1ham9yIGNoYW5nZSBpcyB0aGUgcmV3b3JrIHJlcXVlc3RlZCBieSBDaHJpc3RvcGggYW5kIG90 aGVycyB0bwogIGFkYXB0IGFsbCByZWxldmFudCBoZWxwZXJzIGFuZCBpbm9kZV9vcGVyYXRpb25z IG1ldGhvZHMgdG8gYWNjb3VudCBmb3IKICBpZG1hcHBlZCBtb3VudHMgaW5zdGVhZCBvZiBpbnRy b2R1Y2luZyBuZXcgaGVscGVycyBhbmQgbWV0aG9kcwogIHNwZWNpZmljIHRvIGlkbWFwcGVkIG1v dW50cyBsaWtlIHdlIGRpZCBiZWZvcmUuIFdlJ3ZlIGFsc28gbW92ZWQgdGhlCiAgb3ZlcmxheWZz IGNvbnZlcnNpb24gdG8gaGFuZGxlIGlkbWFwcGVkIG1vdW50cyBpbnRvIGEgc2VwYXJhdGUKICBw YXRjaHNldCB0aGF0IHdpbGwgYmUgc2VudCBvdXQgc2VwYXJhdGVseSBhZnRlciB0aGUgY29yZSBj aGFuZ2VzCiAgbGFuZGVkLiBUaGUgY29udmVydGVkIGZpbGVzeXRlbXMgaW4gdGhpcyBzZXJpZXMg aW5jbHVkZSBmYXQgYW5kIGV4dDQuCiAgQXMgcGVyIENocmlzdG9waCdzIHJlcXVlc3QgdGhlIHZm cy13aWRlIGNvbmZpZyBvcHRpb24gdG8gZGlzYWJsZQogIGlkbWFwcGVkIG1vdW50cyBoYXMgYmVl biByZW1vdmVkLiBJbnN0ZWFkIHRoZSBmaWxlc3lzdGVtcyBjYW4gZGVjaWRlCiAgd2hldGhlciBv ciBub3QgdGhleSB3YW50IHRvIGFsbG93IGlkbWFwIG1vdW50cyB0aHJvdWdoIGEgY29uZmlnCiAg b3B0aW9uLiBUaGVzZSBjb25maWcgb3B0aW9ucyBkZWZhdWx0IHRvIG9mZi4gSGF2aW5nIGEgY29u ZmlnIG9wdGlvbgogIGFsbG93cyB1cyB0byBnYWluIHNvbWUgY29uZmlkZW5jZSBpbiB0aGUgcGF0 Y2hzZXQgb3ZlciBtdWx0aXBsZSBrZXJuZWwKICByZWxlYXNlcy4KLSBUaGlzIHZlcnNpb24gaW50 cm9kdWNlcyBhIGxhcmdlIHRlc3Qtc3VpdGUgdG8gdGVzdCBjdXJyZW50IHZmcwogIGJlaGF2aW9y IGFuZCBpZG1hcHBlZCBtb3VudHMgYmVoYXZpb3IuIFRoaXMgdGVzdC1zdWl0ZSBpcyBpbnRlbmRl ZCB0bwogIGdyb3cgb3ZlciB0aW1lLgotIFdoaWxlIHdoaWxlIHdvcmtpbmcgb24gYWRhcHRpbmcg dGhpcyBwYXRjaHNldCB0byB0aGUgcmVxdWVzdGVkCiAgY2hhbmdlcywgdGhlIHJ1bkMgYW5kIGNv bnRhaW5lcmQgY3Jvd2Qgd2FzIG5pY2UgZW5vdWdoIHRvIGFkYXB0CiAgY29udGFpbmVyZCB0byB0 aGlzIHBhdGNoc2V0IHRvIG1ha2UgdXNlIG9mIGlkbWFwcGVkIG1vdW50cyBpbiBvbmUgb2YKICB0 aGUgbW9zdCB3aWRlbHkgdXNlZCBjb250YWluZXIgcnVudGltZXM6CiAgaHR0cHM6Ly9naXRodWIu Y29tL2NvbnRhaW5lcmQvY29udGFpbmVyZC9wdWxsLzQ3MzQKClRoZSBzb2x1dGlvbiBwcm9wb3Nl ZCBoZXJlIGhhcyBpdCdzIG9yaWdpbnMgaW4gbXVsdGlwbGUgZGlzY3Vzc2lvbnMKZHVyaW5nIExp bnV4IFBsdW1iZXJzIDIwMTcgZHVyaW5nIGFuZCBhZnRlciB0aGUgZW5kIG9mIHRoZSBjb250YWlu ZXJzCm1pY3JvY29uZmVyZW5jZS4KVG8gdGhlIGJlc3Qgb2YgbXkga25vd2xlZGdlIHRoaXMgaW52 b2x2ZWQgQWxla3NhLCBTdMOpcGhhbmUsIEVyaWMsIERhdmlkLApKYW1lcywgYW5kIG15c2VsZi5U aGUgb3JpZ2luYWwgaWRlYSBvciBhIHZhcmlhbnQgdGhlcmVvZiBoYXMgYmVlbgpkaXNjdXNzZWQs IGFnYWluIHRvIHRoZSBiZXN0IG9mIG15IGtub3dsZWRnZSwgYWZ0ZXIgYSBMaW51eCBjb25mZXJl bmNlCmluIFN0LiBQZXRlcnNidXJnIGluIFJ1c3NpYSBpbiAyMDE3IGJldHdlZW4gQ2hyaXN0b3Bo LCBUeWNobywgYW5kCm15c2VsZi4KV2UndmUgdGFrZW4gdGhlIHRpbWUgdG8gaW1wbGVtZW50IGEg d29ya2luZyB2ZXJzaW9uIG9mIHRoaXMgc29sdXRpb24Kb3ZlciB0aGUgbGFzdCB3ZWVrcyB0byB0 aGUgYmVzdCBvZiBteSBhYmlsaXRpZXMuIFR5Y2hvIGhhcyBzaWduZWQgdXAKZm9yIHRoaXMgc2xp Z3RobHkgY3JhenkgZW5kZWF2b3VyIGFzIHdlbGwgYW5kIGhlIGhhcyBoZWxwZWQgd2l0aCB0aGUK Y29udmVyc2lvbiBvZiB0aGUgeGF0dHIgY29kZXBhdGhzIGFuZCB3aWxsIGJlIGludm9sdmVkIHdp dGggb3RoZXJzIGluCmNvbnZlcnRpbmcgYWRkaXRpb25hbCBmaWxlc3lzdGVtcy4KClRoYW5rcyEK Q2hyaXN0aWFuCgpDaHJpc3RpYW4gQnJhdW5lciAoMzkpOgogIG5hbWVzcGFjZTogdGFrZSBsb2Nr X21vdW50X2hhc2goKSBkaXJlY3RseSB3aGVuIGNoYW5naW5nIGZsYWdzCiAgbW91bnQ6IG1ha2Ug e2xvY2ssdW5sb2NrfV9tb3VudF9oYXNoKCkgc3RhdGljCiAgbmFtZXNwYWNlOiBvbmx5IHRha2Ug cmVhZCBsb2NrIGluIGRvX3JlY29uZmlndXJlX21udCgpCiAgZnM6IHNwbGl0IG91dCBmdW5jdGlv bnMgdG8gaG9sZCB3cml0ZXJzCiAgZnM6IGFkZCBhdHRyX2ZsYWdzX3RvX21udF9mbGFncyBoZWxw ZXIKICBmczogYWRkIG1vdW50X3NldGF0dHIoKQogIHRlc3RzOiBhZGQgbW91bnRfc2V0YXR0cigp IHNlbGZ0ZXN0cwogIGZzOiBhZGQgaWQgdHJhbnNsYXRpb24gaGVscGVycwogIG1vdW50OiBhdHRh Y2ggbWFwcGluZ3MgdG8gbW91bnRzCiAgY2FwYWJpbGl0eTogaGFuZGxlIGlkbWFwcGVkIG1vdW50 cwogIG5hbWVpOiBtYWtlIHBlcm1pc3Npb24gaGVscGVycyBpZG1hcHBlZCBtb3VudCBhd2FyZQog IGlub2RlOiBtYWtlIGluaXQgYW5kIHBlcm1pc3Npb24gaGVscGVycyBpZG1hcHBlZCBtb3VudCBh d2FyZQogIGF0dHI6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBhY2w6IGhhbmRsZSBpZG1hcHBl ZCBtb3VudHMKICBmczogYWRkIGZpbGVfdXNlcl9ucygpIGhlbHBlcgogIGNvbW1vbmNhcDogaGFu ZGxlIGlkbWFwcGVkIG1vdW50cwogIHN0YXQ6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBuYW1l aTogaGFuZGxlIGlkbWFwcGVkIG1vdW50cyBpbiBtYXlfKigpIGhlbHBlcnMKICBuYW1laTogaW50 cm9kdWNlIHN0cnVjdCByZW5hbWVkYXRhCiAgbmFtZWk6IHByZXBhcmUgZm9yIGlkbWFwcGVkIG1v dW50cwogIG9wZW46IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMgaW4gZG9fdHJ1bmNhdGUoKQogIG9w ZW46IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBhZl91bml4OiBoYW5kbGUgaWRtYXBwZWQgbW91 bnRzCiAgdXRpbWVzOiBoYW5kbGUgaWRtYXBwZWQgbW91bnRzCiAgZmNudGw6IGhhbmRsZSBpZG1h cHBlZCBtb3VudHMKICBub3RpZnk6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICBpbml0OiBoYW5k bGUgaWRtYXBwZWQgbW91bnRzCiAgaW9jdGw6IGhhbmRsZSBpZG1hcHBlZCBtb3VudHMKICB3b3Vs ZF9kdW1wOiBoYW5kbGUgaWRtYXBwZWQgbW91bnRzCiAgZXhlYzogaGFuZGxlIGlkbWFwcGVkIG1v dW50cwogIGZzOiBtYWtlIGhlbHBlcnMgaWRtYXAgbW91bnQgYXdhcmUKICBhcHBhcm1vcjogaGFu ZGxlIGlkbWFwcGVkIG1vdW50cwogIGltYTogaGFuZGxlIGlkbWFwcGVkIG1vdW50cwogIGZhdDog aGFuZGxlIGlkbWFwcGVkIG1vdW50cwogIGV4dDQ6IHN1cHBvcnQgaWRtYXBwZWQgbW91bnRzCiAg ZWNyeXB0ZnM6IGRvIG5vdCBtb3VudCBvbiB0b3Agb2YgaWRtYXBwZWQgbW91bnRzCiAgb3Zlcmxh eWZzOiBkbyBub3QgbW91bnQgb24gdG9wIG9mIGlkbWFwcGVkIG1vdW50cwogIGZzOiBpbnRyb2R1 Y2UgTU9VTlRfQVRUUl9JRE1BUAogIHRlc3RzOiBleHRlbmQgbW91bnRfc2V0YXR0ciB0ZXN0cwoK Q2hyaXN0b3BoIEhlbGx3aWcgKDEpOgogIHhmczogc3VwcG9ydCBpZG1hcHBlZCBtb3VudHMKClR5 Y2hvIEFuZGVyc2VuICgxKToKICB4YXR0cjogaGFuZGxlIGlkbWFwcGVkIG1vdW50cwoKIERvY3Vt ZW50YXRpb24vZmlsZXN5c3RlbXMvbG9ja2luZy5yc3QgICAgICAgICB8ICAgIDYgKy0KIERvY3Vt ZW50YXRpb24vZmlsZXN5c3RlbXMvcG9ydGluZy5yc3QgICAgICAgICB8ICAgIDIgKwogRG9jdW1l bnRhdGlvbi9maWxlc3lzdGVtcy92ZnMucnN0ICAgICAgICAgICAgIHwgICAxOSArLQogYXJjaC9h bHBoYS9rZXJuZWwvc3lzY2FsbHMvc3lzY2FsbC50YmwgICAgICAgIHwgICAgMSArCiBhcmNoL2Fy bS90b29scy9zeXNjYWxsLnRibCAgICAgICAgICAgICAgICAgICAgfCAgICAxICsKIGFyY2gvYXJt NjQvaW5jbHVkZS9hc20vdW5pc3RkMzIuaCAgICAgICAgICAgICB8ICAgIDIgKwogYXJjaC9pYTY0 L2tlcm5lbC9zeXNjYWxscy9zeXNjYWxsLnRibCAgICAgICAgIHwgICAgMSArCiBhcmNoL202OGsv a2VybmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgICAgfCAgICAxICsKIGFyY2gvbWljcm9i bGF6ZS9rZXJuZWwvc3lzY2FsbHMvc3lzY2FsbC50YmwgICB8ICAgIDEgKwogYXJjaC9taXBzL2tl cm5lbC9zeXNjYWxscy9zeXNjYWxsX24zMi50YmwgICAgIHwgICAgMSArCiBhcmNoL21pcHMva2Vy bmVsL3N5c2NhbGxzL3N5c2NhbGxfbjY0LnRibCAgICAgfCAgICAxICsKIGFyY2gvbWlwcy9rZXJu ZWwvc3lzY2FsbHMvc3lzY2FsbF9vMzIudGJsICAgICB8ICAgIDEgKwogYXJjaC9wYXJpc2Mva2Vy bmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgIHwgICAgMSArCiBhcmNoL3Bvd2VycGMva2Vy bmVsL3N5c2NhbGxzL3N5c2NhbGwudGJsICAgICAgfCAgICAxICsKIGFyY2gvcG93ZXJwYy9wbGF0 Zm9ybXMvY2VsbC9zcHVmcy9pbm9kZS5jICAgICB8ICAgIDUgKy0KIGFyY2gvczM5MC9rZXJuZWwv c3lzY2FsbHMvc3lzY2FsbC50YmwgICAgICAgICB8ICAgIDEgKwogYXJjaC9zaC9rZXJuZWwvc3lz Y2FsbHMvc3lzY2FsbC50YmwgICAgICAgICAgIHwgICAgMSArCiBhcmNoL3NwYXJjL2tlcm5lbC9z eXNjYWxscy9zeXNjYWxsLnRibCAgICAgICAgfCAgICAxICsKIGFyY2gveDg2L2VudHJ5L3N5c2Nh bGxzL3N5c2NhbGxfMzIudGJsICAgICAgICB8ICAgIDEgKwogYXJjaC94ODYvZW50cnkvc3lzY2Fs bHMvc3lzY2FsbF82NC50YmwgICAgICAgIHwgICAgMSArCiBhcmNoL3h0ZW5zYS9rZXJuZWwvc3lz Y2FsbHMvc3lzY2FsbC50YmwgICAgICAgfCAgICAxICsKIGRyaXZlcnMvYW5kcm9pZC9iaW5kZXJm cy5jICAgICAgICAgICAgICAgICAgICB8ICAgIDYgKy0KIGRyaXZlcnMvYmFzZS9kZXZ0bXBmcy5j ICAgICAgICAgICAgICAgICAgICAgICB8ICAgMTIgKy0KIGZzLzlwL2FjbC5jICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDggKy0KIGZzLzlwL3Y5ZnMuaCAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzLzlwL3Y5ZnNfdmZzLmggICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDIgKy0KIGZzLzlwL3Zmc19pbm9kZS5jICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8ICAgMzYgKy0KIGZzLzlwL3Zmc19pbm9kZV9kb3RsLmMg ICAgICAgICAgICAgICAgICAgICAgICB8ICAgMzkgKy0KIGZzLzlwL3hhdHRyLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvYWRmcy9hZGZzLmggICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgMyArLQogZnMvYWRmcy9pbm9kZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgNSArLQogZnMvYWZmcy9hZmZzLmggICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAxMCArLQogZnMvYWZmcy9pbm9kZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgNyArLQogZnMvYWZmcy9uYW1laS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAxNSArLQogZnMvYWZzL2Rpci5jICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAzNCArLQogZnMvYWZzL2lub2RlLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgOSArLQogZnMvYWZzL2ludGVybmFsLmggICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgNyArLQogZnMvYWZzL3NlY3VyaXR5LmMgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgMiArLQogZnMvYWZzL3hhdHRyLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwgICAgMiArCiBmcy9hdHRyLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgMTI0ICstCiBmcy9hdXRvZnMvcm9vdC5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDEzICstCiBmcy9iYWRfaW5vZGUuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDM2ICstCiBmcy9iZnMvZGlyLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDEyICstCiBmcy9idHJmcy9hY2wuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICA1ICstCiBmcy9idHJmcy9jdHJlZS5oICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAzICstCiBmcy9idHJmcy9pbm9kZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDQ1ICstCiBmcy9idHJmcy9pb2N0bC5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgIDI1ICstCiBmcy9idHJmcy90ZXN0cy9idHJmcy10ZXN0 