51671 2004-05-21 09:40 0000 net-mail/mailman 2.1.4 member password disclosure bug 2004-07-21 23:00:13 0000 1 1 1 Unclassified Gentoo Linux Security unspecified All Linux RESOLVED FIXED http://lwn.net/Articles/85472/ B3 [glsa] P1 critical --- 1 kl@vsen.dk security@gentoo.org jaervosz@gentoo.org mholzer@gentoo.org net-mail@gentoo.org x86@gentoo.org kl@vsen.dk 2004-05-21 09:40:28 0000 2.1.4 allows 3rd parties to obtain member passwords. Also 2.1.5 has many performance enhancements. Reproducible: Always Steps to Reproduce: 1. 2. 3. kl@vsen.dk 2004-05-21 10:11:36 0000 I tried just renaming the ebuild to 2.1.5 - and it compiles fine - and installs "almost"-fine.. I get this error: [SNIP] gunzip -c ./$p.tar.gz | (cd . ; tar xf -); \ (cd ./$p ; umask 02 ; PYTHONPATH=/var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib /usr/bin/python setup.py --quiet install --install-lib /var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib --install-purelib /var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib --install-data /var/tmp/portage/mailman-2.1.5/image//usr/local/mailman/pythonlib); \ done <command line>:1:15: missing terminating " character <command line>:1:18: missing terminating " character <command line>:1:18: missing terminating " character <command line>:1:17: missing terminating " character <command line>:1:20: missing terminating " character error: command 'gcc' failed with exit status 1 <command line>:1:15: missing terminating " character <command line>:1:18: missing terminating " character <command line>:1:18: missing terminating " character <command line>:1:17: missing terminating " character <command line>:1:20: missing terminating " character error: command 'gcc' failed with exit status 1 make[1]: *** [install-packages] Error 1 make[1]: Leaving directory `/var/tmp/portage/mailman-2.1.5/work/mailman-2.1.5/misc' [SNIP] I don't remember if the same problem was in 2.1.4 - but 2.1.5 still seems to work just fine, anyways ( I probably just haven't found the place this breaks?). I've tried to subscribe/unsubscribe to my newslist - haven't tried to send out yet. koon@gentoo.org 2004-05-21 11:57:20 0000 Confirmed, from : http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html "This version also contains a fix for an exploit that could allow 3rd parties to retrieve member passwords." net-mail : please bump mailman to 2.1.5 mholzer@gentoo.org 2004-05-25 23:56:36 0000 *** Bug 52043 has been marked as a duplicate of this bug. *** koon@gentoo.org 2004-05-27 01:46:19 0000 Martin: apparently you did a lot of maintenance work on this ebuild, could you bump it ? We had no feedback from the net-mail team... frlinux@frlinux.net 2004-05-29 02:52:57 0000 Created an attachment (id=32239) new version fixing security issue Modified the ebuild by : - fixing the apache2 entries - made python-2.3.3 mandatory to compile on dependencies Steph koon@gentoo.org 2004-05-29 03:42:10 0000 Looking at the submitted ebuild, I think it drops Apache1 compatibility. I checked a simple ebuild bump and it works perfectly... I don't have the problems Klavs described. I propose to put a bump ebuild as ~ for testing. kl@vsen.dk 2004-05-30 01:02:08 0000 It's probably my python version (2.2.3) then. Anyhow it works fine - except for the danish translation - which makes it barf - I have submitted a bugreport on that -with all info - incl. python version. condordes@gentoo.org 2004-05-30 15:53:34 0000 Installs fine for me with the latest stable Python (2.3.3 I believe). koon@gentoo.org 2004-05-31 02:48:00 0000 Created an attachment (id=32372) mailman-2.1.5.ebuild OK so a bumped version is fine. We should probably change the Python DEPEND to ">=dev-lang/python-2.3" as this seems to be required for proper install. Proposed ebuild is attached. net-mail : we really need someone to bump this, and the security team will do it by itself if you don't. koon@gentoo.org 2004-05-31 09:42:15 0000 plasmaroo did the bump in portage, but without proper means to test, the ebuild has no KEYWORDS yet. We know it compiles and installs fine on x86, and had a somewhat positive usage report from the reporter. Arches : please test and mark net-mail/mailman-2.1.5 ~ and/or stable. We need at least "x86 ~ppc sparc" for the GLSA, which is already overdue. mholzer@gentoo.org 2004-05-31 15:31:33 0000 sorry for delay just commited some