marfrit/marfrit-packages
0
0
Fork 2
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

reauktion-home-ca: add Arch + Debian packaging and CI publish jobs
build and publish packages / distcc-avahi-aarch64 (push) Successful in 5s
Details
build and publish packages / mesa-panvk-bifrost-aarch64 (push) Successful in 4s
Details
build and publish packages / mesa-panvk-bifrost-video-aarch64 (push) Successful in 4s
Details
build and publish packages / lmcp-any (push) Successful in 5s
Details
build and publish packages / lmcp-debian (push) Successful in 4s
Details
build and publish packages / claude-his-any (push) Successful in 4s
Details
build and publish packages / aish-any (push) Successful in 4s
Details
build and publish packages / ffmpeg-v4l2-request-aarch64 (push) Successful in 5s
Details
build and publish packages / claude-his-debian (push) Successful in 5s
Details
build and publish packages / aish-debian (push) Successful in 5s
Details
build and publish packages / libva-v4l2-request-fourier-aarch64 (push) Successful in 4s
Details
build and publish packages / mpv-fourier-aarch64 (push) Successful in 4s
Details
build and publish packages / ffmpeg-v4l2-request-debian (push) Has been cancelled
Details
build and publish packages / libva-v4l2-request-fourier-debian (push) Has been cancelled
Details
build and publish packages / mpv-fourier-debian (push) Has been cancelled
Details
build and publish packages / daedalus-v4l2-debian (push) Has been cancelled
Details
build and publish packages / daedalus-v4l2-dkms-debian (push) Has been cancelled
Details
build and publish packages / sicd-arch (push) Has been cancelled
Details
build and publish packages / sic-agent-arch (push) Has been cancelled
Details
build and publish packages / sicd-debian (push) Has been cancelled
Details
build and publish packages / sic-agent-debian (push) Has been cancelled
Details
build and publish packages / reauktion-home-ca-any (push) Has been cancelled
Details
build and publish packages / reauktion-home-ca-debian (push) Has been cancelled
Details

Browse Source 
The package was referenced in memory as already published but never
actually existed in this repo or on packages.reauktion.de — only an
unpublished Arch build was staged on hertz. Adds real PKGBUILD +
dpkg-deb packaging (cert committed alongside, no upstream tarball)
and wires both into build.yml following the lmcp/aish dual-arch +
debian publish pattern.
This commit is contained in:
Markus Fritsche
2026-07-20 10:35:43 +02:00
parent 108fc4fba7
commit 07b4d5383e
10 changed files with 373 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+175
View File
@@ -2006,3 +2006,178 @@ jobs:
- name: wipe secrets
if: always()