cy5jICAgICAgICAgICAgICAgICAgfCAgICAyICstCiBmcy9idHJmcy94YXR0ci5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAgICAyICsKIGZzL2NhY2hlZmlsZXMvaW50ZXJmYWNlLmMg ICAgICAgICAgICAgICAgICAgICB8ICAgIDQgKy0KIGZzL2NhY2hlZmlsZXMvbmFtZWkuYyAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgMTkgKy0KIGZzL2NhY2hlZmlsZXMveGF0dHIuYyAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgMTYgKy0KIGZzL2NlcGgvYWNsLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2NlcGgvZGlyLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgMjMgKy0KIGZzL2NlcGgvaW5vZGUuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgMTcgKy0KIGZzL2NlcGgvc3VwZXIuaCAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgMTIgKy0KIGZzL2NlcGgveGF0dHIuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvY2lmcy9jaWZzZnMuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAgNCArLQogZnMvY2lmcy9jaWZzZnMuaCAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAyMSArLQogZnMvY2lmcy9kaXIuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAgOCArLQogZnMvY2lmcy9pbm9kZS5jICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAyNiArLQogZnMvY2lmcy9saW5rLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAgMyArLQogZnMvY2lmcy94YXR0ci5jICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAgMSArCiBmcy9jb2RhL2NvZGFfbGludXguaCAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA2ICstCiBmcy9jb2RhL2Rpci5jICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgIDE3ICstCiBmcy9jb2RhL2lub2RlLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA5ICstCiBmcy9jb2RhL3Bpb2N0bC5jICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA2ICstCiBmcy9jb25maWdmcy9jb25maWdmc19pbnRlcm5h bC5oICAgICAgICAgICAgICAgfCAgICA3ICstCiBmcy9jb25maWdmcy9kaXIuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICAzICstCiBmcy9jb25maWdmcy9pbm9kZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA1ICstCiBmcy9jb25maWdmcy9zeW1saW5rLmMgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA1ICstCiBmcy9jb3JlZHVtcC5jICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgIDE0ICstCiBmcy9jcnlwdG8vcG9saWN5LmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICAyICstCiBmcy9kZWJ1Z2ZzL2lub2RlLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA5ICstCiBmcy9lY3J5cHRmcy9jcnlwdG8uYyAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA0ICstCiBmcy9lY3J5cHRmcy9pbm9kZS5jICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgIDgwICstCiBmcy9lY3J5cHRmcy9tYWluLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfCAgICA2ICsKIGZzL2VjcnlwdGZzL21tYXAuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDQgKy0KIGZzL2VmaXZhcmZzL2ZpbGUuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDIgKy0KIGZzL2VmaXZhcmZzL2lub2RlLmMgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDQgKy0KIGZzL2Vyb2ZzL2lub2RlLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDcgKy0KIGZzL2Vyb2ZzL2ludGVybmFsLmggICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2V4ZWMuYyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTIgKy0KIGZzL2V4ZmF0L2V4ZmF0X2ZzLmggICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDggKy0KIGZzL2V4ZmF0L2ZpbGUuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTQgKy0KIGZzL2V4ZmF0L25hbWVpLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTQgKy0KIGZzL2V4dDIvYWNsLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2V4dDIvYWNsLmggICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2V4dDIvZXh0Mi5oICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2V4dDIvaWFsbG9jLmMgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDIgKy0KIGZzL2V4dDIvaW5vZGUuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMTUgKy0KIGZzL2V4dDIvaW9jdGwuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDYgKy0KIGZzL2V4dDIvbmFtZWkuYyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8ICAgMjIgKy0KIGZzL2V4dDIveGF0dHJfc2VjdXJpdHkuYyAgICAg ICAgICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvZXh0Mi94YXR0cl90cnVzdGVkLmMgICAgICAg ICAgICAgICAgICAgICAgIHwgICAgMSArCiBmcy9leHQyL3hhdHRyX3VzZXIuYyAgICAgICAgICAg ICAgICAgICAgICAgICAgfCAgICAxICsKIGZzL2V4dDQvYWNsLmMgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDUgKy0KIGZzL2V4dDQvYWNsLmggICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDMgKy0KIGZzL2V4dDQvZXh0NC5oICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMjEgKy0KIGZzL2V4dDQvaWFsbG9jLmMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDcgKy0KIGZzL2V4dDQvaW5vZGUuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMjEgKy0KIGZzL2V4dDQvaW9jdGwuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgMTkgKy0KIGZzL2V4dDQvbmFtZWkuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgNDkgKy0KIGZzL2V4dDQvc3VwZXIuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDIgKy0KIGZzL2V4dDQveGF0dHJfaHVyZC5jICAgICAgICAgICAg ICAgICAgICAgICAgICB8ICAgIDEgKwogZnMvZXh0NC94YXR0cl9zZWN1cml0eS5jICAgICAgICAg ICAgICAgICAgICAgIHwgICAgMSArCiBmcy9leHQ0L3hhdHRyX3RydXN0ZWQuYyAgICAgICAgICAg ICAgICAgICAgICAgfCAgICAxICsKIGZzL2V4dDQveGF0dHJfdXNlci5jICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgIDEgKwogZnMvZjJmcy9hY2wuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNSArLQogZnMvZjJmcy9hY2wuaCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMyArLQogZnMvZjJmcy9mMmZzLmggICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNyArLQogZnMvZjJmcy9maWxlLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAzNSArLQogZnMvZjJmcy9uYW1laS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyMyArLQogZnMvZjJmcy94YXR0ci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNCArLQogZnMvZmF0L2ZhdC5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNiArLQogZnMvZmF0L2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAyNCArLQogZnMvZmF0L25hbWVpX21zZG9zLmMgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAxMiArLQogZnMvZmF0L25hbWVpX3ZmYXQuYyAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAxNSArLQogZnMvZmNudGwuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMyArLQogZnMvZnVzZS9hY2wuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMyArLQogZnMvZnVzZS9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICA0NSArLQogZnMvZnVzZS9mdXNlX2kuaCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgNCArLQogZnMvZnVzZS94YXR0ci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwgICAgMiArCiBmcy9nZnMyL2FjbC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA1ICstCiBmcy9nZnMyL2FjbC5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9nZnMyL2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICA0ICstCiBmcy9nZnMyL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgIDU5ICstCiBmcy9nZnMyL2lub2RlLmggICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAzICstCiBmcy9nZnMyL3hhdHRyLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAxICsKIGZzL2hmcy9hdHRyLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8ICAgIDEgKwogZnMvaGZzL2Rpci5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAxMyArLQogZnMvaGZzL2hmc19mcy5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArLQogZnMvaGZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNyArLQogZnMvaGZzcGx1cy9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAyNSArLQogZnMvaGZzcGx1cy9oZnNwbHVzX2ZzLmggICAgICAgICAgICAgICAg ICAgICAgIHwgICAgNSArLQogZnMvaGZzcGx1cy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAxNiArLQogZnMvaGZzcGx1cy9pb2N0bC5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMiArLQogZnMvaGZzcGx1cy94YXR0ci5jICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwgICAgMSArCiBmcy9oZnNwbHVzL3hhdHRyX3NlY3VyaXR5LmMgICAgICAgICAgICAg ICAgICAgfCAgICAxICsKIGZzL2hmc3BsdXMveGF0dHJfdHJ1c3RlZC5jICAgICAgICAgICAgICAg