correction to ebuild mailman-2.1.5 works fine here weeve@gentoo.org 2004-05-31 17:24:05 0000 Martin, what MTA are you using with mailman? I have a fresh install of mailman here with sendmail and any messages sent to the default mailman list get returned because the mailman script thinks it is getting run with a group of daemon instead of the prefered mail. mholzer@gentoo.org 2004-06-01 03:17:31 0000 i'm using sendmail and have to override MAILGID="280" with MAILGID="2" postfix need 65534 afaik and smrsh need and other GID how about qmail ? koon@gentoo.org 2004-06-01 05:08:32 0000 x86, sparc : please test and mark stable the latest ebuild... weeve@gentoo.org 2004-06-01 07:55:50 0000 Stable on sparc. klieber@gentoo.org 2004-06-03 07:12:56 0000 Martin -- Is this OK to mark stable on x86? condordes@gentoo.org 2004-06-08 12:33:47 0000 This security bug is overdue. x86 -- please test and mark stable ASAP. Thanks. mholzer@gentoo.org 2004-06-08 15:04:48 0000 sorry for delay, x86 is now stable in cvs klieber@gentoo.org 2004-06-09 02:56:47 0000 glsa 200406-04 langthang@gentoo.org 2004-07-21 10:12:30 0000 resolved? kl@vsen.dk 2004-07-21 23:00:13 0000 Yes - Mailman 2.1.5 is the only one in the tree - and it is fixed in that. It is already marked as "RESOLVED FIXED" though. 32239 2004-05-29 02:52 0000 new version fixing security issue mailman-2.1.5.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA0IEdlbnRvbyBUZWNobm9sb2dpZXMsIEluYy4KIyBEaXN0cmli dXRlZCB1bmRlciB0aGUgdGVybXMgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlIHYy CiMgbWFpbG1hbi0yLjEuNS5lYnVpbGQgRlJMaW51eAoKSVVTRT0iYXBhY2hlMiIKCkRFU0NSSVBU SU9OPSJBIHB5dGhvbi1iYXNlZCBtYWlsaW5nIGxpc3Qgc2VydmVyIHdpdGggYW4gZXh0ZW5zaXZl IHdlYiBpbnRlcmZhY2UiClNSQ19VUkk9Im1pcnJvcjovL3NvdXJjZWZvcmdlLyR7UE59LyR7UH0u dGd6IgpSRVNUUklDVD0ibm9taXJyb3IiCkhPTUVQQUdFPSJodHRwOi8vd3d3Lmxpc3Qub3JnLyIK ClNMT1Q9Ik8iCkxJQ0VOU0U9IkdQTC0yIgpLRVlXT1JEUz0ieDg2IHNwYXJjIH5wcGMiCgpERVBF TkQ9Ij49ZGV2LWxhbmcvcHl0aG9uLTIuMy4zCgl2aXJ0dWFsL210YQoJPj1uZXQtd3d3L2FwYWNo ZS0xLjMiCgpJTlNUQUxMRElSPSIvdXNyL2xvY2FsL21haWxtYW4iCkFQQUNIRUdJRD0iODEiCk1B SUxHSUQ9IjI4MCIKCnBrZ19zZXR1cCgpIHsKCWlmICEgZ3JlcCAtcSBebWFpbG1hbjogL2V0Yy9n