Freshgomod (#106)

* initial go modules, fresh start to find breaking change

* change dep to go mod vendor

* main go modules done, tests passed locally

* upgrade go in dockerfileserver

vendor/software.sslmate.com/src/go-pkcs12/README.md

@@ -5,11 +5,14 @@
     import "software.sslmate.com/src/go-pkcs12" 
 
 Package pkcs12 implements some of PKCS#12 (also known as P12 or PFX).
-It is intended for decoding P12/PFX files for use with the `crypto/tls`
+It is intended for decoding DER-encoded P12/PFX files for use with the `crypto/tls`
 package, and for encoding P12/PFX files for use by legacy applications which
 do not support newer formats.  Since PKCS#12 uses weak encryption
 primitives, it SHOULD NOT be used for new applications.
 
+Note that only DER-encoded PKCS#12 files are supported, even though PKCS#12
+allows BER encoding.  This is becuase encoding/asn1 only supports DER.
+
 This package is forked from `golang.org/x/crypto/pkcs12`, which is frozen.
 The implementation is distilled from https://tools.ietf.org/html/rfc7292
 and referenced documents.

vendor/software.sslmate.com/src/go-pkcs12/bmp-string_test.go

@@ -1,63 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs12
-
-import (
-	"bytes"
-	"encoding/hex"
-	"testing"
-)
-
-var bmpStringTests = []struct {
-	in          string
-	expectedHex string
-	shouldFail  bool
-}{
-	{"", "0000", false},
-	// Example from https://tools.ietf.org/html/rfc7292#appendix-B.
-	{"Beavis", "0042006500610076006900730000", false},
-	// Some characters from the "Letterlike Symbols Unicode block".
-	{"\u2115 - Double-struck N", "21150020002d00200044006f00750062006c0065002d00730074007200750063006b0020004e0000", false},
-	// any character outside the BMP should trigger an error.
-	{"\U0001f000 East wind (Mahjong)", "", true},
-}
-
-func TestBMPString(t *testing.T) {
-	for i, test := range bmpStringTests {
-		expected, err := hex.DecodeString(test.expectedHex)
-		if err != nil {
-			t.Fatalf("#%d: failed to decode expectation", i)
-		}
-
-		out, err := bmpString(test.in)
-		if err == nil && test.shouldFail {
-			t.Errorf("#%d: expected to fail, but produced %x", i, out)
-			continue
-		}
-
-		if err != nil && !test.shouldFail {
-			t.Errorf("#%d: failed unexpectedly: %s", i, err)
-			continue
-		}
-
-		if !test.shouldFail {
-			if !bytes.Equal(out, expected) {
-				t.Errorf("#%d: expected %s, got %x", i, test.expectedHex, out)
-				continue
-			}
-
-			roundTrip, err := decodeBMPString(out)
-			if err != nil {
-				t.Errorf("#%d: decoding output gave an error: %s", i, err)
-				continue
-			}
-
-			if roundTrip != test.in {
-				t.Errorf("#%d: decoding output resulted in %q, but it should have been %q", i, roundTrip, test.in)
-				continue
-			}
-		}
-	}
-}

vendor/software.sslmate.com/src/go-pkcs12/crypto.go

@@ -7,18 +7,28 @@ package pkcs12
 
 import (
 	"bytes"
+	"crypto/aes"
 	"crypto/cipher"
 	"crypto/des"
+	"crypto/sha1"
+	"crypto/sha256"
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"errors"
+	"hash"
 
+	"golang.org/x/crypto/pbkdf2"
 	"software.sslmate.com/src/go-pkcs12/internal/rc2"
 )
 
 var (
 	oidPBEWithSHAAnd3KeyTripleDESCBC = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 3})
 	oidPBEWithSHAAnd40BitRC2CBC      = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 6})
+	oidPBES2                         = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 5, 13})
+	oidPBKDF2                        = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 5, 12})
+	oidHmacWithSHA1                  = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 2, 7})
+	oidHmacWithSHA256                = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 2, 9})
+	oidAES256CBC                     = asn1.ObjectIdentifier([]int{2, 16, 840, 1, 101, 3, 4, 1, 42})
 )
 
 // pbeCipher is an abstraction of a PKCS#12 cipher.
@@ -72,6 +82,17 @@ func pbeCipherFor(algorithm pkix.AlgorithmIdentifier, password []byte) (cipher.B
 		cipherType = shaWithTripleDESCBC{}
 	case algorithm.Algorithm.Equal(oidPBEWithSHAAnd40BitRC2CBC):
 		cipherType = shaWith40BitRC2CBC{}
+	case algorithm.Algorithm.Equal(oidPBES2):
+		// rfc7292#appendix-B.1 (the original PKCS#12 PBE) requires passwords formatted as BMPStrings.
+		// However, rfc8018#section-3 recommends that the password for PBES2 follow ASCII or UTF-8.
+		// This is also what Windows expects.
+		// Therefore, we convert the password to UTF-8.
+		originalPassword, err := decodeBMPString(password)
+		if err != nil {
+			return nil, nil, err
+		}
+		utf8Password := []byte(originalPassword)
+		return pbes2CipherFor(algorithm, utf8Password)
 	default:
 		return nil, nil, NotImplementedError("algorithm " + algorithm.Algorithm.String() + " is not supported")
 	}
@@ -134,6 +155,77 @@ func pbDecrypt(info decryptable, password []byte) (decrypted []byte, err error)
 	return
 }
 
