diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 583014c97..0ed8b6dc9 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -2006,3 +2006,178 @@ jobs: - name: wipe secrets if: always() run: rm -f /root/.ssh/id_ed25519_hertz + + # ------------------------------------------------------------------------- + # reauktion-home-ca — trust anchor for the private reauktion.de Home CA + # (internal *.fritz.box HTTPS; PKI material lives on hertz:/opt/herding/pki/, + # see reference_fritzbox_ca memory). No upstream project: the cert is + # committed alongside the packaging in this repo instead of fetched. + # arch=any / Architecture: all — one build serves every target. + # ------------------------------------------------------------------------- + reauktion-home-ca-any: + needs: sic-agent-debian + runs-on: arch-aarch64 + steps: + - uses: actions/checkout@v4 + + - name: skip if already published + id: skip-check + run: | + set -e + result=$(./.gitea/scripts/check-already-published.sh arch/reauktion-home-ca) + echo "$result" >> "$GITHUB_OUTPUT" + echo "decision: $result" + + - name: bootstrap runner (idempotent) + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo + + - name: import signing key + if: steps.skip-check.outputs.skip != '1' + env: + PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }} + PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }} + run: | + set -e + gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true + rm -rf /root/.gnupg /root/repo_pass + mkdir -m700 -p /root/.gnupg + printf '%s' "$PASS" > /root/repo_pass + chmod 600 /root/repo_pass + printf '%s\n' "$PRIV" | gpg --batch --import + echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust + + - name: install deploy ssh key + if: steps.skip-check.outputs.skip != '1' + env: + KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }} + run: | + mkdir -m700 -p /root/.ssh + printf '%s\n' "$KEY" > /root/.ssh/id_ed25519 + chmod 600 /root/.ssh/id_ed25519 + ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null + + - name: makepkg reauktion-home-ca + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + rm -rf /tmp/build-reauktion-home-ca + cp -r arch/reauktion-home-ca /tmp/build-reauktion-home-ca + chown -R builder:builder /tmp/build-reauktion-home-ca + cd /tmp/build-reauktion-home-ca + sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild + ls -la *.pkg.tar.* | grep -v "\.sig$" + + - name: sign reauktion-home-ca + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + cd /tmp/build-reauktion-home-ca + for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do + [ -f "$f" ] || continue + gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \ + --detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f" + done + + - name: publish reauktion-home-ca to both arches + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + export GNUPGHOME=/root/.gnupg + printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf + printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf + gpg-connect-agent reloadagent /bye + + for target in aarch64 x86_64; do + stage="/tmp/arch-stage-$target" + rm -rf "$stage"; mkdir -p "$stage"; cd "$stage" + for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do + curl -sSLf "https://packages.reauktion.de/arch/$target/$f" -o "$f" || rm -f "$f" + done + cp /tmp/build-reauktion-home-ca/*.pkg.tar.* . + pkgs=() + for ext in xz zst gz; do + for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done + done + if [ -f marfrit.db.tar.gz ]; then + for f in "${pkgs[@]}"; do + name=$(echo "$f" | sed -E 's/-[0-9].*//') + repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \ + marfrit.db.tar.gz "$name" 2>/dev/null || true + done + fi + repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \ + --verify marfrit.db.tar.gz "${pkgs[@]}" + ln -sf marfrit.db.tar.gz marfrit.db + ln -sf marfrit.files.tar.gz marfrit.files + ln -sf marfrit.db.tar.gz.sig marfrit.db.sig + ln -sf marfrit.files.tar.gz.sig marfrit.files.sig + retry rsync -avL --copy-unsafe-links \ + -e 'ssh -i /root/.ssh/id_ed25519' \ + ./ "mfritsche@nc.reauktion.de:arch/$target/" + done + + - name: wipe secrets + if: always() + run: rm -f /root/repo_pass /root/.ssh/id_ed25519 + + reauktion-home-ca-debian: + needs: reauktion-home-ca-any + runs-on: arch-aarch64 + steps: + - uses: actions/checkout@v4 + + - name: skip if already published + id: skip-check + run: | + set -e + result=$(./.gitea/scripts/check-already-published.sh debian/reauktion-home-ca) + echo "$result" >> "$GITHUB_OUTPUT" + echo "decision: $result" + + - name: install dpkg + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl + + - name: install hertz deploy ssh key + if: steps.skip-check.outputs.skip != '1' + env: + KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }} + run: | + mkdir -m700 -p /root/.ssh + printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz + chmod 600 /root/.ssh/id_ed25519_hertz + ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null + + - name: build reauktion-home-ca .deb + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + cd debian/reauktion-home-ca + ./build-deb.sh + ls -la *.deb + + - name: upload + publish to suites + if: steps.skip-check.outputs.skip != '1' + run: | + set -e + retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; } + cd debian/reauktion-home-ca + DEB=$(ls reauktion-home-ca_*.deb | head -1) + retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \ + marfritrepo@hertz.fritz.box: + for suite in bookworm trixie; do + retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \ + "publish-deb $suite $DEB" + done + + - name: wipe secrets + if: always() + run: rm -f /root/.ssh/id_ed25519_hertz diff --git a/arch/reauktion-home-ca/PKGBUILD b/arch/reauktion-home-ca/PKGBUILD new file mode 100644 index 000000000..8d3ee578c --- /dev/null +++ b/arch/reauktion-home-ca/PKGBUILD @@ -0,0 +1,20 @@ +# Maintainer: Markus Fritsche +# Trust anchor for the private reauktion.de Home CA (internal *.fritz.box +# HTTPS). No upstream project — PKI material generated once on hertz +# (/opt/herding/pki/), the cert is committed alongside this PKGBUILD. + +pkgname=reauktion-home-ca +pkgver=20260716 +pkgrel=1 +pkgdesc="reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS" +arch=('any') +url="https://git.reauktion.de/marfrit/marfrit-packages" +license=('custom') +depends=('ca-certificates-utils') +source=('reauktion-home-ca.crt') +sha256sums=('838fdb30d06ecbc95dabcb545920c03535527282e0e602598659e1de6de71f4c') + +package() { + install -Dm644 "${srcdir}/reauktion-home-ca.crt" \ + "${pkgdir}/etc/ca-certificates/trust-source/anchors/reauktion-home-ca.crt" +} diff --git a/arch/reauktion-home-ca/reauktion-home-ca.crt b/arch/reauktion-home-ca/reauktion-home-ca.crt new file mode 100644 index 000000000..1310b939c --- /dev/null +++ b/arch/reauktion-home-ca/reauktion-home-ca.crt @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL +BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u +ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy +MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0 +aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC +DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY +AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA +A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+ +lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M +l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP +6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS +rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU +4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7 +rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu +gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq +CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB +o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB +/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb +o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv +bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj +yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9 +p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9 +2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02 +BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q +J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n +uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr +vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG +R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52 +oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7 +GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V +PMS6m3J+HDRSK/22ACSisUhJIQNL +-----END CERTIFICATE----- diff --git a/debian/reauktion-home-ca/build-deb.sh b/debian/reauktion-home-ca/build-deb.sh new file mode 100755 index 000000000..c18872102 --- /dev/null +++ b/debian/reauktion-home-ca/build-deb.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# Build reauktion-home-ca__all.deb from this directory using dpkg-deb +# directly. Run from inside the runner container, which has dpkg installed. +# +# No upstream tarball: this is PKI trust material (the reauktion.de Home CA +# root cert), not software with its own release cadence. The .crt is +# committed alongside this script instead of being fetched. +set -euo pipefail + +PKGVER=20260716 +PKGREL=1 +HERE=$(dirname "$(readlink -f "$0")") + +# Reproducible build: pin all file mtimes + ar member timestamps so repeat +# builds produce identical bytes (reprepro refuses re-includes otherwise). +export SOURCE_DATE_EPOCH=1784505600 + +work=$(mktemp -d) +trap "rm -rf $work" EXIT + +ROOT="$work/pkgroot" +mkdir -p "$ROOT/DEBIAN" \ + "$ROOT/usr/local/share/ca-certificates" \ + "$ROOT/usr/share/doc/reauktion-home-ca" + +install -m 644 "$HERE/reauktion-home-ca.crt" \ + "$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt" + +cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright" +cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian" +gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian" + +install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst" +install -m 755 "$HERE/debian/postrm" "$ROOT/DEBIAN/postrm" + +cat > "$ROOT/DEBIAN/control" < +Homepage: https://git.reauktion.de/marfrit/marfrit-packages +Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS + Installs the private, name-constrained root CA used to sign internal + *.fritz.box and reauktion.de HTTPS services, so clients don't need -k + or