cm91cCA7IHRoZW4KCQlncm91cGFkZCAtZyAyODAgbWFpbG1hbiB8fCBkaWUgInByb2JsZW0gYWRk aW5nIGdyb3VwIG1haWxtYW4iCglmaQoJaWYgISBncmVwIC1xIF5tYWlsbWFuOiAvZXRjL3Bhc3N3 ZCA7IHRoZW4KCQl1c2VyYWRkIC11IDI4MCAtZyBtYWlsbWFuIC1HIGNyb24gLXMgL2Jpbi9iYXNo IFwKCQkJLWQgJHtJTlNUQUxMRElSfSAtYyAibWFpbG1hbiIgbWFpbG1hbgoJZmkKCW1rZGlyIC1w ICR7SU5TVEFMTERJUn0KCWNob3duIG1haWxtYW46bWFpbG1hbiAke0lOU1RBTExESVJ9CgljaG1v ZCAyNzc1ICR7SU5TVEFMTERJUn0KfQoKc3JjX2NvbXBpbGUoKSB7CgllY29uZiBcCgkJLS1wcmVm aXg9JHtJTlNUQUxMRElSfSBcCgkJLS13aXRoLW1haWwtZ2lkPSR7TUFJTEdJRH0gXAoJCS0td2l0 aC1jZ2ktZ2lkPSR7QVBBQ0hFR0lEfSBcCgl8fCBkaWUgImNvbmZpZ3VyZSBmYWlsZWQiCgoJbWFr ZSB8fCBkaWUgIm1ha2UgZmFpbGVkIgoJc2VkIC1pIC1lICdzOmltcG9ydCBqYXBhbmVzZTojaW1w b3J0IGphcGFuZXNlOicgXAoJCS1lICdzOmltcG9ydCBrb3JlYW46I2ltcG9ydCBrb3JlYW46JyBc CgkJLWUgJ3M6aW1wb3J0IGtvcmVhbi5hbGlhc2VzOiNpbXBvcnQga29yZWFuLmFsaWFzZXM6JyBt aXNjL3BhdGhzLnB5Cn0KCnNyY19pbnN0YWxsICgpIHsKCUlEPSR7RH0ke0lOU1RBTExESVJ9CgoJ bWFrZSBwcmVmaXg9JHtJRH0gdmFyX3ByZWZpeD0ke0lEfSBkb2luc3RhbGwgfHwgZGllCgoJa2Vl cGRpciAke0lOU1RBTExESVJ9L2xvZ3MKCWtlZXBkaXIgJHtJTlNUQUxMRElSfS9sb2NrcwoJa2Vl cGRpciAke0lOU1RBTExESVJ9L3NwYW0KCWtlZXBkaXIgJHtJTlNUQUxMRElSfS9hcmNoaXZlcy9w dWJsaWMKCgljaG93biAtUiBtYWlsbWFuOm1haWxtYW4gJHtJRH0KCWNobW9kIDI3NzUgJHtJRH0K Cglkb2RpciAvZXRjL2FwYWNoZTIvY29uZi9tb2R1bGVzLmQKCWluc2ludG8gL2V0Yy9hcGFjaGUy L2NvbmYvbW9kdWxlcy5kCgluZXdpbnMgJHtGSUxFU0RJUn0vbWFpbG1hbi5jb25mIDUwX21haWxt YW4uY29uZgoKCWRvZG9jICR7RklMRVNESVJ9L1JFQURNRS5nZW50b28KCWRvZG9jIEFDSyogQlVH UyBGQVEgTkVXUyBSRUFETUUqIFRPRE8gVVBHUkFESU5HIElOU1RBTEwKCWRvZG9jIGNvbnRyaWIv UkVBRE1FLmNoZWNrX3Blcm1zX2dyc2VjdXJpdHkgY29udHJpYi9tbS1oYW5kbGVyLnJlYWRtZQoJ ZG9kb2MgY29udHJpYi92aXJ0dXNlcnRhYmxlIGNvbnRyaWIvbWFpbG1hbi5tYwoKCWNwIGNvbnRy aWIvKi5weSBjb250cmliL21ham9yZG9tbzJtYWlsbWFuLnBsIGNvbnRyaWIvYXV0byBcCgkJY29u dHJpYi9tbS1oYW5kbGVyKiAke0R9L3Vzci9sb2NhbC9tYWlsbWFuL2JpbgoKCSMgU2F2ZSB0aGUg b2xkIGNvbmZpZyBpbnRvIHRoZSBuZXcgcGFja2FnZSBhcyBDT05GSUdfUFJPVEVDVAoJIyBkb2Vz bid0IHdvcmsgZm9yIHRoaXMgcGFja2FnZS4KCWlmIFsgLWYgJHtST09UfS92YXIvbWFpbG1hbi9N YWlsbWFuL21tX2NmZy5weSBdOyB0aGVuCgkJY3AgJHtST09UfS92YXIvbWFpbG1hbi9NYWlsbWFu L21tX2NmZy5weSBcCgkJCSR7RH0vdXNyL2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkK CQllaW5mbyAiWW91ciBvbGQgY29uZmlnIGhhcyBiZWVuIHNhdmVkIGFzIG1tX2NmZy5weSIKCQll aW5mbyAiQSBuZXcgY29uZmlnIGhhcyBiZWVuIGluc3RhbGxlZCBhcyBtbV9jZmcuZGlzdCIKCWZp CglpZiBbIC1mICR7Uk9PVH0vaG9tZS9tYWlsbWFuL01haWxtYW4vbW1fY2ZnLnB5IF07IHRoZW4K CQljcCAke1JPT1R9L2hvbWUvbWFpbG1hbi9NYWlsbWFuL21tX2NmZy5weSBcCgkJCSR7RH0vdXNy L2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkKCQllaW5mbyAiWW91ciBvbGQgY29uZmln IGhhcyBiZWVuIHNhdmVkIGFzIG1tX2NmZy5weSIKCQllaW5mbyAiQSBuZXcgY29uZmlnIGhhcyBi ZWVuIGluc3RhbGxlZCBhcyBtbV9jZmcucHkuZGlzdCIKCWZpCglpZiBbIC1mICR7Uk9PVH0vdXNy L2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkgXTsgdGhlbgoJCWNwICR7Uk9PVH0vdXNy L2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkgXAoJCQkke0R9L3Vzci9sb2NhbC9tYWls bWFuL01haWxtYW4vbW1fY2ZnLnB5CgkJZWluZm8gIllvdXIgb2xkIGNvbmZpZyBoYXMgYmVlbiBz YXZlZCBhcyBtbV9jZmcucHkiCgkJZWluZm8gIkEgbmV3IGNvbmZpZyBoYXMgYmVlbiBpbnN0YWxs ZWQgYXMgbW1fY2ZnLnB5LmRpc3QiCglmaQoKCWV4ZWludG8gL2V0Yy9pbml0LmQKCW5ld2V4ZSAk e0ZJTEVTRElSfS9tYWlsbWFuLnJjIG1haWxtYW4KCX0KCnBrZ19wb3N0aW5zdCgpIHsKCWNkICR7 SU5TVEFMTERJUn0KCWJpbi91cGRhdGUKCWJpbi9jaGVja19wZXJtcyAtZgoJZWluZm8gIiIKCWVp bmZvICJQbGVhc2UgcmVhZCAvdXNyL3NoYXJlL2RvYy8ke1BGfS9SRUFETUUuZ2VudG9vLmd6IGZv ciBhZGRpdGlvbmFsIgoJZWluZm8gIlNldHVwIGluZm9ybWF0aW9uLCBtYWlsbWFuIHdpbGwgTk9U IHJ1biB1bmxlc3MgeW91IGZvbGxvdyIKCWVpbmZvICJ0aG9zZSBpbnN0cnVjdGlvbnMhIgoJZWlu Zm8gIiIKfQoK 32372 2004-05-31 02:48 0000 mailman-2.1.5.ebuild mailman-2.1.5.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA0IEdlbnRvbyBUZWNobm9sb2dpZXMsIEluYy4KIyBEaXN0cmli dXRlZCB1bmRlciB0aGUgdGVybXMgb2YgdGhlIEdOVSBHZW5lcmFsIFB1YmxpYyBMaWNlbnNlIHYy CiMgJEhlYWRlcjogJAoKSVVTRT0iYXBhY2hlMiIKCkRFU0NSSVBUSU9OPSJBIHB5dGhvbi1iYXNl ZCBtYWlsaW5nIGxpc3Qgc2VydmVyIHdpdGggYW4gZXh0ZW5zaXZlIHdlYiBpbnRlcmZhY2UiClNS Q19VUkk9Im1pcnJvcjovL3NvdXJjZWZvcmdlLyR7UE59LyR7UH0udGd6IgpSRVNUUklDVD0ibm9t aXJyb3IiCkhPTUVQQUdFPSJodHRwOi8vd3d3Lmxpc3Qub3JnLyIKClNMT1Q9Ik8iCkxJQ0VOU0U9 IkdQTC0yIgpLRVlXT1JEUz0ifng4NiB+c3BhcmMgfnBwYyIKCkRFUEVORD0iPj1kZXYtbGFuZy9w eXRob24tMi4zCgl2aXJ0dWFsL210YQoJbmV0LXd3dy9hcGFjaGUiCgpJTlNUQUxMRElSPSIvdXNy L2xvY2FsL21haWxtYW4iCkFQQUNIRUdJRD0iODEiCk1BSUxHSUQ9IjI4MCIKCnBrZ19zZXR1cCgp IHsKCWlmICEgZ3JlcCAtcSBebWFpbG1hbjogL2V0Yy9ncm91cCA7IHRoZW4KCQlncm91cGFkZCAt