From nobody Fri Oct 20 17:26:47 2017 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D214B1344C2; Fri, 20 Oct 2017 17:24:17 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: Kathleen.Moriarty.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.63.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150854545785.20809.15508367058669844081.idtracker@ietfa.amsl.com> Date: Fri, 20 Oct 2017 17:24:17 -0700 Archived-At: Subject: [Id-event] secevent - Requested session has been scheduled for IETF 100 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 21 Oct 2017 00:24:18 -0000 Dear Yaron Sheffer, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. secevent Session 1 (2:00:00) Monday, Afternoon Session I 1330-1530 Room Name: Bras Basah size: 100 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Security Events Area Name: Security Area Session Requester: Yaron Sheffer Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: saag jsonbis httpbis dispatch oauth tokbind tls acme Second Priority: ipsecme sacm ace People who must be present: Yaron Sheffer Kathleen Moriarty Dick Hardt Resources Requested: Special Requests: Please avoid cfrg. --------------------------------------------------------- From nobody Mon Oct 23 10:58:02 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8CA1139938 for ; Mon, 23 Oct 2017 10:58:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kk5LssgHdsFo for ; Mon, 23 Oct 2017 10:57:58 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF1D21398CF for ; Mon, 23 Oct 2017 10:57:57 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9NHvunn014561 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 23 Oct 2017 17:57:56 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9NHvtcK011210 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 23 Oct 2017 17:57:56 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9NHvtub017814 for ; Mon, 23 Oct 2017 17:57:55 GMT Received: from [192.168.1.23] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 10:57:54 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_CE676AB4-CDF6-4B87-A78B-39CC146D399D" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 23 Oct 2017 10:57:51 -0700 References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> To: ID Events Mailing List In-Reply-To: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> Message-Id: <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 17:58:01 -0000 --Apple-Mail=_CE676AB4-CDF6-4B87-A78B-39CC146D399D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 All, I am reviewing the previous feedback from WGLC and will be bringing up = any unresolved issues for quick discussion/confirmation=E2=80=A6 Following up on Marius and Henk=E2=80=99s comment, I am concerned that = =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied to a = security domain definition. We should not necessarily say this is the = receiver though it often turns out to be. For example a RP (=E2=80=9Caud=E2= =80=9D) has outsourced events processing to a third party (the so called = receiver). I am happy with the current claim set, but maybe some text explaining = that a receiver does not have to be the aud is appropriate? I don=E2=80=99= t see any benefit to having a receiver claim as this could complicate = processing more than its worth. There are a few other comments in this thread, but this one seemed the = most unresolved. Phil > On Aug 3, 2017, at 8:03 AM, Henk Birkholz = > wrote: >=20 > Hello, >=20 > to me, the "audience" claim seems to be a good choice here. >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 > On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >> The abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience? >> The last paragraph of section 1 mentions "subscriber". I think it = should be either "receiver" or "audience". >> The explanation for figure 1 states that the issuer denotes the = transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear. >> Figure 3, I think the "sub" claim should be nested in the event, next = to the issuer that provides the correct context. The "iss" and "sub" = definitions in 2.1 also touch on this, providing conflicting advice. >> Section 2,1, definition of "nbf". The definition says that this is = the event time. I see two problems: >> - the name suggest "not before", not exactly the same as event time >> - there can be multiple events >> maybe this claim should be dropped? >> Section 2.1, definition of "exp". Omitting this claim is the short = term solution to the confusion issue. Why not mention that and that it = SHOULD NOT be used? >> Section 2.1, definition of "events". It states that all events must = refer to the same logical event. Lately in discussions we reached the = conclusion that all events in a SET should be defined in the same = profile, which is a stronger requirement. I think this definition should = mention that. >> Regarding events and profiles. There was a proposal to add a new = claim to uniquely identify the profile. I think we need to discuss that. >> Figure 5. Maybe a signed example would be better, especially that the = next paragraph mentions that signatures or encryption should be used. >> Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph. >> Marius >> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer >> wrote: >> This is to announce working group last call on this draft >> = (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.o= rg_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR= 8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6= cxjlKfjqT99u5-Ojw4Fw&e=3D = = >). >> Please send your comments to the list. Even if you are perfectly >> happy with the draft, please let us know that you support its >> publication as-is by posting to the list. >> Because of the summer holidays, this last call is open for 3 = weeks, >> until Aug. 21. >> Thanks, >> Dick and Yaron >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org = > >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = = > >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = --Apple-Mail=_CE676AB4-CDF6-4B87-A78B-39CC146D399D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

All,

I am reviewing the previous feedback = from WGLC and will be bringing up any unresolved issues for quick = discussion/confirmation=E2=80=A6

Following up on Marius and Henk=E2=80=99s= comment, I am concerned that =E2=80=9Caud=E2=80=9D has a very specific = meaning and is often tied to a security domain definition. We should not = necessarily say this is the receiver though it often turns out to be. = For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events = processing to a third party (the so called receiver).

I am happy with the = current claim set, but maybe some text explaining that a receiver does = not have to be the aud is appropriate?  I don=E2=80=99t see any = benefit to having a receiver claim as this could complicate processing = more than its worth.

There are a few other comments in this thread, but this one = seemed the most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz = <henk.birkholz@sit.fraunhofer.de> wrote:

Hello,
to me, the "audience" claim seems to be a good = choice here.

Viele Gr=C3=BC=C3=9Fe,
Henk

On 08/02/2017 11:45 PM, Marius Scurtescu = wrote:
The abstract mentions "issuer" and "receiver" in the last = sentence. "receiver" does not sound right (that should be used in the = context of a transmitter), but I don't have a better suggestion. = Audience?
The last paragraph of section 1 mentions = "subscriber". I think it should be either "receiver" or "audience".
The explanation for figure 1 states that the issuer denotes = the transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear.
Figure 3, I think the "sub" claim should be = nested in the event, next to the issuer that provides the correct = context. The "iss" and "sub" definitions in 2.1 also touch on this, = providing conflicting advice.
Section 2,1, definition of = "nbf". The definition says that this is the event time. I see two = problems:
- the name suggest "not before", not exactly the = same as event time
- there can be multiple events
maybe this claim should be dropped?
Section = 2.1, definition of "exp". Omitting this claim is the short term solution = to the confusion issue. Why not mention that and that it SHOULD NOT be = used?
Section 2.1, definition of "events". It states that = all events must refer to the same logical event. Lately in discussions = we reached the conclusion that all events in a SET should be defined in = the same profile, which is a stronger requirement. I think this = definition should mention that.
Regarding events and = profiles. There was a proposal to add a new claim to uniquely identify = the profile. I think we need to discuss that.
Figure 5. = Maybe a signed example would be better, especially that the next = paragraph mentions that signatures or encryption should be used.
Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph.
Marius
On Mon, Jul 31, 2017 at = 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>> wrote:
   This is to announce working group last call = on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DR= oP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJx= PEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&a= mp;s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D     <<= a = href=3D"https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker= .ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1= YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEi= vzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&= s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D" = class=3D"">https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DR= oP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJx= PEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&a= mp;s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D >).
   Please send your comments to the list. Even = if you are perfectly
   happy with the = draft, please let us know that you support its
   publication as-is by posting to the = list.
   Because of the summer holidays, = this last call is open for 3 weeks,
   until = Aug. 21.
   Thanks,
        Dick and = Yaron
   _____________________________________________= __
   Id-event mailing list
   Id-event@ietf.org <mailto:Id-event@ietf.org>
   https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D     <<= a = href=3D"https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.or= g_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8P= QcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk= &m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt= 8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D" = class=3D"">https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D


= --Apple-Mail=_CE676AB4-CDF6-4B87-A78B-39CC146D399D-- From nobody Mon Oct 23 11:30:46 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16235139976 for ; Mon, 23 Oct 2017 11:30:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UbfI7B_rpu1d for ; Mon, 23 Oct 2017 11:30:41 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0110.outbound.protection.outlook.com [104.47.40.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34D76137C4A for ; Mon, 23 Oct 2017 11:30:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Oq5B6dCpQhFMBmhhhn/zVRMfxV8vAPjG4c5rRi8jNUM=; b=W5SMPNcV/liD6cpLT6MaZpNoNJVMN2QIfNdnWVZ8CieAVHl1gok9wVgIDPsgTz5hbhAvfmsUBg2h2evYnL9HvdbSGS1dJAg2DO6Aj0gWnZyx70es4MvghCYzLWE6F9FltTa1cdJZCJT0TGYJr/dEfgSHEzEdgUPeOrG9A0cCoHs= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0502.namprd21.prod.outlook.com (10.172.122.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Mon, 23 Oct 2017 18:30:39 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Mon, 23 Oct 2017 18:30:39 +0000 From: Mike Jones To: Phil Hunt , ID Events Mailing List Thread-Topic: [Id-event] "aud" vs. receiver issue raised in WGLC Thread-Index: AQHTTCh6o4xBjT/YGEGMZ+isMbHIYaLxwXhg Date: Mon, 23 Oct 2017 18:30:38 +0000 Message-ID: References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> In-Reply-To: <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-23T11:30:14.3878882-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:2::42f] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0502; 6:Sv8EHrpG07zYfqH+R+tttxjH1YJofGWjS5KAjJi0ZoNPJtHhFG+LUuxOhbDNGdMZ2/I3BoTuSBMWEtxA0aIjHUtgXCI1L5xyEu2zjngYyG8HOjzsjig9JuHIb3S1p7qbSYalsi3E+42k8pP0RBLEhdWQqN93XegLLkCBXa5ojovyG7ho+oKI9ie/mdZi4cdaafu8/nQ/QaFGdvR9lD1bzl69PpxqcyosDUWj4X3n5YrqQu/HQRI3p3A35GQO0UtNAKX+9uceW6oa53Ijq8g5lh7eGbXZFakDb2wxD80BElROV+tJ7EPXwCH9V0jOJCPqVtt8aFfLjkd+X6GdzYMlynSV26qvS/W6AkZEtOGSPoU=; 5:5axB0+M1cdouflInQeBKt1TUNH4xhkR6BL3y4Y3awrzuQ+oBsKgesr16qj5ESjsjYjGxaaNYVf9YemLiFVhOBXPaLzMnoXiH4Uks+9JD5VfE//l6HJAv3pM6Ae6J9XZ9eWtq9BjM5lDt03hLYcuoOXllOT3u0wLsFjzVAWQjkh4=; 24:0zXVdzJorDgtevH4KG0keIgWvHjTZa4b+/fPv1fbD4PTqcefKXxdIcO9BIx4nENRqxHRAegE67B/+16BRB6HA9tubIE20wVY7p/aPw0TqnY=; 7:n+y794W/b8mFVqoy2TWSzjz2/wZUy41AnaO+7F9NqFqDuwqJRl10kX1obTrz3ECYyae/N7P9WtFbqSlp0ilPAJCr6Goaq1EoCaYoSgik4uff/tfQgA+Cj43NWvwfHTM84W4m/KH0ESxkCvx+b1/q79TQ3yPdGFmikH/LkOdMcg1luf3bvjeFitsMa5EIzNky3CTw3Wz6xjFTRrEpdFeRuIX9TQSEAEWkag1iYQy62YLLqGRGEVyum4M7cmnslqAV x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 1b0e0581-a47d-4919-d0d4-08d51a442905 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:CY4PR21MB0502; x-ms-traffictypediagnostic: CY4PR21MB0502: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-exchange-antispam-report-test: UriScan:(10436049006162)(192374486261705)(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(3231020)(3002001)(10201501046)(93006095)(93001095)(100000703101)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123564025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0502; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0502; x-forefront-prvs: 046985391D x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(346002)(376002)(47760400005)(24454002)(199003)(189002)(53546010)(8936002)(966005)(606006)(478600001)(72206003)(14454004)(68736007)(54356999)(10290500003)(53936002)(9686003)(99286003)(54896002)(55016002)(236005)(6306002)(74316002)(6246003)(561944003)(8676002)(105586002)(101416001)(110136005)(76176999)(10090500001)(81166006)(50986999)(7736002)(106356001)(81156014)(22452003)(316002)(93886005)(77096006)(6436002)(6506006)(229853002)(189998001)(8990500004)(25786009)(33656002)(6116002)(86362001)(97736004)(790700001)(102836003)(2950100002)(86612001)(575784001)(19609705001)(2900100001)(3660700001)(2906002)(5660300001)(7696004)(3280700002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0502; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05045C2303E540EF078D8706F5460CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1b0e0581-a47d-4919-d0d4-08d51a442905 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2017 18:30:38.9967 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0502 Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 18:30:45 -0000 --_000_CY4PR21MB05045C2303E540EF078D8706F5460CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhbSBhbHNvIGhhcHB5IHdpdGggdGhlIGN1cnJlbnQgYXVkaWVuY2Ugc2VtYW50aWNzLg0KDQpG cm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFs ZiBPZiBQaGlsIEh1bnQNClNlbnQ6IE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyAxMDo1OCBBTQ0K VG86IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDog W0lkLWV2ZW50XSAiYXVkIiB2cy4gcmVjZWl2ZXIgaXNzdWUgcmFpc2VkIGluIFdHTEMNCg0KDQpB bGwsDQoNCkkgYW0gcmV2aWV3aW5nIHRoZSBwcmV2aW91cyBmZWVkYmFjayBmcm9tIFdHTEMgYW5k IHdpbGwgYmUgYnJpbmdpbmcgdXAgYW55IHVucmVzb2x2ZWQgaXNzdWVzIGZvciBxdWljayBkaXNj dXNzaW9uL2NvbmZpcm1hdGlvbuKApg0KDQpGb2xsb3dpbmcgdXAgb24gTWFyaXVzIGFuZCBIZW5r 4oCZcyBjb21tZW50LCBJIGFtIGNvbmNlcm5lZCB0aGF0IOKAnGF1ZOKAnSBoYXMgYSB2ZXJ5IHNw ZWNpZmljIG1lYW5pbmcgYW5kIGlzIG9mdGVuIHRpZWQgdG8gYSBzZWN1cml0eSBkb21haW4gZGVm aW5pdGlvbi4gV2Ugc2hvdWxkIG5vdCBuZWNlc3NhcmlseSBzYXkgdGhpcyBpcyB0aGUgcmVjZWl2 ZXIgdGhvdWdoIGl0IG9mdGVuIHR1cm5zIG91dCB0byBiZS4gRm9yIGV4YW1wbGUgYSBSUCAo4oCc YXVk4oCdKSBoYXMgb3V0c291cmNlZCBldmVudHMgcHJvY2Vzc2luZyB0byBhIHRoaXJkIHBhcnR5 ICh0aGUgc28gY2FsbGVkIHJlY2VpdmVyKS4NCg0KSSBhbSBoYXBweSB3aXRoIHRoZSBjdXJyZW50 IGNsYWltIHNldCwgYnV0IG1heWJlIHNvbWUgdGV4dCBleHBsYWluaW5nIHRoYXQgYSByZWNlaXZl ciBkb2VzIG5vdCBoYXZlIHRvIGJlIHRoZSBhdWQgaXMgYXBwcm9wcmlhdGU/ICBJIGRvbuKAmXQg c2VlIGFueSBiZW5lZml0IHRvIGhhdmluZyBhIHJlY2VpdmVyIGNsYWltIGFzIHRoaXMgY291bGQg Y29tcGxpY2F0ZSBwcm9jZXNzaW5nIG1vcmUgdGhhbiBpdHMgd29ydGguDQoNClRoZXJlIGFyZSBh IGZldyBvdGhlciBjb21tZW50cyBpbiB0aGlzIHRocmVhZCwgYnV0IHRoaXMgb25lIHNlZW1lZCB0 aGUgbW9zdCB1bnJlc29sdmVkLg0KDQpQaGlsDQoNCg0KT24gQXVnIDMsIDIwMTcsIGF0IDg6MDMg QU0sIEhlbmsgQmlya2hvbHogPGhlbmsuYmlya2hvbHpAc2l0LmZyYXVuaG9mZXIuZGU8bWFpbHRv OmhlbmsuYmlya2hvbHpAc2l0LmZyYXVuaG9mZXIuZGU+PiB3cm90ZToNCg0KSGVsbG8sDQoNCnRv IG1lLCB0aGUgImF1ZGllbmNlIiBjbGFpbSBzZWVtcyB0byBiZSBhIGdvb2QgY2hvaWNlIGhlcmUu DQoNClZpZWxlIEdyw7zDn2UsDQoNCkhlbmsNCg0KT24gMDgvMDIvMjAxNyAxMTo0NSBQTSwgTWFy aXVzIFNjdXJ0ZXNjdSB3cm90ZToNCg0KVGhlIGFic3RyYWN0IG1lbnRpb25zICJpc3N1ZXIiIGFu ZCAicmVjZWl2ZXIiIGluIHRoZSBsYXN0IHNlbnRlbmNlLiAicmVjZWl2ZXIiIGRvZXMgbm90IHNv dW5kIHJpZ2h0ICh0aGF0IHNob3VsZCBiZSB1c2VkIGluIHRoZSBjb250ZXh0IG9mIGEgdHJhbnNt aXR0ZXIpLCBidXQgSSBkb24ndCBoYXZlIGEgYmV0dGVyIHN1Z2dlc3Rpb24uIEF1ZGllbmNlPw0K VGhlIGxhc3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gMSBtZW50aW9ucyAic3Vic2NyaWJlciIuIEkg dGhpbmsgaXQgc2hvdWxkIGJlIGVpdGhlciAicmVjZWl2ZXIiIG9yICJhdWRpZW5jZSIuDQpUaGUg ZXhwbGFuYXRpb24gZm9yIGZpZ3VyZSAxIHN0YXRlcyB0aGF0IHRoZSBpc3N1ZXIgZGVub3RlcyB0 aGUgdHJhbnNtaXR0ZXIuIElmIHRoZSBpc3N1ZXIgYW5kIHRoZSB0cmFuc21pdHRlciBhcmUgYXNz dW1lZCB0byBiZSB0aGUgc2FtZSBlbnRpdHksIHRoZW4gdGhlIHRyYW5zbWl0dGVyIGRlZmluaXRp b24gaW4gc2VjdGlvbiAxLjIgc2hvdWxkIG1ha2UgdGhhdCBjbGVhci4NCkZpZ3VyZSAzLCBJIHRo aW5rIHRoZSAic3ViIiBjbGFpbSBzaG91bGQgYmUgbmVzdGVkIGluIHRoZSBldmVudCwgbmV4dCB0 byB0aGUgaXNzdWVyIHRoYXQgcHJvdmlkZXMgdGhlIGNvcnJlY3QgY29udGV4dC4gVGhlICJpc3Mi IGFuZCAic3ViIiBkZWZpbml0aW9ucyBpbiAyLjEgYWxzbyB0b3VjaCBvbiB0aGlzLCBwcm92aWRp bmcgY29uZmxpY3RpbmcgYWR2aWNlLg0KU2VjdGlvbiAyLDEsIGRlZmluaXRpb24gb2YgIm5iZiIu IFRoZSBkZWZpbml0aW9uIHNheXMgdGhhdCB0aGlzIGlzIHRoZSBldmVudCB0aW1lLiBJIHNlZSB0 d28gcHJvYmxlbXM6DQotIHRoZSBuYW1lIHN1Z2dlc3QgIm5vdCBiZWZvcmUiLCBub3QgZXhhY3Rs eSB0aGUgc2FtZSBhcyBldmVudCB0aW1lDQotIHRoZXJlIGNhbiBiZSBtdWx0aXBsZSBldmVudHMN Cm1heWJlIHRoaXMgY2xhaW0gc2hvdWxkIGJlIGRyb3BwZWQ/DQpTZWN0aW9uIDIuMSwgZGVmaW5p dGlvbiBvZiAiZXhwIi4gT21pdHRpbmcgdGhpcyBjbGFpbSBpcyB0aGUgc2hvcnQgdGVybSBzb2x1 dGlvbiB0byB0aGUgY29uZnVzaW9uIGlzc3VlLiBXaHkgbm90IG1lbnRpb24gdGhhdCBhbmQgdGhh dCBpdCBTSE9VTEQgTk9UIGJlIHVzZWQ/DQpTZWN0aW9uIDIuMSwgZGVmaW5pdGlvbiBvZiAiZXZl bnRzIi4gSXQgc3RhdGVzIHRoYXQgYWxsIGV2ZW50cyBtdXN0IHJlZmVyIHRvIHRoZSBzYW1lIGxv Z2ljYWwgZXZlbnQuIExhdGVseSBpbiBkaXNjdXNzaW9ucyB3ZSByZWFjaGVkIHRoZSBjb25jbHVz aW9uIHRoYXQgYWxsIGV2ZW50cyBpbiBhIFNFVCBzaG91bGQgYmUgZGVmaW5lZCBpbiB0aGUgc2Ft ZSBwcm9maWxlLCB3aGljaCBpcyBhIHN0cm9uZ2VyIHJlcXVpcmVtZW50LiBJIHRoaW5rIHRoaXMg ZGVmaW5pdGlvbiBzaG91bGQgbWVudGlvbiB0aGF0Lg0KUmVnYXJkaW5nIGV2ZW50cyBhbmQgcHJv ZmlsZXMuIFRoZXJlIHdhcyBhIHByb3Bvc2FsIHRvIGFkZCBhIG5ldyBjbGFpbSB0byB1bmlxdWVs eSBpZGVudGlmeSB0aGUgcHJvZmlsZS4gSSB0aGluayB3ZSBuZWVkIHRvIGRpc2N1c3MgdGhhdC4N CkZpZ3VyZSA1LiBNYXliZSBhIHNpZ25lZCBleGFtcGxlIHdvdWxkIGJlIGJldHRlciwgZXNwZWNp YWxseSB0aGF0IHRoZSBuZXh0IHBhcmFncmFwaCBtZW50aW9ucyB0aGF0IHNpZ25hdHVyZXMgb3Ig ZW5jcnlwdGlvbiBzaG91bGQgYmUgdXNlZC4NClNlY3Rpb24gNC41LCBzZWNvbmQgcGFyYWdyYXBo LiBNZW50aW9ucyB0aGF0ICJub25jZSIgaXMgYWxzbyByZXF1aXJlZCwgYnV0IHRoYXQgaXMgbm90 IGFjdHVhbGx5IHRydWUuIElkIFRva2VucyBpc3N1ZWQgYXQgdGhlIHRva2VuIGVuZHBvaW50IGZv ciBleGFtcGxlIHdpbGwgbm90IGhhdmUgaXQuIEkgc3VnZ2VzdCB3ZSBkcm9wIHRoZSB3aG9sZSBw YXJhZ3JhcGguDQpNYXJpdXMNCk9uIE1vbiwgSnVsIDMxLCAyMDE3IGF0IDE6NDAgUE0sIFlhcm9u IFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eWFyb25mLmlldGZAZ21haWwu Y29tPiA8bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KICAgVGhpcyBpcyB0 byBhbm5vdW5jZSB3b3JraW5nIGdyb3VwIGxhc3QgY2FsbCBvbiB0aGlzIGRyYWZ0DQogICAoaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19kYXRhdHJh Y2tlci5pZXRmLm9yZ19kb2NfZHJhZnQtMkRpZXRmLTJEc2VjZXZlbnQtMkR0b2tlbl8mZD1Ed0lH YVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJp UnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVVVeWRJRkVWOVNRX2x3X0xO RTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmcz05U0lUOThSbEFiMUM5TWQxVzU0SVJsNmN4amxL ZmpxVDk5dTUtT2p3NEZ3JmU9ICAgICA8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX19kYXRhdHJhY2tlci5pZXRmLm9yZ19kb2NfZHJhZnQtMkRpZXRm LTJEc2VjZXZlbnQtMkR0b2tlbl8mZD1Ed0lHYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hC S0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0 Q19sTElHayZtPVVVeWRJRkVWOVNRX2x3X0xORTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmcz05 U0lUOThSbEFiMUM5TWQxVzU0SVJsNmN4amxLZmpxVDk5dTUtT2p3NEZ3JmU9ID4pLg0KICAgUGxl YXNlIHNlbmQgeW91ciBjb21tZW50cyB0byB0aGUgbGlzdC4gRXZlbiBpZiB5b3UgYXJlIHBlcmZl Y3RseQ0KICAgaGFwcHkgd2l0aCB0aGUgZHJhZnQsIHBsZWFzZSBsZXQgdXMga25vdyB0aGF0IHlv dSBzdXBwb3J0IGl0cw0KICAgcHVibGljYXRpb24gYXMtaXMgYnkgcG9zdGluZyB0byB0aGUgbGlz dC4NCiAgIEJlY2F1c2Ugb2YgdGhlIHN1bW1lciBob2xpZGF5cywgdGhpcyBsYXN0IGNhbGwgaXMg b3BlbiBmb3IgMyB3ZWVrcywNCiAgIHVudGlsIEF1Zy4gMjEuDQogICBUaGFua3MsDQogICAgICAg IERpY2sgYW5kIFlhcm9uDQogICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KICAgSWQtZXZlbnQgbWFpbGluZyBsaXN0DQogICBJZC1ldmVudEBpZXRmLm9y ZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+IDxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQog ICBodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3 dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lHYVEmYz1Sb1AxWXVt Q1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lU U2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVVVeWRJRkVWOVNRX2x3X0xORTRsdlM3cFFMWEVa RVdBMkYxaTdiZkF1VVkmcz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxfVHNKSU5MVlRYT1JVcFNE bnZBJmU9ICAgICA8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJR2FR JmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1VVXlkSUZFVjlTUV9sd19MTkU0 bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJnM9algxUWdjRkk4dW10dDhwRWt0aFhhM3VMX1RzSklO TFZUWE9SVXBTRG52QSZlPSA+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZl bnQmZD1Ed0lHYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVVVeWRJRkVW OVNRX2x3X0xORTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmcz1qWDFRZ2NGSTh1bXR0OHBFa3Ro WGEzdUxfVHNKSU5MVlRYT1JVcFNEbnZBJmU9DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGll dGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGlu Zm9faWQtMkRldmVudCZkPUR3SUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRw a0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr Jm09VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZzPWpYMVFnY0ZJ OHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmZT0NCg0KDQo= --_000_CY4PR21MB05045C2303E540EF078D8706F5460CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBw bGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFj ZTt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SSBhbSBhbHNvIGhhcHB5IHdpdGgg dGhlIGN1cnJlbnQgYXVkaWVuY2Ugc2VtYW50aWNzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQt Ym91bmNlc0BpZXRmLm9yZ10gPGI+DQpPbiBCZWhhbGYgT2YgPC9iPlBoaWwgSHVudDxicj4NCjxi PlNlbnQ6PC9iPiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgMTA6NTggQU08YnI+DQo8Yj5Ubzo8 L2I+IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0Ozxicj4N CjxiPlN1YmplY3Q6PC9iPiBbSWQtZXZlbnRdICZxdW90O2F1ZCZxdW90OyB2cy4gcmVjZWl2ZXIg aXNzdWUgcmFpc2VkIGluIFdHTEM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkFsbCw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBhbSByZXZpZXdpbmcgdGhlIHByZXZpb3VzIGZlZWRiYWNr IGZyb20gV0dMQyBhbmQgd2lsbCBiZSBicmluZ2luZyB1cCBhbnkgdW5yZXNvbHZlZCBpc3N1ZXMg Zm9yIHF1aWNrIGRpc2N1c3Npb24vY29uZmlybWF0aW9u4oCmPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZvbGxvd2luZyB1cCBvbiBNYXJpdXMg YW5kIEhlbmvigJlzIGNvbW1lbnQsIEkgYW0gY29uY2VybmVkIHRoYXQg4oCcYXVk4oCdIGhhcyBh IHZlcnkgc3BlY2lmaWMgbWVhbmluZyBhbmQgaXMgb2Z0ZW4gdGllZCB0byBhIHNlY3VyaXR5IGRv bWFpbiBkZWZpbml0aW9uLiBXZSBzaG91bGQgbm90IG5lY2Vzc2FyaWx5IHNheSB0aGlzIGlzIHRo ZSByZWNlaXZlciB0aG91Z2ggaXQgb2Z0ZW4gdHVybnMgb3V0IHRvIGJlLiBGb3INCiBleGFtcGxl IGEgUlAgKOKAnGF1ZOKAnSkgaGFzIG91dHNvdXJjZWQgZXZlbnRzIHByb2Nlc3NpbmcgdG8gYSB0 aGlyZCBwYXJ0eSAodGhlIHNvIGNhbGxlZCByZWNlaXZlcikuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYW0gaGFwcHkgd2l0aCB0aGUgY3Vy cmVudCBjbGFpbSBzZXQsIGJ1dCBtYXliZSBzb21lIHRleHQgZXhwbGFpbmluZyB0aGF0IGEgcmVj ZWl2ZXIgZG9lcyBub3QgaGF2ZSB0byBiZSB0aGUgYXVkIGlzIGFwcHJvcHJpYXRlPyAmbmJzcDtJ IGRvbuKAmXQgc2VlIGFueSBiZW5lZml0IHRvIGhhdmluZyBhIHJlY2VpdmVyIGNsYWltIGFzIHRo aXMgY291bGQgY29tcGxpY2F0ZSBwcm9jZXNzaW5nIG1vcmUgdGhhbiBpdHMgd29ydGguPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGFy ZSBhIGZldyBvdGhlciBjb21tZW50cyBpbiB0aGlzIHRocmVhZCwgYnV0IHRoaXMgb25lIHNlZW1l ZCB0aGUgbW9zdCB1bnJlc29sdmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5QaGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEF1ZyAzLCAyMDE3LCBhdCA4OjAzIEFNLCBIZW5r IEJpcmtob2x6ICZsdDs8YSBocmVmPSJtYWlsdG86aGVuay5iaXJraG9sekBzaXQuZnJhdW5ob2Zl ci5kZSI+aGVuay5iaXJraG9sekBzaXQuZnJhdW5ob2Zlci5kZTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5IZWxs byw8YnI+DQo8YnI+DQp0byBtZSwgdGhlICZxdW90O2F1ZGllbmNlJnF1b3Q7IGNsYWltIHNlZW1z IHRvIGJlIGEgZ29vZCBjaG9pY2UgaGVyZS48YnI+DQo8YnI+DQpWaWVsZSBHcsO8w59lLDxicj4N Cjxicj4NCkhlbms8YnI+DQo8YnI+DQpPbiAwOC8wMi8yMDE3IDExOjQ1IFBNLCBNYXJpdXMgU2N1 cnRlc2N1IHdyb3RlOjxiciBzdHlsZT0iZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDt0ZXh0LWFs aWduOnN0YXJ0Oy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4 Ij4NCjxicj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+VGhlIGFic3RyYWN0IG1lbnRpb25zICZxdW90O2lzc3VlciZxdW90 OyBhbmQgJnF1b3Q7cmVjZWl2ZXImcXVvdDsgaW4gdGhlIGxhc3Qgc2VudGVuY2UuICZxdW90O3Jl Y2VpdmVyJnF1b3Q7IGRvZXMgbm90IHNvdW5kIHJpZ2h0ICh0aGF0IHNob3VsZCBiZSB1c2VkIGlu IHRoZSBjb250ZXh0IG9mIGEgdHJhbnNtaXR0ZXIpLCBidXQgSSBkb24ndCBoYXZlDQogYSBiZXR0 ZXIgc3VnZ2VzdGlvbi4gQXVkaWVuY2U/PGJyPg0KVGhlIGxhc3QgcGFyYWdyYXBoIG9mIHNlY3Rp b24gMSBtZW50aW9ucyAmcXVvdDtzdWJzY3JpYmVyJnF1b3Q7LiBJIHRoaW5rIGl0IHNob3VsZCBi ZSBlaXRoZXIgJnF1b3Q7cmVjZWl2ZXImcXVvdDsgb3IgJnF1b3Q7YXVkaWVuY2UmcXVvdDsuPGJy Pg0KVGhlIGV4cGxhbmF0aW9uIGZvciBmaWd1cmUgMSBzdGF0ZXMgdGhhdCB0aGUgaXNzdWVyIGRl bm90ZXMgdGhlIHRyYW5zbWl0dGVyLiBJZiB0aGUgaXNzdWVyIGFuZCB0aGUgdHJhbnNtaXR0ZXIg YXJlIGFzc3VtZWQgdG8gYmUgdGhlIHNhbWUgZW50aXR5LCB0aGVuIHRoZSB0cmFuc21pdHRlciBk ZWZpbml0aW9uIGluIHNlY3Rpb24gMS4yIHNob3VsZCBtYWtlIHRoYXQgY2xlYXIuPGJyPg0KRmln dXJlIDMsIEkgdGhpbmsgdGhlICZxdW90O3N1YiZxdW90OyBjbGFpbSBzaG91bGQgYmUgbmVzdGVk IGluIHRoZSBldmVudCwgbmV4dCB0byB0aGUgaXNzdWVyIHRoYXQgcHJvdmlkZXMgdGhlIGNvcnJl Y3QgY29udGV4dC4gVGhlICZxdW90O2lzcyZxdW90OyBhbmQgJnF1b3Q7c3ViJnF1b3Q7IGRlZmlu aXRpb25zIGluIDIuMSBhbHNvIHRvdWNoIG9uIHRoaXMsIHByb3ZpZGluZyBjb25mbGljdGluZyBh ZHZpY2UuPGJyPg0KU2VjdGlvbiAyLDEsIGRlZmluaXRpb24gb2YgJnF1b3Q7bmJmJnF1b3Q7LiBU aGUgZGVmaW5pdGlvbiBzYXlzIHRoYXQgdGhpcyBpcyB0aGUgZXZlbnQgdGltZS4gSSBzZWUgdHdv IHByb2JsZW1zOjxicj4NCi0gdGhlIG5hbWUgc3VnZ2VzdCAmcXVvdDtub3QgYmVmb3JlJnF1b3Q7 LCBub3QgZXhhY3RseSB0aGUgc2FtZSBhcyBldmVudCB0aW1lPGJyPg0KLSB0aGVyZSBjYW4gYmUg bXVsdGlwbGUgZXZlbnRzPGJyPg0KbWF5YmUgdGhpcyBjbGFpbSBzaG91bGQgYmUgZHJvcHBlZD88 YnI+DQpTZWN0aW9uIDIuMSwgZGVmaW5pdGlvbiBvZiAmcXVvdDtleHAmcXVvdDsuIE9taXR0aW5n IHRoaXMgY2xhaW0gaXMgdGhlIHNob3J0IHRlcm0gc29sdXRpb24gdG8gdGhlIGNvbmZ1c2lvbiBp c3N1ZS4gV2h5IG5vdCBtZW50aW9uIHRoYXQgYW5kIHRoYXQgaXQgU0hPVUxEIE5PVCBiZSB1c2Vk Pzxicj4NClNlY3Rpb24gMi4xLCBkZWZpbml0aW9uIG9mICZxdW90O2V2ZW50cyZxdW90Oy4gSXQg c3RhdGVzIHRoYXQgYWxsIGV2ZW50cyBtdXN0IHJlZmVyIHRvIHRoZSBzYW1lIGxvZ2ljYWwgZXZl bnQuIExhdGVseSBpbiBkaXNjdXNzaW9ucyB3ZSByZWFjaGVkIHRoZSBjb25jbHVzaW9uIHRoYXQg YWxsIGV2ZW50cyBpbiBhIFNFVCBzaG91bGQgYmUgZGVmaW5lZCBpbiB0aGUgc2FtZSBwcm9maWxl LCB3aGljaCBpcyBhIHN0cm9uZ2VyIHJlcXVpcmVtZW50LiBJIHRoaW5rIHRoaXMNCiBkZWZpbml0 aW9uIHNob3VsZCBtZW50aW9uIHRoYXQuPGJyPg0KUmVnYXJkaW5nIGV2ZW50cyBhbmQgcHJvZmls ZXMuIFRoZXJlIHdhcyBhIHByb3Bvc2FsIHRvIGFkZCBhIG5ldyBjbGFpbSB0byB1bmlxdWVseSBp ZGVudGlmeSB0aGUgcHJvZmlsZS4gSSB0aGluayB3ZSBuZWVkIHRvIGRpc2N1c3MgdGhhdC48YnI+ DQpGaWd1cmUgNS4gTWF5YmUgYSBzaWduZWQgZXhhbXBsZSB3b3VsZCBiZSBiZXR0ZXIsIGVzcGVj aWFsbHkgdGhhdCB0aGUgbmV4dCBwYXJhZ3JhcGggbWVudGlvbnMgdGhhdCBzaWduYXR1cmVzIG9y IGVuY3J5cHRpb24gc2hvdWxkIGJlIHVzZWQuPGJyPg0KU2VjdGlvbiA0LjUsIHNlY29uZCBwYXJh Z3JhcGguIE1lbnRpb25zIHRoYXQgJnF1b3Q7bm9uY2UmcXVvdDsgaXMgYWxzbyByZXF1aXJlZCwg YnV0IHRoYXQgaXMgbm90IGFjdHVhbGx5IHRydWUuIElkIFRva2VucyBpc3N1ZWQgYXQgdGhlIHRv a2VuIGVuZHBvaW50IGZvciBleGFtcGxlIHdpbGwgbm90IGhhdmUgaXQuIEkgc3VnZ2VzdCB3ZSBk cm9wIHRoZSB3aG9sZSBwYXJhZ3JhcGguPGJyPg0KTWFyaXVzPGJyPg0KT24gTW9uLCBKdWwgMzEs IDIwMTcgYXQgMTo0MCBQTSwgWWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnlhcm9u Zi5pZXRmQGdtYWlsLmNvbSI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnlh cm9uZi5pZXRmQGdtYWlsLmNvbSI+bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7 Jmd0OyB3cm90ZTo8YnI+DQombmJzcDsmbmJzcDsmbmJzcDtUaGlzIGlzIHRvIGFubm91bmNlIHdv cmtpbmcgZ3JvdXAgbGFzdCBjYWxsIG9uIHRoaXMgZHJhZnQ8YnI+DQombmJzcDsmbmJzcDsmbmJz cDsoPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX19kYXRhdHJhY2tlci5pZXRmLm9yZ19kb2NfZHJhZnQtMkRpZXRmLTJEc2VjZXZlbnQt MkR0b2tlbl8mYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1 WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0 Q19sTElHayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZ JmFtcDtzPTlTSVQ5OFJsQWIxQzlNZDFXNTRJUmw2Y3hqbEtmanFUOTl1NS1Panc0RncmYW1wO2U9 Ij5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2Rh dGF0cmFja2VyLmlldGYub3JnX2RvY19kcmFmdC0yRGlldGYtMkRzZWNldmVudC0yRHRva2VuXyZh bXA7ZD1Ed0lHYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPVVVeWRJRkVWOVNRX2x3X0xORTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmYW1wO3M9OVNJ VDk4UmxBYjFDOU1kMVc1NElSbDZjeGpsS2ZqcVQ5OXU1LU9qdzRGdyZhbXA7ZT08L2E+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZsdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX2RhdGF0cmFja2VyLmlldGYub3JnX2RvY19kcmFmdC0yRGlldGYt MkRzZWNldmVudC0yRHRva2VuXyZhbXA7ZD1Ed0lHYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVVVeWRJRkVWOVNRX2x3X0xORTRsdlM3cFFMWEVaRVdB MkYxaTdiZkF1VVkmYW1wO3M9OVNJVDk4UmxBYjFDOU1kMVc1NElSbDZjeGpsS2ZqcVQ5OXU1LU9q dzRGdyZhbXA7ZT0iPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwcy0zQV9fZGF0YXRyYWNrZXIuaWV0Zi5vcmdfZG9jX2RyYWZ0LTJEaWV0Zi0yRHNlY2V2ZW50 LTJEdG9rZW5fJmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NY NVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktl NENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVV WSZhbXA7cz05U0lUOThSbEFiMUM5TWQxVzU0SVJsNmN4amxLZmpxVDk5dTUtT2p3NEZ3JmFtcDtl PTwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmd0 OykuPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7UGxlYXNlIHNlbmQgeW91ciBjb21tZW50cyB0byB0 aGUgbGlzdC4gRXZlbiBpZiB5b3UgYXJlIHBlcmZlY3RseTxicj4NCiZuYnNwOyZuYnNwOyZuYnNw O2hhcHB5IHdpdGggdGhlIGRyYWZ0LCBwbGVhc2UgbGV0IHVzIGtub3cgdGhhdCB5b3Ugc3VwcG9y dCBpdHM8YnI+DQombmJzcDsmbmJzcDsmbmJzcDtwdWJsaWNhdGlvbiBhcy1pcyBieSBwb3N0aW5n IHRvIHRoZSBsaXN0Ljxicj4NCiZuYnNwOyZuYnNwOyZuYnNwO0JlY2F1c2Ugb2YgdGhlIHN1bW1l ciBob2xpZGF5cywgdGhpcyBsYXN0IGNhbGwgaXMgb3BlbiBmb3IgMyB3ZWVrcyw8YnI+DQombmJz cDsmbmJzcDsmbmJzcDt1bnRpbCBBdWcuIDIxLjxicj4NCiZuYnNwOyZuYnNwOyZuYnNwO1RoYW5r cyw8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtE aWNrIGFuZCBZYXJvbjxicj4NCiZuYnNwOyZuYnNwOyZuYnNwO19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7SWQtZXZl bnQgbWFpbGluZyBsaXN0PGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7PGEgaHJlZj0ibWFpbHRvOklk LWV2ZW50QGlldGYub3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpJZC1ldmVu dEBpZXRmLm9yZyI+bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQombmJzcDsm bmJzcDsmbmJzcDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQm YW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3 U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZh bXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtzPWpY MVFnY0ZJOHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmYW1wO2U9Ij5odHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9y Z19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1D WENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBG a0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZT N3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJOHVtdHQ4cEVrdGhYYTN1TF9Uc0pJ TkxWVFhPUlVwU0RudkEmYW1wO2U9PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbHQ7PGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0 Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1Ax WXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3Vn Q0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5F NGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZhbXA7cz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxf VHNKSU5MVlRYT1JVcFNEbnZBJmFtcDtlPSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0y RGV2ZW50JmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlU cGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENf bExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZh bXA7cz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxfVHNKSU5MVlRYT1JVcFNEbnZBJmFtcDtlPTwv YT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmd0Ozxi cj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K SWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYu b3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVX QTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJOHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVw U0RudkEmYW1wO2U9Ij5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9 RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1V VXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJ OHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmYW1wO2U9PC9hPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxi cj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQt ZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPklkLWV2ZW50QGlldGYub3JnPC9zcGFu PjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFp bG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNl R0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxY RVpFV0EyRjFpN2JmQXVVWSZhbXA7cz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxfVHNKSU5MVlRY T1JVcFNEbnZBJmFtcDtlPSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBR Y3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpq V3dsTktlNENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFp N2JmQXVVWSZhbXA7cz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxfVHNKSU5MVlRYT1JVcFNEbnZB JmFtcDtlPTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB05045C2303E540EF078D8706F5460CY4PR21MB0504namp_-- From nobody Mon Oct 23 14:39:00 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9610413A42F for ; Mon, 23 Oct 2017 14:38:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.44 X-Spam-Level: X-Spam-Status: No, score=-2.44 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J0KvyJqzcAko for ; Mon, 23 Oct 2017 14:38:55 -0700 (PDT) Received: from mail-it0-x22e.google.com (mail-it0-x22e.google.com [IPv6:2607:f8b0:4001:c0b::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72BB813A5CF for ; Mon, 23 Oct 2017 14:38:55 -0700 (PDT) Received: by mail-it0-x22e.google.com with SMTP id n195so7681817itg.2 for ; Mon, 23 Oct 2017 14:38:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kl//8Bz9bniiD5CN+0PEyQWx8qDW+O/1YMHU3GWCli8=; b=J+HK1fwDbWCQHrrpLRvcU96GEntGX0tuMAuGSE0+AhhPJ9iwDw5sQ7GvmBxtjMweSG VByKhAhZLpAY+0okft02fEPZx35KputXEvvdqfsUJdwDetd3BrqVGq14NIyIt9vWuqyj 6huJUoA+PD48g0d/0QtgDMHPSek3UtVNLSE5/wWoFmIywMzS8HiqG1nxpzFmewgoXoQZ Y9vDSSY3XqRF4GRshcoMq/CByJNWmkenS3qawoC2cRWJrdhYJT3JPv5r+6xJrA5pUBJi GRong40FiYpX80Q4gKKrqVci9UoYsDLzDkVIwG5kToo0qUNN8wE/5fyrhXmri0A/r0+P GSzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kl//8Bz9bniiD5CN+0PEyQWx8qDW+O/1YMHU3GWCli8=; b=X6f6gaXCw8WpWVtBBPlELT+wWDNL+H5CFrOWrW9VI9g3E0A5aGO9g32rxfevXpTyhS lZ5cvWmFCV6a7woax+wbD8jH+cc6y76t49zqcKu6cWnelYZ37vVa6UQWgF8SZMV3Y61u MfqXSPW7pihp5xV+p7XO0Or+26l06ariijmFsCWrKl0Ov4dJ90/0ONRie3VcC4dAWKp6 14G+KRzc6CdwJIAjlC0RKW2DJ14un4jkA+VYTlUTUEt6R1mlJ82ZXMsKsGiLwbRuTGdb FpqWWhD44LR9XFf2AvqzXA/zx0df1QXwJCW8DpZ6YLOqrdwswo7O7OC5WR99P/QxKD+L pktQ== X-Gm-Message-State: AMCzsaXLWZCRLbYAC1hqAVn85F02K9kBN7eKOp6BtwckGb0SYhvhBRlN k3Pej2KbnH6XeCXFnrcW5f74qh762oBx1lT2SANrtg== X-Google-Smtp-Source: ABhQp+Ret5lbQYqcgPw6BvX3d8TfSNnwPSG5Y+UTN0cxZyAzDjpK6TYqJhYaKiuwO009mi7+zjTjFb2oZZ4yCEThyTc= X-Received: by 10.36.178.85 with SMTP id h21mr11883583iti.118.1508794734335; Mon, 23 Oct 2017 14:38:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Mon, 23 Oct 2017 14:38:33 -0700 (PDT) In-Reply-To: <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> From: Marius Scurtescu Date: Mon, 23 Oct 2017 14:38:33 -0700 Message-ID: To: Phil Hunt Cc: ID Events Mailing List Content-Type: multipart/alternative; boundary="f403045d9a142ea019055c3da68b" Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 21:38:58 -0000 --f403045d9a142ea019055c3da68b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I think "aud" is perfectly fine. IMO it should make no difference for the Transmitter that the event is actually handled by an outsourced entity, the RP trusts that entity and the event is generated and targeted to the RP and not to the current outsourced processor. Marius On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt wrote: > > All, > > I am reviewing the previous feedback from WGLC and will be bringing up an= y > unresolved issues for quick discussion/confirmation=E2=80=A6 > > Following up on Marius and Henk=E2=80=99s comment, I am concerned that = =E2=80=9Caud=E2=80=9D has a > very specific meaning and is often tied to a security domain definition. = We > should not necessarily say this is the receiver though it often turns out > to be. For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events pro= cessing to a third > party (the so called receiver). > > I am happy with the current claim set, but maybe some text explaining tha= t > a receiver does not have to be the aud is appropriate? I don=E2=80=99t s= ee any > benefit to having a receiver claim as this could complicate processing mo= re > than its worth. > > There are a few other comments in this thread, but this one seemed the > most unresolved. > > Phil > > > On Aug 3, 2017, at 8:03 AM, Henk Birkholz > wrote: > > Hello, > > to me, the "audience" claim seems to be a good choice here. > > Viele Gr=C3=BC=C3=9Fe, > > Henk > > On 08/02/2017 11:45 PM, Marius Scurtescu wrote: > > The abstract mentions "issuer" and "receiver" in the last sentence. > "receiver" does not sound right (that should be used in the context of a > transmitter), but I don't have a better suggestion. Audience? > The last paragraph of section 1 mentions "subscriber". I think it should > be either "receiver" or "audience". > The explanation for figure 1 states that the issuer denotes the > transmitter. If the issuer and the transmitter are assumed to be the same > entity, then the transmitter definition in section 1.2 should make that > clear. > Figure 3, I think the "sub" claim should be nested in the event, next to > the issuer that provides the correct context. The "iss" and "sub" > definitions in 2.1 also touch on this, providing conflicting advice. > Section 2,1, definition of "nbf". The definition says that this is the > event time. I see two problems: > - the name suggest "not before", not exactly the same as event time > - there can be multiple events > maybe this claim should be dropped? > Section 2.1, definition of "exp". Omitting this claim is the short term > solution to the confusion issue. Why not mention that and that it SHOULD > NOT be used? > Section 2.1, definition of "events". It states that all events must refer > to the same logical event. Lately in discussions we reached the conclusio= n > that all events in a SET should be defined in the same profile, which is = a > stronger requirement. I think this definition should mention that. > Regarding events and profiles. There was a proposal to add a new claim to > uniquely identify the profile. I think we need to discuss that. > Figure 5. Maybe a signed example would be better, especially that the nex= t > paragraph mentions that signatures or encryption should be used. > Section 4.5, second paragraph. Mentions that "nonce" is also required, bu= t > that is not actually true. Id Tokens issued at the token endpoint for > example will not have it. I suggest we drop the whole paragraph. > Marius > On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer mailto:yaronf.ietf@gmail.com >> wrote: > This is to announce working group last call on this draft > (https://urldefense.proofpoint.com/v2/url?u=3Dhttps- > 3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&= c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_ > LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfj > qT99u5-Ojw4Fw&e=3D url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf- > 2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5Y > TpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFE= V9SQ_ > lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfj > qT99u5-Ojw4Fw&e=3D >). > Please send your comments to the list. Even if you are perfectly > happy with the draft, please let us know that you support its > publication as-is by posting to the list. > Because of the summer holidays, this last call is open for 3 weeks, > until Aug. 21. > Thanks, > Dick and Yaron > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps- > 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_ > LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_ > TsJINLVTXORUpSDnvA&e=3D com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id- > 2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_ > LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_ > TsJINLVTXORUpSDnvA&e=3D > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_ > LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_ > TsJINLVTXORUpSDnvA&e=3D > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_ > LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_ > TsJINLVTXORUpSDnvA&e=3D > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --f403045d9a142ea019055c3da68b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think "aud" is perfectly fine.

<= div>IMO it should make no difference for the Transmitter that the event is = actually handled by an outsourced entity, the RP trusts that entity and the= event is generated and targeted to the RP and not to the current outsource= d processor.

<= div class=3D"gmail_signature" data-smartmail=3D"gmail_signature">Marius

On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt = <phil.hunt@oracle.com> wrote:

<= div>All,

I am reviewing the previous feedback from= WGLC and will be bringing up any unresolved issues for quick discussion/co= nfirmation=E2=80=A6

Following up on Marius and Hen= k=E2=80=99s comment, I am concerned that =E2=80=9Caud=E2=80=9D has a very s= pecific meaning and is often tied to a security domain definition. We shoul= d not necessarily say this is the receiver though it often turns out to be.= For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events processing = to a third party (the so called receiver).

I am ha= ppy with the current claim set, but maybe some text explaining that a recei= ver does not have to be the aud is appropriate?=C2=A0 I don=E2=80=99t see a= ny benefit to having a receiver claim as this could complicate processing m= ore than its worth.

There are a few other comments= in this thread, but this one seemed the most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:

Hello,

to me, the "audience" claim seems to b= e a good choice here.

Viele Gr=C3= =BC=C3=9Fe,

Henk

On 08/02/2017 11:45 PM, Marius Scurtescu wrote:<= /span>
The abstract mentions "issuer" and &quo= t;receiver" in the last sentence. "receiver" does not sound = right (that should be used in the context of a transmitter), but I don'= t have a better suggestion. Audience?
The last paragraph of section 1 me= ntions "subscriber". I think it should be either "receiver&q= uot; or "audience".
The explanation for figure 1 states that t= he issuer denotes the transmitter. If the issuer and the transmitter are as= sumed to be the same entity, then the transmitter definition in section 1.2= should make that clear.
Figure 3, I think the "sub" claim sho= uld be nested in the event, next to the issuer that provides the correct co= ntext. The "iss" and "sub" definitions in 2.1 also touc= h on this, providing conflicting advice.
Section 2,1, definition of &quo= t;nbf". The definition says that this is the event time. I see two pro= blems:
- the name suggest "not before", not exactly the same a= s event time
- there can be multiple events
maybe this claim should b= e dropped?
Section 2.1, definition of "exp". Omitting this cla= im is the short term solution to the confusion issue. Why not mention that = and that it SHOULD NOT be used?
Section 2.1, definition of "events&= quot;. It states that all events must refer to the same logical event. Late= ly in discussions we reached the conclusion that all events in a SET should= be defined in the same profile, which is a stronger requirement. I think t= his definition should mention that.
Regarding events and profiles. There= was a proposal to add a new claim to uniquely identify the profile. I thin= k we need to discuss that.
Figure 5. Maybe a signed example would be bet= ter, especially that the next paragraph mentions that signatures or encrypt= ion should be used.
Section 4.5, second paragraph. Mentions that "n= once" is also required, but that is not actually true. Id Tokens issue= d at the token endpoint for example will not have it. I suggest we drop the= whole paragraph.
Marius
On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheff= er <yaronf.ie= tf@gmail.com= =C2=A0<mailto:yaronf.ietf@gmail.com>> wrote:
=C2=A0=C2=A0=C2=A0= This is to announce working group last call on this draft
=C2=A0=C2=A0= =C2=A0(https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__dat= atracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDw= IGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_<= wbr>lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1= W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<https:= //urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm= 5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_<= wbr>LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6c= xjlKfjqT99u5-Ojw4Fw&e=3D=C2=A0>).
=C2=A0=C2=A0=C2=A0Please send yo= ur comments to the list. Even if you are perfectly
=C2=A0=C2=A0=C2=A0hap= py with the draft, please let us know that you support its
=C2=A0=C2=A0= =C2=A0publication as-is by posting to the list.
=C2=A0=C2=A0=C2=A0Becaus= e of the summer holidays, this last call is open for 3 weeks,
=C2=A0=C2= =A0=C2=A0until Aug. 21.
=C2=A0=C2=A0=C2=A0Thanks,
=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Dick and Yaron
=C2=A0=C2=A0=C2=A0_________= ______________________________________
=C2=A0=C2=A0=C2=A0Id-event m= ailing list
=C2=A0=C2=A0=C2=A0Id-event@ietf.org=C2=A0<mailto:Id-event@ietf.org>
=C2=A0=C2=A0=C2=A0https://urldefense.= proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_lis= tinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxB= KCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlN= Ke4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&am= p;s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0<https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.= ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3D= RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH= 0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lv= S7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTX= ORUpSDnvA&e=3D=C2=A0>
____________________________________________= ___
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dht= tps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&a= mp;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJ= Bm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw= _LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u= =3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwI= GaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D<= wbr>JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3= uL_TsJINLVTXORUpSDnvA&e=3D



= _______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--f403045d9a142ea019055c3da68b-- From nobody Mon Oct 23 15:55:49 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 014A213A9F5 for ; Mon, 23 Oct 2017 15:55:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.011 X-Spam-Level: X-Spam-Status: No, score=-5.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s3SxXobm49_d for ; Mon, 23 Oct 2017 15:55:45 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4145139950 for ; Mon, 23 Oct 2017 15:55:44 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9NMtgED012829 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 23 Oct 2017 22:55:43 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9NMtgom022703 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 23 Oct 2017 22:55:42 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9NMtgaf019814; Mon, 23 Oct 2017 22:55:42 GMT Received: from [192.168.1.23] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 15:55:41 -0700 From: Phil Hunt Message-Id: <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9B8748E1-DC7E-4859-A5C2-FCDCA74EA5AE" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 23 Oct 2017 15:55:39 -0700 In-Reply-To: Cc: ID Events Mailing List To: Marius Scurtescu References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 22:55:47 -0000 --Apple-Mail=_9B8748E1-DC7E-4859-A5C2-FCDCA74EA5AE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 It seems reasonable to further clarify that the definition of a receiver = could be improved. I propose to change from: Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. To: Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different entity than that described by the =E2=80=9Caud=E2=80=9D claim. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 23, 2017, at 2:38 PM, Marius Scurtescu = wrote: >=20 > I think "aud" is perfectly fine. >=20 > IMO it should make no difference for the Transmitter that the event is = actually handled by an outsourced entity, the RP trusts that entity and = the event is generated and targeted to the RP and not to the current = outsourced processor. >=20 > Marius >=20 > On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt > wrote: >=20 > All, >=20 > I am reviewing the previous feedback from WGLC and will be bringing up = any unresolved issues for quick discussion/confirmation=E2=80=A6 >=20 > Following up on Marius and Henk=E2=80=99s comment, I am concerned that = =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied to a = security domain definition. We should not necessarily say this is the = receiver though it often turns out to be. For example a RP (=E2=80=9Caud=E2= =80=9D) has outsourced events processing to a third party (the so called = receiver). >=20 > I am happy with the current claim set, but maybe some text explaining = that a receiver does not have to be the aud is appropriate? I don=E2=80=99= t see any benefit to having a receiver claim as this could complicate = processing more than its worth. >=20 > There are a few other comments in this thread, but this one seemed the = most unresolved. >=20 > Phil >=20 >=20 >> On Aug 3, 2017, at 8:03 AM, Henk Birkholz = > wrote: >>=20 >> Hello, >>=20 >> to me, the "audience" claim seems to be a good choice here. >>=20 >> Viele Gr=C3=BC=C3=9Fe, >>=20 >> Henk >>=20 >> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>> The abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience? >>> The last paragraph of section 1 mentions "subscriber". I think it = should be either "receiver" or "audience". >>> The explanation for figure 1 states that the issuer denotes the = transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear. >>> Figure 3, I think the "sub" claim should be nested in the event, = next to the issuer that provides the correct context. The "iss" and = "sub" definitions in 2.1 also touch on this, providing conflicting = advice. >>> Section 2,1, definition of "nbf". The definition says that this is = the event time. I see two problems: >>> - the name suggest "not before", not exactly the same as event time >>> - there can be multiple events >>> maybe this claim should be dropped? >>> Section 2.1, definition of "exp". Omitting this claim is the short = term solution to the confusion issue. Why not mention that and that it = SHOULD NOT be used? >>> Section 2.1, definition of "events". It states that all events must = refer to the same logical event. Lately in discussions we reached the = conclusion that all events in a SET should be defined in the same = profile, which is a stronger requirement. I think this definition should = mention that. >>> Regarding events and profiles. There was a proposal to add a new = claim to uniquely identify the profile. I think we need to discuss that. >>> Figure 5. Maybe a signed example would be better, especially that = the next paragraph mentions that signatures or encryption should be = used. >>> Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph. >>> Marius >>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer = = >> wrote: >>> This is to announce working group last call on this draft >>> = (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.o= rg_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR= 8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6= cxjlKfjqT99u5-Ojw4Fw&e=3D = = >). >>> Please send your comments to the list. Even if you are perfectly >>> happy with the draft, please let us know that you support its >>> publication as-is by posting to the list. >>> Because of the summer holidays, this last call is open for 3 = weeks, >>> until Aug. 21. >>> Thanks, >>> Dick and Yaron >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org = > >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = = > >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 --Apple-Mail=_9B8748E1-DC7E-4859-A5C2-FCDCA74EA5AE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 It seems reasonable to further clarify that the definition of = a receiver could be improved.

I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method. An Event Receiver MAY be a =
different
      entity than that described by the =E2=80=9Caud=E2=80=9D =
claim.


On Oct 23, 2017, at 2:38 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "aud" is perfectly fine.

IMO it should make no difference for = the Transmitter that the event is actually handled by an outsourced = entity, the RP trusts that entity and the event is generated and = targeted to the RP and not to the current outsourced = processor.

Marius

On Mon, Oct 23, 2017 at 10:57 = AM, Phil Hunt <phil.hunt@oracle.com> wrote:

All,

I am reviewing the previous feedback from WGLC and will be = bringing up any unresolved issues for quick = discussion/confirmation=E2=80=A6

Following up on Marius and Henk=E2=80=99s= comment, I am concerned that =E2=80=9Caud=E2=80=9D has a very specific = meaning and is often tied to a security domain definition. We should not = necessarily say this is the receiver though it often turns out to be. = For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events = processing to a third party (the so called receiver).

I am happy with the = current claim set, but maybe some text explaining that a receiver does = not have to be the aud is appropriate?  I don=E2=80=99t see any = benefit to having a receiver claim as this could complicate processing = more than its worth.

There are a few other comments in this thread, but this one = seemed the most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz = <henk.birkholz@sit.fraunhofer.de> = wrote:

Hello,

to me, the "audience" claim = seems to be a good choice here.

Viele Gr=C3=BC=C3=9Fe,=

Henk

On 08/02/2017 11:45 PM, = Marius Scurtescu wrote:
The abstract mentions "issuer" and "receiver" in the last = sentence. "receiver" does not sound right (that should be used in the = context of a transmitter), but I don't have a better suggestion. = Audience?
The last paragraph of section 1 mentions = "subscriber". I think it should be either "receiver" or "audience".
The explanation for figure 1 states that the issuer denotes = the transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear.
Figure 3, I think the "sub" claim should be = nested in the event, next to the issuer that provides the correct = context. The "iss" and "sub" definitions in 2.1 also touch on this, = providing conflicting advice.
Section 2,1, definition of = "nbf". The definition says that this is the event time. I see two = problems:
- the name suggest "not before", not exactly the = same as event time
- there can be multiple events
maybe this claim should be dropped?
Section = 2.1, definition of "exp". Omitting this claim is the short term solution = to the confusion issue. Why not mention that and that it SHOULD NOT be = used?
Section 2.1, definition of "events". It states that = all events must refer to the same logical event. Lately in discussions = we reached the conclusion that all events in a SET should be defined in = the same profile, which is a stronger requirement. I think this = definition should mention that.
Regarding events and = profiles. There was a proposal to add a new claim to uniquely identify = the profile. I think we need to discuss that.
Figure 5. = Maybe a signed example would be better, especially that the next = paragraph mentions that signatures or encryption should be used.
Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph.
Marius
On Mon, Jul 31, 2017 at = 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>> = wrote:
   This is to announce working group = last call on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D  &nb= sp;  <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D >).   Please send your comments to the list. = Even if you are perfectly
   happy with the = draft, please let us know that you support its
   publication as-is by posting to the = list.
   Because of the summer holidays, = this last call is open for 3 weeks,
   until = Aug. 21.
   Thanks,
        Dick and = Yaron
   _______________________________________________
   Id-event = mailing list
   Id-event@ietf.org <mailto:Id-event@ietf.org>
   https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D  &nb= sp;  <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D 

_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



= --Apple-Mail=_9B8748E1-DC7E-4859-A5C2-FCDCA74EA5AE-- From nobody Mon Oct 23 15:58:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC1B913A415 for ; Mon, 23 Oct 2017 15:58:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.618 X-Spam-Level: X-Spam-Status: No, score=-0.618 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_10_20=0.093, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EQy_ckb14TLT for ; Mon, 23 Oct 2017 15:58:50 -0700 (PDT) Received: from mail-it0-x236.google.com (mail-it0-x236.google.com [IPv6:2607:f8b0:4001:c0b::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67D7413A902 for ; Mon, 23 Oct 2017 15:58:50 -0700 (PDT) Received: by mail-it0-x236.google.com with SMTP id o135so7886853itb.0 for ; Mon, 23 Oct 2017 15:58:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=1TsnOA0BKIwiPdGDbJib9BJMrvUF0dbXvY9RhGs5Wuc=; b=PFL/42Yo/7+BRYKtnhfZ4olQfFL+ZCtseWUK3Y0mpWsJLvelMbO1aKG0bYR3CCp2Dk dYnxejwkniFBjF803rvq19y7DKR3RXGLjzV5DbQzUJMfcZJhSZgd9x4mD3Dw1MKyoFpG TtxHgfKWRk0CxBXm6v1KriWNs/Auz11ok5c7CD6O2NT//p7FBilG5KIO6eMxTgt9gPzs Vz0zYTBxD/IBy5hsGzq2NsY0HWanyM6hHSfY4Zfs48xeVCskZEJC16pG71ppeVA18KTx OUDXO8In7p1hKzMcLc29nmc44+HkpR5NmyZPwHBCiGC2nkUMfvkc32CL2aLkF1PxNipX lF/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=1TsnOA0BKIwiPdGDbJib9BJMrvUF0dbXvY9RhGs5Wuc=; b=XCCTGwL+gkq2fwjn33AKEIDMS9K2LGiYPuaH0Qug4otb4/CJqcDZ1VCZ0vhS53ty5B fKHhFIXtEpExd9zeCLs46yAOWbGhbJ4LjvL7uSoujjrSyV8WUqZtQF9EBX5x61H6aCHc NxndrNsTM1YJdVTk1RehEYrfDC5NVuO6kAKH3Op16DjUry+vO0i8Zdyju0h/t4ZqEzP5 la/IUkZMwgrn51qq2UBRawhQ2fWLVMfm9Ph9wja9caTUPsRpeaQOHoH1I3eA7NF2W6xx jyET3ZuiqYPHLV8slWxXUxnAXpA7JWtxGi83OyBLJIYKeHRLf9o1w4byWEUpO4WlKv7O KDvA== X-Gm-Message-State: AMCzsaWJWTLfYicfMb2FE+FGSsE8Jo9AZpp3xxugPQkT3VJJGwzxAmtF JiXpTYFUnr3WkRgSGoOLgXQ/J8afmAU/6BtQIjGJ4Q== X-Google-Smtp-Source: ABhQp+RAsDM+OaIB6b5D3+CRwZ2yxf5GpTycqL9k3Br9TiLQ8FsEH1Vuw50rm8kRULlj6iV8wcW+ZpsVrWzKlwYtKLU= X-Received: by 10.36.178.85 with SMTP id h21mr12132997iti.118.1508799529139; Mon, 23 Oct 2017 15:58:49 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Mon, 23 Oct 2017 15:58:28 -0700 (PDT) In-Reply-To: <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> From: Marius Scurtescu Date: Mon, 23 Oct 2017 15:58:28 -0700 Message-ID: To: Phil Hunt Cc: ID Events Mailing List Content-Type: multipart/alternative; boundary="f403045d9a14f98c2c055c3ec323" Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 22:58:53 -0000 --f403045d9a14f98c2c055c3ec323 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I think "aud" should point to the Receiver, the outsourcing is irrelevant. Nothing needs to change here IMO. Marius On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt wrote: > It seems reasonable to further clarify that the definition of a receiver > could be improved. > > I propose to change from: > > Event Receiver > An Event Receiver is an entity that receives SETs through some > distribution method. > > > To: > > Event Receiver > An Event Receiver is an entity that receives SETs through some > distribution method. An Event Receiver MAY be a different > > entity than that described by the =E2=80=9Caud=E2=80=9D claim. > > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > > On Oct 23, 2017, at 2:38 PM, Marius Scurtescu > wrote: > > I think "aud" is perfectly fine. > > IMO it should make no difference for the Transmitter that the event is > actually handled by an outsourced entity, the RP trusts that entity and t= he > event is generated and targeted to the RP and not to the current outsourc= ed > processor. > > Marius > > On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt wrote: > >> >> All, >> >> I am reviewing the previous feedback from WGLC and will be bringing up >> any unresolved issues for quick discussion/confirmation=E2=80=A6 >> >> Following up on Marius and Henk=E2=80=99s comment, I am concerned that = =E2=80=9Caud=E2=80=9D has >> a very specific meaning and is often tied to a security domain definitio= n. >> We should not necessarily say this is the receiver though it often turns >> out to be. For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced event= s processing to a >> third party (the so called receiver). >> >> I am happy with the current claim set, but maybe some text explaining >> that a receiver does not have to be the aud is appropriate? I don=E2=80= =99t see >> any benefit to having a receiver claim as this could complicate processi= ng >> more than its worth. >> >> There are a few other comments in this thread, but this one seemed the >> most unresolved. >> >> Phil >> >> >> On Aug 3, 2017, at 8:03 AM, Henk Birkholz > de> wrote: >> >> Hello, >> >> to me, the "audience" claim seems to be a good choice here. >> >> Viele Gr=C3=BC=C3=9Fe, >> >> Henk >> >> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >> >> The abstract mentions "issuer" and "receiver" in the last sentence. >> "receiver" does not sound right (that should be used in the context of a >> transmitter), but I don't have a better suggestion. Audience? >> The last paragraph of section 1 mentions "subscriber". I think it should >> be either "receiver" or "audience". >> The explanation for figure 1 states that the issuer denotes the >> transmitter. If the issuer and the transmitter are assumed to be the sam= e >> entity, then the transmitter definition in section 1.2 should make that >> clear. >> Figure 3, I think the "sub" claim should be nested in the event, next to >> the issuer that provides the correct context. The "iss" and "sub" >> definitions in 2.1 also touch on this, providing conflicting advice. >> Section 2,1, definition of "nbf". The definition says that this is the >> event time. I see two problems: >> - the name suggest "not before", not exactly the same as event time >> - there can be multiple events >> maybe this claim should be dropped? >> Section 2.1, definition of "exp". Omitting this claim is the short term >> solution to the confusion issue. Why not mention that and that it SHOULD >> NOT be used? >> Section 2.1, definition of "events". It states that all events must refe= r >> to the same logical event. Lately in discussions we reached the conclusi= on >> that all events in a SET should be defined in the same profile, which is= a >> stronger requirement. I think this definition should mention that. >> Regarding events and profiles. There was a proposal to add a new claim t= o >> uniquely identify the profile. I think we need to discuss that. >> Figure 5. Maybe a signed example would be better, especially that the >> next paragraph mentions that signatures or encryption should be used. >> Section 4.5, second paragraph. Mentions that "nonce" is also required, >> but that is not actually true. Id Tokens issued at the token endpoint fo= r >> example will not have it. I suggest we drop the whole paragraph. >> Marius >> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer > mailto:yaronf.ietf@gmail.com >> wrote: >> This is to announce working group last call on this draft >> (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__ >> datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3D >> DwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5b >> iRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4 >> lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw= &e=3D >> > u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dseceven >> t-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057 >> SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D >> UUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9M >> d1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D >). >> Please send your comments to the list. Even if you are perfectly >> happy with the draft, please let us know that you support its >> publication as-is by posting to the list. >> Because of the summer holidays, this last call is open for 3 weeks, >> until Aug. 21. >> Thanks, >> Dick and Yaron >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org > >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. >> ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCg >> aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPE >> ivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D >> jX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D > urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_ >> mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8P >> QcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe >> 4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D >> jX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D > >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuU >> Y&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuU >> Y&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >> >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> > > --f403045d9a14f98c2c055c3ec323 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I think "aud" should point to the Receiver, the = outsourcing is irrelevant.

Nothing needs to change here = IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> wrote:
It seems reasonable to further cl= arify that the definition of a receiver could be improved.

I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different
      entity than that described by th=
e =E2=80=9Caud=E2=80=9D claim.

=
Phil

Oracle Corporation, Identity Cloud Services Architect
@inde= pendentid
phil.hunt@oracle.com

On Oct 23, 2017, at 2:38 PM, Marius= Scurtescu <m= scurtescu@google.com> wrote:

I think "aud" is= perfectly fine.

IMO it should make no difference for th= e Transmitter that the event is actually handled by an outsourced entity, t= he RP trusts that entity and the event is generated and targeted to the RP = and not to the current outsourced processor.