ICAgICB8ICAgIDEgKwogZnMvaGZzcGx1cy94YXR0cl91c2VyLmMgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgMSArCiBmcy9ob3N0ZnMvaG9zdGZzX2tlcm4uYyAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDI5ICstCiBmcy9ocGZzL2hwZnNfZm4uaCAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAyICstCiBmcy9ocGZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA3ICstCiBmcy9ocGZzL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDIwICstCiBmcy9odWdldGxiZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDMxICstCiBmcy9pbml0LmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDI3ICstCiBmcy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDUwICstCiBmcy9pbnRlcm5hbC5oICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAyICstCiBmcy9qZmZzMi9hY2wuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA1ICstCiBmcy9qZmZzMi9hY2wuaCAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAzICstCiBmcy9qZmZzMi9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDMyICstCiBmcy9qZmZzMi9mcy5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA3ICstCiBmcy9qZmZzMi9vcy1saW51eC5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAyICstCiBmcy9qZmZzMi9zZWN1cml0eS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAxICsKIGZzL2pmZnMyL3hhdHRyX3RydXN0ZWQuYyAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDEgKwogZnMvamZmczIveGF0dHJfdXNlci5jICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMSArCiBmcy9qZnMvYWNsLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICA1ICstCiBmcy9qZnMvZmlsZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICA5ICstCiBmcy9qZnMvaW9jdGwuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICAyICstCiBmcy9qZnMvamZzX2FjbC5oICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICAzICstCiBmcy9qZnMvamZzX2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICAyICstCiBmcy9qZnMvamZzX2lub2RlLmggICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICAyICstCiBmcy9qZnMvbmFtZWkuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgIDIxICstCiBmcy9qZnMveGF0dHIuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg fCAgICAyICsKIGZzL2tlcm5mcy9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDcgKy0KIGZzL2tlcm5mcy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgMTkgKy0KIGZzL2tlcm5mcy9rZXJuZnMtaW50ZXJuYWwuaCAgICAgICAgICAgICAgICAgICB8 ICAgIDkgKy0KIGZzL2xpYmZzLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgMjggKy0KIGZzL21pbml4L2JpdG1hcC5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDIgKy0KIGZzL21pbml4L2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDcgKy0KIGZzL21pbml4L2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDYgKy0KIGZzL21pbml4L21pbml4LmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDMgKy0KIGZzL21pbml4L25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgMjQgKy0KIGZzL21vdW50LmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 ICAgMTAgLQogZnMvbmFtZWkuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwg IDUxMyArKysrLS0KIGZzL25hbWVzcGFjZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICA0ODQgKysrKystCiBmcy9uZnMvZGlyLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDI1ICstCiBmcy9uZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICA5ICstCiBmcy9uZnMvaW50ZXJuYWwuaCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDEwICstCiBmcy9uZnMvbmFtZXNwYWNlLmMgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgIDE0ICstCiBmcy9uZnMvbmZzM19mcy5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAzICstCiBmcy9uZnMvbmZzM2FjbC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAzICstCiBmcy9uZnMvbmZzNHByb2MuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgfCAgICAzICsKIGZzL25mc2QvbmZzMmFjbC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDQgKy0KIGZzL25mc2QvbmZzM2FjbC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDQgKy0KIGZzL25mc2QvbmZzNGFjbC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDQgKy0KIGZzL25mc2QvbmZzNHJlY292ZXIuYyAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDYgKy0KIGZzL25mc2QvbmZzZmguYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDIgKy0KIGZzL25mc2QvbmZzcHJvYy5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDIgKy0KIGZzL25mc2QvdmZzLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgNDcgKy0KIGZzL25pbGZzMi9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMTMgKy0KIGZzL25pbGZzMi9pb2N0bC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDIgKy0KIGZzL25pbGZzMi9uYW1laS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMTkgKy0KIGZzL25pbGZzMi9uaWxmcy5oICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDQgKy0KIGZzL25vdGlmeS9mYW5vdGlmeS9mYW5vdGlmeV91c2VyLmMgICAgICAg ICAgICB8ICAgIDIgKy0KIGZzL25vdGlmeS9pbm90aWZ5L2lub3RpZnlfdXNlci5jICAgICAgICAg ICAgICB8ICAgIDMgKy0KIGZzL250ZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDYgKy0KIGZzL250ZnMvaW5vZGUuaCAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDMgKy0KIGZzL29jZnMyL2FjbC5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDUgKy0KIGZzL29jZnMyL2FjbC5oICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDMgKy0KIGZzL29jZnMyL2RsbWZzL2RsbWZzLmMgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMTcgKy0KIGZzL29jZnMyL2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMTcgKy0KIGZzL29jZnMyL2ZpbGUuaCAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMTEgKy0KIGZzL29jZnMyL2lvY3RsLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDIgKy0KIGZzL29jZnMyL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgMjEgKy0KIGZzL29jZnMyL3JlZmNvdW50dHJlZS5jICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDQgKy0KIGZzL29jZnMyL3hhdHRyLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8ICAgIDMgKwogZnMvb21mcy9kaXIuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAxMyArLQogZnMvb21mcy9maWxlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNyArLQogZnMvb21mcy9pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgMiArLQogZnMvb3Blbi5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICA1MCArLQogZnMvb3JhbmdlZnMvYWNsLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgNSArLQogZnMvb3JhbmdlZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAyMCArLQogZnMvb3JhbmdlZnMvbmFtZWkuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAxMiArLQogZnMvb3JhbmdlZnMvb3JhbmdlZnMta2VybmVsLmggICAgICAgICAgICAg ICAgIHwgICAxMyArLQogZnMvb3JhbmdlZnMveGF0dHIuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwgICAgMSArCiBmcy9vdmVybGF5ZnMvY29weV91cC5jICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDIwICstCiBmcy9vdmVybGF5ZnMvZGlyLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDMxICstCiBmcy9vdmVybGF5ZnMvZmlsZS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA2ICstCiBmcy9vdmVybGF5ZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDI2ICstCiBmcy9vdmVybGF5ZnMvb3ZlcmxheWZzLmggICAgICAgICAgICAgICAgICAg ICAgfCAgIDQ0ICstCiBmcy9vdmVybGF5ZnMvc3VwZXIuYyAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDE5ICstCiBmcy9vdmVybGF5ZnMvdXRpbC5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA0ICstCiBmcy9wb3NpeF9hY2wuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgMTAxICstCiBmcy9wcm9jL2Jhc2UuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDI4ICstCiBmcy9wcm9jL2ZkLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA1ICstCiBmcy9wcm9jL2ZkLmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAzICstCiBmcy9wcm9jL2dlbmVyaWMuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDEyICstCiBmcy9wcm9jL2ludGVybmFsLmggICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA1ICstCiBmcy9wcm9jL3Byb2NfbmV0LmMgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA1ICstCiBmcy9wcm9jL3Byb2Nfc3lzY3RsLmMgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgIDE1ICstCiBmcy9wcm9jL3Jvb3QuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICA1ICstCiBmcy9wcm9jX25hbWVzcGFjZS5jICAgICAgICAgICAgICAgICAgICAgICAg