ZyAyODAgbWFpbG1hbiB8fCBkaWUgInByb2JsZW0gYWRkaW5nIGdyb3VwIG1haWxtYW4iCglmaQoJ aWYgISBncmVwIC1xIF5tYWlsbWFuOiAvZXRjL3Bhc3N3ZCA7IHRoZW4KCQl1c2VyYWRkIC11IDI4 MCAtZyBtYWlsbWFuIC1HIGNyb24gLXMgL2Jpbi9iYXNoIFwKCQkJLWQgJHtJTlNUQUxMRElSfSAt YyAibWFpbG1hbiIgbWFpbG1hbgoJZmkKCW1rZGlyIC1wICR7SU5TVEFMTERJUn0KCWNob3duIG1h aWxtYW46bWFpbG1hbiAke0lOU1RBTExESVJ9CgljaG1vZCAyNzc1ICR7SU5TVEFMTERJUn0KfQoK c3JjX2NvbXBpbGUoKSB7CgllY29uZiBcCgkJLS1wcmVmaXg9JHtJTlNUQUxMRElSfSBcCgkJLS13 aXRoLW1haWwtZ2lkPSR7TUFJTEdJRH0gXAoJCS0td2l0aC1jZ2ktZ2lkPSR7QVBBQ0hFR0lEfSBc Cgl8fCBkaWUgImNvbmZpZ3VyZSBmYWlsZWQiCgoJbWFrZSB8fCBkaWUgIm1ha2UgZmFpbGVkIgoJ c2VkIC1pIC1lICdzOmltcG9ydCBqYXBhbmVzZTojaW1wb3J0IGphcGFuZXNlOicgXAoJCS1lICdz OmltcG9ydCBrb3JlYW46I2ltcG9ydCBrb3JlYW46JyBcCgkJLWUgJ3M6aW1wb3J0IGtvcmVhbi5h bGlhc2VzOiNpbXBvcnQga29yZWFuLmFsaWFzZXM6JyBtaXNjL3BhdGhzLnB5Cn0KCnNyY19pbnN0 YWxsICgpIHsKCUlEPSR7RH0ke0lOU1RBTExESVJ9CgoJbWFrZSBwcmVmaXg9JHtJRH0gdmFyX3By ZWZpeD0ke0lEfSBkb2luc3RhbGwgfHwgZGllCgoJa2VlcGRpciAke0lOU1RBTExESVJ9L2xvZ3MK CWtlZXBkaXIgJHtJTlNUQUxMRElSfS9sb2NrcwoJa2VlcGRpciAke0lOU1RBTExESVJ9L3NwYW0K CWtlZXBkaXIgJHtJTlNUQUxMRElSfS9hcmNoaXZlcy9wdWJsaWMKCgljaG93biAtUiBtYWlsbWFu Om1haWxtYW4gJHtJRH0KCWNobW9kIDI3NzUgJHtJRH0KCglpZiBbICJgdXNlIGFwYWNoZTJgIiBd OyB0aGVuCgkJZG9kaXIgL2V0Yy9hcGFjaGUyL2NvbmYvbW9kdWxlcy5kCgkJaW5zaW50byAvZXRj L2FwYWNoZTIvY29uZi9tb2R1bGVzLmQKCQluZXdpbnMgJHtGSUxFU0RJUn0vbWFpbG1hbi5jb25m IDUwX21haWxtYW4uY29uZgoJZWxzZQoJCWRvZGlyIC9ldGMvYXBhY2hlL2NvbmYvYWRkb24tbW9k dWxlcwoJCWluc2ludG8gL2V0Yy9hcGFjaGUvY29uZi9hZGRvbi1tb2R1bGVzCgkJZG9pbnMgJHtG SUxFU0RJUn0vbWFpbG1hbi5jb25mCglmaQoKCWRvZG9jICR7RklMRVNESVJ9L1JFQURNRS5nZW50 b28KCWRvZG9jIEFDSyogQlVHUyBGQVEgTkVXUyBSRUFETUUqIFRPRE8gVVBHUkFESU5HIElOU1RB TEwKCWRvZG9jIGNvbnRyaWIvUkVBRE1FLmNoZWNrX3Blcm1zX2dyc2VjdXJpdHkgY29udHJpYi9t bS1oYW5kbGVyLnJlYWRtZQoJZG9kb2MgY29udHJpYi92aXJ0dXNlcnRhYmxlIGNvbnRyaWIvbWFp bG1hbi5tYwoKCWNwIGNvbnRyaWIvKi5weSBjb250cmliL21ham9yZG9tbzJtYWlsbWFuLnBsIGNv bnRyaWIvYXV0byBcCgkJY29udHJpYi9tbS1oYW5kbGVyKiAke0R9L3Vzci9sb2NhbC9tYWlsbWFu L2JpbgoKCSMgU2F2ZSB0aGUgb2xkIGNvbmZpZyBpbnRvIHRoZSBuZXcgcGFja2FnZSBhcyBDT05G SUdfUFJPVEVDVAoJIyBkb2Vzbid0IHdvcmsgZm9yIHRoaXMgcGFja2FnZS4KCWlmIFsgLWYgJHtS