Marius

On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt = <phil.hunt@oracle.com> wrote:

All,

I am reviewing the p= revious feedback from WGLC and will be bringing up any unresolved issues fo= r quick discussion/confirmation=E2=80=A6

Following= up on Marius and Henk=E2=80=99s comment, I am concerned that =E2=80=9Caud= =E2=80=9D has a very specific meaning and is often tied to a security domai= n definition. We should not necessarily say this is the receiver though it = often turns out to be. For example a RP (=E2=80=9Caud=E2=80=9D) has outsour= ced events processing to a third party (the so called receiver).
=
I am happy with the current claim set, but maybe some text e= xplaining that a receiver does not have to be the aud is appropriate?=C2=A0= I don=E2=80=99t see any benefit to having a receiver claim as this could c= omplicate processing more than its worth.

There ar= e a few other comments in this thread, but this one seemed the most unresol= ved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz <henk.birkh= olz@sit.fraunhofer.de> wrote:

Hello,

to me, = the "audience" claim seems to be a good choice here.

Viele Gr=C3=BC=C3=9Fe,

Henk

On 08/02/20= 17 11:45 PM, Marius Scurtescu wrote:
The abstra= ct mentions "issuer" and "receiver" in the last sentenc= e. "receiver" does not sound right (that should be used in the co= ntext of a transmitter), but I don't have a better suggestion. Audience= ?
The last paragraph of section 1 mentions "subscriber". I thi= nk it should be either "receiver" or "audience".
The= explanation for figure 1 states that the issuer denotes the transmitter. I= f the issuer and the transmitter are assumed to be the same entity, then th= e transmitter definition in section 1.2 should make that clear.
Figure 3= , I think the "sub" claim should be nested in the event, next to = the issuer that provides the correct context. The "iss" and "= ;sub" definitions in 2.1 also touch on this, providing conflicting adv= ice.
Section 2,1, definition of "nbf". The definition says tha= t this is the event time. I see two problems:
- the name suggest "n= ot before", not exactly the same as event time
- there can be multi= ple events
maybe this claim should be dropped?
Section 2.1, definitio= n of "exp". Omitting this claim is the short term solution to the= confusion issue. Why not mention that and that it SHOULD NOT be used?
S= ection 2.1, definition of "events". It states that all events mus= t refer to the same logical event. Lately in discussions we reached the con= clusion that all events in a SET should be defined in the same profile, whi= ch is a stronger requirement. I think this definition should mention that.<= br>Regarding events and profiles. There was a proposal to add a new claim t= o uniquely identify the profile. I think we need to discuss that.
Figure= 5. Maybe a signed example would be better, especially that the next paragr= aph mentions that signatures or encryption should be used.
Section 4.5, = second paragraph. Mentions that "nonce" is also required, but tha= t is not actually true. Id Tokens issued at the token endpoint for example = will not have it. I suggest we drop the whole paragraph.
Marius
On Mo= n, Jul 31, 2017 at 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com=C2=A0<= ;mailto:yar= onf.ietf@gmail.com>> wrote:
=C2=A0=C2=A0=C2=A0This is to annou= nce working group last call on this draft
=C2=A0=C2=A0=C2=A0(https://url= defense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_= doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1Y= umCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkIT= SeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEW= A2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&= amp;e=3D=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<https://urlde= fense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_do= c_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2= F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D=C2=A0>).
=C2=A0=C2=A0=C2=A0Please send your com= ments to the list. Even if you are perfectly
=C2=A0=C2=A0=C2=A0happy wit= h the draft, please let us know that you support its
=C2=A0=C2=A0=C2=A0p= ublication as-is by posting to the list.
=C2=A0=C2=A0=C2=A0Because of th= e summer holidays, this last call is open for 3 weeks,
=C2=A0=C2=A0=C2= =A0until Aug. 21.
=C2=A0=C2=A0=C2=A0Thanks,
=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0Dick and Yaron
=C2=A0=C2=A0=C2=A0_______________= ________________________________
=C2=A0=C2=A0=C2=A0Id-event mailing= list
=C2=A0=C2=A0=C2=A0Id-event@ietf.org=C2=A0<mailto:Id-event@ietf.org>
=C2= =A0=C2=A0=C2=A0= https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCg= aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7= bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e= =3D=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<https://urldefense.proofpoint.com/v= 2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&= d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&am= p;r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFE= V9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthX= a3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0>
_________= ______________________________________
Id-event mailing list
Id-event@ietf.orghttps://urldefe= nse.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_list= info_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBK= CX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D= jX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0

___________________= ____________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.= org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv= lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz= jWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAu= UY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D

=


________________________________= _______________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



--f403045d9a14f98c2c055c3ec323-- From nobody Mon Oct 23 16:15:20 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0B7713AB3E for ; Mon, 23 Oct 2017 16:15:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.971 X-Spam-Level: X-Spam-Status: No, score=-1.971 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xqtwidSnrKIo for ; Mon, 23 Oct 2017 16:15:16 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5566713A415 for ; Mon, 23 Oct 2017 16:15:16 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9NNFEtT023442 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 23 Oct 2017 23:15:14 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9NNFDvF010241 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 23 Oct 2017 23:15:14 GMT Received: from abhmp0001.oracle.com (abhmp0001.oracle.com [141.146.116.7]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9NNFDId017224; Mon, 23 Oct 2017 23:15:13 GMT Received: from [192.168.1.23] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 16:15:13 -0700 From: Phil Hunt Message-Id: <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E1C8445F-0968-490B-B79B-B78E8D13A936" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 23 Oct 2017 16:15:11 -0700 In-Reply-To: Cc: ID Events Mailing List To: Marius Scurtescu References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Oct 2017 23:15:19 -0000 --Apple-Mail=_E1C8445F-0968-490B-B79B-B78E8D13A936 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 It=E2=80=99s quite relevant to those with distributed architectures. If an Event Stream requires that SETs need to be encrypted (using JWE), = the SETs needs to be encrypted so the =E2=80=9Creceiver" can read it. = Regardless, =E2=80=9Caud=E2=80=9D should be interpreted by the = traditional JWT method which suggests the security domain the event is = for. For example, a web site relying party does not have the capability = to process (or issue) events itself (eg. because of a distributed = architecture). The relying party assigns another entity the role of = Event Receiver (or Transmitter). =20 The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for = =E2=80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can = read the SET which will make it impossible to for another server to = handle or worse, it would require sharing of private keys.=20 Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 23, 2017, at 3:58 PM, Marius Scurtescu = wrote: >=20 > I think "aud" should point to the Receiver, the outsourcing is = irrelevant. >=20 > Nothing needs to change here IMO. >=20 > Marius >=20 > On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt > wrote: > It seems reasonable to further clarify that the definition of a = receiver could be improved. >=20 > I propose to change from: > Event Receiver > An Event Receiver is an entity that receives SETs through some > distribution method. >=20 > To: > Event Receiver > An Event Receiver is an entity that receives SETs through some > distribution method. An Event Receiver MAY be a different > entity than that described by the =E2=80=9Caud=E2=80=9D claim. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = phil.hunt@o= racle.com >=20 >> On Oct 23, 2017, at 2:38 PM, Marius Scurtescu > wrote: >>=20 >> I think "aud" is perfectly fine. >>=20 >> IMO it should make no difference for the Transmitter that the event = is actually handled by an outsourced entity, the RP trusts that entity = and the event is generated and targeted to the RP and not to the current = outsourced processor. >>=20 >> Marius >>=20 >> On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt > wrote: >>=20 >> All, >>=20 >> I am reviewing the previous feedback from WGLC and will be bringing = up any unresolved issues for quick discussion/confirmation=E2=80=A6 >>=20 >> Following up on Marius and Henk=E2=80=99s comment, I am concerned = that =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied = to a security domain definition. We should not necessarily say this is = the receiver though it often turns out to be. For example a RP = (=E2=80=9Caud=E2=80=9D) has outsourced events processing to a third = party (the so called receiver). >>=20 >> I am happy with the current claim set, but maybe some text explaining = that a receiver does not have to be the aud is appropriate? I don=E2=80=99= t see any benefit to having a receiver claim as this could complicate = processing more than its worth. >>=20 >> There are a few other comments in this thread, but this one seemed = the most unresolved. >>=20 >> Phil >>=20 >>=20 >>> On Aug 3, 2017, at 8:03 AM, Henk Birkholz = > wrote: >>>=20 >>> Hello, >>>=20 >>> to me, the "audience" claim seems to be a good choice here. >>>=20 >>> Viele Gr=C3=BC=C3=9Fe, >>>=20 >>> Henk >>>=20 >>> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>>> The abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience? >>>> The last paragraph of section 1 mentions "subscriber". I think it = should be either "receiver" or "audience". >>>> The explanation for figure 1 states that the issuer denotes the = transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear. >>>> Figure 3, I think the "sub" claim should be nested in the event, = next to the issuer that provides the correct context. The "iss" and = "sub" definitions in 2.1 also touch on this, providing conflicting = advice. >>>> Section 2,1, definition of "nbf". The definition says that this is = the event time. I see two problems: >>>> - the name suggest "not before", not exactly the same as event time >>>> - there can be multiple events >>>> maybe this claim should be dropped? >>>> Section 2.1, definition of "exp". Omitting this claim is the short = term solution to the confusion issue. Why not mention that and that it = SHOULD NOT be used? >>>> Section 2.1, definition of "events". It states that all events must = refer to the same logical event. Lately in discussions we reached the = conclusion that all events in a SET should be defined in the same = profile, which is a stronger requirement. I think this definition should = mention that. >>>> Regarding events and profiles. There was a proposal to add a new = claim to uniquely identify the profile. I think we need to discuss that. >>>> Figure 5. Maybe a signed example would be better, especially that = the next paragraph mentions that signatures or encryption should be = used. >>>> Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph. >>>> Marius >>>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer = = >> wrote: >>>> This is to announce working group last call on this draft >>>> = (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.o= rg_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR= 8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6= cxjlKfjqT99u5-Ojw4Fw&e=3D = = >). >>>> Please send your comments to the list. Even if you are perfectly >>>> happy with the draft, please let us know that you support its >>>> publication as-is by posting to the list. >>>> Because of the summer holidays, this last call is open for 3 = weeks, >>>> until Aug. 21. >>>> Thanks, >>>> Dick and Yaron >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org = > >>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = = > >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = =20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = >>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event = >>=20 >>=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXo= RtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3= N0&e=3D=20 --Apple-Mail=_E1C8445F-0968-490B-B79B-B78E8D13A936 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
It=E2=80=99s quite relevant to those with = distributed architectures.

If an Event Stream requires that SETs need to be encrypted = (using JWE), the SETs needs to be encrypted so the =E2=80=9Creceiver" = can read it.  Regardless, =E2=80=9Caud=E2=80=9D should be = interpreted by the traditional JWT method which suggests the security = domain the event is for.  For example, a web site relying party = does not have the capability to process (or issue) events itself (eg. = because of a distributed architecture). The relying party assigns = another entity the role of Event Receiver (or Transmitter). =  

The = problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for = =E2=80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can = read the SET which will make it impossible to for another server to = handle or worse, it would require sharing of private = keys. 

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 23, 2017, at 3:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "aud" should point to the Receiver, the outsourcing = is irrelevant.

Nothing= needs to change here IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 = PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It seems reasonable to further = clarify that the definition of a receiver could be improved.

I propose to change = from:
=
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
=
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method. An Event Receiver MAY be a =
different
=
      entity than that described by the =E2=80=9Caud=E2=80=9D =
claim.

<= div style=3D"word-wrap:break-word" class=3D"">
Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 23, 2017, at 2:38 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "aud" is perfectly = fine.

IMO it should = make no difference for the Transmitter that the event is actually = handled by an outsourced entity, the RP trusts that entity and the event = is generated and targeted to the RP and not to the current outsourced = processor.

Marius

On Mon, Oct 23, 2017 at 10:57 = AM, Phil Hunt <phil.hunt@oracle.com> wrote:

All,

I am reviewing the previous feedback from WGLC and will be = bringing up any unresolved issues for quick = discussion/confirmation=E2=80=A6

Following up on Marius and Henk=E2=80=99s= comment, I am concerned that =E2=80=9Caud=E2=80=9D has a very specific = meaning and is often tied to a security domain definition. We should not = necessarily say this is the receiver though it often turns out to be. = For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events = processing to a third party (the so called receiver).

I am happy with the = current claim set, but maybe some text explaining that a receiver does = not have to be the aud is appropriate?  I don=E2=80=99t see any = benefit to having a receiver claim as this could complicate processing = more than its worth.

There are a few other comments in this thread, but this one = seemed the most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz = <henk.birkholz@sit.fraunhofer.de> = wrote:

Hello,

to me, the "audience" claim = seems to be a good choice here.

Viele Gr=C3=BC=C3=9Fe,=

Henk

On 08/02/2017 11:45 PM, = Marius Scurtescu wrote:
The abstract mentions "issuer" and "receiver" in the last = sentence. "receiver" does not sound right (that should be used in the = context of a transmitter), but I don't have a better suggestion. = Audience?
The last paragraph of section 1 mentions = "subscriber". I think it should be either "receiver" or "audience".
The explanation for figure 1 states that the issuer denotes = the transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear.
Figure 3, I think the "sub" claim should be = nested in the event, next to the issuer that provides the correct = context. The "iss" and "sub" definitions in 2.1 also touch on this, = providing conflicting advice.
Section 2,1, definition of = "nbf". The definition says that this is the event time. I see two = problems:
- the name suggest "not before", not exactly the = same as event time
- there can be multiple events
maybe this claim should be dropped?
Section = 2.1, definition of "exp". Omitting this claim is the short term solution = to the confusion issue. Why not mention that and that it SHOULD NOT be = used?
Section 2.1, definition of "events". It states that = all events must refer to the same logical event. Lately in discussions = we reached the conclusion that all events in a SET should be defined in = the same profile, which is a stronger requirement. I think this = definition should mention that.
Regarding events and = profiles. There was a proposal to add a new claim to uniquely identify = the profile. I think we need to discuss that.
Figure 5. = Maybe a signed example would be better, especially that the next = paragraph mentions that signatures or encryption should be used.
Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph.
Marius
On Mon, Jul 31, 2017 at = 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com&= nbsp;<mailto:yaronf.ietf@gmail.com>> = wrote:
   This is to announce working group = last call on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D&= nbsp;    <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D&= nbsp;>).
   Please send your = comments to the list. Even if you are perfectly
   happy with the draft, please let us know = that you support its
   publication as-is = by posting to the list.
   Because of the = summer holidays, this last call is open for 3 weeks,
   until Aug. 21.
   Thanks,
        Dick and = Yaron
   _______________________________________________
   Id-event = mailing list
   Id-event@ietf.org&= nbsp;<mailto:Id-event@ietf.org>
   https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D&= nbsp;    <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D&= nbsp;>
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D&= nbsp;

_______________________________________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4B= pCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e=3D