run: rm -f /root/.ssh/id_ed25519_hertz
# -------------------------------------------------------------------------
# reauktion-home-ca — trust anchor for the private reauktion.de Home CA
# (internal *.fritz.box HTTPS; PKI material lives on hertz:/opt/herding/pki/,
# see reference_fritzbox_ca memory). No upstream project: the cert is
# committed alongside the packaging in this repo instead of fetched.
# arch=any / Architecture: all — one build serves every target.
# -------------------------------------------------------------------------
reauktion-home-ca-any:
needs: sic-agent-debian
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: skip if already published
id: skip-check
run: |
set -e
result=$(./.gitea/scripts/check-already-published.sh arch/reauktion-home-ca)
echo "$result" >> "$GITHUB_OUTPUT"
echo "decision: $result"
- name: bootstrap runner (idempotent)
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed base-devel git rsync gnupg openssh sudo
- name: import signing key
if: steps.skip-check.outputs.skip != '1'
env:
PRIV: ${{ secrets.MARFRIT_REPO_PRIVATE_KEY }}
PASS: ${{ secrets.MARFRIT_REPO_PASSPHRASE }}
run: |
set -e
gpgconf --homedir /root/.gnupg --kill all 2>/dev/null || true
rm -rf /root/.gnupg /root/repo_pass
mkdir -m700 -p /root/.gnupg
printf '%s' "$PASS" > /root/repo_pass
chmod 600 /root/repo_pass
printf '%s\n' "$PRIV" | gpg --batch --import
echo "92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C:6:" | gpg --import-ownertrust
- name: install deploy ssh key
if: steps.skip-check.outputs.skip != '1'
env:
KEY: ${{ secrets.MARFRIT_REPO_DEPLOY_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
ssh-keyscan -t ed25519 nc.reauktion.de > /root/.ssh/known_hosts 2>/dev/null
- name: makepkg reauktion-home-ca
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
rm -rf /tmp/build-reauktion-home-ca
cp -r arch/reauktion-home-ca /tmp/build-reauktion-home-ca
chown -R builder:builder /tmp/build-reauktion-home-ca
cd /tmp/build-reauktion-home-ca
sudo -u builder -H makepkg --nocheck --noconfirm --syncdeps --cleanbuild
ls -la *.pkg.tar.* | grep -v "\.sig$"
- name: sign reauktion-home-ca
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
cd /tmp/build-reauktion-home-ca
for f in *.pkg.tar.xz *.pkg.tar.zst *.pkg.tar.gz; do
[ -f "$f" ] || continue
gpg --batch --pinentry-mode loopback --passphrase-file /root/repo_pass \
--detach-sign --yes -u 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C "$f"
done
- name: publish reauktion-home-ca to both arches
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
export GNUPGHOME=/root/.gnupg
printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
gpg-connect-agent reloadagent /bye
for target in aarch64 x86_64; do
stage="/tmp/arch-stage-$target"
rm -rf "$stage"; mkdir -p "$stage"; cd "$stage"
for f in marfrit.db.tar.gz marfrit.db.tar.gz.sig marfrit.files.tar.gz marfrit.files.tar.gz.sig; do
curl -sSLf "https://packages.reauktion.de/arch/$target/$f" -o "$f" || rm -f "$f"
done
cp /tmp/build-reauktion-home-ca/*.pkg.tar.* .
pkgs=()
for ext in xz zst gz; do
for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
done
if [ -f marfrit.db.tar.gz ]; then
for f in "${pkgs[@]}"; do
name=$(echo "$f" | sed -E 's/-[0-9].*//')
repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
marfrit.db.tar.gz "$name" 2>/dev/null || true
done
fi
repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
--verify marfrit.db.tar.gz "${pkgs[@]}"
ln -sf marfrit.db.tar.gz marfrit.db
ln -sf marfrit.files.tar.gz marfrit.files
ln -sf marfrit.db.tar.gz.sig marfrit.db.sig
ln -sf marfrit.files.tar.gz.sig marfrit.files.sig
retry rsync -avL --copy-unsafe-links \
-e 'ssh -i /root/.ssh/id_ed25519' \
./ "mfritsche@nc.reauktion.de:arch/$target/"
done
- name: wipe secrets
if: always()
run: rm -f /root/repo_pass /root/.ssh/id_ed25519
reauktion-home-ca-debian:
needs: reauktion-home-ca-any
runs-on: arch-aarch64
steps:
- uses: actions/checkout@v4
- name: skip if already published
id: skip-check
run: |
set -e
result=$(./.gitea/scripts/check-already-published.sh debian/reauktion-home-ca)
echo "$result" >> "$GITHUB_OUTPUT"
echo "decision: $result"
- name: install dpkg
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
retry pacman -Syu --noconfirm --needed dpkg openssh rsync curl
- name: install hertz deploy ssh key
if: steps.skip-check.outputs.skip != '1'
env:
KEY: ${{ secrets.MARFRIT_REPO_HERTZ_KEY }}
run: |
mkdir -m700 -p /root/.ssh
printf '%s\n' "$KEY" > /root/.ssh/id_ed25519_hertz
chmod 600 /root/.ssh/id_ed25519_hertz
ssh-keyscan -t ed25519 hertz.fritz.box >> /root/.ssh/known_hosts 2>/dev/null
- name: build reauktion-home-ca .deb
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
cd debian/reauktion-home-ca
./build-deb.sh
ls -la *.deb
- name: upload + publish to suites
if: steps.skip-check.outputs.skip != '1'
run: |
set -e
retry() { for i in 1 2 3; do "$@" && return 0; rc=$?; echo "retry $i (exit=$rc)" >&2; sleep $((i*5)); done; return 1; }
cd debian/reauktion-home-ca
DEB=$(ls reauktion-home-ca_*.deb | head -1)
retry rsync -av -e 'ssh -i /root/.ssh/id_ed25519_hertz' "$DEB" \
marfritrepo@hertz.fritz.box:
for suite in bookworm trixie; do
retry ssh -i /root/.ssh/id_ed25519_hertz marfritrepo@hertz.fritz.box \
"publish-deb $suite $DEB"
done
- name: wipe secrets
if: always()