ICAgfCAgICAzICsKIGZzL3JhbWZzL2ZpbGUtbm9tbXUuYyAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDkgKy0KIGZzL3JhbWZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgMTggKy0KIGZzL3JlaXNlcmZzL2FjbC5oICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3JlaXNlcmZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDcgKy0KIGZzL3JlaXNlcmZzL2lvY3RsLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDQgKy0KIGZzL3JlaXNlcmZzL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgMjEgKy0KIGZzL3JlaXNlcmZzL3JlaXNlcmZzLmggICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3JlaXNlcmZzL3hhdHRyLmMgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgMTIgKy0KIGZzL3JlaXNlcmZzL3hhdHRyLmggICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3JlaXNlcmZzL3hhdHRyX2FjbC5jICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDcgKy0KIGZzL3JlaXNlcmZzL3hhdHRyX3NlY3VyaXR5LmMgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3JlaXNlcmZzL3hhdHRyX3RydXN0ZWQuYyAgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3JlaXNlcmZzL3hhdHRyX3VzZXIuYyAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3JlbWFwX3JhbmdlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDcgKy0KIGZzL3N0YXQuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgMjYgKy0KIGZzL3N5c3YvZmlsZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDcgKy0KIGZzL3N5c3YvaWFsbG9jLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDIgKy0KIGZzL3N5c3YvaXRyZWUuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDYgKy0KIGZzL3N5c3YvbmFtZWkuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgMjEgKy0KIGZzL3N5c3Yvc3lzdi5oICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDMgKy0KIGZzL3RyYWNlZnMvaW5vZGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDQgKy0KIGZzL3ViaWZzL2Rpci5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgMzAgKy0KIGZzL3ViaWZzL2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDUgKy0KIGZzL3ViaWZzL2lvY3RsLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDIgKy0KIGZzL3ViaWZzL3ViaWZzLmggICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDUgKy0KIGZzL3ViaWZzL3hhdHRyLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8ICAgIDEgKwogZnMvdWRmL2ZpbGUuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgOSArLQogZnMvdWRmL2lhbGxvYy5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMiArLQogZnMvdWRmL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAyNCArLQogZnMvdWRmL3N5bWxpbmsuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNyArLQogZnMvdWZzL2lhbGxvYy5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMiArLQogZnMvdWZzL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNyArLQogZnMvdWZzL25hbWVpLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAxOSArLQogZnMvdWZzL3Vmcy5oICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMyArLQogZnMvdXRpbWVzLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNCArLQogZnMvdmJveHNmL2Rpci5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAxMiArLQogZnMvdmJveHNmL3V0aWxzLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgOSArLQogZnMvdmJveHNmL3Zmc21vZC5oICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgOCArLQogZnMvdmVyaXR5L2VuYWJsZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMiArLQogZnMveGF0dHIuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgIDEzNiArLQogZnMveGZzL3hmc19hY2wuYyAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNSArLQogZnMveGZzL3hmc19hY2wuaCAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMyArLQogZnMveGZzL3hmc19maWxlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNCArLQogZnMveGZzL3hmc19pbm9kZS5jICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAyNiArLQogZnMveGZzL3hmc19pbm9kZS5oICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAxNiArLQogZnMveGZzL3hmc19pb2N0bC5jICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAyMyArLQogZnMveGZzL3hmc19pb3BzLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICA5OCArLQogZnMveGZzL3hmc19pb3BzLmggICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMyArLQogZnMveGZzL3hmc19xbS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMyArLQogZnMveGZzL3hmc19zdXBlci5jICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMiArLQogZnMveGZzL3hmc19zeW1saW5rLmMgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNSArLQogZnMveGZzL3hmc19zeW1saW5rLmggICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgNSArLQogZnMveGZzL3hmc194YXR0ci5jICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgMyArLQogZnMvem9uZWZzL3N1cGVyLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAgOSArLQogaW5jbHVkZS9saW51eC9jYXBhYmlsaXR5LmggICAgICAgICAgICAgICAgICAg IHwgICAxNSArLQogaW5jbHVkZS9saW51eC9mcy5oICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgIDE1OCArLQogaW5jbHVkZS9saW51eC9pbWEuaCAgICAgICAgICAgICAgICAgICAgICAgICAg IHwgICAxNyArLQogaW5jbHVkZS9saW51eC9sc21faG9va19kZWZzLmggICAgICAgICAgICAgICAg IHwgICAxNSArLQogaW5jbHVkZS9saW51eC9sc21faG9va3MuaCAgICAgICAgICAgICAgICAgICAg IHwgICAgMSArCiBpbmNsdWRlL2xpbnV4L21vdW50LmggICAgICAgICAgICAgICAgICAgICAgICAg fCAgICA3ICsKIGluY2x1ZGUvbGludXgvbmZzX2ZzLmggICAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDcgKy0KIGluY2x1ZGUvbGludXgvcG9zaXhfYWNsLmggICAgICAgICAgICAgICAgICAgICB8 ICAgMTUgKy0KIGluY2x1ZGUvbGludXgvcG9zaXhfYWNsX3hhdHRyLmggICAgICAgICAgICAgICB8 ICAgMTIgKy0KIGluY2x1ZGUvbGludXgvc2VjdXJpdHkuaCAgICAgICAgICAgICAgICAgICAgICB8 ICAgNDYgKy0KIGluY2x1ZGUvbGludXgvc3lzY2FsbHMuaCAgICAgICAgICAgICAgICAgICAgICB8 ICAgIDQgKwogaW5jbHVkZS9saW51eC94YXR0ci5oICAgICAgICAgICAgICAgICAgICAgICAgIHwg ICAzMCArLQogaW5jbHVkZS91YXBpL2FzbS1nZW5lcmljL3VuaXN0ZC5oICAgICAgICAgICAgIHwg ICAgNCArLQogaW5jbHVkZS91YXBpL2xpbnV4L21vdW50LmggICAgICAgICAgICAgICAgICAgIHwg ICAxNyArCiBpcGMvbXF1ZXVlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICA4ICstCiBrZXJuZWwvYXVkaXRzYy5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICA1ICstCiBrZXJuZWwvYnBmL2lub2RlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg IDEzICstCiBrZXJuZWwvY2FwYWJpbGl0eS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg IDE0ICstCiBrZXJuZWwvY2dyb3VwL2Nncm91cC5jICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICAyICstCiBrZXJuZWwvc3lzLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICAyICstCiBtbS9tYWR2aXNlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICA0ICstCiBtbS9tZW1jb250cm9sLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICAyICstCiBtbS9taW5jb3JlLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICA0ICstCiBtbS9zaG1lbS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg IDQ4ICstCiBuZXQvc29ja2V0LmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICA2ICstCiBuZXQvdW5peC9hZl91bml4LmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg ICA0ICstCiBzZWN1cml0eS9hcHBhcm1vci9hcHBhcm1vcmZzLmMgICAgICAgICAgICAgICAgfCAg ICAzICstCiBzZWN1cml0eS9hcHBhcm1vci9kb21haW4uYyAgICAgICAgICAgICAgICAgICAgfCAg IDEzICstCiBzZWN1cml0eS9hcHBhcm1vci9maWxlLmMgICAgICAgICAgICAgICAgICAgICAgfCAg ICA1ICstCiBzZWN1cml0eS9hcHBhcm1vci9sc20uYyAgICAgICAgICAgICAgICAgICAgICAgfCAg IDEyICstCiBzZWN1cml0eS9jb21tb25jYXAuYyAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg MTA5ICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvZXZtL2V2bV9jcnlwdG8uYyAgICAgICAgICAgfCAg IDExICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvZXZtL2V2bV9tYWluLmMgICAgICAgICAgICAgfCAg ICA0ICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvZXZtL2V2bV9zZWNmcy5jICAgICAgICAgICAgfCAg ICAyICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYS5oICAgICAgICAgICAgICAgICAgfCAg IDE5ICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYV9hcGkuYyAgICAgICAgICAgICAgfCAg IDEwICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYV9hcHByYWlzZS5jICAgICAgICAgfCAg IDIyICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYV9hc3ltbWV0cmljX2tleXMuYyAgfCAg ICAyICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYV9tYWluLmMgICAgICAgICAgICAgfCAg IDMxICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYV9wb2xpY3kuYyAgICAgICAgICAgfCAg IDE5ICstCiBzZWN1cml0eS9pbnRlZ3JpdHkvaW1hL2ltYV9xdWV1ZV9rZXlzLmMgICAgICAgfCAg ICAyICstCiBzZWN1cml0eS9zZWN1cml0eS5jICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAg IDI1ICstCiBzZWN1cml0eS9zZWxpbnV4L2hvb2tzLmMgICAgICAgICAgICAgICAgICAgICAgfCAg IDIyICstCiBzZWN1cml0eS9zbWFjay9zbWFja19sc20uYyAgICAgICAgICAgICAgICAgICAgfCAg IDE4ICstCiB0b29scy9pbmNsdWRlL3VhcGkvYXNtLWdlbmVyaWMvdW5pc3RkLmggICAgICAgfCAg ICA0ICstCiB0b29scy90ZXN0aW5nL3NlbGZ0ZXN0cy9NYWtlZmlsZSAgICAgICAgICAgICAgfCAg ICAxICsKIC4uLi9zZWxmdGVzdHMvbW91bnRfc2V0YXR0ci8uZ2l0aWdub3JlICAgICAgICB8ICAg IDEgKwogLi4uL3Rlc3Rpbmcvc2VsZnRlc3RzL21vdW50X3NldGF0dHIvTWFrZWZpbGUgIHwgICAg NyArCiB0b29scy90ZXN0aW5nL3NlbGZ0ZXN0cy9tb3VudF9zZXRhdHRyL2NvbmZpZyAgfCAgICAx ICsKIC4uLi9tb3VudF9zZXRhdHRyL21vdW50X3NldGF0dHJfdGVzdC5jICAgICAgICB8IDE0MjQg KysrKysrKysrKysrKysrKysKIDMzOCBmaWxlcyBjaGFuZ2VkLCA0NzE4IGluc2VydGlvbnMoKyks IDE3MzEgZGVsZXRpb25zKC0pCiBjcmVhdGUgbW9kZSAxMDA2NDQgdG9vbHMvdGVzdGluZy9zZWxm dGVzdHMvbW91bnRfc2V0YXR0ci8uZ2l0aWdub3JlCiBjcmVhdGUgbW9kZSAxMDA2NDQgdG9vbHMv dGVzdGluZy9zZWxmdGVzdHMvbW91bnRfc2V0YXR0ci9NYWtlZmlsZQogY3JlYXRlIG1vZGUgMTAw NjQ0IHRvb2xzL3Rlc3Rpbmcvc2VsZnRlc3RzL21vdW50X3NldGF0dHIvY29uZmlnCiBjcmVhdGUg bW9kZSAxMDA2NDQgdG9vbHMvdGVzdGluZy9zZWxmdGVzdHMvbW91bnRfc2V0YXR0ci9tb3VudF9z ZXRhdHRyX3Rlc3QuYwoKCmJhc2UtY29tbWl0OiA3YzUzZjZiNjcxZjRhYmE3MGZmMTVlMWIwNTE0 OGIxMGQ1OGMyODM3Ci0tIAoyLjMwLjAKCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwpDb250YWluZXJzIG1haWxpbmcgbGlzdApDb250YWluZXJzQGxpc3Rz LmxpbnV4LWZvdW5kYXRpb24ub3JnCmh0dHBzOi8vbGlzdHMubGludXhmb3VuZGF0aW9uLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2NvbnRhaW5lcnM= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61738C43331 for ; Tue, 12 Jan 2021 22:04:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 210F123127 for ; Tue, 12 Jan 2021 22:04:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2393894AbhALWDr (ORCPT ); Tue, 12 Jan 2021 17:03:47 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:42911 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2393847AbhALWDo (ORCPT ); Tue, 12 Jan 2021 17:03:44 -0500 Received: from ip5f5af0a0.dynamic.kabel-deutschland.de ([95.90.240.160] helo=wittgenstein.