= --Apple-Mail=_E1C8445F-0968-490B-B79B-B78E8D13A936-- From nobody Mon Oct 23 17:04:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 620B913A5BC for ; Mon, 23 Oct 2017 17:04:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.009 X-Spam-Level: X-Spam-Status: No, score=-3.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HevmSIEc5zRn for ; Mon, 23 Oct 2017 17:04:07 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0102.outbound.protection.outlook.com [104.47.41.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0868613A1FA for ; Mon, 23 Oct 2017 17:04:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=UVDJP/6+4+kiVn86tJ5P/NwlQSAEFgtqkwbT22nY8eI=; b=aCfEsumeDaH0EfkrSibEdxY3VB9HnL6//pv3q42/Bvq8pxGC6f8NEpIBtIyn1srMnF5RrW7iaM+bSGxNfxIsMMqdvAnVkyGt6NO3LP3FxJs48V0Hs1g89zkHTbS+ifQ/46NGr6w/G6kqeVko6qpzC0nBiVB2tVgC3YD8Hc3mcvU= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0759.namprd21.prod.outlook.com (10.173.192.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Tue, 24 Oct 2017 00:04:05 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 00:04:05 +0000 From: Mike Jones To: Nat Sakimura , "M.Lizar@OCG" CC: Yaron Sheffer , SecEvent Thread-Topic: [Id-event] WG Last Call for draft-ietf-secevent-token-02 Thread-Index: AQHTCj09LrxBWiFA7kmsguwQioPAmaJuaWjQgAFFhACAAaApAICBPUPA Date: Tue, 24 Oct 2017 00:04:05 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-23T17:04:03.2670534-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:5::42f] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0759; 6:izs/IUYHh+rT7rdVraL0w5cZSBJVOToDfpbW2V/g5p9fJk8t6gH60MSX9DHOfa94qOKs5HWPTm6GyQzoPYH9ierJ0GF3mobjaLuBWC5GQcAcbmf2nKzDejvnX/WSNAMnNODFPt+vzzXakFWNMxV+L97P7JNDLciYpognmwYziC1SbmRf5HQSgPqtyt7Foj7INsqWsf9pu/8KgIpN0nFHSD5tRzAHnk6sz7UyF7oKrwus0MKcAX2NOkBc4IfvbX0Vuw9O85FAMzY8SN2iy9e0Fd9m0kKLK+7NQhZpRkH+YQaqNjvPQJMfTVuwz5RmCGi5NjPEsHCdwQf+/dY1TtolUbR5/bk+ckBzfPGrjgtuLf8=; 5:jSBl9TPiaGWyeQoTrz+mYmiaFWlxf4o9UM9bmSXjrYTi7a3e3po1OokZv0/n/pqE0KkUIiYnlCdwooINwMyMMZ3kN0NcUgTQp94snutTn0c9O40ID6p17qh8ul3/OdCm1QQqEHbnDXXsx9eai2sBHVWttasgvcRMReFUCj4wsMM=; 24:U9IjB9DjhMSz4Lwo3JxVqIbEJxp1N6yoDpOFxU7HG2nxmtf+OtXabifPv6cdkibxdpRB8yCBALtEm0kt2FFIJxQKF9zXKjq4VrL/+DMqjMc=; 7:mL6QihcjWTrbpkrxGxSAdSj3eWFzIhTC1Lz+kG5bHb3E3B/jIV+J1nkXTeITBsklQijH/33h2Jo+lSIntViBWvX1llmpI3L5fIp24VmEe4EtfqYnem7xHpi8mhA8FdTyTAXg3K5ynG+eFfw+0HH0OSYlTfhGYcYzkuIBmFGaUznfx1yjsS9EuQHSH8/QRnLbbGwR5Zt3GDoSPr12tWqkYRiwHwxLLwnUO2Jvnr1oPsy4/o78+UGD4EG2EJDyeqZq x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 8b31bd39-767c-433e-09d4-08d51a72bdad x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:CY4PR21MB0759; x-ms-traffictypediagnostic: CY4PR21MB0759: x-exchange-antispam-report-test: UriScan:(89211679590171)(120809045254105)(21748063052155)(1591387915157); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(3231020)(3002001)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123558100)(20161123555025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0759; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0759; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(39860400002)(346002)(47760400005)(199003)(189002)(24454002)(69234005)(51914003)(4326008)(53936002)(229853002)(2950100002)(102836003)(6116002)(6506006)(790700001)(2900100001)(74316002)(7736002)(77096006)(50986999)(8936002)(76176999)(54356999)(230783001)(14454004)(8676002)(6436002)(105586002)(81166006)(81156014)(106356001)(25786009)(72206003)(478600001)(68736007)(966005)(53546010)(606006)(10290500003)(3280700002)(5660300001)(110136005)(54906003)(3660700001)(316002)(22452003)(19609705001)(189998001)(2906002)(86362001)(33656002)(6306002)(9686003)(236005)(39060400002)(8990500004)(99286003)(101416001)(6246003)(86612001)(93886005)(7696004)(55016002)(97736004)(10090500001)(54896002)(491001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0759; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05043CD666835BB3470F2AFDF5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8b31bd39-767c-433e-09d4-08d51a72bdad X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 00:04:05.1859 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0759 Archived-At: Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:04:09 -0000 --_000_CY4PR21MB05043CD666835BB3470F2AFDF5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgdXNlZnVsIHJldmlldywgTmF0LiAgUHJvcG9zZWQgcmVzb2x1dGlvbnMg YXJlIGlubGluZSBiZWxvdy4NCg0KRllJLCBBbm5hYmVsbGUgQmFja21hbiBhbmQgSSBzYXQgZG93 biBsYXN0IHdlZWsgZHVyaW5nIHRoZSBJbnRlcm5ldCBJZGVudGl0eSBXb3Jrc2hvcCAoSUlXKSBh bmQgcmVhZCB0aHJvdWdoIGFsbCB0aGUgV0dMQyBjb21tZW50cy4gIFRoZSBzZXJpZXMgb2YgcmVw bGllcyB0byBjb21lIGNvbnRhaW5zIHByb3Bvc2VkIHJlc29sdXRpb25zIHdlIGRpc2N1c3NlZC4N Cg0KRnJvbTogTmF0IFNha2ltdXJhIFttYWlsdG86c2FraW11cmFAZ21haWwuY29tXQ0KU2VudDog V2VkbmVzZGF5LCBBdWd1c3QgMiwgMjAxNyAxMDowNyBBTQ0KVG86IE0uTGl6YXJAT0NHIDxtLmxp emFyQG9wZW5jb25zZW50Z3JvdXAuY29tPjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPg0KQ2M6IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbT47IFNl Y0V2ZW50IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFdHIExh c3QgQ2FsbCBmb3IgZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wMg0KDQpUaGFua3MsIGl0IGxv b2tzIGdlbmVyYWxseSBnb29kLiBJIGhhZCBvbmx5IHRocmVlIHNtYWxsIG5pdHMuDQoNCjEpICJN VVNUIE5PVCIgaW4gdGhlIGludHJvZHVjdGlvbi4NCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KSSBmZWVsIHRoYXQgaXQgaXMgYmV0dGVyIHRvIGhh dmUgdGhpcyBNVVNUIE5PVCBpbiB0aGUgbWFpbiB0ZXh0LiBUaGUgaW50cm9kdWN0aW9uIG9mdGVu IGlzIHNraXBwZWQgYnkgYSByZWFkZXIuDQoNCkFncmVlZDogIFByb3Bvc2UgY2hhbmdpbmcg4oCc TVVTVCBOT1TigJ0gdG8g4oCcY2Fubm904oCdLg0KDQoyKSBQb3RlbnRpYWxseSBtaXNzaW5nICJk ZWZpbmVkIGluICIgaW4gU2VjdGlvbiAyIHRoZSBmaXJzdCBidWxsZXQNCi0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KVGhlcmUgc2VlbXMgdG8gYmUgbWlzc2lu ZyAiZGVmaW5lZCBpbiIgaW4gdGhlIHNlbnRlbmNlICJ0aGUgSldUIFRva2VuIENsYWltcyBSZWdp c3RyeSBTZWN0aW9uIDEwLjEiLg0KDQpJ4oCZbGwgY2hhbmdlIHRoaXMgcmVmZXJlbmNlIHRvIFtJ QU5BLkpXVC5DbGFpbXNdIHdpdGggdGFyZ2V0IGh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1l bnRzL2p3dC9qd3QueGh0bWwjY2xhaW1zLg0KDQozKSBJc3N1ZXIgdmFsaWRhdGlvbg0KLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KSSBhbSBub3Qgc3VyZSBob3cgdG8gZG8gYW4g aXNzdWVyIHZhbGlkYXRpb24gd2hlbiB1c2luZyB1bnNlY3VyZWQgSldULg0KQWRkaW5nIG1vcmUg ZXhwbGFuYXRpb24gd291bGQgYmUgYmVuZWZpY2lhbC4NCg0KSSBwcm9wb3NlIGFkZGluZyB0aGlz IGFkZGl0aW9uYWwgc2VudGVuY2UgdG8gdGhlIHBhcmFncmFwaCB5b3UgcmVmZXJlbmNlZDoNCuKA nExpa2V3aXNlIGlmIHRoZSBwcm9maWxlIGFsbG93cyAob3IgcmVxdWlyZXMpIHRoYXQgdGhlIEpX VCBiZSB1bnNlY3VyZWQsIHRoZSBtZWFucyBieSB3aGljaCB0aGUgaW50ZWdyaXR5IG9mIHRoZSBK V1QgaXMgZW5zdXJlZCBNVVNUIGJlIHNwZWNpZmllZC7igJ0NCg0KQmVzdCwNCg0KTmF0DQoNCiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICBUaGFua3MsDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpPbiBXZWQsIEF1ZyAyLCAyMDE3IGF0IDE6 MTggQU0gTS5MaXphckBPQ0c8bWFpbHRvOk0uTGl6YXJAT0NHPiA8bS5saXphckBvcGVuY29uc2Vu dGdyb3VwLmNvbTxtYWlsdG86bS5saXphckBvcGVuY29uc2VudGdyb3VwLmNvbT4+IHdyb3RlOg0K KzEgb24gZXhpc3RpbmcgdGV4dCAuDQoNCkFncmVlIHRoZSBkb2N1bWVudCBpcyByZWFkeSB0byBw dWJsaXNoDQoNCi0gTWFyaw0KDQpPbiAzMSBKdWwgMjAxNywgYXQgMTY6NTMsIE1pa2UgSm9uZXMg PE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPj4gd3JvdGU6DQoNCkkgYmVsaWV2ZSB0aGF0IHRoZSBzcGVjaWZpY2F0aW9uIGlzIHJl YWR5IHRvIHB1Ymxpc2ggYXMtaXMuICBJdCBhbHJlYWR5IG1lZXRzIHRoZSBuZWVkcyBvZiB0aGUg a25vd24gdXNlIGNhc2VzIGFuZCBpcyBpbiBwcm9kdWN0aW9uIHVzZS4NCg0KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1p a2UNCg0KRnJvbTogSWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBP biBCZWhhbGYgT2YgWWFyb24gU2hlZmZlcg0KU2VudDogTW9uZGF5LCBKdWx5IDMxLCAyMDE3IDE6 NDAgUE0NClRvOiBTZWNFdmVudCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGll dGYub3JnPj4NClN1YmplY3Q6IFtJZC1ldmVudF0gV0cgTGFzdCBDYWxsIGZvciBkcmFmdC1pZXRm LXNlY2V2ZW50LXRva2VuLTAyDQoNClRoaXMgaXMgdG8gYW5ub3VuY2Ugd29ya2luZyBncm91cCBs YXN0IGNhbGwgb24gdGhpcyBkcmFmdCAoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2Mv ZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi8pLg0KDQpQbGVhc2Ugc2VuZCB5b3VyIGNvbW1lbnRz IHRvIHRoZSBsaXN0LiBFdmVuIGlmIHlvdSBhcmUgcGVyZmVjdGx5IGhhcHB5IHdpdGggdGhlIGRy YWZ0LCBwbGVhc2UgbGV0IHVzIGtub3cgdGhhdCB5b3Ugc3VwcG9ydCBpdHMgcHVibGljYXRpb24g YXMtaXMgYnkgcG9zdGluZyB0byB0aGUgbGlzdC4NCg0KQmVjYXVzZSBvZiB0aGUgc3VtbWVyIGhv bGlkYXlzLCB0aGlzIGxhc3QgY2FsbCBpcyBvcGVuIGZvciAzIHdlZWtzLCB1bnRpbCBBdWcuIDIx Lg0KDQpUaGFua3MsDQogICAgRGljayBhbmQgWWFyb24NCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50 QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYu b3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vaWQtZXZlbnQNCi0tDQoNCk5hdCBTYWtpbXVyYQ0KDQpDaGFpcm1hbiBvZiB0 aGUgQm9hcmQsIE9wZW5JRCBGb3VuZGF0aW9uDQo= --_000_CY4PR21MB05043CD666835BB3470F2AFDF5470CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4ubTIz Njc5MDgzMjM0NDU2Njg0OTZhcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6 bV8yMzY3OTA4MzIzNDQ1NjY4NDk2YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxT dHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdp bjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZd LS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+ DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3ht bD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2 bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+VGhhbmtzIGZvciB0aGUgdXNlZnVs IHJldmlldywgTmF0LiZuYnNwOyBQcm9wb3NlZCByZXNvbHV0aW9ucyBhcmUgaW5saW5lIGJlbG93 LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+RllJLCBBbm5hYmVsbGUgQmFj a21hbiBhbmQgSSBzYXQgZG93biBsYXN0IHdlZWsgZHVyaW5nIHRoZSBJbnRlcm5ldCBJZGVudGl0 eSBXb3Jrc2hvcCAoSUlXKSBhbmQgcmVhZCB0aHJvdWdoIGFsbCB0aGUgV0dMQyBjb21tZW50cy4m bmJzcDsgVGhlIHNlcmllcyBvZiByZXBsaWVzIHRvIGNvbWUgY29udGFpbnMgcHJvcG9zZWQgcmVz b2x1dGlvbnMgd2UgZGlzY3Vzc2VkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gTmF0IFNha2ltdXJh IFttYWlsdG86c2FraW11cmFAZ21haWwuY29tXSA8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5 LCBBdWd1c3QgMiwgMjAxNyAxMDowNyBBTTxicj4NCjxiPlRvOjwvYj4gTS5MaXphckBPQ0cgJmx0 O20ubGl6YXJAb3BlbmNvbnNlbnRncm91cC5jb20mZ3Q7OyBNaWtlIEpvbmVzICZsdDtNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBZYXJvbiBTaGVmZmVyICZs dDt5YXJvbmYuaWV0ZkBnbWFpbC5jb20mZ3Q7OyBTZWNFdmVudCAmbHQ7aWQtZXZlbnRAaWV0Zi5v cmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFdHIExhc3QgQ2FsbCBm b3IgZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi0wMjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhhbmtzLCBpdCBsb29rcyBnZW5lcmFsbHkgZ29vZC4gSSBoYWQgb25seSB0aHJlZSBz bWFsbCBuaXRzLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+MSkgJnF1b3Q7TVVTVCBOT1QmcXVvdDsgaW4gdGhlIGludHJvZHVjdGlvbi4mbmJz cDs8L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgZmVlbCB0 aGF0IGl0IGlzIGJldHRlciB0byBoYXZlIHRoaXMgTVVTVCBOT1QgaW4gdGhlIG1haW4gdGV4dC4g VGhlIGludHJvZHVjdGlvbiBvZnRlbiBpcyBza2lwcGVkIGJ5IGEgcmVhZGVyLiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5BZ3JlZWQ6Jm5ic3A7IFBy b3Bvc2UgY2hhbmdpbmcg4oCcTVVTVCBOT1TigJ0gdG8g4oCcY2Fubm904oCdLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAy MDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj4yKSBQb3RlbnRpYWxseSBtaXNzaW5nICZxdW90O2RlZmluZWQgaW4g JnF1b3Q7IGluIFNlY3Rpb24gMiB0aGUgZmlyc3QgYnVsbGV0PC9iPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVyZSBzZWVtcyB0byBiZSBtaXNzaW5nICZxdW90O2RlZmlu ZWQgaW4mcXVvdDsgaW4gdGhlIHNlbnRlbmNlICZxdW90O3RoZSBKV1QgVG9rZW4gQ2xhaW1zIFJl Z2lzdHJ5IFNlY3Rpb24gMTAuMSZxdW90Oy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ SeKAmWxsIGNoYW5nZSB0aGlzIHJlZmVyZW5jZSB0byBbSUFOQS5KV1QuQ2xhaW1zXSB3aXRoIHRh cmdldA0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvand0L2p3dC54 aHRtbCNjbGFpbXMiPmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2p3dC9qd3QueGh0 bWwjY2xhaW1zPC9hPi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjMpIElzc3VlciB2YWxpZGF0aW9uPC9iPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SSBhbSBub3Qgc3VyZSBob3cgdG8gZG8gYW4gaXNzdWVyIHZhbGlkYXRp b24gd2hlbiB1c2luZyB1bnNlY3VyZWQgSldULiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QWRkaW5nIG1vcmUgZXhwbGFuYXRpb24gd291 bGQgYmUgYmVuZWZpY2lhbC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzAwMjA2MCI+SSBwcm9wb3NlIGFkZGluZyB0aGlzIGFkZGl0aW9uYWwgc2VudGVuY2UgdG8g dGhlIHBhcmFncmFwaCB5b3UgcmVmZXJlbmNlZDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+4oCcTGlrZXdpc2Ug aWYgdGhlIHByb2ZpbGUgYWxsb3dzIChvciByZXF1aXJlcykgdGhhdCB0aGUgSldUIGJlIHVuc2Vj dXJlZCwgdGhlIG1lYW5zIGJ5IHdoaWNoIHRoZSBpbnRlZ3JpdHkgb2YgdGhlIEpXVCBpcyBlbnN1 cmVkIE1VU1QgYmUgc3BlY2lmaWVkLuKAnQ0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJlc3Qs Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPk5hdDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRoYW5rcyw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBXZWQsIEF1ZyAyLCAyMDE3IGF0IDE6MTggQU0gPGEgaHJlZj0ibWFpbHRv Ok0uTGl6YXJAT0NHIj4NCk0uTGl6YXJAT0NHPC9hPiAmbHQ7PGEgaHJlZj0ibWFpbHRvOm0ubGl6 YXJAb3BlbmNvbnNlbnRncm91cC5jb20iPm0ubGl6YXJAb3BlbmNvbnNlbnRncm91cC5jb208L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mIzQzOzEgb24gZXhpc3RpbmcgdGV4dCAuJm5ic3A7PG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BZ3JlZSB0aGUgZG9jdW1l bnQgaXMgcmVhZHkgdG8gcHVibGlzaDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4tIE1hcms8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gMzEgSnVsIDIwMTcsIGF0IDE2OjUz LCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5J IGJlbGlldmUgdGhhdCB0aGUgc3BlY2lmaWNhdGlvbiBpcyByZWFkeSB0byBwdWJsaXNoIGFzLWlz LiZuYnNwOyBJdCBhbHJlYWR5IG1lZXRzIHRoZSBuZWVkcyBvZiB0aGUga25vd24gdXNlIGNhc2Vz IGFuZCBpcyBpbiBwcm9kdWN0aW9uIHVzZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGI+RnJvbTo8L2I+PHNwYW4gY2xhc3M9Im0yMzY3 OTA4MzIzNDQ1NjY4NDk2YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+SWQtZXZl bnQgWzxhIGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+XTxzcGFuIGNsYXNzPSJt MjM2NzkwODMyMzQ0NTY2ODQ5NmFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxi Pk9uDQogQmVoYWxmIE9mPHNwYW4gY2xhc3M9Im0yMzY3OTA4MzIzNDQ1NjY4NDk2YXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPllhcm9uIFNoZWZmZXI8YnI+DQo8Yj5TZW50 OjwvYj48c3BhbiBjbGFzcz0ibTIzNjc5MDgzMjM0NDU2Njg0OTZhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj5Nb25kYXksIEp1bHkgMzEsIDIwMTcgMTo0MCBQTTxicj4NCjxiPlRv OjwvYj48c3BhbiBjbGFzcz0ibTIzNjc5MDgzMjM0NDU2Njg0OTZhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj5TZWNFdmVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxi PlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJtMjM2NzkwODMyMzQ0NTY2ODQ5NmFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPltJZC1ldmVudF0gV0cgTGFzdCBDYWxsIGZvciBkcmFm dC1pZXRmLXNlY2V2ZW50LXRva2VuLTAyPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJv dHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+VGhpcyBp cyB0byBhbm5vdW5jZSB3b3JraW5nIGdyb3VwIGxhc3QgY2FsbCBvbiB0aGlzIGRyYWZ0ICg8YSBo cmVmPSJodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLXNlY2V2ZW50 LXRva2VuLyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBz Oi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4vPC9z cGFuPjwvYT4pLjxicj4NCjxicj4NClBsZWFzZSBzZW5kIHlvdXIgY29tbWVudHMgdG8gdGhlIGxp c3QuIEV2ZW4gaWYgeW91IGFyZSBwZXJmZWN0bHkgaGFwcHkgd2l0aCB0aGUgZHJhZnQsIHBsZWFz ZSBsZXQgdXMga25vdyB0aGF0IHlvdSBzdXBwb3J0IGl0cyBwdWJsaWNhdGlvbiBhcy1pcyBieSBw b3N0aW5nIHRvIHRoZSBsaXN0Ljxicj4NCjxicj4NCkJlY2F1c2Ugb2YgdGhlIHN1bW1lciBob2xp ZGF5cywgdGhpcyBsYXN0IGNhbGwgaXMgb3BlbiBmb3IgMyB3ZWVrcywgdW50aWwgQXVnLiAyMS48 YnI+DQo8YnI+DQpUaGFua3MsPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7IERpY2sgYW5kIFlhcm9u PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmO2JhY2tncm91bmQ6d2hpdGUiPl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4N CjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5JZC1ldmVudCBtYWlsaW5nIGxpc3Q8L3Nw YW4+PGJyPg0KPHNwYW4gc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxhIGhyZWY9Im1haWx0bzpJ ZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjwv c3Bhbj48YnI+DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PC9zcGFu Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJl Zj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0 Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9pZC1ldmVudCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwPk5hdCBTYWtpbXVyYTxvOnA+PC9vOnA+PC9wPg0KPHA+Q2hhaXJtYW4g b2YgdGhlIEJvYXJkLCBPcGVuSUQgRm91bmRhdGlvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB05043CD666835BB3470F2AFDF5470CY4PR21MB0504namp_-- From nobody Mon Oct 23 17:04:47 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EFAC13ADD2 for ; Mon, 23 Oct 2017 17:04:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.009 X-Spam-Level: X-Spam-Status: No, score=-3.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c5O7ipm2xO8V for ; Mon, 23 Oct 2017 17:04:42 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0121.outbound.protection.outlook.com [104.47.41.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFA9513A5BC for ; Mon, 23 Oct 2017 17:04:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=5ruBRXNqCRhJ8hnBfRj5aNndFUCXAT11OdIz5amoM1o=; b=SEJJtSJtTU9oDkZv88PztaJRtfAKJNKOsdWRumtxGi555jRrNXJSilc1hzg6MXG9TEbSipfdhih65mKy7hkXufMGG5MGSOR6Z0rBDlnUiH52d5mvLICLUZITzi17PpM/QsE4OvTUVQ22o3iy7OEGM7qiDFAefKBR2tTzUnq2UTY= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0759.namprd21.prod.outlook.com (10.173.192.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Tue, 24 Oct 2017 00:04:40 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 00:04:40 +0000 From: Mike Jones To: "Richard Backman, Annabelle" , "M.Lizar@OCG" CC: Yaron Sheffer , SecEvent Thread-Topic: [Id-event] WG Last Call for draft-ietf-secevent-token-02 Thread-Index: AQHTCj09LrxBWiFA7kmsguwQioPAmaJuaWjQgAFFhACAAbsQgICBJ7wQ Date: Tue, 24 Oct 2017 00:04:39 +0000 Message-ID: References: <72B8E7CA-3EB6-4194-BB77-CD46062FDFB7@amazon.com> In-Reply-To: <72B8E7CA-3EB6-4194-BB77-CD46062FDFB7@amazon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-23T17:04:38.7846163-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:5::42f] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0759; 6:RQl5ca1+xeN1haMzhaMvlabxLqAtDi7J03MWB1GwDI3FESE9PM/031JxZ+1NxLkp4K+0VOFRXutS7QXk0NJ1C+/J4OOWxm7m/tJyIDJpmeqeQnaPXl2pdQwWpwMHeSY6ARwT5qH5k4pdmhNP9R/UN4m/WNDbCqSamFMXkWwm3QvdDMhZrKYYUT8VxSyvj/deP5WnHa5uIfhP9woMHmrznUabzSd2ZMt6/lO63gU9taGg3Ob60FGUnCOCNqO6wde1Qv2mIayTmuj5R67oY0PjzeAYZt1ry+UbVHNkVsejX8Sr5KTW8XYZ5efTTsu+y3NnSFYqUNWrgDwBmBPzyOKNWHhKGoAIU9d/4C+4eF6AVBo=; 5:xwCj2hZxWnfb2mKyap2TTnLq7IJDobS/kwiCVnhWoW4spD1KRBhNJAy0ZB0c5jIpNDZdQHO4A2ElX2HF/K850C7lKOTHAh5IYVkBPatzkhBrTbYEchq0NNbGw1cg5cDKXgO2VQ1XTwiACLppN7KOxq7FXmN7HTeO970VY8GiYeU=; 24:XY835bEpMgNdLu9LcADbivQGH7+1ipuuMcNVjvv86mf3kK3U9eLVYxjhV8UfczDMKPXlfjtMTKiDl+63FpPJJRZE3q+GxPYAlXqji2lTr9w=; 7:N82LMhxMuKiBWqMNTj1IJScTx0jWby6F5sCNvCWp/c8heZ5RC4Qn9EB5tQJlI530Y+hxqoYK+OGJ8D06uziPTBqvBQVm6QO40jquvxlFaDG+O4K9S7CXN2Yg/SLLLLigqoz+NMboUxKv/FStFWMb47wc23GwiF/zZyHCW3CDAcj6HJRiAS1s3a/ER7nxc96KBMHyuP8+ptyJLjTDGbBm0mBGUxqC+/CbqSYaetg94IfNH6C1+ZOyvpRM4/ILPs/S x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 12109166-aeb7-4b41-9adb-08d51a72d26c x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:CY4PR21MB0759; x-ms-traffictypediagnostic: CY4PR21MB0759: x-exchange-antispam-report-test: UriScan:(89211679590171)(120809045254105)(192374486261705)(21748063052155)(47284530071512); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(3231020)(3002001)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123558100)(20161123555025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0759; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0759; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(47760400005)(51914003)(43784003)(199003)(189002)(24454002)(69224002)(22452003)(189998001)(2906002)(54906003)(110136005)(316002)(3660700001)(6246003)(93886005)(86612001)(8990500004)(99286003)(101416001)(39060400002)(10090500001)(55016002)(97736004)(54896002)(7696004)(86362001)(33656002)(6306002)(236005)(9686003)(76176999)(8936002)(54356999)(50986999)(8676002)(230783001)(14454004)(2950100002)(790700001)(2900100001)(6506006)(102836003)(6116002)(53936002)(4326008)(229853002)(77096006)(74316002)(7736002)(478600001)(72206003)(966005)(68736007)(25786009)(3280700002)(5660300001)(10290500003)(53546010)(606006)(81166006)(105586002)(81156014)(6436002)(106356001)(491001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0759; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504E0464CA7C7A3C5267792F5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 12109166-aeb7-4b41-9adb-08d51a72d26c X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 00:04:40.0368 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0759 Archived-At: Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:04:45 -0000 --_000_CY4PR21MB0504E0464CA7C7A3C5267792F5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgZGV0YWlsZWQgcmV2aWV3LCBBbm5hYmVsbGUsIGFuZCBmb3Igc2l0dGlu ZyBkb3duIHdpdGggbWUgaW4gcGVyc29uIGxhc3Qgd2VlayB0byBnbyBvdmVyIGl0LiAgUHJvcG9z ZWQgcmVzb2x1dGlvbnMgZm9sbG93IGluLWxpbmUuDQoNCkZyb206IFJpY2hhcmQgQmFja21hbiwg QW5uYWJlbGxlIFttYWlsdG86cmljaGFubmFAYW1hem9uLmNvbV0NClNlbnQ6IFdlZG5lc2RheSwg QXVndXN0IDIsIDIwMTcgMTE6NDMgQU0NClRvOiBNLkxpemFyQE9DRyA8bS5saXphckBvcGVuY29u c2VudGdyb3VwLmNvbT47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4N CkNjOiBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb20+OyBTZWNFdmVudCA8aWQt ZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBXRyBMYXN0IENhbGwgZm9y IGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMDINCg0KVGhhbmtzIGZvciBhbGwgdGhlIHdvcmsg b24gdGhpcyEgSXQgd2FzIG15IHVuZGVyc3RhbmRpbmcgdGhhdCB0aGVyZSB3YXMgYW4gb3BlbiBp dGVtIGZyb20gUHJhZ3VlIHJlZ2FyZGluZyB3aGV0aGVyIHRvIGV4cGxpY2l0bHkgZGVjbGFyZSB0 aGUgZXZlbnRz4oCZIHByb2ZpbGluZyBzcGVjaWZpY2F0aW9uIGluIHRoZSBTRVQuIEhhcyB0aGlz IGJlZW4gZGlzY3Vzc2VkIGZ1cnRoZXIsIG9yIGRvIHdlIHN0aWxsIG5lZWQgdG8gY2xvc2Ugb24g aXQ/DQoNCkkgaGF2ZSBzZXZlcmFsIGNvbW1lbnRzL3F1ZXN0aW9ucyBvbiB0aGUgY3VycmVudCBk cmFmdDoNCg0KDQogIDEuICDigJxQcm9maWxlIFNwZWNpZmljYXRpb27igJ0gdnMuIOKAnFByb2Zp bGluZyBTcGVjaWZpY2F0aW9u4oCdDQpUaGVyZSBhcmUgYSBoYW5kZnVsIG9mIGluc3RhbmNlcyBv ZiB0aGUgZm9ybWVyIHRoYXQgbmVlZCB0byBiZSBjaGFuZ2VkIHRvIHRoZSBsYXR0ZXIsIHRvIG1h dGNoIHRoZSB0ZXJtIGFzIGRlZmluZWQgaW4gc2VjdGlvbiAxLjI6DQogICAgICogICBJbiB0aGUg 4oCcc3Vi4oCdIGRlZmluaXRpb24gaW4gc2VjdGlvbiAxLjINCiAgICAgKiAgIEluIHNlY3Rpb24g Mw0KICAgICAqICAgSW4gc2VjdGlvbiA0LjINCg0KSSB0aGluayB3ZSBzaG91bGQgdW5pZm9ybWx5 IGdvIHdpdGggdGhlIHRlcm0g4oCcUHJvZmlsaW5nIFNwZWNpZmljYXRpb27igJ0sIGFzIHlvdSBz dWdnZXN0Lg0KDQoNCiAgMS4gIE5vdGUgcmVnYXJkaW5nIFN1YmplY3QgSXNzdWVyIHZzLiBTRVQg SXNzdWVyDQpUaGUgbm90ZSByZWdhcmRpbmcgdGhlIHBvdGVudGlhbCBmb3IgU3ViamVjdCBhbmQg U0VUIElzc3VlciBtaXNtYXRjaCAoaW4gdGhlIOKAnGlzc+KAnSBkZWZpbml0aW9uIGluIHNlY3Rp b24gMS4yKSBpcyBJIHRoaW5rIG1vcmUgcHJlc2NyaXB0aXZlIHRoYW4gaW50ZW5kZWQuIEFzIHdy aXR0ZW4sIGl0IG1hbmRhdGVzIHBsYWNpbmcgdGhlIFN1YmplY3TigJlzIElzc3VlciBpbiBhbiDi gJxpc3PigJ0gdmFsdWUgd2l0aGluIHRoZSBldmVudCBwYXlsb2FkLCBidXQgZG9lcyBub3QgZGVm aW5lIGEgZm9ybWF0IG9yIHN0cnVjdHVyZSBmb3IgdGhpcyB2YWx1ZS4gVGhlIGxvZ2ljYWwgZm9y bWF0IOKAkyB0aGF0IG9mIHRoZSDigJxpc3PigJ0gSldUIGNsYWltIOKAkyBtYXkgb3IgbWF5IG5v dCBiZSBhcHByb3ByaWF0ZSwgZGVwZW5kaW5nIG9uIHRoZSBuYXR1cmUgb2YgdGhlIGV2ZW50IGFu ZCBpdHMgU3ViamVjdC4gSSBzdWdnZXN0IHJlbW92aW5nIHRoaXMgbm90ZSBhbmQgY292ZXJpbmcg dGhpcyBjb25jZXJuIGVsc2V3aGVyZSAoc2VlICM0IGJlbG93LCByZTogU3ViamVjdCBJZGVudGlm aWNhdGlvbikuDQooWW91IHdlcmUgYWN0dWFsbHkgcmVmZXJyaW5nIHRvIFNlY3Rpb24gMi4xLikg IEFzIHdlIGRpc2N1c3NlZCwgaWYgdGhlIGxvZ2ljYWwgaXNzdWVyIGZvciB0aGUgU0VUIGRvZXNu 4oCZdCBmaXQgdGhlIEpXVCDigJxpc3PigJ0gc3RyaW5nIHN5bnRheCwgaXTigJlzIHBlcmZlY3Rs eSByZWFzb25hYmxlIHRvIGRlZmluZSBhIGRpZmZlcmVudCBjbGFpbSBhbmQgaXRzIHN5bnRheCB0 aGF0IG1lZXRzIHRoZSBhcHBsaWNhdGlvbuKAmXMgbmVlZHMuICBUaGUg4oCcTm90ZeKAnSBwYXJ0 IGFsc28gZG9lc27igJl0IGRpY3RhdGUgdGhhdCB0aGUg4oCcc3Vi4oCdIGNsYWltIG5hbWUgYmUg dXNlZC4gIFdlIGNvdWxkIGFkZCB0aGUgcGFyZW50aGV0aWNhbCByZW1hcmsg4oCcKGVpdGhlciB1 c2luZyB0aGUg4oCcaXNz4oCdIG1lbWJlciBuYW1lIG9yIGFub3RoZXIgbmFtZSnigJ0gYmVmb3Jl IHRoZSBmaXJzdCBjb21tYSBpbiB0aGUgbm90ZSwgdG8gbWFrZSB0aGlzIHBvaW50IGNsZWFyLCBp ZiB5b3UgdGhpbmsgdGhhdCB3b3VsZCBhZGRyZXNzIHlvdXIgY29uY2Vybi4NCg0KICAxLiAgRXhw bGljaXQgVHlwaW5nIG9mIFNFVHMNCkkgc3VnZ2VzdCByZW1vdmluZyB0aGUgdGV4dCDigJxpZiB0 aGUgU0VUIGNvdWxkIGJlIHVzZWQgaW4gYW4gYXBwbGljYXRpb24gY29udGV4dCBpbiB3aGljaCBp dCBjb3VsZCBiZSBjb25mdXNlZCB3aXRoIG90aGVyIGtpbmRzIG9mIEpXVHPigJ0gZnJvbSB0aGUg Zmlyc3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gMi4yLCBtYWtpbmcgdGhlIHNlY2V2ZW50K2p3dCB0 eXAgaGVhZGVyIG1hbmRhdG9yeSB0byBpbXBsZW1lbnQgZm9yIGFsbCBTRVRzLiBUaGlzIGNvbmRp dGlvbmFsIGlzIGltcG9zc2libGUgdG8gZXZhbHVhdGUsIGFzIG5ldyB0eXBlcyBvZiBKV1RzIHdp bGwgYmUgaW50cm9kdWNlZCBvdmVyIHRpbWUuIEp1c3QgY29uc2lkZXJpbmcgZXhpc3RpbmcgSldU cywgaXQgaXMgYSBsb3QgdG8gYXNrIGZvciBQcm9maWxpbmcgU3BlYyBhdXRob3JzIHRvIGZ1bGx5 IGV4YW1pbmUgdGhlIGNvbnRlbnRzIGFuZCB1c2FnZSBvZiBldmVyeSBleGlzdGluZyBKV1QuIE1h bmRhdGluZyB1c2Ugb2YgdHlwIGZvciBTRVRzIHRha2VzIHRoaXMgbG9hZCBvZmYgb2YgUHJvZmls aW5nIFNwZWMgYXV0aG9ycyBhbmQgaW5zdXJlcyB0aGF0IGZ1dHVyZSBzcGVjcyBoYXZlIGEgY29u c2lzdGVudCwgcmVsaWFibGUgd2F5IHRvIGRlZmVuZCBhZ2FpbnN0IEpXVCB0eXBlIGNvbmZ1c2lv bi4NCkFzIHdlIGRpc2N1c3NlZCwgSeKAmW0gcmVsdWN0YW50IHRvIHJlbW92ZSB0aGUgY2xhdXNl IGJlY2F1c2UgdGhlcmUgaXMgYWxyZWFkeSB0aGlzIHN0cm9uZyBsYW5ndWFnZSBhdCB0aGUgZW5k IG9mIHRoZSBwYXJhZ3JhcGg6IOKAnFRoaXMgTVVTVCBiZSBpbmNsdWRlZCBpZiB0aGUgU0VUIGNv dWxkIGJlIHVzZWQgaW4gYW4gYXBwbGljYXRpb24gY29udGV4dCBpbiB3aGljaCBpdCBjb3VsZCBi ZSBjb25mdXNlZCB3aXRoIG90aGVyIGtpbmRzIG9mIEpXVHMu4oCdICBTbyB0aGUgZGVmYXVsdCBi ZWhhdmlvciBpcyBhbHJlYWR5IHRoZSBvbmUgeW91IHdhbnQuDQoNCiAgMS4gIFJlcXVpcmVtZW50 cyBmb3IgU0VUIFByb2ZpbGVzOiBTdWJqZWN0IElkZW50aWZpY2F0aW9uDQpJIHN1Z2dlc3QgYWRk aW5nIHRleHQgYWxvbmcgdGhlIGxpbmVzIG9mIOKAnFByb2ZpbGluZyBTcGVjaWZpY2F0aW9ucyBN VVNUIGRlZmluZSBmb3IgZWFjaCBvZiB0aGVpciBldmVudHMgaG93IHRoZSBTdWJqZWN0IGlzIGlk ZW50aWZpZWQgaW4gdGhlIFNFVCwgYXMgd2VsbCBhcyBob3cgdG8gYWRkcmVzcyBjb25mbGljdHMg dGhlIGV2ZW50IFN1YmplY3TigJlzIElzc3VlciBhbmQgdGhlIFNFVCBJc3N1ZXIgaWYgYXBwbGlj YWJsZS4gSXQgaXMgTk9UIFJFQ09NTUVOREVEIGZvciBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbnMg dG8gdXNlIHRoZSDigJxzdWLigJ0gY2xhaW0gaW4gY2FzZXMgd2hlcmUgdGhlIFN1YmplY3QgaXMg bm90IGdsb2JhbGx5IHVuaXF1ZSBhbmQgaGFzIGEgZGlmZmVyZW50IElzc3VlciBmcm9tIHRoZSBT RVQgaXRzZWxmLuKAnQ0KSeKAmW0gT0sgYWRkaW5nIHNvbWV0aGluZyBhbG9uZyB0aG9zZSBsaW5l cy4NCg0KICAxLiAgR3VpZGFuY2UgZm9yIFNpZ25pbmcgU0VUcw0KVGhlIHRleHQgaW4gdGhlIGxh c3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gNC4xIGlzIHVuY2xlYXIgdG8gbWUuIEl0IHNlZW1zIHRv IHN1Z2dlc3QgdGhhdCBpdCBpcyBzYWZlIHRvIHNlbmQgdW5zaWduZWQgSldUcyBvdmVyIGEgY2hh bm5lbCB0aGF0IGxhY2tzIHRyYW5zcG9ydC1sYXllciBzZWN1cml0eSwgc28gbG9uZyBhcyByZXF1 ZXN0cyBpbmNsdWRlIGEgYmVhcmVyIHRva2VuIG9yIHVzZSBCYXNpYyBBdXRoZW50aWNhdGlvbi4g QW0gSSBtaXNyZWFkaW5nIHRoaXM/IEl0IHNlZW1zIGNvdW50ZXIgdG8gdGhlIGd1aWRhbmNlIGdp dmVuIGVhcmxpZXIgaW4gdGhlIHNhbWUgc2VjdGlvbi4NCkdvb2QgY2F0Y2guICBJbiBmYWN0IHRo ZSBwbGFpbiByZWFkaW5nIG9mIHRoZSBmaXJzdCBoYWxmIG9mIHRoZSBzZW50ZW5jZSBpcyBzZWxm LWNvbnRyYWRpY3RvcnkuICBBcyB3ZSBkaXNjdXNzZWQsIGxldOKAmXMgc2ltcGxpZnkgdGhpcyB0 byDigJxVbmxlc3MgaW50ZWdyaXR5IG9mIHRoZSBKV1QgaXMgZW5zdXJlZCBieSBvdGhlciBtZWFu cywgaXQgTVVTVCBiZSBzaWduZWQgdXNpbmcgSldT4oCm4oCdDQoNCiAgMS4gIERpc3Rpbmd1aXNo aW5nIFNFVHMgZnJvbSBvdGhlciBraW5kcyBvZiBKV1RzDQpUaGUgbGFzdCBzZW50ZW5jZSBvZiB0 aGUgZmlyc3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gNC43IHNlZW1zIGltcG9zc2libGUgdG8gbWUu IFByb2ZpbGluZyBTcGVjaWZpY2F0aW9ucyBjYW5ub3QgYmUgc29sZWx5IHJlc3BvbnNpYmxlIGZv ciBlbnN1cmluZyBpbmNvbXBhdGliaWxpdHkgd2l0aCBhbGwgZnV0dXJlIEpXVCBwcm9maWxlcy4g VGhleSBjYW4gYXQgYmVzdCBlbnN1cmUgaW5jb21wYXRpYmlsaXR5IHdpdGggZXhpc3RpbmcgSldU IHByb2ZpbGVzIGFuZCBiZSBjb21wYXRpYmxlIHdpdGggYSBzdGFuZGFyZCBtZWNoYW5pc20gYnkg d2hpY2ggZnV0dXJlIEpXVCBwcm9maWxlcyBtYXkgZW5zdXJlIGluY29tcGF0aWJpbGl0eSAoZS5n LiB0aGUg4oCcc2VjZXZlbnQrand04oCdIHR5cCBoZWFkZXIpLiBJdCBtYXkgYmUgZW5vdWdoIHRv IHN0cmlrZSB0aGUg4oCcKG9yIG90aGVyKeKAnSB0ZXh0IGZyb20gdGhpcyBzZW50ZW5jZS4NClRo ZSBzZWNvbmQgcGFyYWdyYXBoIChiZWdpbm5pbmcg4oCcVGhlIG1vc3QgZGlyZWN0IHdheeKAnSkg d2FzIHdyaXR0ZW4gYmVmb3JlIHdlIGhhZCBleHBsaWNpdCB0eXBpbmcuICBBcyB3ZSBkaXNjdXNz ZWQsIEkgcHJvcG9zZSB0byByZW9yZGVyIHBhcmFncmFwaHMgMiBhbmQgMywgY2hhbmdpbmcgZXhw bGljaXQgdHlwaW5nIHRvIGJlIOKAnFRoZSBtb3N0IGRpcmVjdCB3YXnigJ0gYW5kIG11dHVhbGx5 IGV4Y2x1c2l2ZSB2YWxpZGF0aW9uIGxvZ2ljIHRvIGJlIOKAnEFub3RoZXIgd2F54oCdLiAgVGhh dCBwdXRzIHRoZSBlbXBoYXNpcyB3aGVyZSBpdCBzaG91bGQgYmUsIGF0IHRoaXMganVuY3R1cmUg aW4gdGhlIGRldmVsb3BtZW50IG9mIHRoZSBzcGVjaWZpY2F0aW9uLg0KDQotLQ0KQW5uYWJlbGxl IFJpY2hhcmQgQmFja21hbg0KSWRlbnRpdHkgU2VydmljZXMNCg0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYW5rcyBhZ2Fp biENCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAtLSBNaWtlDQoNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJvdW5jZXNA aWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2Yg Ik0uTGl6YXJAT0NHPG1haWx0bzpNLkxpemFyQE9DRz4iIDxtLmxpemFyQG9wZW5jb25zZW50Z3Jv dXAuY29tPG1haWx0bzptLmxpemFyQG9wZW5jb25zZW50Z3JvdXAuY29tPj4NCkRhdGU6IFR1ZXNk YXksIEF1Z3VzdCAxLCAyMDE3IGF0IDk6MTcgQU0NClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpD YzogWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0 ZkBnbWFpbC5jb20+PiwgU2VjRXZlbnQgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVu dEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBXRyBMYXN0IENhbGwgZm9yIGRy YWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMDINCg0KKzEgb24gZXhpc3RpbmcgdGV4dCAuDQoNCkFn cmVlIHRoZSBkb2N1bWVudCBpcyByZWFkeSB0byBwdWJsaXNoDQoNCi0gTWFyaw0KDQpPbiAzMSBK dWwgMjAxNywgYXQgMTY6NTMsIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6DQoNCkkgYmVsaWV2 ZSB0aGF0IHRoZSBzcGVjaWZpY2F0aW9uIGlzIHJlYWR5IHRvIHB1Ymxpc2ggYXMtaXMuICBJdCBh bHJlYWR5IG1lZXRzIHRoZSBuZWVkcyBvZiB0aGUga25vd24gdXNlIGNhc2VzIGFuZCBpcyBpbiBw cm9kdWN0aW9uIHVzZS4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogSWQtZXZlbnQgW21haWx0 bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgWWFyb24gU2hlZmZlcg0K U2VudDogTW9uZGF5LCBKdWx5IDMxLCAyMDE3IDE6NDAgUE0NClRvOiBTZWNFdmVudCA8aWQtZXZl bnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFtJZC1ldmVu dF0gV0cgTGFzdCBDYWxsIGZvciBkcmFmdC1pZXRmLXNlY2V2ZW50LXRva2VuLTAyDQoNClRoaXMg aXMgdG8gYW5ub3VuY2Ugd29ya2luZyBncm91cCBsYXN0IGNhbGwgb24gdGhpcyBkcmFmdCAoaHR0 cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi8p Lg0KDQpQbGVhc2Ugc2VuZCB5b3VyIGNvbW1lbnRzIHRvIHRoZSBsaXN0LiBFdmVuIGlmIHlvdSBh cmUgcGVyZmVjdGx5IGhhcHB5IHdpdGggdGhlIGRyYWZ0LCBwbGVhc2UgbGV0IHVzIGtub3cgdGhh dCB5b3Ugc3VwcG9ydCBpdHMgcHVibGljYXRpb24gYXMtaXMgYnkgcG9zdGluZyB0byB0aGUgbGlz dC4NCg0KQmVjYXVzZSBvZiB0aGUgc3VtbWVyIGhvbGlkYXlzLCB0aGlzIGxhc3QgY2FsbCBpcyBv cGVuIGZvciAzIHdlZWtzLCB1bnRpbCBBdWcuIDIxLg0KDQpUaGFua3MsDQogICAgRGljayBhbmQg WWFyb24NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQN Cg0K --_000_CY4PR21MB0504E0464CA7C7A3C5267792F5470CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xp c3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJ e21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFs MA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJn aW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFt ZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjoj MDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEu MGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24x DQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGww DQoJe21zby1saXN0LWlkOjEzNzQ2MDM0MzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTM2ODU5 NzA0O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLXRhYi1z dG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDoyLjBpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30N CkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDps ZXZlbDYNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21z by1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtdGFi LXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjQuNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6NjE2MjU3NTY1Ow0KCW1zby1saXN0LXR5cGU6aHli cmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMjA4NTI5NzYyIDY3Njk4NzAzIDY3Njk4NzEz IDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3 Njk4NzE1O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBs aXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlz dCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9t YW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJ e21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7 DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJ e21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+ PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4 dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBs YW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIw NjAiPlRoYW5rcyBmb3IgdGhlIGRldGFpbGVkIHJldmlldywgQW5uYWJlbGxlLCBhbmQgZm9yIHNp dHRpbmcgZG93biB3aXRoIG1lIGluIHBlcnNvbiBsYXN0IHdlZWsgdG8gZ28gb3ZlciBpdC4mbmJz cDsgUHJvcG9zZWQgcmVzb2x1dGlvbnMgZm9sbG93IGluLWxpbmUuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gUmljaGFyZCBCYWNrbWFuLCBB bm5hYmVsbGUgW21haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tXQ0KPGJyPg0KPGI+U2VudDo8L2I+ IFdlZG5lc2RheSwgQXVndXN0IDIsIDIwMTcgMTE6NDMgQU08YnI+DQo8Yj5Ubzo8L2I+IE0uTGl6 YXJAT0NHICZsdDttLmxpemFyQG9wZW5jb25zZW50Z3JvdXAuY29tJmd0OzsgTWlrZSBKb25lcyAm bHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gWWFyb24g U2hlZmZlciAmbHQ7eWFyb25mLmlldGZAZ21haWwuY29tJmd0OzsgU2VjRXZlbnQgJmx0O2lkLWV2 ZW50QGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBXRyBM YXN0IENhbGwgZm9yIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4tMDI8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoYW5rcyBmb3IgYWxsIHRoZSB3b3JrIG9uIHRoaXMh IEl0IHdhcyBteSB1bmRlcnN0YW5kaW5nIHRoYXQgdGhlcmUgd2FzIGFuIG9wZW4gaXRlbSBmcm9t IFByYWd1ZSByZWdhcmRpbmcgd2hldGhlciB0byBleHBsaWNpdGx5IGRlY2xhcmUgdGhlIGV2ZW50 c+KAmSBwcm9maWxpbmcgc3BlY2lmaWNhdGlvbiBpbiB0aGUgU0VULiBIYXMgdGhpcyBiZWVuIGRp c2N1c3NlZCBmdXJ0aGVyLCBvciBkbyB3ZSBzdGlsbCBuZWVkDQogdG8gY2xvc2Ugb24gaXQ/PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZSBzZXZlcmFsIGNvbW1lbnRzL3F1ZXN0aW9ucyBv biB0aGUgY3VycmVudCBkcmFmdDo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9 IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbGlzdDpsMSBs ZXZlbDEgbGZvMyI+PGI+4oCcUHJvZmlsZSBTcGVjaWZpY2F0aW9u4oCdIHZzLiDigJxQcm9maWxp bmcgU3BlY2lmaWNhdGlvbuKAnTwvYj48YnI+DQpUaGVyZSBhcmUgYSBoYW5kZnVsIG9mIGluc3Rh bmNlcyBvZiB0aGUgZm9ybWVyIHRoYXQgbmVlZCB0byBiZSBjaGFuZ2VkIHRvIHRoZSBsYXR0ZXIs IHRvIG1hdGNoIHRoZSB0ZXJtIGFzIGRlZmluZWQgaW4gc2VjdGlvbiAxLjI6DQo8bzpwPjwvbzpw Pg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9IjEiIHR5cGU9ImEiPg0KPGxpIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbGlzdDpsMSBsZXZlbDIgbGZvMyI+SW4gdGhlIOKA nHN1YuKAnSBkZWZpbml0aW9uIGluIHNlY3Rpb24gMS4yPG86cD48L286cD48L2xpPjxsaSBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLWxpc3Q6bDEgbGV2ZWwyIGxmbzMiPkluIHNlY3Rpb24g MzxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1saXN0Omwx IGxldmVsMiBsZm8zIj5JbiBzZWN0aW9uIDQuMjxvOnA+PC9vOnA+PC9saT48L29sPg0KPC9saT48 L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj5JIHRoaW5rIHdlIHNob3VsZCB1bmlmb3JtbHkgZ28gd2l0aCB0 aGUgdGVybSDigJxQcm9maWxpbmcgU3BlY2lmaWNhdGlvbuKAnSwgYXMgeW91IHN1Z2dlc3QuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxvbCBzdHlsZT0ibWFy Z2luLXRvcDowaW4iIHN0YXJ0PSIyIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPjxiPk5v dGUgcmVnYXJkaW5nIFN1YmplY3QgSXNzdWVyIHZzLiBTRVQgSXNzdWVyPC9iPjxicj4NClRoZSBu b3RlIHJlZ2FyZGluZyB0aGUgcG90ZW50aWFsIGZvciBTdWJqZWN0IGFuZCBTRVQgSXNzdWVyIG1p c21hdGNoIChpbiB0aGUg4oCcaXNz4oCdIGRlZmluaXRpb24gaW4gc2VjdGlvbiAxLjIpIGlzIEkg dGhpbmsgbW9yZSBwcmVzY3JpcHRpdmUgdGhhbiBpbnRlbmRlZC4gQXMgd3JpdHRlbiwgaXQgbWFu ZGF0ZXMgcGxhY2luZyB0aGUgU3ViamVjdOKAmXMgSXNzdWVyIGluIGFuIOKAnGlzc+KAnSB2YWx1 ZSB3aXRoaW4gdGhlIGV2ZW50IHBheWxvYWQsIGJ1dCBkb2VzDQogbm90IGRlZmluZSBhIGZvcm1h dCBvciBzdHJ1Y3R1cmUgZm9yIHRoaXMgdmFsdWUuIFRoZSBsb2dpY2FsIGZvcm1hdCDigJMgdGhh dCBvZiB0aGUg4oCcaXNz4oCdIEpXVCBjbGFpbSDigJMgbWF5IG9yIG1heSBub3QgYmUgYXBwcm9w cmlhdGUsIGRlcGVuZGluZyBvbiB0aGUgbmF0dXJlIG9mIHRoZSBldmVudCBhbmQgaXRzIFN1Ympl Y3QuIEkgc3VnZ2VzdCByZW1vdmluZyB0aGlzIG5vdGUgYW5kIGNvdmVyaW5nIHRoaXMgY29uY2Vy biBlbHNld2hlcmUgKHNlZSAjNA0KIGJlbG93LCByZTogU3ViamVjdCBJZGVudGlmaWNhdGlvbiku PG86cD48L286cD48L2xpPjwvb2w+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4oWW91IHdlcmUgYWN0 dWFsbHkgcmVmZXJyaW5nIHRvIFNlY3Rpb24gMi4xLikmbmJzcDsgQXMgd2UgZGlzY3Vzc2VkLCBp ZiB0aGUgbG9naWNhbCBpc3N1ZXIgZm9yIHRoZSBTRVQgZG9lc27igJl0IGZpdCB0aGUgSldUIOKA nGlzc+KAnSBzdHJpbmcgc3ludGF4LCBpdOKAmXMgcGVyZmVjdGx5IHJlYXNvbmFibGUgdG8gZGVm aW5lIGEgZGlmZmVyZW50DQogY2xhaW0gYW5kIGl0cyBzeW50YXggdGhhdCBtZWV0cyB0aGUgYXBw bGljYXRpb27igJlzIG5lZWRzLiZuYnNwOyBUaGUg4oCcTm90ZeKAnSBwYXJ0IGFsc28gZG9lc27i gJl0IGRpY3RhdGUgdGhhdCB0aGUg4oCcc3Vi4oCdIGNsYWltIG5hbWUgYmUgdXNlZC4mbmJzcDsg V2UgY291bGQgYWRkIHRoZSBwYXJlbnRoZXRpY2FsIHJlbWFyayDigJwoZWl0aGVyIHVzaW5nIHRo ZSDigJxpc3PigJ0gbWVtYmVyIG5hbWUgb3IgYW5vdGhlciBuYW1lKeKAnSBiZWZvcmUgdGhlIGZp cnN0IGNvbW1hIGluIHRoZSBub3RlLA0KIHRvIG1ha2UgdGhpcyBwb2ludCBjbGVhciwgaWYgeW91 IHRoaW5rIHRoYXQgd291bGQgYWRkcmVzcyB5b3VyIGNvbmNlcm4uPG86cD48L286cD48L3NwYW4+ PC9wPg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9IjMiIHR5cGU9IjEiPg0KPGxp IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDttc28tbGlzdDps MSBsZXZlbDEgbGZvMyI+PGI+RXhwbGljaXQgVHlwaW5nIG9mIFNFVHM8L2I+PGJyPg0KSSBzdWdn ZXN0IHJlbW92aW5nIHRoZSB0ZXh0IOKAnGlmIHRoZSBTRVQgY291bGQgYmUgdXNlZCBpbiBhbiBh cHBsaWNhdGlvbiBjb250ZXh0IGluIHdoaWNoIGl0IGNvdWxkIGJlIGNvbmZ1c2VkIHdpdGggb3Ro ZXIga2luZHMgb2YgSldUc+KAnSBmcm9tIHRoZSBmaXJzdCBwYXJhZ3JhcGggb2Ygc2VjdGlvbiAy LjIsIG1ha2luZyB0aGUgc2VjZXZlbnQmIzQzO2p3dCB0eXAgaGVhZGVyIG1hbmRhdG9yeSB0byBp bXBsZW1lbnQgZm9yIGFsbCBTRVRzLiBUaGlzIGNvbmRpdGlvbmFsDQogaXMgaW1wb3NzaWJsZSB0 byBldmFsdWF0ZSwgYXMgbmV3IHR5cGVzIG9mIEpXVHMgd2lsbCBiZSBpbnRyb2R1Y2VkIG92ZXIg dGltZS4gSnVzdCBjb25zaWRlcmluZyBleGlzdGluZyBKV1RzLCBpdCBpcyBhIGxvdCB0byBhc2sg Zm9yIFByb2ZpbGluZyBTcGVjIGF1dGhvcnMgdG8gZnVsbHkgZXhhbWluZSB0aGUgY29udGVudHMg YW5kIHVzYWdlIG9mIGV2ZXJ5IGV4aXN0aW5nIEpXVC4gTWFuZGF0aW5nIHVzZSBvZiB0eXAgZm9y IFNFVHMgdGFrZXMgdGhpcw0KIGxvYWQgb2ZmIG9mIFByb2ZpbGluZyBTcGVjIGF1dGhvcnMgYW5k IGluc3VyZXMgdGhhdCBmdXR1cmUgc3BlY3MgaGF2ZSBhIGNvbnNpc3RlbnQsIHJlbGlhYmxlIHdh eSB0byBkZWZlbmQgYWdhaW5zdCBKV1QgdHlwZSBjb25mdXNpb24uPG86cD48L286cD48L2xpPjwv b2w+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5BcyB3ZSBkaXNjdXNzZWQsIEnigJltIHJlbHVjdGFu dCB0byByZW1vdmUgdGhlIGNsYXVzZSBiZWNhdXNlIHRoZXJlIGlzIGFscmVhZHkgdGhpcyBzdHJv bmcgbGFuZ3VhZ2UgYXQgdGhlIGVuZCBvZiB0aGUgcGFyYWdyYXBoOiDigJxUaGlzIE1VU1QgYmUg aW5jbHVkZWQgaWYgdGhlIFNFVCBjb3VsZCBiZSB1c2VkIGluIGFuDQogYXBwbGljYXRpb24gY29u dGV4dCBpbiB3aGljaCBpdCBjb3VsZCBiZSBjb25mdXNlZCB3aXRoIG90aGVyIGtpbmRzIG9mIEpX VHMu4oCdJm5ic3A7IFNvIHRoZSBkZWZhdWx0IGJlaGF2aW9yIGlzIGFscmVhZHkgdGhlIG9uZSB5 b3Ugd2FudC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGlu IiBzdGFydD0iNCIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1ib3R0b206MTIuMHB0O21zby1saXN0OmwxIGxldmVsMSBsZm8zIj48Yj5SZXF1aXJlbWVudHMg Zm9yIFNFVCBQcm9maWxlczogU3ViamVjdCBJZGVudGlmaWNhdGlvbjwvYj48YnI+DQpJIHN1Z2dl c3QgYWRkaW5nIHRleHQgYWxvbmcgdGhlIGxpbmVzIG9mIOKAnFByb2ZpbGluZyBTcGVjaWZpY2F0 aW9ucyBNVVNUIGRlZmluZSBmb3IgZWFjaCBvZiB0aGVpciBldmVudHMgaG93IHRoZSBTdWJqZWN0 IGlzIGlkZW50aWZpZWQgaW4gdGhlIFNFVCwgYXMgd2VsbCBhcyBob3cgdG8gYWRkcmVzcyBjb25m bGljdHMgdGhlIGV2ZW50IFN1YmplY3TigJlzIElzc3VlciBhbmQgdGhlIFNFVCBJc3N1ZXIgaWYg YXBwbGljYWJsZS4gSXQgaXMgTk9UIFJFQ09NTUVOREVEDQogZm9yIFByb2ZpbGluZyBTcGVjaWZp Y2F0aW9ucyB0byB1c2UgdGhlIOKAnHN1YuKAnSBjbGFpbSBpbiBjYXNlcyB3aGVyZSB0aGUgU3Vi amVjdCBpcyBub3QgZ2xvYmFsbHkgdW5pcXVlIGFuZCBoYXMgYSBkaWZmZXJlbnQgSXNzdWVyIGZy b20gdGhlIFNFVCBpdHNlbGYu4oCdPG86cD48L286cD48L2xpPjwvb2w+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MDAyMDYwIj5J4oCZbSBPSyBhZGRpbmcgc29tZXRoaW5nIGFsb25nIHRob3NlIGxpbmVzLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSI1IiB0 eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4w cHQ7bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPjxiPkd1aWRhbmNlIGZvciBTaWduaW5nIFNFVHM8 L2I+PGJyPg0KVGhlIHRleHQgaW4gdGhlIGxhc3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gNC4xIGlz IHVuY2xlYXIgdG8gbWUuIEl0IHNlZW1zIHRvIHN1Z2dlc3QgdGhhdCBpdCBpcyBzYWZlIHRvIHNl bmQgdW5zaWduZWQgSldUcyBvdmVyIGEgY2hhbm5lbCB0aGF0IGxhY2tzIHRyYW5zcG9ydC1sYXll ciBzZWN1cml0eSwgc28gbG9uZyBhcyByZXF1ZXN0cyBpbmNsdWRlIGEgYmVhcmVyIHRva2VuIG9y IHVzZSBCYXNpYyBBdXRoZW50aWNhdGlvbi4gQW0gSSBtaXNyZWFkaW5nDQogdGhpcz8gSXQgc2Vl bXMgY291bnRlciB0byB0aGUgZ3VpZGFuY2UgZ2l2ZW4gZWFybGllciBpbiB0aGUgc2FtZSBzZWN0 aW9uLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+R29vZCBjYXRj aC4mbmJzcDsgSW4gZmFjdCB0aGUgcGxhaW4gcmVhZGluZyBvZiB0aGUgZmlyc3QgaGFsZiBvZiB0 aGUgc2VudGVuY2UgaXMgc2VsZi1jb250cmFkaWN0b3J5LiZuYnNwOyBBcyB3ZSBkaXNjdXNzZWQs IGxldOKAmXMgc2ltcGxpZnkgdGhpcyB0byDigJxVbmxlc3MgaW50ZWdyaXR5IG9mIHRoZSBKV1Qg aXMgZW5zdXJlZCBieQ0KIG90aGVyIG1lYW5zLCBpdCBNVVNUIGJlIHNpZ25lZCB1c2luZyBKV1Pi gKbigJ08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGluIiBz dGFydD0iNiIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1i b3R0b206MTIuMHB0O21zby1saXN0OmwxIGxldmVsMSBsZm8zIj48Yj5EaXN0aW5ndWlzaGluZyBT RVRzIGZyb20gb3RoZXIga2luZHMgb2YgSldUczwvYj48YnI+DQpUaGUgbGFzdCBzZW50ZW5jZSBv ZiB0aGUgZmlyc3QgcGFyYWdyYXBoIG9mIHNlY3Rpb24gNC43IHNlZW1zIGltcG9zc2libGUgdG8g bWUuIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9ucyBjYW5ub3QgYmUgc29sZWx5IHJlc3BvbnNpYmxl IGZvciBlbnN1cmluZyBpbmNvbXBhdGliaWxpdHkgd2l0aCBhbGwgZnV0dXJlIEpXVCBwcm9maWxl cy4gVGhleSBjYW4gYXQgYmVzdCBlbnN1cmUgaW5jb21wYXRpYmlsaXR5IHdpdGggZXhpc3Rpbmcg SldUIHByb2ZpbGVzDQogYW5kIGJlIGNvbXBhdGlibGUgd2l0aCBhIHN0YW5kYXJkIG1lY2hhbmlz bSBieSB3aGljaCBmdXR1cmUgSldUIHByb2ZpbGVzIG1heSBlbnN1cmUgaW5jb21wYXRpYmlsaXR5 IChlLmcuIHRoZSDigJxzZWNldmVudCYjNDM7and04oCdIHR5cCBoZWFkZXIpLiBJdCBtYXkgYmUg ZW5vdWdoIHRvIHN0cmlrZSB0aGUg4oCcKG9yIG90aGVyKeKAnSB0ZXh0IGZyb20gdGhpcyBzZW50 ZW5jZS48Yj48bzpwPjwvbzpwPjwvYj48L2xpPjwvb2w+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5U aGUgc2Vjb25kIHBhcmFncmFwaCAoYmVnaW5uaW5nIOKAnFRoZSBtb3N0IGRpcmVjdCB3YXnigJ0p IHdhcyB3cml0dGVuIGJlZm9yZSB3ZSBoYWQgZXhwbGljaXQgdHlwaW5nLiZuYnNwOyBBcyB3ZSBk aXNjdXNzZWQsIEkgcHJvcG9zZSB0byByZW9yZGVyIHBhcmFncmFwaHMgMiBhbmQgMywgY2hhbmdp bmcgZXhwbGljaXQgdHlwaW5nDQogdG8gYmUg4oCcVGhlIG1vc3QgZGlyZWN0IHdheeKAnSBhbmQg bXV0dWFsbHkgZXhjbHVzaXZlIHZhbGlkYXRpb24gbG9naWMgdG8gYmUg4oCcQW5vdGhlciB3YXni gJ0uJm5ic3A7IFRoYXQgcHV0cyB0aGUgZW1waGFzaXMgd2hlcmUgaXQgc2hvdWxkIGJlLCBhdCB0 aGlzIGp1bmN0dXJlIGluIHRoZSBkZXZlbG9wbWVudCBvZiB0aGUgc3BlY2lmaWNhdGlvbi48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPi0t Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFu JnF1b3Q7LHNlcmlmIj5Bbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj5JZGVudGl0eSBT ZXJ2aWNlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyBUaGFua3MgYWdhaW4hPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGlu IDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPklkLWV2ZW50ICZsdDs8YSBocmVmPSJtYWlsdG86aWQt ZXZlbnQtYm91bmNlc0BpZXRmLm9yZyI+aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7 IG9uIGJlaGFsZiBvZiAmcXVvdDs8YSBocmVmPSJtYWlsdG86TS5MaXphckBPQ0ciPk0uTGl6YXJA T0NHPC9hPiZxdW90Ow0KICZsdDs8YSBocmVmPSJtYWlsdG86bS5saXphckBvcGVuY29uc2VudGdy b3VwLmNvbSI+bS5saXphckBvcGVuY29uc2VudGdyb3VwLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+RGF0 ZTogPC9iPlR1ZXNkYXksIEF1Z3VzdCAxLCAyMDE3IGF0IDk6MTcgQU08YnI+DQo8Yj5UbzogPC9i Pk1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b20iPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6IDwvYj5Z YXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tIj55 YXJvbmYuaWV0ZkBnbWFpbC5jb208L2E+Jmd0OywgU2VjRXZlbnQgJmx0OzxhIGhyZWY9Im1haWx0 bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1 YmplY3Q6IDwvYj5SZTogW0lkLWV2ZW50XSBXRyBMYXN0IENhbGwgZm9yIGRyYWZ0LWlldGYtc2Vj ZXZlbnQtdG9rZW4tMDI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+JiM0MzsxIG9uIGV4aXN0aW5nIHRleHQgLiZuYnNwOyA8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlIHRoZSBkb2N1bWVudCBpcyBy ZWFkeSB0byBwdWJsaXNoPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPi0gTWFyazxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAzMSBKdWwgMjAxNywgYXQgMTY6NTMsIE1pa2Ug Sm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JIGJlbGlldmUgdGhhdCB0aGUgc3BlY2lmaWNhdGlv biBpcyByZWFkeSB0byBwdWJsaXNoIGFzLWlzLiZuYnNwOyBJdCBhbHJlYWR5IG1lZXRzIHRoZSBu ZWVkcyBvZiB0aGUga25vd24gdXNlIGNhc2VzIGFuZCBpcyBpbiBwcm9kdWN0aW9uIHVzZS48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGI+ RnJvbTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PklkLWV2ZW50IFs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyI+bWFp bHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPllhcm9uDQogU2hlZmZlcjxicj4N CjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5Nb25kYXksIEp1bHkgMzEsIDIwMTcgMTo0MCBQTTxicj4NCjxiPlRvOjwvYj48c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U2VjRXZlbnQgJmx0Ozxh IGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0 Ozxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj5bSWQtZXZlbnRdIFdHIExhc3QgQ2FsbCBmb3IgZHJhZnQtaWV0Zi1zZWNl dmVudC10b2tlbi0wMjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj5UaGlzIGlzIHRvIGFubm91bmNlIHdvcmtpbmcgZ3JvdXAgbGFz dCBjYWxsIG9uIHRoaXMgZHJhZnQgKDxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5v cmcvZG9jL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4vIj48c3BhbiBzdHlsZT0iY29sb3I6cHVy cGxlIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLXNlY2V2ZW50 LXRva2VuLzwvc3Bhbj48L2E+KS48YnI+DQo8YnI+DQpQbGVhc2Ugc2VuZCB5b3VyIGNvbW1lbnRz IHRvIHRoZSBsaXN0LiBFdmVuIGlmIHlvdSBhcmUgcGVyZmVjdGx5IGhhcHB5IHdpdGggdGhlIGRy YWZ0LCBwbGVhc2UgbGV0IHVzIGtub3cgdGhhdCB5b3Ugc3VwcG9ydCBpdHMgcHVibGljYXRpb24g YXMtaXMgYnkgcG9zdGluZyB0byB0aGUgbGlzdC48YnI+DQo8YnI+DQpCZWNhdXNlIG9mIHRoZSBz dW1tZXIgaG9saWRheXMsIHRoaXMgbGFzdCBjYWxsIGlzIG9wZW4gZm9yIDMgd2Vla3MsIHVudGls IEF1Zy4gMjEuPGJyPg0KPGJyPg0KVGhhbmtzLDxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyBEaWNr IGFuZCBZYXJvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmO2JhY2tncm91bmQ6d2hpdGUiPl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjxz cGFuIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5JZC1ldmVudCBtYWlsaW5nIGxpc3Q8L3NwYW4+ PGJyPg0KPHNwYW4gc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxhIGhyZWY9Im1haWx0bzpJZC1l dmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PC9zcGFuPjxicj4NCjxzcGFuIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2lkLWV2ZW50Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2lkLWV2ZW50PC9hPjwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1i b3R0b206MTIuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_CY4PR21MB0504E0464CA7C7A3C5267792F5470CY4PR21MB0504namp_-- From nobody Mon Oct 23 17:05:15 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A91C413ADD2 for ; Mon, 23 Oct 2017 17:05:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lbef0nx9TIGb for ; Mon, 23 Oct 2017 17:05:12 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0129.outbound.protection.outlook.com [104.47.40.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A93A813A5BC for ; Mon, 23 Oct 2017 17:05:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+3sQzK3Qw3AOQxnWjyWajETGhrnM+1I3Kn/ZQfX9RjA=; b=iFIsNIipqnhQT7QZ0r4tLCvpllyPcan+ATXHXIq6XiQnsroPDWhnmqcj0WRPtchwloFkIeEGKhtnC6wAIvd16VINm2mJQJVw8h5btenGrcW08LuIZzXTB2eCI92uA4lm6KX8OMEvEuVokUJa+p1H3j3VmYtUvpGaFusCVnI4g2U= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0839.namprd21.prod.outlook.com (10.173.192.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Tue, 24 Oct 2017 00:05:11 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 00:05:11 +0000 From: Mike Jones To: Marius Scurtescu , Yaron Sheffer CC: SecEvent Thread-Topic: [Id-event] WG Last Call for draft-ietf-secevent-token-02 Thread-Index: AQHTCj09LrxBWiFA7kmsguwQioPAmaJxnOSAgID7ziA= Date: Tue, 24 Oct 2017 00:05:10 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-23T17:05:09.8493188-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:5::42f] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0839; 6:wc+SJ3mhHZdIM+o5rut6U2QUx/ilE2SxMbvblgtDXGDOITWN+YcG+D4ma7BtNN+sTeKEMmrKorkDm8fpB9IQvibgkMG1sdMthuni0ziiLdqYuh/l+3Y1xvViMgu3V2Q5QDqk5N1bHhaqIsGkLIHRMPv3pBgXBshNiaaG0qUpdBjrevT13dJ0N7lvBDoD+cxLBKyNcfWBjFL9cxTo/Jrw4dMM0TIR7468tNBuyqY1Ks9WTzq/KQ8DfLiSs3vICUgHHGKaLomAJdMCn1EAYO7nkCBOjoFwVn/UUNZJQr6Oj2wyaUTTsAcKpLq50A/uADoah944/u7Ll/S8DMQSwkEj7C+GM3jkyVvEIexUXmsSUGg=; 5:Qpp+H9Rkp3m5BAwaclw1Y4k0LNGBoPmnhYYYNDA7BBQtAwyPwdgwmNDHgss1+CaCTaMLAjqsaQKoO/bPpKCJZ7QVZrSsGpfZPqHP9nVCmM2dN2RpWbRU5AllGZDnGPxCHQCo8dMToIQkoPdZQ9C+4tgi4JZiTaqexkZw9BKlLdQ=; 24:HYrz90q8P3V1aqfSVJAaWT+CesB2s95rW+um1RtZu3Bi/0UGt9oSA5zhZbIBkfFgl/T4nssnPFIcodWnCCrq6ShQKvpX6XliGT0gneRwQwQ=; 7:YbBafcdjSBx1gFL2D5u+QXXIHIb7vX+4Ev+FzOk2NbDKYM21LjvFDUVKSOhFytrZiZPrkvVQwH/WnilcPEJzw8McS4OYklN1jBoE8EgHobOyI6DHlnvphAPOw+VygFT45ZCNSZQVgYnZc2CvN0OG0wZnS0Ige4ZNZLlUvKZz9eWaDYx846rR6VAXeXHNTi1+WYb1gx+6/evi5mhwbPa1kTejyByhqd9XceVL+/yW1xH9Mcr0cl8THC/xuhvm0yRB x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 0984cbae-81be-4c81-2948-08d51a72e4e8 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:CY4PR21MB0839; x-ms-traffictypediagnostic: CY4PR21MB0839: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-exchange-antispam-report-test: UriScan:(120809045254105)(21748063052155); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(3231020)(10201501046)(100000703101)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123560025)(20161123562025)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0839; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0839; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(346002)(39860400002)(47760400005)(43784003)(69234005)(51914003)(24454002)(189002)(199003)(316002)(6306002)(110136005)(54896002)(236005)(3660700001)(9686003)(99286003)(55016002)(97736004)(2900100001)(2906002)(10090500001)(6116002)(102836003)(790700001)(561944003)(22452003)(53936002)(33656002)(86612001)(6246003)(86362001)(39060400002)(230783001)(7696004)(189998001)(4326008)(19609705001)(3280700002)(2950100002)(77096006)(106356001)(5660300001)(53546010)(68736007)(6506006)(50986999)(101416001)(229853002)(76176999)(54356999)(105586002)(6436002)(25786009)(74316002)(8676002)(10290500003)(7736002)(478600001)(8990500004)(81156014)(81166006)(8936002)(606006)(14454004)(72206003)(966005); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0839; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05044FEC88C9019A9E9BD146F5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0984cbae-81be-4c81-2948-08d51a72e4e8 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 00:05:10.9855 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0839 Archived-At: Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:05:14 -0000 --_000_CY4PR21MB05044FEC88C9019A9E9BD146F5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIGZvciB0aGUgdXNlZnVsIHJldmlldyBjb21tZW50cywgTWFyaXVzLiAgVGhlIHByb3Bv c2VkIHJlc29sdXRpb25zIHRoYXQgQW5uYWJlbGxlIGFuZCBJIGRpc2N1c3NlZCBpbi1wZXJzb24g YXJlIGFzIGZvbGxvd3MuDQoNCkZyb206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNl c0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIE1hcml1cyBTY3VydGVzY3UNClNlbnQ6IFdlZG5lc2Rh eSwgQXVndXN0IDIsIDIwMTcgMjo0NiBQTQ0KVG86IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRm QGdtYWlsLmNvbT4NCkNjOiBTZWNFdmVudCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBS ZTogW0lkLWV2ZW50XSBXRyBMYXN0IENhbGwgZm9yIGRyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4t MDINCg0KVGhlIGFic3RyYWN0IG1lbnRpb25zICJpc3N1ZXIiIGFuZCAicmVjZWl2ZXIiIGluIHRo ZSBsYXN0IHNlbnRlbmNlLiAicmVjZWl2ZXIiIGRvZXMgbm90IHNvdW5kIHJpZ2h0ICh0aGF0IHNo b3VsZCBiZSB1c2VkIGluIHRoZSBjb250ZXh0IG9mIGEgdHJhbnNtaXR0ZXIpLCBidXQgSSBkb24n dCBoYXZlIGEgYmV0dGVyIHN1Z2dlc3Rpb24uIEF1ZGllbmNlPw0KDQpKV1QgW1JGQyA3NTE5XSwg SldTLCBKV0UsIGV0Yy4gdW5pZm9ybWx5IHVzZSB0aGUgdGVybSDigJxyZWNpcGllbnTigJ0gZm9y IHRoaXMgY29uY2VwdC4gIEkgYmVsaWV2ZSB3ZSBzaG91bGQgZG8gdGhlIHNhbWUuDQoNClRoZSBs YXN0IHBhcmFncmFwaCBvZiBzZWN0aW9uIDEgbWVudGlvbnMgInN1YnNjcmliZXIiLiBJIHRoaW5r IGl0IHNob3VsZCBiZSBlaXRoZXIgInJlY2VpdmVyIiBvciAiYXVkaWVuY2UiLg0KDQrigJxyZWNp cGllbnRz4oCdIHNlZW1zIHJpZ2h0IGhlcmUgYWdhaW4sIGJvdGggZm9yIGNvbnNpc3RlbmN5IHNh a2UsIGFuZCBiZWNhdXNlIHRoZSBwbGFpbiBFbmdsaXNoIG1lYW5pbmcgbWF0Y2hlcyB0aGUgaW50 ZW5kZWQgc2VtYW50aWNzLg0KDQpUaGUgZXhwbGFuYXRpb24gZm9yIGZpZ3VyZSAxIHN0YXRlcyB0 aGF0IHRoZSBpc3N1ZXIgZGVub3RlcyB0aGUgdHJhbnNtaXR0ZXIuIElmIHRoZSBpc3N1ZXIgYW5k IHRoZSB0cmFuc21pdHRlciBhcmUgYXNzdW1lZCB0byBiZSB0aGUgc2FtZSBlbnRpdHksIHRoZW4g dGhlIHRyYW5zbWl0dGVyIGRlZmluaXRpb24gaW4gc2VjdGlvbiAxLjIgc2hvdWxkIG1ha2UgdGhh dCBjbGVhci4NCg0KSSBiZWxpZXZlIHRoYXQgdGhlIOKAnHRyYW5zbWl0dGVy4oCdIGlzIGludGVu ZGVkIHRvIGJlIGFibGUgdG8gYmUgZGlmZmVyZW50IHRoYW4gdGhlIOKAnGlzc3VlcuKAnS4gIEpX VCB1c2VzIHRoZSB0ZXJtIOKAnGlzc3VlcuKAnSBhbmQgbm90IOKAnHRyYW5zbWl0dGVy4oCdLCBG WUkuICBJIGJlbGlldmUgdGhhdCBzb21lIG9mIHRoZSB1c2VzIG9mIOKAnHRyYW5zbWl0dGVy4oCd IHNob3VsZCBhY3R1YWxseSBiZSDigJxpc3N1ZXLigJ0g4oCTIGluIHBhcnRpY3VsYXIgdGhpcyBu ZWVkcyB0byBiZSBjaGFuZ2VkIOKAnEFuICJpc3MiIGNsYWltLCBkZW5vdGluZyB0aGUgRXZlbnQg VHJhbnNtaXR0ZXIu4oCdICBBbiDigJxFdmVudCBJc3N1ZXLigJ0gZGVmaW5pdGlvbiBwcm9iYWJs eSBuZWVkcyB0byBiZSBhbHNvIGFkZGVkLiAgSeKAmWxsIHRha2UgYSBjcmFjayBhbmQgbm9ybWFs aXppbmcgdGhpcyB0ZXJtaW5vbG9neSB1c2FnZSwgYm90aCB0byBtYXRjaCBKV1QsIGFuZCB0byBt YWtlIHRoZSDigJxpc3N1ZXLigJ0gLyDigJx0cmFuc21pdHRlcuKAnSBkaXN0aW5jdGlvbiBjbGVh ci4NCg0KRmlndXJlIDMsIEkgdGhpbmsgdGhlICJzdWIiIGNsYWltIHNob3VsZCBiZSBuZXN0ZWQg aW4gdGhlIGV2ZW50LCBuZXh0IHRvIHRoZSBpc3N1ZXIgdGhhdCBwcm92aWRlcyB0aGUgY29ycmVj dCBjb250ZXh0LiBUaGUgImlzcyIgYW5kICJzdWIiIGRlZmluaXRpb25zIGluIDIuMSBhbHNvIHRv dWNoIG9uIHRoaXMsIHByb3ZpZGluZyBjb25mbGljdGluZyBhZHZpY2UuDQoNCk9LLCBpbiB0aGlz IGNhc2UsIEkgdGhpbmsgSeKAmW0gZmluZSB3aXRoIHRoZSBwcm9wb3NlZCBjaGFuZ2UuDQoNClNl Y3Rpb24gMiwxLCBkZWZpbml0aW9uIG9mICJuYmYiLiBUaGUgZGVmaW5pdGlvbiBzYXlzIHRoYXQg dGhpcyBpcyB0aGUgZXZlbnQgdGltZS4gSSBzZWUgdHdvIHByb2JsZW1zOg0KLSB0aGUgbmFtZSBz dWdnZXN0ICJub3QgYmVmb3JlIiwgbm90IGV4YWN0bHkgdGhlIHNhbWUgYXMgZXZlbnQgdGltZQ0K LSB0aGVyZSBjYW4gYmUgbXVsdGlwbGUgZXZlbnRzDQptYXliZSB0aGlzIGNsYWltIHNob3VsZCBi ZSBkcm9wcGVkPw0KDQpBdCBsZWFzdCBBbm5hYmVsbGUgYW5kIEkgYWdyZWVkIHdpdGggeW91IHRo YXQgZHJvcHBpbmcgdGhpcyBjbGFpbSBkZXNjcmlwdGlvbiBmcm9tIHRoZSBTRVQgbWFrZXMgc2Vu c2UsIGFzIGl04oCZcyBkZXNjcmliZWQgdXNhZ2UgaXMgY3VycmVudGx5IGtpbmQgb2YgYSBoYWNr LiAgKOKAnG5iZuKAnSBjb3VsZCBzdGlsbCBiZSB1c2VkIGJ5IHNvbWUgcHJvZmlsZXMgaW4gaXRz IHVzdWFsIEpXVCBtYW5uZXIgd2l0aG91dCB0aGUgU0VUIHNwZWMgc2F5aW5nIGFueXRoaW5nIGFi b3V0IGl0LikgIFdlIHByb3Bvc2UgcmVwbGFjaW5nIGl0IHdpdGggdGhlIOKAnHRvZeKAnSAodGlt ZSBvZiBldmVudCkgY2xhaW0gZGVzY3JpYmVkIGluIHRoZSB0aHJlYWQg4oCcW0lkLWV2ZW50XSBS ZXBsYWNpbmcgIm5iZiIgY2xhaW0gd2l0aCBhIG5ldyAidG9lIiBjbGFpbeKAnS4NCg0KU2VjdGlv biAyLjEsIGRlZmluaXRpb24gb2YgImV4cCIuIE9taXR0aW5nIHRoaXMgY2xhaW0gaXMgdGhlIHNo b3J0IHRlcm0gc29sdXRpb24gdG8gdGhlIGNvbmZ1c2lvbiBpc3N1ZS4gV2h5IG5vdCBtZW50aW9u IHRoYXQgYW5kIHRoYXQgaXQgU0hPVUxEIE5PVCBiZSB1c2VkPw0KDQpJdOKAmXMgc2FpZCB0aGF0 IGl0IHNob3VsZCBub3QgYmUgdXNlZCBiZWNhdXNlIGl04oCZcyBvbmUgb2YgdGhlIG1vc3QgY29t bW9ubHkgdXNlZCBjbGFpbXMgaW4gb3RoZXIgSldUcyBhbmQgdGhpcyBwYXJhZ3JhcGggZ2l2ZXMg dXMgYSBwbGFjZSB0byBkZXNjcmliZSB0aGUgcmF0aW9uYWxlIGZvciBub3QgdXNpbmcgaXQgaW4g U0VUIHByb2ZpbGVzLg0KDQpTZWN0aW9uIDIuMSwgZGVmaW5pdGlvbiBvZiAiZXZlbnRzIi4gSXQg c3RhdGVzIHRoYXQgYWxsIGV2ZW50cyBtdXN0IHJlZmVyIHRvIHRoZSBzYW1lIGxvZ2ljYWwgZXZl bnQuIExhdGVseSBpbiBkaXNjdXNzaW9ucyB3ZSByZWFjaGVkIHRoZSBjb25jbHVzaW9uIHRoYXQg YWxsIGV2ZW50cyBpbiBhIFNFVCBzaG91bGQgYmUgZGVmaW5lZCBpbiB0aGUgc2FtZSBwcm9maWxl LCB3aGljaCBpcyBhIHN0cm9uZ2VyIHJlcXVpcmVtZW50LiBJIHRoaW5rIHRoaXMgZGVmaW5pdGlv biBzaG91bGQgbWVudGlvbiB0aGF0Lg0KDQpJ4oCZbSBPSyBhZGRpbmcgYSBzdGF0ZW1lbnQgdGhh dCB0aGV5IHNob3VsZCBhbGwgYmUgZnJvbSBwcm9maWxlcyB3aXRoIGNvbXBhdGlibGUgY2xhaW1z IHVzYWdlLCB3aGljaCBJIHRoaW5rIGlzIHdoYXQgeW914oCZcmUgYWN0dWFsbHkgYWZ0ZXIuDQoN ClJlZ2FyZGluZyBldmVudHMgYW5kIHByb2ZpbGVzLiBUaGVyZSB3YXMgYSBwcm9wb3NhbCB0byBh ZGQgYSBuZXcgY2xhaW0gdG8gdW5pcXVlbHkgaWRlbnRpZnkgdGhlIHByb2ZpbGUuIEkgdGhpbmsg d2UgbmVlZCB0byBkaXNjdXNzIHRoYXQuDQoNCkFzIGRpc2N1c3NlZCBvbiB0aGUgbGlzdCwgdGhl IHByb2JsZW0gd2l0aCBhZGRpbmcgYSBuZXcg4oCccHJvZmlsZeKAnSBjbGFpbSBpcyB0aGF0IGl0 IGR1cGxpY2F0ZXMgaW5mb3JtYXRpb24gYWxyZWFkeSBkZXJpdmFibGUgZnJvbSB0aGUgZXZlbnQg VVJJcy4gIFRoaXMgY2FuIGxlYWQgdG8gZXJyb3IgY29uZGl0aW9ucyB0aGF0IGFyZSBvdGhlcndp c2UgaW1wb3NzaWJsZSwgYmVjYXVzZSBpbmNvbnNpc3RlbmNpZXMgY2FuIGFyaXNlLiAgQWxzbywg cGVyIHRoZSBwcmV2aW91cyByZXBseSBldmVudHMgbmVlZCB0byBiZSBmcm9tIGNvbXBhdGlibGUg cHJvZmlsZXMg4oCTIG5vdCBuZWNlc3NhcmlseSB0aGUgc2FtZSBwcm9maWxlIOKAkyBhbmQgc28g YSBzaW5nbGV0b24g4oCccHJvZmlsZeKAnSBjbGFpbSB3b3VsZG7igJl0IGFjdHVhbGx5IHdvcmsg aW4gdGhlIGdlbmVyYWwgY2FzZS4NCg0KRmlndXJlIDUuIE1heWJlIGEgc2lnbmVkIGV4YW1wbGUg d291bGQgYmUgYmV0dGVyLCBlc3BlY2lhbGx5IHRoYXQgdGhlIG5leHQgcGFyYWdyYXBoIG1lbnRp b25zIHRoYXQgc2lnbmF0dXJlcyBvciBlbmNyeXB0aW9uIHNob3VsZCBiZSB1c2VkLg0KDQpVbnNp Z25lZCBrZWVwcyB0aGUgZHJhZnQgc2hvcnRlci4gOy0pDQoNClNlY3Rpb24gNC41LCBzZWNvbmQg cGFyYWdyYXBoLiBNZW50aW9ucyB0aGF0ICJub25jZSIgaXMgYWxzbyByZXF1aXJlZCwgYnV0IHRo YXQgaXMgbm90IGFjdHVhbGx5IHRydWUuIElkIFRva2VucyBpc3N1ZWQgYXQgdGhlIHRva2VuIGVu ZHBvaW50IGZvciBleGFtcGxlIHdpbGwgbm90IGhhdmUgaXQuIEkgc3VnZ2VzdCB3ZSBkcm9wIHRo ZSB3aG9sZSBwYXJhZ3JhcGguDQoNCkdvb2QgY2F0Y2guICBJdCBzaG91bGQgcmVhbGx5IGJlIHF1 YWxpZmllZCB0byBzYXkg4oCcaXQgd291bGQgbm90IGNvbnRhaW4gdGhlIGNvcnJlY3QgIm5vbmNl IiBjbGFpbSB2YWx1ZSBmb3IgdGhlIElEIFRva2VuIHRvIGJlIGFjY2VwdGVkIGluIGNvbnRleHRz IGZvciB3aGljaCBzdWJzdGl0dXRpb24gaXMgcG9zc2libGXigJ0uDQoNCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBUaGFua3Mg YWdhaW4sIE1hcml1cyENCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQpNYXJpdXMNCg0KT24gTW9uLCBKdWwgMzEs IDIwMTcgYXQgMTo0MCBQTSwgWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1h aWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+PiB3cm90ZToNClRoaXMgaXMgdG8gYW5ub3VuY2Ug d29ya2luZyBncm91cCBsYXN0IGNhbGwgb24gdGhpcyBkcmFmdCAoaHR0cHM6Ly9kYXRhdHJhY2tl ci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1zZWNldmVudC10b2tlbi8pLg0KDQpQbGVhc2Ugc2Vu ZCB5b3VyIGNvbW1lbnRzIHRvIHRoZSBsaXN0LiBFdmVuIGlmIHlvdSBhcmUgcGVyZmVjdGx5IGhh cHB5IHdpdGggdGhlIGRyYWZ0LCBwbGVhc2UgbGV0IHVzIGtub3cgdGhhdCB5b3Ugc3VwcG9ydCBp dHMgcHVibGljYXRpb24gYXMtaXMgYnkgcG9zdGluZyB0byB0aGUgbGlzdC4NCg0KQmVjYXVzZSBv ZiB0aGUgc3VtbWVyIGhvbGlkYXlzLCB0aGlzIGxhc3QgY2FsbCBpcyBvcGVuIGZvciAzIHdlZWtz LCB1bnRpbCBBdWcuIDIxLg0KDQpUaGFua3MsDQogICAgRGljayBhbmQgWWFyb24NCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxp bmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQo= --_000_CY4PR21MB05044FEC88C9019A9E9BD146F5470CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGlu Ow0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJ e3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+ PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4 dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+VGhhbmtzIGZvciB0 aGUgdXNlZnVsIHJldmlldyBjb21tZW50cywgTWFyaXVzLiZuYnNwOyBUaGUgcHJvcG9zZWQgcmVz b2x1dGlvbnMgdGhhdCBBbm5hYmVsbGUgYW5kIEkgZGlzY3Vzc2VkIGluLXBlcnNvbiBhcmUgYXMg Zm9sbG93cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQt Ym91bmNlc0BpZXRmLm9yZ10gPGI+DQpPbiBCZWhhbGYgT2YgPC9iPk1hcml1cyBTY3VydGVzY3U8 YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVzZGF5LCBBdWd1c3QgMiwgMjAxNyAyOjQ2IFBNPGJyPg0K PGI+VG86PC9iPiBZYXJvbiBTaGVmZmVyICZsdDt5YXJvbmYuaWV0ZkBnbWFpbC5jb20mZ3Q7PGJy Pg0KPGI+Q2M6PC9iPiBTZWNFdmVudCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+ U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFdHIExhc3QgQ2FsbCBmb3IgZHJhZnQtaWV0Zi1z ZWNldmVudC10b2tlbi0wMjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGFic3Ry YWN0IG1lbnRpb25zICZxdW90O2lzc3VlciZxdW90OyBhbmQgJnF1b3Q7cmVjZWl2ZXImcXVvdDsg aW4gdGhlIGxhc3Qgc2VudGVuY2UuICZxdW90O3JlY2VpdmVyJnF1b3Q7IGRvZXMgbm90IHNvdW5k IHJpZ2h0ICh0aGF0IHNob3VsZCBiZSB1c2VkIGluIHRoZSBjb250ZXh0IG9mIGEgdHJhbnNtaXR0 ZXIpLCBidXQgSSBkb24ndCBoYXZlIGEgYmV0dGVyIHN1Z2dlc3Rpb24uIEF1ZGllbmNlPzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIw NjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5KV1QgW1JGQyA3NTE5XSwgSldTLCBKV0UsIGV0Yy4g dW5pZm9ybWx5IHVzZSB0aGUgdGVybSDigJxyZWNpcGllbnTigJ0gZm9yIHRoaXMgY29uY2VwdC4m bmJzcDsgSSBiZWxpZXZlIHdlIHNob3VsZCBkbyB0aGUgc2FtZS48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgbGFzdCBwYXJhZ3JhcGggb2Yg c2VjdGlvbiAxIG1lbnRpb25zICZxdW90O3N1YnNjcmliZXImcXVvdDsuIEkgdGhpbmsgaXQgc2hv dWxkIGJlIGVpdGhlciAmcXVvdDtyZWNlaXZlciZxdW90OyBvciAmcXVvdDthdWRpZW5jZSZxdW90 Oy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+4oCccmVjaXBpZW50c+KAnSBzZWVtcyBy aWdodCBoZXJlIGFnYWluLCBib3RoIGZvciBjb25zaXN0ZW5jeSBzYWtlLCBhbmQgYmVjYXVzZSB0 aGUgcGxhaW4gRW5nbGlzaCBtZWFuaW5nIG1hdGNoZXMgdGhlIGludGVuZGVkIHNlbWFudGljcy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRoZSBleHBsYW5hdGlvbiBmb3IgZmlndXJlIDEgc3RhdGVzIHRoYXQgdGhlIGlzc3VlciBk ZW5vdGVzIHRoZSB0cmFuc21pdHRlci4gSWYgdGhlIGlzc3VlciBhbmQgdGhlIHRyYW5zbWl0dGVy IGFyZSBhc3N1bWVkIHRvIGJlIHRoZSBzYW1lIGVudGl0eSwgdGhlbiB0aGUgdHJhbnNtaXR0ZXIg ZGVmaW5pdGlvbiBpbiBzZWN0aW9uIDEuMiBzaG91bGQgbWFrZSB0aGF0IGNsZWFyLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JIGJlbGlldmUgdGhhdCB0aGUg4oCcdHJhbnNtaXR0ZXLi gJ0gaXMgaW50ZW5kZWQgdG8gYmUgYWJsZSB0byBiZSBkaWZmZXJlbnQgdGhhbiB0aGUg4oCcaXNz dWVy4oCdLiZuYnNwOyBKV1QgdXNlcyB0aGUgdGVybSDigJxpc3N1ZXLigJ0gYW5kIG5vdCDigJx0 cmFuc21pdHRlcuKAnSwgRllJLiZuYnNwOyBJIGJlbGlldmUgdGhhdCBzb21lIG9mIHRoZSB1c2Vz IG9mIOKAnHRyYW5zbWl0dGVy4oCdIHNob3VsZCBhY3R1YWxseQ0KIGJlIOKAnGlzc3VlcuKAnSDi gJMgaW4gcGFydGljdWxhciB0aGlzIG5lZWRzIHRvIGJlIGNoYW5nZWQg4oCcQW4gJnF1b3Q7aXNz JnF1b3Q7IGNsYWltLCBkZW5vdGluZyB0aGUgRXZlbnQgVHJhbnNtaXR0ZXIu4oCdJm5ic3A7IEFu IOKAnEV2ZW50IElzc3VlcuKAnSBkZWZpbml0aW9uIHByb2JhYmx5IG5lZWRzIHRvIGJlIGFsc28g YWRkZWQuJm5ic3A7IEnigJlsbCB0YWtlIGEgY3JhY2sgYW5kIG5vcm1hbGl6aW5nIHRoaXMgdGVy bWlub2xvZ3kgdXNhZ2UsIGJvdGggdG8gbWF0Y2ggSldULCBhbmQgdG8gbWFrZQ0KIHRoZSDigJxp c3N1ZXLigJ0gLyDigJx0cmFuc21pdHRlcuKAnSBkaXN0aW5jdGlvbiBjbGVhci48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZpZ3Vy ZSAzLCBJIHRoaW5rIHRoZSAmcXVvdDtzdWImcXVvdDsgY2xhaW0gc2hvdWxkIGJlIG5lc3RlZCBp biB0aGUgZXZlbnQsIG5leHQgdG8gdGhlIGlzc3VlciB0aGF0IHByb3ZpZGVzIHRoZSBjb3JyZWN0 IGNvbnRleHQuIFRoZSAmcXVvdDtpc3MmcXVvdDsgYW5kICZxdW90O3N1YiZxdW90OyBkZWZpbml0 aW9ucyBpbiAyLjEgYWxzbyB0b3VjaCBvbiB0aGlzLCBwcm92aWRpbmcgY29uZmxpY3RpbmcgYWR2 aWNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5PSywgaW4gdGhpcyBjYXNlLCBJIHRo aW5rIEnigJltIGZpbmUgd2l0aCB0aGUgcHJvcG9zZWQgY2hhbmdlLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VjdGlvbiAyLDEs IGRlZmluaXRpb24gb2YgJnF1b3Q7bmJmJnF1b3Q7LiBUaGUgZGVmaW5pdGlvbiBzYXlzIHRoYXQg dGhpcyBpcyB0aGUgZXZlbnQgdGltZS4gSSBzZWUgdHdvIHByb2JsZW1zOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSB0aGUgbmFtZSBzdWdnZXN0 ICZxdW90O25vdCBiZWZvcmUmcXVvdDssIG5vdCBleGFjdGx5IHRoZSBzYW1lIGFzIGV2ZW50IHRp bWU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0g dGhlcmUgY2FuIGJlIG11bHRpcGxlIGV2ZW50czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+bWF5YmUgdGhpcyBjbGFpbSBzaG91bGQgYmUgZHJvcHBl ZD88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QXQgbGVhc3Qg QW5uYWJlbGxlIGFuZCBJIGFncmVlZCB3aXRoIHlvdSB0aGF0IGRyb3BwaW5nIHRoaXMgY2xhaW0g ZGVzY3JpcHRpb24gZnJvbSB0aGUgU0VUIG1ha2VzIHNlbnNlLCBhcyBpdOKAmXMgZGVzY3JpYmVk IHVzYWdlIGlzIGN1cnJlbnRseSBraW5kIG9mIGEgaGFjay4mbmJzcDsgKOKAnG5iZuKAnSBjb3Vs ZCBzdGlsbCBiZSB1c2VkIGJ5IHNvbWUgcHJvZmlsZXMgaW4gaXRzDQogdXN1YWwgSldUIG1hbm5l ciB3aXRob3V0IHRoZSBTRVQgc3BlYyBzYXlpbmcgYW55dGhpbmcgYWJvdXQgaXQuKSZuYnNwOyBX ZSBwcm9wb3NlIHJlcGxhY2luZyBpdCB3aXRoIHRoZSDigJx0b2XigJ0gKHRpbWUgb2YgZXZlbnQp IGNsYWltIGRlc2NyaWJlZCBpbiB0aGUgdGhyZWFkIOKAnFtJZC1ldmVudF0gUmVwbGFjaW5nICZx dW90O25iZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZxdW90OyBjbGFpbeKAnS48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VjdGlvbiAyLjEsIGRlZmluaXRpb24gb2YgJnF1b3Q7 ZXhwJnF1b3Q7LiBPbWl0dGluZyB0aGlzIGNsYWltIGlzIHRoZSBzaG9ydCB0ZXJtIHNvbHV0aW9u IHRvIHRoZSBjb25mdXNpb24gaXNzdWUuIFdoeSBub3QgbWVudGlvbiB0aGF0IGFuZCB0aGF0IGl0 IFNIT1VMRCBOT1QgYmUgdXNlZD88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+SXTigJlzIHNhaWQgdGhhdCBpdCBzaG91bGQgbm90IGJlIHVzZWQgYmVjYXVzZSBp dOKAmXMgb25lIG9mIHRoZSBtb3N0IGNvbW1vbmx5IHVzZWQgY2xhaW1zIGluIG90aGVyIEpXVHMg YW5kIHRoaXMgcGFyYWdyYXBoIGdpdmVzIHVzIGEgcGxhY2UgdG8gZGVzY3JpYmUgdGhlIHJhdGlv bmFsZSBmb3Igbm90IHVzaW5nIGl0IGluIFNFVCBwcm9maWxlcy48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+U2VjdGlvbiAyLjEsIGRlZmluaXRpb24gb2YgJnF1b3Q7ZXZlbnRzJnF1b3Q7LiBJdCBz dGF0ZXMgdGhhdCBhbGwgZXZlbnRzIG11c3QgcmVmZXIgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVu dC4gTGF0ZWx5IGluIGRpc2N1c3Npb25zIHdlIHJlYWNoZWQgdGhlIGNvbmNsdXNpb24gdGhhdCBh bGwgZXZlbnRzIGluIGEgU0VUIHNob3VsZCBiZSBkZWZpbmVkIGluIHRoZSBzYW1lIHByb2ZpbGUs IHdoaWNoIGlzIGEgc3Ryb25nZXIgcmVxdWlyZW1lbnQuDQogSSB0aGluayB0aGlzIGRlZmluaXRp b24gc2hvdWxkIG1lbnRpb24gdGhhdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SeKA mW0gT0sgYWRkaW5nIGEgc3RhdGVtZW50IHRoYXQgdGhleSBzaG91bGQgYWxsIGJlIGZyb20gcHJv ZmlsZXMgd2l0aCBjb21wYXRpYmxlIGNsYWltcyB1c2FnZSwgd2hpY2ggSSB0aGluayBpcyB3aGF0 IHlvdeKAmXJlIGFjdHVhbGx5IGFmdGVyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkaW5nIGV2ZW50cyBhbmQgcHJvZmls ZXMuIFRoZXJlIHdhcyBhIHByb3Bvc2FsIHRvIGFkZCBhIG5ldyBjbGFpbSB0byB1bmlxdWVseSBp ZGVudGlmeSB0aGUgcHJvZmlsZS4gSSB0aGluayB3ZSBuZWVkIHRvIGRpc2N1c3MgdGhhdC48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QXMgZGlzY3Vzc2VkIG9u IHRoZSBsaXN0LCB0aGUgcHJvYmxlbSB3aXRoIGFkZGluZyBhIG5ldyDigJxwcm9maWxl4oCdIGNs YWltIGlzIHRoYXQgaXQgZHVwbGljYXRlcyBpbmZvcm1hdGlvbiBhbHJlYWR5IGRlcml2YWJsZSBm cm9tIHRoZSBldmVudCBVUklzLiZuYnNwOyBUaGlzIGNhbiBsZWFkIHRvIGVycm9yIGNvbmRpdGlv bnMgdGhhdCBhcmUgb3RoZXJ3aXNlIGltcG9zc2libGUsDQogYmVjYXVzZSBpbmNvbnNpc3RlbmNp ZXMgY2FuIGFyaXNlLiZuYnNwOyBBbHNvLCBwZXIgdGhlIHByZXZpb3VzIHJlcGx5IGV2ZW50cyBu ZWVkIHRvIGJlIGZyb20gY29tcGF0aWJsZSBwcm9maWxlcyDigJMgbm90IG5lY2Vzc2FyaWx5IHRo ZSBzYW1lIHByb2ZpbGUg4oCTIGFuZCBzbyBhIHNpbmdsZXRvbiDigJxwcm9maWxl4oCdIGNsYWlt IHdvdWxkbuKAmXQgYWN0dWFsbHkgd29yayBpbiB0aGUgZ2VuZXJhbCBjYXNlLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAy MDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5GaWd1cmUgNS4gTWF5YmUgYSBzaWduZWQgZXhhbXBsZSB3b3VsZCBiZSBi ZXR0ZXIsIGVzcGVjaWFsbHkgdGhhdCB0aGUgbmV4dCBwYXJhZ3JhcGggbWVudGlvbnMgdGhhdCBz aWduYXR1cmVzIG9yIGVuY3J5cHRpb24gc2hvdWxkIGJlIHVzZWQuPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMwMDIwNjAiPlVuc2lnbmVkIGtlZXBzIHRoZSBkcmFmdCBzaG9ydGVyLiA7LSk8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNl Y3Rpb24gNC41LCBzZWNvbmQgcGFyYWdyYXBoLiBNZW50aW9ucyB0aGF0ICZxdW90O25vbmNlJnF1 b3Q7IGlzIGFsc28gcmVxdWlyZWQsIGJ1dCB0aGF0IGlzIG5vdCBhY3R1YWxseSB0cnVlLiBJZCBU b2tlbnMgaXNzdWVkIGF0IHRoZSB0b2tlbiBlbmRwb2ludCBmb3IgZXhhbXBsZSB3aWxsIG5vdCBo YXZlIGl0LiBJIHN1Z2dlc3Qgd2UgZHJvcCB0aGUgd2hvbGUgcGFyYWdyYXBoLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Hb29kIGNhdGNoLiZuYnNwOyBJdCBzaG91bGQgcmVhbGx5 IGJlIHF1YWxpZmllZCB0byBzYXkg4oCcaXQgd291bGQgbm90IGNvbnRhaW4gdGhlIGNvcnJlY3Qg JnF1b3Q7bm9uY2UmcXVvdDsgY2xhaW0gdmFsdWUgZm9yIHRoZSBJRCBUb2tlbiB0byBiZSBhY2Nl cHRlZCBpbiBjb250ZXh0cyBmb3Igd2hpY2ggc3Vic3RpdHV0aW9uIGlzIHBvc3NpYmxl4oCdLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IFRoYW5rcyBhZ2FpbiwgTWFyaXVzITxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48YnIgY2xlYXI9 ImFsbCI+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+TWFyaXVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ T24gTW9uLCBKdWwgMzEsIDIwMTcgYXQgMTo0MCBQTSwgWWFyb24gU2hlZmZlciAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9uZi5p ZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGlzIGlzIHRvIGFubm91bmNlIHdvcmtpbmcg Z3JvdXAgbGFzdCBjYWxsIG9uIHRoaXMgZHJhZnQgKDxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtc2VjZXZlbnQtdG9rZW4vIiB0YXJnZXQ9Il9ibGFu ayI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1zZWNldmVudC10 b2tlbi88L2E+KS48YnI+DQo8YnI+DQpQbGVhc2Ugc2VuZCB5b3VyIGNvbW1lbnRzIHRvIHRoZSBs aXN0LiBFdmVuIGlmIHlvdSBhcmUgcGVyZmVjdGx5IGhhcHB5IHdpdGggdGhlIGRyYWZ0LCBwbGVh c2UgbGV0IHVzIGtub3cgdGhhdCB5b3Ugc3VwcG9ydCBpdHMgcHVibGljYXRpb24gYXMtaXMgYnkg cG9zdGluZyB0byB0aGUgbGlzdC48YnI+DQo8YnI+DQpCZWNhdXNlIG9mIHRoZSBzdW1tZXIgaG9s aWRheXMsIHRoaXMgbGFzdCBjYWxsIGlzIG9wZW4gZm9yIDMgd2Vla3MsIHVudGlsIEF1Zy4gMjEu PGJyPg0KPGJyPg0KVGhhbmtzLDxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyBEaWNrIGFuZCBZYXJv bjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQiPjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0i bWFpbHRvOklkLWV2ZW50QGlldGYub3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBo cmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJn ZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVu dDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0K PC9odG1sPg0K --_000_CY4PR21MB05044FEC88C9019A9E9BD146F5470CY4PR21MB0504namp_-- From nobody Mon Oct 23 17:05:44 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5443513AD2D for ; Mon, 23 Oct 2017 17:05:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.018 X-Spam-Level: X-Spam-Status: No, score=-2.018 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HRHOKmPQ3gjo for ; Mon, 23 Oct 2017 17:05:40 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0126.outbound.protection.outlook.com [104.47.38.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A9CE13ACAB for ; Mon, 23 Oct 2017 17:05:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=MhFmt27sYgFHU8kbEFDn/rh+1s61Emq0slwRjuKNOoI=; b=QeVS7UY12iAjghyJ+oiNIOo8q1ys8tFdjJxYB3I5EYqX8GOphCqANRLaXCLfXDQqAqwq1Z2o3D/O9oJkjjaAxzz4go399rkPwgL1LT+ApPG3iwDPCoKSNyRb8t6HuP28tsQJcRw9rxuxZDmSRaAjjVGQTmiLmNI9AMCu8hUwj8w= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0150.namprd21.prod.outlook.com (10.173.189.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Tue, 24 Oct 2017 00:05:38 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 00:05:38 +0000 From: Mike Jones To: Brian Campbell , Phil Hunt CC: ID Events Mailing List Thread-Topic: [Id-event] Replacing "nbf" claim with a new "toe" claim Thread-Index: AQHTN9KpAILmSZE0GUKb7XxJ9mLviKLKa5QAgCfaOrA= Date: Tue, 24 Oct 2017 00:05:38 +0000 Message-ID: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-23T17:05:36.8495930-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:5::42f] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0150; 6:I+SLWMSd3ECFupieMfic5NQuAMyGxP8AO9j0hAL6Mv516uKdZOsIwKITGTr9jH4A82l1qNaSPkhIlxaH3uYogbbmkRkRpcP2+1XjjCtUgwTAqoK6YrX2l3ytgDjPzBlYeTl7CXdJ9cDwF0/FbMxUMiDJVVZT7GNTarZkRp60uiHpt9Td5KyG7nN/bvm2h/4FJcZg7G/oOlVMFBt19HWyrmYs7cMsD50rN9oxaPX85LsxT1eNPOtUi1csgtIa/rVkyoZrfJ0IJIK2hTMyE7Ryw46sSf6CnK6yEy0/7GHopaujLq8zxtzmSDZ8P6yGhQlt8uBy1puYSy+nFWi8/PdPmm+zBatlOCV2d0q0Yaa9QZk=; 5:/9V37T2Ms7EDz3doIsFcRb0cyqQDCbtfTRoawW0l5GsKnqXQ9hPxaMugGh3236kzFIJQIJvtUV+vfTl2mwWUqCocbiitVEgv2cCjxXFJGeNa42npGWeQi+kp+sCti2SYUiaZdHNune4jOSRoDpHG7OFr2XKBjiUVG7jeL4V7G5Y=; 24:9FmlklodKmvxE2CMLS9P2f7x8UiILRxKFTtDb9vVyScqvutzwH9SjmXFj/Mpdam8LdY11u4FDbX/M+hGTrLQdhqDk+asjABbug5466uX6SU=; 7:fZDk6IUEGqGscfHH52t+H53dfZYLrmg0vYUGHsr/7SID7WtWh0xl9gcVCuKV31DqIR+by4XRcPrSAgUXsWiX5kDJA9hdmocJOjFUeciVjCbKvuJiVDTW5NAIyhbN3uzyUunMyotTxAT44ZtM5kGGT81bXgvEisymJmEJU7LIeRmsqn/K4LxrQ2rxx064V84y/v/IkZ4FNSREtnbSfwhIAPfLClORngU8eguNLII9bj2ZReOzvaa3a2HOLT6COswE x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 0da0b260-0d6c-4e92-0358-08d51a72f520 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:CY4PR21MB0150; x-ms-traffictypediagnostic: CY4PR21MB0150: x-exchange-antispam-report-test: UriScan:(21748063052155)(146099531331640); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(3231020)(3002001)(93006095)(93001095)(100000703101)(100105400095)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123558100)(20161123555025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0150; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0150; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(39860400002)(346002)(47760400005)(199003)(189002)(24454002)(36304003)(189998001)(19609705001)(8990500004)(86612001)(22452003)(76176999)(316002)(5890100001)(50986999)(7736002)(74316002)(54356999)(25786009)(86362001)(3660700001)(3280700002)(6436002)(53546010)(110136005)(229853002)(606006)(97736004)(14454004)(6506006)(77096006)(2950100002)(53386004)(6116002)(790700001)(6246003)(55016002)(561944003)(53936002)(102836003)(99286003)(236005)(9686003)(101416001)(33656002)(6306002)(4326008)(2900100001)(54896002)(106356001)(105586002)(966005)(10290500003)(478600001)(72206003)(10090500001)(5660300001)(81166006)(81156014)(8936002)(8676002)(7696004)(68736007)(2906002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0150; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504D2B5C6B828B6868A56ECF5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0da0b260-0d6c-4e92-0358-08d51a72f520 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 00:05:38.2401 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0150 Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:05:42 -0000 --_000_CY4PR21MB0504D2B5C6B828B6868A56ECF5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QW5uYWJlbGxlIGFuZCBJIGFncmVlZCB3aXRoIHRoaXMgcHJvcG9zZWQgY2hhbmdlIChhcyBjb3Jy ZWN0bHkgd29yZHNtaXRoZWQgYnkgQnJpYW4pIGR1cmluZyBvdXIgaW4tcGVyc29uIHJldmlldyDi gJMgYXMgYWxzbyBub3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLg0KDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgVGhhbmtzIFBoaWwgYW5kIGFsbCwNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2 ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJyaWFu IENhbXBiZWxsDQpTZW50OiBUaHVyc2RheSwgU2VwdGVtYmVyIDI4LCAyMDE3IDg6MjMgQU0NClRv OiBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5n IExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gUmVwbGFj aW5nICJuYmYiIGNsYWltIHdpdGggYSBuZXcgInRvZSIgY2xhaW0NCg0KKzEgdG8gU0VUIGRlZmlu aW5nIGEgdGltZSBvZiBldmVudCBjbGFpbSByYXRoZXIgdGhhbiB0cnlpbmcgdG8gcmVkZWZpbmUg YSBzdGFuZGFyZCBjbGFpbS4gQW5kIHdobyBkb2Vzbid0IGxpa2UgYSBjbGFpbSBuYW1lZCAidG9l Ij8NCkhvd2V2ZXIsIHRoZSB0ZXh0IHRoZXJlIGZvciBuYmYgaXMgc3RpbGwgZWZmZWN0aXZlbHkg cmVkZWZpbmluZyBpdCBieSBzYXlpbmcgaXQgc2hvdWxkIGJlIGlnbm9yZWQsIHdoaWNoIGlzbid0 IGNvbnNpc3RlbnQgd2l0aCB0aGUgIk1VU1QgTk9UIGJlIGFjY2VwdGVkIGZvciBwcm9jZXNzaW5n IiBmcm9tIFJGQyA3NTE5LiBJdCB3b3VsZCBiZSBtb3JlIGFwcHJvcHJpYXRlIHRvIHNheSB0aGF0 IG5iZiBzaG91bGQvbXVzdCBub3QgYmUgaW5jbHVkZWQgaW4gYSBTRVQuIE9yIGp1c3Qgbm90IG1l bnRpb24gbmJmIGF0IGFsbC4gQnV0IGRvbid0IGNoYW5nZSB0aGUgbWVhbmluZy4NCkFsc28gdG9l IHdvdWxkIG5vdCBiZSAiRGVmaW5lZCBieSBTZWN0aW9uIDQuMS41IFtSRkM3NTE5XSIsIHdoaWNo IGlzIHRoZSBuYmYgc2VjdGlvbi4gVGhlIHZhbHVlIG9mIHRoZSB0b2UgY2xhaW0gaXMgYSBOdW1l cmljRGF0ZSwgd2hpY2ggaXMgZGVmaW5lZCBpbiBTZWMgMiBSRkM3NTE5LiBCdXQgdG9lIGhhcyBu byByZWxhdGlvbiB0byBuYmYgYW5kIG5vIHJlYXNvbiB0byByZWZlcmVuY2UgbmJmLg0KDQpPbiBX ZWQsIFNlcCAyNywgMjAxNyBhdCAyOjUzIFBNLCBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUu Y29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KRHVyaW5nIHRoZSBPcGVu SUQgUklTQyBGYWNlIHRvIEZhY2UgbWVldGluZyBhIHF1ZXN0aW9uIGNhbWUgdXAgcmVnYXJkaW5n IFNFVOKAmXMgcmVkZWZpbml0aW9uIG9mIOKAnG5iZuKAnSBhbmQgd2hldGhlciB0aGF0IHJlZGVm aW5pdGlvbiB3YXMgYXBwcm9wcmlhdGUuDQoNClRoZSBpbnRlbnRpb24gb2YgU0VUcyBkZWZpbml0 aW9uIGlzIHRvIGFsbG93IFNFVCBUcmFuc21pdHRlcnMgdG8gaW5kaWNhdGUgdGhhdCBhbiBldmVu dCBtYXkgaGF2ZSBvY2N1cnJlZCBhcyBlYXJseSBhcyBhIHNwZWNpZmllZCBkYXRlIOKAlCBhIGRh dGUgd2hpY2ggaXMgZGlmZmVyZW50IGZyb20gdGhlIGlzc3VhbmNlIGRhdGUgb2YgdGhlIFNFVC4g SW4gcGFydGljdWxhciB0aGlzIGlzIHVzZWZ1bCBpbiBjYXNlcyB3aGVyZSB0aGUgc3RhdGUgY2hh bmdlIGlzIGJlbGlldmVkIHRvIGhhdmUgb2NjdXJyZWQgZWFybGllciB0aGFuIHRoZSB0aW1lIG9m IGlzc3VhbmNlIChlLmcuIGJlY2F1c2UgdGhlIGluY2lkZW50IHdhcyBkaXNjb3ZlcmVkIHRocm91 Z2ggYW4gYWRtaW5pc3RyYXRpdmUgcmV2aWV3IG9yIGRhdGEgYW5hbHlzaXMgdG8gaGF2ZSBvY2N1 cnJlZCBpbiB0aGUgcGFzdCkuDQoNClRoZSBkZWZpbml0aW9uIGZyb20gSldUIGlzOg0KNC4xLjU8 aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi00LjEuNT4uICAibmJm IiAoTm90IEJlZm9yZSkgQ2xhaW0NCg0KDQoNCg0KDQogICBUaGUgIm5iZiIgKG5vdCBiZWZvcmUp IGNsYWltIGlkZW50aWZpZXMgdGhlIHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBKV1QNCg0KICAgTVVT VCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcuICBUaGUgcHJvY2Vzc2luZyBvZiB0aGUg Im5iZiINCg0KICAgY2xhaW0gcmVxdWlyZXMgdGhhdCB0aGUgY3VycmVudCBkYXRlL3RpbWUgTVVT VCBiZSBhZnRlciBvciBlcXVhbCB0bw0KDQogICB0aGUgbm90LWJlZm9yZSBkYXRlL3RpbWUgbGlz dGVkIGluIHRoZSAibmJmIiBjbGFpbS4gIEltcGxlbWVudGVycyBNQVkNCg0KICAgcHJvdmlkZSBm b3Igc29tZSBzbWFsbCBsZWV3YXksIHVzdWFsbHkgbm8gbW9yZSB0aGFuIGEgZmV3IG1pbnV0ZXMs IHRvDQoNCiAgIGFjY291bnQgZm9yIGNsb2NrIHNrZXcuICBJdHMgdmFsdWUgTVVTVCBiZSBhIG51 bWJlciBjb250YWluaW5nIGENCg0KICAgTnVtZXJpY0RhdGUgdmFsdWUuICBVc2Ugb2YgdGhpcyBj bGFpbSBpcyBPUFRJT05BTC4NCg0KDQpBcyBkZWZpbmVkIGluIFNFVDoNCg0KICAgbmJmDQoNCiAg ICAgIERlZmluZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV08aHR0cHM6Ly90b29scy5pZXRm Lm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi00LjEuNT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlz IGENCg0KICAgICAgTnVtZXJpY0RhdGUuICBJbiB0aGUgY29udGV4dCBvZiB0aGUgU0VUIHRva2Vu IGl0IFNIQUxMIGJlDQoNCiAgICAgIGludGVycHJldGVkIHRvIG1lYW4gYSBkYXRlIGluIHdoaWNo IHRoZSBldmVudCBpcyBiZWxpZXZlZCB0byBoYXZlDQoNCiAgICAgIG9jY3VycmVkIChpbiB0aGUg cGFzdCkgb3Igd2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiAgTm90ZTogdGhlcmUNCg0KICAgICAg TUFZIGJlIHNvbWUgY2FzZXMgd2hlcmUgIm5iZiIgaXMgc3RpbGwgc21hbGxlciB0aGFuICJpYXQi IHN1Y2ggYXMNCg0KICAgICAgd2hlbiBpdCB0b29rIGFuIGV4dGVuZGVkIHRpbWUgZm9yIGEgU0VU IHRvIGJlIGlzc3VlZCAoZm9yIGV4YW1wbGUNCg0KICAgICAgYWZ0ZXIgc29tZSBhbmFseXNpcyku ICBUaGlzIGNsYWltIGlzIE9QVElPTkFMLg0KDQpUaGVyZSBpcyBhbiBhcmd1bWVudCB0aGF0IHRo ZSByZWRlZmluaXRpb24gd2lsbCBjYXVzZSBjb25mdXNpb24uDQoNClRoZSBwcm9wb3NhbCBpcyB0 byByZWdpc3RlciBhIGRpZmZlcmVudCBjbGFpbSBuYW1lIHN1Y2ggYXMg4oCcdG9l4oCdICh0aW1l IG9mIGV2ZW50KS4gVGhlIHByb3Bvc2VkIG5ldw0KZGVmaW5pdGlvbjoNCg0KDQp0b2UNCg0KICAg ICAgRGVmaW5lZCBieSBTZWN0aW9uIDQuMS41IFtSRkM3NTE5XTxodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMS41PiwgYSBudW1iZXIgd2hvc2UgdmFsdWUgaXMg YQ0KDQogICAgICBOdW1lcmljRGF0ZS4gIFRoZSB2YWx1ZSBpcyB0aGUgZGF0ZSBhbmQgdGltZSBp biB3aGljaCB0aGUgZXZlbnQgaXMgYmVsaWV2ZWQgdG8gaGF2ZQ0KDQogICAgICBvY2N1cnJlZCBp biB0aGUgcGFzdCBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuIFRoaXMgY2xhaW0gaXMgT1BU SU9OQUwuDQoNCiAgICAgIFdoZW4gbm90IGFzc2VydGVkLCB0aGUgdmFsdWUgb2Yg4oCcdG9l4oCd IE1BWSBiZSBhc3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0uDQoNCg0KDQpuYmYN Cg0KICAgICAgVGhpcyBjbGFpbSBpcyBub3QgdXNlZCBpbiBTRVQgRXZlbnRzLiBJZiBhc3NlcnRl ZCwgdGhlIHZhbHVlIFNIT1VMRA0KDQogICAgICBiZSBpZ25vcmVkLg0KDQoNCkFyZSB0aGVyZSBh bnkgb2JqZWN0aW9ucyB0byB0aGUgcHJvcG9zZWQgY2hhbmdlPw0KDQpQaGlsDQoNCk9yYWNsZSBD b3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQpAaW5kZXBlbmRl bnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+ DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50 IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3Jn Pg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudA0KDQoNCkNP TkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZW1haWwgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFs IGFuZCBwcml2aWxlZ2VkIG1hdGVyaWFsIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVk IHJlY2lwaWVudChzKS4gQW55IHJldmlldywgdXNlLCBkaXN0cmlidXRpb24gb3IgZGlzY2xvc3Vy ZSBieSBvdGhlcnMgaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4gIElmIHlvdSBoYXZlIHJlY2VpdmVk IHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGlt bWVkaWF0ZWx5IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkgZmlsZSBh dHRhY2htZW50cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS4NCg== --_000_CY4PR21MB0504D2B5C6B828B6868A56ECF5470CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJTZWdvZSBVSSI7 DQoJcGFub3NlLTE6MiAxMSA1IDIgNCAyIDQgMiAyIDM7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMg Ki8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpoNA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTsN Cgltc28tc3R5bGUtbGluazoiSGVhZGluZyA0IENoYXIiOw0KCW1zby1tYXJnaW4tdG9wLWFsdDph dXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJ bWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUt cHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30N CmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJl DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3Jt YXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCnAubXNvbm9ybWFs MCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9y bWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5IVE1MUHJl Zm9ybWF0dGVkQ2hhcg0KCXttc28tc3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7 DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1h dHRlZCI7DQoJZm9udC1mYW1pbHk6Q29uc29sYXM7fQ0Kc3Bhbi5tNDgxODQ0MDk0OTkwMDk4NTc1 M2g0DQoJe21zby1zdHlsZS1uYW1lOm1fNDgxODQ0MDk0OTkwMDk4NTc1M2g0O30NCnNwYW4uSGVh ZGluZzRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIZWFkaW5nIDQgQ2hhciI7DQoJbXNvLXN0eWxl LXByaW9yaXR5Ojk7DQoJbXNvLXN0eWxlLWxpbms6IkhlYWRpbmcgNCI7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkgTGlnaHQiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzJGNTQ5NjsNCglmb250LXN0eWxl Oml0YWxpYzt9DQpzcGFuLm00ODE4NDQwOTQ5OTAwOTg1NzUzYXBwbGUtc3R5bGUtc3Bhbg0KCXtt c28tc3R5bGUtbmFtZTptXzQ4MTg0NDA5NDk5MDA5ODU3NTNhcHBsZS1zdHlsZS1zcGFuO30NCnNw YW4uRW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERl ZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGlu Ow0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJ e3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+ PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4 dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QW5uYWJlbGxlIGFu ZCBJIGFncmVlZCB3aXRoIHRoaXMgcHJvcG9zZWQgY2hhbmdlIChhcyBjb3JyZWN0bHkgd29yZHNt aXRoZWQgYnkgQnJpYW4pIGR1cmluZyBvdXIgaW4tcGVyc29uIHJldmlldyDigJMgYXMgYWxzbyBu b3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IFRoYW5rcyBQaGlsIGFuZCBhbGwsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBJZC1ldmVudCBb bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIDxiPg0KT24gQmVoYWxmIE9mIDwvYj5C cmlhbiBDYW1wYmVsbDxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgU2VwdGVtYmVyIDI4LCAy MDE3IDg6MjMgQU08YnI+DQo8Yj5Ubzo8L2I+IFBoaWwgSHVudCAmbHQ7cGhpbC5odW50QG9yYWNs ZS5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1l dmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gUmVw bGFjaW5nICZxdW90O25iZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZxdW90OyBj bGFpbTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWJvdHRvbToxMi4wcHQiPiYjNDM7MSB0byBTRVQgZGVmaW5pbmcgYSB0aW1lIG9mIGV2 ZW50IGNsYWltIHJhdGhlciB0aGFuIHRyeWluZyB0byByZWRlZmluZSBhIHN0YW5kYXJkIGNsYWlt LiBBbmQgd2hvIGRvZXNuJ3QgbGlrZSBhIGNsYWltIG5hbWVkICZxdW90O3RvZSZxdW90Oz8NCjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPkhvd2V2ZXIsIHRoZSB0ZXh0IHRoZXJlIGZvciBuYmYgaXMgc3RpbGwg ZWZmZWN0aXZlbHkgcmVkZWZpbmluZyBpdCBieSBzYXlpbmcgaXQgc2hvdWxkIGJlIGlnbm9yZWQs IHdoaWNoIGlzbid0IGNvbnNpc3RlbnQgd2l0aCB0aGUgJnF1b3Q7TVVTVCBOT1QgYmUgYWNjZXB0 ZWQgZm9yIHByb2Nlc3NpbmcmcXVvdDsgZnJvbSBSRkMgNzUxOS4gSXQgd291bGQgYmUgbW9yZSBh cHByb3ByaWF0ZQ0KIHRvIHNheSB0aGF0IG5iZiBzaG91bGQvbXVzdCBub3QgYmUgaW5jbHVkZWQg aW4gYSBTRVQuIE9yIGp1c3Qgbm90IG1lbnRpb24gbmJmIGF0IGFsbC4gQnV0IGRvbid0IGNoYW5n ZSB0aGUgbWVhbmluZy4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5BbHNvIHRvZSB3b3VsZCBub3QgYmUgJnF1b3Q7RGVmaW5lZCBieSBTZWN0aW9uIDQuMS41 IFtSRkM3NTE5XSZxdW90Oywgd2hpY2ggaXMgdGhlIG5iZiBzZWN0aW9uLiBUaGUgdmFsdWUgb2Yg dGhlIHRvZSBjbGFpbSBpcyBhIE51bWVyaWNEYXRlLCB3aGljaCBpcyBkZWZpbmVkIGluIFNlYyAy IFJGQzc1MTkuIEJ1dCB0b2UgaGFzIG5vIHJlbGF0aW9uIHRvIG5iZiBhbmQgbm8gcmVhc29uIHRv IHJlZmVyZW5jZSBuYmYuJm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9uIFdlZCwgU2VwIDI3LCAyMDE3IGF0IDI6NTMgUE0sIFBoaWwgSHVudCAm bHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+ cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0 OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RHVyaW5nIHRoZSBPcGVuSUQgUklT QyBGYWNlIHRvIEZhY2UgbWVldGluZyBhIHF1ZXN0aW9uIGNhbWUgdXAgcmVnYXJkaW5nIFNFVOKA mXMgcmVkZWZpbml0aW9uIG9mIOKAnG5iZuKAnSBhbmQgd2hldGhlciB0aGF0IHJlZGVmaW5pdGlv biB3YXMgYXBwcm9wcmlhdGUuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5UaGUgaW50ZW50aW9uIG9mIFNFVHMgZGVmaW5pdGlvbiBpcyB0byBhbGxvdyBTRVQg VHJhbnNtaXR0ZXJzIHRvIGluZGljYXRlIHRoYXQgYW4gZXZlbnQgbWF5IGhhdmUgb2NjdXJyZWQg YXMgZWFybHkgYXMgYSBzcGVjaWZpZWQgZGF0ZSDigJQgYSBkYXRlIHdoaWNoIGlzIGRpZmZlcmVu dCBmcm9tIHRoZSBpc3N1YW5jZSBkYXRlIG9mIHRoZSBTRVQuIEluIHBhcnRpY3VsYXIgdGhpcyBp cyB1c2VmdWwgaW4gY2FzZXMNCiB3aGVyZSB0aGUgc3RhdGUgY2hhbmdlIGlzIGJlbGlldmVkIHRv IGhhdmUgb2NjdXJyZWQgZWFybGllciB0aGFuIHRoZSB0aW1lIG9mIGlzc3VhbmNlIChlLmcuIGJl Y2F1c2UgdGhlIGluY2lkZW50IHdhcyBkaXNjb3ZlcmVkIHRocm91Z2ggYW4gYWRtaW5pc3RyYXRp dmUgcmV2aWV3IG9yIGRhdGEgYW5hbHlzaXMgdG8gaGF2ZSBvY2N1cnJlZCBpbiB0aGUgcGFzdCku PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRo ZSBkZWZpbml0aW9uIGZyb20gSldUIGlzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PGg0IHN0eWxlPSJtc28tbGluZS1oZWlnaHQtYWx0OjBwdCI+PGEgbmFtZT0ibV80ODE4NDQwOTQ5 OTAwOTg1NzUzX3NlY3Rpb24tNC4xLjUiPjwvYT48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMS41IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9Im1zby1ib29rbWFyazomcXVvdDttXzQ4MTg0NDA5NDk5MDA5ODU3NTNfc2VjdGlvbi00XC4x XC41JnF1b3Q7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjazt0ZXh0LWRlY29yYXRpb246bm9uZSI+NC4x LjU8L3NwYW4+PC9zcGFuPjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6JnF1b3Q7bV80ODE4NDQw OTQ5OTAwOTg1NzUzX3NlY3Rpb24tNFwuMVwuNSZxdW90OyI+PC9zcGFuPjwvYT48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOiZxdW90O21fNDgxODQ0MDk0OTkwMDk4NTc1M19zZWN0aW9uLTRcLjFc LjUmcXVvdDsiPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+LiZuYnNwOw0KICZxdW90O25iZiZxdW90OyAoTm90 IEJlZm9yZSkgQ2xhaW08bzpwPjwvbzpwPjwvc3Bhbj48L2g0Pg0KPHByZT48bzpwPiZuYnNwOzwv bzpwPjwvcHJlPg0KPHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsgVGhlICZxdW90O25iZiZxdW90OyAobm90IGJlZm9yZSkgY2xhaW0gaWRlbnRpZmllcyB0aGUg dGltZSBiZWZvcmUgd2hpY2ggdGhlIEpXVDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyBNVVNUIE5PVCBiZSBhY2NlcHRlZCBmb3IgcHJvY2Vzc2luZy4mbmJzcDsgVGhlIHByb2Nl c3Npbmcgb2YgdGhlICZxdW90O25iZiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyBjbGFpbSByZXF1aXJlcyB0aGF0IHRoZSBjdXJyZW50IGRhdGUvdGltZSBNVVNUIGJl IGFmdGVyIG9yIGVxdWFsIHRvPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRo ZSBub3QtYmVmb3JlIGRhdGUvdGltZSBsaXN0ZWQgaW4gdGhlICZxdW90O25iZiZxdW90OyBjbGFp bS4mbmJzcDsgSW1wbGVtZW50ZXJzIE1BWTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyBwcm92aWRlIGZvciBzb21lIHNtYWxsIGxlZXdheSwgdXN1YWxseSBubyBtb3JlIHRoYW4g YSBmZXcgbWludXRlcywgdG88bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgYWNj b3VudCBmb3IgY2xvY2sgc2tldy4mbmJzcDsgSXRzIHZhbHVlIE1VU1QgYmUgYSBudW1iZXIgY29u dGFpbmluZyBhPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IE51bWVyaWNEYXRl IHZhbHVlLiZuYnNwOyBVc2Ugb2YgdGhpcyBjbGFpbSBpcyBPUFRJT05BTC48bzpwPjwvbzpwPjwv cHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIGRlZmluZWQg aW4gU0VUOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsg bmJmPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkj c2VjdGlvbi00LjEuNSIgdGFyZ2V0PSJfYmxhbmsiPlNlY3Rpb24mbmJzcDs0LjEuNSBbUkZDNzUx OV08L2E+LCBhIG51bWJlciB3aG9zZSB2YWx1ZSBpcyBhPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE51bWVyaWNEYXRlLiZuYnNwOyBJbiB0aGUg Y29udGV4dCBvZiB0aGUgU0VUIHRva2VuIGl0IFNIQUxMIGJlPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGludGVycHJldGVkIHRvIG1lYW4gYSBk YXRlIGluIHdoaWNoIHRoZSBldmVudCBpcyBiZWxpZXZlZCB0byBoYXZlPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IG9jY3VycmVkIChpbiB0aGUg cGFzdCkgb3Igd2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiZuYnNwOyBOb3RlOiB0aGVyZTxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBNQVkgYmUg c29tZSBjYXNlcyB3aGVyZSAmcXVvdDtuYmYmcXVvdDsgaXMgc3RpbGwgc21hbGxlciB0aGFuICZx dW90O2lhdCZxdW90OyBzdWNoIGFzPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IHdoZW4gaXQgdG9vayBhbiBleHRlbmRlZCB0aW1lIGZvciBhIFNF VCB0byBiZSBpc3N1ZWQgKGZvciBleGFtcGxlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGFmdGVyIHNvbWUgYW5hbHlzaXMpLiZuYnNwOyBUaGlz IGNsYWltIGlzIE9QVElPTkFMLjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGlzIGFuIGFyZ3VtZW50IHRoYXQgdGhlIHJlZGVmaW5p dGlvbiB3aWxsIGNhdXNlIGNvbmZ1c2lvbi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIHByb3Bvc2FsIGlzIHRvIHJlZ2lzdGVy IGEgZGlmZmVyZW50IGNsYWltIG5hbWUgc3VjaCBhcyDigJx0b2XigJ0gKHRpbWUgb2YgZXZlbnQp LiBUaGUgcHJvcG9zZWQgbmV3PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5kZWZpbml0aW9uOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cHJlPnRvZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBEZWZpbmVkIGJ5IDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9y ZmM3NTE5I3NlY3Rpb24tNC4xLjUiIHRhcmdldD0iX2JsYW5rIj5TZWN0aW9uJm5ic3A7NC4xLjUg W1JGQzc1MTldPC9hPiwgYSBudW1iZXIgd2hvc2UgdmFsdWUgaXMgYTxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBOdW1lcmljRGF0ZS4mbmJzcDsg VGhlIHZhbHVlIGlzIHRoZSBkYXRlIGFuZCB0aW1lIGluIHdoaWNoIHRoZSBldmVudCBpcyBiZWxp ZXZlZCB0byBoYXZlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IG9jY3VycmVkIGluIHRoZSBwYXN0IG9yIHdpbGwgb2NjdXIgaW4gdGhlIGZ1dHVy ZS4gVGhpcyBjbGFpbSBpcyBPUFRJT05BTC48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgV2hlbiBub3QgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBvZiDi gJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhlIHZhbHVlIG9mIOKAnGlhdOKAnS48bzpw PjwvbzpwPjwvcHJlPg0KPHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZT5uYmY8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgVGhpcyBj bGFpbSBpcyBub3QgdXNlZCBpbiBTRVQgRXZlbnRzLiBJZiBhc3NlcnRlZCwgdGhlIHZhbHVlIFNI T1VMRDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyBiZSBpZ25vcmVkLjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+QXJlIHRoZXJlIGFueSBvYmplY3Rpb25zIHRvIHRoZSBwcm9wb3NlZCBj aGFuZ2U/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+UGhpbDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5PcmFj bGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50aWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20iIHRhcmdldD0iX2Js YW5rIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQi Pjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJy Pg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGll dGYub3JnIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwv cD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxiPjxpPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzU1NTU1NTtib3JkZXI6bm9uZSB3aW5kb3d0ZXh0IDEuMHB0 O3BhZGRpbmc6MGluIj5DT05GSURFTlRJQUxJVFkgTk9USUNFOiBUaGlzIGVtYWlsIG1heSBjb250 YWluIGNvbmZpZGVudGlhbCBhbmQgcHJpdmlsZWdlZCBtYXRlcmlhbCBmb3IgdGhlIHNvbGUgdXNl IG9mIHRoZSBpbnRlbmRlZCByZWNpcGllbnQocykuDQogQW55IHJldmlldywgdXNlLCBkaXN0cmli dXRpb24gb3IgZGlzY2xvc3VyZSBieSBvdGhlcnMgaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4mbmJz cDsgSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9uIGluIGVycm9yLCBwbGVh c2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYnkgZS1tYWlsIGFuZCBkZWxldGUgdGhl IG1lc3NhZ2UgYW5kIGFueSBmaWxlIGF0dGFjaG1lbnRzIGZyb20geW91ciBjb21wdXRlci4gVGhh bmsgeW91Ljwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_CY4PR21MB0504D2B5C6B828B6868A56ECF5470CY4PR21MB0504namp_-- From nobody Mon Oct 23 17:47:51 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FACD13AF04 for ; Mon, 23 Oct 2017 17:47:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.45 X-Spam-Level: X-Spam-Status: No, score=-0.45 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NS4Pxcw2P1yI for ; Mon, 23 Oct 2017 17:47:47 -0700 (PDT) Received: from mail-io0-x236.google.com (mail-io0-x236.google.com [IPv6:2607:f8b0:4001:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15880138BD8 for ; Mon, 23 Oct 2017 17:47:47 -0700 (PDT) Received: by mail-io0-x236.google.com with SMTP id j17so22074169iod.5 for ; Mon, 23 Oct 2017 17:47:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=oXKPy+gA5pUyXuA3kFifQfb7ermM6b54wYZH/KClFc0=; b=dOsRGJM0qCuMnzUzX8hqi8jgjF6CczeQf1n3u6qaYMRGIF4pggubd7XTiqkhwDYP8P KQS7Rq/BwXIP+JjlcTDw3upCM+C8Lysl71cDWRl3VorTsI8L0YzFm7xkedpnMTJjXPFP B5+Iq814p2/zlYPnjkPbJdBC/kyrrEhN3XkeiYCMM3liXZ6ZtMDPm4yimvsAo8C1y5r5 AVmYIHIjtv4YSYHPbbdW7A2KeHcdciqZtzoyOuTLdtieCy7yfKgjpabgjHUI0AbeCXTT EL9jjpObQE5jmKFAczvM08gNVaoDbZkc25ZbOA+bYW+HurgoNVTWcLH6k10tGqEmabq/ acFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=oXKPy+gA5pUyXuA3kFifQfb7ermM6b54wYZH/KClFc0=; b=dZWt1O2hMuhyHn1qktBu7ZAekDMkl8LQMqaVCMTRG1kuAEpG8WKqJ14o6Fiwko78iS zh5ID0uSHShC47qg18F13QkuTnRkvui6mhvnkxmYP0s4iYowOucNQKcVrCv/KbeZmehf DSncH6Dm91Jd1DSLvpUtYyVRpGRuy+t/advzyMpRbRT2gT+FuaKjUmLxeBZ0A1GCMqSp Wp06Xx3OUSkJOCb7hKYGP1Lf7RCBfEZTg9DlmZYQKoKr6IBR2tJG9W7W4qK/eFa0Jymh wvzMrk6fM2Ju54jQ6noB5y4uXTx+xXXZt9bFcWXh2FwUcfPD+mcCHBcfW20KvOh86uQB OFVw== X-Gm-Message-State: AMCzsaVJcDFNrsef/+Ehep7gxZ/Iqmvs4mp1npJXHiLlBpQfARec7WdU omM2P+pWub1kfXbbuJSDy/zeKnSVXnPdveCGLPm4VupJ X-Google-Smtp-Source: ABhQp+RebYgFaCwm4fFAEO2Xo+2SlItfbhckpgkq+gWIoW9RrEFO/y8caXP5XisWunxvgG72fSu/JefsCK87reDwheU= X-Received: by 10.107.168.103 with SMTP id r100mr19558937ioe.158.1508806066039; Mon, 23 Oct 2017 17:47:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Mon, 23 Oct 2017 17:47:25 -0700 (PDT) In-Reply-To: <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> From: Marius Scurtescu Date: Mon, 23 Oct 2017 17:47:25 -0700 Message-ID: To: Phil Hunt Cc: ID Events Mailing List Content-Type: multipart/alternative; boundary="001a11427c389a6cf6055c4049b8" Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:47:50 -0000 --001a11427c389a6cf6055c4049b8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt wrote: > It=E2=80=99s quite relevant to those with distributed architectures. > > If an Event Stream requires that SETs need to be encrypted (using JWE), > the SETs needs to be encrypted so the =E2=80=9Creceiver" can read it. Re= gardless, > =E2=80=9Caud=E2=80=9D should be interpreted by the traditional JWT method= which suggests > the security domain the event is for. For example, a web site relying > party does not have the capability to process (or issue) events itself (e= g. > because of a distributed architecture). The relying party assigns another > entity the role of Event Receiver (or Transmitter). > > The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for =E2= =80=9Caud=E2=80=9D then only the > =E2=80=9Caud=E2=80=9D entity can read the SET which will make it impossib= le to for another > server to handle or worse, it would require sharing of private keys. > The RP controls the configuration of the stream, so they can specify an endpoint that belongs to the outsourced receiver and they can also specify an encryption key that is controlled by the outsourced receiver. The RP does not need access to the private key at all. I still think it is irrelevant to the transmitter, or to this spec. I agree it is totally relevant for the RP, > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > > On Oct 23, 2017, at 3:58 PM, Marius Scurtescu > wrote: > > I think "aud" should point to the Receiver, the outsourcing is irrelevant= . > > Nothing needs to change here IMO. > > Marius > > On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt wrote: > >> It seems reasonable to further clarify that the definition of a receiver >> could be improved. >> >> I propose to change from: >> >> Event Receiver >> An Event Receiver is an entity that receives SETs through some >> distribution method. >> >> >> To: >> >> Event Receiver >> An Event Receiver is an entity that receives SETs through some >> distribution method. An Event Receiver MAY be a different >> >> entity than that described by the =E2=80=9Caud=E2=80=9D claim. >> >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> >> phil.hunt@oracle.com >> >> On Oct 23, 2017, at 2:38 PM, Marius Scurtescu >> wrote: >> >> I think "aud" is perfectly fine. >> >> IMO it should make no difference for the Transmitter that the event is >> actually handled by an outsourced entity, the RP trusts that entity and = the >> event is generated and targeted to the RP and not to the current outsour= ced >> processor. >> >> Marius >> >> On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt wrote= : >> >>> >>> All, >>> >>> I am reviewing the previous feedback from WGLC and will be bringing up >>> any unresolved issues for quick discussion/confirmation=E2=80=A6 >>> >>> Following up on Marius and Henk=E2=80=99s comment, I am concerned that = =E2=80=9Caud=E2=80=9D has >>> a very specific meaning and is often tied to a security domain definiti= on. >>> We should not necessarily say this is the receiver though it often turn= s >>> out to be. For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced even= ts processing to a >>> third party (the so called receiver). >>> >>> I am happy with the current claim set, but maybe some text explaining >>> that a receiver does not have to be the aud is appropriate? I don=E2= =80=99t see >>> any benefit to having a receiver claim as this could complicate process= ing >>> more than its worth. >>> >>> There are a few other comments in this thread, but this one seemed the >>> most unresolved. >>> >>> Phil >>> >>> >>> On Aug 3, 2017, at 8:03 AM, Henk Birkholz >> de> wrote: >>> >>> Hello, >>> >>> to me, the "audience" claim seems to be a good choice here. >>> >>> Viele Gr=C3=BC=C3=9Fe, >>> >>> Henk >>> >>> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>> >>> The abstract mentions "issuer" and "receiver" in the last sentence. >>> "receiver" does not sound right (that should be used in the context of = a >>> transmitter), but I don't have a better suggestion. Audience? >>> The last paragraph of section 1 mentions "subscriber". I think it shoul= d >>> be either "receiver" or "audience". >>> The explanation for figure 1 states that the issuer denotes the >>> transmitter. If the issuer and the transmitter are assumed to be the sa= me >>> entity, then the transmitter definition in section 1.2 should make that >>> clear. >>> Figure 3, I think the "sub" claim should be nested in the event, next t= o >>> the issuer that provides the correct context. The "iss" and "sub" >>> definitions in 2.1 also touch on this, providing conflicting advice. >>> Section 2,1, definition of "nbf". The definition says that this is the >>> event time. I see two problems: >>> - the name suggest "not before", not exactly the same as event time >>> - there can be multiple events >>> maybe this claim should be dropped? >>> Section 2.1, definition of "exp". Omitting this claim is the short term >>> solution to the confusion issue. Why not mention that and that it SHOUL= D >>> NOT be used? >>> Section 2.1, definition of "events". It states that all events must >>> refer to the same logical event. Lately in discussions we reached the >>> conclusion that all events in a SET should be defined in the same profi= le, >>> which is a stronger requirement. I think this definition should mention >>> that. >>> Regarding events and profiles. There was a proposal to add a new claim >>> to uniquely identify the profile. I think we need to discuss that. >>> Figure 5. Maybe a signed example would be better, especially that the >>> next paragraph mentions that signatures or encryption should be used. >>> Section 4.5, second paragraph. Mentions that "nonce" is also required, >>> but that is not actually true. Id Tokens issued at the token endpoint f= or >>> example will not have it. I suggest we drop the whole paragraph. >>> Marius >>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer >> mailto:yaronf.ietf@gmail.com >> wrote: >>> This is to announce working group last call on this draft >>> (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__dat >>> atracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DD >>> wIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5bi >>> RrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4l >>> vS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw= &e=3D >>> >> =3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent- >>> 2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057Sb >>> K10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV >>> 9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl >>> 6cxjlKfjqT99u5-Ojw4Fw&e=3D >). >>> Please send your comments to the list. Even if you are perfectly >>> happy with the draft, please let us know that you support its >>> publication as-is by posting to the list. >>> Because of the summer holidays, this last call is open for 3 weeks, >>> until Aug. 21. >>> Thanks, >>> Dick and Yaron >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org > >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. >>> ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCga >>> WHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEi >>> vzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfA >>> uUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >> tps://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. >>> ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3D >>> RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0 >>> FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXE >>> ZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D > >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY >>> &s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY >>> &s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >>> >>> >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> >>> >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_ > tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e=3D > > > --001a11427c389a6cf6055c4049b8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On M= on, Oct 23, 2017 at 4:15 PM, Phil Hunt <phil.hunt@orac= le.com> wrote:
It=E2=80=99s quite relevant to those with di= stributed architectures.