+// PBES2-params ::= SEQUENCE {
+// 	keyDerivationFunc AlgorithmIdentifier {{PBES2-KDFs}},
+// 	encryptionScheme AlgorithmIdentifier {{PBES2-Encs}}
+// }
+type pbes2Params struct {
+	Kdf              pkix.AlgorithmIdentifier
+	EncryptionScheme pkix.AlgorithmIdentifier
+}
+
+// PBKDF2-params ::= SEQUENCE {
+//     salt CHOICE {
+//       specified OCTET STRING,
+//       otherSource AlgorithmIdentifier {{PBKDF2-SaltSources}}
+//     },
+//     iterationCount INTEGER (1..MAX),
+//     keyLength INTEGER (1..MAX) OPTIONAL,
+//     prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT
+//     algid-hmacWithSHA1
+// }
+type pbkdf2Params struct {
+	Salt       asn1.RawValue
+	Iterations int
+	KeyLength  int `asn1:"optional"`
+	Prf        pkix.AlgorithmIdentifier
+}
+
+func pbes2CipherFor(algorithm pkix.AlgorithmIdentifier, password []byte) (cipher.Block, []byte, error) {
+	var params pbes2Params
+	if err := unmarshal(algorithm.Parameters.FullBytes, &params); err != nil {
+		return nil, nil, err
+	}
+
+	if !params.Kdf.Algorithm.Equal(oidPBKDF2) {
+		return nil, nil, NotImplementedError("kdf algorithm " + params.Kdf.Algorithm.String() + " is not supported")
+	}
+
+	var kdfParams pbkdf2Params
+	if err := unmarshal(params.Kdf.Parameters.FullBytes, &kdfParams); err != nil {
+		return nil, nil, err
+	}
+	if kdfParams.Salt.Tag != asn1.TagOctetString {
+		return nil, nil, errors.New("pkcs12: only octet string salts are supported for pbkdf2")
+	}
+
+	var prf func() hash.Hash
+	switch {
+	case kdfParams.Prf.Algorithm.Equal(oidHmacWithSHA256):
+		prf = sha256.New
+	case kdfParams.Prf.Algorithm.Equal(oidHmacWithSHA1):
+		prf = sha1.New
+	case kdfParams.Prf.Algorithm.Equal(asn1.ObjectIdentifier([]int{})):
+		prf = sha1.New
+	}
+
+	key := pbkdf2.Key(password, kdfParams.Salt.Bytes, kdfParams.Iterations, 32, prf)
+	iv := params.EncryptionScheme.Parameters.Bytes
+
+	var block cipher.Block
+	switch {
+	case params.EncryptionScheme.Algorithm.Equal(oidAES256CBC):
+		b, err := aes.NewCipher(key)
+		if err != nil {
+			return nil, nil, err
+		}
+		block = b
+	default:
+		return nil, nil, NotImplementedError("pbes2 algorithm " + params.EncryptionScheme.Algorithm.String() + " is not supported")
+	}
+	return block, iv, nil
+}
+
 // decryptable abstracts an object that contains ciphertext.
 type decryptable interface {
 	Algorithm() pkix.AlgorithmIdentifier

vendor/software.sslmate.com/src/go-pkcs12/crypto_test.go

@@ -1,194 +0,0 @@
-// Copyright 2015, 2018, 2019 Opsmate, Inc. All rights reserved.
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs12
-
-import (
-	"bytes"
-	"crypto/x509/pkix"
-	"encoding/asn1"
-	"testing"
-)
-
-var sha1WithTripleDES = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 3})
-
-func TestPbDecrypterFor(t *testing.T) {
-	params, _ := asn1.Marshal(pbeParams{
-		Salt:       []byte{1, 2, 3, 4, 5, 6, 7, 8},
-		Iterations: 2048,
-	})
-	alg := pkix.AlgorithmIdentifier{
-		Algorithm: asn1.ObjectIdentifier([]int{1, 2, 3}),
-		Parameters: asn1.RawValue{
-			FullBytes: params,
-		},
-	}
-
-	pass, _ := bmpString("Sesame open")
-
-	_, _, err := pbDecrypterFor(alg, pass)
-	if _, ok := err.(NotImplementedError); !ok {
-		t.Errorf("expected not implemented error, got: %T %s", err, err)
-	}
-
-	alg.Algorithm = sha1WithTripleDES
-	cbc, blockSize, err := pbDecrypterFor(alg, pass)
-	if err != nil {
-		t.Errorf("unexpected error from pbDecrypterFor %v", err)
-	}
-	if blockSize != 8 {
-		t.Errorf("unexpected block size %d, wanted 8", blockSize)
-	}
-
-	plaintext := []byte{1, 2, 3, 4, 5, 6, 7, 8}
-	expectedCiphertext := []byte{185, 73, 135, 249, 137, 1, 122, 247}
-	ciphertext := make([]byte, len(plaintext))
-	cbc.CryptBlocks(ciphertext, plaintext)
-
-	if bytes.Compare(ciphertext, expectedCiphertext) != 0 {
-		t.Errorf("bad ciphertext, got %x but wanted %x", ciphertext, expectedCiphertext)
-	}
-}
-
-func TestPbEncrypterFor(t *testing.T) {
-	params, _ := asn1.Marshal(pbeParams{
-		Salt:       []byte{1, 2, 3, 4, 5, 6, 7, 8},
-		Iterations: 2048,
-	})
-	alg := pkix.AlgorithmIdentifier{
-		Algorithm: asn1.ObjectIdentifier([]int{1, 2, 3}),
-		Parameters: asn1.RawValue{
-			FullBytes: params,
-		},
-	}
-
-	pass, _ := bmpString("Sesame open")
-
-	_, _, err := pbEncrypterFor(alg, pass)
-	if _, ok := err.(NotImplementedError); !ok {
-		t.Errorf("expected not implemented error, got: %T %s", err, err)
-	}
-
-	alg.Algorithm = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 3})
-	cbc, _, err := pbEncrypterFor(alg, pass)
-	if err != nil {
-		t.Errorf("err: %v", err)
-	}
-
-	expectedM := []byte{1, 2, 3, 4, 5, 6, 7, 8}
-	M := []byte{185, 73, 135, 249, 137, 1, 122, 247}
-	cbc.CryptBlocks(M, M)
-
-	if bytes.Compare(M, expectedM) != 0 {
-		t.Errorf("expected M to be '%d', but found '%d", expectedM, M)
-	}
-}
-
-var pbDecryptTests = []struct {
-	in            []byte
-	expected      []byte
-	expectedError error
-}{
-	{
-		[]byte("\x33\x73\xf3\x9f\xda\x49\xae\xfc\xa0\x9a\xdf\x5a\x58\xa0\xea\x46"), // 7 padding bytes
-		[]byte("A secret!"),
-		nil,
-	},
-	{
-		[]byte("\x33\x73\xf3\x9f\xda\x49\xae\xfc\x96\x24\x2f\x71\x7e\x32\x3f\xe7"), // 8 padding bytes
-		[]byte("A secret"),
-		nil,
-	},
-	{
-		[]byte("\x35\x0c\xc0\x8d\xab\xa9\x5d\x30\x7f\x9a\xec\x6a\xd8\x9b\x9c\xd9"), // 9 padding bytes, incorrect
-		nil,
-		ErrDecryption,
-	},
-	{
-		[]byte("\xb2\xf9\x6e\x06\x60\xae\x20\xcf\x08\xa0\x7b\xd9\x6b\x20\xef\x41"), // incorrect padding bytes: [ ... 0x04 0x02 ]
-		nil,
-		ErrDecryption,
-	},
-}
-
-func TestPbDecrypt(t *testing.T) {
-	for i, test := range pbDecryptTests {
-		decryptable := testDecryptable{
-			data: test.in,
-			algorithm: pkix.AlgorithmIdentifier{
-				Algorithm: sha1WithTripleDES,
-				Parameters: pbeParams{
-					Salt:       []byte("\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8"),
-					Iterations: 4096,
-				}.RawASN1(),
-			},
-		}
-		password, _ := bmpString("sesame")
-
-		plaintext, err := pbDecrypt(decryptable, password)
-		if err != test.expectedError {
-			t.Errorf("#%d: got error %q, but wanted %q", i, err, test.expectedError)
-			continue
-		}
-
-		if !bytes.Equal(plaintext, test.expected) {
-			t.Errorf("#%d: got %x, but wanted %x", i, plaintext, test.expected)
-		}
-	}
-}
-
-func TestPbEncrypt(t *testing.T) {
-	tests := [][]byte{
-		[]byte("A secret!"),
-		[]byte("A secret"),
-	}
-	expected := [][]byte{
-		[]byte("\x33\x73\xf3\x9f\xda\x49\xae\xfc\xa0\x9a\xdf\x5a\x58\xa0\xea\x46"), // 7 padding bytes
-		[]byte("\x33\x73\xf3\x9f\xda\x49\xae\xfc\x96\x24\x2f\x71\x7e\x32\x3f\xe7"), // 8 padding bytes
-	}
-
-	for i, c := range tests {
-		td := testDecryptable{
-			algorithm: pkix.AlgorithmIdentifier{
-				Algorithm: asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 3}), // SHA1/3TDES
-				Parameters: pbeParams{
-					Salt:       []byte("\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8"),
-					Iterations: 4096,
-				}.RawASN1(),
-			},
-		}
-		p, _ := bmpString("sesame")
-
-		err := pbEncrypt(&td, c, p)
-		if err != nil {
-			t.Errorf("error encrypting %d: %v", c, err)
-		}
-
-		if bytes.Compare(td.data, expected[i]) != 0 {
-			t.Errorf("expected %d to be encrypted to %d, but found %d", c, expected[i], td.data)
-		}
-	}
-}
-
-type testDecryptable struct {
-	data      []byte
-	algorithm pkix.AlgorithmIdentifier
-}
-
-func (d testDecryptable) Algorithm() pkix.AlgorithmIdentifier { return d.algorithm }
-func (d testDecryptable) Data() []byte                        { return d.data }
-func (d *testDecryptable) SetData(data []byte)                { d.data = data }
-
-func (params pbeParams) RawASN1() (raw asn1.RawValue) {
-	asn1Bytes, err := asn1.Marshal(params)
-	if err != nil {
-		panic(err)
-	}
-	_, err = asn1.Unmarshal(asn1Bytes, &raw)
-	if err != nil {
-		panic(err)
-	}
-	return
-}