run: rm -f /root/.ssh/id_ed25519_hertz
arch/reauktion-home-ca/PKGBUILD
+20
View File
@@ -0,0 +1,20 @@
# Maintainer: Markus Fritsche <mfritsche@reauktion.de>
# Trust anchor for the private reauktion.de Home CA (internal *.fritz.box
# HTTPS). No upstream project — PKI material generated once on hertz
# (/opt/herding/pki/), the cert is committed alongside this PKGBUILD.
pkgname=reauktion-home-ca
pkgver=20260716
pkgrel=1
pkgdesc="reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS"
arch=('any')
url="https://git.reauktion.de/marfrit/marfrit-packages"
license=('custom')
depends=('ca-certificates-utils')
source=('reauktion-home-ca.crt')
sha256sums=('838fdb30d06ecbc95dabcb545920c03535527282e0e602598659e1de6de71f4c')
package() {
install -Dm644 "${srcdir}/reauktion-home-ca.crt" \
"${pkgdir}/etc/ca-certificates/trust-source/anchors/reauktion-home-ca.crt"
}
arch/reauktion-home-ca/reauktion-home-ca.crt
+33
View File
@@ -0,0 +1,33 @@
-----BEGIN CERTIFICATE-----
MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL
BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u
ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy
MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0
aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC
DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY
AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA
A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+
lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M
l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP
6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS
rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU
4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7
rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu
gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq
CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB
o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB
/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb
o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv
bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj
yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9
p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9
2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02
BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q
J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n
uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr
vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG
R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52
oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7
GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V
PMS6m3J+HDRSK/22ACSisUhJIQNL
-----END CERTIFICATE-----
debian/reauktion-home-ca/build-deb.sh
Vendored Executable
+60
View File
@@ -0,0 +1,60 @@
#!/bin/bash
# Build reauktion-home-ca_<ver>_all.deb from this directory using dpkg-deb
# directly. Run from inside the runner container, which has dpkg installed.
#
# No upstream tarball: this is PKI trust material (the reauktion.de Home CA
# root cert), not software with its own release cadence. The .crt is
# committed alongside this script instead of being fetched.
set -euo pipefail
PKGVER=20260716
PKGREL=1
HERE=$(dirname "$(readlink -f "$0")")
# Reproducible build: pin all file mtimes + ar member timestamps so repeat
# builds produce identical bytes (reprepro refuses re-includes otherwise).
export SOURCE_DATE_EPOCH=1784505600
work=$(mktemp -d)
trap "rm -rf $work" EXIT
ROOT="$work/pkgroot"
mkdir -p "$ROOT/DEBIAN" \
"$ROOT/usr/local/share/ca-certificates" \
"$ROOT/usr/share/doc/reauktion-home-ca"
install -m 644 "$HERE/reauktion-home-ca.crt" \
"$ROOT/usr/local/share/ca-certificates/reauktion-home-ca.crt"
cp "$HERE/debian/copyright" "$ROOT/usr/share/doc/reauktion-home-ca/copyright"
cp "$HERE/debian/changelog" "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
gzip -9 -n "$ROOT/usr/share/doc/reauktion-home-ca/changelog.Debian"
install -m 755 "$HERE/debian/postinst" "$ROOT/DEBIAN/postinst"
install -m 755 "$HERE/debian/postrm" "$ROOT/DEBIAN/postrm"
cat > "$ROOT/DEBIAN/control" <<EOF
Package: reauktion-home-ca
Version: ${PKGVER}-${PKGREL}
Section: admin
Priority: optional
Architecture: all
Depends: ca-certificates
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Homepage: https://git.reauktion.de/marfrit/marfrit-packages
Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
Installs the private, name-constrained root CA used to sign internal
*.fritz.box and reauktion.de HTTPS services, so clients don't need -k
or browser exceptions to reach them.