If an Event Stream requir= es that SETs need to be encrypted (using JWE), the SETs needs to be encrypt= ed so the =E2=80=9Creceiver" can read it.=C2=A0 Regardless, =E2=80=9Ca= ud=E2=80=9D should be interpreted by the traditional JWT method which sugge= sts the security domain the event is for.=C2=A0 For example, a web site rel= ying party does not have the capability to process (or issue) events itself= (eg. because of a distributed architecture). The relying party assigns ano= ther entity the role of Event Receiver (or Transmitter). =C2=A0
<= br>
The problem being that If the =E2=80=9Cset=E2=80=9D is encryp= ted for =E2=80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity ca= n read the SET which will make it impossible to for another server to handl= e or worse, it would require sharing of private keys.=C2=A0

The RP controls the configuration of the strea= m, so they can specify an endpoint that belongs to the outsourced receiver = and they can also specify an encryption key that is controlled by the outso= urced receiver. The RP does not need access to the private key at all.

I still think it is irrelevant to the transmitter, or = to this spec. I agree it is totally relevant for the RP,



=
Phil

Oracle Corporation, Identity Cloud Services Architect
@inde= pendentid
phil.hunt@oracle.com
<= /div>

On Oc= t 23, 2017, at 3:58 PM, Marius Scurtescu <mscurtescu@google.com>= wrote:

<= /div>
I think "aud&q= uot; should point to the Receiver, the outsourcing is irrelevant.

<= /div>
Nothing needs to change here IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> wrote:
It seems reasona= ble to further clarify that the definition of a receiver could be improved.=

I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
Event Recei= ver An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different
      entity than=
 that described by the =E2=80=9Caud=E2=80=9D claim.

Phil

Oracle Corporation, Ident= ity Cloud Services Architect
@independentid
phil.hunt@oracle.com

On Oct 23, 2017, at 2:38 PM, Marius= Scurtescu <mscurtescu@google.com> wrote:

I think "aud" is perfectly fine.

I= MO it should make no difference for the Transmitter that the event is actua= lly handled by an outsourced entity, the RP trusts that entity and the even= t is generated and targeted to the RP and not to the current outsourced pro= cessor.

Marius

On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt = <phil.hunt@oracle.com> wrote:

All,
<= div>
I am reviewing the previous feedback from WGLC and will = be bringing up any unresolved issues for quick discussion/confirmation=E2= =80=A6

Following up on Marius and Henk=E2=80=99s c= omment, I am concerned that =E2=80=9Caud=E2=80=9D has a very specific meani= ng and is often tied to a security domain definition. We should not necessa= rily say this is the receiver though it often turns out to be. For example = a RP (=E2=80=9Caud=E2=80=9D) has outsourced events processing to a third pa= rty (the so called receiver).

I am happy with the = current claim set, but maybe some text explaining that a receiver does not = have to be the aud is appropriate?=C2=A0 I don=E2=80=99t see any benefit to= having a receiver claim as this could complicate processing more than its = worth.

There are a few other comments in this thre= ad, but this one seemed the most unresolved.

Phil<= /div>


On Aug 3, = 2017, at 8:03 AM, Henk Birkholz <henk.birkholz@sit.fraunhofer= .de> wrote:

Hello,

to m= e, the "audience" claim seems to be a good choice here.
Viele Gr=C3=BC=C3=9Fe,

Henk

On 08/02= /2017 11:45 PM, Marius Scurtescu wrote:
The abstr= act mentions "issuer" and "receiver" in the last senten= ce. "receiver" does not sound right (that should be used in the c= ontext of a transmitter), but I don't have a better suggestion. Audienc= e?
The last paragraph of section 1 mentions "subscriber". I th= ink it should be either "receiver" or "audience".
Th= e explanation for figure 1 states that the issuer denotes the transmitter. = If the issuer and the transmitter are assumed to be the same entity, then t= he transmitter definition in section 1.2 should make that clear.
Figure = 3, I think the "sub" claim should be nested in the event, next to= the issuer that provides the correct context. The "iss" and &quo= t;sub" definitions in 2.1 also touch on this, providing conflicting ad= vice.
Section 2,1, definition of "nbf". The definition says th= at this is the event time. I see two problems:
- the name suggest "= not before", not exactly the same as event time
- there can be mult= iple events
maybe this claim should be dropped?
Section 2.1, definiti= on of "exp". Omitting this claim is the short term solution to th= e confusion issue. Why not mention that and that it SHOULD NOT be used?
= Section 2.1, definition of "events". It states that all events mu= st refer to the same logical event. Lately in discussions we reached the co= nclusion that all events in a SET should be defined in the same profile, wh= ich is a stronger requirement. I think this definition should mention that.=
Regarding events and profiles. There was a proposal to add a new claim = to uniquely identify the profile. I think we need to discuss that.
Figur= e 5. Maybe a signed example would be better, especially that the next parag= raph mentions that signatures or encryption should be used.
Section 4.5,= second paragraph. Mentions that "nonce" is also required, but th= at is not actually true. Id Tokens issued at the token endpoint for example= will not have it. I suggest we drop the whole paragraph.
Marius
On M= on, Jul 31, 2017 at 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com=C2=A0<mailto:yaronf.ietf@gmail.com<= /a>>> wrote:
=C2=A0=C2=A0=C2=A0This is to announce working group l= ast call on this draft
=C2=A0=C2=A0=C2=A0(https://urlde= fense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_do= c_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1Yum= CXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSe= GJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2= F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&am= p;e=3D=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<= ;https://urldefense.proofpoint.com/v2/url?u=3Dht= tps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_= &d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK= 10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFE= V9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54I= Rl6cxjlKfjqT99u5-Ojw4Fw&e=3D=C2=A0>).
=C2=A0=C2=A0=C2=A0Please send your comments to the list. Even= if you are perfectly
=C2=A0=C2=A0=C2=A0happy with the draft, please let= us know that you support its
=C2=A0=C2=A0=C2=A0publication as-is by pos= ting to the list.
=C2=A0=C2=A0=C2=A0Because of the summer holidays, this= last call is open for 3 weeks,
=C2=A0=C2=A0=C2=A0until Aug. 21.
=C2= =A0=C2=A0=C2=A0Thanks,
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0D= ick and Yaron
=C2=A0=C2=A0=C2=A0___________________________________= ____________
=C2=A0=C2=A0=C2=A0Id-event mailing list
=C2=A0=C2=A0=C2= =A0= Id-event@ietf.org=C2=A0<mailto:Id-= event@ietf.org>
=C2=A0=C2=A0=C2=A0https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2= Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057Sb= K10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DU= UydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8= pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0<https://urldefense.proofpoint.= com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2D= event&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY0= 57SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0>
_______________________________________________<= br>Id-event mailing list
Id-event@ietf.org
https://urldefense.proofp= oint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2D= event&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY0= 57SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0

________= _______________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint= .com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057Sb= K10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DU= UydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8= pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D



_______________________________________________
Id-event mailing list
Id-= event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= br>


_______________________________________________
Id-event mailing li= st
Id-event@ietf.org
https://urldefense.proofpoint.= com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent= &d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK= 10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4B= pCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e=3D
=

--001a11427c389a6cf6055c4049b8-- From nobody Mon Oct 23 17:48:10 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64D6E138BD8 for ; Mon, 23 Oct 2017 17:47:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.008 X-Spam-Level: X-Spam-Status: No, score=-5.008 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NzEDmbGPtJW9 for ; Mon, 23 Oct 2017 17:47:48 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2AFC13AEFD for ; Mon, 23 Oct 2017 17:47:48 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9O0llFB003541 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 00:47:47 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9O0lkKm011593 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 00:47:47 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9O0ljR8002884; Tue, 24 Oct 2017 00:47:46 GMT Received: from [192.168.1.9] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 17:47:45 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-C3308EAA-9730-46D1-8DE8-F3A1D4944EE5 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Mon, 23 Oct 2017 17:47:42 -0700 Cc: Brian Campbell , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> To: Mike Jones X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:47:51 -0000 --Apple-Mail-C3308EAA-9730-46D1-8DE8-F3A1D4944EE5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Agreed +1 on Brian's edits.=20 Phil > On Oct 23, 2017, at 5:05 PM, Mike Jones wrot= e: >=20 > Annabelle and I agreed with this proposed change (as correctly wordsmithed= by Brian) during our in-person review =E2=80=93 as also noted in the reply t= o Marius=E2=80=99 comments. > =20 > Thanks Phi= l and all, > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Brian Camp= bell > Sent: Thursday, September 28, 2017 8:23 AM > To: Phil Hunt > Cc: ID Events Mailing List > Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim > =20 > +1 to SET defining a time of event claim rather than trying to redefine a s= tandard claim. And who doesn't like a claim named "toe"? >=20 > However, the text there for nbf is still effectively redefining it by sayi= ng it should be ignored, which isn't consistent with the "MUST NOT be accept= ed for processing" from RFC 7519. It would be more appropriate to say that n= bf should/must not be included in a SET. Or just not mention nbf at all. But= don't change the meaning. >=20 > Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is the n= bf section. The value of the toe claim is a NumericDate, which is defined in= Sec 2 RFC7519. But toe has no relation to nbf and no reason to reference nb= f.=20 > =20 > On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt wrote: > During the OpenID RISC Face to Face meeting a question came up regarding S= ET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that redefini= tion was appropriate. > =20 > The intention of SETs definition is to allow SET Transmitters to indicate t= hat an event may have occurred as early as a specified date =E2=80=94 a date= which is different from the issuance date of the SET. In particular this is= useful in cases where the state change is believed to have occurred earlier= than the time of issuance (e.g. because the incident was discovered through= an administrative review or data analysis to have occurred in the past). > =20 > The definition from JWT is: > 4.1.5. "nbf" (Not Before) Claim >=20 > =20 > =20 > The "nbf" (not before) claim identifies the time before which the JWT > MUST NOT be accepted for processing. The processing of the "nbf" > claim requires that the current date/time MUST be after or equal to > the not-before date/time listed in the "nbf" claim. Implementers MAY > provide for some small leeway, usually no more than a few minutes, to > account for clock skew. Its value MUST be a number containing a > NumericDate value. Use of this claim is OPTIONAL. > =20 > =20 > As defined in SET: > nbf > Defined by Section 4.1.5 [RFC7519], a number whose value is a > NumericDate. In the context of the SET token it SHALL be > interpreted to mean a date in which the event is believed to have > occurred (in the past) or will occur in the future. Note: there > MAY be some cases where "nbf" is still smaller than "iat" such as > when it took an extended time for a SET to be issued (for example > after some analysis). This claim is OPTIONAL. > =20 > There is an argument that the redefinition will cause confusion.=20 > =20 > The proposal is to register a different claim name such as =E2=80=9Ctoe=E2= =80=9D (time of event). The proposed new > definition: > =20 > toe > Defined by Section 4.1.5 [RFC7519], a number whose value is a > NumericDate. The value is the date and time in which the event is b= elieved to have > occurred in the past or will occur in the future. This claim is OPTI= ONAL. > When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed= to be the value of =E2=80=9Ciat=E2=80=9D. > =20 > nbf > This claim is not used in SET Events. If asserted, the value SHOULD > be ignored. > =20 > =20 > Are there any objections to the proposed change? > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event >=20 > =20 >=20 > CONFIDENTIALITY NOTICE: This email may contain confidential and privileged= material for the sole use of the intended recipient(s). Any review, use, di= stribution or disclosure by others is strictly prohibited. If you have rece= ived this communication in error, please notify the sender immediately by e-= mail and delete the message and any file attachments from your computer. Tha= nk you. > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCB= jUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D= =20 --Apple-Mail-C3308EAA-9730-46D1-8DE8-F3A1D4944EE5 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Agreed +1 on Brian's edits. 
<= br>Phil

On Oct 23, 2017, at 5:05 PM, Mike Jones <Michael.Jones@microsoft.com> wro= te:

Annabelle and I agreed w= ith this proposed change (as correctly wordsmithed by Brian) during our in-p= erson review =E2=80=93 as also noted in the reply to Marius=E2=80=99 comment= s.

 

    = ;            &nb= sp;            &= nbsp;            = ;            &nb= sp;         Thanks Phil and all,

    = ;            &nb= sp;            &= nbsp;            = ;            &nb= sp;         -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Brian Campbell
Sent: Thursday, September 28, 2017 8:23 AM
To: Phil Hunt <phil.hunt@o= racle.com>
Cc: ID Events Mailing List <i= d-event@ietf.org>
Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim<= o:p>

 

+1 to SET defining a t= ime of event claim rather than trying to redefine a standard claim. And who d= oesn't like a claim named "toe"?

However, the text ther= e for nbf is still effectively redefining it by saying it should be ignored,= which isn't consistent with the "MUST NOT be accepted for processing" from R= FC 7519. It would be more appropriate to say that nbf should/must not be included in a SET. Or just not mention n= bf at all. But don't change the meaning.

Also toe would not be "Defined by Section 4.1.5 [RFC7= 519]", which is the nbf section. The value of the toe claim is a NumericDate= , which is defined in Sec 2 RFC7519. But toe has no relation to nbf and no r= eason to reference nbf. 

 

On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com= > wrote:

During the OpenID RISC Face to Face meeting a questio= n came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and w= hether that redefinition was appropriate.

 

The intention of SETs definition is to allow SET Tran= smitters to indicate that an event may have occurred as early as a specified= date =E2=80=94 a date which is different from the issuance date of the SET.= In particular this is useful in cases where the state change is believed to have occurred earlier than the time o= f issuance (e.g. because the incident was discovered through an administrati= ve review or data analysis to have occurred in the past).

 

The definition from JWT is:

<= span style=3D"font-size:10.0pt;font-family:"Courier New";color:bla= ck;text-decoration:none">4.1.5.  "nbf" (Not Before) Claim

 
 
   The "nbf" (not before) claim identifies the time before wh=
ich the JWT
   MUST NOT be accepted for processing.  The processing o=
f the "nbf"
   claim requires that the current date/time MUST be after or=
 equal to
   the not-before date/time listed in the "nbf" claim.  I=
mplementers MAY
   provide for some small leeway, usually no more than a few m=
inutes, to
   account for clock skew.  Its value MUST be a number c=
ontaining a
   NumericDate value.  Use of this claim is OPTIONAL.

 

 

As defined in SET:

   nbf
      Defined by Section 4.1.5 [RFC7519], a number who=
se value is a
      NumericDate.  In the context of the=
 SET token it SHALL be
      interpreted to mean a date in which the e=
vent is believed to have
      occurred (in the past) or will occur in t=
he future.  Note: there
      MAY be some cases where "nbf" is still s=
maller than "iat" such as
      when it took an extended time for a SET t=
o be issued (for example
      after some analysis).  This claim i=
s OPTIONAL.

 

There is an argument that the redefinition will cause= confusion. 

 

The proposal is to register a different claim name su= ch as =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new

=

definition:

 

toe
      Defined by Section 4.1.5 [RFC7519], a number who=
se value is a
      NumericDate.  The value is the date=
 and time in which the event is believed to have
      occurred in the past or will occur in th=
e future. This claim is OPTIONAL.
      When not asserted, the value of =E2=80=9C=
toe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.
 
nbf
      This claim is not used in SET Events. If=
 asserted, the value SHOULD
      be ignored.

 

 

Are there any objections to the proposed change?=

 

Phil

 <= /p>

Oracle Corporation, Ident= ity Cloud Services Architect

@independentid=

phil.hunt@oracle.com<= /p>

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/m= ailman/listinfo/id-event

 


CONFIDENTIALIT= Y NOTICE: This email may contain confidential and privileged material for th= e sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibite= d.  If you have received this communication in error, please notify the= sender immediately by e-mail and delete the message and any file attachment= s from your computer. Thank you.

= --Apple-Mail-C3308EAA-9730-46D1-8DE8-F3A1D4944EE5-- From nobody Mon Oct 23 17:49:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B75E5139976 for ; Mon, 23 Oct 2017 17:49:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.969 X-Spam-Level: X-Spam-Status: No, score=-1.969 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P8yw8Umo1ain for ; Mon, 23 Oct 2017 17:49:45 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28371139507 for ; Mon, 23 Oct 2017 17:49:45 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9O0ng81007701 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 00:49:43 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9O0ng5D015668 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 00:49:42 GMT Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9O0ngmw016952; Tue, 24 Oct 2017 00:49:42 GMT Received: from [192.168.1.9] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 17:49:41 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-E8FB1075-D3B6-446C-A25F-EFFB9668A313 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Mon, 23 Oct 2017 17:49:40 -0700 Cc: ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> To: Marius Scurtescu X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:49:48 -0000 --Apple-Mail-E8FB1075-D3B6-446C-A25F-EFFB9668A313 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ok. But you raised the concern. Are you withdrawing it? Phil > On Oct 23, 2017, at 5:47 PM, Marius Scurtescu wrot= e: >=20 >> On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt wrote: >> It=E2=80=99s quite relevant to those with distributed architectures. >>=20 >> If an Event Stream requires that SETs need to be encrypted (using JWE), t= he SETs needs to be encrypted so the =E2=80=9Creceiver" can read it. Regard= less, =E2=80=9Caud=E2=80=9D should be interpreted by the traditional JWT met= hod which suggests the security domain the event is for. For example, a web= site relying party does not have the capability to process (or issue) event= s itself (eg. because of a distributed architecture). The relying party assi= gns another entity the role of Event Receiver (or Transmitter). =20 >>=20 >> The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for =E2=80= =9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can read the SET w= hich will make it impossible to for another server to handle or worse, it wo= uld require sharing of private keys.=20 >=20 > The RP controls the configuration of the stream, so they can specify an en= dpoint that belongs to the outsourced receiver and they can also specify an e= ncryption key that is controlled by the outsourced receiver. The RP does not= need access to the private key at all. >=20 > I still think it is irrelevant to the transmitter, or to this spec. I agre= e it is totally relevant for the RP, >=20 >=20 >>=20 >> Phil >>=20 >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >>> On Oct 23, 2017, at 3:58 PM, Marius Scurtescu wr= ote: >>>=20 >>> I think "aud" should point to the Receiver, the outsourcing is irrelevan= t. >>>=20 >>> Nothing needs to change here IMO. >>>=20 >>> Marius >>>=20 >>>> On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt wrote= : >>>> It seems reasonable to further clarify that the definition of a receive= r could be improved. >>>>=20 >>>> I propose to change from: >>>> Event Receiver >>>> An Event Receiver is an entity that receives SETs through some >>>> distribution method. >>>>=20 >>>> To: >>>> Event Receiver >>>> An Event Receiver is an entity that receives SETs through some >>>> distribution method. An Event Receiver MAY be a different >>>> entity than that described by the =E2=80=9Caud=E2=80=9D claim. >>>>=20 >>>> Phil >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>> @independentid >>>> www.independentid.com >>>> phil.hunt@oracle.com >>>>=20 >>>>> On Oct 23, 2017, at 2:38 PM, Marius Scurtescu w= rote: >>>>>=20 >>>>> I think "aud" is perfectly fine. >>>>>=20 >>>>> IMO it should make no difference for the Transmitter that the event is= actually handled by an outsourced entity, the RP trusts that entity and the= event is generated and targeted to the RP and not to the current outsourced= processor. >>>>>=20 >>>>> Marius >>>>>=20 >>>>>> On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt wr= ote: >>>>>>=20 >>>>>> All, >>>>>>=20 >>>>>> I am reviewing the previous feedback from WGLC and will be bringing u= p any unresolved issues for quick discussion/confirmation=E2=80=A6 >>>>>>=20 >>>>>> Following up on Marius and Henk=E2=80=99s comment, I am concerned tha= t =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied to a s= ecurity domain definition. We should not necessarily say this is the receive= r though it often turns out to be. For example a RP (=E2=80=9Caud=E2=80=9D) h= as outsourced events processing to a third party (the so called receiver). >>>>>>=20 >>>>>> I am happy with the current claim set, but maybe some text explaining= that a receiver does not have to be the aud is appropriate? I don=E2=80=99= t see any benefit to having a receiver claim as this could complicate proces= sing more than its worth. >>>>>>=20 >>>>>> There are a few other comments in this thread, but this one seemed th= e most unresolved. >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>>=20 >>>>>>> On Aug 3, 2017, at 8:03 AM, Henk Birkholz wrote: >>>>>>>=20 >>>>>>> Hello, >>>>>>>=20 >>>>>>> to me, the "audience" claim seems to be a good choice here. >>>>>>>=20 >>>>>>> Viele Gr=C3=BC=C3=9Fe, >>>>>>>=20 >>>>>>> Henk >>>>>>>=20 >>>>>>>> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>>>>>>> The abstract mentions "issuer" and "receiver" in the last sentence.= "receiver" does not sound right (that should be used in the context of a tr= ansmitter), but I don't have a better suggestion. Audience? >>>>>>>> The last paragraph of section 1 mentions "subscriber". I think it s= hould be either "receiver" or "audience". >>>>>>>> The explanation for figure 1 states that the issuer denotes the tra= nsmitter. If the issuer and the transmitter are assumed to be the same entit= y, then the transmitter definition in section 1.2 should make that clear. >>>>>>>> Figure 3, I think the "sub" claim should be nested in the event, ne= xt to the issuer that provides the correct context. The "iss" and "sub" defi= nitions in 2.1 also touch on this, providing conflicting advice. >>>>>>>> Section 2,1, definition of "nbf". The definition says that this is t= he event time. I see two problems: >>>>>>>> - the name suggest "not before", not exactly the same as event time= >>>>>>>> - there can be multiple events >>>>>>>> maybe this claim should be dropped? >>>>>>>> Section 2.1, definition of "exp". Omitting this claim is the short t= erm solution to the confusion issue. Why not mention that and that it SHOULD= NOT be used? >>>>>>>> Section 2.1, definition of "events". It states that all events must= refer to the same logical event. Lately in discussions we reached the concl= usion that all events in a SET should be defined in the same profile, which i= s a stronger requirement. I think this definition should mention that. >>>>>>>> Regarding events and profiles. There was a proposal to add a new cl= aim to uniquely identify the profile. I think we need to discuss that. >>>>>>>> Figure 5. Maybe a signed example would be better, especially that t= he next paragraph mentions that signatures or encryption should be used. >>>>>>>> Section 4.5, second paragraph. Mentions that "nonce" is also requir= ed, but that is not actually true. Id Tokens issued at the token endpoint fo= r example will not have it. I suggest we drop the whole paragraph. >>>>>>>> Marius >>>>>>>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer > wrote: >>>>>>>> This is to announce working group last call on this draft >>>>>>>> (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCg= aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54= IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D ). >>>>>>>> Please send your comments to the list. Even if you are perfectly= >>>>>>>> happy with the draft, please let us know that you support its >>>>>>>> publication as-is by posting to the list. >>>>>>>> Because of the summer holidays, this last call is open for 3 wee= ks, >>>>>>>> until Aug. 21. >>>>>>>> Thanks, >>>>>>>> Dick and Yaron >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.= org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5= YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9= SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORU= pSDnvA&e=3D >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org= _mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTp= kKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_= lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSD= nvA&e=3D=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org >>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_= mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpk= KY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_l= w_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D >>>>>>=20 >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>=20 >>>>>=20 >>>>=20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRt= aXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e= =3D=20 >>=20 >=20 --Apple-Mail-E8FB1075-D3B6-446C-A25F-EFFB9668A313 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Ok. But you raised the concern. Are yo= u withdrawing it?

Phil

On Oct 23, 2017, at 5:47 PM, Mar= ius Scurtescu <mscurtescu@google= .com> wrote:

On Mon, Oct 23, 2= 017 at 4:15 PM, Phil Hunt <phil.hunt@oracle.com><= /span> wrote:
It=E2=80=99s quite relevant to those with distributed architectu= res.

If an Event Stream requires that SETs need to b= e encrypted (using JWE), the SETs needs to be encrypted so the =E2=80=9Crece= iver" can read it.  Regardless, =E2=80=9Caud=E2=80=9D should be interpr= eted by the traditional JWT method which suggests the security domain the ev= ent is for.  For example, a web site relying party does not have the ca= pability to process (or issue) events itself (eg. because of a distributed a= rchitecture). The relying party assigns another entity the role of Event Rec= eiver (or Transmitter).  

The problem being th= at If the =E2=80=9Cset=E2=80=9D is encrypted for =E2=80=9Caud=E2=80=9D then o= nly the =E2=80=9Caud=E2=80=9D entity can read the SET which will make it imp= ossible to for another server to handle or worse, it would require sharing o= f private keys. 

The RP con= trols the configuration of the stream, so they can specify an endpoint that b= elongs to the outsourced receiver and they can also specify an encryption ke= y that is controlled by the outsourced receiver. The RP does not need access= to the private key at all.

I still think it is irr= elevant to the transmitter, or to this spec. I agree it is totally relevant f= or the RP,


=

Phil

Oracle Corporation, Ide= ntity Cloud Services Architect
@independentid
phil.hunt@oracle.com

On Oct= 23, 2017, at 3:58 PM, Marius Scurtescu <mscurtescu@google.com> wr= ote:

I think "aud" should poi= nt to the Receiver, the outsourcing is irrelevant.

Nothin= g needs to change here IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It seems reasonable t= o further clarify that the definition of a receiver could be improved.
<= br>
I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
Event Receiver= An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different
      entity than th=
at described by the =E2=80=9Caud=E2=80=9D claim.

<= div>
Phil
<= div>
Oracle Corporation, Identity Cloud Services Architect
@independentid
phil.hunt@orac= le.com
=

On Oct 23, 2017, at 2:38 PM, Marius S= curtescu <mscurtescu@google.com> wrote:

I think "aud" is perfectly fine.

IMO it should make= no difference for the Transmitter that the event is actually handled by an o= utsourced entity, the RP trusts that entity and the event is generated and t= argeted to the RP and not to the current outsourced processor.

Marius

On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> wrote:

All,

=
I am reviewing the previous feedback from WGLC and will be bringi= ng up any unresolved issues for quick discussion/confirmation=E2=80=A6
=

Following up on Marius and Henk=E2=80=99s comment, I am c= oncerned that =E2=80=9Caud=E2=80=9D has a very specific meaning and is often= tied to a security domain definition. We should not necessarily say this is= the receiver though it often turns out to be. For example a RP (=E2=80=9Cau= d=E2=80=9D) has outsourced events processing to a third party (the so called= receiver).

I am happy with the current claim set, b= ut maybe some text explaining that a receiver does not have to be the aud is= appropriate?  I don=E2=80=99t see any benefit to having a receiver cla= im as this could complicate processing more than its worth.

There are a few other comments in this thread, but this one seemed t= he most unresolved.

Phil

<= br>
On Aug 3, 2017, at 8:03 AM, Henk Birk= holz <henk.birkholz@sit.fraunhofer.de> wrote:
=
Hello,
to me, the "audience" claim seems to be a good ch= oice here.

Viele Gr=C3=BC=C3=9Fe,

Henk

On 08/02/2017 11:45= PM, Marius Scurtescu wrote:
The abstract mentions "issu= er" and "receiver" in the last sentence. "receiver" does not sound right (th= at should be used in the context of a transmitter), but I don't have a bette= r suggestion. Audience?
The last paragraph of section 1 mentions "subscri= ber". I think it should be either "receiver" or "audience".
The explanati= on for figure 1 states that the issuer denotes the transmitter. If the issue= r and the transmitter are assumed to be the same entity, then the transmitte= r definition in section 1.2 should make that clear.
Figure 3, I think the= "sub" claim should be nested in the event, next to the issuer that provides= the correct context. The "iss" and "sub" definitions in 2.1 also touch on t= his, providing conflicting advice.
Section 2,1, definition of "nbf". The d= efinition says that this is the event time. I see two problems:
- the nam= e suggest "not before", not exactly the same as event time
- there can be= multiple events
maybe this claim should be dropped?
Section 2.1, defi= nition of "exp". Omitting this claim is the short term solution to the confu= sion issue. Why not mention that and that it SHOULD NOT be used?
Section 2= .1, definition of "events". It states that all events must refer to the same= logical event. Lately in discussions we reached the conclusion that all eve= nts in a SET should be defined in the same profile, which is a stronger requ= irement. I think this definition should mention that.
Regarding events an= d profiles. There was a proposal to add a new claim to uniquely identify the= profile. I think we need to discuss that.
Figure 5. Maybe a signed examp= le would be better, especially that the next paragraph mentions that signatu= res or encryption should be used.
Section 4.5, second paragraph. Mentions= that "nonce" is also required, but that is not actually true. Id Tokens iss= ued at the token endpoint for example will not have it. I suggest we drop th= e whole paragraph.
Marius
On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheff= er <yaronf.ietf@gmail.com <mail= to:yaronf.ietf@gmail.com>> wrote:
   This i= s to announce working group last call on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDw= IGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5bi= RrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4l= vS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99= u5-Ojw4Fw&e=3D   =   <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2D= token_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057Sb<= wbr>K10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUy= dIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W= 54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D >).
   Please send your comments to the list. Even= if you are perfectly
   happy with the draft, please let u= s know that you support its
   publication as-is by postin= g to the list.
   Because of the summer holidays, this las= t call is open for 3 weeks,
   until Aug. 21.
 &nb= sp; Thanks,
        Dick and= Yaron
   ___________________________________________= ____
   Id-event mailing list
   Id-event@ie= tf.org <mailto:Id-event@ietf.org= >
   https://urldefense.proofpoint.com/v2/url?u=3Dh= ttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&a= mp;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biR= rKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lv= S7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXO= RUpSDnvA&e=3D    =  <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP= 1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkI= TSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEW= A2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&a= mp;e=3D >
____________________= ___________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/u= rl?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3D= DwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw= _LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJ= INLVTXORUpSDnvA&e=3D
<= /blockquote>



________________= _______________________________
Id-event mailing list
Id-e= vent@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




= _______________________________________________
Id-event mailing lis= t
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/ur= l?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DD= wICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWN= g5BPXoRtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8= ucznK2XkdYp7wB0zI3N0&e=3D


= --Apple-Mail-E8FB1075-D3B6-446C-A25F-EFFB9668A313-- From nobody Mon Oct 23 17:53:16 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2227813AB66 for ; Mon, 23 Oct 2017 17:53:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.45 X-Spam-Level: X-Spam-Status: No, score=-0.45 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NxEtuR7PtlIM for ; Mon, 23 Oct 2017 17:53:12 -0700 (PDT) Received: from mail-it0-x235.google.com (mail-it0-x235.google.com [IPv6:2607:f8b0:4001:c0b::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C470B139507 for ; Mon, 23 Oct 2017 17:53:11 -0700 (PDT) Received: by mail-it0-x235.google.com with SMTP id l196so8108066itl.4 for ; Mon, 23 Oct 2017 17:53:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=VA+OON5GLVLp8OqsO5KxmKVsKsDz87guKKkRY5Fo2rQ=; b=EHn5IUTanBrgaLJWluf5ruWjYSxud33YWvgKNjV1D7UIR2kYvUTpn94RNtMkXfiG85 TURgfY8tcqY2/Lf2ui/P/8kBaGCn3l31bUzfokhXm2zCgngk4E/VqGD0iFYgyC9xjLqH y8vtTUjIiS4lULDDsJJDQq5HeQSzE/EHHV+3Uh4HinnCBl1dnmzFQ4ufKbfIUXO0LBKk MUO5M4noUB9g57QkOk29cBrjKyjTaETB+KlPdZg8/U8/RH0z8YEFtnC/IrMeAICxdAcU purj34plXPW7jboF+J4r3xz3e4R5gjPiWy9NAOEzSd4hH/cx3j/FlRxtQHmYiBX7q2NN axnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=VA+OON5GLVLp8OqsO5KxmKVsKsDz87guKKkRY5Fo2rQ=; b=pxTuMWaFV5By0dDhcckloyffHnhI9/cDKc5HzxY10j1hs/0PLbQchQzmK38ihCUOb7 a+jpFiRCO0CzT7uSuLrH/LmKddR7Au920JlGTE8jIStJirk91BE2PdhVLBJUFanVRbIL bjo7CB/G0d2/1NWuXZo6AMBmj+YEwHpyAMuuArvEuMEc6kEObY6BlkQUKGVm09HF8HRW Z0JozNSeNSPtnjzKphqDl8HYcwmlCnxN99TMLodsSFMlGX+2tgq976Ll1JO73PedNs7d Gz9w9Z5F5adaRf1g7IxvvOmE7b53Phs25n6QDKT8cf1z0wQf2DW+yKkTIEs5MXB8lg/4 HODQ== X-Gm-Message-State: AMCzsaUiMKq4MZ7RIkRmvHVDZcRGGdlPEBX0etVGV+Jtth/xvj5CNVq7 ktwOkm2cq1cImslhHluJl2GlMTHx68DiNaIUYLADkQ== X-Google-Smtp-Source: ABhQp+SDKRyOrG1FTGWk2I8N7YVCzNmbAzaAMwygPg8HCyLIFCSPo4rK42vUetpnlHExBo75C35V8JD8L188VnN6fK0= X-Received: by 10.36.120.136 with SMTP id p130mr11439826itc.54.1508806390673; Mon, 23 Oct 2017 17:53:10 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Mon, 23 Oct 2017 17:52:49 -0700 (PDT) In-Reply-To: <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> From: Marius Scurtescu Date: Mon, 23 Oct 2017 17:52:49 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: ID Events Mailing List Content-Type: multipart/alternative; boundary="001a114ab8e4f4080c055c405c7e" Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 00:53:15 -0000 --001a114ab8e4f4080c055c405c7e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I raised a wording issue, not sure if it still applies: "The abstract mentions "issuer" and "receiver" in the last sentence. "receiver" does not sound right (that should be used in the context of a transmitter), but I don't have a better suggestion. Audience? The last paragraph of section 1 mentions "subscriber". I think it should be either "receiver" or "audience"." Marius On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (IDM) wrote: > Ok. But you raised the concern. Are you withdrawing it? > > Phil > > On Oct 23, 2017, at 5:47 PM, Marius Scurtescu > wrote: > > On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt wrote: > >> It=E2=80=99s quite relevant to those with distributed architectures. >> >> If an Event Stream requires that SETs need to be encrypted (using JWE), >> the SETs needs to be encrypted so the =E2=80=9Creceiver" can read it. R= egardless, >> =E2=80=9Caud=E2=80=9D should be interpreted by the traditional JWT metho= d which suggests >> the security domain the event is for. For example, a web site relying >> party does not have the capability to process (or issue) events itself (= eg. >> because of a distributed architecture). The relying party assigns anothe= r >> entity the role of Event Receiver (or Transmitter). >> >> The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for =E2= =80=9Caud=E2=80=9D then only the >> =E2=80=9Caud=E2=80=9D entity can read the SET which will make it impossi= ble to for another >> server to handle or worse, it would require sharing of private keys. >> > > The RP controls the configuration of the stream, so they can specify an > endpoint that belongs to the outsourced receiver and they can also specif= y > an encryption key that is controlled by the outsourced receiver. The RP > does not need access to the private key at all. > > I still think it is irrelevant to the transmitter, or to this spec. I > agree it is totally relevant for the RP, > > > >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> >> phil.hunt@oracle.com >> >> On Oct 23, 2017, at 3:58 PM, Marius Scurtescu >> wrote: >> >> I think "aud" should point to the Receiver, the outsourcing is irrelevan= t. >> >> Nothing needs to change here IMO. >> >> Marius >> >> On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt wrote: >> >>> It seems reasonable to further clarify that the definition of a receive= r >>> could be improved. >>> >>> I propose to change from: >>> >>> Event Receiver >>> An Event Receiver is an entity that receives SETs through some >>> distribution method. >>> >>> >>> To: >>> >>> Event Receiver >>> An Event Receiver is an entity that receives SETs through some >>> distribution method. An Event Receiver MAY be a different >>> >>> entity than that described by the =E2=80=9Caud=E2=80=9D claim. >>> >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect >>> @independentid >>> www.independentid.com >>> >>> phil.hunt@oracle.com >>> >>> On Oct 23, 2017, at 2:38 PM, Marius Scurtescu >>> wrote: >>> >>> I think "aud" is perfectly fine. >>> >>> IMO it should make no difference for the Transmitter that the event is >>> actually handled by an outsourced entity, the RP trusts that entity and= the >>> event is generated and targeted to the RP and not to the current outsou= rced >>> processor. >>> >>> Marius >>> >>> On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt >>> wrote: >>> >>>> >>>> All, >>>> >>>> I am reviewing the previous feedback from WGLC and will be bringing up >>>> any unresolved issues for quick discussion/confirmation=E2=80=A6 >>>> >>>> Following up on Marius and Henk=E2=80=99s comment, I am concerned that= =E2=80=9Caud=E2=80=9D >>>> has a very specific meaning and is often tied to a security domain >>>> definition. We should not necessarily say this is the receiver though = it >>>> often turns out to be. For example a RP (=E2=80=9Caud=E2=80=9D) has ou= tsourced events >>>> processing to a third party (the so called receiver). >>>> >>>> I am happy with the current claim set, but maybe some text explaining >>>> that a receiver does not have to be the aud is appropriate? I don=E2= =80=99t see >>>> any benefit to having a receiver claim as this could complicate proces= sing >>>> more than its worth. >>>> >>>> There are a few other comments in this thread, but this one seemed the >>>> most unresolved. >>>> >>>> Phil >>>> >>>> >>>> On Aug 3, 2017, at 8:03 AM, Henk Birkholz < >>>> henk.birkholz@sit.fraunhofer.de> wrote: >>>> >>>> Hello, >>>> >>>> to me, the "audience" claim seems to be a good choice here. >>>> >>>> Viele Gr=C3=BC=C3=9Fe, >>>> >>>> Henk >>>> >>>> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>>> >>>> The abstract mentions "issuer" and "receiver" in the last sentence. >>>> "receiver" does not sound right (that should be used in the context of= a >>>> transmitter), but I don't have a better suggestion. Audience? >>>> The last paragraph of section 1 mentions "subscriber". I think it >>>> should be either "receiver" or "audience". >>>> The explanation for figure 1 states that the issuer denotes the >>>> transmitter. If the issuer and the transmitter are assumed to be the s= ame >>>> entity, then the transmitter definition in section 1.2 should make tha= t >>>> clear. >>>> Figure 3, I think the "sub" claim should be nested in the event, next >>>> to the issuer that provides the correct context. The "iss" and "sub" >>>> definitions in 2.1 also touch on this, providing conflicting advice. >>>> Section 2,1, definition of "nbf". The definition says that this is the >>>> event time. I see two problems: >>>> - the name suggest "not before", not exactly the same as event time >>>> - there can be multiple events >>>> maybe this claim should be dropped? >>>> Section 2.1, definition of "exp". Omitting this claim is the short ter= m >>>> solution to the confusion issue. Why not mention that and that it SHOU= LD >>>> NOT be used? >>>> Section 2.1, definition of "events". It states that all events must >>>> refer to the same logical event. Lately in discussions we reached the >>>> conclusion that all events in a SET should be defined in the same prof= ile, >>>> which is a stronger requirement. I think this definition should mentio= n >>>> that. >>>> Regarding events and profiles. There was a proposal to add a new claim >>>> to uniquely identify the profile. I think we need to discuss that. >>>> Figure 5. Maybe a signed example would be better, especially that the >>>> next paragraph mentions that signatures or encryption should be used. >>>> Section 4.5, second paragraph. Mentions that "nonce" is also required, >>>> but that is not actually true. Id Tokens issued at the token endpoint = for >>>> example will not have it. I suggest we drop the whole paragraph. >>>> Marius >>>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer >>> mailto:yaronf.ietf@gmail.com >> wrote: >>>> This is to announce working group last call on this draft >>>> (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__dat >>>> atracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwI >>>> GaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRr >>>> KugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS >>>> 7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&= e=3D >>>> >>> https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2 >>>> Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK >>>> 10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9 >>>> SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6 >>>> cxjlKfjqT99u5-Ojw4Fw&e=3D >). >>>> Please send your comments to the list. Even if you are perfectly >>>> happy with the draft, please let us know that you support its >>>> publication as-is by posting to the list. >>>> Because of the summer holidays, this last call is open for 3 weeks, >>>> until Aug. 21. >>>> Thanks, >>>> Dick and Yaron >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org > >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. >>>> ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCga >>>> WHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEi >>>> vzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfA >>>> uUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >>> tps://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf. >>>> org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZ >>>> YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjW >>>> wlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuU >>>> Y&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D > >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>> f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv >>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>> WwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY >>>> &s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >>>> >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>> f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHv >>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>> WwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY >>>> &s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>> >>>> >>>> >>> >>> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_tq5wICJLi5itJHRai >> 0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e=3D >> >> >> > --001a114ab8e4f4080c055c405c7e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I raised a wording issue, not sure if it still applies:
"The abstract mentions "issuer" and "r= eceiver" in the last sentence. "receiver" does not sound rig= ht (that should be used in the context of a transmitter), but I don't h= ave a better suggestion. Audience?
The last paragraph of section = 1 mentions "subscriber". I think it should be either "receiv= er" or "audience"."


=

Marius

On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (= IDM) <phil.hunt@oracle.com> wrote:
Ok. But you raised the concern. Are yo= u withdrawing it?

Phi= l

On Oct 23, 2017, at 5:= 47 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt = <phil.hunt@oracle.com> wrote:
It=E2=80= =99s quite relevant to those with distributed architectures.

=
If an Event Stream requires that SETs need to be encrypted (usin= g JWE), the SETs needs to be encrypted so the =E2=80=9Creceiver" can r= ead it.=C2=A0 Regardless, =E2=80=9Caud=E2=80=9D should be interpreted by th= e traditional JWT method which suggests the security domain the event is fo= r.=C2=A0 For example, a web site relying party does not have the capability= to process (or issue) events itself (eg. because of a distributed architec= ture). The relying party assigns another entity the role of Event Receiver = (or Transmitter). =C2=A0

The problem being that If= the =E2=80=9Cset=E2=80=9D is encrypted for =E2=80=9Caud=E2=80=9D then only= the =E2=80=9Caud=E2=80=9D entity can read the SET which will make it impos= sible to for another server to handle or worse, it would require sharing of= private keys.=C2=A0

The RP con= trols the configuration of the stream, so they can specify an endpoint that= belongs to the outsourced receiver and they can also specify an encryption= key that is controlled by the outsourced receiver. The RP does not need ac= cess to the private key at all.

I still think it i= s irrelevant to the transmitter, or to this spec. I agree it is totally rel= evant for the RP,



Phil=

Oracle Corporation, Identity Cloud Services Archi= tect
@independentid
phil.hunt@oracle.com

On Oct 23, 2017, at 3:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "= ;aud" should point to the Receiver, the outsourcing is irrelevant.
Nothing needs to change here IMO.

Marius<= /div>

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> wrote:
It seems reasonable to further clarify that the definition of a receive= r could be improved.

I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different
      entity than that described by the =E2=80=9Caud=E2=80=9D claim.

Phil

Orac= le Corporation, Identity Cloud Services Architect
@independentid<= /div>
phil.hunt@oracle.com

On Oct 23, 2017, at 2:38 PM, Marius= Scurtescu <mscurtescu@google.com> wrote:
I think "aud"= is perfectly fine.

IMO it should make no difference for= the Transmitter that the event is actually handled by an outsourced entity= , the RP trusts that entity and the event is generated and targeted to the = RP and not to the current outsourced processor.

Marius

On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt = <phil.hunt@oracle.com> wrote:

All,

I am reviewing th= e previous feedback from WGLC and will be bringing up any unresolved issues= for quick discussion/confirmation=E2=80=A6

Follow= ing up on Marius and Henk=E2=80=99s comment, I am concerned that =E2=80=9Ca= ud=E2=80=9D has a very specific meaning and is often tied to a security dom= ain definition. We should not necessarily say this is the receiver though i= t often turns out to be. For example a RP (=E2=80=9Caud=E2=80=9D) has outso= urced events processing to a third party (the so called receiver).

I am happy with the current claim set, but maybe some text= explaining that a receiver does not have to be the aud is appropriate?=C2= =A0 I don=E2=80=99t see any benefit to having a receiver claim as this coul= d complicate processing more than its worth.