vendor/software.sslmate.com/src/go-pkcs12/internal/rc2/bench_test.go

@@ -1,27 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package rc2
-
-import (
-	"testing"
-)
-
-func BenchmarkEncrypt(b *testing.B) {
-	r, _ := New([]byte{0, 0, 0, 0, 0, 0, 0, 0}, 64)
-	b.ResetTimer()
-	var src [8]byte
-	for i := 0; i < b.N; i++ {
-		r.Encrypt(src[:], src[:])
-	}
-}
-
-func BenchmarkDecrypt(b *testing.B) {
-	r, _ := New([]byte{0, 0, 0, 0, 0, 0, 0, 0}, 64)
-	b.ResetTimer()
-	var src [8]byte
-	for i := 0; i < b.N; i++ {
-		r.Decrypt(src[:], src[:])
-	}
-}

vendor/software.sslmate.com/src/go-pkcs12/internal/rc2/rc2_test.go

@@ -1,92 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package rc2
-
-import (
-	"bytes"
-	"encoding/hex"
-	"testing"
-)
-
-func TestEncryptDecrypt(t *testing.T) {
-	// TODO(dgryski): add the rest of the test vectors from the RFC
-	var tests = []struct {
-		key    string
-		plain  string
-		cipher string
-		t1     int
-	}{
-		{
-			"0000000000000000",
-			"0000000000000000",
-			"ebb773f993278eff",
-			63,
-		},
-		{
-			"ffffffffffffffff",
-			"ffffffffffffffff",
-			"278b27e42e2f0d49",
-			64,
-		},
-		{
-			"3000000000000000",
-			"1000000000000001",
-			"30649edf9be7d2c2",
-			64,
-		},
-		{
-			"88",
-			"0000000000000000",
-			"61a8a244adacccf0",
-			64,
-		},
-		{
-			"88bca90e90875a",
-			"0000000000000000",
-			"6ccf4308974c267f",
-			64,
-		},
-		{
-			"88bca90e90875a7f0f79c384627bafb2",
-			"0000000000000000",
-			"1a807d272bbe5db1",
-			64,
-		},
-		{
-			"88bca90e90875a7f0f79c384627bafb2",
-			"0000000000000000",
-			"2269552ab0f85ca6",
-			128,
-		},
-		{
-			"88bca90e90875a7f0f79c384627bafb216f80a6f85920584c42fceb0be255daf1e",
-			"0000000000000000",
-			"5b78d3a43dfff1f1",
-			129,
-		},
-	}
-
-	for _, tt := range tests {
-		k, _ := hex.DecodeString(tt.key)
-		p, _ := hex.DecodeString(tt.plain)
-		c, _ := hex.DecodeString(tt.cipher)
-
-		b, _ := New(k, tt.t1)
-
-		var dst [8]byte
-
-		b.Encrypt(dst[:], p)
-
-		if !bytes.Equal(dst[:], c) {
-			t.Errorf("encrypt failed: got % 2x wanted % 2x\n", dst, c)
-		}
-
-		b.Decrypt(dst[:], c)
-
-		if !bytes.Equal(dst[:], p) {
-			t.Errorf("decrypt failed: got % 2x wanted % 2x\n", dst, p)
-		}
-	}
-}

vendor/software.sslmate.com/src/go-pkcs12/mac.go

@@ -8,8 +8,10 @@ package pkcs12
 import (
 	"crypto/hmac"
 	"crypto/sha1"
+	"crypto/sha256"
 	"crypto/x509/pkix"
 	"encoding/asn1"
+	"hash"
 )
 
 type macData struct {
@@ -25,17 +27,25 @@ type digestInfo struct {
 }
 
 var (
-	oidSHA1 = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
+	oidSHA1   = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
+	oidSHA256 = asn1.ObjectIdentifier([]int{2, 16, 840, 1, 101, 3, 4, 2, 1})
 )
 
 func verifyMac(macData *macData, message, password []byte) error {
-	if !macData.Mac.Algorithm.Algorithm.Equal(oidSHA1) {
+	var hFn func() hash.Hash
+	var key []byte
+	switch {
+	case macData.Mac.Algorithm.Algorithm.Equal(oidSHA1):
+		hFn = sha1.New
+		key = pbkdf(sha1Sum, 20, 64, macData.MacSalt, password, macData.Iterations, 3, 20)
+	case macData.Mac.Algorithm.Algorithm.Equal(oidSHA256):
+		hFn = sha256.New
+		key = pbkdf(sha256Sum, 32, 64, macData.MacSalt, password, macData.Iterations, 3, 32)
+	default:
 		return NotImplementedError("unknown digest algorithm: " + macData.Mac.Algorithm.Algorithm.String())
 	}
 