.
Name constraints permit only fritz.box, reauktion.de, and localhost —
a leaked key can forge certificates for no other domain.
.
SHA256 fingerprint:
A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
EOF
# Build the .deb. Output to current dir of the caller.
DEB_OUT=reauktion-home-ca_${PKGVER}-${PKGREL}_all.deb
dpkg-deb --root-owner-group --build "$ROOT" "$HERE/$DEB_OUT"
echo "built: $HERE/$DEB_OUT"
debian/reauktion-home-ca/debian/changelog
Vendored
+9
View File
@@ -0,0 +1,9 @@
reauktion-home-ca (20260716-1) bookworm trixie; urgency=medium
* Initial release. Trust anchor for the reauktion.de Home CA (created
2026-07-16 on hertz:/opt/herding/pki/), a name-constrained root
permitted only for fritz.box, reauktion.de, and localhost. Installs
to /usr/local/share/ca-certificates/ and runs update-ca-certificates
on install/remove via maintainer scripts.
-- Markus Fritsche <mfritsche@reauktion.de> Mon, 20 Jul 2026 00:00:00 +0000
debian/reauktion-home-ca/debian/control
Vendored
+18
View File
@@ -0,0 +1,18 @@
Package: reauktion-home-ca
Version: 20260716-1
Section: admin
Priority: optional
Architecture: all
Depends: ca-certificates
Maintainer: Markus Fritsche <mfritsche@reauktion.de>
Homepage: https://git.reauktion.de/marfrit/marfrit-packages
Description: reauktion.de Home CA trust anchor for internal *.fritz.box HTTPS
Installs the private, name-constrained root CA used to sign internal
*.fritz.box and reauktion.de HTTPS services, so clients don't need -k
or browser exceptions to reach them.
.
Name constraints permit only fritz.box, reauktion.de, and localhost —
a leaked key can forge certificates for no other domain.
.
SHA256 fingerprint:
A3:32:17:6D:17:CF:F7:24:23:05:88:E0:6A:5E:5A:37:82:B9:BA:B5:BC:A1:2E:52:E3:88:3C:54:19:8B:F9:86
debian/reauktion-home-ca/debian/copyright
Vendored
+9
View File
@@ -0,0 +1,9 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: reauktion-home-ca
Source: https://git.reauktion.de/marfrit/marfrit-packages
Files: *
Copyright: 2026 Markus Fritsche <mfritsche@reauktion.de>
License: proprietary
Private PKI trust material for the reauktion.de / fritz.box fleet.
Not for redistribution outside that fleet.