There= are a few other comments in this thread, but this one seemed the most unre= solved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz <<= a href=3D"mailto:henk.birkholz@sit.fraunhofer.de" class=3D"m_27075417827233= 1192cremed" target=3D"_blank">henk.birkholz@sit.fraunhofer.de> = wrote:

Hello,

t= o me, the "audience" claim seems to be a good choice here.=
<= br style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-var= iant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;= text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Viele Gr=C3=BC=C3=9Fe,

Henk

On= 08/02/2017 11:45 PM, Marius Scurtescu wrote:
The= abstract mentions "issuer" and "receiver" in the last = sentence. "receiver" does not sound right (that should be used in= the context of a transmitter), but I don't have a better suggestion. A= udience?
The last paragraph of section 1 mentions "subscriber"= . I think it should be either "receiver" or "audience".=
The explanation for figure 1 states that the issuer denotes the transmi= tter. If the issuer and the transmitter are assumed to be the same entity, = then the transmitter definition in section 1.2 should make that clear.
F= igure 3, I think the "sub" claim should be nested in the event, n= ext to the issuer that provides the correct context. The "iss" an= d "sub" definitions in 2.1 also touch on this, providing conflict= ing advice.
Section 2,1, definition of "nbf". The definition s= ays that this is the event time. I see two problems:
- the name suggest = "not before", not exactly the same as event time
- there can b= e multiple events
maybe this claim should be dropped?
Section 2.1, de= finition of "exp". Omitting this claim is the short term solution= to the confusion issue. Why not mention that and that it SHOULD NOT be use= d?
Section 2.1, definition of "events". It states that all eve= nts must refer to the same logical event. Lately in discussions we reached = the conclusion that all events in a SET should be defined in the same profi= le, which is a stronger requirement. I think this definition should mention= that.
Regarding events and profiles. There was a proposal to add a new = claim to uniquely identify the profile. I think we need to discuss that.Figure 5. Maybe a signed example would be better, especially that the next= paragraph mentions that signatures or encryption should be used.
Sectio= n 4.5, second paragraph. Mentions that "nonce" is also required, = but that is not actually true. Id Tokens issued at the token endpoint for e= xample will not have it. I suggest we drop the whole paragraph.
MariusOn Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer <y= aronf.ietf@gmail.com=C2=A0= <mailto:yaronf.ietf@gmail.com>&g= t; wrote:
=C2=A0=C2=A0=C2=A0This is to announce working group last call = on this draft
=C2=A0=C2=A0=C2=A0(ht= tps://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.= ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&= c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrK= ugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS= 7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<https:= //urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf= .org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3D= RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH= 0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQL= XEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Oj= w4Fw&e=3D=C2=A0= >).
=C2=A0=C2=A0=C2=A0Please send your comments to the list. Even if = you are perfectly
=C2=A0=C2=A0=C2=A0happy with the draft, please let us = know that you support its
=C2=A0=C2=A0=C2=A0publication as-is by posting= to the list.
=C2=A0=C2=A0=C2=A0Because of the summer holidays, this las= t call is open for 3 weeks,
=C2=A0=C2=A0=C2=A0until Aug. 21.
=C2=A0= =C2=A0=C2=A0Thanks,
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Dick= and Yaron
=C2=A0=C2=A0=C2=A0______________________________________= _________
=C2=A0=C2=A0=C2=A0Id-event mailing list
=C2=A0=C2=A0=C2=A0<= a href=3D"mailto:Id-event@ietf.org" class=3D"m_270754178272331192cremed" ta= rget=3D"_blank">Id-event@ietf.org=C2=A0<mailto:Id-event@ietf.org&= gt;
=C2=A0=C2=A0=C2=A0https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2D= event&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK= 10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUU= ydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8p= EkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCX= CgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJ= xPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1= i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&= e=3D=C2=A0>
_= ______________________________________________
Id-event mailing lis= t
Id-event@ietf.org
https://= urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailm= an_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR= 8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwl= NKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&a= mp;s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D=C2=A0

_________________________________________= ______
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofp= oint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2D= event&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY0= 57SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/li= stinfo/id-event



_______________________________________________
Id-event mailing li= st
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxP= EivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_tq5wICJLi5it= JHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e= =3D


--001a114ab8e4f4080c055c405c7e-- From nobody Mon Oct 23 18:04:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC6FB1393A8 for ; Mon, 23 Oct 2017 18:04:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.309 X-Spam-Level: X-Spam-Status: No, score=-15.309 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UMyAB6hyx8Sf for ; Mon, 23 Oct 2017 18:04:14 -0700 (PDT) Received: from smtp-fw-9101.amazon.com (smtp-fw-9101.amazon.com [207.171.184.25]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF9DF138BE2 for ; Mon, 23 Oct 2017 18:04:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1508807054; x=1540343054; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=Djs38owR1Shhs7fsIUcz51WE0D6aaSEkCIe750BIyko=; b=D2/rOMIOixu3PGCCXnUrLGuAB4SODTJg1ZiUhv1whRypMbqBnsnDLR93 PH0ua5OgdSYYbJ78axoYaILIbNo+q178virSZmCBfov3y1NgnCGlpW5un rBjSdn1+anAgPy2l2p3DMuPZGaaJGrfg/4zBDDKaIhhs/CXcb32Z865Sq s=; X-IronPort-AV: E=Sophos;i="5.43,424,1503360000"; d="scan'208,217";a="713342808" Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-2a-538b0bfb.us-west-2.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 24 Oct 2017 01:04:13 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-2a-538b0bfb.us-west-2.amazon.com (8.14.7/8.14.7) with ESMTP id v9O14Cdf042789 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 24 Oct 2017 01:04:12 GMT Received: from EX13D11UWC001.ant.amazon.com (10.43.162.151) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 24 Oct 2017 01:04:12 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC001.ant.amazon.com (10.43.162.151) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 24 Oct 2017 01:04:11 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Tue, 24 Oct 2017 01:04:11 +0000 From: "Richard Backman, Annabelle" To: "Phil Hunt (IDM)" , Mike Jones CC: Brian Campbell , ID Events Mailing List Thread-Topic: [Id-event] Replacing "nbf" claim with a new "toe" claim Thread-Index: AQHTN9K/qlvLmS09/ky6I+v1p9U3wqLKa5QAgCfcawCAAAvBAIAABJkA Date: Tue, 24 Oct 2017 01:04:11 +0000 Message-ID: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.162.215] Content-Type: multipart/alternative; boundary="_000_A2458FA9449241EA8FFA5BF3E5ECF377amazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 01:04:17 -0000 --_000_A2458FA9449241EA8FFA5BF3E5ECF377amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWdyZWVkIG92ZXJhbGwuIEhhdmluZyByZXJlYWQgdGhlIHByb3Bvc2VkIHRleHQsIEkgc3VnZ2Vz dCBzdHJpa2luZyB0aGUgbGFzdCBzZW50ZW5jZSwg4oCcV2hlbiBub3QgYXNzZXJ0ZWQsIHRoZSB2 YWx1ZSBvZiDigJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhlIHZhbHVlIG9mIOKAnGlh dOKAnS7igJ0gSSBkbyBub3QgdGhpbmsgaXQgaXMgbmVjZXNzYXJ5IG9yIHBhcnRpY3VsYXJseSBo ZWxwZnVsIHRvIHN0YW5kYXJkaXplIHRoZSBzZW1hbnRpY3Mgb2YgYSBtaXNzaW5nIHRpbWUtb2Yt ZXZlbnQgY2xhaW0gYXQgdGhlIFNFVCBsZXZlbC4NCg0KLS0NCkFubmFiZWxsZSBSaWNoYXJkIEJh Y2ttYW4NCkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXMNCg0KDQpGcm9tOiBJZC1ldmVudCA8 aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mICJQaGlsIEh1bnQgKElETSki IDxwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCkRhdGU6IE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyBh dCA1OjQ4IFBNDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0K Q2M6IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4sIElEIEV2ZW50 cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gUmVwbGFjaW5nICJuYmYiIGNsYWltIHdpdGggYSBuZXcgInRvZSIgY2xhaW0NCg0KQWdyZWVk ICsxIG9uIEJyaWFuJ3MgZWRpdHMuDQoNClBoaWwNCg0KT24gT2N0IDIzLCAyMDE3LCBhdCA1OjA1 IFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KQW5uYWJlbGxlIGFuZCBJIGFncmVlZCB3 aXRoIHRoaXMgcHJvcG9zZWQgY2hhbmdlIChhcyBjb3JyZWN0bHkgd29yZHNtaXRoZWQgYnkgQnJp YW4pIGR1cmluZyBvdXIgaW4tcGVyc29uIHJldmlldyDigJMgYXMgYWxzbyBub3RlZCBpbiB0aGUg cmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVGhhbmtzIFBoaWwgYW5kIGFs bCwNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJyaWFuIENhbXBiZWxsDQpTZW50OiBUaHVyc2Rh eSwgU2VwdGVtYmVyIDI4LCAyMDE3IDg6MjMgQU0NClRvOiBQaGlsIEh1bnQgPHBoaWwuaHVudEBv cmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+DQpDYzogSUQgRXZlbnRzIE1h aWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4N ClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAibmJmIiBjbGFpbSB3aXRoIGEgbmV3 ICJ0b2UiIGNsYWltDQoNCisxIHRvIFNFVCBkZWZpbmluZyBhIHRpbWUgb2YgZXZlbnQgY2xhaW0g cmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHJlZGVmaW5lIGEgc3RhbmRhcmQgY2xhaW0uIEFuZCB3aG8g ZG9lc24ndCBsaWtlIGEgY2xhaW0gbmFtZWQgInRvZSI/DQpIb3dldmVyLCB0aGUgdGV4dCB0aGVy ZSBmb3IgbmJmIGlzIHN0aWxsIGVmZmVjdGl2ZWx5IHJlZGVmaW5pbmcgaXQgYnkgc2F5aW5nIGl0 IHNob3VsZCBiZSBpZ25vcmVkLCB3aGljaCBpc24ndCBjb25zaXN0ZW50IHdpdGggdGhlICJNVVNU IE5PVCBiZSBhY2NlcHRlZCBmb3IgcHJvY2Vzc2luZyIgZnJvbSBSRkMgNzUxOS4gSXQgd291bGQg YmUgbW9yZSBhcHByb3ByaWF0ZSB0byBzYXkgdGhhdCBuYmYgc2hvdWxkL211c3Qgbm90IGJlIGlu Y2x1ZGVkIGluIGEgU0VULiBPciBqdXN0IG5vdCBtZW50aW9uIG5iZiBhdCBhbGwuIEJ1dCBkb24n dCBjaGFuZ2UgdGhlIG1lYW5pbmcuDQpBbHNvIHRvZSB3b3VsZCBub3QgYmUgIkRlZmluZWQgYnkg U2VjdGlvbiA0LjEuNSBbUkZDNzUxOV0iLCB3aGljaCBpcyB0aGUgbmJmIHNlY3Rpb24uIFRoZSB2 YWx1ZSBvZiB0aGUgdG9lIGNsYWltIGlzIGEgTnVtZXJpY0RhdGUsIHdoaWNoIGlzIGRlZmluZWQg aW4gU2VjIDIgUkZDNzUxOS4gQnV0IHRvZSBoYXMgbm8gcmVsYXRpb24gdG8gbmJmIGFuZCBubyBy ZWFzb24gdG8gcmVmZXJlbmNlIG5iZi4NCg0KT24gV2VkLCBTZXAgMjcsIDIwMTcgYXQgMjo1MyBQ TSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb20+PiB3cm90ZToNCkR1cmluZyB0aGUgT3BlbklEIFJJU0MgRmFjZSB0byBGYWNlIG1lZXRp bmcgYSBxdWVzdGlvbiBjYW1lIHVwIHJlZ2FyZGluZyBTRVTigJlzIHJlZGVmaW5pdGlvbiBvZiDi gJxuYmbigJ0gYW5kIHdoZXRoZXIgdGhhdCByZWRlZmluaXRpb24gd2FzIGFwcHJvcHJpYXRlLg0K DQpUaGUgaW50ZW50aW9uIG9mIFNFVHMgZGVmaW5pdGlvbiBpcyB0byBhbGxvdyBTRVQgVHJhbnNt aXR0ZXJzIHRvIGluZGljYXRlIHRoYXQgYW4gZXZlbnQgbWF5IGhhdmUgb2NjdXJyZWQgYXMgZWFy bHkgYXMgYSBzcGVjaWZpZWQgZGF0ZSDigJQgYSBkYXRlIHdoaWNoIGlzIGRpZmZlcmVudCBmcm9t IHRoZSBpc3N1YW5jZSBkYXRlIG9mIHRoZSBTRVQuIEluIHBhcnRpY3VsYXIgdGhpcyBpcyB1c2Vm dWwgaW4gY2FzZXMgd2hlcmUgdGhlIHN0YXRlIGNoYW5nZSBpcyBiZWxpZXZlZCB0byBoYXZlIG9j Y3VycmVkIGVhcmxpZXIgdGhhbiB0aGUgdGltZSBvZiBpc3N1YW5jZSAoZS5nLiBiZWNhdXNlIHRo ZSBpbmNpZGVudCB3YXMgZGlzY292ZXJlZCB0aHJvdWdoIGFuIGFkbWluaXN0cmF0aXZlIHJldmll dyBvciBkYXRhIGFuYWx5c2lzIHRvIGhhdmUgb2NjdXJyZWQgaW4gdGhlIHBhc3QpLg0KDQpUaGUg ZGVmaW5pdGlvbiBmcm9tIEpXVCBpczoNCjQuMS41PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIz c2VjdGlvbi0yRDQuMS41JmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9MDBzRWl1 ZWZ3aFdiWGVSZkprdGpvcU42UkdPbmlIaVFpcHhIWmlDRzYydyZlPT4uICAibmJmIiAoTm90IEJl Zm9yZSkgQ2xhaW0NCg0KDQoNCg0KDQogICBUaGUgIm5iZiIgKG5vdCBiZWZvcmUpIGNsYWltIGlk ZW50aWZpZXMgdGhlIHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBKV1QNCg0KICAgTVVTVCBOT1QgYmUg YWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcuICBUaGUgcHJvY2Vzc2luZyBvZiB0aGUgIm5iZiINCg0K ICAgY2xhaW0gcmVxdWlyZXMgdGhhdCB0aGUgY3VycmVudCBkYXRlL3RpbWUgTVVTVCBiZSBhZnRl ciBvciBlcXVhbCB0bw0KDQogICB0aGUgbm90LWJlZm9yZSBkYXRlL3RpbWUgbGlzdGVkIGluIHRo ZSAibmJmIiBjbGFpbS4gIEltcGxlbWVudGVycyBNQVkNCg0KICAgcHJvdmlkZSBmb3Igc29tZSBz bWFsbCBsZWV3YXksIHVzdWFsbHkgbm8gbW9yZSB0aGFuIGEgZmV3IG1pbnV0ZXMsIHRvDQoNCiAg IGFjY291bnQgZm9yIGNsb2NrIHNrZXcuICBJdHMgdmFsdWUgTVVTVCBiZSBhIG51bWJlciBjb250 YWluaW5nIGENCg0KICAgTnVtZXJpY0RhdGUgdmFsdWUuICBVc2Ugb2YgdGhpcyBjbGFpbSBpcyBP UFRJT05BTC4NCg0KDQpBcyBkZWZpbmVkIGluIFNFVDoNCg0KICAgbmJmDQoNCiAgICAgIERlZmlu ZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV08aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1sX3JmYzc1MTktMjNz ZWN0aW9uLTJENC4xLjUmZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlU cGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElH ayZtPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmcz0wMHNFaXVl ZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmU9PiwgYSBudW1iZXIgd2hvc2Ug dmFsdWUgaXMgYQ0KDQogICAgICBOdW1lcmljRGF0ZS4gIEluIHRoZSBjb250ZXh0IG9mIHRoZSBT RVQgdG9rZW4gaXQgU0hBTEwgYmUNCg0KICAgICAgaW50ZXJwcmV0ZWQgdG8gbWVhbiBhIGRhdGUg aW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRvIGhhdmUNCg0KICAgICAgb2NjdXJyZWQg KGluIHRoZSBwYXN0KSBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuICBOb3RlOiB0aGVyZQ0K DQogICAgICBNQVkgYmUgc29tZSBjYXNlcyB3aGVyZSAibmJmIiBpcyBzdGlsbCBzbWFsbGVyIHRo YW4gImlhdCIgc3VjaCBhcw0KDQogICAgICB3aGVuIGl0IHRvb2sgYW4gZXh0ZW5kZWQgdGltZSBm b3IgYSBTRVQgdG8gYmUgaXNzdWVkIChmb3IgZXhhbXBsZQ0KDQogICAgICBhZnRlciBzb21lIGFu YWx5c2lzKS4gIFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuDQoNClRoZXJlIGlzIGFuIGFyZ3VtZW50 IHRoYXQgdGhlIHJlZGVmaW5pdGlvbiB3aWxsIGNhdXNlIGNvbmZ1c2lvbi4NCg0KVGhlIHByb3Bv c2FsIGlzIHRvIHJlZ2lzdGVyIGEgZGlmZmVyZW50IGNsYWltIG5hbWUgc3VjaCBhcyDigJx0b2Xi gJ0gKHRpbWUgb2YgZXZlbnQpLiBUaGUgcHJvcG9zZWQgbmV3DQpkZWZpbml0aW9uOg0KDQoNCnRv ZQ0KDQogICAgICBEZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjUgW1JGQzc1MTldPGh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdf aHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVp dnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hT aWNINjF3JnM9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdPbmlIaVFpcHhIWmlDRzYydyZlPT4s IGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGENCg0KICAgICAgTnVtZXJpY0RhdGUuICBUaGUgdmFs dWUgaXMgdGhlIGRhdGUgYW5kIHRpbWUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRv IGhhdmUNCg0KICAgICAgb2NjdXJyZWQgaW4gdGhlIHBhc3Qgb3Igd2lsbCBvY2N1ciBpbiB0aGUg ZnV0dXJlLiBUaGlzIGNsYWltIGlzIE9QVElPTkFMLg0KDQogICAgICBXaGVuIG5vdCBhc3NlcnRl ZCwgdGhlIHZhbHVlIG9mIOKAnHRvZeKAnSBNQVkgYmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUg b2Yg4oCcaWF04oCdLg0KDQoNCg0KbmJmDQoNCiAgICAgIFRoaXMgY2xhaW0gaXMgbm90IHVzZWQg aW4gU0VUIEV2ZW50cy4gSWYgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBTSE9VTEQNCg0KICAgICAgYmUg aWdub3JlZC4NCg0KDQpBcmUgdGhlcmUgYW55IG9iamVjdGlvbnMgdG8gdGhlIHByb3Bvc2VkIGNo YW5nZT8NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZp Y2VzIEFyY2hpdGVjdA0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVw ZW5kZW50aWQuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBr S1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9MV9aN092QXlh eGxlc0NkTE5DNXFzYTVYajlQWlEtTE1iQ2FfaG1UbzJlTSZlPT4NCnBoaWwuaHVudEBvcmFjbGUu Y29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1l dmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9f aWQtMkRldmVudCZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09 TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPThBb29EV1kxRndU RzNCajJFTFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZPTjgmZT0+DQoNCg0KQ09ORklERU5USUFMSVRZ IE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgYW5kIHByaXZpbGVn ZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMp LiBBbnkgcmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVycyBp cyBzdHJpY3RseSBwcm9oaWJpdGVkLiAgSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5p Y2F0aW9uIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYnkg ZS1tYWlsIGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UgYW5kIGFueSBmaWxlIGF0dGFjaG1lbnRzIGZy b20geW91ciBjb21wdXRlci4gVGhhbmsgeW91Lg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0 Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5m b19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBr S1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9OEFvb0RXWTFG d1RHM0JqMkVMV3FwVDdYQWFVWUFVVHhnNzhrZGIwVk9OOCZlPQ0K --_000_A2458FA9449241EA8FFA5BF3E5ECF377amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYWxpYnJpIExpZ2h0IjsNCglwYW5vc2UtMToyIDE1IDMgMiAyIDIgNCAzIDIgNDt9 DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5v c2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJT ZWdvZSBVSSI7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29O b3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAx cHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpoNA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGlu ZyA0IENoYXIiOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseToiQ291cmllciBOZXciLHNlcmlmO30NCnNwYW4uSGVhZGluZzRDaGFyDQoJe21zby1zdHls ZS1uYW1lOiJIZWFkaW5nIDQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJbXNvLXN0 eWxlLWxpbms6IkhlYWRpbmcgNCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkgTGlnaHQiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzJGNTQ5NjsNCglmb250LXN0eWxlOml0YWxpYzt9DQpzcGFuLkhUTUxQ cmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFy IjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9y bWF0dGVkIjsNCglmb250LWZhbWlseToiQ29uc29sYXMiLHNhbnMtc2VyaWY7fQ0KcC5tc29ub3Jt YWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29u b3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCglt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLm00ODE4 NDQwOTQ5OTAwOTg1NzUzaDQNCgl7bXNvLXN0eWxlLW5hbWU6bV80ODE4NDQwOTQ5OTAwOTg1NzUz aDQ7fQ0Kc3Bhbi5tNDgxODQ0MDk0OTkwMDk4NTc1M2FwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0 eWxlLW5hbWU6bV80ODE4NDQwOTQ5OTAwOTg1NzUzYXBwbGUtc3R5bGUtc3Bhbjt9DQpzcGFuLkVt YWlsU3R5bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4uRW1haWxTdHlsZTI0DQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8 L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkFncmVlZCBvdmVyYWxsLiBIYXZpbmcgcmVyZWFkIHRoZSBwcm9wb3NlZCB0ZXh0LCBJ IHN1Z2dlc3Qgc3RyaWtpbmcgdGhlIGxhc3Qgc2VudGVuY2UsIOKAnFdoZW4gbm90IGFzc2VydGVk LCB0aGUgdmFsdWUgb2Yg4oCcdG9l4oCdIE1BWSBiZSBhc3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBv ZiDigJxpYXTigJ0u4oCdIEkgZG8gbm90IHRoaW5rIGl0IGlzIG5lY2Vzc2FyeSBvciBwYXJ0aWN1 bGFybHkgaGVscGZ1bCB0byBzdGFuZGFyZGl6ZQ0KIHRoZSBzZW1hbnRpY3Mgb2YgYSBtaXNzaW5n IHRpbWUtb2YtZXZlbnQgY2xhaW0gYXQgdGhlIFNFVCBsZXZlbC48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+LS0mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPkFubmFiZWxs ZSBSaWNoYXJkIEJhY2ttYW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1l cyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXM8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+SWQtZXZlbnQgJmx0O2lk LWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7IG9uIGJlaGFsZiBvZiAmcXVvdDtQaGlsIEh1bnQg KElETSkmcXVvdDsgJmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwv Yj5Nb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgYXQgNTo0OCBQTTxicj4NCjxiPlRvOiA8L2I+TWlr ZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOiA8 L2I+QnJpYW4gQ2FtcGJlbGwgJmx0O2JjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tJmd0OywgSUQg RXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3Vi amVjdDogPC9iPlJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAmcXVvdDtuYmYmcXVvdDsgY2xhaW0g d2l0aCBhIG5ldyAmcXVvdDt0b2UmcXVvdDsgY2xhaW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFncmVlZCAmIzQzOzEgb24gQnJp YW4ncyBlZGl0cy4mbmJzcDs8YnI+DQo8YnI+DQpQaGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQi Pjxicj4NCk9uIE9jdCAyMywgMjAxNywgYXQgNTowNSBQTSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1 b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Bbm5hYmVs bGUgYW5kIEkgYWdyZWVkIHdpdGggdGhpcyBwcm9wb3NlZCBjaGFuZ2UgKGFzIGNvcnJlY3RseSB3 b3Jkc21pdGhlZCBieSBCcmlhbikgZHVyaW5nIG91ciBpbi1wZXJzb24gcmV2aWV3IOKAkyBhcyBh bHNvIG5vdGVkIGluIHRoZSByZXBseSB0byBNYXJpdXPigJkgY29tbWVudHMuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIw NjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgVGhhbmtzIFBoaWwgYW5kIGFsbCw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IElkLWV2 ZW50IFs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyI+bWFpbHRvOmlk LWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+XQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5CcmlhbiBD YW1wYmVsbDxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwgU2VwdGVtYmVyIDI4LCAyMDE3IDg6 MjMgQU08YnI+DQo8Yj5Ubzo8L2I+IFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwu aHVudEBvcmFjbGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6 PC9iPiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRA aWV0Zi5vcmciPmlkLWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g UmU6IFtJZC1ldmVudF0gUmVwbGFjaW5nICZxdW90O25iZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3 ICZxdW90O3RvZSZxdW90OyBjbGFpbTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiYjNDM7MSB0byBTRVQgZGVm aW5pbmcgYSB0aW1lIG9mIGV2ZW50IGNsYWltIHJhdGhlciB0aGFuIHRyeWluZyB0byByZWRlZmlu ZSBhIHN0YW5kYXJkIGNsYWltLiBBbmQgd2hvIGRvZXNuJ3QgbGlrZSBhIGNsYWltIG5hbWVkICZx dW90O3RvZSZxdW90Oz8NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkhvd2V2ZXIsIHRoZSB0ZXh0IHRoZXJl IGZvciBuYmYgaXMgc3RpbGwgZWZmZWN0aXZlbHkgcmVkZWZpbmluZyBpdCBieSBzYXlpbmcgaXQg c2hvdWxkIGJlIGlnbm9yZWQsIHdoaWNoIGlzbid0IGNvbnNpc3RlbnQgd2l0aCB0aGUgJnF1b3Q7 TVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcmcXVvdDsgZnJvbSBSRkMgNzUxOS4g SXQgd291bGQgYmUgbW9yZSBhcHByb3ByaWF0ZQ0KIHRvIHNheSB0aGF0IG5iZiBzaG91bGQvbXVz dCBub3QgYmUgaW5jbHVkZWQgaW4gYSBTRVQuIE9yIGp1c3Qgbm90IG1lbnRpb24gbmJmIGF0IGFs bC4gQnV0IGRvbid0IGNoYW5nZSB0aGUgbWVhbmluZy4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbHNvIHRvZSB3b3VsZCBub3QgYmUgJnF1b3Q7RGVmaW5l ZCBieSBTZWN0aW9uIDQuMS41IFtSRkM3NTE5XSZxdW90Oywgd2hpY2ggaXMgdGhlIG5iZiBzZWN0 aW9uLiBUaGUgdmFsdWUgb2YgdGhlIHRvZSBjbGFpbSBpcyBhIE51bWVyaWNEYXRlLCB3aGljaCBp cyBkZWZpbmVkIGluIFNlYyAyIFJGQzc1MTkuIEJ1dCB0b2UgaGFzIG5vIHJlbGF0aW9uIHRvIG5i ZiBhbmQgbm8gcmVhc29uIHRvIHJlZmVyZW5jZSBuYmYuJm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFdlZCwgU2VwIDI3LCAyMDE3IGF0IDI6 NTMgUE0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpw PjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkR1cmluZyB0aGUgT3BlbklEIFJJU0Mg RmFjZSB0byBGYWNlIG1lZXRpbmcgYSBxdWVzdGlvbiBjYW1lIHVwIHJlZ2FyZGluZyBTRVTigJlz IHJlZGVmaW5pdGlvbiBvZiDigJxuYmbigJ0gYW5kIHdoZXRoZXIgdGhhdCByZWRlZmluaXRpb24g d2FzIGFwcHJvcHJpYXRlLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhlIGludGVudGlvbiBvZiBTRVRzIGRlZmluaXRpb24gaXMgdG8gYWxsb3cgU0VUIFRy YW5zbWl0dGVycyB0byBpbmRpY2F0ZSB0aGF0IGFuIGV2ZW50IG1heSBoYXZlIG9jY3VycmVkIGFz IGVhcmx5IGFzIGEgc3BlY2lmaWVkIGRhdGUg4oCUIGEgZGF0ZSB3aGljaCBpcyBkaWZmZXJlbnQg ZnJvbSB0aGUgaXNzdWFuY2UgZGF0ZSBvZiB0aGUgU0VULiBJbiBwYXJ0aWN1bGFyIHRoaXMgaXMg dXNlZnVsIGluIGNhc2VzDQogd2hlcmUgdGhlIHN0YXRlIGNoYW5nZSBpcyBiZWxpZXZlZCB0byBo YXZlIG9jY3VycmVkIGVhcmxpZXIgdGhhbiB0aGUgdGltZSBvZiBpc3N1YW5jZSAoZS5nLiBiZWNh dXNlIHRoZSBpbmNpZGVudCB3YXMgZGlzY292ZXJlZCB0aHJvdWdoIGFuIGFkbWluaXN0cmF0aXZl IHJldmlldyBvciBkYXRhIGFuYWx5c2lzIHRvIGhhdmUgb2NjdXJyZWQgaW4gdGhlIHBhc3QpLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUg ZGVmaW5pdGlvbiBmcm9tIEpXVCBpczo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxo NCBzdHlsZT0ibXNvLWxpbmUtaGVpZ2h0LWFsdDowcHQiPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVm ZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRt bF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2 cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhp UWlweEhaaUNHNjJ3JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmO2NvbG9y OmJsYWNrO3RleHQtZGVjb3JhdGlvbjpub25lIj40LjEuNTwvc3Bhbj48L2E+PGEgbmFtZT0ibV80 ODE4NDQwOTQ5OTAwOTg1NzUzX3NlY3Rpb24tNC4xLjUiPjwvYT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+LiZu YnNwOw0KICZxdW90O25iZiZxdW90OyAoTm90IEJlZm9yZSkgQ2xhaW08L3NwYW4+PG86cD48L286 cD48L2g0Pg0KPHByZT4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDs8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgVGhlICZxdW90O25iZiZxdW90OyAobm90IGJl Zm9yZSkgY2xhaW0gaWRlbnRpZmllcyB0aGUgdGltZSBiZWZvcmUgd2hpY2ggdGhlIEpXVDxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBNVVNUIE5PVCBiZSBhY2NlcHRlZCBmb3Ig cHJvY2Vzc2luZy4mbmJzcDsgVGhlIHByb2Nlc3Npbmcgb2YgdGhlICZxdW90O25iZiZxdW90Ozxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBjbGFpbSByZXF1aXJlcyB0aGF0IHRo ZSBjdXJyZW50IGRhdGUvdGltZSBNVVNUIGJlIGFmdGVyIG9yIGVxdWFsIHRvPG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZSBub3QtYmVmb3JlIGRhdGUvdGltZSBsaXN0ZWQg aW4gdGhlICZxdW90O25iZiZxdW90OyBjbGFpbS4mbmJzcDsgSW1wbGVtZW50ZXJzIE1BWTxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBwcm92aWRlIGZvciBzb21lIHNtYWxsIGxl ZXdheSwgdXN1YWxseSBubyBtb3JlIHRoYW4gYSBmZXcgbWludXRlcywgdG88bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgYWNjb3VudCBmb3IgY2xvY2sgc2tldy4mbmJzcDsgSXRz IHZhbHVlIE1VU1QgYmUgYSBudW1iZXIgY29udGFpbmluZyBhPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7IE51bWVyaWNEYXRlIHZhbHVlLiZuYnNwOyBVc2Ugb2YgdGhpcyBjbGFp bSBpcyBPUFRJT05BTC48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFzIGRlZmluZWQgaW4gU0VUOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsgbmJmPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9y Z19odG1sX3JmYzc1MTktMjNzZWN0aW9uLTJENC4xLjUmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZ dW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdD SDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNC alVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJH T25pSGlRaXB4SFppQ0c2MncmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+U2VjdGlvbiZuYnNwOzQu MS41IFtSRkM3NTE5XTwvYT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGE8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgTnVtZXJpY0RhdGUuJm5i c3A7IEluIHRoZSBjb250ZXh0IG9mIHRoZSBTRVQgdG9rZW4gaXQgU0hBTEwgYmU8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgaW50ZXJwcmV0ZWQg dG8gbWVhbiBhIGRhdGUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRvIGhhdmU8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgb2NjdXJy ZWQgKGluIHRoZSBwYXN0KSBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuJm5ic3A7IE5vdGU6 IHRoZXJlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IE1BWSBiZSBzb21lIGNhc2VzIHdoZXJlICZxdW90O25iZiZxdW90OyBpcyBzdGlsbCBzbWFs bGVyIHRoYW4gJnF1b3Q7aWF0JnF1b3Q7IHN1Y2ggYXM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgd2hlbiBpdCB0b29rIGFuIGV4dGVuZGVkIHRp bWUgZm9yIGEgU0VUIHRvIGJlIGlzc3VlZCAoZm9yIGV4YW1wbGU8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYWZ0ZXIgc29tZSBhbmFseXNpcyku Jm5ic3A7IFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlcmUgaXMgYW4gYXJndW1lbnQgdGhhdCB0 aGUgcmVkZWZpbml0aW9uIHdpbGwgY2F1c2UgY29uZnVzaW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgcHJvcG9zYWwgaXMg dG8gcmVnaXN0ZXIgYSBkaWZmZXJlbnQgY2xhaW0gbmFtZSBzdWNoIGFzIOKAnHRvZeKAnSAodGlt ZSBvZiBldmVudCkuIFRoZSBwcm9wb3NlZCBuZXc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmRlZmluaXRpb246PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwcmU+dG9lPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1sX3Jm Yzc1MTktMjNzZWN0aW9uLTJENC4xLjUmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VH SnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpC cFpZdUNWZ0hTaWNINjF3JmFtcDtzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25pSGlRaXB4 SFppQ0c2MncmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+U2VjdGlvbiZuYnNwOzQuMS41IFtSRkM3 NTE5XTwvYT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGE8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgTnVtZXJpY0RhdGUuJm5ic3A7IFRoZSB2 YWx1ZSBpcyB0aGUgZGF0ZSBhbmQgdGltZSBpbiB3aGljaCB0aGUgZXZlbnQgaXMgYmVsaWV2ZWQg dG8gaGF2ZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBvY2N1cnJlZCBpbiB0aGUgcGFzdCBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuIFRo aXMgY2xhaW0gaXMgT1BUSU9OQUwuPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IFdoZW4gbm90IGFzc2VydGVkLCB0aGUgdmFsdWUgb2Yg4oCcdG9l 4oCdIE1BWSBiZSBhc3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0uPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmU+bmJmPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRoaXMgY2xhaW0g aXMgbm90IHVzZWQgaW4gU0VUIEV2ZW50cy4gSWYgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBTSE9VTEQ8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYmUg aWdub3JlZC48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkFyZSB0aGVyZSBhbnkgb2JqZWN0aW9ucyB0byB0aGUgcHJvcG9zZWQgY2hhbmdl PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENv cnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3Q8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2 cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz0xX1o3T3ZBeWF4bGVzQ2RMTkM1cXNhNVhqOVBaUS1M TWJDYV9obVRvMmVNJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPnd3dy5pbmRlcGVuZGVudGlkLmNv bTwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJl Zj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50 QG9yYWNsZS5jb208L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8 YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3Jn PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZh bXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmYW1wO3M9OEFv b0RXWTFGd1RHM0JqMkVMV3FwVDdYQWFVWUFVVHhnNzhrZGIwVk9OOCZhbXA7ZT0iIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGJyPg0KPGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7U2Vnb2UgVUkmcXVvdDs7Y29sb3I6IzU1NTU1NTtib3JkZXI6bm9uZSB3aW5kb3d0ZXh0IDEu MHB0O3BhZGRpbmc6MGluIj5DT05GSURFTlRJQUxJVFkgTk9USUNFOiBUaGlzIGVtYWlsIG1heSBj b250YWluIGNvbmZpZGVudGlhbCBhbmQgcHJpdmlsZWdlZCBtYXRlcmlhbCBmb3IgdGhlIHNvbGUg dXNlIG9mIHRoZSBpbnRlbmRlZCByZWNpcGllbnQocykuIEFueSByZXZpZXcsDQogdXNlLCBkaXN0 cmlidXRpb24gb3IgZGlzY2xvc3VyZSBieSBvdGhlcnMgaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4m bmJzcDsgSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9uIGluIGVycm9yLCBw bGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYnkgZS1tYWlsIGFuZCBkZWxldGUg dGhlIG1lc3NhZ2UgYW5kIGFueSBmaWxlIGF0dGFjaG1lbnRzIGZyb20geW91ciBjb21wdXRlci4g VGhhbmsgeW91Ljwvc3Bhbj48L2k+PC9iPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxi cj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRAaWV0Zi5vcmc8 L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFt cDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1Ni SzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1w O209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz04QW9v RFdZMUZ3VEczQmoyRUxXcXBUN1hBYVVZQVVUeGc3OGtkYjBWT044JmFtcDtlPSI+aHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdf bWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2 cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz04QW9vRFdZMUZ3VEczQmoyRUxXcXBUN1hBYVVZQVVU eGc3OGtkYjBWT044JmFtcDtlPTwvYT4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_A2458FA9449241EA8FFA5BF3E5ECF377amazoncom_-- From nobody Mon Oct 23 18:15:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3251F13AAFF for ; Mon, 23 Oct 2017 18:15:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.709 X-Spam-Level: X-Spam-Status: No, score=-0.709 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JrUo07c_HSOE for ; Mon, 23 Oct 2017 18:15:45 -0700 (PDT) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8737E138BE2 for ; Mon, 23 Oct 2017 18:15:45 -0700 (PDT) Received: by mail-it0-x22d.google.com with SMTP id l196so8151986itl.4 for ; Mon, 23 Oct 2017 18:15:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LAR2AXu09Ts/orvTSJK7fTEH+tCFm/lWk8NDJnhYcHg=; b=V2qgBjHHJZ0lBIh7UjrJklWcRpJjU68J7V9m4fpIQdgp4H/ZwsCeqwNumMxCVxXfyd nSkz4kFcNVMe52DT+Ttx8XpXvjQmAf/+pfB8/LOCyGDj9tNxNpQb22XLMM7OJ/BkPqSo 1lJZN3AjcrS/Tk3Blt6vN7pqHhv21qjIbuGNWH82ep3uq7gmbRo7+6Z+lM5B5BbF1TcX u6ot+Khvk9QhoEcd9cwxPPbpCar7nxfntx0zeedllXJWR/vweuAqYYPRBpTl/euR7J+d ztpmbEhF2UEoF8ImCJqqTuIn7YRVSEYxt27lwKlpkUVZMtDbUyEer0oNzVR+s4Gsf2qX NPqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LAR2AXu09Ts/orvTSJK7fTEH+tCFm/lWk8NDJnhYcHg=; b=O5ccybzR9LnhARdJ++1jcE6AmPT0veO6Rgzrx21b4o9t0mGC/eNlL+nwvWLwhWtsIU dG09gmD3kvBZ8cZBGW30qDEWvSZciT2hY10kpV7um0Eb2P+eXnJ16vdjZW50iwJy0gkj 1SPrgKvwu3fnO6dApjLyjkfqvqApSg0yp2xQGNIDRdbeiaRD1/fJi+nO1E/x2A4iCcZv 3qaJDUjbwbVgQuzm2MHRHVMBtfdxm+Oj71d1YYgemMDNXOHEPYkVy3aOOPONybdQve5C mmJstUdkU3381wivooruU+hq+EF657ebtl0Rgds+bFsDppkCYu3N7YqVy8J6GufCoa7r VDOg== X-Gm-Message-State: AMCzsaXoN5yaafhWynzfq7NRbUxtPv+B904vGOolv+G33caPgyEaUj5z uIV9+enu1tj1XimR/XfjGmtEv9uiDHgsYx62vWtVcA== X-Google-Smtp-Source: ABhQp+Rom004EpyaxPo1kMUqGyFINRiK8ILn56Xgcu9/gnYwcVIXAcRUjE/WnVr9mnGpTAitN3FTWDF5F3Kd2uWRR3s= X-Received: by 10.36.29.19 with SMTP id 19mr10419817itj.86.1508807744457; Mon, 23 Oct 2017 18:15:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Mon, 23 Oct 2017 18:15:23 -0700 (PDT) In-Reply-To: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> From: Marius Scurtescu Date: Mon, 23 Oct 2017 18:15:23 -0700 Message-ID: To: "Richard Backman, Annabelle" Cc: "Phil Hunt (IDM)" , Mike Jones , Brian Campbell , ID Events Mailing List Content-Type: multipart/alternative; boundary="001a1143e546a523c6055c40adc8" Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 01:15:49 -0000 --001a1143e546a523c6055c40adc8 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle < richanna@amazon.com> wrote: > Agreed overall. Having reread the proposed text, I suggest striking the > last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2= =80=9D MAY be assumed to be > the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is necessa= ry or particularly helpful > to standardize the semantics of a missing time-of-event claim at the SET > level. > +1 > > > -- > > Annabelle Richard Backman > > Amazon =E2=80=93 Identity Services > > > > > > *From: *Id-event on behalf of "Phil Hunt > (IDM)" > *Date: *Monday, October 23, 2017 at 5:48 PM > *To: *Mike Jones > *Cc: *Brian Campbell , ID Events Mailing List > > > *Subject: *Re: [Id-event] Replacing "nbf" claim with a new "toe" claim > > > > Agreed +1 on Brian's edits. > > Phil > > > On Oct 23, 2017, at 5:05 PM, Mike Jones > wrote: > > Annabelle and I agreed with this proposed change (as correctly wordsmithe= d > by Brian) during our in-person review =E2=80=93 as also noted in the repl= y to > Marius=E2=80=99 comments. > > > > Thanks > Phil and all, > > -- Mike > > > > *From:* Id-event [mailto:id-event-bounces@ietf.org > ] *On Behalf Of *Brian Campbell > *Sent:* Thursday, September 28, 2017 8:23 AM > *To:* Phil Hunt > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Replacing "nbf" claim with a new "toe" claim > > > > +1 to SET defining a time of event claim rather than trying to redefine a > standard claim. And who doesn't like a claim named "toe"? > > However, the text there for nbf is still effectively redefining it by > saying it should be ignored, which isn't consistent with the "MUST NOT be > accepted for processing" from RFC 7519. It would be more appropriate to s= ay > that nbf should/must not be included in a SET. Or just not mention nbf at > all. But don't change the meaning. > > Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is the > nbf section. The value of the toe claim is a NumericDate, which is define= d > in Sec 2 RFC7519. But toe has no relation to nbf and no reason to referen= ce > nbf. > > > > On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt wrote: > > During the OpenID RISC Face to Face meeting a question came up regarding > SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that rede= finition was appropriate. > > > > The intention of SETs definition is to allow SET Transmitters to indicate > that an event may have occurred as early as a specified date =E2=80=94 a = date which > is different from the issuance date of the SET. In particular this is > useful in cases where the state change is believed to have occurred earli= er > than the time of issuance (e.g. because the incident was discovered throu= gh > an administrative review or data analysis to have occurred in the past). > > > > The definition from JWT is: > 4.1.5 > . > "nbf" (Not Before) Claim > > > > > > The "nbf" (not before) claim identifies the time before which the JWT > > MUST NOT be accepted for processing. The processing of the "nbf" > > claim requires that the current date/time MUST be after or equal to > > the not-before date/time listed in the "nbf" claim. Implementers MAY > > provide for some small leeway, usually no more than a few minutes, to > > account for clock skew. Its value MUST be a number containing a > > NumericDate value. Use of this claim is OPTIONAL. > > > > > > As defined in SET: > > nbf > > Defined by Section 4.1.5 [RFC7519] , a number whose value= is a > > NumericDate. In the context of the SET token it SHALL be > > interpreted to mean a date in which the event is believed to have > > occurred (in the past) or will occur in the future. Note: there > > MAY be some cases where "nbf" is still smaller than "iat" such as > > when it took an extended time for a SET to be issued (for example > > after some analysis). This claim is OPTIONAL. > > > > There is an argument that the redefinition will cause confusion. > > > > The proposal is to register a different claim name such as =E2=80=9Ctoe= =E2=80=9D (time of > event). The proposed new > > definition: > > > > toe > > Defined by Section 4.1.5 [RFC7519] , a number whose value= is a > > NumericDate. The value is the date and time in which the event is = believed to have > > occurred in the past or will occur in the future. This claim is OPT= IONAL. > > When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assume= d to be the value of =E2=80=9Ciat=E2=80=9D. > > > > nbf > > This claim is not used in SET Events. If asserted, the value SHOULD > > be ignored. > > > > > > Are there any objections to the proposed change? > > > > Phil > > > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > > phil.hunt@oracle.com > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > *CONFIDENTIALITY NOTICE: This email may contain confidential and > privileged material for the sole use of the intended recipient(s). Any > review, use, distribution or disclosure by others is strictly prohibited. > If you have received this communication in error, please notify the sende= r > immediately by e-mail and delete the message and any file attachments fro= m > your computer. Thank you.* > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_ > FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAU > Txg78kdb0VON8&e=3D > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a1143e546a523c6055c40adc8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On M= on, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle &= lt;richanna@amazon.com> wrote:

Agreed overall. Having reread the proposed text, I s= uggest striking the last sentence, =E2=80=9CWhen not asserted, the value of= =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80= =9D.=E2=80=9D I do not think it is necessary or particularly helpful to sta= ndardize the semantics of a missing time-of-event claim at the SET level.

=

+1

=C2=A0

=C2=A0

--=C2=A0

Annabelle Richard Backman

Amazon =E2=80=93 Identity Services=

=C2=A0

=C2=A0

From= : Id-event <id-event-bounces@ietf.org> on behalf of "Phil Hunt (IDM)"= <phil.hunt@oracle.com>
Date: Monday, October 23, 2017 at 5:48 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Brian Campbell <bcampbell@pingidentity.com>, ID = Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Replacing "nbf" claim with a new &= quot;toe" claim

=C2=A0

Agreed +1 on Brian's edits.=C2=A0

Phil


On Oct 23, 2017, at 5:05 PM, Mike Jones <Michael.Jones@microsoft.= com> wrote:

Annabelle and I agreed= with this proposed change (as correctly wordsmithed by Brian) during our i= n-person review =E2=80=93 as also noted in the reply to Marius=E2=80=99 com= ments.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Thanks= Phil and all,

=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mik= e

=C2=A0

From: Id-event [mailto:id-event-bounces@= ietf.org] On Behalf Of Brian Campbell
Sent: Thursday, September 28, 2017 8:23 AM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Replacing "nbf" claim with a new &= quot;toe" claim

=C2=A0

+1 to SET defining a = time of event claim rather than trying to redefine a standard claim. And wh= o doesn't like a claim named "toe"?

However, the text the= re for nbf is still effectively redefining it by saying it should be ignore= d, which isn't consistent with the "MUST NOT be accepted for proce= ssing" from RFC 7519. It would be more appropriate to say that nbf should/must not be included in a SET. Or just not mention = nbf at all. But don't change the meaning.

Also toe would not be "Defined by Section 4.1.5= [RFC7519]", which is the nbf section. The value of the toe claim is a= NumericDate, which is defined in Sec 2 RFC7519. But toe has no relation to= nbf and no reason to reference nbf.=C2=A0

=C2=A0

On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt <phil.= hunt@oracle.com> wrote:

During the OpenID RISC Face to Face meeting a questi= on came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D an= d whether that redefinition was appropriate.

=C2=A0

The intention of SETs definition is to allow SET Tra= nsmitters to indicate that an event may have occurred as early as a specifi= ed date =E2=80=94 a date which is different from the issuance date of the S= ET. In particular this is useful in cases where the state change is believed to have occurred earlier than the time = of issuance (e.g. because the incident was discovered through an administra= tive review or data analysis to have occurred in the past).

=C2=A0

The definition from JWT is:

4.1.5= = .=C2=A0 "nbf" (Not Before) Claim

=C2=A0
=C2=A0
=C2=A0=C2=A0 The "nbf" (not before) claim identifies the tim=
e before which the JWT
=C2=A0=C2=A0 MUST NOT be accepted for processing.=C2=A0 The processing=
 of the "nbf"
=C2=A0=C2=A0 claim requires that the current date/time MUST be after o=
r equal to
=C2=A0=C2=A0 the not-before date/time listed in the "nbf" cl=
aim.=C2=A0 Implementers MAY
=C2=A0=C2=A0 provide for some small leeway, usually no more than a few=
 minutes, to
=C2=A0=C2=A0 account for clock skew.=C2=A0 Its value MUST be a number =
containing a
=C2=A0=C2=A0 NumericDate value.=C2=A0 Use of this claim is OPTIONAL.

=C2=A0

=C2=A0

As defined in SET:

=C2=A0=C2=A0 nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Section=C2=A04.1.5 [RFC=
7519], a number whose value is a
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 In the context of th=
e SET token it SHALL be
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 interpreted to mean a date in which the=
 event is believed to have
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occurred (in the past) or will occur in=
 the future.=C2=A0 Note: there
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 MAY be some cases where "nbf"=
 is still smaller than "iat" such as
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 when it took an extended time for a SET=
 to be issued (for example
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 after some analysis).=C2=A0 This claim =
is OPTIONAL.

=C2=A0

There is an argument that the redefinition will caus= e confusion.=C2=A0

=C2=A0

The proposal is to register a different claim name s= uch as =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new

definition:

=C2=A0

toe
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Section=C2=A04.1.5 [RFC=
7519], a number whose value is a
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 The value is the dat=
e and time in which the event is believed to have
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occurred in the past or will occur in t=
he future. This claim is OPTIONAL.
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 When not asserted, the value of =E2=80=
=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=

=C2=A0
nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 This claim is not used in SET Events. I=
f asserted, the value SHOULD
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 be ignored.

=C2=A0

=C2=A0

Are there any objections to the proposed change?<= /u>

=C2=A0

Phil

=C2=A0<= /u>

Oracle Corporation, Iden= tity Cloud Services Architect

@independentid=

phil.hunt@oracle.com=

=C2=A0


_______________________________________________
Id-event mailing list
Id-= event@ietf.org
= https://www.ietf.org/mailman/listinfo/id-event

=C2=A0


CONFIDENTIALITY NOTICE:= This email may contain confidential and privileged material for the sole u= se of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.=C2=A0 If= you have received this communication in error, please notify the sender im= mediately by e-mail and delete the message and any file attachments from yo= ur computer. Thank you.


_______________________________________________
Id-event mailing list
Id-event@ietf.org=
https://www.ietf.org/mailman/lis= tinfo/id-event


--001a1143e546a523c6055c40adc8-- From nobody Mon Oct 23 18:45:36 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 683D7139F67 for ; Mon, 23 Oct 2017 18:45:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.749 X-Spam-Level: X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nIEz1Xq5OmN4 for ; Mon, 23 Oct 2017 18:45:32 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F23913942F for ; Mon, 23 Oct 2017 18:45:32 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9O1jTPi012861 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 01:45:30 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9O1jT6r007226 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 01:45:29 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9O1jT6F009408; Tue, 24 Oct 2017 01:45:29 GMT Received: from [192.168.1.9] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 18:45:28 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-7E9EA998-6325-4A39-80EB-CD15992D2B81 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Mon, 23 Oct 2017 18:45:26 -0700 Cc: ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <9D836134-3DD2-4444-92B4-07C7DA49D51A@oracle.com> References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> To: Marius Scurtescu X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 01:45:35 -0000 --Apple-Mail-7E9EA998-6325-4A39-80EB-CD15992D2B81 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Ok. I will do search replace on subscriber as they should all be receiver.=20= Thks Phil > On Oct 23, 2017, at 5:52 PM, Marius Scurtescu wrot= e: >=20 > I raised a wording issue, not sure if it still applies: >=20 > "The abstract mentions "issuer" and "receiver" in the last sentence. "rece= iver" does not sound right (that should be used in the context of a transmit= ter), but I don't have a better suggestion. Audience? > The last paragraph of section 1 mentions "subscriber". I think it should b= e either "receiver" or "audience"." >=20 >=20 >=20 > Marius >=20 >> On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (IDM) w= rote: >> Ok. But you raised the concern. Are you withdrawing it? >>=20 >> Phil >>=20 >>> On Oct 23, 2017, at 5:47 PM, Marius Scurtescu wr= ote: >>>=20 >>>> On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt wrote= : >>>> It=E2=80=99s quite relevant to those with distributed architectures. >>>>=20 >>>> If an Event Stream requires that SETs need to be encrypted (using JWE),= the SETs needs to be encrypted so the =E2=80=9Creceiver" can read it. Rega= rdless, =E2=80=9Caud=E2=80=9D should be interpreted by the traditional JWT m= ethod which suggests the security domain the event is for. For example, a w= eb site relying party does not have the capability to process (or issue) eve= nts itself (eg. because of a distributed architecture). The relying party as= signs another entity the role of Event Receiver (or Transmitter). =20 >>>>=20 >>>> The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for =E2= =80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can read the S= ET which will make it impossible to for another server to handle or worse, i= t would require sharing of private keys.=20 >>>=20 >>> The RP controls the configuration of the stream, so they can specify an e= ndpoint that belongs to the outsourced receiver and they can also specify an= encryption key that is controlled by the outsourced receiver. The RP does n= ot need access to the private key at all. >>>=20 >>> I still think it is irrelevant to the transmitter, or to this spec. I ag= ree it is totally relevant for the RP, >>>=20 >>>=20 >>>>=20 >>>> Phil >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>> @independentid >>>> www.independentid.com >>>> phil.hunt@oracle.com >>>>=20 >>>>> On Oct 23, 2017, at 3:58 PM, Marius Scurtescu w= rote: >>>>>=20 >>>>> I think "aud" should point to the Receiver, the outsourcing is irrelev= ant. >>>>>=20 >>>>> Nothing needs to change here IMO. >>>>>=20 >>>>> Marius >>>>>=20 >>>>>> On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt wro= te: >>>>>> It seems reasonable to further clarify that the definition of a recei= ver could be improved. >>>>>>=20 >>>>>> I propose to change from: >>>>>> Event Receiver >>>>>> An Event Receiver is an entity that receives SETs through some >>>>>> distribution method. >>>>>>=20 >>>>>> To: >>>>>> Event Receiver >>>>>> An Event Receiver is an entity that receives SETs through some >>>>>> distribution method. An Event Receiver MAY be a different >>>>>> entity than that described by the =E2=80=9Caud=E2=80=9D claim. >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>> @independentid >>>>>> www.independentid.com >>>>>> phil.hunt@oracle.com >>>>>>=20 >>>>>>> On Oct 23, 2017, at 2:38 PM, Marius Scurtescu wrote: >>>>>>>=20 >>>>>>> I think "aud" is perfectly fine. >>>>>>>=20 >>>>>>> IMO it should make no difference for the Transmitter that the event i= s actually handled by an outsourced entity, the RP trusts that entity and th= e event is generated and targeted to the RP and not to the current outsource= d processor. >>>>>>>=20 >>>>>>> Marius >>>>>>>=20 >>>>>>>> On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt w= rote: >>>>>>>>=20 >>>>>>>> All, >>>>>>>>=20 >>>>>>>> I am reviewing the previous feedback from WGLC and will be bringing= up any unresolved issues for quick discussion/confirmation=E2=80=A6 >>>>>>>>=20 >>>>>>>> Following up on Marius and Henk=E2=80=99s comment, I am concerned t= hat =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied to a= security domain definition. We should not necessarily say this is the recei= ver though it often turns out to be. For example a RP (=E2=80=9Caud=E2=80=9D= ) has outsourced events processing to a third party (the so called receiver)= . >>>>>>>>=20 >>>>>>>> I am happy with the current claim set, but maybe some text explaini= ng that a receiver does not have to be the aud is appropriate? I don=E2=80=99= t see any benefit to having a receiver claim as this could complicate proces= sing more than its worth. >>>>>>>>=20 >>>>>>>> There are a few other comments in this thread, but this one seemed t= he most unresolved. >>>>>>>>=20 >>>>>>>> Phil >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>> On Aug 3, 2017, at 8:03 AM, Henk Birkholz wrote: >>>>>>>>>=20 >>>>>>>>> Hello, >>>>>>>>>=20 >>>>>>>>> to me, the "audience" claim seems to be a good choice here. >>>>>>>>>=20 >>>>>>>>> Viele Gr=C3=BC=C3=9Fe, >>>>>>>>>=20 >>>>>>>>> Henk >>>>>>>>>=20 >>>>>>>>>> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>>>>>>>>> The abstract mentions "issuer" and "receiver" in the last sentenc= e. "receiver" does not sound right (that should be used in the context of a t= ransmitter), but I don't have a better suggestion. Audience? >>>>>>>>>> The last paragraph of section 1 mentions "subscriber". I think it= should be either "receiver" or "audience". >>>>>>>>>> The explanation for figure 1 states that the issuer denotes the t= ransmitter. If the issuer and the transmitter are assumed to be the same ent= ity, then the transmitter definition in section 1.2 should make that clear. >>>>>>>>>> Figure 3, I think the "sub" claim should be nested in the event, n= ext to the issuer that provides the correct context. The "iss" and "sub" def= initions in 2.1 also touch on this, providing conflicting advice. >>>>>>>>>> Section 2,1, definition of "nbf". The definition says that this i= s the event time. I see two problems: >>>>>>>>>> - the name suggest "not before", not exactly the same as event ti= me >>>>>>>>>> - there can be multiple events >>>>>>>>>> maybe this claim should be dropped? >>>>>>>>>> Section 2.1, definition of "exp". Omitting this claim is the shor= t term solution to the confusion issue. Why not mention that and that it SHO= ULD NOT be used? >>>>>>>>>> Section 2.1, definition of "events". It states that all events mu= st refer to the same logical event. Lately in discussions we reached the con= clusion that all events in a SET should be defined in the same profile, whic= h is a stronger requirement. I think this definition should mention that. >>>>>>>>>> Regarding events and profiles. There was a proposal to add a new c= laim to uniquely identify the profile. I think we need to discuss that. >>>>>>>>>> Figure 5. Maybe a signed example would be better, especially that= the next paragraph mentions that signatures or encryption should be used. >>>>>>>>>> Section 4.5, second paragraph. Mentions that "nonce" is also requ= ired, but that is not actually true. Id Tokens issued at the token endpoint f= or example will not have it. I suggest we drop the whole paragraph. >>>>>>>>>> Marius >>>>>>>>>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer > wrote: >>>>>>>>>> This is to announce working group last call on this draft >>>>>>>>>> (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatr= acker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCX= CgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C= _lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W= 54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D ). >>>>>>>>>> Please send your comments to the list. Even if you are perfect= ly >>>>>>>>>> happy with the draft, please let us know that you support its >>>>>>>>>> publication as-is by posting to the list. >>>>>>>>>> Because of the summer holidays, this last call is open for 3 w= eeks, >>>>>>>>>> until Aug. 21. >>>>>>>>>> Thanks, >>>>>>>>>> Dick and Yaron >>>>>>>>>> _______________________________________________ >>>>>>>>>> Id-event mailing list >>>>>>>>>> Id-event@ietf.org >>>>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet= f.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKC= X5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFE= V9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXO= RUpSDnvA&e=3D >>>>>>>>>> _______________________________________________ >>>>>>>>>> Id-event mailing list >>>>>>>>>> Id-event@ietf.org >>>>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5Y= TpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9S= Q_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUp= SDnvA&e=3D=20 >>>>>>>>>=20 >>>>>>>>> _______________________________________________ >>>>>>>>> Id-event mailing list >>>>>>>>> Id-event@ietf.org >>>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.or= g_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YT= pkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ= _lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpS= DnvA&e=3D >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>>=20 >>>>>>>=20 >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_ma= ilman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY= 057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXo= RtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0= &e=3D=20 >>>>=20 >>>=20 >=20 --Apple-Mail-7E9EA998-6325-4A39-80EB-CD15992D2B81 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Ok. I will do search replace on subscr= iber as they should all be receiver. 

Thks

Phil

O= n Oct 23, 2017, at 5:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I raised a wording issue, not sure if it s= till applies:

"The abstract mentions "issuer" and "receiv= er" in the last sentence. "receiver" does not sound right (that should be us= ed in the context of a transmitter), but I don't have a better suggestion. A= udience?
The last paragraph of section 1 mentions "subscriber". I t= hink it should be either "receiver" or "audience"."



Marius

On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (I= DM) <phil.hunt@oracle.com> wrote:
Ok. But you raised the concern. Are you withd= rawing it?

Phil=

On Oct 23, 2017, at 5:47 PM, Ma= rius Scurtescu <mscurtescu@google.com> wrote:

On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It=E2=80=99s quite relevan= t to those with distributed architectures.

If an Ev= ent Stream requires that SETs need to be encrypted (using JWE), the SETs nee= ds to be encrypted so the =E2=80=9Creceiver" can read it.  Regardless, =E2= =80=9Caud=E2=80=9D should be interpreted by the traditional JWT method which= suggests the security domain the event is for.  For example, a web sit= e relying party does not have the capability to process (or issue) events it= self (eg. because of a distributed architecture). The relying party assigns a= nother entity the role of Event Receiver (or Transmitter).  
=
The problem being that If the =E2=80=9Cset=E2=80=9D is encryp= ted for =E2=80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can= read the SET which will make it impossible to for another server to handle o= r worse, it would require sharing of private keys. 

The RP controls the configuration of the stream, so= they can specify an endpoint that belongs to the outsourced receiver and th= ey can also specify an encryption key that is controlled by the outsourced r= eceiver. The RP does not need access to the private key at all.
I still think it is irrelevant to the transmitter, or to this s= pec. I agree it is totally relevant for the RP,


Phil

Ora= cle Corporation, Identity Cloud Services Architect
@independentid<= /div>
phil.hunt@oracle.com
=

On Oct 23, 2017, at 3:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "aud" should= point to the Receiver, the outsourcing is irrelevant.

No= thing needs to change here IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <phil.hunt@oracle.com> w= rote:
I= t seems reasonable to further clarify that the definition of a receiver coul= d be improved.

I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different
=
      entity than that described by the =E2=80=9Caud=E2=80=9D claim.

<= div>
Phil

Oracle Corporation, Identity Cloud Se= rvices Architect
@independentid
phil.hunt@oracle.com
=

On Oct 23, 2017, at 2:38 PM, Marius S= curtescu <mscurtescu@google.com> wrote:
<= br class=3D"m_270754178272331192m_8638809138429705438m_5224536889703988085Ap= ple-interchange-newline">
I think "aud" is perfectly fi= ne.

IMO it should make no difference for the Transmitter t= hat the event is actually handled by an outsourced entity, the RP trusts tha= t entity and the event is generated and targeted to the RP and not to the cu= rrent outsourced processor.

Marius
<= /div>
On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> w= rote:
<= div>
All,

I am reviewing the previou= s feedback from WGLC and will be bringing up any unresolved issues for quick= discussion/confirmation=E2=80=A6

Following up on M= arius and Henk=E2=80=99s comment, I am concerned that =E2=80=9Caud=E2=80=9D h= as a very specific meaning and is often tied to a security domain definition= . We should not necessarily say this is the receiver though it often turns o= ut to be. For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events pro= cessing to a third party (the so called receiver).

= I am happy with the current claim set, but maybe some text explaining that a= receiver does not have to be the aud is appropriate?  I don=E2=80=99t s= ee any benefit to having a receiver claim as this could complicate processin= g more than its worth.

There are a few other commen= ts in this thread, but this one seemed the most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:

Hello,<= /span>

to me, the "audience" claim seems to be a go= od choice here.

Viele Gr=C3=BC=C3=9Fe,
Henk

On 08/02/201= 7 11:45 PM, Marius Scurtescu wrote:
The abstract mention= s "issuer" and "receiver" in the last sentence. "receiver" does not sound ri= ght (that should be used in the context of a transmitter), but I don't have a= better suggestion. Audience?
The last paragraph of section 1 mentions "s= ubscriber". I think it should be either "receiver" or "audience".
The exp= lanation for figure 1 states that the issuer denotes the transmitter. If the= issuer and the transmitter are assumed to be the same entity, then the tran= smitter definition in section 1.2 should make that clear.
Figure 3, I thi= nk the "sub" claim should be nested in the event, next to the issuer that pr= ovides the correct context. The "iss" and "sub" definitions in 2.1 also touc= h on this, providing conflicting advice.
Section 2,1, definition of "nbf"= . The definition says that this is the event time. I see two problems:
- t= he name suggest "not before", not exactly the same as event time
- there c= an be multiple events
maybe this claim should be dropped?
Section 2.1,= definition of "exp". Omitting this claim is the short term solution to the c= onfusion issue. Why not mention that and that it SHOULD NOT be used?
Sect= ion 2.1, definition of "events". It states that all events must refer to the= same logical event. Lately in discussions we reached the conclusion that al= l events in a SET should be defined in the same profile, which is a stronger= requirement. I think this definition should mention that.
Regarding even= ts and profiles. There was a proposal to add a new claim to uniquely identif= y the profile. I think we need to discuss that.
Figure 5. Maybe a signed e= xample would be better, especially that the next paragraph mentions that sig= natures or encryption should be used.
Section 4.5, second paragraph. Ment= ions that "nonce" is also required, but that is not actually true. Id Tokens= issued at the token endpoint for example will not have it. I suggest we dro= p the whole paragraph.
Marius
On Mon, Jul 31, 2017 at 1:40 PM, Yaron S= heffer <yaronf.ietf@gmail.com <mailto:yar= onf.ietf@gmail.com>> wrote:
   This is to announ= ce working group last call on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3= A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d= =3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&= r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9S= Q_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6c= xjlKfjqT99u5-Ojw4Fw&e=3D     <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrack= er.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&am= p;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRr= KugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS= 7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5= -Ojw4Fw&e=3D >).
   Please send your comments to the list. Even if y= ou are perfectly
   happy with the draft, please let us kn= ow that you support its
   publication as-is by posting to= the list.
   Because of the summer holidays, this last ca= ll is open for 3 weeks,
   until Aug. 21.
  &= nbsp;Thanks,
        Dick and Yar= on
   _______________________________________________=
   Id-event mailing list
   Id-event@ietf.org = <mailto:Id-event@ietf.org>
 &n= bsp; https://urldefense.proofpoint.com/v2/url?u=3Dh= ttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&a= mp;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biR= rKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lv= S7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXO= RUpSDnvA&e=3D     <https://urldefense.proofpo= int.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Dev= ent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DU= UydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8p= EkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >
____________________________________= ___________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-= 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3D= RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0= FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXE= ZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnv= A&e=3D 
<= /blockquote>
_______________________________________________
Id-event mailing list=
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/u= rl?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3D= DwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw= _LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJ= INLVTXORUpSDnvA&e=3D
<= /blockquote>



________________= _______________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo= /id-event




=
_______________________________________________
Id-event mailing lis= t
Id-event@ietf.org
htt= ps://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_m= ailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvl= ZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjW= wlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_tq5wICJLi5itJHRai0&= amp;s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e=3D