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1kzRkP-0003bd-Cd; Tue, 12 Jan 2021 22:02:41 +0000 From: Christian Brauner To: Alexander Viro , Christoph Hellwig , linux-fsdevel@vger.kernel.org Cc: John Johansen , James Morris , Mimi Zohar , Dmitry Kasatkin , Stephen Smalley , Casey Schaufler , Arnd Bergmann , Andreas Dilger , OGAWA Hirofumi , Geoffrey Thomas , Mrunal Patel , Josh Triplett , Andy Lutomirski , Theodore Tso , Alban Crequy , Tycho Andersen , David Howells , James Bottomley , Seth Forshee , =?UTF-8?q?St=C3=A9phane=20Graber?= , Linus Torvalds , Aleksa Sarai , Lennart Poettering , "Eric W. Biederman" , smbarber@chromium.org, Phil Estes , Serge Hallyn , Kees Cook , Todd Kjos , Paul Moore , Jonathan Corbet , containers@lists.linux-foundation.org, linux-security-module@vger.kernel.org, linux-api@vger.kernel.org, linux-ext4@vger.kernel.org, linux-xfs@vger.kernel.org, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, Christian Brauner Subject: [PATCH v5 00/42] idmapped mounts Date: Tue, 12 Jan 2021 23:00:42 +0100 Message-Id: <20210112220124.837960-1-christian.brauner@ubuntu.com> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Hey everyone, The only major change is the inclusion of hch's patch to port XFS to support idmapped mounts. Thanks to Christoph for doing that work. (For a full list of major changes between versions see the end of this cover letter. Please also note the large xfstests testsuite in patch 42 that has been kept as part of this series. It verifies correct vfs behavior with and without idmapped mounts including covering newer vfs features such as io_uring. I currently still plan to target the v5.12 merge window.) With this patchset we make it possible to attach idmappings to mounts, i.e. simply put different bind mounts can expose the same file or directory with different ownership. Shifting of ownership on a per-mount basis handles a wide range of long standing use-cases. Here are just a few: - Shifting of a subset of ownership-less filesystems (vfat) for use by multiple users, effectively allowing for DAC on such devices (systemd, Android, ...) - Allow remapping uid/gid on external filesystems or paths (USB sticks, network filesystem, ...) to match the local system's user and groups. (David Howells intends to port AFS as a first candidate.) - Shifting of a container rootfs or base image without having to mangle every file (runc, Docker, containerd, k8s, LXD, systemd ...) - Sharing of data between host or privileged containers with unprivileged containers (runC, Docker, containerd, k8s, LXD, ...) - Data sharing between multiple user namespaces with incompatible maps (LXD, k8s, ...) There has been significant interest in this patchset as evidenced by user commenting on previous version of this patchset. They include containerd, ChromeOS, systemd, LXD and a range of others. There is already a patchset up for containerd, the default Kubernetes container runtime https://github.com/containerd/containerd/pull/4734 to make use of this. systemd intends to use it in their systemd-homed implementation for portable home directories. ChromeOS wants to make use of it to share data between the host and the Linux containers they run on Chrome- and Pixelbooks. (Fwiw, for fun and since I wanted to do this for a long time I've ported my home directory to be completely portable with a simple service file that now mounts my home directory on an ext4 formatted usb stick with an id mapping mapping all files to the random uid I'm assigned at login.) Making it possible to share directories and mounts between users with different uids and gids is itself quite an important use-case in distributed systems environments. It's of course especially useful in general for portable usb sticks, sharing data between multiple users in, and sharing home directories between multiple users. The last example is now elegantly expressed in systemd's homed concept for portable home directories. As mentioned above, idmapped mounts also allow data from the host to be shared with unprivileged containers, between privileged and unprivileged containers simultaneously and in addition also between unprivileged containers with different idmappings whenever they are used to isolate one container completely from another container. We have implemented and proposed multiple solutions to this before. This included the introduction of fsid mappings, a tiny filesystem I've authored with Seth Forshee that is currently carried in Ubuntu that has shown to be the wrong approach, and the conceptual hack of calling override creds directly in the vfs. In addition, to some of these solutions being hacky none of these solutions have covered all of the above use-cases. Idmappings become a property of struct vfsmount instead of tying it to a process being inside of a user namespace which has been the case for all other proposed approaches. It also allows to pass down the user namespace into the filesystems which is a clean way instead of violating calling conventions by strapping the user namespace information that is a property of the mount to the caller's credentials or similar hacks. Each mount can have a separate idmapping and idmapped mounts can even be created in the initial user namespace unblocking a range of use-cases. To this end the vfsmount struct gains a new struct user_namespace member. The idmapping of the user namespace becomes the idmapping of the mount. A caller that is privileged with respect to the user namespace of the superblock of the underlying filesystem can create an idmapped mount. In the future, we can enable unprivileged use-cases by checking whether the caller is privileged wrt to the user namespace that an already idmapped mount has been marked with, allowing them to change the idmapping. For now, keep things simple until the need arises. Note, that with syscall interception it is already possible to intercept idmapped mount requests from unprivileged containers and handle them in a sufficiently privileged container manager. Support for this is already available in LXD and will be available in runC where syscall interception is currently in the process of becoming part of the runtime spec: https://github.com/opencontainers/runtime-spec/pull/1074. The user namespace the mount will be marked with can be specified by passing a file descriptor refering to the user namespace as an argument to the new mount_setattr() syscall together with the new MOUNT_ATTR_IDMAP flag. By default vfsmounts are marked with the initial user namespace and no behavioral or performance changes are observed. All mapping operations are nops for the initial user namespace. When a file/inode is accessed through an idmapped mount the i_uid and i_gid of the inode will be remapped according to the user namespace the mount has been marked with. In order to support idmapped mounts, filesystems need to be changed and mark themselves with the FS_ALLOW_IDMAP flag in fs_flags. The initial version contains fat, ext4, and xfs including a list of examples. But patches for other filesystems are actively worked on and will be sent out separately. We are here to see this through and there are multiple people involved in converting filesystems. So filesystem developers are not left alone with this and are provided with a large testsuite to verify that their port is correct. There is a simple tool available at https://github.com/brauner/mount-idmapped that allows to create idmapped mounts so people can play with this patch series. Here are a few illustrations: 1. Create a simple