-	key := pbkdf(sha1Sum, 20, 64, macData.MacSalt, password, macData.Iterations, 3, 20)
-
-	mac := hmac.New(sha1.New, key)
+	mac := hmac.New(hFn, key)
 	mac.Write(message)
 	expectedMAC := mac.Sum(nil)
 

vendor/software.sslmate.com/src/go-pkcs12/mac_test.go

@@ -1,73 +0,0 @@
-// Copyright 2015, 2018, 2019 Opsmate, Inc. All rights reserved.
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs12
-
-import (
-	"bytes"
-	"encoding/asn1"
-	"testing"
-)
-
-func TestVerifyMac(t *testing.T) {
-	td := macData{
-		Mac: digestInfo{
-			Digest: []byte{0x18, 0x20, 0x3d, 0xff, 0x1e, 0x16, 0xf4, 0x92, 0xf2, 0xaf, 0xc8, 0x91, 0xa9, 0xba, 0xd6, 0xca, 0x9d, 0xee, 0x51, 0x93},
-		},
-		MacSalt:    []byte{1, 2, 3, 4, 5, 6, 7, 8},
-		Iterations: 2048,
-	}
-
-	message := []byte{11, 12, 13, 14, 15}
-	password, _ := bmpString("")
-
-	td.Mac.Algorithm.Algorithm = asn1.ObjectIdentifier([]int{1, 2, 3})
-	err := verifyMac(&td, message, password)
-	if _, ok := err.(NotImplementedError); !ok {
-		t.Errorf("err: %v", err)
-	}
-
-	td.Mac.Algorithm.Algorithm = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
-	err = verifyMac(&td, message, password)
-	if err != ErrIncorrectPassword {
-		t.Errorf("Expected incorrect password, got err: %v", err)
-	}
-
-	password, _ = bmpString("Sesame open")
-	err = verifyMac(&td, message, password)
-	if err != nil {
-		t.Errorf("err: %v", err)
-	}
-
-}
-
-func TestComputeMac(t *testing.T) {
-	td := macData{
-		MacSalt:    []byte{1, 2, 3, 4, 5, 6, 7, 8},
-		Iterations: 2048,
-	}
-
-	message := []byte{11, 12, 13, 14, 15}
-	password, _ := bmpString("Sesame open")
-
-	td.Mac.Algorithm.Algorithm = asn1.ObjectIdentifier([]int{1, 2, 3})
-	err := computeMac(&td, message, password)
-	if _, ok := err.(NotImplementedError); !ok {
-		t.Errorf("err: %v", err)
-	}
-
-	td.Mac.Algorithm.Algorithm = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
-	err = computeMac(&td, message, password)
-	if err != nil {
-		t.Errorf("err: %v", err)
-	}
-
-	expectedDigest := []byte{0x18, 0x20, 0x3d, 0xff, 0x1e, 0x16, 0xf4, 0x92, 0xf2, 0xaf, 0xc8, 0x91, 0xa9, 0xba, 0xd6, 0xca, 0x9d, 0xee, 0x51, 0x93}
-
-	if bytes.Compare(td.Mac.Digest, expectedDigest) != 0 {
-		t.Errorf("Computed incorrect MAC; expected MAC to be '%d' but got '%d'", expectedDigest, td.Mac.Digest)
-	}
-
-}

vendor/software.sslmate.com/src/go-pkcs12/pbkdf.go

@@ -7,6 +7,7 @@ package pkcs12
 import (
 	"bytes"
 	"crypto/sha1"
+	"crypto/sha256"
 	"math/big"
 )
 
@@ -20,6 +21,12 @@ func sha1Sum(in []byte) []byte {
 	return sum[:]
 }
 
+// sha256Sum returns the SHA-256 hash of in.
+func sha256Sum(in []byte) []byte {
+	sum := sha256.Sum256(in)
+	return sum[:]
+}
+
 // fillWithRepeats returns v*ceiling(len(pattern) / v) bytes consisting of
 // repeats of pattern.
 func fillWithRepeats(pattern []byte, v int) []byte {
@@ -102,7 +109,7 @@ func pbkdf(hash func([]byte) []byte, u, v int, salt, password []byte, r int, ID
 	c := (size + u - 1) / u
 
 	//    6.  For i=1, 2, ..., c, do the following:
-	A := make([]byte, c*20)
+	A := make([]byte, c*u)
 	var IjBuf []byte
 	for i := 0; i < c; i++ {
 		//        A.  Set A2=H^r(D||I). (i.e., the r-th hash of D||1,
@@ -111,7 +118,7 @@ func pbkdf(hash func([]byte) []byte, u, v int, salt, password []byte, r int, ID
 		for j := 1; j < r; j++ {
 			Ai = hash(Ai)
 		}
-		copy(A[i*20:], Ai[:])
+		copy(A[i*u:], Ai[:])
 
 		if i < c-1 { // skip on last iteration
 			// B.  Concatenate copies of Ai to create a string B of length v

vendor/software.sslmate.com/src/go-pkcs12/pbkdf_test.go

@@ -1,34 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs12
-
-import (
-	"bytes"
-	"testing"
-)
-
-func TestThatPBKDFWorksCorrectlyForLongKeys(t *testing.T) {
-	cipherInfo := shaWithTripleDESCBC{}
-
-	salt := []byte("\xff\xff\xff\xff\xff\xff\xff\xff")
-	password, _ := bmpString("sesame")
-	key := cipherInfo.deriveKey(salt, password, 2048)
-
-	if expected := []byte("\x7c\xd9\xfd\x3e\x2b\x3b\xe7\x69\x1a\x44\xe3\xbe\xf0\xf9\xea\x0f\xb9\xb8\x97\xd4\xe3\x25\xd9\xd1"); bytes.Compare(key, expected) != 0 {
-		t.Fatalf("expected key '%x', but found '%x'", expected, key)
-	}
-}
-
-func TestThatPBKDFHandlesLeadingZeros(t *testing.T) {
-	// This test triggers a case where I_j (in step 6C) ends up with leading zero
-	// byte, meaning that len(Ijb) < v (leading zeros get stripped by big.Int).
-	// This was previously causing bug whereby certain inputs would break the
-	// derivation and produce the wrong output.
-	key := pbkdf(sha1Sum, 20, 64, []byte("\xf3\x7e\x05\xb5\x18\x32\x4b\x4b"), []byte("\x00\x00"), 2048, 1, 24)
-	expected := []byte("\x00\xf7\x59\xff\x47\xd1\x4d\xd0\x36\x65\xd5\x94\x3c\xb3\xc4\xa3\x9a\x25\x55\xc0\x2a\xed\x66\xe1")
-	if bytes.Compare(key, expected) != 0 {
-		t.Fatalf("expected key '%x', but found '%x'", expected, key)
-	}
-}

vendor/software.sslmate.com/src/go-pkcs12/pkcs12.go

@@ -4,11 +4,14 @@
 // license that can be found in the LICENSE file.
 