= --Apple-Mail-7E9EA998-6325-4A39-80EB-CD15992D2B81-- From nobody Mon Oct 23 19:02:30 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4A93138BE2 for ; Mon, 23 Oct 2017 19:02:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.82 X-Spam-Level: X-Spam-Status: No, score=-11.82 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FlVH4XF9UlZm for ; Mon, 23 Oct 2017 19:02:27 -0700 (PDT) Received: from smtp-fw-6001.amazon.com (smtp-fw-6001.amazon.com [52.95.48.154]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF564138BCD for ; Mon, 23 Oct 2017 19:02:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1508810546; x=1540346546; h=from:to:subject:date:message-id:mime-version; bh=xP0HvdLSUTHyw3pifdVxh0sszy30on6tJZTA/m7/gec=; b=DDdfRePaN96nPaKaJXBHOAmt6XJJioweKKUA7t9JMwHwKeLPLd1e5thZ FNa4Yz4a4Hkg4Xl3KlskkZlt9l0dkaMd4yivtgJ6r0ieV4lxTmjX2Mzre vyvDqI1nMHeKaSW6bqmOFm6WdfToTQFpG8aIahhnIlnEKr3+WO0guDnSL Q=; X-IronPort-AV: E=Sophos;i="5.43,424,1503360000"; d="scan'208,217";a="315300389" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-1e-428a6f71.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6001.iad6.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 24 Oct 2017 02:02:18 +0000 Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-1e-428a6f71.us-east-1.amazon.com (8.14.7/8.14.7) with ESMTP id v9O22Cvv098861 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 24 Oct 2017 02:02:18 GMT Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 24 Oct 2017 02:02:18 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC004.ant.amazon.com (10.43.162.101) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 24 Oct 2017 02:02:17 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Tue, 24 Oct 2017 02:02:17 +0000 From: "Richard Backman, Annabelle" To: ID Events Mailing List Thread-Topic: Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9Q== Date: Tue, 24 Oct 2017 02:02:17 +0000 Message-ID: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.63] Content-Type: multipart/alternative; boundary="_000_2FF066DEA1EB4656AC2374FC11104FFAamazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Subject: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 02:02:29 -0000 --_000_2FF066DEA1EB4656AC2374FC11104FFAamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlIGN1cnJlbnQgZHJhZnQgb2YgdGhlIFNFVCBzcGVjIGFsbG93cyBmb3IgZXhwcmVzc2luZyBt dWx0aXBsZSBldmVudHMgd2l0aGluIHRoZSBzYW1lIHRva2VuLCB3aGljaCBpbnRyb2R1Y2VzIGFk ZGl0aW9uYWwgY29tcGxleGl0eSBhbmQgcm9vbSBmb3IgYW1iaWd1b3VzIHNlbWFudGljcy4gV2Xi gJl2ZSBkaXNjdXNzZWQgdGhpcyBpbiB0aGUgT0lERiBSSVNDIHdvcmtpbmcgZ3JvdXAgYW5kIHRo ZSBjdXJyZW50IGNvbnNlbnN1cyB0aGVyZSBpcyB0aGF0IFJJU0Mgd2lsbCByZXF1aXJlIHRoYXQg UklTQyBldmVudHMgbXVzdCBiZSB0aGUgb25seSBldmVudCBpbiB0aGUgU0VULCBoYXZpbmcgaWRl bnRpZmllZCB3YXlzIHRvIGNsZWFybHkgYW5kIGVhc2lseSBzdXBwb3J0IHRoZSBoYW5kZnVsIG9m IHVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciB0b2tlbiB0aGF0IHBlb3BsZSBoYXZl IHJhaXNlZC4gV2l0aCB0aGF0IGNvbnRleHQgaW4gbWluZCwgSSBwcm9wb3NlIHN0cmlraW5nIHRo ZSBkZWZpbml0aW9uIG9mIHRoZSDigJxldmVudHPigJ0gY2xhaW0gZnJvbSB0aGUgU2VjdXJpdHkg RXZlbnQgVG9rZW4gc3BlYywgYW5kIHJlcGxhY2luZyBpdCB3aXRoIHRoZSBmb2xsb3dpbmcgZGVm aW5pdGlvbiBmb3IgYW4g4oCcZXZlbnTigJ0gY2xhaW0gKHNpbmd1bGFyKToNCg0KZXZlbnQNCkEg SlNPTiBvYmplY3QgY29udGFpbmluZyBhbiAiZXZlbnRfdHlwZSIgbWVtYmVyIHdob3NlIHZhbHVl IGlzIGEgVVJJIHJlcHJlc2VudGluZyBhIHR5cGUgb2YgZXZlbnQgZGVmaW5lZCBpbiBhIFByb2Zp bGluZyBTcGVjaWZpY2F0aW9uLiBUaGUgb2JqZWN0IE1BWSBvdGhlcndpc2UgYmUgZW1wdHksIG9y IE1BWSBjb250YWluIGFkZGl0aW9uYWwgbWVtYmVycyBhcyBkZXNjcmliZWQgYnkgdGhlIFByb2Zp bGluZyBTcGVjaWZpY2F0aW9uLg0KDQpIZXJlIGlzIHRoZSBleGFtcGxlIFNFVCBmcm9tIHNlY3Rp b24gMi4zLCByZXdyaXR0ZW4gd2l0aCB0aGlzIGNoYW5nZSBtaW5kOg0Kew0KICAianRpIjogIjRk MzU1OWVjNjc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4IiwNCiAgImlhdCI6IDE0NTg0OTY0MDQsDQog ImlzcyI6ICJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iLA0KICAiYXVkIjogWw0KICAgICJodHRw czovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIsDQog ICAgImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2 ZWU3Ig0KICBdLA0KDQogICJldmVudCI6IHsNCiAgICAiZXZlbnRfdHlwZSI6ICJ1cm46aWV0Zjpw YXJhbXM6c2NpbTpldmVudDpjcmVhdGUiLA0KICAgICJyZWYiOiAiaHR0cHM6Ly9zY2ltLmV4YW1w bGUuY29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkiLA0KICAgICJhdHRyaWJ1dGVz IjogWyJpZCIsICJuYW1lIiwgInVzZXJOYW1lIiwgInBhc3N3b3JkIiwgImVtYWlscyJdDQogIH0N Cn0NCg0KRG9lcyBhbnlvbmUgaW4gdGhlIHdvcmtpbmcgZ3JvdXAgaGF2ZSB1c2UgY2FzZXMgZm9y IFNFVHMgdGhhdCBjYW5ub3QgYmUgbWV0IGJ5IHRoaXMgcHJvcG9zZWQgdGV4dD8gV2l0aGluIFJJ U0MsIHdlIGlkZW50aWZpZWQgdGhyZWUgdXNlIGNhc2VzLCB3aXRoIHNvbHV0aW9ucyBvdXRsaW5l ZCBiZWxvdzoNCg0KRXh0ZW5zaW9ucw0KRXZlbnQgZXh0ZW5zaW9uIG1lY2hhbmlzbXMgY2FuIGJl IGRlZmluZWQgaW50ZXJuYWwgdG8gdGhlIGV2ZW50IG9iamVjdC4gQSBzaW1wbGUgYXBwcm9hY2gg d291bGQgYmUgdG8gIGRlZmluZSBhbiDigJxleHRlbnNpb25z4oCdIG1lbWJlciB0aGF0IGlzIGEg bGlzdCBvZiBldmVudCBvYmplY3RzIChvciBzZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCd IGNsYWltIGFzIGRlZmluZWQgaW4gdGhlIGN1cnJlbnQgc3BlYykuIFRoaXMgaGFzIHRoZSBhZHZh bnRhZ2Ugb2YgbWFraW5nIGl0IGNsZWFyIGluIHRoZSBkYXRhIHN0cnVjdHVyZSB0aGF0IHRoZXJl IGlzIGEgc2luZ2xlIHByaW1hcnkgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lvbnMu IFRoZXJlIGlzIG5vIHJvb20gZm9yIGNvbmZ1c2lvbiBvdmVyIHdoaWNoIGV2ZW50IGlzIHByaW1h cnksIG9yIGlmIHRoZXJlIGlzIGEgcHJpbWFyeSBldmVudCBhdCBhbGwuIEkgd291bGQgYmUgZmlu ZSB3aXRoIGFkZGluZyBzb21ldGhpbmcgbGlrZSB0aGlzIHRvIG15IHByb3Bvc2VkIHRleHQsIGlm IHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkgdXNlZnVsLg0KDQpBbGlhc2Vz DQpUaGlzIHVzZSBjYXNlIHdhcyBicm91Z2h0IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGlu ZyBjbGllbnRzIGZyb20gZHJhZnQgZXZlbnQgbmFtZXMgdG8gc3RhbmRhcmRpemVkIGV2ZW50IG5h bWVzLiBJbiB0aGlzIGNhc2UsIHRoZSBldmVudCB0cmFuc21pdHRlciBjYW4gdHJhbnNtaXQgdHdv IHRva2VucyBmb3IgdGhlIGxvZ2ljYWwgZXZlbnQsIG9uZSB1c2luZyB0aGUgb2xkIG5hbWUgYW5k IGFub3RoZXIgdXNpbmcgdGhlIG5ldyBuYW1lLg0KDQpSZWxhdGVkIEV2ZW50cw0KVGhlIFNFVCBz cGVjIGRlZmluZXMgdGhlIHR4biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJlbGF0aW5nIGluZGVw ZW5kZW50IHRva2VucyB0aGF0IHJlbGF0ZSB0byB0aGUgc2FtZSBsb2dpY2FsIGV2ZW50Lg0KDQot LQ0KQW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbg0KQW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2aWNl cw0KDQo= --_000_2FF066DEA1EB4656AC2374FC11104FFAamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEy LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4u TXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlu a0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojOTU0RjcyOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4ubXNvSW5zDQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCW1zby1zdHlsZS1uYW1lOiIiOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7DQoJY29sb3I6dGVhbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z dHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0i IzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGUgY3Vy cmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMgYWxsb3dzIGZvciBleHByZXNzaW5nIG11bHRpcGxl IGV2ZW50cyB3aXRoaW4gdGhlIHNhbWUgdG9rZW4sIHdoaWNoIGludHJvZHVjZXMgYWRkaXRpb25h bCBjb21wbGV4aXR5IGFuZCByb29tIGZvciBhbWJpZ3VvdXMgc2VtYW50aWNzLiBXZeKAmXZlIGRp c2N1c3NlZCB0aGlzIGluIHRoZSBPSURGIFJJU0MNCiB3b3JraW5nIGdyb3VwIGFuZCB0aGUgY3Vy cmVudCBjb25zZW5zdXMgdGhlcmUgaXMgdGhhdCBSSVNDIHdpbGwgcmVxdWlyZSB0aGF0IFJJU0Mg ZXZlbnRzIG11c3QgYmUgdGhlIG9ubHkgZXZlbnQgaW4gdGhlIFNFVCwgaGF2aW5nIGlkZW50aWZp ZWQgd2F5cyB0byBjbGVhcmx5IGFuZCBlYXNpbHkgc3VwcG9ydCB0aGUgaGFuZGZ1bCBvZiB1c2Ug Y2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgdG9rZW4gdGhhdCBwZW9wbGUgaGF2ZSByYWlz ZWQuDQogV2l0aCB0aGF0IGNvbnRleHQgaW4gbWluZCwgSSBwcm9wb3NlIHN0cmlraW5nIHRoZSBk ZWZpbml0aW9uIG9mIHRoZSDigJxldmVudHPigJ0gY2xhaW0gZnJvbSB0aGUgU2VjdXJpdHkgRXZl bnQgVG9rZW4gc3BlYywgYW5kIHJlcGxhY2luZyBpdCB3aXRoIHRoZSBmb2xsb3dpbmcgZGVmaW5p dGlvbiBmb3IgYW4g4oCcZXZlbnTigJ0gY2xhaW0gKHNpbmd1bGFyKTo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmIj5ldmVudDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDssc2VyaWYiPkEgSlNPTiBvYmplY3QgY29udGFpbmluZyBhbiAmcXVvdDtldmVudF90 eXBlJnF1b3Q7IG1lbWJlciB3aG9zZSB2YWx1ZSBpcyBhIFVSSSByZXByZXNlbnRpbmcgYSB0eXBl IG9mIGV2ZW50IGRlZmluZWQgaW4gYSBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbi4gVGhlIG9iamVj dA0KIE1BWSBvdGhlcndpc2UgYmUgZW1wdHksIG9yIE1BWSBjb250YWluIGFkZGl0aW9uYWwgbWVt YmVycyBhcyBkZXNjcmliZWQgYnkgdGhlIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+SGVyZSBpcyB0aGUgZXhhbXBsZSBTRVQgZnJvbSBzZWN0aW9u IDIuMywgcmV3cml0dGVuIHdpdGggdGhpcyBjaGFuZ2UgbWluZDo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDssc2VyaWYiPns8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPiZuYnNwOyAmcXVvdDtqdGkm cXVvdDs6ICZxdW90OzRkMzU1OWVjNjc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4JnF1b3Q7LDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+Jm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjQw NCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPiZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1 b3Q7aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tJnF1b3Q7LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oyxz ZXJpZiI+Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJp ZiI+Jm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90O2h0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVk cy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0JnF1b3Q7LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oyxz ZXJpZiI+Jm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90O2h0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9G ZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 LHNlcmlmIj4mbmJzcDsgXSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+Jm5ic3A7ICZxdW90O2V2ZW50JnF1b3Q7OiB7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7LHNlcmlmIj4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnRfdHlw ZSZxdW90OzogJnF1b3Q7dXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6Y3JlYXRlJnF1b3Q7LDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3JlZiZx dW90OzogJnF1b3Q7aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2 YWI2MWU3NTIxZDkmcXVvdDssPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmIj4mbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7YXR0cmlidXRlcyZxdW90OzogWyZxdW90O2lkJnF1b3Q7LCAmcXVvdDtu YW1lJnF1b3Q7LCAmcXVvdDt1c2VyTmFtZSZxdW90OywgJnF1b3Q7cGFzc3dvcmQmcXVvdDssICZx dW90O2VtYWlscyZxdW90O108bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPiZuYnNwOyB9PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmIj59PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5E b2VzIGFueW9uZSBpbiB0aGUgd29ya2luZyBncm91cCBoYXZlIHVzZSBjYXNlcyBmb3IgU0VUcyB0 aGF0IGNhbm5vdCBiZSBtZXQgYnkgdGhpcyBwcm9wb3NlZCB0ZXh0PyBXaXRoaW4gUklTQywgd2Ug aWRlbnRpZmllZCB0aHJlZSB1c2UgY2FzZXMsIHdpdGggc29sdXRpb25zIG91dGxpbmVkIGJlbG93 OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2I+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkV4 dGVuc2lvbnM8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+RXZlbnQgZXh0ZW5zaW9uIG1lY2hhbmlzbXMgY2FuIGJlIGRlZmluZWQgaW50 ZXJuYWwgdG8gdGhlIGV2ZW50IG9iamVjdC4gQSBzaW1wbGUgYXBwcm9hY2ggd291bGQgYmUgdG8g Jm5ic3A7ZGVmaW5lIGFuIOKAnGV4dGVuc2lvbnPigJ0gbWVtYmVyIHRoYXQgaXMgYSBsaXN0IG9m IGV2ZW50IG9iamVjdHMgKG9yIHNldCByZXNlbWJsaW5nIHRoZSDigJxldmVudHPigJ0gY2xhaW0g YXMNCiBkZWZpbmVkIGluIHRoZSBjdXJyZW50IHNwZWMpLiBUaGlzIGhhcyB0aGUgYWR2YW50YWdl IG9mIG1ha2luZyBpdCBjbGVhciBpbiB0aGUgZGF0YSBzdHJ1Y3R1cmUgdGhhdCB0aGVyZSBpcyBh IHNpbmdsZSBwcmltYXJ5IGV2ZW50LCB3aXRoIHplcm8gb3IgbW9yZSBleHRlbnNpb25zLiBUaGVy ZSBpcyBubyByb29tIGZvciBjb25mdXNpb24gb3ZlciB3aGljaCBldmVudCBpcyBwcmltYXJ5LCBv ciBpZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQgYXQNCiBhbGwuIEkgd291bGQgYmUgZmluZSB3 aXRoIGFkZGluZyBzb21ldGhpbmcgbGlrZSB0aGlzIHRvIG15IHByb3Bvc2VkIHRleHQsIGlmIHRo ZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkgdXNlZnVsLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QWxpYXNlczwvc3Bhbj48L2I+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGlzIHVzZSBjYXNl IHdhcyBicm91Z2h0IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRzIGZyb20g ZHJhZnQgZXZlbnQgbmFtZXMgdG8gc3RhbmRhcmRpemVkIGV2ZW50IG5hbWVzLiBJbiB0aGlzIGNh c2UsIHRoZSBldmVudCB0cmFuc21pdHRlciBjYW4gdHJhbnNtaXQgdHdvIHRva2VucyBmb3IgdGhl IGxvZ2ljYWwgZXZlbnQsIG9uZSB1c2luZw0KIHRoZSBvbGQgbmFtZSBhbmQgYW5vdGhlciB1c2lu ZyB0aGUgbmV3IG5hbWUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0Ij5SZWxhdGVkIEV2ZW50czwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGUgU0VUIHNwZWMgZGVmaW5lcyB0aGUgdHhuIGNsYWlt IGFzIGEgbWVhbnMgb2YgY29ycmVsYXRpbmcgaW5kZXBlbmRlbnQgdG9rZW5zIHRoYXQgcmVsYXRl IHRvIHRoZSBzYW1lIGxvZ2ljYWwgZXZlbnQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPi0tJm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW5uYWJlbGxlIFJpY2hh cmQgQmFja21hbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYi PkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0K PC9odG1sPg0K --_000_2FF066DEA1EB4656AC2374FC11104FFAamazoncom_-- From nobody Mon Oct 23 20:08:30 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBAED13B1A9 for ; Mon, 23 Oct 2017 20:08:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.23 X-Spam-Level: X-Spam-Status: No, score=0.23 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oNdj03U5Y26M for ; Mon, 23 Oct 2017 20:08:23 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0108.outbound.protection.outlook.com [104.47.33.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 806AA13B133 for ; Mon, 23 Oct 2017 20:08:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Shrn0mOH2ABPyw7bMQwlvE/Ef+eMUAX98rVi4WUcCaY=; b=BQSpwdN2B8qsCKhKfgLbKm+IVvcXt4i2knkEK62+UdN9GZ0uQnblHPNInuEa7MRNTt9j7aCHVp3Ff3KeXXFVNmfpQlnyLG/1c93i06N+T5Ld/huB7Y2sQpoLNHVFrF7vhSz+gVnrhIvtpr4krReo/CE9JlFrhX6wQex5MOVU8Hc= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0742.namprd21.prod.outlook.com (10.173.189.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.1; Tue, 24 Oct 2017 03:08:19 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 03:08:19 +0000 From: Mike Jones To: "Phil Hunt (IDM)" , Marius Scurtescu CC: ID Events Mailing List Thread-Topic: [Id-event] "aud" vs. receiver issue raised in WGLC Thread-Index: AQHTTCh6o4xBjT/YGEGMZ+isMbHIYaLx9juAgAAVi4CAAADJAIAABKyAgAAZxYCAAAChAIAAAOGAgAAOtACAABcoVg== Date: Tue, 24 Oct 2017 03:08:19 +0000 Message-ID: References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> , <9D836134-3DD2-4444-92B4-07C7DA49D51A@oracle.com> In-Reply-To: <9D836134-3DD2-4444-92B4-07C7DA49D51A@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.85.199] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0742; 6:ZXSudzcXif4Vtr74QcmYFPfVNdXV5foRnXLC32SVLGnfyKtsEyfU3OvYoxfXUi2IzbXehvEhwhNiXMj6P/EpJSTk46kAuFLnVEshda8/rWWM6oi07DWnE3FbvkCGHS7DMktERDsZRPvc6Mguw9VCGExyFNP7v7Bk/f4DlHgPJVbCruNAWYKEzLwHnCqZUjf2ArAPzVre25EMIvWqz6G0x6m0v4Pe8ywoLi2vPknKV2DgizZwihBpAlQtOKHEFB1DrQuFCY9n7SNPrDzCzjkB4JsQHlaXwjhCxRgNUjZos91nCDvxT8KDPWlzTKOyr9SOxUvMWH8OfykY1zGURvdAXg+e3ZT2FqzNHzM9FmARy7k=; 5:6+zYfHmZTNZvDfFtPhpiUHyBOpIcyrnWnTTn1PtTeDl6vShhtwQxNyjb1VG0vW4E5nuL+Y05bRZE5tI8w7/x3rXQTeiLcVIiZsN/nheOsE/AXWX64BGfby97DbuIhKYojw88oS6D4vm0wcu1BVRfTl6wMpNg16j2GoLWt+WYlTg=; 24:3ktH1WiyTWFGAEFB6s2+Ahjea6UuolLIo7skiChLwf/liYNd5CWfqtidGmTWqll9UqpNU80QMBozvS5eFLkfP5l10E17V6zB/oRO5AsG3+c=; 7:Y6+gqaP62VzcemDrI6rcRRWEsn3Yt8QuO1qL2yePsxnqEYqLFGzbCIsAaxRZLUftSoZPBs2k5v9ynYXVgQb1tAK8NJXrGGLITf7n7SI/AW9dZJu0iuR190EPYImaFaHmKZPOA1GmDcSKd6fF5QauxztLxm9q3C6xic/HlIFRNZh1JpN5XgiV29HBNDFkUbskxkw/DSvx356EGIDKl14Kwql/b+eX/HMZxH+Dr5YVshK5yG/v2GyxH7B62KQCoUDj x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 834ffdb2-a0ff-42d7-e6d2-08d51a8c7a8f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229); SRVR:CY4PR21MB0742; x-ms-traffictypediagnostic: CY4PR21MB0742: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-exchange-antispam-report-test: UriScan:(158342451672863)(10436049006162)(192374486261705)(788757137089)(211936372134217)(153496737603132)(146099531331640); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(3002001)(3231020)(10201501046)(93006095)(93001095)(100000703101)(100105400095)(920507026)(6055026)(61426038)(61427038)(6041248)(20161123558100)(20161123564025)(20161123560025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0742; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0742; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(47760400005)(199003)(189002)(24454002)(99286003)(966005)(7736002)(6116002)(72206003)(3846002)(55016002)(3660700001)(102836003)(14454004)(316002)(2900100001)(6436002)(110136005)(66066001)(93886005)(229853002)(236005)(9686003)(4326008)(6246003)(3280700002)(74316002)(33656002)(53946003)(97736004)(16410355002)(54896002)(34040400001)(53936002)(6306002)(81166006)(81156014)(2906002)(575784001)(86362001)(189998001)(7696004)(478600001)(76176999)(50986999)(54356999)(8936002)(10290500003)(8990500004)(561944003)(8676002)(86612001)(5660300001)(25786009)(106356001)(22452003)(2950100002)(105586002)(77096006)(68736007)(606006)(53546010)(10090500001)(6506006)(101416001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0742; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05043612734A19D3720D68D5F5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 834ffdb2-a0ff-42d7-e6d2-08d51a8c7a8f X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 03:08:19.6027 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0742 Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 03:08:27 -0000 --_000_CY4PR21MB05043612734A19D3720D68D5F5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable See one of my other my other replies. The term should be =93recipient=94 fo= r JWT/JWS, etc. consistency. From: Phil Hunt (IDM) Sent: Monday, October 23, 2017 6:45 PM To: Marius Scurtescu Cc: ID Events Mailing List Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC Ok. I will do search replace on subscriber as they should all be receiver. Thks Phil On Oct 23, 2017, at 5:52 PM, Marius Scurtescu > wrote: I raised a wording issue, not sure if it still applies: "The abstract mentions "issuer" and "receiver" in the last sentence. "recei= ver" does not sound right (that should be used in the context of a transmit= ter), but I don't have a better suggestion. Audience? The last paragraph of section 1 mentions "subscriber". I think it should be= either "receiver" or "audience"." Marius On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (IDM) > wrote: Ok. But you raised the concern. Are you withdrawing it? Phil On Oct 23, 2017, at 5:47 PM, Marius Scurtescu > wrote: On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt > wrote: It=92s quite relevant to those with distributed architectures. If an Event Stream requires that SETs need to be encrypted (using JWE), the= SETs needs to be encrypted so the =93receiver" can read it. Regardless, = =93aud=94 should be interpreted by the traditional JWT method which suggest= s the security domain the event is for. For example, a web site relying pa= rty does not have the capability to process (or issue) events itself (eg. b= ecause of a distributed architecture). The relying party assigns another en= tity the role of Event Receiver (or Transmitter). The problem being that If the =93set=94 is encrypted for =93aud=94 then onl= y the =93aud=94 entity can read the SET which will make it impossible to fo= r another server to handle or worse, it would require sharing of private ke= ys. The RP controls the configuration of the stream, so they can specify an end= point that belongs to the outsourced receiver and they can also specify an = encryption key that is controlled by the outsourced receiver. The RP does n= ot need access to the private key at all. I still think it is irrelevant to the transmitter, or to this spec. I agree= it is totally relevant for the RP, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com phil.hunt@oracle.com On Oct 23, 2017, at 3:58 PM, Marius Scurtescu > wrote: I think "aud" should point to the Receiver, the outsourcing is irrelevant. Nothing needs to change here IMO. Marius On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt > wrote: It seems reasonable to further clarify that the definition of a receiver co= uld be improved. I propose to change from: Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. To: Event Receiver An Event Receiver is an entity that receives SETs through some distribution method. An Event Receiver MAY be a different entity than that described by the =93aud=94 claim. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com phil.hunt@oracle.com On Oct 23, 2017, at 2:38 PM, Marius Scurtescu > wrote: I think "aud" is perfectly fine. IMO it should make no difference for the Transmitter that the event is actu= ally handled by an outsourced entity, the RP trusts that entity and the eve= nt is generated and targeted to the RP and not to the current outsourced pr= ocessor. Marius On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt > wrote: All, I am reviewing the previous feedback from WGLC and will be bringing up any = unresolved issues for quick discussion/confirmation=85 Following up on Marius and Henk=92s comment, I am concerned that =93aud=94 = has a very specific meaning and is often tied to a security domain definiti= on. We should not necessarily say this is the receiver though it often turn= s out to be. For example a RP (=93aud=94) has outsourced events processing = to a third party (the so called receiver). I am happy with the current claim set, but maybe some text explaining that = a receiver does not have to be the aud is appropriate? I don=92t see any b= enefit to having a receiver claim as this could complicate processing more = than its worth. There are a few other comments in this thread, but this one seemed the most= unresolved. Phil On Aug 3, 2017, at 8:03 AM, Henk Birkholz > wrote: Hello, to me, the "audience" claim seems to be a good choice here. Viele Gr=FC=DFe, Henk On 08/02/2017 11:45 PM, Marius Scurtescu wrote: The abstract mentions "issuer" and "receiver" in the last sentence. "receiv= er" does not sound right (that should be used in the context of a transmitt= er), but I don't have a better suggestion. Audience? The last paragraph of section 1 mentions "subscriber". I think it should be= either "receiver" or "audience". The explanation for figure 1 states that the issuer denotes the transmitter= . If the issuer and the transmitter are assumed to be the same entity, then= the transmitter definition in section 1.2 should make that clear. Figure 3, I think the "sub" claim should be nested in the event, next to th= e issuer that provides the correct context. The "iss" and "sub" definitions= in 2.1 also touch on this, providing conflicting advice. Section 2,1, definition of "nbf". The definition says that this is the even= t time. I see two problems: - the name suggest "not before", not exactly the same as event time - there can be multiple events maybe this claim should be dropped? Section 2.1, definition of "exp". Omitting this claim is the short term sol= ution to the confusion issue. Why not mention that and that it SHOULD NOT b= e used? Section 2.1, definition of "events". It states that all events must refer t= o the same logical event. Lately in discussions we reached the conclusion t= hat all events in a SET should be defined in the same profile, which is a s= tronger requirement. I think this definition should mention that. Regarding events and profiles. There was a proposal to add a new claim to u= niquely identify the profile. I think we need to discuss that. Figure 5. Maybe a signed example would be better, especially that the next = paragraph mentions that signatures or encryption should be used. Section 4.5, second paragraph. Mentions that "nonce" is also required, but = that is not actually true. Id Tokens issued at the token endpoint for examp= le will not have it. I suggest we drop the whole paragraph. Marius On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer > wrote: This is to announce working group last call on this draft (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf= .org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6c= xjlKfjqT99u5-Ojw4Fw&e=3D ). Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list. Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21. Thanks, Dick and Yaron _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY0= 57SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnv= A&e=3D _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE= 4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e= =3D _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE= 4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e= =3D _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event _______________________________________________ Id-event mailing list Id-event@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRta= XXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e= =3D --_000_CY4PR21MB05043612734A19D3720D68D5F5470CY4PR21MB0504namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

See one of my other my other replies. The term shoul= d be =93recipient=94 for JWT/JWS, etc. consistency.

 

 

From: Phil Hunt (IDM)
Sent: Monday, October 23, 2017 6:45 PM
To: Marius Scurtescu Cc: ID Events Mailing List<= br> Subject: Re: [Id-event] "aud" vs. receiver issue raised in= WGLC

 

Ok. I will do search replace on subscriber as they should all be recei= ver. 

Thks

Phil

On Oct 23, 2017, at 5:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I raised a wording issue, not sure if it still applies:

"The abstract mentions "issuer" and "receiver"= ; in the last sentence. "receiver" does not sound right (that sho= uld be used in the context of a transmitter), but I don't have a better sug= gestion. Audience?
The last paragraph of section 1 mentions "subscriber". I thi= nk it should be either "receiver" or "audience"."<= /div>



Marius

On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (IDM)= <phil.hunt@ora= cle.com> wrote:
Ok. But you raised the concern. Are you withdrawing it?

Phil

On Oct 23, 2017, at 5:47 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It=92s quite relevant to those with distributed architectures.

If an Event Stream requires that SETs need to be encrypted (using JWE)= , the SETs needs to be encrypted so the =93receiver" can read it. = ; Regardless, =93aud=94 should be interpreted by the traditional JWT method= which suggests the security domain the event is for.  For example, a web site relying party does not have the capabil= ity to process (or issue) events itself (eg. because of a distributed archi= tecture). The relying party assigns another entity the role of Event Receiv= er (or Transmitter).  

The problem being that If the =93set=94 is encrypted for =93aud=94 the= n only the =93aud=94 entity can read the SET which will make it impossible = to for another server to handle or worse, it would require sharing of priva= te keys. 

The RP controls the configuration of the stream, so they can specify a= n endpoint that belongs to the outsourced receiver and they can also specif= y an encryption key that is controlled by the outsourced receiver. The RP d= oes not need access to the private key at all.

I still think it is irrelevant to the transmitter, or to this spec. I = agree it is totally relevant for the RP,



Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
On Oct 23, 2017, at 3:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "aud" should point to the Receiver, the = outsourcing is irrelevant.

Nothing needs to change here IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It seems reasonable to further clarify = that the definition of a receiver could be improved.

I propose to change from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method. An Event Receiver MAY be a different
      entity than that described by the =93aud=94 claim.

Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com

On Oct 23, 2017, at 2:38 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think "aud" is perfectly fine.

IMO it should make no difference for the Transmitter that the event is= actually handled by an outsourced entity, the RP trusts that entity and th= e event is generated and targeted to the RP and not to the current outsourc= ed processor.

Marius

On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

All,

I am reviewing the previous feedback from WGLC and will be bringing up= any unresolved issues for quick discussion/confirmation=85

Following up on Marius and Henk=92s comment, I am concerned that =93au= d=94 has a very specific meaning and is often tied to a security domain def= inition. We should not necessarily say this is the receiver though it often= turns out to be. For example a RP (=93aud=94) has outsourced events processing to a third party (the so called receiver)= .

I am happy with the current claim set, but maybe some text explaining = that a receiver does not have to be the aud is appropriate?  I don=92t= see any benefit to having a receiver claim as this could complicate proces= sing more than its worth.

There are a few other comments in this thread, but this one seemed the= most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:

Hello,

to me, the "audience" claim seems to be a good choice here.<= br style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-var= iant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;= text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
Viele Gr=FC=DFe,

Henk

On 08/02/2017 11:45 PM, Marius Scurtescu wrote:
The abstract mentions "issuer" and "receiver" in the la= st sentence. "receiver" does not sound right (that should be used= in the context of a transmitter), but I don't have a better suggestion. Au= dience?
The last paragraph of section 1 mentions "subscriber". I think it= should be either "receiver" or "audience".
The explanation for figure 1 states that the issuer denotes the transmitter= . If the issuer and the transmitter are assumed to be the same entity, then= the transmitter definition in section 1.2 should make that clear.
Figure 3, I think the "sub" claim should be nested in the event, = next to the issuer that provides the correct context. The "iss" a= nd "sub" definitions in 2.1 also touch on this, providing conflic= ting advice.
Section 2,1, definition of "nbf". The definition says that this i= s the event time. I see two problems:
- the name suggest "not before", not exactly the same as event ti= me
- there can be multiple events
maybe this claim should be dropped?
Section 2.1, definition of "exp". Omitting this claim is the shor= t term solution to the confusion issue. Why not mention that and that it SH= OULD NOT be used?
Section 2.1, definition of "events". It states that all events mu= st refer to the same logical event. Lately in discussions we reached the co= nclusion that all events in a SET should be defined in the same profile, wh= ich is a stronger requirement. I think this definition should mention that.
Regarding events and profiles. There was a proposal to add a new claim to u= niquely identify the profile. I think we need to discuss that.
Figure 5. Maybe a signed example would be better, especially that the next = paragraph mentions that signatures or encryption should be used.
Section 4.5, second paragraph. Mentions that "nonce" is also requ= ired, but that is not actually true. Id Tokens issued at the token endpoint= for example will not have it. I suggest we drop the whole paragraph.
Marius
On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer <yar= onf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>> wrote:
   This is to announce working group last call on this draft=
   (https://urldefe= nse.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_= draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCX= CgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJ= xPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1= i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&= e=3D  &nb= sp;  <https://urldef<= wbr>ense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org= _doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCX= CgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJ= xPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1= i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&= e=3D >).    Please send your comments to the list. Even if you are pe= rfectly
   happy with the draft, please let us know that you support= its
   publication as-is by posting to the list.
   Because of the summer holidays, this last call is open fo= r 3 weeks,
   until Aug. 21.
   Thanks,
        Dick and Yaron
   _______________________________________________
   Id-event mailing list
   Id-event@ietf.org <mailto:Id-= event@ietf.org>
   https://urldefense.proofpoint.co= m/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&a= mp;d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10= &r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9= SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3= uL_TsJINLVTXORUpSDnvA&e=3D     <https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvl= ZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj= WwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuU= Y&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps= -3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&= c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrK= ugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS= 7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXO= RUpSDnvA&e=3D 

_________________________________= ______________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__= www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DR= oP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0= FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLX= EZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSD= nvA&e=3D



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/li= stinfo/id-event




_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps= -3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&= c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrK= ugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1= Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7= wB0zI3N0&e=3D



--_000_CY4PR21MB05043612734A19D3720D68D5F5470CY4PR21MB0504namp_-- From nobody Mon Oct 23 20:47:26 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8406813B47C for ; Mon, 23 Oct 2017 20:47:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nu8CnISFP5eg for ; Mon, 23 Oct 2017 20:47:21 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 812F813B44B for ; Mon, 23 Oct 2017 20:47:21 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9O3lIdK024079 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 03:47:18 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9O3lHJQ004876 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 03:47:18 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9O3lH9b023083; Tue, 24 Oct 2017 03:47:17 GMT Received: from [192.168.1.23] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 20:47:16 -0700 From: Phil Hunt Message-Id: <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BE64EE5D-20FD-4ED3-A565-BE36F9E6CAED" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 23 Oct 2017 20:47:16 -0700 In-Reply-To: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> Cc: ID Events Mailing List To: "Richard Backman, Annabelle" References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 03:47:24 -0000 --Apple-Mail=_BE64EE5D-20FD-4ED3-A565-BE36F9E6CAED Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Annabelle, I have a number of concerns with this proposal. Profiling Independence / Keeping Event Payloads Independent Indicating that extensions should be handled by profiles leads to more = inter-operability issues and more importantly intrudes on the Event = payload space by suggesting a sub-schema creates potential limitations = and conflicts that may add to complexity later on. The current format = allows a parser to discover and unload one or more JSON payloads which = can each have independent structure. General extensions The proposal also rules out general purpose extensions not related to = any specific event. Given the emergence of items like GPRD, I would not = want to block the ability to add meta-data or other general purpose = items. We can also anticipate some delivery scenarios where additional = data might be required. Even though there is no current planned use, I = see no good reason to rule this out. Multiple Events =46rom Different Families (vs. Multiple Events from a = single family like RISC) In our RISC session we discussed expressing multiple distinct RISC = events in one SET. The discussion was that only one RISC event at a = time. We did not discuss other event profiles. I don=E2=80=99t see a = reason to rule out multi-events from different families at the SET = level. Each profile is expressing slightly different things about the = same event.=20 I can forsee some cases where it is not clear which is the primary and = which is the extension. There may not be a clear winner. A couple of examples (these are necessarily real=E2=80=A6just = possibilities): * It is probably useful to be able to express simlar/overlapping events = from different SET profiles in one SET. For example a Backchannel = Logout & a RISC session cancel event. * SCIM may want to represent a single transaction as causing multiple = state changes in an event (e.g. a password change causes multiple = effects). Having to chase down multiple events and correlate by = =E2=80=9Ctxn=E2=80=9D would be challenging in a = multi-threaded/multi-node delivery system. The SCIM list has not = discussed this, but I would not want to block this capability. IOW - = Just because RISC does not want to express multiple events does not make = this true for other profiles. * We may wish to indicate a SCIM Password Reset was performed and a = Logout/session cancellation is expressed at the same time. The events = are related but express different data. Avoiding Confusion =46rom Similar Events Originating from the Same = Transaction If events are sent separately, then more tracking of state (e.g. by txn) = would be required to ensure similar events are not mistaken or handled = as repeats. While txn provides useful audit analysis capability, I=E2=80=99= m not sure it can be used in live or near-real time systems given = distributed multi-node, multi-threading architectures. Previous Discussion I note that I originally raised having an attribute to designate primary = event attribute to alleviate your concern, but this was not accepted. = See:=20 * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html The consensus, at least as I interpreted it is up to the receiver to = figure this out based on the definitions it has for each event URI and = the profiles they represent. IOW - RISC is free to limit that only one = RISC event be expressed at a time. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle = wrote: >=20 > The current draft of the SET spec allows for expressing multiple = events within the same token, which introduces additional complexity and = room for ambiguous semantics. We=E2=80=99ve discussed this in the OIDF = RISC working group and the current consensus there is that RISC will = require that RISC events must be the only event in the SET, having = identified ways to clearly and easily support the handful of use cases = for multiple events per token that people have raised. With that context = in mind, I propose striking the definition of the =E2=80=9Cevents=E2=80=9D= claim from the Security Event Token spec, and replacing it with the = following definition for an =E2=80=9Cevent=E2=80=9D claim (singular): > =20 > event > A JSON object containing an "event_type" member whose value is a URI = representing a type of event defined in a Profiling Specification. The = object MAY otherwise be empty, or MAY contain additional members as = described by the Profiling Specification. > =20 > Here is the example SET from section 2.3, rewritten with this change = mind: > { > "jti": "4d3559ec67504aaba65d40b0363faad8", > "iat": 1458496404, > "iss": "https://scim.example.com ", > "aud": [ > "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754 = ", > "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7 = " > ], > =20 > "event": { > "event_type": "urn:ietf:params:scim:event:create", > "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 = ", > "attributes": ["id", "name", "userName", "password", "emails"] > } > } > =20 > Does anyone in the working group have use cases for SETs that cannot = be met by this proposed text? Within RISC, we identified three use = cases, with solutions outlined below: > =20 > Extensions > Event extension mechanisms can be defined internal to the event = object. A simple approach would be to define an =E2=80=9Cextensions=E2=80= =9D member that is a list of event objects (or set resembling the = =E2=80=9Cevents=E2=80=9D claim as defined in the current spec). This has = the advantage of making it clear in the data structure that there is a = single primary event, with zero or more extensions. There is no room for = confusion over which event is primary, or if there is a primary event at = all. I would be fine with adding something like this to my proposed = text, if there is consensus that it is broadly useful. > =20 > Aliases > This use case was brought up in the context of migrating clients from = draft event names to standardized event names. In this case, the event = transmitter can transmit two tokens for the logical event, one using the = old name and another using the new name. > =20 > Related Events > The SET spec defines the txn claim as a means of correlating = independent tokens that relate to the same logical event. > =20 > --=20 > Annabelle Richard Backman > Amazon =E2=80=93 Identity Services > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuA= b1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyo= IY&e=3D = =20 --Apple-Mail=_BE64EE5D-20FD-4ED3-A565-BE36F9E6CAED Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Annabelle,

I have a number of concerns with this proposal.

Profiling Independence / = Keeping Event Payloads Independent

Indicating that extensions should be = handled by profiles leads to more inter-operability issues and more = importantly intrudes on the Event payload space by suggesting a = sub-schema creates potential limitations and conflicts that may add to = complexity later on. The current format allows a parser to discover and = unload one or more JSON payloads which can each have independent = structure.

General extensions

The proposal also rules out general = purpose extensions not related to any specific event. Given the = emergence of items like GPRD, I would not want to block the ability to = add meta-data or other general purpose items. We can also anticipate = some delivery scenarios where additional data might be required. Even = though there is no current planned use, I see no good reason to rule = this out.

Multiple Events =46rom Different Families (vs. Multiple = Events from a single family like RISC)

In our RISC session we discussed = expressing multiple distinct RISC events in one SET. The discussion was = that only one RISC event at a time. We did not discuss other event = profiles. I don=E2=80=99t see a reason to rule out multi-events from = different families at the SET level. Each profile is expressing slightly = different things about the same event. 

I can forsee some cases where it is not = clear which is the primary and which is the extension.  There may = not be a clear winner.

A couple of examples (these are necessarily real=E2=80=A6just = possibilities):
* It is probably useful to be able = to express simlar/overlapping events from different SET profiles in one = SET.  For example a Backchannel Logout & a RISC session cancel = event.
* SCIM may want to represent a single = transaction as causing multiple state changes in an event (e.g. a = password change causes multiple effects). Having to chase down multiple = events and correlate by =E2=80=9Ctxn=E2=80=9D would be challenging in a = multi-threaded/multi-node delivery system.  The SCIM list has not = discussed this, but I would not want to block this capability.  IOW = - Just because RISC does not want to express multiple events does not = make this true for other profiles.
* We may wish to = indicate a SCIM Password Reset was performed and a Logout/session = cancellation is expressed at the same time.  The events are related = but express different data.

Avoiding Confusion =46rom Similar Events Originating from = the Same Transaction

If events are sent separately, then more tracking of state = (e.g. by txn) would be required to ensure similar events are not = mistaken or handled as repeats. While txn provides useful audit analysis = capability, I=E2=80=99m not sure it can be used in live or near-real = time systems given distributed multi-node, multi-threading = architectures.

Previous Discussion

I note that I originally raised having = an attribute to designate primary event attribute to alleviate your = concern, but this was not accepted. See: 
* https://www.ietf.org/mail-archive/web/id-event/current/msg00406= .html
* https://www.ietf.org/mail-archive/web/id-event/current/msg00140= .html

The = consensus, at least as I interpreted it is up to the receiver to figure = this out based on the definitions it has for each event URI and the = profiles they represent. IOW - RISC is free to limit that only one RISC = event be expressed at a time.


Phil

Oracle = Corporation, Identity Cloud Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle = <richanna@amazon.com> wrote:

The current draft of the SET spec = allows for expressing multiple events within the same token, which = introduces additional complexity and room for ambiguous semantics. = We=E2=80=99ve discussed this in the OIDF RISC working group and the = current consensus there is that RISC will require that RISC events must = be the only event in the SET, having identified ways to clearly and = easily support the handful of use cases for multiple events per token = that people have raised. With that context in mind, I propose striking = the definition of the =E2=80=9Cevents=E2=80=9D claim from the Security = Event Token spec, and replacing it with the following definition for an = =E2=80=9Cevent=E2=80=9D claim (singular):
 
event
A JSON object containing = an "event_type" member whose value is a URI representing a type of event = defined in a Profiling Specification. The object MAY otherwise be empty, = or MAY contain additional members as described by the Profiling = Specification.
 
Here is the example SET from section 2.3, rewritten with this = change mind:
{
  "jti": = "4d3559ec67504aaba65d40b0363faad8",
  "iat": = 1458496404,
  "aud": [
    "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",<= o:p class=3D"">
  ],
 
  "event": {
    "event_type": = "urn:ietf:params:scim:event:create",
    "attributes": ["id", "name", = "userName", "password", "emails"]
  }
}
 
Does anyone in = the working group have use cases for SETs that cannot be met by this = proposed text? Within RISC, we identified three use cases, with = solutions outlined below:
 
Extensions
Event extension = mechanisms can be defined internal to the event object. A simple = approach would be to  define an =E2=80=9Cextensions=E2=80=9D member = that is a list of event objects (or set resembling the =E2=80=9Cevents=E2=80= =9D claim as defined in the current spec). This has the advantage of = making it clear in the data structure that there is a single primary = event, with zero or more extensions. There is no room for confusion over = which event is primary, or if there is a primary event at all. I would = be fine with adding something like this to my proposed text, if there is = consensus that it is broadly useful.
 
Aliases
This use case was = brought up in the context of migrating clients from draft event names to = standardized event names. In this case, the event transmitter can = transmit two tokens for the logical event, one using the old name and = another using the new name.
 
Related Events
The SET spec = defines the txn claim as a means of correlating independent tokens that = relate to the same logical event.
 
-- 
Annabelle Richard Backman
Amazon =E2=80=93= Identity Services
 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3Izl= F7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D 

= --Apple-Mail=_BE64EE5D-20FD-4ED3-A565-BE36F9E6CAED-- From nobody Mon Oct 23 21:00:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE55113B46E for ; Mon, 23 Oct 2017 21:00:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.75 X-Spam-Level: X-Spam-Status: No, score=-4.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KBIDy2a0GlrS for ; Mon, 23 Oct 2017 21:00:45 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6A0DB13B44B for ; Mon, 23 Oct 2017 21:00:45 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9O40g3d012009 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 04:00:43 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9O40g46001780 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 04:00:42 GMT Received: from abhmp0010.oracle.com (abhmp0010.oracle.com [141.146.116.16]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9O40gC6030032; Tue, 24 Oct 2017 04:00:42 GMT Received: from [192.168.1.23] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 23 Oct 2017 21:00:41 -0700 From: Phil Hunt Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_C3D28C14-7181-42FF-851D-424AA7DE7AC4" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 23 Oct 2017 21:00:39 -0700 In-Reply-To: Cc: Marius Scurtescu , ID Events Mailing List To: Mike Jones References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> <9D836134-3DD2-4444-92B4-07C7DA49D51A@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 04:00:49 -0000 --Apple-Mail=_C3D28C14-7181-42FF-851D-424AA7DE7AC4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Mike, The group originally requested change from publisher/subscriber to Event = Transmitter and Event Receiver. Regarding =E2=80=9Cconsistency=E2=80=9D between specs, I can=E2=80=99t = find any definitive use of the term recipient in RFC7159, 7515, or 7523. = Am I missing something? I only found this paragraph: > Note: No "charset" parameter is defined for this registration. > Adding one really has no effect on compliant recipients. Are we bike-shedding here?=20 Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 23, 2017, at 8:08 PM, Mike Jones = wrote: >=20 > See one of my other my other replies. The term should be = =E2=80=9Crecipient=E2=80=9D for JWT/JWS, etc. consistency. > =20 > =20 > From: Phil Hunt (IDM) > Sent: Monday, October 23, 2017 6:45 PM > To: Marius Scurtescu > Cc: ID Events Mailing List > Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC > =20 > Ok. I will do search replace on subscriber as they should all be = receiver.=20 >=20 > Thks >=20 > Phil >=20 > On Oct 23, 2017, at 5:52 PM, Marius Scurtescu > wrote: >=20 >> I raised a wording issue, not sure if it still applies: >>=20 >> "The abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience? >> The last paragraph of section 1 mentions "subscriber". I think it = should be either "receiver" or "audience"." >>=20 >>=20 >>=20 >> Marius >>=20 >> On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (IDM) = > wrote: >> Ok. But you raised the concern. Are you withdrawing it? >>=20 >> Phil >>=20 >> On Oct 23, 2017, at 5:47 PM, Marius Scurtescu > wrote: >>=20 >>> On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt > wrote: >>> It=E2=80=99s quite relevant to those with distributed architectures. >>>=20 >>> If an Event Stream requires that SETs need to be encrypted (using = JWE), the SETs needs to be encrypted so the =E2=80=9Creceiver" can read = it. Regardless, =E2=80=9Caud=E2=80=9D should be interpreted by the = traditional JWT method which suggests the security domain the event is = for. For example, a web site relying party does not have the capability = to process (or issue) events itself (eg. because of a distributed = architecture). The relying party assigns another entity the role of = Event Receiver (or Transmitter). =20 >>>=20 >>> The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for = =E2=80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can = read the SET which will make it impossible to for another server to = handle or worse, it would require sharing of private keys.=20 >>>=20 >>> The RP controls the configuration of the stream, so they can specify = an endpoint that belongs to the outsourced receiver and they can also = specify an encryption key that is controlled by the outsourced receiver. = The RP does not need access to the private key at all. >>>=20 >>> I still think it is irrelevant to the transmitter, or to this spec. = I agree it is totally relevant for the RP, >>>=20 >>>=20 >>>=20 >>> Phil >>>=20 >>> Oracle Corporation, Identity Cloud Services Architect >>> @independentid >>> www.independentid.com = phil.hunt@o= racle.com >>>> On Oct 23, 2017, at 3:58 PM, Marius Scurtescu = > wrote: >>>>=20 >>>> I think "aud" should point to the Receiver, the outsourcing is = irrelevant. >>>>=20 >>>> Nothing needs to change here IMO. >>>>=20 >>>> Marius >>>>=20 >>>> On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt > wrote: >>>> It seems reasonable to further clarify that the definition of a = receiver could be improved. >>>>=20 >>>> I propose to change from: >>>> Event Receiver >>>> An Event Receiver is an entity that receives SETs through = some >>>> distribution method. >>>>=20 >>>> To: >>>> Event Receiver >>>> An Event Receiver is an entity that receives SETs through = some >>>> distribution method. An Event Receiver MAY be a different >>>> entity than that described by the =E2=80=9Caud=E2=80=9D = claim. >>>>=20 >>>> Phil >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>> @independentid >>>> www.independentid.com = phil.hunt@o= racle.com >>>>=20 >>>>> On Oct 23, 2017, at 2:38 PM, Marius Scurtescu = > wrote: >>>>>=20 >>>>> I think "aud" is perfectly fine. >>>>>=20 >>>>> IMO it should make no difference for the Transmitter that the = event is actually handled by an outsourced entity, the RP trusts that = entity and the event is generated and targeted to the RP and not to the = current outsourced processor. >>>>>=20 >>>>> Marius >>>>>=20 >>>>> On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt > wrote: >>>>>=20 >>>>> All, >>>>>=20 >>>>> I am reviewing the previous feedback from WGLC and will be = bringing up any unresolved issues for quick discussion/confirmation=E2=80=A6= >>>>>=20 >>>>> Following up on Marius and Henk=E2=80=99s comment, I am concerned = that =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied = to a security domain definition. We should not necessarily say this is = the receiver though it often turns out to be. For example a RP = (=E2=80=9Caud=E2=80=9D) has outsourced events processing to a third = party (the so called receiver). >>>>>=20 >>>>> I am happy with the current claim set, but maybe some text = explaining that a receiver does not have to be the aud is appropriate? = I don=E2=80=99t see any benefit to having a receiver claim as this could = complicate processing more than its worth. >>>>>=20 >>>>> There are a few other comments in this thread, but this one seemed = the most unresolved. >>>>>=20 >>>>> Phil >>>>>=20 >>>>>=20 >>>>>> On Aug 3, 2017, at 8:03 AM, Henk Birkholz = > wrote: >>>>>>=20 >>>>>> Hello, >>>>>>=20 >>>>>> to me, the "audience" claim seems to be a good choice here. >>>>>>=20 >>>>>> Viele Gr=C3=BC=C3=9Fe, >>>>>>=20 >>>>>> Henk >>>>>>=20 >>>>>> On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >>>>>>> The abstract mentions "issuer" and "receiver" in the last = sentence. "receiver" does not sound right (that should be used in the = context of a transmitter), but I don't have a better suggestion. = Audience? >>>>>>> The last paragraph of section 1 mentions "subscriber". I think = it should be either "receiver" or "audience". >>>>>>> The explanation for figure 1 states that the issuer denotes the = transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear. >>>>>>> Figure 3, I think the "sub" claim should be nested in the event, = next to the issuer that provides the correct context. The "iss" and = "sub" definitions in 2.1 also touch on this, providing conflicting = advice. >>>>>>> Section 2,1, definition of "nbf". The definition says that this = is the event time. I see two problems: >>>>>>> - the name suggest "not before", not exactly the same as event = time >>>>>>> - there can be multiple events >>>>>>> maybe this claim should be dropped? >>>>>>> Section 2.1, definition of "exp". Omitting this claim is the = short term solution to the confusion issue. Why not mention that and = that it SHOULD NOT be used? >>>>>>> Section 2.1, definition of "events". It states that all events = must refer to the same logical event. Lately in discussions we reached = the conclusion that all events in a SET should be defined in the same = profile, which is a stronger requirement. I think this definition should = mention that. >>>>>>> Regarding events and profiles. There was a proposal to add a new = claim to uniquely identify the profile. I think we need to discuss that. >>>>>>> Figure 5. Maybe a signed example would be better, especially = that the next paragraph mentions that signatures or encryption should be = used. >>>>>>> Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph. >>>>>>> Marius >>>>>>> On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer = = >> wrote: >>>>>>> This is to announce working group last call on this draft >>>>>>> = (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.o= rg_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR= 8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6= cxjlKfjqT99u5-Ojw4Fw&e=3D = = >). >>>>>>> Please send your comments to the list. Even if you are = perfectly >>>>>>> happy with the draft, please let us know that you support its >>>>>>> publication as-is by posting to the list. >>>>>>> Because of the summer holidays, this last call is open for 3 = weeks, >>>>>>> until Aug. 21. >>>>>>> Thanks, >>>>>>> Dick and Yaron >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org = > >>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = = > >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org >>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = =20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = >>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>>=20 >>>>>=20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXo= RtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3= N0&e=3D = --Apple-Mail=_C3D28C14-7181-42FF-851D-424AA7DE7AC4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Mike,

The group originally requested change from = publisher/subscriber to Event Transmitter and Event Receiver.

Regarding = =E2=80=9Cconsistency=E2=80=9D between specs, I can=E2=80=99t find any = definitive use of the term recipient in RFC7159, 7515, or 7523.  Am = I missing something? I only found this paragraph:
Note:  No "charset" parameter =
is defined for this registration.
      Adding one really has no effect on compliant recipients.

Are we bike-shedding here? 

Phil

Oracle Corporation, = Identity Cloud Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 23, 2017, at 8:08 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

See one of my other my other replies. The term should be = =E2=80=9Crecipient=E2=80=9D for JWT/JWS, etc. consistency.
 
 
From: Phil Hunt (IDM)
Sent: Monday, October 23, = 2017 6:45 PM
To: Marius Scurtescu
Cc: ID Events Mailing List
Subject: Re: [Id-event] "aud" = vs. receiver issue raised in WGLC
 
Ok. I will do search replace on subscriber as = they should all be receiver. 

Thks

Phil

On Oct 23, 2017, at = 5:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I raised a wording issue, not sure if it still = applies:

"The = abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience?
The last paragraph of section 1 mentions "subscriber". I = think it should be either "receiver" or "audience"."



Marius

On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt = (IDM) <phil.hunt@oracle.com> wrote:
Ok. But you raised the concern. = Are you withdrawing it?

Phil

On Oct 23, = 2017, at 5:47 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It=E2=80=99s = quite relevant to those with distributed architectures.

If an Event Stream = requires that SETs need to be encrypted (using JWE), the SETs needs to = be encrypted so the =E2=80=9Creceiver" can read it.  Regardless, = =E2=80=9Caud=E2=80=9D should be interpreted by the traditional JWT = method which suggests the security domain the event is for.  For = example, a web site relying party does not have the capability to = process (or issue) events itself (eg. because of a distributed = architecture). The relying party assigns another entity the role of = Event Receiver (or Transmitter).  

The problem being that If the =E2=80=9Cse= t=E2=80=9D is encrypted for =E2=80=9Caud=E2=80=9D then only the = =E2=80=9Caud=E2=80=9D entity can read the SET which will make it = impossible to for another server to handle or worse, it would require = sharing of private keys. 
The RP controls the configuration of = the stream, so they can specify an endpoint that belongs to the = outsourced receiver and they can also specify an encryption key that is = controlled by the outsourced receiver. The RP does not need access to = the private key at all.

I still think it is irrelevant to the transmitter, or to this = spec. I agree it is totally relevant for the RP,



Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 23, 2017, at = 3:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I think = "aud" should point to the Receiver, the outsourcing is irrelevant.

Nothing needs to change = here IMO.

Marius

On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It seems reasonable to = further clarify that the definition of a receiver could be improved.

I propose to change = from:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method.

To:
   Event Receiver
      An Event Receiver is an entity that receives SETs through some
      distribution method. An Event Receiver MAY be a =
different
      entity than that described by the =E2=80=9Caud=E2=
=80=9D claim.

Phil

Oracle Corporation, = Identity Cloud Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct = 23, 2017, at 2:38 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I = think "aud" is perfectly fine.

IMO it should make no difference for the Transmitter that the = event is actually handled by an outsourced entity, the RP trusts that = entity and the event is generated and targeted to the RP and not to the = current outsourced processor.

Marius

On Mon, Oct 23, 2017 at 10:57 AM, = Phil Hunt <phil.hunt@oracle.com> wrote:

All,

I am reviewing the = previous feedback from WGLC and will be bringing up any unresolved = issues for quick discussion/confirmation=E2=80=A6
Following up on Marius and Henk=E2=80=99= s comment, I am concerned that =E2=80=9Caud=E2=80=9D has a very specific = meaning and is often tied to a security domain definition. We should not = necessarily say this is the receiver though it often turns out to be. = For example a RP (=E2=80=9Caud=E2=80=9D) has outsourced events = processing to a third party (the so called receiver).

I am happy with the = current claim set, but maybe some text explaining that a receiver does = not have to be the aud is appropriate?  I don=E2=80=99t see any = benefit to having a receiver claim as this could complicate processing = more than its worth.

There are a few other comments in this thread, but this one = seemed the most unresolved.

Phil


On Aug 3, 2017, at 8:03 AM, Henk Birkholz = <henk.birkholz@sit.fraunhofer.de> = wrote:

Hello,

to me, the "audience" = claim seems to be a good choice here.

Viele Gr=C3=BC=C3=9Fe,

Henk

On 08/02/2017 11:45 PM, = Marius Scurtescu wrote:
The abstract mentions "issuer" = and "receiver" in the last sentence. "receiver" does not sound right = (that should be used in the context of a transmitter), but I don't have = a better suggestion. Audience?
The last paragraph of = section 1 mentions "subscriber". I think it should be either "receiver" = or "audience".
The explanation for figure 1 states that = the issuer denotes the transmitter. If the issuer and the transmitter = are assumed to be the same entity, then the transmitter definition in = section 1.2 should make that clear.
Figure 3, I think the = "sub" claim should be nested in the event, next to the issuer that = provides the correct context. The "iss" and "sub" definitions in 2.1 = also touch on this, providing conflicting advice.
Section = 2,1, definition of "nbf". The definition says that this is the event = time. I see two problems:
- the name suggest "not before", = not exactly the same as event time
- there can be multiple = events
maybe this claim should be dropped?
Section 2.1, definition of "exp". Omitting this claim is the = short term solution to the confusion issue. Why not mention that and = that it SHOULD NOT be used?
Section 2.1, definition of = "events". It states that all events must refer to the same logical = event. Lately in discussions we reached the conclusion that all events = in a SET should be defined in the same profile, which is a stronger = requirement. I think this definition should mention that.
Regarding events and profiles. There was a proposal to add a = new claim to uniquely identify the profile. I think we need to discuss = that.
Figure 5. Maybe a signed example would be better, = especially that the next paragraph mentions that signatures or = encryption should be used.
Section 4.5, second paragraph. = Mentions that "nonce" is also required, but that is not actually true. = Id Tokens issued at the token endpoint for example will not have it. I = suggest we drop the whole paragraph.
Marius
On= Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>> = wrote:
   This is to announce working group = last call on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D    &nb= sp;<https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D >).
   Please send your comments to the list. Even = if you are perfectly
   happy with the = draft, please let us know that you support its
   publication as-is by posting to the = list.
   Because of the summer holidays, = this last call is open for 3 weeks,
   until = Aug. 21.
   Thanks,
        Dick and = Yaron
   _______________________________________________
   Id-event = mailing list
   Id-event@ietf.org <mailto:Id-event@ietf.org>
   https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D    &nb= sp;<https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXoRtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3N0&e=3D
<= br class=3D"">= --Apple-Mail=_C3D28C14-7181-42FF-851D-424AA7DE7AC4-- From nobody Tue Oct 24 07:01:42 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2C0313F6D0 for ; Tue, 24 Oct 2017 07:01:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c9MVRNOos1t4 for ; Tue, 24 Oct 2017 07:01:40 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B092013F6CA for ; Tue, 24 Oct 2017 07:01:34 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.21/8.16.0.21) with SMTP id v9ODw3if010952; Tue, 24 Oct 2017 15:01:30 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=subject : to : cc : references : from : message-id : date : mime-version : in-reply-to : content-type; s=jan2016.eng; bh=E0AR9nyZP+Cgb/w9Cn8quPEubWrPjV8TVCCsouAKpao=; b=EAIWn/EtZVPTez9oFnBCKl9c5XokEUgVTFj+jGJhcw/KHvWQJFIBXb4BLIxaUuHhX3+R m8LDy1fiknRx38eoMmOehKKS5BaV0gXltxAFu937VPq7Yrff0X4OONWLxq4qEvFFfqyj KVf3TMbam5Yfe1yOae6/axee1oP8iYvMR8iRny6OVcKjEtiq081+UwPl66eVN8x2mX3y VrHFOW06xJ1XYNXFE6pUK5iJ67H8BO2JUs2Z6qfaHwAccxS+YJ9p+NzE7lUTMymmgsZD qMq/MHQ1Muj+4wqvrHqMPjOmkxMn9jQjqfHlZww8LE+HO5FVpYDzjnpRyQ3TkgTgZQ1G eA== Received: from prod-mail-ppoint4 ([96.6.114.87]) by m0050093.ppops.net-00190b01. with ESMTP id 2dqwgkt9fd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 24 Oct 2017 15:01:29 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.21/8.16.0.21) with SMTP id v9OE0TAl023290; Tue, 24 Oct 2017 10:01:28 -0400 Received: from prod-mail-relay15.akamai.com ([172.27.17.40]) by prod-mail-ppoint4.akamai.com with ESMTP id 2dr1jwtmku-1; Tue, 24 Oct 2017 10:01:28 -0400 Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay15.akamai.com (Postfix) with ESMTP id 129D420066; Tue, 24 Oct 2017 08:01:27 -0600 (MDT) To: Mike Jones , Marius Scurtescu , Yaron Sheffer Cc: SecEvent References: From: Benjamin Kaduk Message-ID: Date: Tue, 24 Oct 2017 09:01:27 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------643922634522843C3A6ECB0F" Content-Language: en-US X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-10-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1710240197 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-10-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 lowpriorityscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1710240197 Archived-At: Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 14:01:41 -0000 This is a multi-part message in MIME format. --------------643922634522843C3A6ECB0F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit On 10/23/2017 07:05 PM, Mike Jones wrote: > > Figure 5. Maybe a signed example would be better, especially that the > next paragraph mentions that signatures or encryption should be used. > >   > > Unsigned keeps the draft shorter. ;-) > >   > That justification sounds like a joke, especially with the smiley. In-document examples are used to give guidance to the reader, including implicit guidance; I would strongly prefer for there to be examples that actually describe the desired/expected common deployment scenario, to subtly reiterate the expected case. -Ben --------------643922634522843C3A6ECB0F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit On 10/23/2017 07:05 PM, Mike Jones wrote:

Figure 5. Maybe a signed example would be better, especially that the next paragraph mentions that signatures or encryption should be used.

 

Unsigned keeps the draft shorter. ;-)

 


That justification sounds like a joke, especially with the smiley.

In-document examples are used to give guidance to the reader, including implicit guidance; I would strongly prefer for there to be examples that actually describe the desired/expected common deployment scenario, to subtly reiterate the expected case.