idmapped mount of another user's home directory u1001@f2-vm:/$ sudo ./mount-idmapped --map-mount b:1000:1001:1 /home/ubuntu/ /mnt u1001@f2-vm:/$ ls -al /home/ubuntu/ total 28 drwxr-xr-x 2 ubuntu ubuntu 4096 Oct 28 22:07 . drwxr-xr-x 4 root root 4096 Oct 28 04:00 .. -rw------- 1 ubuntu ubuntu 3154 Oct 28 22:12 .bash_history -rw-r--r-- 1 ubuntu ubuntu 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 ubuntu ubuntu 807 Feb 25 2020 .profile -rw-r--r-- 1 ubuntu ubuntu 0 Oct 16 16:11 .sudo_as_admin_successful -rw------- 1 ubuntu ubuntu 1144 Oct 28 00:43 .viminfo u1001@f2-vm:/$ ls -al /mnt/ total 28 drwxr-xr-x 2 u1001 u1001 4096 Oct 28 22:07 . drwxr-xr-x 29 root root 4096 Oct 28 22:01 .. -rw------- 1 u1001 u1001 3154 Oct 28 22:12 .bash_history -rw-r--r-- 1 u1001 u1001 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 u1001 u1001 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 u1001 u1001 807 Feb 25 2020 .profile -rw-r--r-- 1 u1001 u1001 0 Oct 16 16:11 .sudo_as_admin_successful -rw------- 1 u1001 u1001 1144 Oct 28 00:43 .viminfo u1001@f2-vm:/$ touch /mnt/my-file u1001@f2-vm:/$ setfacl -m u:1001:rwx /mnt/my-file u1001@f2-vm:/$ sudo setcap -n 1001 cap_net_raw+ep /mnt/my-file u1001@f2-vm:/$ ls -al /mnt/my-file -rw-rwxr--+ 1 u1001 u1001 0 Oct 28 22:14 /mnt/my-file u1001@f2-vm:/$ ls -al /home/ubuntu/my-file -rw-rwxr--+ 1 ubuntu ubuntu 0 Oct 28 22:14 /home/ubuntu/my-file u1001@f2-vm:/$ getfacl /mnt/my-file getfacl: Removing leading '/' from absolute path names # file: mnt/my-file # owner: u1001 # group: u1001 user::rw- user:u1001:rwx group::rw- mask::rwx other::r-- u1001@f2-vm:/$ getfacl /home/ubuntu/my-file getfacl: Removing leading '/' from absolute path names # file: home/ubuntu/my-file # owner: ubuntu # group: ubuntu user::rw- user:ubuntu:rwx group::rw- mask::rwx other::r-- 2. Create mapping of the whole ext4 rootfs without a mapping for uid and gid 0 ubuntu@f2-vm:~$ sudo /mount-idmapped --map-mount b:1:1:65536 / /mnt/ ubuntu@f2-vm:~$ findmnt | grep mnt └─/mnt /dev/sda2 ext4 rw,relatime └─/mnt/mnt /dev/sda2 ext4 rw,relatime ubuntu@f2-vm:~$ sudo mkdir /AS-ROOT-CAN-CREATE ubuntu@f2-vm:~$ sudo mkdir /mnt/AS-ROOT-CANT-CREATE mkdir: cannot create directory ‘/mnt/AS-ROOT-CANT-CREATE’: Value too large for defined data type ubuntu@f2-vm:~$ mkdir /mnt/home/ubuntu/AS-USER-1000-CAN-CREATE 3. Create a vfat usb mount and expose to user 1001 and 5000 ubuntu@f2-vm:/$ sudo mount /dev/sdb /mnt ubuntu@f2-vm:/$ findmnt | grep mnt └─/mnt /dev/sdb vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro ubuntu@f2-vm:/$ ls -al /mnt total 12 drwxr-xr-x 2 root root 4096 Jan 1 1970 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. -rwxr-xr-x 1 root root 4 Oct 28 03:44 aaa -rwxr-xr-x 1 root root 0 Oct 28 01:09 bbb ubuntu@f2-vm:/$ sudo /mount-idmapped --map-mount b:0:1001:1 /mnt /mnt-1001/ ubuntu@f2-vm:/$ ls -al /mnt-1001/ total 12 drwxr-xr-x 2 u1001 u1001 4096 Jan 1 1970 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. -rwxr-xr-x 1 u1001 u1001 4 Oct 28 03:44 aaa -rwxr-xr-x 1 u1001 u1001 0 Oct 28 01:09 bbb ubuntu@f2-vm:/$ sudo /mount-idmapped --map-mount b:0:5000:1 /mnt /mnt-5000/ ubuntu@f2-vm:/$ ls -al /mnt-5000/ total 12 drwxr-xr-x 2 5000 5000 4096 Jan 1 1970 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. -rwxr-xr-x 1 5000 5000 4 Oct 28 03:44 aaa -rwxr-xr-x 1 5000 5000 0 Oct 28 01:09 bbb 4. Create an idmapped rootfs mount for a container root@f2-vm:~# ls -al /var/lib/lxc/f2/rootfs/ total 68 drwxr-xr-x 17 20000 20000 4096 Sep 24 07:48 . drwxrwx--- 3 20000 20000 4096 Oct 16 19:26 .. lrwxrwxrwx 1 20000 20000 7 Sep 24 07:43 bin -> usr/bin drwxr-xr-x 2 20000 20000 4096 Apr 15 2020 boot drwxr-xr-x 3 20000 20000 4096 Oct 16 19:26 dev drwxr-xr-x 61 20000 20000 4096 Oct 16 19:26 etc drwxr-xr-x 3 20000 20000 4096 Sep 24 07:45 home lrwxrwxrwx 1 20000 20000 7 Sep 24 07:43 lib -> usr/lib lrwxrwxrwx 1 20000 20000 9 Sep 24 07:43 lib32 -> usr/lib32 lrwxrwxrwx 1 20000 20000 9 Sep 24 07:43 lib64 -> usr/lib64 lrwxrwxrwx 1 20000 20000 10 Sep 24 07:43 libx32 -> usr/libx32 drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 media drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 mnt drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 opt drwxr-xr-x 2 20000 20000 4096 Apr 15 2020 proc drwx------ 2 20000 20000 4096 Sep 24 07:43 root drwxr-xr-x 2 20000 20000 4096 Sep 24 07:45 run lrwxrwxrwx 1 20000 20000 8 Sep 24 07:43 sbin -> usr/sbin drwxr-xr-x 2 20000 20000 4096 Sep 24 07:43 srv drwxr-xr-x 2 20000 20000 4096 Apr 15 2020 sys drwxrwxrwt 2 20000 20000 4096 Sep 24 07:44 tmp drwxr-xr-x 13 20000 20000 4096 Sep 24 07:43 usr drwxr-xr-x 12 20000 20000 4096 Sep 24 07:44 var root@f2-vm:~# /mount-idmapped --map-mount b:20000:10000:100000 /var/lib/lxc/f2/rootfs/ /mnt root@f2-vm:~# ls -al /mnt total 68 drwxr-xr-x 17 10000 10000 4096 Sep 24 07:48 . drwxr-xr-x 34 root root 4096 Oct 28 22:24 .. lrwxrwxrwx 1 10000 10000 7 Sep 24 07:43 bin -> usr/bin drwxr-xr-x 2 10000 10000 4096 Apr 15 2020 boot drwxr-xr-x 3 10000 10000 4096 Oct 16 19:26 dev drwxr-xr-x 61 10000 10000 4096 Oct 16 19:26 etc drwxr-xr-x 3 10000 10000 4096 Sep 24 07:45 home lrwxrwxrwx 1 10000 10000 7 Sep 24 07:43 lib -> usr/lib lrwxrwxrwx 1 10000 10000 9 Sep 24 07:43 lib32 -> usr/lib32 lrwxrwxrwx 1 10000 10000 9 Sep 24 07:43 lib64 -> usr/lib64 lrwxrwxrwx 1 10000 10000 10 Sep 24 07:43 libx32 -> usr/libx32 drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 media drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 mnt drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 opt drwxr-xr-x 2 10000 10000 4096 Apr 15 2020 proc drwx------ 2 10000 10000 4096 Sep 24 07:43 root drwxr-xr-x 2 10000 10000 4096 Sep 24 07:45 run lrwxrwxrwx 1 10000 10000 8 Sep 24 07:43 sbin -> usr/sbin drwxr-xr-x 2 10000 10000 4096 Sep 24 07:43 srv drwxr-xr-x 2 10000 10000 4096 Apr 15 2020 sys drwxrwxrwt 2 10000 10000 4096 Sep 24 07:44 tmp drwxr-xr-x 13 10000 10000 4096 Sep 24 07:43 usr drwxr-xr-x 12 10000 10000 4096 Sep 24 07:44 var root@f2-vm:~# lxc-start f2 # uses /mnt as rootfs root@f2-vm:~# lxc-attach f2 -- cat /proc/1/uid_map 0 10000 10000 root@f2-vm:~# lxc-attach f2 -- cat /proc/1/gid_map 0 10000 10000 root@f2-vm:~# lxc-attach f2 -- ls -al / total 52 drwxr-xr-x 17 root root 4096 Sep 24 07:48 . drwxr-xr-x 17 root root 4096 Sep 24 07:48 .. lrwxrwxrwx 1 root root 7 Sep 24 07:43 bin -> usr/bin drwxr-xr-x 2 root root 4096 Apr 15 2020 boot drwxr-xr-x 5 root root 500 Oct 28 23:39 dev drwxr-xr-x 61 root root 4096 Oct 28 23:39 etc drwxr-xr-x 3 root root 4096 Sep 24 07:45 home lrwxrwxrwx 1 root root 7 Sep 24 07:43 lib -> usr/lib lrwxrwxrwx 1 root root 9 Sep 24 07:43 lib32 -> usr/lib32 lrwxrwxrwx 1 root root 9 Sep 24 07:43 lib64 -> usr/lib64 lrwxrwxrwx 1 root root 10 Sep 24 07:43 libx32 -> usr/libx32 drwxr-xr-x 2 root root 4096 Sep 24 07:43 media drwxr-xr-x 2 root root 4096 Sep 24 07:43 mnt drwxr-xr-x 2 root root 4096 Sep 24 07:43 opt dr-xr-xr-x 232 nobody nogroup 0 Oct 28 23:39 proc drwx------ 2 root root 4096 Oct 28 23:41 root drwxr-xr-x 12 root root 360 Oct 28 23:39 run lrwxrwxrwx 1 root root 8 Sep 24 07:43 sbin -> usr/sbin drwxr-xr-x 2 root root 4096 Sep 24 07:43 srv dr-xr-xr-x 13 nobody nogroup 0 Oct 28 23:39 sys drwxrwxrwt 11 root root 4096 Oct 28 23:40 tmp drwxr-xr-x 13 root root 4096 Sep 24 07:43 usr drwxr-xr-x 12 root root 4096 Sep 24 07:44 var root@f2-vm:~# lxc-attach f2 -- ls -al /my-file -rw-r--r-- 1 root root 0 Oct 28 23:43 /my-file root@f2-vm:~# ls -al /var/lib/lxc/f2/rootfs/my-file -rw-r--r-- 1 20000 20000 0 Oct 28 23:43 /var/lib/lxc/f2/rootfs/my-file I'd like to say thanks to: Al for pointing me into the direction to avoid inode alias issues during lookup. David for various discussions around this. Christoph for porting xfs, providing good reviews and for being involved in the original idea. Tycho for helping with this series and on future patches to convert filesystems. Alban Crequy and the Kinvolk peeps located just a few streets away from me in Berlin for providing use-case discussions and writing patches for containerd. Stéphane for his invaluable input on many things and level head and enabling me to work on this. Amir for explaining and discussing aspects of overlayfs with me. I'd like to especially thank Seth Forshee. He provided a lot of good analysis, suggestions, and participated in short-notice discussions in both