T09UfS92YXIvbWFpbG1hbi9NYWlsbWFuL21tX2NmZy5weSBdOyB0aGVuCgkJY3AgJHtST09UfS92 YXIvbWFpbG1hbi9NYWlsbWFuL21tX2NmZy5weSBcCgkJCSR7RH0vdXNyL2xvY2FsL21haWxtYW4v TWFpbG1hbi9tbV9jZmcucHkKCQllaW5mbyAiWW91ciBvbGQgY29uZmlnIGhhcyBiZWVuIHNhdmVk IGFzIG1tX2NmZy5weSIKCQllaW5mbyAiQSBuZXcgY29uZmlnIGhhcyBiZWVuIGluc3RhbGxlZCBh cyBtbV9jZmcuZGlzdCIKCWZpCglpZiBbIC1mICR7Uk9PVH0vaG9tZS9tYWlsbWFuL01haWxtYW4v bW1fY2ZnLnB5IF07IHRoZW4KCQljcCAke1JPT1R9L2hvbWUvbWFpbG1hbi9NYWlsbWFuL21tX2Nm Zy5weSBcCgkJCSR7RH0vdXNyL2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkKCQllaW5m byAiWW91ciBvbGQgY29uZmlnIGhhcyBiZWVuIHNhdmVkIGFzIG1tX2NmZy5weSIKCQllaW5mbyAi QSBuZXcgY29uZmlnIGhhcyBiZWVuIGluc3RhbGxlZCBhcyBtbV9jZmcucHkuZGlzdCIKCWZpCglp ZiBbIC1mICR7Uk9PVH0vdXNyL2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkgXTsgdGhl bgoJCWNwICR7Uk9PVH0vdXNyL2xvY2FsL21haWxtYW4vTWFpbG1hbi9tbV9jZmcucHkgXAoJCQkk e0R9L3Vzci9sb2NhbC9tYWlsbWFuL01haWxtYW4vbW1fY2ZnLnB5CgkJZWluZm8gIllvdXIgb2xk IGNvbmZpZyBoYXMgYmVlbiBzYXZlZCBhcyBtbV9jZmcucHkiCgkJZWluZm8gIkEgbmV3IGNvbmZp ZyBoYXMgYmVlbiBpbnN0YWxsZWQgYXMgbW1fY2ZnLnB5LmRpc3QiCglmaQoKCWV4ZWludG8gL2V0 Yy9pbml0LmQKCW5ld2V4ZSAke0ZJTEVTRElSfS9tYWlsbWFuLnJjIG1haWxtYW4KCX0KCnBrZ19w b3N0aW5zdCgpIHsKCWNkICR7SU5TVEFMTERJUn0KCWJpbi91cGRhdGUKCWJpbi9jaGVja19wZXJt cyAtZgoJZWluZm8gIiIKCWVpbmZvICJQbGVhc2UgcmVhZCAvdXNyL3NoYXJlL2RvYy8ke1BGfS9S RUFETUUuZ2VudG9vLmd6IGZvciBhZGRpdGlvbmFsIgoJZWluZm8gIlNldHVwIGluZm9ybWF0aW9u LCBtYWlsbWFuIHdpbGwgTk9UIHJ1biB1bmxlc3MgeW91IGZvbGxvdyIKCWVpbmZvICJ0aG9zZSBp bnN0cnVjdGlvbnMhIgoJZWluZm8gIiIKCWlmIFsgISAiYHVzZSBhcGFjaGUyYCIgXTsgdGhlbgoJ CWVpbmZvICJJdCBhcHBlYXJzIHRoYXQgeW91IGFyZW4ndCBydW5uaW5nIGFwYWNoZTIuLi4iCgkJ ZWluZm8gImVidWlsZCAvdmFyL2RiL3BrZy9uZXQtbWFpbC8ke1BOfS8ke1BGfS5lYnVpbGQgY29u ZmlnIgoJCWVpbmZvICJ0byBhZGQgdGhlIG1haWxtYW4gaG9va3MgdG8geW91ciBjb25maWciCglm aQp9Cgpwa2dfY29uZmlnKCkgewoJaWYgWyAhICJgdXNlIGFwYWNoZTJgIiBdOyB0aGVuCgkJZWlu Zm8gIlVwZGF0aW5nIGFwYWNoZSBjb25maWciCgkJZWluZm8gImFkZGVkOiBcIkluY2x1ZGUgIGNv bmYvYWRkb24tbW9kdWxlcy9tYWlsbWFuLmNvbmZcIiIKCQllaW5mbyAidG8gJHtST09UfWV0Yy9h cGFjaGUvY29uZi9hcGFjaGUuY29uZiIKCQllY2hvICJJbmNsdWRlICBjb25mL2FkZG9uLW1vZHVs ZXMvbWFpbG1hbi5jb25mIiBcCgkJCT4+ICR7Uk9PVH1ldGMvYXBhY2hlL2NvbmYvYXBhY2hlLmNv bmYKCWZpCn0K