 // Package pkcs12 implements some of PKCS#12 (also known as P12 or PFX).
-// It is intended for decoding P12/PFX files for use with the crypto/tls
+// It is intended for decoding DER-encoded P12/PFX files for use with the crypto/tls
 // package, and for encoding P12/PFX files for use by legacy applications which
 // do not support newer formats.  Since PKCS#12 uses weak encryption
 // primitives, it SHOULD NOT be used for new applications.
 //
+// Note that only DER-encoded PKCS#12 files are supported, even though PKCS#12
+// allows BER encoding.  This is becuase encoding/asn1 only supports DER.
+//
 // This package is forked from golang.org/x/crypto/pkcs12, which is frozen.
 // The implementation is distilled from https://tools.ietf.org/html/rfc7292
 // and referenced documents.
@@ -40,6 +43,8 @@ var (
 	oidFriendlyName     = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 20})
 	oidLocalKeyID       = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 21})
 	oidMicrosoftCSPName = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 311, 17, 1})
+
+	oidJavaTrustStore = asn1.ObjectIdentifier([]int{2, 16, 840, 1, 113894, 746875, 1, 1})
 )
 
 type pfxPdu struct {
@@ -78,6 +83,15 @@ type safeBag struct {
 	Attributes []pkcs12Attribute `asn1:"set,optional"`
 }
 
+func (bag *safeBag) hasAttribute(id asn1.ObjectIdentifier) bool {
+	for _, attr := range bag.Attributes {
+		if attr.Id.Equal(id) {
+			return true
+		}
+	}
+	return false
+}
+
 type pkcs12Attribute struct {
 	Id    asn1.ObjectIdentifier
 	Value asn1.RawValue `asn1:"set"`
@@ -130,7 +144,7 @@ func ToPEM(pfxData []byte, password string) ([]*pem.Block, error) {
 		return nil, ErrIncorrectPassword
 	}
 
-	bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword)
+	bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword, 2)
 
 	if err != nil {
 		return nil, err
@@ -229,7 +243,7 @@ func convertAttribute(attribute *pkcs12Attribute) (key, value string, err error)
 	return key, value, nil
 }
 
-// Decode extracts a certificate and private key from pfxData. This function
+// Decode extracts a certificate and private key from pfxData, which must be a DER-encoded PKCS#12 file. This function
 // assumes that there is only one certificate and only one private key in the
 // pfxData.  Since PKCS#12 files often contain more than one certificate, you
 // probably want to use DecodeChain instead.
@@ -243,7 +257,7 @@ func Decode(pfxData []byte, password string) (privateKey interface{}, certificat
 }
 
 // DecodeChain extracts a certificate, a CA certificate chain, and private key
-// from pfxData. This function assumes that there is at least one certificate
+// from pfxData, which must be a DER-encoded PKCS#12 file. This function assumes that there is at least one certificate
 // and only one private key in the pfxData.  The first certificate is assumed to
 // be the leaf certificate, and subsequent certificates, if any, are assumed to
 // comprise the CA certificate chain.
@@ -253,7 +267,7 @@ func DecodeChain(pfxData []byte, password string) (privateKey interface{}, certi
 		return nil, nil, nil, err
 	}
 
-	bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword)
+	bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword, 2)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -301,7 +315,51 @@ func DecodeChain(pfxData []byte, password string) (privateKey interface{}, certi
 	return
 }
 
-func getSafeContents(p12Data, password []byte) (bags []safeBag, updatedPassword []byte, err error) {
+// DecodeTrustStore extracts the certificates from pfxData, which must be a DER-encoded
+// PKCS#12 file containing exclusively certificates with attribute 2.16.840.1.113894.746875.1.1,
+// which is used by Java to designate a trust anchor.
+func DecodeTrustStore(pfxData []byte, password string) (certs []*x509.Certificate, err error) {
+	encodedPassword, err := bmpString(password)
+	if err != nil {
+		return nil, err
+	}
+
+	bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword, 1)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, bag := range bags {
+		switch {
+		case bag.Id.Equal(oidCertBag):
+			if !bag.hasAttribute(oidJavaTrustStore) {
+				return nil, errors.New("pkcs12: trust store contains a certificate that is not marked as trusted")
+			}
+			certsData, err := decodeCertBag(bag.Value.Bytes)
+			if err != nil {
+				return nil, err
+			}
+			parsedCerts, err := x509.ParseCertificates(certsData)
+			if err != nil {
+				return nil, err
+			}
+
+			if len(parsedCerts) != 1 {
+				err = errors.New("pkcs12: expected exactly one certificate in the certBag")
+				return nil, err
+			}
+
+			certs = append(certs, parsedCerts[0])
+
+		default:
+			return nil, errors.New("pkcs12: expected only certificate bags")
+		}
+	}
+
+	return
+}
+
+func getSafeContents(p12Data, password []byte, expectedItems int) (bags []safeBag, updatedPassword []byte, err error) {
 	pfx := new(pfxPdu)
 	if err := unmarshal(p12Data, pfx); err != nil {
 		return nil, nil, errors.New("pkcs12: error reading P12 data: " + err.Error())
@@ -342,7 +400,7 @@ func getSafeContents(p12Data, password []byte) (bags []safeBag, updatedPassword
 		return nil, nil, err
 	}
 
-	if len(authenticatedSafe) != 2 {
+	if len(authenticatedSafe) != expectedItems {
 		return nil, nil, NotImplementedError("expected exactly two items in the authenticated safe")
 	}
 
@@ -481,6 +539,81 @@ func Encode(rand io.Reader, privateKey interface{}, certificate *x509.Certificat
 	return
 }
 