debian/reauktion-home-ca/debian/postinst
Vendored Executable
+8
View File
@@ -0,0 +1,8 @@
#!/bin/sh
set -e
if [ "$1" = "configure" ]; then
update-ca-certificates
fi
exit 0
debian/reauktion-home-ca/debian/postrm
Vendored Executable
+8
View File
@@ -0,0 +1,8 @@
#!/bin/sh
set -e
if [ "$1" = "remove" ] || [ "$1" = "purge" ]; then
update-ca-certificates
fi
exit 0
debian/reauktion-home-ca/reauktion-home-ca.crt
Vendored
+33
View File
@@ -0,0 +1,33 @@
-----BEGIN CERTIFICATE-----
MIIFsTCCA5mgAwIBAgIUTAWmENkKSdBtjEqN55mD2S96BbMwDQYJKoZIhvcNAQEL
BQAwQjEVMBMGA1UECgwMcmVhdWt0aW9uLmRlMSkwJwYDVQQDDCByZWF1a3Rpb24u
ZGUgSG9tZSBDQSAoZnJpdHouYm94KTAeFw0yNjA3MTYyMTMzMjZaFw00NjA3MTEy
MTMzMjZaMEIxFTATBgNVBAoMDHJlYXVrdGlvbi5kZTEpMCcGA1UEAwwgcmVhdWt0
aW9uLmRlIEhvbWUgQ0EgKGZyaXR6LmJveCkwggIiMA0GCSqGSIb3DQEBAQUAA4IC
DwAwggIKAoICAQCoXQg4BEvZ7PDZMvnRJtESFBPtWsdNFQz+YT1Z/mhWnNyAgfkY
AQ5f9yzegyDrDdnm/nzv6h1Zpss+S6TE29lnLGtXaMnkNsLpdvnIi8j0Wgi2+DkA
A9JTkvoDrgn9yJWcG9tFj6BPex4VvLUK55luFiv+y+2e/Xg6z4zhMJe0PwoUkb3+
lUsBnNHbBQF2bH1suJx3xVgAdpZTpqBp/bfDyj0RgokSnD17jlxF2xC3nY3lCJ1M
l676xToeoAMvDcGc0zjKwno/JtvB/ZzfF7jPNV47czMYboCpa7lSDtjwmCLpeVkP
6HvXcg1riER+aLC1urGLNtC2hMiSBmjlm0KZfxdTZj9J1hHLUynlYCc+jHYfSXKS
rP6i3EV4fKuMeuFyt/ribHMv+fsI2Te7IwOBA4VQg/d+q6qwTcRO09MJzEDtY5OU
4EPlLvd2nNKeF3u0qCn+2t7TmIK9dpi4gVmxhnCRlD1SLDfwnznMiDydtZJr/Kh7
rjKgTCBAulfS9N4RQ0kyFM9hPF2KNYu8Ef6DRb3wysN1W0ozs+sdYQA15hczEFDu
gVxTcwQEd4B+1seUWsDKDqRogZHLoNVrPVWp+sK4E5msyLjHzcqTBt0tpVK+2ztq
CgkwnmNPcexevrkkPz4PuxpwqDpEJ3CLutu/RCAwSZZGSM8q0ViIXreRcwIDAQAB
o4GeMIGbMB8GA1UdIwQYMBaAFOT/M0xih1hOVqUu1dujtbAmfEjZMA8GA1UdEwEB
/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTk/zNMYodYTlalLtXb
o7WwJnxI2TA4BgNVHR4BAf8ELjAsoCowC4IJZnJpdHouYm94MA6CDHJlYXVrdGlv
bi5kZTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAI76BcH2ATaiSwUj
yleSzhvFB2HjOjdQimo4vt6O6YWagYXXijC3VUJ2fY5/x/S20WuVXONfqVvBKmi9
p7x/oz/UsmLtn/SHy253a37Uf62EV++JgNiaf1GuJXjgRAxtQ3fsWY3qw906yjN9
2BqFBRRcX026HU7a9b921VCp1D8qDa43kIi9T69Fl+pNKYb2XJYda8EpehStK/02
BQr2Owp3QGWBly5w+cjB1E77PhFYLb4jzPe2eDDs01zoDZ/IVaf2jPWiG+dGmV2Q
J1O7u5OacwWS4WjhWYIMG3XSbkZkCIrrJFuKNEabhYlS9GxySfDn3vovWQQsJf6n
uoeCOI/dN08snps2XMoaMbl8TeqrityQnDKhX5k8sxvO8/IrpHt4766YBHMcwcIr
vU1zc9Yls5vOMc5adAGGj3WloCCtzTOiDPQC952nmA+8e6Pla4u4GFvwArS+LfKG
R7c7pN6Q61bVRhM4liQ6n9djkaGuXSfkrjcWy+JsjyesHG62TxhUNDY7kqEo8V52
oVFxWkZClQN0f5kxeXuPV+LCby4YiDq8kTkXp8jE0OvpPx4WR4pUG/nHBOE1O0b7
GQTHwKaJs/CtfuwfJRk7ACjwEdV8G8mQxgRJB6e+pZMGqbigqWPcPTR9tnjdbg4V
PMS6m3J+HDRSK/22ACSisUhJIQNL
-----END CERTIFICATE-----