-Ben
--------------643922634522843C3A6ECB0F-- From nobody Tue Oct 24 11:54:47 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C5681397FA for ; Tue, 24 Oct 2017 11:54:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.029 X-Spam-Level: X-Spam-Status: No, score=-0.029 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3n65AodsIKZw for ; Tue, 24 Oct 2017 11:54:42 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0120.outbound.protection.outlook.com [104.47.38.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92C771397EF for ; Tue, 24 Oct 2017 11:54:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=BitMZisk3tGW9QFaWgjvoW3pR3rvNaeF0V4nAAxrMPk=; b=H31LcD8TBotN77SlilvU+Qe0VC2ha9bsp3BjcxeOFpozcf3Mx7pLRJW+8fSKjVqQyjL9WsCRyJrHsw9uAGhLn0RhTLOE9fkLvDcMwF4mfNpicrx6+q+cCM0siVp6uKaY9wEilAXjP/DRrIbvuw+mzWFkB7PoNpFzj9kfUiEb2r4= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0119.namprd21.prod.outlook.com (10.173.189.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Tue, 24 Oct 2017 18:54:39 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 18:54:39 +0000 From: Mike Jones To: Phil Hunt CC: Marius Scurtescu , ID Events Mailing List Thread-Topic: [Id-event] "aud" vs. receiver issue raised in WGLC Thread-Index: AQHTTCh6o4xBjT/YGEGMZ+isMbHIYaLx9juAgAAVi4CAAADJAIAABKyAgAAZxYCAAAChAIAAAOGAgAAOtACAABcoVoAADp+AgAD4AhA= Date: Tue, 24 Oct 2017 18:54:39 +0000 Message-ID: References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> <9D836134-3DD2-4444-92B4-07C7DA49D51A@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-24T11:54:35.8402840-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:b::19a] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0119; 6:EaoINQnjSWoHsVbFe2HHJC44tClUMHnNWAOn3WDwlKgwpdCTOnOvBbjExA2Cx2u8lPmooqY+mtlu5cqJH1+gFByiV1To8oKK85Y/ZgP/wRxG9z8zBh6FV+xIzB7JXhcw3W888obAsZKXPOw3QHwVOYCsX4Qti/Cq91XZtyQOxhtUpN3+W6RyXxeQP0rK9rBHKToqQ7p4yXQ7WoF9GesPNij6bmR4ELtx+7jgSLFPG9N+/yUzIbPw6JpD1ohvfXzbE4eHZkLOrI6msmtT0E4ffiV6ypkPifrJ/bSTwSGk01nukImARClPSIP56a0z9iyj2vNVRDAT+aOTR6gSzksIS6ZQOCpHH1L4maI6m3X3KtU=; 5:E1UEh3XTJQga5H6iQlpgnhYlHwC3kMz2CvYiq3UkA/0CC3IoDkiL7AfL90Dx33Ip5qgv8Ag8YG9LyzW9P3jneqFU0c023TlgAy///WHoNMgTM9h0O4NSuecPGg5vNPyAOqd6ZpCM7vGvDXjXhJQQrY3PuFbP9e0e9vG+Z2J1LuY=; 24:kyW9lr3Jb7Jkkp8hmn6Cl4dTrjsVIguK30oVgEJed/G36HTNkJBBVVx4ujWm1Up2KD6Q7U1fvnmiwl/HSWdUGP2kVfDqHNmmmDFv5JWJKfc=; 7:d3bn6c8cZ+Qn+TY6UJxBvdzCvQL2ROfPGMP8ZTd3gNp5bQhiSq7jfYMYk2FDUc12+ITtg8aCXIb9rQgcrwwQzAa9fuBhdh51UYF1PbtIgFLLxoTgmygknFQDCByFFMyLv3I3TIHMKvHoYqDMFDdJGc+iQMLmk8gyII6MqHf79Bf3pcwidIFzsFGgimYYorqWk7YNVrcmTmxvY8CxH2pkwrHAbeXJKG4r7ku1d46XbVwvbHAPr55tKmbOX/ldXt6J x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: bc1afeb5-6f7e-48c8-6e21-08d51b10ade7 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603231); SRVR:CY4PR21MB0119; x-ms-traffictypediagnostic: CY4PR21MB0119: x-exchange-antispam-report-test: UriScan:(158342451672863)(10436049006162)(89211679590171)(192374486261705)(788757137089)(211936372134217)(153496737603132)(21748063052155)(146099531331640); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(10201501046)(100000703101)(100105400095)(93006095)(93001095)(3002001)(3231020)(920507026)(6055026)(61426038)(61427038)(6041248)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123555025)(20161123558100)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0119; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0119; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39860400002)(376002)(47760400005)(189002)(199003)(24454002)(54906003)(25786009)(34040400001)(189998001)(72206003)(77096006)(6436002)(6506006)(106356001)(966005)(105586002)(53546010)(74316002)(575784001)(7736002)(6916009)(86612001)(790700001)(93886005)(229853002)(2950100002)(102836003)(19609705001)(86362001)(97736004)(6116002)(14454004)(50986999)(76176999)(316002)(53946003)(8676002)(8936002)(54896002)(8990500004)(55016002)(236005)(6306002)(9686003)(2900100001)(22452003)(478600001)(99286003)(54356999)(7696004)(101416001)(10090500001)(561944003)(68736007)(3280700002)(81166006)(4326008)(6246003)(81156014)(53386004)(3660700001)(5660300001)(33656002)(53936002)(2906002)(1680700002)(606006)(10290500003)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0119; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504D9B25F3D52539D5322EBF5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: bc1afeb5-6f7e-48c8-6e21-08d51b10ade7 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 18:54:39.2284 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0119 Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 18:54:46 -0000 --_000_CY4PR21MB0504D9B25F3D52539D5322EBF5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi00LjEuMzoNCg0KNC4x LjM8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi00LjEuMz4uICAi YXVkIiAoQXVkaWVuY2UpIENsYWltDQogICBUaGUgImF1ZCIgKGF1ZGllbmNlKSBjbGFpbSBpZGVu dGlmaWVzIHRoZSByZWNpcGllbnRzIHRoYXQgdGhlIEpXVCBpcw0KICAgaW50ZW5kZWQgZm9yLg0K DQpUaGVyZeKAmXMgYSBidW5jaCBvZiBvdGhlciBwbGFjZXMgd2hlcmUgdGhlIHRlcm0g4oCccmVj aXBpZW504oCdIG9jY3Vycy4gIFByZXZpb3VzIGluY29uc2lzdGVuY2VzIGluIEpXVCB3ZXJlIHBv aW50ZWQgb3V0IGR1cmluZyBsYXRlIFdHIHJldmlld3MgYW5kIGFkZHJlc3NlZCB1c2luZyB0aGUg Y3VycmVudCB0ZXJtaW5vbG9neSwgd2hpY2ggaXMgcGFydCBvZiB3aHkgSSByZW1lbWJlciB0aGlz IGF0IGFsbC4NCg0KTXkgcG9pbnQgb2YgdmlldyBpcyB0aGF0IHJldmlld2VycyBub3RpY2VkIGlu Y29uc2lzdGVudCB1c2FnZSBvZiB0ZXJtaW5vbG9neSBkdXJpbmcgV0dMQywgc28gd2Ugc2hvdWxk IHRyeSB0byBhZGRyZXNzIHRoYXQuICBTRVQgZG9lc27igJl0IGV4aXN0IGluIGEgdmFjdXVtIOKA kyBpdOKAmXMgYSBwcm9maWxlIG9mIEpXVCwgc28gdG8gdGhlIGV4dGVudCB0aGF0IFNFVCB1c2Vz IGNvbmNlcHRzIHRoYXQgSldUIGFscmVhZHkgaGFzIG5hbWVzIGZvciwgd2Ugc2hvdWxkIHVzZSB0 aGUgc2FtZSBuYW1lcyB1bmxlc3MgdGhlcmUgYXJlIGNvbXBlbGxpbmcgcmVhc29ucyBub3QgdG8u DQoNCkl0IG1heSBiZSBiaWtlLXNoZWRkaW5nLCBidXQgaW4gbXkgZXhwZXJpZW5jZSwgaWYgd2Ug ZG9u4oCZdCBhZGRyZXNzIGluY29uc2lzdGVuY2llcyBub3csIHRoZXkgd2lsbCBiZSBwb2ludGVk IG91dCB0byB1cyBhZ2FpbiBkdXJpbmcgSUVURi13aWRlIHJldmlldyDigJMgcG9zc2libHkgYnkg R2VuLUFydCwgcG9zc2libHkgYnkgU2VjLURpciwgcG9zc2libHkgYnkgb3VyIEFELCBvciBwb3Nz aWJseSBieSBpbmRpdmlkdWFsIHJldmlld2VycyDigJMgYW5kIGlmIG5vdCB0aGVuLCBieSB0aGUg UkZDIEVkaXRvci4gIEJldHRlciB0byBmaXggdGhlc2UgdGhpbmdzIG5vdywgcmF0aGVyIHRoYW4g bGV0IHRoZW0gbGluZ2VyIGFuZCBnZW5lcmF0ZSBtb3JlIG9iamVjdGlvbnMgYW5kIGRlbGF5cy4N Cg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUGhpbCBIdW50IFttYWlsdG86cGhpbC5odW50QG9y YWNsZS5jb21dDQpTZW50OiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgOTowMSBQTQ0KVG86IE1p a2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4NCkNjOiBNYXJpdXMgU2N1cnRl c2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb20+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1l dmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdICJhdWQiIHZzLiByZWNlaXZl ciBpc3N1ZSByYWlzZWQgaW4gV0dMQw0KDQpNaWtlLA0KDQpUaGUgZ3JvdXAgb3JpZ2luYWxseSBy ZXF1ZXN0ZWQgY2hhbmdlIGZyb20gcHVibGlzaGVyL3N1YnNjcmliZXIgdG8gRXZlbnQgVHJhbnNt aXR0ZXIgYW5kIEV2ZW50IFJlY2VpdmVyLg0KDQpSZWdhcmRpbmcg4oCcY29uc2lzdGVuY3nigJ0g YmV0d2VlbiBzcGVjcywgSSBjYW7igJl0IGZpbmQgYW55IGRlZmluaXRpdmUgdXNlIG9mIHRoZSB0 ZXJtIHJlY2lwaWVudCBpbiBSRkM3MTU5LCA3NTE1LCBvciA3NTIzLiAgQW0gSSBtaXNzaW5nIHNv bWV0aGluZz8gSSBvbmx5IGZvdW5kIHRoaXMgcGFyYWdyYXBoOg0KDQpOb3RlOiAgTm8gImNoYXJz ZXQiIHBhcmFtZXRlciBpcyBkZWZpbmVkIGZvciB0aGlzIHJlZ2lzdHJhdGlvbi4NCg0KICAgICAg QWRkaW5nIG9uZSByZWFsbHkgaGFzIG5vIGVmZmVjdCBvbiBjb21wbGlhbnQgcmVjaXBpZW50cy4N Cg0KDQpBcmUgd2UgYmlrZS1zaGVkZGluZyBoZXJlPw0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3Jh dGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQpAaW5kZXBlbmRlbnRpZA0K d3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGls Lmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9jdCAy MywgMjAxNywgYXQgODowOCBQTSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCg0KU2VlIG9u ZSBvZiBteSBvdGhlciBteSBvdGhlciByZXBsaWVzLiBUaGUgdGVybSBzaG91bGQgYmUg4oCccmVj aXBpZW504oCdIGZvciBKV1QvSldTLCBldGMuIGNvbnNpc3RlbmN5Lg0KDQoNCkZyb206IFBoaWwg SHVudCAoSURNKTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQpTZW50OiBNb25kYXksIE9j dG9iZXIgMjMsIDIwMTcgNjo0NSBQTQ0KVG86IE1hcml1cyBTY3VydGVzY3U8bWFpbHRvOm1zY3Vy dGVzY3VAZ29vZ2xlLmNvbT4NCkNjOiBJRCBFdmVudHMgTWFpbGluZyBMaXN0PG1haWx0bzppZC1l dmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdICJhdWQiIHZzLiByZWNlaXZl ciBpc3N1ZSByYWlzZWQgaW4gV0dMQw0KDQpPay4gSSB3aWxsIGRvIHNlYXJjaCByZXBsYWNlIG9u IHN1YnNjcmliZXIgYXMgdGhleSBzaG91bGQgYWxsIGJlIHJlY2VpdmVyLg0KDQpUaGtzDQoNClBo aWwNCg0KT24gT2N0IDIzLCAyMDE3LCBhdCA1OjUyIFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1 cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0K SSByYWlzZWQgYSB3b3JkaW5nIGlzc3VlLCBub3Qgc3VyZSBpZiBpdCBzdGlsbCBhcHBsaWVzOg0K DQoiVGhlIGFic3RyYWN0IG1lbnRpb25zICJpc3N1ZXIiIGFuZCAicmVjZWl2ZXIiIGluIHRoZSBs YXN0IHNlbnRlbmNlLiAicmVjZWl2ZXIiIGRvZXMgbm90IHNvdW5kIHJpZ2h0ICh0aGF0IHNob3Vs ZCBiZSB1c2VkIGluIHRoZSBjb250ZXh0IG9mIGEgdHJhbnNtaXR0ZXIpLCBidXQgSSBkb24ndCBo YXZlIGEgYmV0dGVyIHN1Z2dlc3Rpb24uIEF1ZGllbmNlPw0KVGhlIGxhc3QgcGFyYWdyYXBoIG9m IHNlY3Rpb24gMSBtZW50aW9ucyAic3Vic2NyaWJlciIuIEkgdGhpbmsgaXQgc2hvdWxkIGJlIGVp dGhlciAicmVjZWl2ZXIiIG9yICJhdWRpZW5jZSIuIg0KDQoNCg0KTWFyaXVzDQoNCk9uIE1vbiwg T2N0IDIzLCAyMDE3IGF0IDU6NDkgUE0sIFBoaWwgSHVudCAoSURNKSA8cGhpbC5odW50QG9yYWNs ZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpPay4gQnV0IHlvdSBy YWlzZWQgdGhlIGNvbmNlcm4uIEFyZSB5b3Ugd2l0aGRyYXdpbmcgaXQ/DQoNClBoaWwNCg0KT24g T2N0IDIzLCAyMDE3LCBhdCA1OjQ3IFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdv b2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KT24gTW9uLCBP Y3QgMjMsIDIwMTcgYXQgNDoxNSBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCkl04oCZcyBxdWl0ZSByZWxldmFu dCB0byB0aG9zZSB3aXRoIGRpc3RyaWJ1dGVkIGFyY2hpdGVjdHVyZXMuDQoNCklmIGFuIEV2ZW50 IFN0cmVhbSByZXF1aXJlcyB0aGF0IFNFVHMgbmVlZCB0byBiZSBlbmNyeXB0ZWQgKHVzaW5nIEpX RSksIHRoZSBTRVRzIG5lZWRzIHRvIGJlIGVuY3J5cHRlZCBzbyB0aGUg4oCccmVjZWl2ZXIiIGNh biByZWFkIGl0LiAgUmVnYXJkbGVzcywg4oCcYXVk4oCdIHNob3VsZCBiZSBpbnRlcnByZXRlZCBi eSB0aGUgdHJhZGl0aW9uYWwgSldUIG1ldGhvZCB3aGljaCBzdWdnZXN0cyB0aGUgc2VjdXJpdHkg ZG9tYWluIHRoZSBldmVudCBpcyBmb3IuICBGb3IgZXhhbXBsZSwgYSB3ZWIgc2l0ZSByZWx5aW5n IHBhcnR5IGRvZXMgbm90IGhhdmUgdGhlIGNhcGFiaWxpdHkgdG8gcHJvY2VzcyAob3IgaXNzdWUp IGV2ZW50cyBpdHNlbGYgKGVnLiBiZWNhdXNlIG9mIGEgZGlzdHJpYnV0ZWQgYXJjaGl0ZWN0dXJl KS4gVGhlIHJlbHlpbmcgcGFydHkgYXNzaWducyBhbm90aGVyIGVudGl0eSB0aGUgcm9sZSBvZiBF dmVudCBSZWNlaXZlciAob3IgVHJhbnNtaXR0ZXIpLg0KDQpUaGUgcHJvYmxlbSBiZWluZyB0aGF0 IElmIHRoZSDigJxzZXTigJ0gaXMgZW5jcnlwdGVkIGZvciDigJxhdWTigJ0gdGhlbiBvbmx5IHRo ZSDigJxhdWTigJ0gZW50aXR5IGNhbiByZWFkIHRoZSBTRVQgd2hpY2ggd2lsbCBtYWtlIGl0IGlt cG9zc2libGUgdG8gZm9yIGFub3RoZXIgc2VydmVyIHRvIGhhbmRsZSBvciB3b3JzZSwgaXQgd291 bGQgcmVxdWlyZSBzaGFyaW5nIG9mIHByaXZhdGUga2V5cy4NCg0KVGhlIFJQIGNvbnRyb2xzIHRo ZSBjb25maWd1cmF0aW9uIG9mIHRoZSBzdHJlYW0sIHNvIHRoZXkgY2FuIHNwZWNpZnkgYW4gZW5k cG9pbnQgdGhhdCBiZWxvbmdzIHRvIHRoZSBvdXRzb3VyY2VkIHJlY2VpdmVyIGFuZCB0aGV5IGNh biBhbHNvIHNwZWNpZnkgYW4gZW5jcnlwdGlvbiBrZXkgdGhhdCBpcyBjb250cm9sbGVkIGJ5IHRo ZSBvdXRzb3VyY2VkIHJlY2VpdmVyLiBUaGUgUlAgZG9lcyBub3QgbmVlZCBhY2Nlc3MgdG8gdGhl IHByaXZhdGUga2V5IGF0IGFsbC4NCg0KSSBzdGlsbCB0aGluayBpdCBpcyBpcnJlbGV2YW50IHRv IHRoZSB0cmFuc21pdHRlciwgb3IgdG8gdGhpcyBzcGVjLiBJIGFncmVlIGl0IGlzIHRvdGFsbHkg cmVsZXZhbnQgZm9yIHRoZSBSUCwNCg0KDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJ ZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5k ZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJm09Q0ItSGtjeGdsaC1ZTmhYeXNPcnJva180ekNHRFlweFg0OVhz dXF0azV4TSZzPXlMczFjVHhudlpVWEFxdDcycUxHU0ptejBYM0VLVkU2eU5CSjBuc1ZVZ28mZT0+ DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9u IE9jdCAyMywgMjAxNywgYXQgMzo1OCBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBn b29nbGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCg0KSSB0aGlu ayAiYXVkIiBzaG91bGQgcG9pbnQgdG8gdGhlIFJlY2VpdmVyLCB0aGUgb3V0c291cmNpbmcgaXMg aXJyZWxldmFudC4NCg0KTm90aGluZyBuZWVkcyB0byBjaGFuZ2UgaGVyZSBJTU8uDQoNCk1hcml1 cw0KDQpPbiBNb24sIE9jdCAyMywgMjAxNyBhdCAzOjU1IFBNLCBQaGlsIEh1bnQgPHBoaWwuaHVu dEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KSXQgc2Vl bXMgcmVhc29uYWJsZSB0byBmdXJ0aGVyIGNsYXJpZnkgdGhhdCB0aGUgZGVmaW5pdGlvbiBvZiBh IHJlY2VpdmVyIGNvdWxkIGJlIGltcHJvdmVkLg0KDQpJIHByb3Bvc2UgdG8gY2hhbmdlIGZyb206 DQoNCiAgIEV2ZW50IFJlY2VpdmVyDQoNCiAgICAgIEFuIEV2ZW50IFJlY2VpdmVyIGlzIGFuIGVu dGl0eSB0aGF0IHJlY2VpdmVzIFNFVHMgdGhyb3VnaCBzb21lDQoNCiAgICAgIGRpc3RyaWJ1dGlv biBtZXRob2QuDQoNClRvOg0KDQogICBFdmVudCBSZWNlaXZlcg0KDQogICAgICBBbiBFdmVudCBS ZWNlaXZlciBpcyBhbiBlbnRpdHkgdGhhdCByZWNlaXZlcyBTRVRzIHRocm91Z2ggc29tZQ0KDQog ICAgICBkaXN0cmlidXRpb24gbWV0aG9kLiBBbiBFdmVudCBSZWNlaXZlciBNQVkgYmUgYSBkaWZm ZXJlbnQNCg0KICAgICAgZW50aXR5IHRoYW4gdGhhdCBkZXNjcmliZWQgYnkgdGhlIOKAnGF1ZOKA nSBjbGFpbS4NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNl cnZpY2VzIEFyY2hpdGVjdA0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3Lmlu ZGVwZW5kZW50aWQuY29tJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1mREI5cE5tV05nNUJQWG9SdGFYWEIxSXpfdHE1d0lDSkxpNWl0SkhSYWkwJnM9RWU3UnNQ Rkt6aGVXTnZPejFVdDlnQ3ZzXzJidzBERTZHRWVnLVMwS015RSZlPT4NCnBoaWwuaHVudEBvcmFj bGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KT24gT2N0IDIzLCAyMDE3LCBh dCAyOjM4IFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRv Om1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KDQpJIHRoaW5rICJhdWQiIGlzIHBlcmZl Y3RseSBmaW5lLg0KDQpJTU8gaXQgc2hvdWxkIG1ha2Ugbm8gZGlmZmVyZW5jZSBmb3IgdGhlIFRy YW5zbWl0dGVyIHRoYXQgdGhlIGV2ZW50IGlzIGFjdHVhbGx5IGhhbmRsZWQgYnkgYW4gb3V0c291 cmNlZCBlbnRpdHksIHRoZSBSUCB0cnVzdHMgdGhhdCBlbnRpdHkgYW5kIHRoZSBldmVudCBpcyBn ZW5lcmF0ZWQgYW5kIHRhcmdldGVkIHRvIHRoZSBSUCBhbmQgbm90IHRvIHRoZSBjdXJyZW50IG91 dHNvdXJjZWQgcHJvY2Vzc29yLg0KDQpNYXJpdXMNCg0KT24gTW9uLCBPY3QgMjMsIDIwMTcgYXQg MTA6NTcgQU0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVu dEBvcmFjbGUuY29tPj4gd3JvdGU6DQoNCkFsbCwNCg0KSSBhbSByZXZpZXdpbmcgdGhlIHByZXZp b3VzIGZlZWRiYWNrIGZyb20gV0dMQyBhbmQgd2lsbCBiZSBicmluZ2luZyB1cCBhbnkgdW5yZXNv bHZlZCBpc3N1ZXMgZm9yIHF1aWNrIGRpc2N1c3Npb24vY29uZmlybWF0aW9u4oCmDQoNCkZvbGxv d2luZyB1cCBvbiBNYXJpdXMgYW5kIEhlbmvigJlzIGNvbW1lbnQsIEkgYW0gY29uY2VybmVkIHRo YXQg4oCcYXVk4oCdIGhhcyBhIHZlcnkgc3BlY2lmaWMgbWVhbmluZyBhbmQgaXMgb2Z0ZW4gdGll ZCB0byBhIHNlY3VyaXR5IGRvbWFpbiBkZWZpbml0aW9uLiBXZSBzaG91bGQgbm90IG5lY2Vzc2Fy aWx5IHNheSB0aGlzIGlzIHRoZSByZWNlaXZlciB0aG91Z2ggaXQgb2Z0ZW4gdHVybnMgb3V0IHRv IGJlLiBGb3IgZXhhbXBsZSBhIFJQICjigJxhdWTigJ0pIGhhcyBvdXRzb3VyY2VkIGV2ZW50cyBw cm9jZXNzaW5nIHRvIGEgdGhpcmQgcGFydHkgKHRoZSBzbyBjYWxsZWQgcmVjZWl2ZXIpLg0KDQpJ IGFtIGhhcHB5IHdpdGggdGhlIGN1cnJlbnQgY2xhaW0gc2V0LCBidXQgbWF5YmUgc29tZSB0ZXh0 IGV4cGxhaW5pbmcgdGhhdCBhIHJlY2VpdmVyIGRvZXMgbm90IGhhdmUgdG8gYmUgdGhlIGF1ZCBp cyBhcHByb3ByaWF0ZT8gIEkgZG9u4oCZdCBzZWUgYW55IGJlbmVmaXQgdG8gaGF2aW5nIGEgcmVj ZWl2ZXIgY2xhaW0gYXMgdGhpcyBjb3VsZCBjb21wbGljYXRlIHByb2Nlc3NpbmcgbW9yZSB0aGFu IGl0cyB3b3J0aC4NCg0KVGhlcmUgYXJlIGEgZmV3IG90aGVyIGNvbW1lbnRzIGluIHRoaXMgdGhy ZWFkLCBidXQgdGhpcyBvbmUgc2VlbWVkIHRoZSBtb3N0IHVucmVzb2x2ZWQuDQoNClBoaWwNCg0K DQpPbiBBdWcgMywgMjAxNywgYXQgODowMyBBTSwgSGVuayBCaXJraG9seiA8aGVuay5iaXJraG9s ekBzaXQuZnJhdW5ob2Zlci5kZTxtYWlsdG86aGVuay5iaXJraG9sekBzaXQuZnJhdW5ob2Zlci5k ZT4+IHdyb3RlOg0KDQpIZWxsbywNCg0KdG8gbWUsIHRoZSAiYXVkaWVuY2UiIGNsYWltIHNlZW1z IHRvIGJlIGEgZ29vZCBjaG9pY2UgaGVyZS4NCg0KVmllbGUgR3LDvMOfZSwNCg0KSGVuaw0KDQpP biAwOC8wMi8yMDE3IDExOjQ1IFBNLCBNYXJpdXMgU2N1cnRlc2N1IHdyb3RlOg0KDQpUaGUgYWJz dHJhY3QgbWVudGlvbnMgImlzc3VlciIgYW5kICJyZWNlaXZlciIgaW4gdGhlIGxhc3Qgc2VudGVu Y2UuICJyZWNlaXZlciIgZG9lcyBub3Qgc291bmQgcmlnaHQgKHRoYXQgc2hvdWxkIGJlIHVzZWQg aW4gdGhlIGNvbnRleHQgb2YgYSB0cmFuc21pdHRlciksIGJ1dCBJIGRvbid0IGhhdmUgYSBiZXR0 ZXIgc3VnZ2VzdGlvbi4gQXVkaWVuY2U/DQpUaGUgbGFzdCBwYXJhZ3JhcGggb2Ygc2VjdGlvbiAx IG1lbnRpb25zICJzdWJzY3JpYmVyIi4gSSB0aGluayBpdCBzaG91bGQgYmUgZWl0aGVyICJyZWNl aXZlciIgb3IgImF1ZGllbmNlIi4NClRoZSBleHBsYW5hdGlvbiBmb3IgZmlndXJlIDEgc3RhdGVz IHRoYXQgdGhlIGlzc3VlciBkZW5vdGVzIHRoZSB0cmFuc21pdHRlci4gSWYgdGhlIGlzc3VlciBh bmQgdGhlIHRyYW5zbWl0dGVyIGFyZSBhc3N1bWVkIHRvIGJlIHRoZSBzYW1lIGVudGl0eSwgdGhl biB0aGUgdHJhbnNtaXR0ZXIgZGVmaW5pdGlvbiBpbiBzZWN0aW9uIDEuMiBzaG91bGQgbWFrZSB0 aGF0IGNsZWFyLg0KRmlndXJlIDMsIEkgdGhpbmsgdGhlICJzdWIiIGNsYWltIHNob3VsZCBiZSBu ZXN0ZWQgaW4gdGhlIGV2ZW50LCBuZXh0IHRvIHRoZSBpc3N1ZXIgdGhhdCBwcm92aWRlcyB0aGUg Y29ycmVjdCBjb250ZXh0LiBUaGUgImlzcyIgYW5kICJzdWIiIGRlZmluaXRpb25zIGluIDIuMSBh bHNvIHRvdWNoIG9uIHRoaXMsIHByb3ZpZGluZyBjb25mbGljdGluZyBhZHZpY2UuDQpTZWN0aW9u IDIsMSwgZGVmaW5pdGlvbiBvZiAibmJmIi4gVGhlIGRlZmluaXRpb24gc2F5cyB0aGF0IHRoaXMg aXMgdGhlIGV2ZW50IHRpbWUuIEkgc2VlIHR3byBwcm9ibGVtczoNCi0gdGhlIG5hbWUgc3VnZ2Vz dCAibm90IGJlZm9yZSIsIG5vdCBleGFjdGx5IHRoZSBzYW1lIGFzIGV2ZW50IHRpbWUNCi0gdGhl cmUgY2FuIGJlIG11bHRpcGxlIGV2ZW50cw0KbWF5YmUgdGhpcyBjbGFpbSBzaG91bGQgYmUgZHJv cHBlZD8NClNlY3Rpb24gMi4xLCBkZWZpbml0aW9uIG9mICJleHAiLiBPbWl0dGluZyB0aGlzIGNs YWltIGlzIHRoZSBzaG9ydCB0ZXJtIHNvbHV0aW9uIHRvIHRoZSBjb25mdXNpb24gaXNzdWUuIFdo eSBub3QgbWVudGlvbiB0aGF0IGFuZCB0aGF0IGl0IFNIT1VMRCBOT1QgYmUgdXNlZD8NClNlY3Rp b24gMi4xLCBkZWZpbml0aW9uIG9mICJldmVudHMiLiBJdCBzdGF0ZXMgdGhhdCBhbGwgZXZlbnRz IG11c3QgcmVmZXIgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC4gTGF0ZWx5IGluIGRpc2N1c3Np b25zIHdlIHJlYWNoZWQgdGhlIGNvbmNsdXNpb24gdGhhdCBhbGwgZXZlbnRzIGluIGEgU0VUIHNo b3VsZCBiZSBkZWZpbmVkIGluIHRoZSBzYW1lIHByb2ZpbGUsIHdoaWNoIGlzIGEgc3Ryb25nZXIg cmVxdWlyZW1lbnQuIEkgdGhpbmsgdGhpcyBkZWZpbml0aW9uIHNob3VsZCBtZW50aW9uIHRoYXQu DQpSZWdhcmRpbmcgZXZlbnRzIGFuZCBwcm9maWxlcy4gVGhlcmUgd2FzIGEgcHJvcG9zYWwgdG8g YWRkIGEgbmV3IGNsYWltIHRvIHVuaXF1ZWx5IGlkZW50aWZ5IHRoZSBwcm9maWxlLiBJIHRoaW5r IHdlIG5lZWQgdG8gZGlzY3VzcyB0aGF0Lg0KRmlndXJlIDUuIE1heWJlIGEgc2lnbmVkIGV4YW1w bGUgd291bGQgYmUgYmV0dGVyLCBlc3BlY2lhbGx5IHRoYXQgdGhlIG5leHQgcGFyYWdyYXBoIG1l bnRpb25zIHRoYXQgc2lnbmF0dXJlcyBvciBlbmNyeXB0aW9uIHNob3VsZCBiZSB1c2VkLg0KU2Vj dGlvbiA0LjUsIHNlY29uZCBwYXJhZ3JhcGguIE1lbnRpb25zIHRoYXQgIm5vbmNlIiBpcyBhbHNv IHJlcXVpcmVkLCBidXQgdGhhdCBpcyBub3QgYWN0dWFsbHkgdHJ1ZS4gSWQgVG9rZW5zIGlzc3Vl ZCBhdCB0aGUgdG9rZW4gZW5kcG9pbnQgZm9yIGV4YW1wbGUgd2lsbCBub3QgaGF2ZSBpdC4gSSBz dWdnZXN0IHdlIGRyb3AgdGhlIHdob2xlIHBhcmFncmFwaC4NCk1hcml1cw0KT24gTW9uLCBKdWwg MzEsIDIwMTcgYXQgMTo0MCBQTSwgWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29t PG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+IDxtYWlsdG86eWFyb25mLmlldGZAZ21haWwu Y29tPj4gd3JvdGU6DQogICBUaGlzIGlzIHRvIGFubm91bmNlIHdvcmtpbmcgZ3JvdXAgbGFzdCBj YWxsIG9uIHRoaXMgZHJhZnQNCiAgIChodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX2RhdGF0cmFja2VyLmlldGYub3JnX2RvY19kcmFmdC0yRGlldGYt MkRzZWNldmVudC0yRHRva2VuXyZkPUR3SUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZzPTlT SVQ5OFJsQWIxQzlNZDFXNTRJUmw2Y3hqbEtmanFUOTl1NS1Panc0RncmZT0gICAgIDxodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2RhdGF0cmFja2Vy LmlldGYub3JnX2RvY19kcmFmdC0yRGlldGYtMkRzZWNldmVudC0yRHRva2VuXyZkPUR3SUdhUSZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09VVV5ZElGRVY5U1FfbHdfTE5FNGx2 UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZzPTlTSVQ5OFJsQWIxQzlNZDFXNTRJUmw2Y3hqbEtmanFU OTl1NS1Panc0RncmZT0gPikuDQogICBQbGVhc2Ugc2VuZCB5b3VyIGNvbW1lbnRzIHRvIHRoZSBs aXN0LiBFdmVuIGlmIHlvdSBhcmUgcGVyZmVjdGx5DQogICBoYXBweSB3aXRoIHRoZSBkcmFmdCwg cGxlYXNlIGxldCB1cyBrbm93IHRoYXQgeW91IHN1cHBvcnQgaXRzDQogICBwdWJsaWNhdGlvbiBh cy1pcyBieSBwb3N0aW5nIHRvIHRoZSBsaXN0Lg0KICAgQmVjYXVzZSBvZiB0aGUgc3VtbWVyIGhv bGlkYXlzLCB0aGlzIGxhc3QgY2FsbCBpcyBvcGVuIGZvciAzIHdlZWtzLA0KICAgdW50aWwgQXVn LiAyMS4NCiAgIFRoYW5rcywNCiAgICAgICAgRGljayBhbmQgWWFyb24NCiAgIF9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICBJZC1ldmVudCBtYWlsaW5n IGxpc3QNCiAgIElkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4gPG1h aWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCiAgIGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZkPUR3SUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3 U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09VVV5 ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZzPWpYMVFnY0ZJOHVtdHQ4 cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmZT0gICAgIDxodHRwczovL3VybGRlZmVuc2Uu cHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xp c3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lHYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NY NVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19s TElHayZtPVVVeWRJRkVWOVNRX2x3X0xORTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmcz1qWDFR Z2NGSTh1bXR0OHBFa3RoWGEzdUxfVHNKSU5MVlRYT1JVcFNEbnZBJmU9ID4NCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxp c3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUdhUSZjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJm09VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxYRVpFV0EyRjFpN2Jm QXVVWSZzPWpYMVFnY0ZJOHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmZT0NCg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50 IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3Jn Pg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193 d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJR2FRJmM9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhF WkVXQTJGMWk3YmZBdVVZJnM9algxUWdjRkk4dW10dDhwRWt0aFhhM3VMX1RzSklOTFZUWE9SVXBT RG52QSZlPQ0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklk LWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9p ZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed01GYVEmYz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdD SDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPXFnemk2aElRVWRYVUNadTNYMmxyUUZB ZEdaTzJPOXN6endQYWgyTThMWDAmcz1rcjllMk9iX3EwZzVCaW5qQk9MSkFqclplV0ljckNOeDlP MWpheC1CczhvJmU9Pg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFp bHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2 ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksx MCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1mREI5cE5t V05nNUJQWG9SdGFYWEIxSXpfdHE1d0lDSkxpNWl0SkhSYWkwJnM9N00wT2xlVGQ0QnBDYk5NSGtB OVZpZjh1Y3puSzJYa2RZcDd3QjB6STNOMCZlPQ0KDQo= --_000_CY4PR21MB0504D9B25F3D52539D5322EBF5470CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmg0DQoJe21zby1zdHlsZS1wcmlvcml0eTo5Ow0K CW1zby1zdHlsZS1saW5rOiJIZWFkaW5nIDQgQ2hhciI7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowaW47DQoJbXNvLWxpbmUtaGVpZ2h0LWFsdDowcHQ7DQoJZm9udC1zaXplOjEy LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxl LWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3Ijt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21z by1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJn aW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0 OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwg UHJlZm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUt bGluazoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7 fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNw YW47fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUt Y29udmVydGVkLXNwYWNlO30NCnNwYW4uaG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOmhvZW56Yjt9 DQpzcGFuLm0yNzA3NTQxNzgyNzIzMzExOTJtODYzODgwOTEzODQyOTcwNTQzOGFwcGxlLXN0eWxl LXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6bV8yNzA3NTQxNzgyNzIzMzExOTJtXzg2Mzg4MDkxMzg0 Mjk3MDU0MzhhcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4ubTI3MDc1NDE3ODI3MjMzMTE5Mm04NjM4 ODA5MTM4NDI5NzA1NDM4bTUyMjQ1MzY4ODk3MDM5ODgwODVhcHBsZS1zdHlsZS1zcGFuDQoJe21z by1zdHlsZS1uYW1lOm1fMjcwNzU0MTc4MjcyMzMxMTkybV84NjM4ODA5MTM4NDI5NzA1NDM4bV81 MjI0NTM2ODg5NzAzOTg4MDg1YXBwbGUtc3R5bGUtc3Bhbjt9DQpzcGFuLm0yNzA3NTQxNzgyNzIz MzExOTJtODYzODgwOTEzODQyOTcwNTQzOG01MjI0NTM2ODg5NzAzOTg4MDg1bTU4NTg3Mjg5MzY3 NDA1ODAzOGFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTptXzI3MDc1NDE3 ODI3MjMzMTE5Mm1fODYzODgwOTEzODQyOTcwNTQzOG1fNTIyNDUzNjg4OTcwMzk4ODA4NW1fNTg1 ODcyODkzNjc0MDU4MDM4YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTI2 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0Kc3Bhbi5IZWFkaW5nNENoYXINCgl7bXNv LXN0eWxlLW5hbWU6IkhlYWRpbmcgNCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTsNCglt c28tc3R5bGUtbGluazoiSGVhZGluZyA0IjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciOw0K CWZvbnQtd2VpZ2h0OmJvbGQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhw b3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEw MjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAv Pg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFu Zz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNl Y3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYw Ij48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQu MS4zIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMS4zPC9h Pjo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0icGFn ZS1icmVhay1iZWZvcmU6YWx3YXlzIj48c3BhbiBsYW5nPSJFTiIgc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpbmUtaGVpZ2h0LWFsdDowcHQ7cGFnZS1icmVhay1i ZWZvcmU6YWx3YXlzIj4NCjxhIG5hbWU9InNlY3Rpb24tNC4xLjMiPjwvYT48YSBocmVmPSJodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTQuMS4zIj48c3BhbiBzdHls ZT0ibXNvLWJvb2ttYXJrOiZxdW90O3NlY3Rpb24tNFwuMVwuMyZxdW90OyI+PGI+PHNwYW4gbGFu Zz0iRU4iIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpi bGFjayI+NC4xLjM8L3NwYW4+PC9iPjwvc3Bhbj48c3BhbiBzdHlsZT0ibXNvLWJvb2ttYXJrOiZx dW90O3NlY3Rpb24tNFwuMVwuMyZxdW90OyI+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0ibXNvLWJv b2ttYXJrOiZxdW90O3NlY3Rpb24tNFwuMVwuMyZxdW90OyI+PC9zcGFuPjxiPjxzcGFuIGxhbmc9 IkVOIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPi4mbmJzcDsN CiAmcXVvdDthdWQmcXVvdDsgKEF1ZGllbmNlKSBDbGFpbTxvOnA+PC9vOnA+PC9zcGFuPjwvYj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0icGFnZS1icmVhay1iZWZvcmU6YWx3YXlz Ij48c3BhbiBsYW5nPSJFTiIgc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij4mbmJzcDsmbmJzcDsgVGhlICZxdW90O2F1ZCZxdW90OyAoYXVkaWVuY2UpIGNsYWltIGlk ZW50aWZpZXMgdGhlDQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp5ZWxsb3c7bXNvLWhpZ2hsaWdo dDp5ZWxsb3ciPnJlY2lwaWVudHM8L3NwYW4+IHRoYXQgdGhlIEpXVCBpczxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJwYWdlLWJyZWFrLWJlZm9yZTph bHdheXMiPjxzcGFuIGxhbmc9IkVOIiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyZuYnNwOyBpbnRlbmRlZCBmb3IuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojMDAyMDYwIj5UaGVyZeKAmXMgYSBidW5jaCBvZiBvdGhlciBwbGFjZXMgd2hlcmUg dGhlIHRlcm0g4oCccmVjaXBpZW504oCdIG9jY3Vycy4mbmJzcDsgUHJldmlvdXMgaW5jb25zaXN0 ZW5jZXMgaW4gSldUIHdlcmUgcG9pbnRlZCBvdXQgZHVyaW5nIGxhdGUgV0cgcmV2aWV3cyBhbmQg YWRkcmVzc2VkIHVzaW5nIHRoZSBjdXJyZW50IHRlcm1pbm9sb2d5LCB3aGljaCBpcyBwYXJ0IG9m IHdoeSBJIHJlbWVtYmVyDQogdGhpcyBhdCBhbGwuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMDAyMDYwIj5NeSBwb2ludCBvZiB2aWV3IGlzIHRoYXQgcmV2aWV3ZXJzIG5vdGljZWQgaW5j b25zaXN0ZW50IHVzYWdlIG9mIHRlcm1pbm9sb2d5IGR1cmluZyBXR0xDLCBzbyB3ZSBzaG91bGQg dHJ5IHRvIGFkZHJlc3MgdGhhdC4mbmJzcDsgU0VUIGRvZXNu4oCZdCBleGlzdCBpbiBhIHZhY3V1 bSDigJMgaXTigJlzIGEgcHJvZmlsZSBvZiBKV1QsIHNvIHRvIHRoZSBleHRlbnQgdGhhdCBTRVQg dXNlcw0KIGNvbmNlcHRzIHRoYXQgSldUIGFscmVhZHkgaGFzIG5hbWVzIGZvciwgd2Ugc2hvdWxk IHVzZSB0aGUgc2FtZSBuYW1lcyB1bmxlc3MgdGhlcmUgYXJlIGNvbXBlbGxpbmcgcmVhc29ucyBu b3QgdG8uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JdCBtYXkgYmUgYmlr ZS1zaGVkZGluZywgYnV0IGluIG15IGV4cGVyaWVuY2UsIGlmIHdlIGRvbuKAmXQgYWRkcmVzcyBp bmNvbnNpc3RlbmNpZXMgbm93LCB0aGV5IHdpbGwgYmUgcG9pbnRlZCBvdXQgdG8gdXMgYWdhaW4g ZHVyaW5nIElFVEYtd2lkZSByZXZpZXcg4oCTIHBvc3NpYmx5IGJ5IEdlbi1BcnQsIHBvc3NpYmx5 IGJ5IFNlYy1EaXIsIHBvc3NpYmx5IGJ5IG91cg0KIEFELCBvciBwb3NzaWJseSBieSBpbmRpdmlk dWFsIHJldmlld2VycyDigJMgYW5kIGlmIG5vdCB0aGVuLCBieSB0aGUgUkZDIEVkaXRvci4mbmJz cDsgQmV0dGVyIHRvIGZpeCB0aGVzZSB0aGluZ3Mgbm93LCByYXRoZXIgdGhhbiBsZXQgdGhlbSBs aW5nZXIgYW5kIGdlbmVyYXRlIG1vcmUgb2JqZWN0aW9ucyBhbmQgZGVsYXlzLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAy MDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPkZyb206PC9iPiBQaGlsIEh1bnQgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0gPGJy Pg0KPGI+U2VudDo8L2I+IE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyA5OjAxIFBNPGJyPg0KPGI+ VG86PC9iPiBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7PGJy Pg0KPGI+Q2M6PC9iPiBNYXJpdXMgU2N1cnRlc2N1ICZsdDttc2N1cnRlc2N1QGdvb2dsZS5jb20m Z3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+ DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gJnF1b3Q7YXVkJnF1b3Q7IHZzLiByZWNl aXZlciBpc3N1ZSByYWlzZWQgaW4gV0dMQzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+TWlrZSw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5UaGUgZ3JvdXAgb3JpZ2luYWxseSByZXF1ZXN0ZWQgY2hhbmdlIGZyb20gcHVi bGlzaGVyL3N1YnNjcmliZXIgdG8gRXZlbnQgVHJhbnNtaXR0ZXIgYW5kIEV2ZW50IFJlY2VpdmVy LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5S ZWdhcmRpbmcg4oCcY29uc2lzdGVuY3nigJ0gYmV0d2VlbiBzcGVjcywgSSBjYW7igJl0IGZpbmQg YW55IGRlZmluaXRpdmUgdXNlIG9mIHRoZSB0ZXJtIHJlY2lwaWVudCBpbiBSRkM3MTU5LCA3NTE1 LCBvciA3NTIzLiAmbmJzcDtBbSBJIG1pc3Npbmcgc29tZXRoaW5nPyBJIG9ubHkgZm91bmQgdGhp cyBwYXJhZ3JhcGg6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwcmUgc3R5bGU9 ImJyZWFrLWJlZm9yZTogcGFnZSI+Tm90ZTombmJzcDsgTm8gJnF1b3Q7Y2hhcnNldCZxdW90OyBw YXJhbWV0ZXIgaXMgZGVmaW5lZCBmb3IgdGhpcyByZWdpc3RyYXRpb24uPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEFkZGluZyBvbmUgcmVhbGx5 IGhhcyBubyBlZmZlY3Qgb24gY29tcGxpYW50IHJlY2lwaWVudHMuPG86cD48L286cD48L3ByZT4N CjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkFyZSB3ZSBiaWtlLXNoZWRk aW5nIGhlcmU/Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVu dGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRw Oi8vd3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzpw aGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE9jdCAyMywgMjAxNywgYXQgODow OCBQTSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWUgb25lIG9mIG15IG90 aGVyIG15IG90aGVyIHJlcGxpZXMuIFRoZSB0ZXJtIHNob3VsZCBiZSDigJxyZWNpcGllbnTigJ0g Zm9yIEpXVC9KV1MsIGV0Yy4gY29uc2lzdGVuY3kuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+RnJvbTo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PC9iPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNv bG9yOiM5NTRGNzIiPlBoaWwgSHVudCAoSURNKTwvc3Bhbj48L2E+PGJyPg0KPGI+U2VudDo8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPk1vbmRheSwg T2N0b2JlciAyMywgMjAxNyA2OjQ1IFBNPGJyPg0KPGI+VG86PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj48YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNj dUBnb29nbGUuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+TWFyaXVzIFNjdXJ0ZXNj dTwvc3Bhbj48L2E+PGJyPg0KPGI+Q2M6PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjwvYj48YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciPjxz cGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5JRCBFdmVudHMgTWFpbGluZyBMaXN0PC9zcGFuPjwv YT48YnI+DQo8Yj5TdWJqZWN0OjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj48L2I+UmU6IFtJZC1ldmVudF0gJnF1b3Q7YXVkJnF1b3Q7IHZzLiByZWNlaXZl ciBpc3N1ZSByYWlzZWQgaW4gV0dMQzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5Pay4g SSB3aWxsIGRvIHNlYXJjaCByZXBsYWNlIG9uIHN1YnNjcmliZXIgYXMgdGhleSBzaG91bGQgYWxs IGJlIHJlY2VpdmVyLiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPlRoa3M8YnI+DQo8YnI+DQpQaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpPbiBPY3QgMjMsIDIwMTcsIGF0IDU6NTIgUE0s IE1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5j b20iPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208L3Nw YW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSByYWlzZWQg YSB3b3JkaW5nIGlzc3VlLCBub3Qgc3VyZSBpZiBpdCBzdGlsbCBhcHBsaWVzOjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mcXVvdDtUaGUgYWJzdHJhY3QgbWVudGlvbnMg JnF1b3Q7aXNzdWVyJnF1b3Q7IGFuZCAmcXVvdDtyZWNlaXZlciZxdW90OyBpbiB0aGUgbGFzdCBz ZW50ZW5jZS4gJnF1b3Q7cmVjZWl2ZXImcXVvdDsgZG9lcyBub3Qgc291bmQgcmlnaHQgKHRoYXQg c2hvdWxkIGJlIHVzZWQgaW4gdGhlIGNvbnRleHQgb2YgYSB0cmFuc21pdHRlciksIGJ1dCBJIGRv bid0IGhhdmUNCiBhIGJldHRlciBzdWdnZXN0aW9uLiBBdWRpZW5jZT88bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj5UaGUgbGFzdCBwYXJhZ3JhcGggb2Ygc2VjdGlvbiAxIG1lbnRpb25zICZxdW90O3N1YnNj cmliZXImcXVvdDsuIEkgdGhpbmsgaXQgc2hvdWxkIGJlIGVpdGhlciAmcXVvdDtyZWNlaXZlciZx dW90OyBvciAmcXVvdDthdWRpZW5jZSZxdW90Oy4mcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+TWFyaXVzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIE9jdCAyMywgMjAxNyBhdCA1 OjQ5IFBNLCBQaGlsIEh1bnQgKElETSk8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5waGlsLmh1bnRAb3Jh Y2xlLmNvbTwvc3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj53cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5n OjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5Pay4g QnV0IHlvdSByYWlzZWQgdGhlIGNvbmNlcm4uIEFyZSB5b3Ugd2l0aGRyYXdpbmcgaXQ/PHNwYW4g c3R5bGU9ImNvbG9yOiM4ODg4ODgiPjxicj4NCjxicj4NCjxzcGFuIGNsYXNzPSJob2VuemIiPlBo aWw8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpPbiBPY3QgMjMsIDIwMTcsIGF0IDU6NDcgUE0s IE1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5j b20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+bXNjdXJ0ZXNj dUBnb29nbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+T24gTW9uLCBPY3QgMjMsIDIwMTcgYXQgNDoxNSBQTSwgUGhp bCBIdW50PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZs dDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9h PiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+d3Jv dGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SXTigJlzIHF1aXRlIHJlbGV2YW50 IHRvIHRob3NlIHdpdGggZGlzdHJpYnV0ZWQgYXJjaGl0ZWN0dXJlcy48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JZiBhbiBFdmVudCBTdHJlYW0gcmVxdWly ZXMgdGhhdCBTRVRzIG5lZWQgdG8gYmUgZW5jcnlwdGVkICh1c2luZyBKV0UpLCB0aGUgU0VUcyBu ZWVkcyB0byBiZSBlbmNyeXB0ZWQgc28gdGhlIOKAnHJlY2VpdmVyJnF1b3Q7IGNhbiByZWFkIGl0 LiZuYnNwOyBSZWdhcmRsZXNzLCDigJxhdWTigJ0gc2hvdWxkIGJlIGludGVycHJldGVkDQogYnkg dGhlIHRyYWRpdGlvbmFsIEpXVCBtZXRob2Qgd2hpY2ggc3VnZ2VzdHMgdGhlIHNlY3VyaXR5IGRv bWFpbiB0aGUgZXZlbnQgaXMgZm9yLiZuYnNwOyBGb3IgZXhhbXBsZSwgYSB3ZWIgc2l0ZSByZWx5 aW5nIHBhcnR5IGRvZXMgbm90IGhhdmUgdGhlIGNhcGFiaWxpdHkgdG8gcHJvY2VzcyAob3IgaXNz dWUpIGV2ZW50cyBpdHNlbGYgKGVnLiBiZWNhdXNlIG9mIGEgZGlzdHJpYnV0ZWQgYXJjaGl0ZWN0 dXJlKS4gVGhlIHJlbHlpbmcgcGFydHkgYXNzaWducw0KIGFub3RoZXIgZW50aXR5IHRoZSByb2xl IG9mIEV2ZW50IFJlY2VpdmVyIChvciBUcmFuc21pdHRlcikuICZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBwcm9ibGVtIGJlaW5nIHRoYXQg SWYgdGhlIOKAnHNldOKAnSBpcyBlbmNyeXB0ZWQgZm9yIOKAnGF1ZOKAnSB0aGVuIG9ubHkgdGhl IOKAnGF1ZOKAnSBlbnRpdHkgY2FuIHJlYWQgdGhlIFNFVCB3aGljaCB3aWxsIG1ha2UgaXQgaW1w b3NzaWJsZSB0byBmb3IgYW5vdGhlciBzZXJ2ZXIgdG8gaGFuZGxlIG9yIHdvcnNlLA0KIGl0IHdv dWxkIHJlcXVpcmUgc2hhcmluZyBvZiBwcml2YXRlIGtleXMuJm5ic3A7PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5U aGUgUlAgY29udHJvbHMgdGhlIGNvbmZpZ3VyYXRpb24gb2YgdGhlIHN0cmVhbSwgc28gdGhleSBj YW4gc3BlY2lmeSBhbiBlbmRwb2ludCB0aGF0IGJlbG9uZ3MgdG8gdGhlIG91dHNvdXJjZWQgcmVj ZWl2ZXIgYW5kIHRoZXkgY2FuIGFsc28gc3BlY2lmeSBhbiBlbmNyeXB0aW9uIGtleSB0aGF0IGlz DQogY29udHJvbGxlZCBieSB0aGUgb3V0c291cmNlZCByZWNlaXZlci4gVGhlIFJQIGRvZXMgbm90 IG5lZWQgYWNjZXNzIHRvIHRoZSBwcml2YXRlIGtleSBhdCBhbGwuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSBzdGlsbCB0aGluayBpdCBpcyBpcnJlbGV2 YW50IHRvIHRoZSB0cmFuc21pdHRlciwgb3IgdG8gdGhpcyBzcGVjLiBJIGFncmVlIGl0IGlzIHRv dGFsbHkgcmVsZXZhbnQgZm9yIHRoZSBSUCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlBoaWw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PcmFjbGUgQ29ycG9yYXRp b24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlk LmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBr S1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xM SUdrJmFtcDttPUNCLUhrY3hnbGgtWU5oWHlzT3Jyb2tfNHpDR0RZcHhYNDlYc3VxdGs1eE0mYW1w O3M9eUxzMWNUeG52WlVYQXF0NzJxTEdTSm16MFgzRUtWRTZ5TkJKMG5zVlVnbyZhbXA7ZT0iIHRh cmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+d3d3LmluZGVwZW5kZW50 aWQuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxh IGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJjb2xvcjojOTU0RjcyIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIE9jdCAyMywgMjAx NywgYXQgMzo1OCBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3Vy dGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0 RjcyIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPkkgdGhpbmsgJnF1b3Q7YXVkJnF1b3Q7IHNob3VsZCBwb2ludCB0byB0aGUgUmVjZWl2ZXIs IHRoZSBvdXRzb3VyY2luZyBpcyBpcnJlbGV2YW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5Ob3RoaW5nIG5lZWRzIHRvIGNoYW5nZSBoZXJlIElNTy48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ TWFyaXVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIE9j dCAyMywgMjAxNyBhdCAzOjU1IFBNLCBQaGlsIEh1bnQ8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3Jh Y2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5waGls Lmh1bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj53cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdo dDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkl0 IHNlZW1zIHJlYXNvbmFibGUgdG8gZnVydGhlciBjbGFyaWZ5IHRoYXQgdGhlIGRlZmluaXRpb24g b2YgYSByZWNlaXZlciBjb3VsZCBiZSBpbXByb3ZlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+SSBwcm9wb3NlIHRvIGNoYW5nZSBmcm9tOjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IEV2ZW50IFJlY2VpdmVyPG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IEFuIEV2 ZW50IFJlY2VpdmVyIGlzIGFuIGVudGl0eSB0aGF0IHJlY2VpdmVzIFNFVHMgdGhyb3VnaCBzb21l PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGRp c3RyaWJ1dGlvbiBtZXRob2QuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPlRvOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+Jm5ic3A7 Jm5ic3A7IEV2ZW50IFJlY2VpdmVyPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IEFuIEV2ZW50IFJlY2VpdmVyIGlzIGFuIGVudGl0eSB0aGF0IHJl Y2VpdmVzIFNFVHMgdGhyb3VnaCBzb21lPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGRpc3RyaWJ1dGlvbiBtZXRob2QuIEFuIEV2ZW50IFJlY2Vp dmVyIE1BWSBiZSBhIGRpZmZlcmVudDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyBlbnRpdHkgdGhhbiB0aGF0IGRlc2NyaWJlZCBieSB0aGUg4oCc YXVk4oCdIGNsYWltLjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj5QaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRl Y3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw LTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENn YVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lU U2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1mREI5cE5tV05nNUJQWG9SdGFYWEIxSXpf dHE1d0lDSkxpNWl0SkhSYWkwJmFtcDtzPUVlN1JzUEZLemhlV052T3oxVXQ5Z0N2c18yYncwREU2 R0VlZy1TMEtNeUUmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5 NTRGNzIiPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20i IHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+cGhpbC5odW50QG9y YWNsZS5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5PbiBPY3QgMjMsIDIwMTcsIGF0IDI6MzggUE0sIE1hcml1cyBTY3VydGVzY3UgJmx0 OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9zcGFuPjwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JIHRo aW5rICZxdW90O2F1ZCZxdW90OyBpcyBwZXJmZWN0bHkgZmluZS48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+SU1PIGl0IHNob3VsZCBtYWtlIG5vIGRpZmZlcmVuY2UgZm9y IHRoZSBUcmFuc21pdHRlciB0aGF0IHRoZSBldmVudCBpcyBhY3R1YWxseSBoYW5kbGVkIGJ5IGFu IG91dHNvdXJjZWQgZW50aXR5LCB0aGUgUlAgdHJ1c3RzIHRoYXQgZW50aXR5IGFuZCB0aGUgZXZl bnQgaXMgZ2VuZXJhdGVkIGFuZCB0YXJnZXRlZA0KIHRvIHRoZSBSUCBhbmQgbm90IHRvIHRoZSBj dXJyZW50IG91dHNvdXJjZWQgcHJvY2Vzc29yLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5NYXJpdXM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIE1vbiwgT2N0IDIzLCAyMDE3IGF0IDEwOjU3 IEFNLCBQaGlsIEh1bnQ8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwv c3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj53cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj5BbGwsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+SSBhbSByZXZpZXdpbmcgdGhlIHByZXZpb3VzIGZlZWRiYWNrIGZyb20g V0dMQyBhbmQgd2lsbCBiZSBicmluZ2luZyB1cCBhbnkgdW5yZXNvbHZlZCBpc3N1ZXMgZm9yIHF1 aWNrIGRpc2N1c3Npb24vY29uZmlybWF0aW9u4oCmPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+Rm9sbG93aW5nIHVwIG9uIE1hcml1cyBhbmQgSGVua+KAmXMg Y29tbWVudCwgSSBhbSBjb25jZXJuZWQgdGhhdCDigJxhdWTigJ0gaGFzIGEgdmVyeSBzcGVjaWZp YyBtZWFuaW5nIGFuZCBpcyBvZnRlbiB0aWVkIHRvIGEgc2VjdXJpdHkgZG9tYWluIGRlZmluaXRp b24uIFdlIHNob3VsZCBub3QgbmVjZXNzYXJpbHkNCiBzYXkgdGhpcyBpcyB0aGUgcmVjZWl2ZXIg dGhvdWdoIGl0IG9mdGVuIHR1cm5zIG91dCB0byBiZS4gRm9yIGV4YW1wbGUgYSBSUCAo4oCcYXVk 4oCdKSBoYXMgb3V0c291cmNlZCBldmVudHMgcHJvY2Vzc2luZyB0byBhIHRoaXJkIHBhcnR5ICh0 aGUgc28gY2FsbGVkIHJlY2VpdmVyKS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5JIGFtIGhhcHB5IHdpdGggdGhlIGN1cnJlbnQgY2xhaW0gc2V0LCBidXQg bWF5YmUgc29tZSB0ZXh0IGV4cGxhaW5pbmcgdGhhdCBhIHJlY2VpdmVyIGRvZXMgbm90IGhhdmUg dG8gYmUgdGhlIGF1ZCBpcyBhcHByb3ByaWF0ZT8mbmJzcDsgSSBkb27igJl0IHNlZSBhbnkgYmVu ZWZpdCB0byBoYXZpbmcgYSByZWNlaXZlcg0KIGNsYWltIGFzIHRoaXMgY291bGQgY29tcGxpY2F0 ZSBwcm9jZXNzaW5nIG1vcmUgdGhhbiBpdHMgd29ydGguPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhlcmUgYXJlIGEgZmV3IG90aGVyIGNvbW1lbnRzIGlu IHRoaXMgdGhyZWFkLCBidXQgdGhpcyBvbmUgc2VlbWVkIHRoZSBtb3N0IHVucmVzb2x2ZWQuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+UGhpbDxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj5PbiBBdWcgMywgMjAxNywgYXQgODowMyBBTSwgSGVuayBCaXJraG9seiAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmhlbmsuYmlya2hvbHpAc2l0LmZyYXVuaG9mZXIuZGUiIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+aGVuay5iaXJraG9sekBzaXQuZnJh dW5ob2Zlci5kZTwvc3Bhbj48L2E+Jmd0Ow0KIHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPkhlbGxvLDxicj4NCjxicj4NCnRvIG1lLCB0aGUgJnF1b3Q7YXVkaWVuY2UmcXVv dDsgY2xhaW0gc2VlbXMgdG8gYmUgYSBnb29kIGNob2ljZSBoZXJlLjxicj4NCjxicj4NClZpZWxl IEdyw7zDn2UsPGJyPg0KPGJyPg0KSGVuazxicj4NCjxicj4NCk9uIDA4LzAyLzIwMTcgMTE6NDUg UE0sIE1hcml1cyBTY3VydGVzY3Ugd3JvdGU6PGJyIHN0eWxlPSJmb250LXZhcmlhbnQtY2Fwczog bm9ybWFsO3RleHQtYWxpZ246c3RhcnQ7d29yZC1zcGFjaW5nOjBweCI+DQo8YnI+DQo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PlRoZSBhYnN0cmFjdCBtZW50aW9ucyAmcXVvdDtpc3N1ZXImcXVvdDsgYW5kICZxdW90O3JlY2Vp dmVyJnF1b3Q7IGluIHRoZSBsYXN0IHNlbnRlbmNlLiAmcXVvdDtyZWNlaXZlciZxdW90OyBkb2Vz IG5vdCBzb3VuZCByaWdodCAodGhhdCBzaG91bGQgYmUgdXNlZCBpbiB0aGUgY29udGV4dCBvZiBh IHRyYW5zbWl0dGVyKSwgYnV0IEkgZG9uJ3QgaGF2ZQ0KIGEgYmV0dGVyIHN1Z2dlc3Rpb24uIEF1 ZGllbmNlPzxicj4NClRoZSBsYXN0IHBhcmFncmFwaCBvZiBzZWN0aW9uIDEgbWVudGlvbnMgJnF1 b3Q7c3Vic2NyaWJlciZxdW90Oy4gSSB0aGluayBpdCBzaG91bGQgYmUgZWl0aGVyICZxdW90O3Jl Y2VpdmVyJnF1b3Q7IG9yICZxdW90O2F1ZGllbmNlJnF1b3Q7Ljxicj4NClRoZSBleHBsYW5hdGlv biBmb3IgZmlndXJlIDEgc3RhdGVzIHRoYXQgdGhlIGlzc3VlciBkZW5vdGVzIHRoZSB0cmFuc21p dHRlci4gSWYgdGhlIGlzc3VlciBhbmQgdGhlIHRyYW5zbWl0dGVyIGFyZSBhc3N1bWVkIHRvIGJl IHRoZSBzYW1lIGVudGl0eSwgdGhlbiB0aGUgdHJhbnNtaXR0ZXIgZGVmaW5pdGlvbiBpbiBzZWN0 aW9uIDEuMiBzaG91bGQgbWFrZSB0aGF0IGNsZWFyLjxicj4NCkZpZ3VyZSAzLCBJIHRoaW5rIHRo ZSAmcXVvdDtzdWImcXVvdDsgY2xhaW0gc2hvdWxkIGJlIG5lc3RlZCBpbiB0aGUgZXZlbnQsIG5l eHQgdG8gdGhlIGlzc3VlciB0aGF0IHByb3ZpZGVzIHRoZSBjb3JyZWN0IGNvbnRleHQuIFRoZSAm cXVvdDtpc3MmcXVvdDsgYW5kICZxdW90O3N1YiZxdW90OyBkZWZpbml0aW9ucyBpbiAyLjEgYWxz byB0b3VjaCBvbiB0aGlzLCBwcm92aWRpbmcgY29uZmxpY3RpbmcgYWR2aWNlLjxicj4NClNlY3Rp b24gMiwxLCBkZWZpbml0aW9uIG9mICZxdW90O25iZiZxdW90Oy4gVGhlIGRlZmluaXRpb24gc2F5 cyB0aGF0IHRoaXMgaXMgdGhlIGV2ZW50IHRpbWUuIEkgc2VlIHR3byBwcm9ibGVtczo8YnI+DQot IHRoZSBuYW1lIHN1Z2dlc3QgJnF1b3Q7bm90IGJlZm9yZSZxdW90Oywgbm90IGV4YWN0bHkgdGhl IHNhbWUgYXMgZXZlbnQgdGltZTxicj4NCi0gdGhlcmUgY2FuIGJlIG11bHRpcGxlIGV2ZW50czxi cj4NCm1heWJlIHRoaXMgY2xhaW0gc2hvdWxkIGJlIGRyb3BwZWQ/PGJyPg0KU2VjdGlvbiAyLjEs IGRlZmluaXRpb24gb2YgJnF1b3Q7ZXhwJnF1b3Q7LiBPbWl0dGluZyB0aGlzIGNsYWltIGlzIHRo ZSBzaG9ydCB0ZXJtIHNvbHV0aW9uIHRvIHRoZSBjb25mdXNpb24gaXNzdWUuIFdoeSBub3QgbWVu dGlvbiB0aGF0IGFuZCB0aGF0IGl0IFNIT1VMRCBOT1QgYmUgdXNlZD88YnI+DQpTZWN0aW9uIDIu MSwgZGVmaW5pdGlvbiBvZiAmcXVvdDtldmVudHMmcXVvdDsuIEl0IHN0YXRlcyB0aGF0IGFsbCBl dmVudHMgbXVzdCByZWZlciB0byB0aGUgc2FtZSBsb2dpY2FsIGV2ZW50LiBMYXRlbHkgaW4gZGlz Y3Vzc2lvbnMgd2UgcmVhY2hlZCB0aGUgY29uY2x1c2lvbiB0aGF0IGFsbCBldmVudHMgaW4gYSBT RVQgc2hvdWxkIGJlIGRlZmluZWQgaW4gdGhlIHNhbWUgcHJvZmlsZSwgd2hpY2ggaXMgYSBzdHJv bmdlciByZXF1aXJlbWVudC4gSSB0aGluayB0aGlzDQogZGVmaW5pdGlvbiBzaG91bGQgbWVudGlv biB0aGF0Ljxicj4NClJlZ2FyZGluZyBldmVudHMgYW5kIHByb2ZpbGVzLiBUaGVyZSB3YXMgYSBw cm9wb3NhbCB0byBhZGQgYSBuZXcgY2xhaW0gdG8gdW5pcXVlbHkgaWRlbnRpZnkgdGhlIHByb2Zp bGUuIEkgdGhpbmsgd2UgbmVlZCB0byBkaXNjdXNzIHRoYXQuPGJyPg0KRmlndXJlIDUuIE1heWJl IGEgc2lnbmVkIGV4YW1wbGUgd291bGQgYmUgYmV0dGVyLCBlc3BlY2lhbGx5IHRoYXQgdGhlIG5l eHQgcGFyYWdyYXBoIG1lbnRpb25zIHRoYXQgc2lnbmF0dXJlcyBvciBlbmNyeXB0aW9uIHNob3Vs ZCBiZSB1c2VkLjxicj4NClNlY3Rpb24gNC41LCBzZWNvbmQgcGFyYWdyYXBoLiBNZW50aW9ucyB0 aGF0ICZxdW90O25vbmNlJnF1b3Q7IGlzIGFsc28gcmVxdWlyZWQsIGJ1dCB0aGF0IGlzIG5vdCBh Y3R1YWxseSB0cnVlLiBJZCBUb2tlbnMgaXNzdWVkIGF0IHRoZSB0b2tlbiBlbmRwb2ludCBmb3Ig ZXhhbXBsZSB3aWxsIG5vdCBoYXZlIGl0LiBJIHN1Z2dlc3Qgd2UgZHJvcCB0aGUgd2hvbGUgcGFy YWdyYXBoLjxicj4NCk1hcml1czxicj4NCk9uIE1vbiwgSnVsIDMxLCAyMDE3IGF0IDE6NDAgUE0s IFlhcm9uIFNoZWZmZXIgJmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20i IHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+eWFyb25mLmlldGZA Z21haWwuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0ibTI3MDc1NDE3ODI3MjMzMTE5Mm04NjM4 ODA5MTM4NDI5NzA1NDM4bTUyMjQ1MzY4ODk3MDM5ODgwODVtNTg1ODcyODkzNjc0MDU4MDM4YXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzp5YXJv bmYuaWV0ZkBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1 NEY3MiI+bWFpbHRvOnlhcm9uZi5pZXRmQGdtYWlsLmNvbTwvc3Bhbj48L2E+Jmd0OyZndDsNCiB3 cm90ZTo8YnI+DQombmJzcDsmbmJzcDsmbmJzcDtUaGlzIGlzIHRvIGFubm91bmNlIHdvcmtpbmcg Z3JvdXAgbGFzdCBjYWxsIG9uIHRoaXMgZHJhZnQ8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsoPGEg aHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNB X19kYXRhdHJhY2tlci5pZXRmLm9yZ19kb2NfZHJhZnQtMkRpZXRmLTJEc2VjZXZlbnQtMkR0b2tl bl8mYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElH ayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtz PTlTSVQ5OFJsQWIxQzlNZDFXNTRJUmw2Y3hqbEtmanFUOTl1NS1Panc0RncmYW1wO2U9IiB0YXJn ZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fZGF0YXRyYWNrZXIuaWV0Zi5vcmdf ZG9jX2RyYWZ0LTJEaWV0Zi0yRHNlY2V2ZW50LTJEdG9rZW5fJmFtcDtkPUR3SUdhUSZhbXA7Yz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdf TE5FNGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZhbXA7cz05U0lUOThSbEFiMUM5TWQxVzU0SVJs NmN4amxLZmpxVDk5dTUtT2p3NEZ3JmFtcDtlPTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9Im0yNzA3 NTQxNzgyNzIzMzExOTJtODYzODgwOTEzODQyOTcwNTQzOG01MjI0NTM2ODg5NzAzOTg4MDg1bTU4 NTg3Mjg5MzY3NDA1ODAzOGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZsdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2RhdGF0cmFja2VyLmlldGYub3JnX2RvY19kcmFm dC0yRGlldGYtMkRzZWNldmVudC0yRHRva2VuXyZhbXA7ZD1Ed0lHYVEmYW1wO2M9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZr SVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVVVeWRJRkVWOVNRX2x3X0xORTRsdlM3 cFFMWEVaRVdBMkYxaTdiZkF1VVkmYW1wO3M9OVNJVDk4UmxBYjFDOU1kMVc1NElSbDZjeGpsS2Zq cVQ5OXU1LU9qdzRGdyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 Izk1NEY3MiI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBz LTNBX19kYXRhdHJhY2tlci5pZXRmLm9yZ19kb2NfZHJhZnQtMkRpZXRmLTJEc2VjZXZlbnQtMkR0 b2tlbl8mYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRw a0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19s TElHayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFt cDtzPTlTSVQ5OFJsQWIxQzlNZDFXNTRJUmw2Y3hqbEtmanFUOTl1NS1Panc0RncmYW1wO2U9PC9z cGFuPjwvYT48c3BhbiBjbGFzcz0ibTI3MDc1NDE3ODI3MjMzMTE5Mm04NjM4ODA5MTM4NDI5NzA1 NDM4bTUyMjQ1MzY4ODk3MDM5ODgwODVtNTg1ODcyODkzNjc0MDU4MDM4YXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmd0OykuPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7UGxlYXNl IHNlbmQgeW91ciBjb21tZW50cyB0byB0aGUgbGlzdC4gRXZlbiBpZiB5b3UgYXJlIHBlcmZlY3Rs eTxicj4NCiZuYnNwOyZuYnNwOyZuYnNwO2hhcHB5IHdpdGggdGhlIGRyYWZ0LCBwbGVhc2UgbGV0 IHVzIGtub3cgdGhhdCB5b3Ugc3VwcG9ydCBpdHM8YnI+DQombmJzcDsmbmJzcDsmbmJzcDtwdWJs aWNhdGlvbiBhcy1pcyBieSBwb3N0aW5nIHRvIHRoZSBsaXN0Ljxicj4NCiZuYnNwOyZuYnNwOyZu YnNwO0JlY2F1c2Ugb2YgdGhlIHN1bW1lciBob2xpZGF5cywgdGhpcyBsYXN0IGNhbGwgaXMgb3Bl biBmb3IgMyB3ZWVrcyw8YnI+DQombmJzcDsmbmJzcDsmbmJzcDt1bnRpbCBBdWcuIDIxLjxicj4N CiZuYnNwOyZuYnNwOyZuYnNwO1RoYW5rcyw8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtEaWNrIGFuZCBZYXJvbjxicj4NCiZuYnNwOyZuYnNwOyZu YnNwO19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K Jm5ic3A7Jm5ic3A7Jm5ic3A7SWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KJm5ic3A7Jm5ic3A7 Jm5ic3A7PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48 c3BhbiBjbGFzcz0ibTI3MDc1NDE3ODI3MjMzMTE5Mm04NjM4ODA5MTM4NDI5NzA1NDM4bTUyMjQ1 MzY4ODk3MDM5ODgwODVtNTg1ODcyODkzNjc0MDU4MDM4YXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5tYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmc8L3NwYW4+PC9hPiZndDs8YnI+DQombmJzcDsmbmJzcDsmbmJzcDs8YSBocmVmPSJodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRm Lm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZ dW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdD SDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0 bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJOHVtdHQ4cEVrdGhYYTN1TF9U c0pJTkxWVFhPUlVwU0RudkEmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOiM5NTRGNzIiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1E d0lHYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZh bXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVVV eWRJRkVWOVNRX2x3X0xORTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmYW1wO3M9algxUWdjRkk4 dW10dDhwRWt0aFhhM3VMX1RzSklOTFZUWE9SVXBTRG52QSZhbXA7ZT08L3NwYW4+PC9hPjxzcGFu IGNsYXNzPSJtMjcwNzU0MTc4MjcyMzMxMTkybTg2Mzg4MDkxMzg0Mjk3MDU0MzhtNTIyNDUzNjg4 OTcwMzk4ODA4NW01ODU4NzI4OTM2NzQwNTgwMzhhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbHQ7PGEgaHJlZj0iaHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFp bG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNl R0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5FNGx2UzdwUUxY RVpFV0EyRjFpN2JmQXVVWSZhbXA7cz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxfVHNKSU5MVlRY T1JVcFNEbnZBJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0 RjcyIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJR2FRJmFt cDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJt NWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1VVXlkSUZFVjlT UV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJOHVtdHQ4cEVr dGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmYW1wO2U9PC9zcGFuPjwvYT48c3BhbiBjbGFzcz0i bTI3MDc1NDE3ODI3MjMzMTE5Mm04NjM4ODA5MTM4NDI5NzA1NDM4bTUyMjQ1MzY4ODk3MDM5ODgw ODVtNTg1ODcyODkzNjc0MDU4MDM4YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ Jmd0Ozxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f PGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50 QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPklk LWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1VVXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVX QTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJOHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVw U0RudkEmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIi Pmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lHYVEmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVVVeWRJRkVWOVNRX2x3 X0xORTRsdlM3cFFMWEVaRVdBMkYxaTdiZkF1VVkmYW1wO3M9algxUWdjRkk4dW10dDhwRWt0aFhh M3VMX1RzSklOTFZUWE9SVXBTRG52QSZhbXA7ZT08L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtMjcw NzU0MTc4MjcyMzMxMTkybTg2Mzg4MDkxMzg0Mjk3MDU0MzhtNTIyNDUzNjg4OTcwMzk4ODA4NW01 ODU4NzI4OTM2NzQwNTgwMzhhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1h aWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xv cjojOTU0RjcyIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0 Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUdhUSZhbXA7Yz1Sb1Ax WXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3Vn Q0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209VVV5ZElGRVY5U1FfbHdfTE5F NGx2UzdwUUxYRVpFV0EyRjFpN2JmQXVVWSZhbXA7cz1qWDFRZ2NGSTh1bXR0OHBFa3RoWGEzdUxf VHNKSU5MVlRYT1JVcFNEbnZBJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjojOTU0RjcyIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9 RHdJR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1V VXlkSUZFVjlTUV9sd19MTkU0bHZTN3BRTFhFWkVXQTJGMWk3YmZBdVVZJmFtcDtzPWpYMVFnY0ZJ OHVtdHQ4cEVrdGhYYTN1TF9Uc0pJTkxWVFhPUlVwU0RudkEmYW1wO2U9PC9zcGFuPjwvYT48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1 NEY3MiI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZr SVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXFnemk2aElRVWRYVUNadTNYMmxyUUZB ZEdaTzJPOXN6endQYWgyTThMWDAmYW1wO3M9a3I5ZTJPYl9xMGc1QmluakJPTEpBanJaZVdJY3JD Tng5TzFqYXgtQnM4byZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 Izk1NEY3MiI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwv c3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjojOTU0RjcyIj5JZC1ldmVu dEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhyZWY9Imh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPWZEQjlwTm1XTmc1QlBYb1J0YVhY QjFJel90cTV3SUNKTGk1aXRKSFJhaTAmYW1wO3M9N00wT2xlVGQ0QnBDYk5NSGtBOVZpZjh1Y3pu SzJYa2RZcDd3QjB6STNOMCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29s b3I6Izk1NEY3MiI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3 SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFt cDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209ZkRC OXBObVdOZzVCUFhvUnRhWFhCMUl6X3RxNXdJQ0pMaTVpdEpIUmFpMCZhbXA7cz03TTBPbGVUZDRC cENiTk1Ia0E5VmlmOHVjem5LMlhrZFlwN3dCMHpJM04wJmFtcDtlPTwvc3Bhbj48L2E+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504D9B25F3D52539D5322EBF5470CY4PR21MB0504namp_-- From nobody Tue Oct 24 12:00:08 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF7B5138F9C for ; Tue, 24 Oct 2017 12:00:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DNv9OhdsMaU0 for ; Tue, 24 Oct 2017 12:00:01 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB2BC139672 for ; Tue, 24 Oct 2017 12:00:00 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9OIxv89031364 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 18:59:58 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9OIxv8J028121 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 24 Oct 2017 18:59:57 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9OIxvKj031679; Tue, 24 Oct 2017 18:59:57 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 24 Oct 2017 11:59:55 -0700 From: Phil Hunt Message-Id: <09B6E626-3D65-4738-A3BF-2D11065F6527@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9D5342A5-6F9D-48FC-86F9-EDEF36D87701" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Tue, 24 Oct 2017 11:59:51 -0700 In-Reply-To: Cc: ID Events Mailing List , Marius Scurtescu To: Mike Jones References: <71FA69AE-F8F6-45AB-9550-36BC9395DE32@gmail.com> <684D9C6F-C59A-4850-9A1B-24A026278A62@oracle.com> <7DAF5B83-F6DB-4015-A011-AB6E13C46B81@oracle.com> <5FF78162-D0FF-4742-90BF-9A12BA299D06@oracle.com> <73EA53D2-55F8-46EB-99BA-41516D844559@oracle.com> <9D836134-3DD2-4444-92B4-07C7DA49D51A@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 19:00:06 -0000 --Apple-Mail=_9D5342A5-6F9D-48FC-86F9-EDEF36D87701 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I stand corrected. Yesterday my browser wasn=E2=80=99t showing no = matches, and yet today it is. Weird. I think as long as SET is consistent on Receiver, we=E2=80=99re probably = good - meaning get rid of the remaining =E2=80=9Csubscriber=E2=80=9D = term. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 24, 2017, at 11:54 AM, Mike Jones = wrote: >=20 > https://tools.ietf.org/html/rfc7519#section-4.1.3 = : > =20 > <>4.1.3 = . "aud" (Audience) Claim > The "aud" (audience) claim identifies the recipients that the JWT = is > intended for. > =20 > There=E2=80=99s a bunch of other places where the term =E2=80=9Crecipien= t=E2=80=9D occurs. Previous inconsistences in JWT were pointed out = during late WG reviews and addressed using the current terminology, = which is part of why I remember this at all. > =20 > My point of view is that reviewers noticed inconsistent usage of = terminology during WGLC, so we should try to address that. SET = doesn=E2=80=99t exist in a vacuum =E2=80=93 it=E2=80=99s a profile of = JWT, so to the extent that SET uses concepts that JWT already has names = for, we should use the same names unless there are compelling reasons = not to. > =20 > It may be bike-shedding, but in my experience, if we don=E2=80=99t = address inconsistencies now, they will be pointed out to us again during = IETF-wide review =E2=80=93 possibly by Gen-Art, possibly by Sec-Dir, = possibly by our AD, or possibly by individual reviewers =E2=80=93 and if = not then, by the RFC Editor. Better to fix these things now, rather = than let them linger and generate more objections and delays. > =20 > -- = Mike > =20 > From: Phil Hunt [mailto:phil.hunt@oracle.com = ]=20 > Sent: Monday, October 23, 2017 9:01 PM > To: Mike Jones > > Cc: Marius Scurtescu >; ID Events Mailing List = > > Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC > =20 > Mike, > =20 > The group originally requested change from publisher/subscriber to = Event Transmitter and Event Receiver. > =20 > Regarding =E2=80=9Cconsistency=E2=80=9D between specs, I can=E2=80=99t = find any definitive use of the term recipient in RFC7159, 7515, or 7523. = Am I missing something? I only found this paragraph: > Note: No "charset" parameter is defined for this registration. > Adding one really has no effect on compliant recipients. > =20 > Are we bike-shedding here?=20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 > On Oct 23, 2017, at 8:08 PM, Mike Jones > wrote: > =20 > See one of my other my other replies. The term should be = =E2=80=9Crecipient=E2=80=9D for JWT/JWS, etc. consistency. > =20 > =20 > From: Phil Hunt (IDM) > Sent: Monday, October 23, 2017 6:45 PM > To: Marius Scurtescu > Cc: ID Events Mailing List > Subject: Re: [Id-event] "aud" vs. receiver issue raised in WGLC > =20 > Ok. I will do search replace on subscriber as they should all be = receiver.=20 > =20 > Thks >=20 > Phil >=20 > On Oct 23, 2017, at 5:52 PM, Marius Scurtescu > wrote: >=20 > I raised a wording issue, not sure if it still applies: > =20 > "The abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience? > The last paragraph of section 1 mentions "subscriber". I think it = should be either "receiver" or "audience"." > =20 > =20 >=20 > Marius > =20 > On Mon, Oct 23, 2017 at 5:49 PM, Phil Hunt (IDM) > wrote: > Ok. But you raised the concern. Are you withdrawing it? >=20 > Phil >=20 > On Oct 23, 2017, at 5:47 PM, Marius Scurtescu > wrote: >=20 > On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt > wrote: > It=E2=80=99s quite relevant to those with distributed architectures. > =20 > If an Event Stream requires that SETs need to be encrypted (using = JWE), the SETs needs to be encrypted so the =E2=80=9Creceiver" can read = it. Regardless, =E2=80=9Caud=E2=80=9D should be interpreted by the = traditional JWT method which suggests the security domain the event is = for. For example, a web site relying party does not have the capability = to process (or issue) events itself (eg. because of a distributed = architecture). The relying party assigns another entity the role of = Event Receiver (or Transmitter). =20 > =20 > The problem being that If the =E2=80=9Cset=E2=80=9D is encrypted for = =E2=80=9Caud=E2=80=9D then only the =E2=80=9Caud=E2=80=9D entity can = read the SET which will make it impossible to for another server to = handle or worse, it would require sharing of private keys.=20 > =20 > The RP controls the configuration of the stream, so they can specify = an endpoint that belongs to the outsourced receiver and they can also = specify an encryption key that is controlled by the outsourced receiver. = The RP does not need access to the private key at all. > =20 > I still think it is irrelevant to the transmitter, or to this spec. I = agree it is totally relevant for the RP, > =20 > =20 > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 > On Oct 23, 2017, at 3:58 PM, Marius Scurtescu > wrote: > =20 > I think "aud" should point to the Receiver, the outsourcing is = irrelevant. > =20 > Nothing needs to change here IMO. >=20 > Marius > =20 > On Mon, Oct 23, 2017 at 3:55 PM, Phil Hunt > wrote: > It seems reasonable to further clarify that the definition of a = receiver could be improved. > =20 > I propose to change from: > Event Receiver > An Event Receiver is an entity that receives SETs through some > distribution method. > =20 > To: > Event Receiver > An Event Receiver is an entity that receives SETs through some > distribution method. An Event Receiver MAY be a different > entity than that described by the =E2=80=9Caud=E2=80=9D claim. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 > On Oct 23, 2017, at 2:38 PM, Marius Scurtescu > wrote: > =20 > I think "aud" is perfectly fine. > =20 > IMO it should make no difference for the Transmitter that the event is = actually handled by an outsourced entity, the RP trusts that entity and = the event is generated and targeted to the RP and not to the current = outsourced processor. >=20 > Marius > =20 > On Mon, Oct 23, 2017 at 10:57 AM, Phil Hunt > wrote: > =20 > All, > =20 > I am reviewing the previous feedback from WGLC and will be bringing up = any unresolved issues for quick discussion/confirmation=E2=80=A6 > =20 > Following up on Marius and Henk=E2=80=99s comment, I am concerned that = =E2=80=9Caud=E2=80=9D has a very specific meaning and is often tied to a = security domain definition. We should not necessarily say this is the = receiver though it often turns out to be. For example a RP (=E2=80=9Caud=E2= =80=9D) has outsourced events processing to a third party (the so called = receiver). > =20 > I am happy with the current claim set, but maybe some text explaining = that a receiver does not have to be the aud is appropriate? I don=E2=80=99= t see any benefit to having a receiver claim as this could complicate = processing more than its worth. > =20 > There are a few other comments in this thread, but this one seemed the = most unresolved. > =20 > Phil > =20 > =20 > On Aug 3, 2017, at 8:03 AM, Henk Birkholz = > wrote: > =20 > Hello, >=20 > to me, the "audience" claim seems to be a good choice here. >=20 > Viele Gr=C3=BC=C3=9Fe, >=20 > Henk >=20 > On 08/02/2017 11:45 PM, Marius Scurtescu wrote: >=20 > The abstract mentions "issuer" and "receiver" in the last sentence. = "receiver" does not sound right (that should be used in the context of a = transmitter), but I don't have a better suggestion. Audience? > The last paragraph of section 1 mentions "subscriber". I think it = should be either "receiver" or "audience". > The explanation for figure 1 states that the issuer denotes the = transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear. > Figure 3, I think the "sub" claim should be nested in the event, next = to the issuer that provides the correct context. The "iss" and "sub" = definitions in 2.1 also touch on this, providing conflicting advice. > Section 2,1, definition of "nbf". The definition says that this is the = event time. I see two problems: > - the name suggest "not before", not exactly the same as event time > - there can be multiple events > maybe this claim should be dropped? > Section 2.1, definition of "exp". Omitting this claim is the short = term solution to the confusion issue. Why not mention that and that it = SHOULD NOT be used? > Section 2.1, definition of "events". It states that all events must = refer to the same logical event. Lately in discussions we reached the = conclusion that all events in a SET should be defined in the same = profile, which is a stronger requirement. I think this definition should = mention that. > Regarding events and profiles. There was a proposal to add a new claim = to uniquely identify the profile. I think we need to discuss that. > Figure 5. Maybe a signed example would be better, especially that the = next paragraph mentions that signatures or encryption should be used. > Section 4.5, second paragraph. Mentions that "nonce" is also required, = but that is not actually true. Id Tokens issued at the token endpoint = for example will not have it. I suggest we drop the whole paragraph. > Marius > On Mon, Jul 31, 2017 at 1:40 PM, Yaron Sheffer >> wrote: > This is to announce working group last call on this draft > = (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.o= rg_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR= 8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m= =3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3D9SIT98RlAb1C9Md1W54IRl6= cxjlKfjqT99u5-Ojw4Fw&e=3D = = >). > Please send your comments to the list. Even if you are perfectly > happy with the draft, please let us know that you support its > publication as-is by posting to the list. > Because of the summer holidays, this last call is open for 3 weeks, > until Aug. 21. > Thanks, > Dick and Yaron > _______________________________________________ > Id-event mailing list > Id-event@ietf.org = > > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = = > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_= LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8umtt8pEkthXa3uL_TsJINLVTXORUpSDn= vA&e=3D = > =20 > =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 > =20 > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DfDB9pNmWNg5BPXo= RtaXXB1Iz_tq5wICJLi5itJHRai0&s=3D7M0OleTd4BpCbNMHkA9Vif8ucznK2XkdYp7wB0zI3= N0&e=3D = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DzDjEgJvZeb4lVQN= z1NbQT2pBNfKrowDq-2L0vKRmx7s&s=3DDYiok-rItKjqJocoDkvX-5ccOQU1Q56gFaiip8X1f= RA&e=3D = =20 --Apple-Mail=_9D5342A5-6F9D-48FC-86F9-EDEF36D87701 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I stand corrected.  Yesterday my browser wasn=E2=80=99t = showing no matches, and yet today it is. Weird.