+// EncodeTrustStore produces pfxData containing any number of CA certificates
+// (certs) to be trusted. The certificates will be marked with a special OID that
+// allow it to be used as a Java TrustStore in Java 1.8 and newer.
+//
+// Due to the weak encryption primitives used by PKCS#12, it is RECOMMENDED that
+// you specify a hard-coded password (such as pkcs12.DefaultPassword) and protect
+// the resulting pfxData using other means.
+//
+// The rand argument is used to provide entropy for the encryption, and
+// can be set to rand.Reader from the crypto/rand package.
+//
+// EncodeTrustStore creates a single SafeContents that's encrypted with RC2
+// and contains the certificates.
+func EncodeTrustStore(rand io.Reader, certs []*x509.Certificate, password string) (pfxData []byte, err error) {
+	encodedPassword, err := bmpString(password)
+	if err != nil {
+		return nil, err
+	}
+
+	var pfx pfxPdu
+	pfx.Version = 3
+
+	// Setting this attribute will make the certificates trusted in Java >= 1.8
+	var javaTrustStoreAttr pkcs12Attribute
+	javaTrustStoreAttr.Id = oidJavaTrustStore
+	javaTrustStoreAttr.Value.Class = 0
+	javaTrustStoreAttr.Value.Tag = 17
+	javaTrustStoreAttr.Value.IsCompound = true
+
+	var certBags []safeBag
+	for _, cert := range certs {
+		certBag, err := makeCertBag(cert.Raw, []pkcs12Attribute{javaTrustStoreAttr})
+		if err != nil {
+			return nil, err
+		}
+		certBags = append(certBags, *certBag)
+	}
+
+	// Construct an authenticated safe with one SafeContent.
+	// The SafeContents is encrypted and contains the cert bags.
+	var authenticatedSafe [1]contentInfo
+	if authenticatedSafe[0], err = makeSafeContents(rand, certBags, encodedPassword); err != nil {
+		return nil, err
+	}
+
+	var authenticatedSafeBytes []byte
+	if authenticatedSafeBytes, err = asn1.Marshal(authenticatedSafe[:]); err != nil {
+		return nil, err
+	}
+
+	// compute the MAC
+	pfx.MacData.Mac.Algorithm.Algorithm = oidSHA1
+	pfx.MacData.MacSalt = make([]byte, 8)
+	if _, err = rand.Read(pfx.MacData.MacSalt); err != nil {
+		return nil, err
+	}
+	pfx.MacData.Iterations = 1
+	if err = computeMac(&pfx.MacData, authenticatedSafeBytes, encodedPassword); err != nil {
+		return nil, err
+	}
+
+	pfx.AuthSafe.ContentType = oidDataContentType
+	pfx.AuthSafe.Content.Class = 2
+	pfx.AuthSafe.Content.Tag = 0
+	pfx.AuthSafe.Content.IsCompound = true
+	if pfx.AuthSafe.Content.Bytes, err = asn1.Marshal(authenticatedSafeBytes); err != nil {
+		return nil, err
+	}
+
+	if pfxData, err = asn1.Marshal(pfx); err != nil {
+		return nil, errors.New("pkcs12: error writing P12 data: " + err.Error())
+	}
+	return
+}
+
 func makeCertBag(certBytes []byte, attributes []pkcs12Attribute) (certBag *safeBag, err error) {
 	certBag = new(safeBag)
 	certBag.Id = oidCertBag