browser exceptions to reach them. + . + Name constraints permit only fritz.box, reauktion.de, and localhost — + a leaked key can forge certificates for no other domain. + . + SHA256 fingerprint: + A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86 +EOF + +# Build the .deb. Output to current dir of the caller. +DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb +dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT" +echo "built: $HERE/$DEB_OUT" diff --git a/debian/reauktion-home-ca/debian/changelog b/debian/reauktion-home-ca/debian/changelog new file mode 100644 index 000000000..c26db2604 --- /dev/null +++ b/debian/reauktion-home-ca/debian/changelog @@ -0,0 +1,9 @@ +reauktion-home-ca (20260716-1) bookworm trixie; urgency=medium + + * Initial release. Trust anchor for the reauktion.de Home CA (created + 2026-07-16 on hertz:/opt/herding/pki/), a name-constrained root + permitted only for fritz.box, reauktion.de, and localhost. Installs + to /usr/local/share/ca-certificates/ and runs update-ca-certificates + on install/remove via maintainer scripts. + + -- Markus Fritsche Mon, 20 Jul 2026 00:00:00 +0000 diff --git a/debian/reauktion-home-ca/debian/control b/debian/reauktion-home-ca/debian/control new file mode 100644 index 000000000..4298c1aae --- /dev/null +++ b/debian/reauktion-home-ca/debian/control @@ -0,0 +1,18 @@ +Package: reauktion-home-ca +Version: 20260716-1 +Section: admin +Priority: optional +Architecture: all +Depends: ca-certificates +Maintainer: Markus Fritsche +Homepage: https://git.reauktion.de/marfrit/marfrit-packages +Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS + Installs the private, name-constrained root CA used to sign internal + *.fritz.box and reauktion.de HTTPS services, so clients don't need -k + or browser exceptions to reach them. + . + Name constraints permit only fritz.box, reauktion.de, and localhost — + a leaked key can forge certificates for no other domain. + . + SHA256 fingerprint: + A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86 diff --git a/debian/reauktion-home-ca/debian/copyright b/debian/reauktion-home-ca/debian/copyright new file mode 100644 index 000000000..dd546c60e --- /dev/null +++ b/debian/reauktion-home-ca/debian/copyright @@ -0,0 +1,9 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: reauktion-home-ca +Source: https://git.reauktion.de/marfrit/marfrit-packages + +Files: * +Copyright: 2026 Markus Fritsche +License: proprietary + Private PKI trust material for the reauktion.de / fritz.box fleet. + Not for redistribution outside that fleet. diff --git a/debian/reauktion-home-ca/debian/postinst b/debian/reauktion-home-ca/debian/postinst new file mode 100755 index 000000000..470f8751e --- /dev/null +++ b/debian/reauktion-home-ca/debian/postinst @@ -0,0 +1,8 @@ +#!/bin/sh +set -e + +if [ "$1" = "configure" ]; then + update-ca-certificates +fi + +exit 0 diff --git a/debian/reauktion-home-ca/debian/postrm b/debian/reauktion-home-ca/debian/postrm new file mode 100755 index 000000000..65cae1c12 --- /dev/null +++ b/debian/reauktion-home-ca/debian/postrm @@ -0,0 +1,8 @@ +#!/bin/sh +set -e + +if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then + update-ca-certificates +fi + +exit 0 diff --git a/debian/reauktion-home-ca/reauktion-home-ca.crt b/debian/reauktion-home-ca/reauktion-home-ca.crt new file mode 100644 index 000000000..1310b939c --- /dev/null +++ b/debian/reauktion-home-ca/reauktion-home-ca.crt @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL +BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u +ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy +MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0 +aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC +DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY +AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA +A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+ +lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M +l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP +6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS +rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU +4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7 +rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu +gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq +CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB +o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB +/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb +o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv +bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj +yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9 +p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9 +2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02 +BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q +J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n +uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr +vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG +R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52 +oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7 +GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V +PMS6m3J+HDRSK/22ACSisUhJIQNL +-----END CERTIFICATE-----