chat and video for some nitty-gritty technical details. This series can be found and pulled from the three usual locations: https://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux.git/log/?h=idmapped_mounts https://github.com/brauner/linux/tree/idmapped_mounts https://gitlab.com/brauner/linux/-/commits/idmapped_mounts /* v5 */ - Adress Christoph's feedback. - Use v5.11-rc3 as new base. - Add Christoph's xfs port. /* v4 */ - Split out several preparatory patches from the initial mount_setattr patch as requested by Christoph. - Add new tests for file/directory creation in directories with the setgid bit set. Specifically, verify that the setgid bit is correctly ignored when creating a file with the setgid bit and the parent directory's i_gid isn't in_group_p() and the caller isn't capable_wrt_inode_uidgid() over the parent directory's inode when inode_init_owner() is called. Conversely, verify that the setgid bit is set when creating a file with the setgid bit and the parent's i_gid is either in_group_p() or the caller is capable_wrt_inode_uidgid() over the parent directory's inode. In additiona, verify that the setgid bit is always inherited when creating directories. Test all of this on regular mounts, idmapped mounts, and on idmapped mounts in user namespaces. - Add new tests to verify that the i_gid of newly created files or directories is correctly set to the parent directory's i_gid when the parent directory has the setgid bit set. - Use "mnt_userns" as the de facto name for a vfsmount's user namespace everywhere as suggested by Serge. - Reuse existing propagation flags instead of introducing new ones as suggested by Christoph. (This is in line with Linus request to not introduce too many new flags as evidenced by prior discussions on other patchsets such as openat2().) - Add first set of Acked-bys from Serge and Reviewed-bys from Christoph. - Fix commit messages to reflect the fact that we modify existing vfs helpers but do not introduce new ones like we did in the first version. Some commit messages still implied we were adding new helpers. - Reformat all commit messages to adhere to 73 char length limit and wrap all lines in commits at 80 chars whenever this doesn't hinder legibility. - Simplify various codepaths with Christoph's suggestions. /* v3 */ - The major change is the port of the test-suite from the kernel-internal selftests framework to xfstests as requested by Darrick and Christoph. The test-suite for xfstests is patch 38 in this series. It has been kept as part of this series even though it belongs to xfstests so it's easier to see what is tested and to keep it in-sync. - Note, the test-suite now has been extended to cover io_uring and idmapped mounts. The IORING_REGISTER_PERSONALITY feature allows to register the caller's credentials with io_uring and returns an id associated with these credentials. This is useful for applications that wish to share a ring between separate users/processes. Callers can pass in the credential id in the sqe personality field. If set, that particular sqe will be issued with these credentials. The test-suite now tests that the openat* operations with different registered credentials work correctly and safely on regular mounts, on regular mounts inside user namespaces, on idmapped mounts, and on idmapped mounts inside user namespaces. /* v2 */ - The major change is the rework requested by Christoph and others to adapt all relevant helpers and inode_operations methods to account for idmapped mounts instead of introducing new helpers and methods specific to idmapped mounts like we did before. We've also moved the overlayfs conversion to handle idmapped mounts into a separate patchset that will be sent out separately after the core changes landed. The converted filesytems in this series include fat and ext4. As per Christoph's request the vfs-wide config option to disable idmapped mounts has been removed. Instead the filesystems can decide whether or not they want to allow idmap mounts through a config option. These config options default to off. Having a config option allows us to gain some confidence in the patchset over multiple kernel releases. - This version introduces a large test-suite to test current vfs behavior and idmapped mounts behavior. This test-suite is intended to grow over time. - While while working on adapting this patchset to the requested changes, the runC and containerd crowd was nice enough to adapt containerd to this patchset to make use of idmapped mounts in one of the most widely used container runtimes: https://github.com/containerd/containerd/pull/4734 The solution proposed here has it's origins in multiple discussions during Linux Plumbers 2017 during and after the end of the containers microconference. To the best of my knowledge this involved Aleksa, Stéphane, Eric, David, James, and myself.The original idea or a variant thereof has been discussed, again to the best of my knowledge, after a Linux conference in St. Petersburg in Russia in 2017 between Christoph, Tycho, and myself. We've taken the time to implement a working version of this solution over the last weeks to the best of my abilities. Tycho has signed up for this sligthly crazy endeavour as well and he has helped with the conversion of the xattr codepaths and will be involved with others in converting additional filesystems. Thanks! Christian Christian Brauner (39): namespace: take lock_mount_hash() directly when changing flags mount: make {lock,unlock}_mount_hash() static namespace: only take read lock in do_reconfigure_mnt() fs: split out functions to hold writers fs: add attr_flags_to_mnt_flags helper fs: add mount_setattr() tests: add mount_setattr() selftests fs: add id translation helpers mount: attach mappings to mounts capability: handle idmapped mounts namei: make permission helpers idmapped mount aware inode: make init and permission helpers idmapped mount aware attr: handle idmapped mounts acl: handle idmapped mounts fs: add file_user_ns() helper commoncap: handle idmapped mounts stat: handle idmapped mounts namei: handle idmapped mounts in may_*() helpers namei: introduce struct renamedata namei: prepare for idmapped mounts open: handle idmapped mounts in do_truncate() open: handle idmapped mounts af_unix: handle idmapped mounts utimes: handle idmapped mounts fcntl: handle idmapped mounts notify: handle idmapped mounts init: handle idmapped mounts ioctl: handle idmapped mounts would_dump: handle idmapped mounts exec: handle idmapped mounts fs: make helpers idmap mount aware apparmor: handle idmapped mounts ima: handle idmapped mounts fat: handle idmapped mounts ext4: support idmapped mounts ecryptfs: do not mount on top of idmapped mounts overlayfs: do not mount on top of idmapped mounts fs: introduce MOUNT_ATTR_IDMAP tests: extend mount_setattr tests Christoph Hellwig (1): xfs: support idmapped mounts Tycho Andersen (1): xattr: handle idmapped mounts Documentation/filesystems/locking.rst | 6 +- Documentation/filesystems/porting.rst | 2 + Documentation/filesystems/vfs.rst | 19 +- arch/alpha/kernel/syscalls/syscall.tbl | 1 + arch/arm/tools/syscall.tbl | 1 + arch/arm64/include/asm/unistd32.h | 2 + arch/ia64/kernel/syscalls/syscall.tbl | 1 + arch/m68k/kernel/syscalls/syscall.tbl | 1 + arch/microblaze/kernel/syscalls/syscall.tbl | 1 + arch/mips/kernel/syscalls/syscall_n32.tbl | 1 + arch/mips/kernel/syscalls/syscall_n64.tbl | 1 + arch/mips/kernel/syscalls/syscall_o32.tbl | 1 + arch/parisc/kernel/syscalls/syscall.tbl | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 5 +- arch/s390/kernel/syscalls/syscall.tbl | 1 + arch/sh/kernel/syscalls/syscall.tbl | 1 + arch/sparc/kernel/syscalls/syscall.tbl | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 1 + arch/xtensa/kernel/syscalls/syscall.tbl | 1 + drivers/android/binderfs.c | 6 +- drivers/base/devtmpfs.c | 12 +- fs/9p/acl.c | 8 +- fs/9p/v9fs.h | 3 +- fs/9p/v9fs_vfs.h | 2 +- fs/9p/vfs_inode.c | 36 +- fs/9p/vfs_inode_dotl.c | 39 +- fs/9p/xattr.c | 1 + fs/adfs/adfs.h | 3 +- fs/adfs/inode.c | 5 +- fs/affs/affs.h | 10 +- fs/affs/inode.c | 7 +- fs/affs/namei.c | 15 +- fs/afs/dir.c | 34 +- fs/afs/inode.c | 9 +- fs/afs/internal.h | 7 +- fs/afs/security.c | 2 +- fs/afs/xattr.c | 2 + fs/attr.c | 124 +- fs/autofs/root.c | 13 +- fs/bad_inode.c | 36 +- fs/bfs/dir.c | 12 +- fs/btrfs/acl.c | 5 +- fs/btrfs/ctree.h | 3 +- fs/btrfs/inode.c | 45 +- fs/btrfs/ioctl.c | 25 +- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/xattr.c | 2 + fs/cachefiles/interface.c | 4 +- fs/cachefiles/namei.c | 19 +- fs/cachefiles/xattr.c | 16 +- fs/ceph/acl.c | 5 +- fs/ceph/dir.c | 23 +- fs/ceph/inode.c | 17 +- fs/ceph/super.h | 12 +- fs/ceph/xattr.c | 1 + fs/cifs/cifsfs.c | 4 +- fs/cifs/cifsfs.h | 21 +- fs/cifs/dir.c | 8 +- fs/cifs/inode.c | 26 +- fs/cifs/link.c | 3 +- fs/cifs/xattr.c | 1 + fs/coda/coda_linux.h | 6 +- fs/coda/dir.c | 17 +- fs/coda/inode.c | 9 +- fs/coda/pioctl.c | 6 +- fs/configfs/configfs_internal.h | 7 +- fs/configfs/dir.c | 3 +- fs/configfs/inode.c | 5 +- fs/configfs/symlink.c | 5 +- fs/coredump.c | 14 +- fs/crypto/policy.c | 2 +- fs/debugfs/inode.c | 9 +- fs/ecryptfs/crypto.c | 4 +- fs/ecryptfs/inode.c | 80 +- fs/ecryptfs/main.c | 6 + fs/ecryptfs/mmap.c | 4 +- fs/efivarfs/file.c | 2 +- fs/efivarfs/inode.c | 4 +- fs/erofs/inode.c | 7 +- fs/erofs/internal.h | 5 +- fs/exec.c | 12 +- fs/exfat/exfat_fs.h | 8 +- fs/exfat/file.c | 14 +- fs/exfat/namei.c | 14 +- fs/ext2/acl.c | 5 +- fs/ext2/acl.h | 3 +- fs/ext2/ext2.h | 5 +- fs/ext2/ialloc.c | 2 +- fs/ext2/inode.c | 15 +- fs/ext2/ioctl.c | 6 +- fs/ext2/namei.c | 22 +- fs/ext2/xattr_security.c | 1 + fs/ext2/xattr_trusted.c | 1 + fs/ext2/xattr_user.c | 1 + fs/ext4/acl.c | 5 +- fs/ext4/acl.h | 3 +- fs/ext4/ext4.h | 21 +- fs/ext4/ialloc.c | 7 +- fs/ext4/inode.c | 21 +- fs/ext4/ioctl.c | 19 +- fs/ext4/namei.c | 49 +- fs/ext4/super.c | 2 +- fs/ext4/xattr_hurd.c | 1 + fs/ext4/xattr_security.c | 1 + fs/ext4/xattr_trusted.c | 1 + fs/ext4/xattr_user.c | 1 + fs/f2fs/acl.c | 5 +- fs/f2fs/acl.h | 3 +- fs/f2fs/f2fs.h | 7 +- fs/f2fs/file.c | 35 +- fs/f2fs/namei.c | 23 +- fs/f2fs/xattr.c | 4 +- fs/fat/fat.h | 6 +- fs/fat/file.c | 24 +- fs/fat/namei_msdos.c | 12 +- fs/fat/namei_vfat.c | 15 +- fs/fcntl.c | 3 +- fs/fuse/acl.c | 3 +- fs/fuse/dir.c | 45 +- fs/fuse/fuse_i.h | 4 +- fs/fuse/xattr.c | 2 + fs/gfs2/acl.c | 5 +- fs/gfs2/acl.h | 3 +- fs/gfs2/file.c | 4 +- fs/gfs2/inode.c | 59 +- fs/gfs2/inode.h | 3 +- fs/gfs2/xattr.c | 1 + fs/hfs/attr.c | 1 + fs/hfs/dir.c | 13 +- fs/hfs/hfs_fs.h | 2 +- fs/hfs/inode.c | 7 +- fs/hfsplus/dir.c | 25 +- fs/hfsplus/hfsplus_fs.h | 5 +- fs/hfsplus/inode.c | 16 +- fs/hfsplus/ioctl.c | 2 +- fs/hfsplus/xattr.c | 1 + fs/hfsplus/xattr_security.c | 1 + fs/hfsplus/xattr_trusted.c | 1 + fs/hfsplus/xattr_user.c | 1 + fs/hostfs/hostfs_kern.c | 29 +- fs/hpfs/hpfs_fn.h | 2 +- fs/hpfs/inode.c | 7 +- fs/hpfs/namei.c | 20 +- fs/hugetlbfs/inode.c | 31 +- fs/init.c | 27 +- fs/inode.c | 50 +- fs/internal.h | 2 +- fs/jffs2/acl.c | 5 +- fs/jffs2/acl.h | 3 +- fs/jffs2/dir.c | 32 +- fs/jffs2/fs.c | 7 +- fs/jffs2/os-linux.h | 2 +- fs/jffs2/security.c | 1 + fs/jffs2/xattr_trusted.c | 1 + fs/jffs2/xattr_user.c | 1 + fs/jfs/acl.c | 5 +- fs/jfs/file.c | 9 +- fs/jfs/ioctl.c | 2 +- fs/jfs/jfs_acl.h | 3 +- fs/jfs/jfs_inode.c | 2 +- fs/jfs/jfs_inode.h | 2 +- fs/jfs/namei.c | 21 +- fs/jfs/xattr.c | 2 + fs/kernfs/dir.c | 7 +- fs/kernfs/inode.c | 19 +- fs/kernfs/kernfs-internal.h | 9 +- fs/libfs.c | 28 +- fs/minix/bitmap.c | 2 +- fs/minix/file.c | 7 +- fs/minix/inode.c | 6 +- fs/minix/minix.h | 3 +- fs/minix/namei.c | 24 +- fs/mount.h | 10 - fs/namei.c | 513 ++++-- fs/namespace.c | 484 +++++- fs/nfs/dir.c | 25 +- fs/nfs/inode.c | 9 +- fs/nfs/internal.h | 10 +- fs/nfs/namespace.c | 14 +- fs/nfs/nfs3_fs.h | 3 +- fs/nfs/nfs3acl.c | 3 +- fs/nfs/nfs4proc.c | 3 + fs/nfsd/nfs2acl.c | 4 +- fs/nfsd/nfs3acl.c | 4 +- fs/nfsd/nfs4acl.c | 4 +- fs/nfsd/nfs4recover.c | 6 +- fs/nfsd/nfsfh.c | 2 +- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/vfs.c | 47 +- fs/nilfs2/inode.c | 13 +- fs/nilfs2/ioctl.c | 2 +- fs/nilfs2/namei.c | 19 +- fs/nilfs2/nilfs.h | 4 +- fs/notify/fanotify/fanotify_user.c | 2 +- fs/notify/inotify/inotify_user.c | 3 +- fs/ntfs/inode.c | 6 +- fs/ntfs/inode.h | 3 +- fs/ocfs2/acl.c | 5 +- fs/ocfs2/acl.h | 3 +- fs/ocfs2/dlmfs/dlmfs.c | 17 +- fs/ocfs2/file.c | 17 +- fs/ocfs2/file.h | 11 +- fs/ocfs2/ioctl.c | 2 +- fs/ocfs2/namei.c | 21 +- fs/ocfs2/refcounttree.c | 4 +- fs/ocfs2/xattr.c | 3 + fs/omfs/dir.c | 13 +- fs/omfs/file.c | 7 +- fs/omfs/inode.c | 2 +- fs/open.c | 50 +- fs/orangefs/acl.c | 5 +- fs/orangefs/inode.c | 20 +- fs/orangefs/namei.c | 12 +- fs/orangefs/orangefs-kernel.h | 13 +- fs/orangefs/xattr.c | 1 + fs/overlayfs/copy_up.c | 20 +- fs/overlayfs/dir.c | 31 +- fs/overlayfs/file.c | 6 +- fs/overlayfs/inode.c | 26 +- fs/overlayfs/overlayfs.h | 44 +- fs/overlayfs/super.c | 19 +- fs/overlayfs/util.c | 4 +- fs/posix_acl.c | 101 +- fs/proc/base.c | 28 +- fs/proc/fd.c | 5 +- fs/proc/fd.h | 3 +- fs/proc/generic.c | 12 +- fs/proc/internal.h | 5 +- fs/proc/proc_net.c | 5 +- fs/proc/proc_sysctl.c | 15 +- fs/proc/root.c | 5 +- fs/proc_namespace.c | 3 + fs/ramfs/file-nommu.c | 9 +- fs/ramfs/inode.c | 18 +- fs/reiserfs/acl.h | 3 +- fs/reiserfs/inode.c | 7 +- fs/reiserfs/ioctl.c | 4 +- fs/reiserfs/namei.c | 21 +- fs/reiserfs/reiserfs.h | 3 +- fs/reiserfs/xattr.c | 12 +- fs/reiserfs/xattr.h | 3 +- fs/reiserfs/xattr_acl.c | 7 +- fs/reiserfs/xattr_security.c | 3 +- fs/reiserfs/xattr_trusted.c | 3 +- fs/reiserfs/xattr_user.c | 3 +- fs/remap_range.c | 7 +- fs/stat.c | 26 +- fs/sysv/file.c | 7 +- fs/sysv/ialloc.c | 2 +- fs/sysv/itree.c | 6 +- fs/sysv/namei.c | 21 +- fs/sysv/sysv.h | 3 +- fs/tracefs/inode.c | 4 +- fs/ubifs/dir.c | 30 +- fs/ubifs/file.c | 5 +- fs/ubifs/ioctl.c | 2 +- fs/ubifs/ubifs.h | 5 +- fs/ubifs/xattr.c | 1 + fs/udf/file.c | 9 +- fs/udf/ialloc.c | 2 +- fs/udf/namei.c | 24 +- fs/udf/symlink.c | 7 +- fs/ufs/ialloc.c | 2 +- fs/ufs/inode.c | 7 +- fs/ufs/namei.c | 19 +- fs/ufs/ufs.h | 3 +- fs/utimes.c | 4 +- fs/vboxsf/dir.c | 12 +- fs/vboxsf/utils.c | 9 +- fs/vboxsf/vfsmod.h | 8 +- fs/verity/enable.c | 2 +- fs/xattr.c | 136 +- fs/xfs/xfs_acl.c | 5 +- fs/xfs/xfs_acl.h | 3 +- fs/xfs/xfs_file.c | 4 +- fs/xfs/xfs_inode.c | 26 +- fs/xfs/xfs_inode.h | 16 +- fs/xfs/xfs_ioctl.c | 23 +- fs/xfs/xfs_iops.c | 98 +- fs/xfs/xfs_iops.h | 3 +- fs/xfs/xfs_qm.c | 3 +- fs/xfs/xfs_super.c | 2 +- fs/xfs/xfs_symlink.c | 5 +- fs/xfs/xfs_symlink.h | 5 +- fs/xfs/xfs_xattr.c | 3 +- fs/zonefs/super.c | 9 +- include/linux/capability.h | 15 +- include/linux/fs.h | 158 +- include/linux/ima.h | 17 +- include/linux/lsm_hook_defs.h | 15 +- include/linux/lsm_hooks.h | 1 + include/linux/mount.h | 7 + include/linux/nfs_fs.h | 7 +- include/linux/posix_acl.h | 15 +- include/linux/posix_acl_xattr.h | 12 +- include/linux/security.h | 46 +- include/linux/syscalls.h | 4 + include/linux/xattr.h | 30 +- include/uapi/asm-generic/unistd.h | 4 +- include/uapi/linux/mount.h | 17 + ipc/mqueue.c | 8 +- kernel/auditsc.c | 5 +- kernel/bpf/inode.c | 13 +- kernel/capability.c | 14 +- kernel/cgroup/cgroup.c | 2 +- kernel/sys.c | 2 +- mm/madvise.c | 4 +- mm/memcontrol.c | 2 +- mm/mincore.c | 4 +- mm/shmem.c | 48 +- net/socket.c | 6 +- net/unix/af_unix.c | 4 +- security/apparmor/apparmorfs.c | 3 +- security/apparmor/domain.c | 13 +- security/apparmor/file.c | 5 +- security/apparmor/lsm.c | 12 +- security/commoncap.c | 109 +- security/integrity/evm/evm_crypto.c | 11 +- security/integrity/evm/evm_main.c | 4 +- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/ima/ima.h | 19 +- security/integrity/ima/ima_api.c | 10 +- security/integrity/ima/ima_appraise.c | 22 +- security/integrity/ima/ima_asymmetric_keys.c | 2 +- security/integrity/ima/ima_main.c | 31 +- security/integrity/ima/ima_policy.c | 19 +- security/integrity/ima/ima_queue_keys.c | 2 +- security/security.c | 25 +- security/selinux/hooks.c | 22 +- security/smack/smack_lsm.c | 18 +- tools/include/uapi/asm-generic/unistd.h | 4 +- tools/testing/selftests/Makefile | 1 + .../selftests/mount_setattr/.gitignore | 1 + .../testing/selftests/mount_setattr/Makefile | 7 + tools/testing/selftests/mount_setattr/config | 1 + .../mount_setattr/mount_setattr_test.c | 1424 +++++++++++++++++ 338 files changed, 4718 insertions(+), 1731 deletions(-) create mode 100644 tools/testing/selftests/mount_setattr/.gitignore create mode 100644 tools/testing/selftests/mount_setattr/Makefile create mode 100644 tools/testing/selftests/mount_setattr/config create mode 100644 tools/testing/selftests/mount_setattr/mount_setattr_test.c base-commit: 7c53f6b671f4aba70ff15e1b05148b10d58c2837 -- 2.30.0