vendor/software.sslmate.com/src/go-pkcs12/pkcs12_test.go

@@ -1,138 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package pkcs12
-
-import (
-	"crypto/rsa"
-	"crypto/tls"
-	"encoding/base64"
-	"encoding/pem"
-	"testing"
-)
-
-func TestPfx(t *testing.T) {
-	for commonName, base64P12 := range testdata {
-		p12, _ := base64.StdEncoding.DecodeString(base64P12)
-
-		priv, cert, err := Decode(p12, "")
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		if err := priv.(*rsa.PrivateKey).Validate(); err != nil {
-			t.Errorf("error while validating private key: %v", err)
-		}
-
-		if cert.Subject.CommonName != commonName {
-			t.Errorf("expected common name to be %q, but found %q", commonName, cert.Subject.CommonName)
-		}
-	}
-}
-
-func TestPEM(t *testing.T) {
-	for commonName, base64P12 := range testdata {
-		p12, _ := base64.StdEncoding.DecodeString(base64P12)
-
-		blocks, err := ToPEM(p12, "")
-		if err != nil {
-			t.Fatalf("error while converting to PEM: %s", err)
-		}
-
-		var pemData []byte
-		for _, b := range blocks {
-			pemData = append(pemData, pem.EncodeToMemory(b)...)
-		}
-
-		cert, err := tls.X509KeyPair(pemData, pemData)
-		if err != nil {
-			t.Errorf("err while converting to key pair: %v", err)
-		}
-		config := tls.Config{
-			Certificates: []tls.Certificate{cert},
-		}
-		config.BuildNameToCertificate()
-
-		if _, exists := config.NameToCertificate[commonName]; !exists {
-			t.Errorf("did not find our cert in PEM?: %v", config.NameToCertificate)
-		}
-	}
-}
-
-func ExampleToPEM() {
-	p12, _ := base64.StdEncoding.DecodeString(`MIIJzgIBAzCCCZQGCS ... CA+gwggPk==`)
-
-	blocks, err := ToPEM(p12, "password")
-	if err != nil {
-		panic(err)
-	}
-
-	var pemData []byte
-	for _, b := range blocks {
-		pemData = append(pemData, pem.EncodeToMemory(b)...)
-	}
-
-	// then use PEM data for tls to construct tls certificate:
-	cert, err := tls.X509KeyPair(pemData, pemData)
-	if err != nil {
-		panic(err)
-	}
-
-	config := &tls.Config{
-		Certificates: []tls.Certificate{cert},
-	}
-
-	_ = config
-}
-
-var testdata = map[string]string{
-	// 'null' password test case
-	"Windows Azure Tools": `MIIKDAIBAzCCCcwGCSqGSIb3DQEHAaCCCb0Eggm5MIIJtTCCBe4GCSqGSIb3DQEHAaCCBd8EggXbMIIF1zCCBdMGCyqGSIb3DQEMCgECoIIE7jCCBOowHAYKKoZIhvcNAQwBAzAOBAhStUNnlTGV+gICB9AEggTIJ81JIossF6boFWpPtkiQRPtI6DW6e9QD4/WvHAVrM2bKdpMzSMsCML5NyuddANTKHBVq00Jc9keqGNAqJPKkjhSUebzQFyhe0E1oI9T4zY5UKr/I8JclOeccH4QQnsySzYUG2SnniXnQ+JrG3juetli7EKth9h6jLc6xbubPadY5HMB3wL/eG/kJymiXwU2KQ9Mgd4X6jbcV+NNCE/8jbZHvSTCPeYTJIjxfeX61Sj5kFKUCzERbsnpyevhY3X0eYtEDezZQarvGmXtMMdzf8HJHkWRdk9VLDLgjk8uiJif/+X4FohZ37ig0CpgC2+dP4DGugaZZ51hb8tN9GeCKIsrmWogMXDIVd0OACBp/EjJVmFB6y0kUCXxUE0TZt0XA1tjAGJcjDUpBvTntZjPsnH/4ZySy+s2d9OOhJ6pzRQBRm360TzkFdSwk9DLiLdGfv4pwMMu/vNGBlqjP/1sQtj+jprJiD1sDbCl4AdQZVoMBQHadF2uSD4/o17XG/Ci0r2h6Htc2yvZMAbEY4zMjjIn2a+vqIxD6onexaek1R3zbkS9j19D6EN9EWn8xgz80YRCyW65znZk8xaIhhvlU/mg7sTxeyuqroBZNcq6uDaQTehDpyH7bY2l4zWRpoj10a6JfH2q5shYz8Y6UZC/kOTfuGqbZDNZWro/9pYquvNNW0M847E5t9bsf9VkAAMHRGBbWoVoU9VpI0UnoXSfvpOo+aXa2DSq5sHHUTVY7A9eov3z5IqT+pligx11xcs+YhDWcU8di3BTJisohKvv5Y8WSkm/rloiZd4ig269k0jTRk1olP/vCksPli4wKG2wdsd5o42nX1yL7mFfXocOANZbB+5qMkiwdyoQSk+Vq+C8nAZx2bbKhUq2MbrORGMzOe0Hh0x2a0PeObycN1Bpyv7Mp3ZI9h5hBnONKCnqMhtyQHUj/nNvbJUnDVYNfoOEqDiEqqEwB7YqWzAKz8KW0OIqdlM8uiQ4JqZZlFllnWJUfaiDrdFM3lYSnFQBkzeVlts6GpDOOBjCYd7dcCNS6kq6pZC6p6HN60Twu0JnurZD6RT7rrPkIGE8vAenFt4iGe/yF52fahCSY8Ws4K0UTwN7bAS+4xRHVCWvE8sMRZsRCHizb5laYsVrPZJhE6+hux6OBb6w8kwPYXc+ud5v6UxawUWgt6uPwl8mlAtU9Z7Miw4Nn/wtBkiLL/ke1UI1gqJtcQXgHxx6mzsjh41+nAgTvdbsSEyU6vfOmxGj3Rwc1eOrIhJUqn5YjOWfzzsz/D5DzWKmwXIwdspt1p+u+kol1N3f2wT9fKPnd/RGCb4g/1hc3Aju4DQYgGY782l89CEEdalpQ/35bQczMFk6Fje12HykakWEXd/bGm9Unh82gH84USiRpeOfQvBDYoqEyrY3zkFZzBjhDqa+jEcAj41tcGx47oSfDq3iVYCdL7HSIjtnyEktVXd7mISZLoMt20JACFcMw+mrbjlug+eU7o2GR7T+LwtOp/p4LZqyLa7oQJDwde1BNZtm3TCK2P1mW94QDL0nDUps5KLtr1DaZXEkRbjSJub2ZE9WqDHyU3KA8G84Tq/rN1IoNu/if45jacyPje1Npj9IftUZSP22nV7HMwZtwQ4P4MYHRMBMGCSqGSIb3DQEJFTEGBAQBAAAAMFsGCSqGSIb3DQEJFDFOHkwAewBCADQAQQA0AEYARQBCADAALQBBADEAOABBAC0ANAA0AEIAQgAtAEIANQBGADIALQA0ADkAMQBFAEYAMQA1ADIAQgBBADEANgB9MF0GCSsGAQQBgjcRATFQHk4ATQBpAGMAcgBvAHMAbwBmAHQAIABTAG8AZgB0AHcAYQByAGUAIABLAGUAeQAgAFMAdABvAHIAYQBnAGUAIABQAHIAbwB2AGkAZABlAHIwggO/BgkqhkiG9w0BBwagggOwMIIDrAIBADCCA6UGCSqGSIb3DQEHATAcBgoqhkiG9w0BDAEGMA4ECEBk5ZAYpu0WAgIH0ICCA3hik4mQFGpw9Ha8TQPtk+j2jwWdxfF0+sTk6S8PTsEfIhB7wPltjiCK92Uv2tCBQnodBUmatIfkpnRDEySmgmdglmOCzj204lWAMRs94PoALGn3JVBXbO1vIDCbAPOZ7Z0Hd0/1t2hmk8v3//QJGUg+qr59/4y/MuVfIg4qfkPcC2QSvYWcK3oTf6SFi5rv9B1IOWFgN5D0+C+x/9Lb/myPYX+rbOHrwtJ4W1fWKoz9g7wwmGFA9IJ2DYGuH8ifVFbDFT1Vcgsvs8arSX7oBsJVW0qrP7XkuDRe3EqCmKW7rBEwYrFznhxZcRDEpMwbFoSvgSIZ4XhFY9VKYglT+JpNH5iDceYEBOQL4vBLpxNUk3l5jKaBNxVa14AIBxq18bVHJ+STInhLhad4u10v/Xbx7wIL3f9DX1yLAkPrpBYbNHS2/ew6H/ySDJnoIDxkw2zZ4qJ+qUJZ1S0lbZVG+VT0OP5uF6tyOSpbMlcGkdl3z254n6MlCrTifcwkzscysDsgKXaYQw06rzrPW6RDub+t+hXzGny799fS9jhQMLDmOggaQ7+LA4oEZsfT89HLMWxJYDqjo3gIfjciV2mV54R684qLDS+AO09U49e6yEbwGlq8lpmO/pbXCbpGbB1b3EomcQbxdWxW2WEkkEd/VBn81K4M3obmywwXJkw+tPXDXfBmzzaqqCR+onMQ5ME1nMkY8ybnfoCc1bDIupjVWsEL2Wvq752RgI6KqzVNr1ew1IdqV5AWN2fOfek+0vi3Jd9FHF3hx8JMwjJL9dZsETV5kHtYJtE7wJ23J68BnCt2eI0GEuwXcCf5EdSKN/xXCTlIokc4Qk/gzRdIZsvcEJ6B1lGovKG54X4IohikqTjiepjbsMWj38yxDmK3mtENZ9ci8FPfbbvIEcOCZIinuY3qFUlRSbx7VUerEoV1IP3clUwexVQo4lHFee2jd7ocWsdSqSapW7OWUupBtDzRkqVhE7tGria+i1W2d6YLlJ21QTjyapWJehAMO637OdbJCCzDs1cXbodRRE7bsP492ocJy8OX66rKdhYbg8srSFNKdb3pF3UDNbN9jhI/t8iagRhNBhlQtTr1me2E/c86Q18qcRXl4bcXTt6acgCeffK6Y26LcVlrgjlD33AEYRRUeyC+rpxbT0aMjdFderlndKRIyG23mSp0HaUwNzAfMAcGBSsOAwIaBBRlviCbIyRrhIysg2dc/KbLFTc2vQQUg4rfwHMM4IKYRD/fsd1x6dda+wQ=`,
-	// empty string password test case
-	"testing@example.com": `MIIJzgIBAzCCCZQGCSqGSIb3DQEHAaCCCYUEggmBMIIJfTCCA/cGCSqGSIb3DQEHBqCCA+gwggPk
-AgEAMIID3QYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIIszfRGqcmPcCAggAgIIDsOZ9Eg1L
-s5Wx8JhYoV3HAL4aRnkAWvTYB5NISZOgSgIQTssmt/3A7134dibTmaT/93LikkL3cTKLnQzJ4wDf
-YZ1bprpVJvUqz+HFT79m27bP9zYXFrvxWBJbxjYKTSjQMgz+h8LAEpXXGajCmxMJ1oCOtdXkhhzc
-LdZN6SAYgtmtyFnCdMEDskSggGuLb3fw84QEJ/Sj6FAULXunW/CPaS7Ce0TMsKmNU/jfFWj3yXXw
-ro0kwjKiVLpVFlnBlHo2OoVU7hmkm59YpGhLgS7nxLD3n7nBroQ0ID1+8R01NnV9XLGoGzxMm1te
-6UyTCkr5mj+kEQ8EP1Ys7g/TC411uhVWySMt/rcpkx7Vz1r9kYEAzJpONAfr6cuEVkPKrxpq4Fh0
-2fzlKBky0i/hrfIEUmngh+ERHUb/Mtv/fkv1j5w9suESbhsMLLiCXAlsP1UWMX+3bNizi3WVMEts
-FM2k9byn+p8IUD/A8ULlE4kEaWeoc+2idkCNQkLGuIdGUXUFVm58se0auUkVRoRJx8x4CkMesT8j
-b1H831W66YRWoEwwDQp2kK1lA2vQXxdVHWlFevMNxJeromLzj3ayiaFrfByeUXhR2S+Hpm+c0yNR
-4UVU9WED2kacsZcpRm9nlEa5sr28mri5JdBrNa/K02OOhvKCxr5ZGmbOVzUQKla2z4w+Ku9k8POm
-dfDNU/fGx1b5hcFWtghXe3msWVsSJrQihnN6q1ughzNiYZlJUGcHdZDRtiWwCFI0bR8h/Dmg9uO9
-4rawQQrjIRT7B8yF3UbkZyAqs8Ppb1TsMeNPHh1rxEfGVQknh/48ouJYsmtbnzugTUt3mJCXXiL+
-XcPMV6bBVAUu4aaVKSmg9+yJtY4/VKv10iw88ktv29fViIdBe3t6l/oPuvQgbQ8dqf4T8w0l/uKZ
-9lS1Na9jfT1vCoS7F5TRi+tmyj1vL5kr/amEIW6xKEP6oeAMvCMtbPAzVEj38zdJ1R22FfuIBxkh
-f0Zl7pdVbmzRxl/SBx9iIBJSqAvcXItiT0FIj8HxQ+0iZKqMQMiBuNWJf5pYOLWGrIyntCWwHuaQ
-wrx0sTGuEL9YXLEAsBDrsvzLkx/56E4INGZFrH8G7HBdW6iGqb22IMI4GHltYSyBRKbB0gadYTyv
-abPEoqww8o7/85aPSzOTJ/53ozD438Q+d0u9SyDuOb60SzCD/zPuCEd78YgtXJwBYTuUNRT27FaM
-3LGMX8Hz+6yPNRnmnA2XKPn7dx/IlaqAjIs8MIIFfgYJKoZIhvcNAQcBoIIFbwSCBWswggVnMIIF
-YwYLKoZIhvcNAQwKAQKgggTuMIIE6jAcBgoqhkiG9w0BDAEDMA4ECJr0cClYqOlcAgIIAASCBMhe
-OQSiP2s0/46ONXcNeVAkz2ksW3u/+qorhSiskGZ0b3dFa1hhgBU2Q7JVIkc4Hf7OXaT1eVQ8oqND
-uhqsNz83/kqYo70+LS8Hocj49jFgWAKrf/yQkdyP1daHa2yzlEw4mkpqOfnIORQHvYCa8nEApspZ
-wVu8y6WVuLHKU67mel7db2xwstQp7PRuSAYqGjTfAylElog8ASdaqqYbYIrCXucF8iF9oVgmb/Qo
-xrXshJ9aSLO4MuXlTPELmWgj07AXKSb90FKNihE+y0bWb9LPVFY1Sly3AX9PfrtkSXIZwqW3phpv
-MxGxQl/R6mr1z+hlTfY9Wdpb5vlKXPKA0L0Rt8d2pOesylFi6esJoS01QgP1kJILjbrV731kvDc0
-Jsd+Oxv4BMwA7ClG8w1EAOInc/GrV1MWFGw/HeEqj3CZ/l/0jv9bwkbVeVCiIhoL6P6lVx9pXq4t
-KZ0uKg/tk5TVJmG2vLcMLvezD0Yk3G2ZOMrywtmskrwoF7oAUpO9e87szoH6fEvUZlkDkPVW1NV4
-cZk3DBSQiuA3VOOg8qbo/tx/EE3H59P0axZWno2GSB0wFPWd1aj+b//tJEJHaaNR6qPRj4IWj9ru
-Qbc8eRAcVWleHg8uAehSvUXlFpyMQREyrnpvMGddpiTC8N4UMrrBRhV7+UbCOWhxPCbItnInBqgl
-1JpSZIP7iUtsIMdu3fEC2cdbXMTRul+4rdzUR7F9OaezV3jjvcAbDvgbK1CpyC+MJ1Mxm/iTgk9V
-iUArydhlR8OniN84GyGYoYCW9O/KUwb6ASmeFOu/msx8x6kAsSQHIkKqMKv0TUR3kZnkxUvdpBGP
-KTl4YCTvNGX4dYALBqrAETRDhua2KVBD/kEttDHwBNVbN2xi81+Mc7ml461aADfk0c66R/m2sjHB
-2tN9+wG12OIWFQjL6wF/UfJMYamxx2zOOExiId29Opt57uYiNVLOO4ourPewHPeH0u8Gz35aero7
-lkt7cZAe1Q0038JUuE/QGlnK4lESK9UkSIQAjSaAlTsrcfwtQxB2EjoOoLhwH5mvxUEmcNGNnXUc
-9xj3M5BD3zBz3Ft7G3YMMDwB1+zC2l+0UG0MGVjMVaeoy32VVNvxgX7jk22OXG1iaOB+PY9kdk+O
-X+52BGSf/rD6X0EnqY7XuRPkMGgjtpZeAYxRQnFtCZgDY4wYheuxqSSpdF49yNczSPLkgB3CeCfS
-+9NTKN7aC6hBbmW/8yYh6OvSiCEwY0lFS/T+7iaVxr1loE4zI1y/FFp4Pe1qfLlLttVlkygga2UU
-SCunTQ8UB/M5IXWKkhMOO11dP4niWwb39Y7pCWpau7mwbXOKfRPX96cgHnQJK5uG+BesDD1oYnX0
-6frN7FOnTSHKruRIwuI8KnOQ/I+owmyz71wiv5LMQt+yM47UrEjB/EZa5X8dpEwOZvkdqL7utcyo
-l0XH5kWMXdW856LL/FYftAqJIDAmtX1TXF/rbP6mPyN/IlDC0gjP84Uzd/a2UyTIWr+wk49Ek3vQ
-/uDamq6QrwAxVmNh5Tset5Vhpc1e1kb7mRMZIzxSP8JcTuYd45oFKi98I8YjvueHVZce1g7OudQP
-SbFQoJvdT46iBg1TTatlltpOiH2mFaxWVS0xYjAjBgkqhkiG9w0BCRUxFgQUdA9eVqvETX4an/c8
-p8SsTugkit8wOwYJKoZIhvcNAQkUMS4eLABGAHIAaQBlAG4AZABsAHkAIABuAGEAbQBlACAAZgBv
-AHIAIABjAGUAcgB0MDEwITAJBgUrDgMCGgUABBRFsNz3Zd1O1GI8GTuFwCWuDOjEEwQIuBEfIcAy
-HQ8CAggA`,
-}