I think as long as SET is consistent on = Receiver, we=E2=80=99re probably good - meaning get rid of the remaining = =E2=80=9Csubscriber=E2=80=9D term.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 24, 2017, at 11:54 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

 
4.1.3.  "aud" (Audience) Claim
   The "aud" (audience) claim = identifies the recipients that the JWT is
   intended for.
 
There=E2=80=99= s a bunch of other places where the term =E2=80=9Crecipient=E2=80=9D = occurs.  Previous inconsistences in JWT were pointed out during = late WG reviews and addressed using the current terminology, which is = part of why I remember this at all.
 
My point of = view is that reviewers noticed inconsistent usage of terminology during = WGLC, so we should try to address that.  SET doesn=E2=80=99t exist = in a vacuum =E2=80=93 it=E2=80=99s a profile of JWT, so to the extent = that SET uses concepts that JWT already has names for, we should use the = same names unless there are compelling reasons not to.
 
It may be = bike-shedding, but in my experience, if we don=E2=80=99t address = inconsistencies now, they will be pointed out to us again during = IETF-wide review =E2=80=93 possibly by Gen-Art, possibly by Sec-Dir, = possibly by our AD, or possibly by individual reviewers =E2=80=93 and if = not then, by the RFC Editor.  Better to fix these things now, = rather than let them linger and generate more objections and delays.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Phil Hunt [mailto:phil.hunt@oracle.com] 
Sent: Monday, October 23, 2017 = 9:01 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Marius Scurtescu <mscurtescu@google.com>; = ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] "aud" vs. = receiver issue raised in WGLC
 
Mike,
 
The group originally requested change = from publisher/subscriber to Event Transmitter and Event Receiver.
 
Regarding =E2=80=9Cconsistency=E2=80=9D = between specs, I can=E2=80=99t find any definitive use of the term = recipient in RFC7159, 7515, or 7523.  Am I missing something? I = only found this paragraph:
Note:  =
No "charset" parameter is defined for this registration.
      Adding one really has no =
effect on compliant recipients.
 
Are we bike-shedding here? 
 
Phil
 
Oracle = Corporation, Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
 
On Oct 23, 2017, at 8:08 = PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
 
See one of my other my other replies. = The term should be =E2=80=9Crecipient=E2=80=9D for JWT/JWS, etc. = consistency.
 
 
From: Phil Hunt (IDM)
Sent: Monday, October 23, = 2017 6:45 PM
To: Marius Scurtescu
Cc: ID Events Mailing List
Subject: Re: [Id-event] "aud" = vs. receiver issue raised in WGLC
 
Ok. I will do = search replace on subscriber as they should all be receiver. 
 
Thks

Phil

On Oct = 23, 2017, at 5:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

I raised a wording = issue, not sure if it still applies:
 
"The abstract mentions = "issuer" and "receiver" in the last sentence. "receiver" does not sound = right (that should be used in the context of a transmitter), but I don't = have a better suggestion. Audience?
The last paragraph of section 1 mentions = "subscriber". I think it should be either "receiver" or "audience"."
 
 

Marius
 
On Mon, Oct 23, = 2017 at 5:49 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
Ok. But you raised the concern. Are you = withdrawing it?

Phil


On Oct 23, 2017, at 5:47 PM, Marius Scurtescu = <mscurtescu@google.com> wrote:

On Mon, Oct 23, 2017 at 4:15 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It=E2=80=99s quite relevant to those with = distributed architectures.
 
If an Event Stream = requires that SETs need to be encrypted (using JWE), the SETs needs to = be encrypted so the =E2=80=9Creceiver" can read it.  Regardless, = =E2=80=9Caud=E2=80=9D should be interpreted by the traditional JWT = method which suggests the security domain the event is for.  For = example, a web site relying party does not have the capability to = process (or issue) events itself (eg. because of a distributed = architecture). The relying party assigns another entity the role of = Event Receiver (or Transmitter).  
 
The problem being that = If the =E2=80=9Cset=E2=80=9D is encrypted for =E2=80=9Caud=E2=80=9D then = only the =E2=80=9Caud=E2=80=9D entity can read the SET which will make = it impossible to for another server to handle or worse, it would require = sharing of private keys. 
 
The RP controls the = configuration of the stream, so they can specify an endpoint that = belongs to the outsourced receiver and they can also specify an = encryption key that is controlled by the outsourced receiver. The RP = does not need access to the private key at all.
 
I still think it is = irrelevant to the transmitter, or to this spec. I agree it is totally = relevant for the RP,
 
 
 
Phil
 
Oracle Corporation, = Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
 
On Oct 23, 2017, at 3:58 = PM, Marius Scurtescu <mscurtescu@google.com> wrote:
 
I think "aud" should point to the Receiver, the = outsourcing is irrelevant.
 
Nothing needs to change = here IMO.

Marius
 
On Mon, Oct 23, = 2017 at 3:55 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
It seems reasonable to further clarify that the definition of = a receiver could be improved.
 
I propose to change = from:
   Event Receiver
      An Event Receiver is an entity =
that receives SETs through some
      distribution =
method.
 
To:
   Event Receiver
      An Event =
Receiver is an entity that receives SETs through some
      distribution method. An Event =
Receiver MAY be a different
      entity than =
that described by the =E2=80=9Caud=E2=80=9D claim.
 
Phil
 
Oracle Corporation, = Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
 
On Oct 23, 2017, at = 2:38 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
 
I= think "aud" is perfectly fine.
 
IMO it should make no = difference for the Transmitter that the event is actually handled by an = outsourced entity, the RP trusts that entity and the event is generated = and targeted to the RP and not to the current outsourced processor.

Marius
 
On Mon, Oct 23, = 2017 at 10:57 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
 
All,
 
I am reviewing the = previous feedback from WGLC and will be bringing up any unresolved = issues for quick discussion/confirmation=E2=80=A6
 
Following up on Marius = and Henk=E2=80=99s comment, I am concerned that =E2=80=9Caud=E2=80=9D = has a very specific meaning and is often tied to a security domain = definition. We should not necessarily say this is the receiver though it = often turns out to be. For example a RP (=E2=80=9Caud=E2=80=9D) has = outsourced events processing to a third party (the so called = receiver).
 
I am happy with the = current claim set, but maybe some text explaining that a receiver does = not have to be the aud is appropriate?  I don=E2=80=99t see any = benefit to having a receiver claim as this could complicate processing = more than its worth.
 
There are a few other = comments in this thread, but this one seemed the most unresolved.
 
Phil
 
 
On Aug 3, 2017, at = 8:03 AM, Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:
 
Hello,

to me, the "audience" claim seems to be a good = choice here.

Viele Gr=C3=BC=C3=9Fe,

Henk

On = 08/02/2017 11:45 PM, Marius Scurtescu wrote:

The abstract mentions "issuer" and "receiver" in the last = sentence. "receiver" does not sound right (that should be used in the = context of a transmitter), but I don't have a better suggestion. = Audience?
The last paragraph of section 1 mentions = "subscriber". I think it should be either "receiver" or "audience".
The explanation for figure 1 states that the issuer denotes = the transmitter. If the issuer and the transmitter are assumed to be the = same entity, then the transmitter definition in section 1.2 should make = that clear.
Figure 3, I think the "sub" claim should be = nested in the event, next to the issuer that provides the correct = context. The "iss" and "sub" definitions in 2.1 also touch on this, = providing conflicting advice.
Section 2,1, definition of = "nbf". The definition says that this is the event time. I see two = problems:
- the name suggest "not before", not exactly the = same as event time
- there can be multiple events
maybe this claim should be dropped?
Section = 2.1, definition of "exp". Omitting this claim is the short term solution = to the confusion issue. Why not mention that and that it SHOULD NOT be = used?
Section 2.1, definition of "events". It states that = all events must refer to the same logical event. Lately in discussions = we reached the conclusion that all events in a SET should be defined in = the same profile, which is a stronger requirement. I think this = definition should mention that.
Regarding events and = profiles. There was a proposal to add a new claim to uniquely identify = the profile. I think we need to discuss that.
Figure 5. = Maybe a signed example would be better, especially that the next = paragraph mentions that signatures or encryption should be used.
Section 4.5, second paragraph. Mentions that "nonce" is also = required, but that is not actually true. Id Tokens issued at the token = endpoint for example will not have it. I suggest we drop the whole = paragraph.
Marius
On Mon, Jul 31, 2017 at = 1:40 PM, Yaron Sheffer <yaronf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>> wrote:
   This is to announce working group last call = on this draft
   (https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DR= oP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJx= PEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&a= mp;s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D     &= lt;https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwIGaQ&c=3DR= oP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJx= PEivzjWwlNKe4C_lLIGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&a= mp;s=3D9SIT98RlAb1C9Md1W54IRl6cxjlKfjqT99u5-Ojw4Fw&e=3D >).
   Please send your comments to the list. Even = if you are perfectly
   happy with the = draft, please let us know that you support its
   publication as-is by posting to the = list.
   Because of the summer holidays, = this last call is open for 3 weeks,
   until = Aug. 21.
   Thanks,
        Dick and = Yaron
   _____________________________________________= __
   Id-event mailing list
   Id-event@ietf.org <mailto:Id-event@ietf.org>
   https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D     &= lt;https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D >
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DUUydIFEV9SQ_lw_LNE4lvS7pQLXEZEWA2F1i7bfAuUY&s=3DjX1QgcFI8u= mtt8pEkthXa3uL_TsJINLVTXORUpSDnvA&e=3D 
 
 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
 
<= /div>
 
_______________________________________________Id-event mailing list
Id-event@ietf.org
=
 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DzDjEgJvZeb4lVQNz1NbQT2pBNfKrowDq-2L0vKRmx7s&s=3DDYiok-rItK= jqJocoDkvX-5ccOQU1Q56gFaiip8X1fRA&e=3D 

= --Apple-Mail=_9D5342A5-6F9D-48FC-86F9-EDEF36D87701-- From nobody Tue Oct 24 12:10:20 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CF511386F3 for ; Tue, 24 Oct 2017 12:10:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.018 X-Spam-Level: X-Spam-Status: No, score=-2.018 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R9ZLFUTMrBYL for ; Tue, 24 Oct 2017 12:10:16 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0114.outbound.protection.outlook.com [104.47.33.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30F48138F9C for ; Tue, 24 Oct 2017 12:10:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=IEUWRAlxciD5AnP8+y/KqVUcnXJGh8b75dDuLmmzbC8=; b=ZdXMHL31of5rryQUDoJzOT48Om3ARDGD5V8TpmQMsJHPGWBCb+Q3P8laVtLjw7bXr0dnkBkuMzZ7KUUMZZY7xq/G8aIKL/rkU9FnaspuKq5iI/YLhmAPaMOGc3+saLSdFOaH5YLBWPZGFVe7Qc4l9Ezt1IbLZ/eSq19We5wD3sM= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0696.namprd21.prod.outlook.com (10.175.121.150) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Tue, 24 Oct 2017 19:10:14 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.001; Tue, 24 Oct 2017 19:10:14 +0000 From: Mike Jones To: Phil Hunt , "Richard Backman, Annabelle" CC: ID Events Mailing List Thread-Topic: [Id-event] Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9aLyXLkAgAEBjXA= Date: Tue, 24 Oct 2017 19:10:14 +0000 Message-ID: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> In-Reply-To: <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-24T12:10:12.6597755-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:b::19a] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0696; 6:0PFTDkbxbIvdU7jiQ2WAPWDjPRPkRN95CSrW2aYr89ZpOSLnZiAFO8DjUghivsNiSk/JV8wOD+r9eoCxfKrvv2L5BTbW68VWVhHH3+bQGnEyv66oLNG9GyQufOJW8mjSTOrPdmhydhEeHVaMFxOrE8yHaakuJlx8bIy645Y7ZJMSd0wwU8X+y+pJNLRO6RXbbtpTJWoutRXnSEzSA7tiSIo/Mzr11f0ZDSwbsQeRgWbXqr/nxmbhHFTj26ArzBvVdnaFRJiQjjp+1RI28O2xLhAxzWHShSU52aNps+2vWAHLasisFy4AqXNhzII9cFbu5Q9vXTezSGfbT/jvdDlQQkDKMnM8Zbc9NX1Uh7KbJyM=; 5:L50tBf3neC+4Ml3y7j/sIpUhQMm0HFSn3F3TxiL9Wr3noATGNDYUMRh0XQpREb41tdNmpKfbFa9HZVollRqx8nRVP0vPwt9mYWXbY8w5wmn9LRirVL32fDnAwq0wVALmEFpVm0z580/jN3EU7nyB1HPgXjBDTJhwr/rQtqw2sYQ=; 24:/9XZUAx2rJ9q2qN8EQ+lUJMDHp/M22ZbPPAK0ZG5P2Gf5dGyBH8Id0U6el9bsodc4h6U2ZB/ZxhwfxYTjTRlUWZJ5F4cgoBMv7MDR0rv8bY=; 7:/R+OR5swBtUp8hUlNu36wQPEq6X+HXmZRlIf+qNbR3OsSx0qgdYS8SLNdnTityz06DMugpkNc/ebNbQsdPfR8mavNtWPBX3zRLRfZFBO7xiOIRTyGBv8/7EsdxzjE6DP2AijVX1gUS6xIppUAh/HGzMWHvY+DsrMk+LSHBUK2ATBNQ0PXRAUkk0hIb6NGkmH71InSWnH71Huu70e06/iBFRsOtIRMyw/jh7zCmedcuGj0+RyrcJaY+t3S0/QFipd x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 23d14bfa-7d15-45d5-2489-08d51b12db20 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603231); SRVR:CY4PR21MB0696; x-ms-traffictypediagnostic: CY4PR21MB0696: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-exchange-antispam-report-test: UriScan:(10436049006162)(192374486261705)(33061846794335)(100405760836317)(21748063052155)(146099531331640)(47284530071512); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(10201501046)(3002001)(93006095)(93001095)(3231020)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123555025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0696; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0696; x-forefront-prvs: 047001DADA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(346002)(376002)(47760400005)(189002)(199003)(24454002)(551544002)(99286003)(6306002)(54896002)(55016002)(1680700002)(9686003)(236005)(53936002)(53386004)(4326008)(229853002)(81156014)(6246003)(77096006)(81166006)(8936002)(6506006)(606006)(50986999)(76176999)(110136005)(10290500003)(54356999)(478600001)(53546010)(86362001)(19609705001)(97736004)(575784001)(10090500001)(966005)(86612001)(25786009)(102836003)(6116002)(790700001)(72206003)(14454004)(8676002)(3280700002)(74316002)(7736002)(3660700001)(189998001)(68736007)(106356001)(6436002)(105586002)(101416001)(33656002)(316002)(551934003)(561944003)(2906002)(22452003)(8990500004)(5660300001)(7696004)(2950100002)(2900100001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0696; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB050408B26405044A6E1A7861F5470CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 23d14bfa-7d15-45d5-2489-08d51b12db20 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Oct 2017 19:10:14.0900 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0696 Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Oct 2017 19:10:19 -0000 --_000_CY4PR21MB050408B26405044A6E1A7861F5470CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhZ3JlZSB3aXRoIG11Y2ggb2YgUGhpbOKAmXMgcmF0aW9uYWxlIGhlcmUuDQoNCkl04oCZcyBm aW5lIGZvciBzb21lIHByb2ZpbGVzIHRvIHNheSB0aGF0IHRoZSDigJxldmVudHPigJ0gc2V0IG11 c3QgYmUgYSBzaW5nbGV0b24uICBUaGF0IGRvZXNu4oCZdCBoYXZlIHRvIGJlIHRydWUgZm9yIGFs bCBldmVudHMuICBJIHRoaW5rIHRoaW5ncyBhcmUgZmluZSBhcy1pcy4NCg0KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1p a2UNCg0KRnJvbTogSWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBP biBCZWhhbGYgT2YgUGhpbCBIdW50DQpTZW50OiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgODo0 NyBQTQ0KVG86IFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIDxyaWNoYW5uYUBhbWF6b24uY29t Pg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVj dDogUmU6IFtJZC1ldmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD8N Cg0KQW5uYWJlbGxlLA0KDQpJIGhhdmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHBy b3Bvc2FsLg0KDQpQcm9maWxpbmcgSW5kZXBlbmRlbmNlIC8gS2VlcGluZyBFdmVudCBQYXlsb2Fk cyBJbmRlcGVuZGVudA0KDQpJbmRpY2F0aW5nIHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFu ZGxlZCBieSBwcm9maWxlcyBsZWFkcyB0byBtb3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBh bmQgbW9yZSBpbXBvcnRhbnRseSBpbnRydWRlcyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBi eSBzdWdnZXN0aW5nIGEgc3ViLXNjaGVtYSBjcmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBh bmQgY29uZmxpY3RzIHRoYXQgbWF5IGFkZCB0byBjb21wbGV4aXR5IGxhdGVyIG9uLiBUaGUgY3Vy cmVudCBmb3JtYXQgYWxsb3dzIGEgcGFyc2VyIHRvIGRpc2NvdmVyIGFuZCB1bmxvYWQgb25lIG9y IG1vcmUgSlNPTiBwYXlsb2FkcyB3aGljaCBjYW4gZWFjaCBoYXZlIGluZGVwZW5kZW50IHN0cnVj dHVyZS4NCg0KR2VuZXJhbCBleHRlbnNpb25zDQoNClRoZSBwcm9wb3NhbCBhbHNvIHJ1bGVzIG91 dCBnZW5lcmFsIHB1cnBvc2UgZXh0ZW5zaW9ucyBub3QgcmVsYXRlZCB0byBhbnkgc3BlY2lmaWMg ZXZlbnQuIEdpdmVuIHRoZSBlbWVyZ2VuY2Ugb2YgaXRlbXMgbGlrZSBHUFJELCBJIHdvdWxkIG5v dCB3YW50IHRvIGJsb2NrIHRoZSBhYmlsaXR5IHRvIGFkZCBtZXRhLWRhdGEgb3Igb3RoZXIgZ2Vu ZXJhbCBwdXJwb3NlIGl0ZW1zLiBXZSBjYW4gYWxzbyBhbnRpY2lwYXRlIHNvbWUgZGVsaXZlcnkg c2NlbmFyaW9zIHdoZXJlIGFkZGl0aW9uYWwgZGF0YSBtaWdodCBiZSByZXF1aXJlZC4gRXZlbiB0 aG91Z2ggdGhlcmUgaXMgbm8gY3VycmVudCBwbGFubmVkIHVzZSwgSSBzZWUgbm8gZ29vZCByZWFz b24gdG8gcnVsZSB0aGlzIG91dC4NCg0KTXVsdGlwbGUgRXZlbnRzIEZyb20gRGlmZmVyZW50IEZh bWlsaWVzICh2cy4gTXVsdGlwbGUgRXZlbnRzIGZyb20gYSBzaW5nbGUgZmFtaWx5IGxpa2UgUklT QykNCg0KSW4gb3VyIFJJU0Mgc2Vzc2lvbiB3ZSBkaXNjdXNzZWQgZXhwcmVzc2luZyBtdWx0aXBs ZSBkaXN0aW5jdCBSSVNDIGV2ZW50cyBpbiBvbmUgU0VULiBUaGUgZGlzY3Vzc2lvbiB3YXMgdGhh dCBvbmx5IG9uZSBSSVNDIGV2ZW50IGF0IGEgdGltZS4gV2UgZGlkIG5vdCBkaXNjdXNzIG90aGVy IGV2ZW50IHByb2ZpbGVzLiBJIGRvbuKAmXQgc2VlIGEgcmVhc29uIHRvIHJ1bGUgb3V0IG11bHRp LWV2ZW50cyBmcm9tIGRpZmZlcmVudCBmYW1pbGllcyBhdCB0aGUgU0VUIGxldmVsLiBFYWNoIHBy b2ZpbGUgaXMgZXhwcmVzc2luZyBzbGlnaHRseSBkaWZmZXJlbnQgdGhpbmdzIGFib3V0IHRoZSBz YW1lIGV2ZW50Lg0KDQpJIGNhbiBmb3JzZWUgc29tZSBjYXNlcyB3aGVyZSBpdCBpcyBub3QgY2xl YXIgd2hpY2ggaXMgdGhlIHByaW1hcnkgYW5kIHdoaWNoIGlzIHRoZSBleHRlbnNpb24uICBUaGVy ZSBtYXkgbm90IGJlIGEgY2xlYXIgd2lubmVyLg0KDQpBIGNvdXBsZSBvZiBleGFtcGxlcyAodGhl c2UgYXJlIG5lY2Vzc2FyaWx5IHJlYWzigKZqdXN0IHBvc3NpYmlsaXRpZXMpOg0KKiBJdCBpcyBw cm9iYWJseSB1c2VmdWwgdG8gYmUgYWJsZSB0byBleHByZXNzIHNpbWxhci9vdmVybGFwcGluZyBl dmVudHMgZnJvbSBkaWZmZXJlbnQgU0VUIHByb2ZpbGVzIGluIG9uZSBTRVQuICBGb3IgZXhhbXBs ZSBhIEJhY2tjaGFubmVsIExvZ291dCAmIGEgUklTQyBzZXNzaW9uIGNhbmNlbCBldmVudC4NCiog U0NJTSBtYXkgd2FudCB0byByZXByZXNlbnQgYSBzaW5nbGUgdHJhbnNhY3Rpb24gYXMgY2F1c2lu ZyBtdWx0aXBsZSBzdGF0ZSBjaGFuZ2VzIGluIGFuIGV2ZW50IChlLmcuIGEgcGFzc3dvcmQgY2hh bmdlIGNhdXNlcyBtdWx0aXBsZSBlZmZlY3RzKS4gSGF2aW5nIHRvIGNoYXNlIGRvd24gbXVsdGlw bGUgZXZlbnRzIGFuZCBjb3JyZWxhdGUgYnkg4oCcdHhu4oCdIHdvdWxkIGJlIGNoYWxsZW5naW5n IGluIGEgbXVsdGktdGhyZWFkZWQvbXVsdGktbm9kZSBkZWxpdmVyeSBzeXN0ZW0uICBUaGUgU0NJ TSBsaXN0IGhhcyBub3QgZGlzY3Vzc2VkIHRoaXMsIGJ1dCBJIHdvdWxkIG5vdCB3YW50IHRvIGJs b2NrIHRoaXMgY2FwYWJpbGl0eS4gIElPVyAtIEp1c3QgYmVjYXVzZSBSSVNDIGRvZXMgbm90IHdh bnQgdG8gZXhwcmVzcyBtdWx0aXBsZSBldmVudHMgZG9lcyBub3QgbWFrZSB0aGlzIHRydWUgZm9y IG90aGVyIHByb2ZpbGVzLg0KKiBXZSBtYXkgd2lzaCB0byBpbmRpY2F0ZSBhIFNDSU0gUGFzc3dv cmQgUmVzZXQgd2FzIHBlcmZvcm1lZCBhbmQgYSBMb2dvdXQvc2Vzc2lvbiBjYW5jZWxsYXRpb24g aXMgZXhwcmVzc2VkIGF0IHRoZSBzYW1lIHRpbWUuICBUaGUgZXZlbnRzIGFyZSByZWxhdGVkIGJ1 dCBleHByZXNzIGRpZmZlcmVudCBkYXRhLg0KDQpBdm9pZGluZyBDb25mdXNpb24gRnJvbSBTaW1p bGFyIEV2ZW50cyBPcmlnaW5hdGluZyBmcm9tIHRoZSBTYW1lIFRyYW5zYWN0aW9uDQoNCklmIGV2 ZW50cyBhcmUgc2VudCBzZXBhcmF0ZWx5LCB0aGVuIG1vcmUgdHJhY2tpbmcgb2Ygc3RhdGUgKGUu Zy4gYnkgdHhuKSB3b3VsZCBiZSByZXF1aXJlZCB0byBlbnN1cmUgc2ltaWxhciBldmVudHMgYXJl IG5vdCBtaXN0YWtlbiBvciBoYW5kbGVkIGFzIHJlcGVhdHMuIFdoaWxlIHR4biBwcm92aWRlcyB1 c2VmdWwgYXVkaXQgYW5hbHlzaXMgY2FwYWJpbGl0eSwgSeKAmW0gbm90IHN1cmUgaXQgY2FuIGJl IHVzZWQgaW4gbGl2ZSBvciBuZWFyLXJlYWwgdGltZSBzeXN0ZW1zIGdpdmVuIGRpc3RyaWJ1dGVk IG11bHRpLW5vZGUsIG11bHRpLXRocmVhZGluZyBhcmNoaXRlY3R1cmVzLg0KDQpQcmV2aW91cyBE aXNjdXNzaW9uDQoNCkkgbm90ZSB0aGF0IEkgb3JpZ2luYWxseSByYWlzZWQgaGF2aW5nIGFuIGF0 dHJpYnV0ZSB0byBkZXNpZ25hdGUgcHJpbWFyeSBldmVudCBhdHRyaWJ1dGUgdG8gYWxsZXZpYXRl IHlvdXIgY29uY2VybiwgYnV0IHRoaXMgd2FzIG5vdCBhY2NlcHRlZC4gU2VlOg0KKiBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYu aHRtbA0KKiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1 cnJlbnQvbXNnMDAxNDAuaHRtbA0KDQpUaGUgY29uc2Vuc3VzLCBhdCBsZWFzdCBhcyBJIGludGVy cHJldGVkIGl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBmaWd1cmUgdGhpcyBvdXQgYmFzZWQg b24gdGhlIGRlZmluaXRpb25zIGl0IGhhcyBmb3IgZWFjaCBldmVudCBVUkkgYW5kIHRoZSBwcm9m aWxlcyB0aGV5IHJlcHJlc2VudC4gSU9XIC0gUklTQyBpcyBmcmVlIHRvIGxpbWl0IHRoYXQgb25s eSBvbmUgUklTQyBldmVudCBiZSBleHByZXNzZWQgYXQgYSB0aW1lLg0KDQoNClBoaWwNCg0KT3Jh Y2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QNCkBpbmRl cGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVudGlk LmNvbT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4N Cg0KT24gT2N0IDIzLCAyMDE3LCBhdCA3OjAyIFBNLCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxs ZSA8cmljaGFubmFAYW1hem9uLmNvbTxtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbT4+IHdyb3Rl Og0KDQpUaGUgY3VycmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMgYWxsb3dzIGZvciBleHByZXNz aW5nIG11bHRpcGxlIGV2ZW50cyB3aXRoaW4gdGhlIHNhbWUgdG9rZW4sIHdoaWNoIGludHJvZHVj ZXMgYWRkaXRpb25hbCBjb21wbGV4aXR5IGFuZCByb29tIGZvciBhbWJpZ3VvdXMgc2VtYW50aWNz LiBXZeKAmXZlIGRpc2N1c3NlZCB0aGlzIGluIHRoZSBPSURGIFJJU0Mgd29ya2luZyBncm91cCBh bmQgdGhlIGN1cnJlbnQgY29uc2Vuc3VzIHRoZXJlIGlzIHRoYXQgUklTQyB3aWxsIHJlcXVpcmUg dGhhdCBSSVNDIGV2ZW50cyBtdXN0IGJlIHRoZSBvbmx5IGV2ZW50IGluIHRoZSBTRVQsIGhhdmlu ZyBpZGVudGlmaWVkIHdheXMgdG8gY2xlYXJseSBhbmQgZWFzaWx5IHN1cHBvcnQgdGhlIGhhbmRm dWwgb2YgdXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIHRva2VuIHRoYXQgcGVvcGxl IGhhdmUgcmFpc2VkLiBXaXRoIHRoYXQgY29udGV4dCBpbiBtaW5kLCBJIHByb3Bvc2Ugc3RyaWtp bmcgdGhlIGRlZmluaXRpb24gb2YgdGhlIOKAnGV2ZW50c+KAnSBjbGFpbSBmcm9tIHRoZSBTZWN1 cml0eSBFdmVudCBUb2tlbiBzcGVjLCBhbmQgcmVwbGFjaW5nIGl0IHdpdGggdGhlIGZvbGxvd2lu ZyBkZWZpbml0aW9uIGZvciBhbiDigJxldmVudOKAnSBjbGFpbSAoc2luZ3VsYXIpOg0KDQpldmVu dA0KQSBKU09OIG9iamVjdCBjb250YWluaW5nIGFuICJldmVudF90eXBlIiBtZW1iZXIgd2hvc2Ug dmFsdWUgaXMgYSBVUkkgcmVwcmVzZW50aW5nIGEgdHlwZSBvZiBldmVudCBkZWZpbmVkIGluIGEg UHJvZmlsaW5nIFNwZWNpZmljYXRpb24uIFRoZSBvYmplY3QgTUFZIG90aGVyd2lzZSBiZSBlbXB0 eSwgb3IgTUFZIGNvbnRhaW4gYWRkaXRpb25hbCBtZW1iZXJzIGFzIGRlc2NyaWJlZCBieSB0aGUg UHJvZmlsaW5nIFNwZWNpZmljYXRpb24uDQoNCkhlcmUgaXMgdGhlIGV4YW1wbGUgU0VUIGZyb20g c2VjdGlvbiAyLjMsIHJld3JpdHRlbiB3aXRoIHRoaXMgY2hhbmdlIG1pbmQ6DQp7DQogICJqdGki OiAiNGQzNTU5ZWM2NzUwNGFhYmE2NWQ0MGIwMzYzZmFhZDgiLA0KICAiaWF0IjogMTQ1ODQ5NjQw NCwNCiAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbTxodHRwczovL3NjaW0uZXhhbXBs ZS5jb20vPiIsDQogICJhdWQiOiBbDQogICAgImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVk cy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0IiwNCiAgICAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUu Y29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciDQogIF0sDQoNCiAgImV2ZW50Ijog ew0KICAgICJldmVudF90eXBlIjogInVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OmNyZWF0ZSIs DQogICAgInJlZiI6ICJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZi ZDZhYjYxZTc1MjFkOSIsDQogICAgImF0dHJpYnV0ZXMiOiBbImlkIiwgIm5hbWUiLCAidXNlck5h bWUiLCAicGFzc3dvcmQiLCAiZW1haWxzIl0NCiAgfQ0KfQ0KDQpEb2VzIGFueW9uZSBpbiB0aGUg d29ya2luZyBncm91cCBoYXZlIHVzZSBjYXNlcyBmb3IgU0VUcyB0aGF0IGNhbm5vdCBiZSBtZXQg YnkgdGhpcyBwcm9wb3NlZCB0ZXh0PyBXaXRoaW4gUklTQywgd2UgaWRlbnRpZmllZCB0aHJlZSB1 c2UgY2FzZXMsIHdpdGggc29sdXRpb25zIG91dGxpbmVkIGJlbG93Og0KDQpFeHRlbnNpb25zDQpF dmVudCBleHRlbnNpb24gbWVjaGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0aGUg ZXZlbnQgb2JqZWN0LiBBIHNpbXBsZSBhcHByb2FjaCB3b3VsZCBiZSB0byAgZGVmaW5lIGFuIOKA nGV4dGVuc2lvbnPigJ0gbWVtYmVyIHRoYXQgaXMgYSBsaXN0IG9mIGV2ZW50IG9iamVjdHMgKG9y IHNldCByZXNlbWJsaW5nIHRoZSDigJxldmVudHPigJ0gY2xhaW0gYXMgZGVmaW5lZCBpbiB0aGUg Y3VycmVudCBzcGVjKS4gVGhpcyBoYXMgdGhlIGFkdmFudGFnZSBvZiBtYWtpbmcgaXQgY2xlYXIg aW4gdGhlIGRhdGEgc3RydWN0dXJlIHRoYXQgdGhlcmUgaXMgYSBzaW5nbGUgcHJpbWFyeSBldmVu dCwgd2l0aCB6ZXJvIG9yIG1vcmUgZXh0ZW5zaW9ucy4gVGhlcmUgaXMgbm8gcm9vbSBmb3IgY29u ZnVzaW9uIG92ZXIgd2hpY2ggZXZlbnQgaXMgcHJpbWFyeSwgb3IgaWYgdGhlcmUgaXMgYSBwcmlt YXJ5IGV2ZW50IGF0IGFsbC4gSSB3b3VsZCBiZSBmaW5lIHdpdGggYWRkaW5nIHNvbWV0aGluZyBs aWtlIHRoaXMgdG8gbXkgcHJvcG9zZWQgdGV4dCwgaWYgdGhlcmUgaXMgY29uc2Vuc3VzIHRoYXQg aXQgaXMgYnJvYWRseSB1c2VmdWwuDQoNCkFsaWFzZXMNClRoaXMgdXNlIGNhc2Ugd2FzIGJyb3Vn aHQgdXAgaW4gdGhlIGNvbnRleHQgb2YgbWlncmF0aW5nIGNsaWVudHMgZnJvbSBkcmFmdCBldmVu dCBuYW1lcyB0byBzdGFuZGFyZGl6ZWQgZXZlbnQgbmFtZXMuIEluIHRoaXMgY2FzZSwgdGhlIGV2 ZW50IHRyYW5zbWl0dGVyIGNhbiB0cmFuc21pdCB0d28gdG9rZW5zIGZvciB0aGUgbG9naWNhbCBl dmVudCwgb25lIHVzaW5nIHRoZSBvbGQgbmFtZSBhbmQgYW5vdGhlciB1c2luZyB0aGUgbmV3IG5h bWUuDQoNClJlbGF0ZWQgRXZlbnRzDQpUaGUgU0VUIHNwZWMgZGVmaW5lcyB0aGUgdHhuIGNsYWlt IGFzIGEgbWVhbnMgb2YgY29ycmVsYXRpbmcgaW5kZXBlbmRlbnQgdG9rZW5zIHRoYXQgcmVsYXRl IHRvIHRoZSBzYW1lIGxvZ2ljYWwgZXZlbnQuDQoNCi0tDQpBbm5hYmVsbGUgUmljaGFyZCBCYWNr bWFuDQpBbWF6b24g4oCTIElkZW50aXR5IFNlcnZpY2VzDQoNCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2 ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5f bGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09czVieUJlNUtBTm5HVnVBYjFtQXVwRUdvSm44WEc1SklVVXdXR0ZTaWJFYyZzPVg4 b1JTcTNJemxGN2ppUkFlWmhYcFIzZVZJMEk1OFpGZDRlRVpmZ3lvSVkmZT0NCg0K --_000_CY4PR21MB050408B26405044A6E1A7861F5470CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2 aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5 OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBs eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30N Ci5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1h cmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5k aWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRp dCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48 L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVl IiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+SSBhZ3JlZSB3aXRoIG11Y2gg b2YgUGhpbOKAmXMgcmF0aW9uYWxlIGhlcmUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MDAyMDYwIj5JdOKAmXMgZmluZSBmb3Igc29tZSBwcm9maWxlcyB0byBzYXkgdGhhdCB0aGUg4oCc ZXZlbnRz4oCdIHNldCBtdXN0IGJlIGEgc2luZ2xldG9uLiZuYnNwOyBUaGF0IGRvZXNu4oCZdCBo YXZlIHRvIGJlIHRydWUgZm9yIGFsbCBldmVudHMuJm5ic3A7IEkgdGhpbmsgdGhpbmdzIGFyZSBm aW5lIGFzLWlzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2 ZW50LWJvdW5jZXNAaWV0Zi5vcmddIDxiPg0KT24gQmVoYWxmIE9mIDwvYj5QaGlsIEh1bnQ8YnI+ DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBPY3RvYmVyIDIzLCAyMDE3IDg6NDcgUE08YnI+DQo8Yj5U bzo8L2I+IFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlICZsdDtyaWNoYW5uYUBhbWF6b24uY29t Jmd0Ozxicj4NCjxiPkNjOjwvYj4gSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRA aWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFVzZSBjYXNl cyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Bbm5hYmVsbGUsPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JIGhhdmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHByb3Bv c2FsLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5Qcm9maWxpbmcgSW5kZXBlbmRlbmNlIC8gS2VlcGluZyBFdmVudCBQYXlsb2FkcyBJbmRlcGVu ZGVudDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5JbmRpY2F0aW5nIHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFuZGxlZCBieSBwcm9maWxl cyBsZWFkcyB0byBtb3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBhbmQgbW9yZSBpbXBvcnRh bnRseSBpbnRydWRlcyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBieSBzdWdnZXN0aW5nIGEg c3ViLXNjaGVtYSBjcmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBhbmQgY29uZmxpY3RzIHRo YXQgbWF5IGFkZA0KIHRvIGNvbXBsZXhpdHkgbGF0ZXIgb24uIFRoZSBjdXJyZW50IGZvcm1hdCBh bGxvd3MgYSBwYXJzZXIgdG8gZGlzY292ZXIgYW5kIHVubG9hZCBvbmUgb3IgbW9yZSBKU09OIHBh eWxvYWRzIHdoaWNoIGNhbiBlYWNoIGhhdmUgaW5kZXBlbmRlbnQgc3RydWN0dXJlLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5HZW5lcmFsIGV4 dGVuc2lvbnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhlIHByb3Bvc2FsIGFsc28gcnVsZXMgb3V0IGdlbmVyYWwgcHVycG9zZSBleHRlbnNp b25zIG5vdCByZWxhdGVkIHRvIGFueSBzcGVjaWZpYyBldmVudC4gR2l2ZW4gdGhlIGVtZXJnZW5j ZSBvZiBpdGVtcyBsaWtlIEdQUkQsIEkgd291bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhlIGFiaWxp dHkgdG8gYWRkIG1ldGEtZGF0YSBvciBvdGhlciBnZW5lcmFsIHB1cnBvc2UgaXRlbXMuIFdlIGNh biBhbHNvIGFudGljaXBhdGUNCiBzb21lIGRlbGl2ZXJ5IHNjZW5hcmlvcyB3aGVyZSBhZGRpdGlv bmFsIGRhdGEgbWlnaHQgYmUgcmVxdWlyZWQuIEV2ZW4gdGhvdWdoIHRoZXJlIGlzIG5vIGN1cnJl bnQgcGxhbm5lZCB1c2UsIEkgc2VlIG5vIGdvb2QgcmVhc29uIHRvIHJ1bGUgdGhpcyBvdXQuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk11bHRp cGxlIEV2ZW50cyBGcm9tIERpZmZlcmVudCBGYW1pbGllcyAodnMuIE11bHRpcGxlIEV2ZW50cyBm cm9tIGEgc2luZ2xlIGZhbWlseSBsaWtlIFJJU0MpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIG91ciBSSVNDIHNlc3Npb24gd2UgZGlzY3Vz c2VkIGV4cHJlc3NpbmcgbXVsdGlwbGUgZGlzdGluY3QgUklTQyBldmVudHMgaW4gb25lIFNFVC4g VGhlIGRpc2N1c3Npb24gd2FzIHRoYXQgb25seSBvbmUgUklTQyBldmVudCBhdCBhIHRpbWUuIFdl IGRpZCBub3QgZGlzY3VzcyBvdGhlciBldmVudCBwcm9maWxlcy4gSSBkb27igJl0IHNlZSBhIHJl YXNvbiB0byBydWxlIG91dCBtdWx0aS1ldmVudHMgZnJvbSBkaWZmZXJlbnQNCiBmYW1pbGllcyBh dCB0aGUgU0VUIGxldmVsLiBFYWNoIHByb2ZpbGUgaXMgZXhwcmVzc2luZyBzbGlnaHRseSBkaWZm ZXJlbnQgdGhpbmdzIGFib3V0IHRoZSBzYW1lIGV2ZW50LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGNhbiBmb3JzZWUgc29tZSBj YXNlcyB3aGVyZSBpdCBpcyBub3QgY2xlYXIgd2hpY2ggaXMgdGhlIHByaW1hcnkgYW5kIHdoaWNo IGlzIHRoZSBleHRlbnNpb24uICZuYnNwO1RoZXJlIG1heSBub3QgYmUgYSBjbGVhciB3aW5uZXIu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkEg Y291cGxlIG9mIGV4YW1wbGVzICh0aGVzZSBhcmUgbmVjZXNzYXJpbHkgcmVhbOKApmp1c3QgcG9z c2liaWxpdGllcyk6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4qIEl0IGlzIHByb2JhYmx5IHVzZWZ1bCB0byBiZSBhYmxlIHRvIGV4cHJlc3Mgc2lt bGFyL292ZXJsYXBwaW5nIGV2ZW50cyBmcm9tIGRpZmZlcmVudCBTRVQgcHJvZmlsZXMgaW4gb25l IFNFVC4gJm5ic3A7Rm9yIGV4YW1wbGUgYSBCYWNrY2hhbm5lbCBMb2dvdXQgJmFtcDsgYSBSSVND IHNlc3Npb24gY2FuY2VsIGV2ZW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+KiBTQ0lNIG1heSB3YW50IHRvIHJlcHJlc2VudCBhIHNpbmdsZSB0 cmFuc2FjdGlvbiBhcyBjYXVzaW5nIG11bHRpcGxlIHN0YXRlIGNoYW5nZXMgaW4gYW4gZXZlbnQg KGUuZy4gYSBwYXNzd29yZCBjaGFuZ2UgY2F1c2VzIG11bHRpcGxlIGVmZmVjdHMpLiBIYXZpbmcg dG8gY2hhc2UgZG93biBtdWx0aXBsZSBldmVudHMgYW5kIGNvcnJlbGF0ZSBieSDigJx0eG7igJ0g d291bGQgYmUgY2hhbGxlbmdpbmcgaW4gYSBtdWx0aS10aHJlYWRlZC9tdWx0aS1ub2RlDQogZGVs aXZlcnkgc3lzdGVtLiAmbmJzcDtUaGUgU0NJTSBsaXN0IGhhcyBub3QgZGlzY3Vzc2VkIHRoaXMs IGJ1dCBJIHdvdWxkIG5vdCB3YW50IHRvIGJsb2NrIHRoaXMgY2FwYWJpbGl0eS4gJm5ic3A7SU9X IC0gSnVzdCBiZWNhdXNlIFJJU0MgZG9lcyBub3Qgd2FudCB0byBleHByZXNzIG11bHRpcGxlIGV2 ZW50cyBkb2VzIG5vdCBtYWtlIHRoaXMgdHJ1ZSBmb3Igb3RoZXIgcHJvZmlsZXMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qIFdlIG1heSB3aXNo IHRvIGluZGljYXRlIGEgU0NJTSBQYXNzd29yZCBSZXNldCB3YXMgcGVyZm9ybWVkIGFuZCBhIExv Z291dC9zZXNzaW9uIGNhbmNlbGxhdGlvbiBpcyBleHByZXNzZWQgYXQgdGhlIHNhbWUgdGltZS4g Jm5ic3A7VGhlIGV2ZW50cyBhcmUgcmVsYXRlZCBidXQgZXhwcmVzcyBkaWZmZXJlbnQgZGF0YS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXZv aWRpbmcgQ29uZnVzaW9uIEZyb20gU2ltaWxhciBFdmVudHMgT3JpZ2luYXRpbmcgZnJvbSB0aGUg U2FtZSBUcmFuc2FjdGlvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JZiBldmVudHMgYXJlIHNlbnQgc2VwYXJhdGVseSwgdGhlbiBtb3JlIHRy YWNraW5nIG9mIHN0YXRlIChlLmcuIGJ5IHR4bikgd291bGQgYmUgcmVxdWlyZWQgdG8gZW5zdXJl IHNpbWlsYXIgZXZlbnRzIGFyZSBub3QgbWlzdGFrZW4gb3IgaGFuZGxlZCBhcyByZXBlYXRzLiBX aGlsZSB0eG4gcHJvdmlkZXMgdXNlZnVsIGF1ZGl0IGFuYWx5c2lzIGNhcGFiaWxpdHksIEnigJlt IG5vdCBzdXJlIGl0IGNhbiBiZSB1c2VkDQogaW4gbGl2ZSBvciBuZWFyLXJlYWwgdGltZSBzeXN0 ZW1zIGdpdmVuIGRpc3RyaWJ1dGVkIG11bHRpLW5vZGUsIG11bHRpLXRocmVhZGluZyBhcmNoaXRl Y3R1cmVzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+UHJldmlvdXMgRGlzY3Vzc2lvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIG5vdGUgdGhhdCBJIG9yaWdpbmFsbHkgcmFp c2VkIGhhdmluZyBhbiBhdHRyaWJ1dGUgdG8gZGVzaWduYXRlIHByaW1hcnkgZXZlbnQgYXR0cmli dXRlIHRvIGFsbGV2aWF0ZSB5b3VyIGNvbmNlcm4sIGJ1dCB0aGlzIHdhcyBub3QgYWNjZXB0ZWQu IFNlZTombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiogPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbC1hcmNoaXZlL3dlYi9p ZC1ldmVudC9jdXJyZW50L21zZzAwNDA2Lmh0bWwiPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bC1hcmNoaXZlL3dlYi9pZC1ldmVudC9jdXJyZW50L21zZzAwNDA2Lmh0bWw8L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4qJm5ic3A7PGEgaHJl Zj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbC1hcmNoaXZlL3dlYi9pZC1ldmVudC9jdXJyZW50 L21zZzAwMTQwLmh0bWwiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvaWQt ZXZlbnQvY3VycmVudC9tc2cwMDE0MC5odG1sPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgY29uc2Vuc3VzLCBhdCBsZWFzdCBhcyBJ IGludGVycHJldGVkIGl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBmaWd1cmUgdGhpcyBvdXQg YmFzZWQgb24gdGhlIGRlZmluaXRpb25zIGl0IGhhcyBmb3IgZWFjaCBldmVudCBVUkkgYW5kIHRo ZSBwcm9maWxlcyB0aGV5IHJlcHJlc2VudC4gSU9XIC0gUklTQyBpcyBmcmVlIHRvIGxpbWl0IHRo YXQgb25seSBvbmUgUklTQyBldmVudCBiZSBleHByZXNzZWQgYXQNCiBhIHRpbWUuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Q aGlsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OmJsYWNrIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hp dGVjdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50aWQ8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20i Pnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5waGls Lmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIE9jdCAyMywgMjAxNywgYXQgNzowMiBQTSwgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUg Jmx0OzxhIGhyZWY9Im1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tIj5yaWNoYW5uYUBhbWF6b24u Y29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+VGhlIGN1cnJlbnQgZHJhZnQgb2YgdGhl IFNFVCBzcGVjIGFsbG93cyBmb3IgZXhwcmVzc2luZyBtdWx0aXBsZSBldmVudHMgd2l0aGluIHRo ZSBzYW1lIHRva2VuLCB3aGljaCBpbnRyb2R1Y2VzIGFkZGl0aW9uYWwgY29tcGxleGl0eSBhbmQg cm9vbSBmb3IgYW1iaWd1b3VzIHNlbWFudGljcy4gV2XigJl2ZSBkaXNjdXNzZWQgdGhpcyBpbiB0 aGUgT0lERiBSSVNDIHdvcmtpbmcNCiBncm91cCBhbmQgdGhlIGN1cnJlbnQgY29uc2Vuc3VzIHRo ZXJlIGlzIHRoYXQgUklTQyB3aWxsIHJlcXVpcmUgdGhhdCBSSVNDIGV2ZW50cyBtdXN0IGJlIHRo ZSBvbmx5IGV2ZW50IGluIHRoZSBTRVQsIGhhdmluZyBpZGVudGlmaWVkIHdheXMgdG8gY2xlYXJs eSBhbmQgZWFzaWx5IHN1cHBvcnQgdGhlIGhhbmRmdWwgb2YgdXNlIGNhc2VzIGZvciBtdWx0aXBs ZSBldmVudHMgcGVyIHRva2VuIHRoYXQgcGVvcGxlIGhhdmUgcmFpc2VkLiBXaXRoIHRoYXQNCiBj b250ZXh0IGluIG1pbmQsIEkgcHJvcG9zZSBzdHJpa2luZyB0aGUgZGVmaW5pdGlvbiBvZiB0aGUg 4oCcZXZlbnRz4oCdIGNsYWltIGZyb20gdGhlIFNlY3VyaXR5IEV2ZW50IFRva2VuIHNwZWMsIGFu ZCByZXBsYWNpbmcgaXQgd2l0aCB0aGUgZm9sbG93aW5nIGRlZmluaXRpb24gZm9yIGFuIOKAnGV2 ZW504oCdIGNsYWltIChzaW5ndWxhcik6PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPmV2ZW50 PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPkEgSlNPTiBvYmplY3QgY29udGFpbmluZyBhbiAm cXVvdDtldmVudF90eXBlJnF1b3Q7IG1lbWJlciB3aG9zZSB2YWx1ZSBpcyBhIFVSSSByZXByZXNl bnRpbmcgYSB0eXBlIG9mIGV2ZW50IGRlZmluZWQgaW4gYSBQcm9maWxpbmcgU3BlY2lmaWNhdGlv bi4gVGhlIG9iamVjdCBNQVkgb3RoZXJ3aXNlIGJlIGVtcHR5LA0KIG9yIE1BWSBjb250YWluIGFk ZGl0aW9uYWwgbWVtYmVycyBhcyBkZXNjcmliZWQgYnkgdGhlIFByb2ZpbGluZyBTcGVjaWZpY2F0 aW9uLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tn cm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+SGVyZSBpcyB0aGUgZXhhbXBsZSBTRVQgZnJvbSBzZWN0aW9u IDIuMywgcmV3cml0dGVuIHdpdGggdGhpcyBjaGFuZ2UgbWluZDo8c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi Pns8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVv dDs0ZDM1NTllYzY3NTA0YWFiYTY1ZDQwYjAzNjNmYWFkOCZxdW90Oyw8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2NDA0LDwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPiZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly9zY2ltLmV4YW1wbGUuY29tLyI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBz Oi8vc2NpbS5leGFtcGxlLmNvbTwvc3Bhbj48L2E+JnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPiZuYnNwOyAmcXVvdDthdWQmcXVvdDs6IFs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3Vu ZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij4mbmJzcDsgJm5ic3A7Jm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUu Y29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiPjxzcGFuIHN0eWxlPSJjb2xvcjoj OTU0RjcyIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1 OTNiNzc1NDwvc3Bhbj48L2E+JnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNw OyAmbmJzcDsmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVl ZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5NTRGNzIi Pmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3 PC9zcGFuPjwvYT4mcXVvdDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgXSw8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6IHs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0 ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnRfdHlwZSZxdW90OzogJnF1b3Q7dXJuOmlldGY6cGFy YW1zOnNjaW06ZXZlbnQ6Y3JlYXRlJnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtyZWYmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5Ij48c3BhbiBz dHlsZT0iY29sb3I6Izk1NEY3MiI+aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYx NDJkZjk2YmQ2YWI2MWU3NTIxZDk8L3NwYW4+PC9hPiZxdW90Oyw8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXR0cmlidXRlcyZxdW90OzogWyZxdW90 O2lkJnF1b3Q7LCAmcXVvdDtuYW1lJnF1b3Q7LCAmcXVvdDt1c2VyTmFtZSZxdW90OywgJnF1b3Q7 cGFzc3dvcmQmcXVvdDssICZxdW90O2VtYWlscyZxdW90O108L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dy b3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij4mbmJzcDsgfTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPn08L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOzwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PkRvZXMgYW55b25lIGluIHRoZSB3b3JraW5nIGdyb3VwIGhhdmUgdXNlIGNhc2VzIGZvciBTRVRz IHRoYXQgY2Fubm90IGJlIG1ldCBieSB0aGlzIHByb3Bvc2VkIHRleHQ/IFdpdGhpbiBSSVNDLCB3 ZSBpZGVudGlmaWVkIHRocmVlIHVzZSBjYXNlcywgd2l0aCBzb2x1dGlvbnMgb3V0bGluZWQgYmVs b3c6PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48Yj4mbmJzcDs8L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48Yj5FeHRlbnNpb25zPC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+RXZlbnQgZXh0ZW5zaW9uIG1l Y2hhbmlzbXMgY2FuIGJlIGRlZmluZWQgaW50ZXJuYWwgdG8gdGhlIGV2ZW50IG9iamVjdC4gQSBz aW1wbGUgYXBwcm9hY2ggd291bGQgYmUgdG8gJm5ic3A7ZGVmaW5lIGFuIOKAnGV4dGVuc2lvbnPi gJ0gbWVtYmVyIHRoYXQgaXMgYSBsaXN0IG9mIGV2ZW50IG9iamVjdHMgKG9yIHNldCByZXNlbWJs aW5nIHRoZSDigJxldmVudHPigJ0gY2xhaW0gYXMgZGVmaW5lZA0KIGluIHRoZSBjdXJyZW50IHNw ZWMpLiBUaGlzIGhhcyB0aGUgYWR2YW50YWdlIG9mIG1ha2luZyBpdCBjbGVhciBpbiB0aGUgZGF0 YSBzdHJ1Y3R1cmUgdGhhdCB0aGVyZSBpcyBhIHNpbmdsZSBwcmltYXJ5IGV2ZW50LCB3aXRoIHpl cm8gb3IgbW9yZSBleHRlbnNpb25zLiBUaGVyZSBpcyBubyByb29tIGZvciBjb25mdXNpb24gb3Zl ciB3aGljaCBldmVudCBpcyBwcmltYXJ5LCBvciBpZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQg YXQgYWxsLiBJIHdvdWxkDQogYmUgZmluZSB3aXRoIGFkZGluZyBzb21ldGhpbmcgbGlrZSB0aGlz IHRvIG15IHByb3Bvc2VkIHRleHQsIGlmIHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJy b2FkbHkgdXNlZnVsLjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48Yj5BbGlhc2VzPC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+VGhpcyB1c2UgY2FzZSB3YXMg YnJvdWdodCB1cCBpbiB0aGUgY29udGV4dCBvZiBtaWdyYXRpbmcgY2xpZW50cyBmcm9tIGRyYWZ0 IGV2ZW50IG5hbWVzIHRvIHN0YW5kYXJkaXplZCBldmVudCBuYW1lcy4gSW4gdGhpcyBjYXNlLCB0 aGUgZXZlbnQgdHJhbnNtaXR0ZXIgY2FuIHRyYW5zbWl0IHR3byB0b2tlbnMgZm9yIHRoZSBsb2dp Y2FsIGV2ZW50LCBvbmUgdXNpbmcgdGhlDQogb2xkIG5hbWUgYW5kIGFub3RoZXIgdXNpbmcgdGhl IG5ldyBuYW1lLjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48Yj5SZWxhdGVkIEV2ZW50czwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPlRoZSBTRVQgc3BlYyBk ZWZpbmVzIHRoZSB0eG4gY2xhaW0gYXMgYSBtZWFucyBvZiBjb3JyZWxhdGluZyBpbmRlcGVuZGVu dCB0b2tlbnMgdGhhdCByZWxhdGUgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7LHNlcmlmIj4tLSZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+ QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW1h em9uIOKAkyBJZGVudGl0eSBTZXJ2aWNlczwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7YmFja2dyb3VuZDp3aGl0ZSI+X19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PGJyPg0KPHNwYW4gc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPklkLWV2ZW50IG1haWxpbmcg bGlzdDwvc3Bhbj48YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3Jn Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5NTRGNzI7YmFja2dyb3VuZDp3aGl0ZSI+SWQtZXZl bnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjwvc3Bhbj48YSBo cmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFt cDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJt NWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1zNWJ5QmU1S0FO bkdWdUFiMW1BdXBFR29KbjhYRzVKSVVVd1dHRlNpYkVjJmFtcDtzPVg4b1JTcTNJemxGN2ppUkFl WmhYcFIzZVZJMEk1OFpGZDRlRVpmZ3lvSVkmYW1wO2U9Ij48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiM5NTRGNzI7YmFja2dyb3VuZDp3aGl0ZSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0y RGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlU cGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENf bExJR2smYW1wO209czVieUJlNUtBTm5HVnVBYjFtQXVwRUdvSm44WEc1SklVVXdXR0ZTaWJFYyZh bXA7cz1YOG9SU3EzSXpsRjdqaVJBZVpoWHBSM2VWSTBJNThaRmQ0ZUVaZmd5b0lZJmFtcDtlPTwv c3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZjtiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB050408B26405044A6E1A7861F5470CY4PR21MB0504namp_-- From nobody Wed Oct 25 11:10:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5D0A13F44E for ; Wed, 25 Oct 2017 11:10:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.231 X-Spam-Level: X-Spam-Status: No, score=-2.231 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cgBzi8dli1pr for ; Wed, 25 Oct 2017 11:10:10 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FF9D13F447 for ; Wed, 25 Oct 2017 11:09:59 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9PI9ttl032185 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 18:09:56 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9PI9tZ4003393 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 18:09:55 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9PI9sos019187; Wed, 25 Oct 2017 18:09:54 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 25 Oct 2017 11:09:54 -0700 From: Phil Hunt Message-Id: <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_ADC21C7D-6386-4A77-B796-609337F55DE9" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 25 Oct 2017 11:09:52 -0700 In-Reply-To: Cc: "Richard Backman, Annabelle" , Mike Jones , Brian Campbell , ID Events Mailing List To: Marius Scurtescu References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 18:10:15 -0000 --Apple-Mail=_ADC21C7D-6386-4A77-B796-609337F55DE9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 It is not clear how to revise the document with regards to the = suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D = is not asserted.=20 If I remove this clarification, it seems unclear what the time of the = event is defined as. There seem to be two options: A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of = event, then =E2=80=9Ctoe=E2=80=9D should be a required claim. B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly used = to mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D is only = needed when the time of the event is different (on an exceptional = basis). Some clarification from the group would be appreciated. Should we = proceed with B, or revise the text to A (or some other proposal). Thanks, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 23, 2017, at 6:15 PM, Marius Scurtescu = wrote: >=20 > On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle = > wrote: > Agreed overall. Having reread the proposed text, I suggest striking = the last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2= =80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D = I do not think it is necessary or particularly helpful to standardize = the semantics of a missing time-of-event claim at the SET level. >=20 >=20 > +1 >=20 > =20 >=20 > =20 >=20 > --=20 >=20 > Annabelle Richard Backman >=20 > Amazon =E2=80=93 Identity Services >=20 > =20 >=20 > =20 >=20 > From: Id-event > on behalf of "Phil Hunt (IDM)" = > > Date: Monday, October 23, 2017 at 5:48 PM > To: Mike Jones > > Cc: Brian Campbell >, ID Events Mailing List = > >=20 >=20 > Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >=20 > =20 >=20 > Agreed +1 on Brian's edits.=20 >=20 > Phil >=20 >=20 > On Oct 23, 2017, at 5:05 PM, Mike Jones > wrote: >=20 > Annabelle and I agreed with this proposed change (as correctly = wordsmithed by Brian) during our in-person review =E2=80=93 as also = noted in the reply to Marius=E2=80=99 comments. >=20 > =20 >=20 > Thanks = Phil and all, >=20 > -- = Mike >=20 > =20 >=20 > From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Brian Campbell > Sent: Thursday, September 28, 2017 8:23 AM > To: Phil Hunt > > Cc: ID Events Mailing List > > Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >=20 > =20 >=20 > +1 to SET defining a time of event claim rather than trying to = redefine a standard claim. And who doesn't like a claim named "toe"? >=20 > However, the text there for nbf is still effectively redefining it by = saying it should be ignored, which isn't consistent with the "MUST NOT = be accepted for processing" from RFC 7519. It would be more appropriate = to say that nbf should/must not be included in a SET. Or just not = mention nbf at all. But don't change the meaning. >=20 > Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is = the nbf section. The value of the toe claim is a NumericDate, which is = defined in Sec 2 RFC7519. But toe has no relation to nbf and no reason = to reference nbf.=20 >=20 > =20 >=20 > On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt > wrote: >=20 > During the OpenID RISC Face to Face meeting a question came up = regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and = whether that redefinition was appropriate. >=20 > =20 >=20 > The intention of SETs definition is to allow SET Transmitters to = indicate that an event may have occurred as early as a specified date = =E2=80=94 a date which is different from the issuance date of the SET. = In particular this is useful in cases where the state change is believed = to have occurred earlier than the time of issuance (e.g. because the = incident was discovered through an administrative review or data = analysis to have occurred in the past). >=20 > =20 >=20 > The definition from JWT is: >=20 > 4.1.5 = <>. "nbf" (Not Before) Claim >=20 > =20 > =20 > The "nbf" (not before) claim identifies the time before which the = JWT > MUST NOT be accepted for processing. The processing of the "nbf" > claim requires that the current date/time MUST be after or equal to > the not-before date/time listed in the "nbf" claim. Implementers = MAY > provide for some small leeway, usually no more than a few minutes, = to > account for clock skew. Its value MUST be a number containing a > NumericDate value. Use of this claim is OPTIONAL. > =20 >=20 > =20 >=20 > As defined in SET: >=20 > nbf > Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a > NumericDate. In the context of the SET token it SHALL be > interpreted to mean a date in which the event is believed to = have > occurred (in the past) or will occur in the future. Note: there > MAY be some cases where "nbf" is still smaller than "iat" such = as > when it took an extended time for a SET to be issued (for = example > after some analysis). This claim is OPTIONAL. > =20 >=20 > There is an argument that the redefinition will cause confusion.=20 >=20 > =20 >=20 > The proposal is to register a different claim name such as =E2=80=9Ctoe=E2= =80=9D (time of event). The proposed new >=20 > definition: >=20 > =20 >=20 > toe > Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a > NumericDate. The value is the date and time in which the event = is believed to have > occurred in the past or will occur in the future. This claim is = OPTIONAL. > When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be = assumed to be the value of =E2=80=9Ciat=E2=80=9D. > =20 > nbf > This claim is not used in SET Events. If asserted, the value = SHOULD > be ignored. > =20 >=20 > =20 >=20 > Are there any objections to the proposed change? >=20 > =20 >=20 > Phil >=20 > =20 >=20 > Oracle Corporation, Identity Cloud Services Architect >=20 > @independentid >=20 > www.independentid.com = > phil.hunt@oracle.com > =20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > =20 >=20 >=20 > CONFIDENTIALITY NOTICE: This email may contain confidential and = privileged material for the sole use of the intended recipient(s). Any = review, use, distribution or disclosure by others is strictly = prohibited. If you have received this communication in error, please = notify the sender immediately by e-mail and delete the message and any = file attachments from your computer. Thank you. >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlH= OMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VO= N8&e=3D = > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd= 5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYp= BY&e=3D = --Apple-Mail=_ADC21C7D-6386-4A77-B796-609337F55DE9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 It is not clear how to revise the document with regards to = the suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80= =9D is not asserted. 

If I remove this clarification, it seems unclear what the = time of the event is defined as.  There seem to be two options:

A. If =E2=80=9Ciat=E2=80=9D= can=E2=80=99t be assumed to be the time of event, then =E2=80=9Ctoe=E2=80= =9D should be a required claim.

B. For the majority of use cases, = =E2=80=9Ciat=E2=80=9D is commonly used to mark SET issuance and event = time.  =E2=80=9Ctoe=E2=80=9D is only needed when the time of the = event is different (on an exceptional basis).

Some clarification from the group would = be appreciated.  Should we proceed with B, or revise the text to A = (or some other proposal).

Thanks,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 23, 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Mon, = Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle <richanna@amazon.com> wrote:

Agreed overall. Having reread the proposed text, I = suggest striking the last sentence, =E2=80=9CWhen not asserted, the = value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of = =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is necessary or = particularly helpful to standardize the semantics of a missing = time-of-event claim at the SET level.


+1

 

 

-- 

Annabelle = Richard Backman

Amazon =E2=80=93 Identity Services

 

 

From: Id-event <id-event-bounces@ietf.org> on behalf of "Phil = Hunt (IDM)" <phil.hunt@oracle.com>
Date: Monday, October 23, = 2017 at 5:48 PM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Brian= Campbell <bcampbell@pingidentity.com>, = ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim

 

Agreed +1 on Brian's edits. 

Phil


On Oct 23, 2017, at 5:05 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Annabelle and I agreed with this proposed change (as = correctly wordsmithed by Brian) during our in-person review =E2=80=93 as = also noted in the reply to Marius=E2=80=99 comments.

 

          &nb= sp;            = ;                 &nb= sp;            = ;           Thanks Phil and = all,

          &nb= sp;            = ;                 &nb= sp;            = ;           -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Brian Campbell
Sent: Thursday, September 28, = 2017 8:23 AM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: ID = Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Replacing = "nbf" claim with a new "toe" claim

 

+1 to SET defining a = time of event claim rather than trying to redefine a standard claim. And = who doesn't like a claim named "toe"?

However, the text there for nbf is still effectively redefining = it by saying it should be ignored, which isn't consistent with the "MUST = NOT be accepted for processing" from RFC 7519. It would be more = appropriate to say that nbf should/must not be included in a SET. Or = just not mention nbf at all. But don't change the meaning.

Also = toe would not be "Defined by Section 4.1.5 [RFC7519]", which is the nbf = section. The value of the toe claim is a NumericDate, which is defined = in Sec 2 RFC7519. But toe has no relation to nbf and no reason to = reference nbf. 

 

On Wed, Sep = 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com> = wrote:

During the OpenID RISC Face to Face meeting a = question came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80= =9D and whether that redefinition was appropriate.

 

The intention of SETs definition is to allow SET = Transmitters to indicate that an event may have occurred as early as a = specified date =E2=80=94 a date which is different from the issuance = date of the SET. In particular this is useful in cases where the state = change is believed to have occurred earlier than the time of issuance = (e.g. because the incident was discovered through an administrative = review or data analysis to have occurred in the past).

 

The definition from JWT is:

4.1.5.  "nbf" (Not Before) = Claim

 
 
   The "nbf" (not before) claim identifies the time =
before which the JWT
   MUST NOT be accepted for processing.  The =
processing of the "nbf"
   claim requires that the current date/time MUST =
be after or equal to
   the not-before date/time listed in the "nbf" =
claim.  Implementers MAY
   provide for some small =
leeway, usually no more than a few minutes, to
   account for clock =
skew.  Its value MUST be a number containing a
   NumericDate =
value.  Use of this claim is OPTIONAL.

 

 

As = defined in SET:

   nbf
      =
Defined by Section 4.1.5 [RFC7519], a number whose value =
is a
      NumericDate.  In the =
context of the SET token it SHALL be
      =
interpreted to mean a date in which the event is believed to have
      occurred (in the past) or will =
occur in the future.  Note: there
      MAY =
be some cases where "nbf" is still smaller than "iat" such as
      when it took an extended time =
for a SET to be issued (for example
      =
after some analysis).  This claim is OPTIONAL.

 

There is an argument that the redefinition will = cause confusion. 

 

The = proposal is to register a different claim name such as =E2=80=9Ctoe=E2=80=9D= (time of event). The proposed new

definition:

 

toe
      Defined by Section 4.1.5 [RFC7519], a number whose value =
is a
      NumericDate.  The value =
is the date and time in which the event is believed to have
      occurred in the past or will =
occur in the future. This claim is OPTIONAL.
      When =
not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be =
the value of =E2=80=9Ciat=E2=80=9D.
 
nbf
      This =
claim is not used in SET Events. If asserted, the value SHOULD
      be ignored.

 

 

Are = there any objections to the proposed change?

 

Phil

 

Oracle = Corporation, Identity Cloud Services Architect

@independentid

www.independentid.com

phil.hunt@oracle.com

<= /div>

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 


CONFIDENTIALITY NOTICE: This email = may contain confidential and privileged material for the sole use of the = intended recipient(s). Any review, use, distribution or disclosure by = others is strictly prohibited.  If you have received this = communication in error, please notify the sender immediately by e-mail = and delete the message and any file attachments from your computer. = Thank you.

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_P= XMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D

= --Apple-Mail=_ADC21C7D-6386-4A77-B796-609337F55DE9-- From nobody Wed Oct 25 12:33:29 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A61831386A1 for ; Wed, 25 Oct 2017 12:33:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.02 X-Spam-Level: X-Spam-Status: No, score=-1.02 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=-1, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hgfcwPxFHzol for ; Wed, 25 Oct 2017 12:33:22 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0090.outbound.protection.outlook.com [104.47.41.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D181138103 for ; Wed, 25 Oct 2017 12:33:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=nTz4SrnKKKCWm87E+3yTCkrOKIl4CuEh2D7oCohFKEc=; b=Y8UVfVimZ/IJRBCYY4MXwPbYtK6gNGQAp0tVJx2toBEXnTCx1Cn61nHVFXv/2vMfsO8pFbLd/MYhTABqAIJW0p1IEGcBAHUzrdl7I7XKsDU1DD73IKiKITMsxRDKZkWj4wNw6Y/9zDiYfvjTarJ5Q1ae683PKVLTNVAb5j+PTJk= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0117.namprd21.prod.outlook.com (10.173.189.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Wed, 25 Oct 2017 19:33:20 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.004; Wed, 25 Oct 2017 19:33:20 +0000 From: Mike Jones To: Phil Hunt , Marius Scurtescu CC: "Richard Backman, Annabelle" , Brian Campbell , ID Events Mailing List Thread-Topic: [Id-event] Replacing "nbf" claim with a new "toe" claim Thread-Index: AQHTN9KpAILmSZE0GUKb7XxJ9mLviKLKa5QAgCfaOrCAAA3yAIAABJuAgAADIYCAAq3GAIAAFu8w Date: Wed, 25 Oct 2017 19:33:19 +0000 Message-ID: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> In-Reply-To: <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-10-25T12:33:18.4571942-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General x-originating-ip: [2001:4898:80e8:1::36] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0117; 6:sG2hjEWl01IEQjfSZ3B1DVDYm9X+qsXekRtlYdlRKKs+JkpFiCBi791zhr3RH0zdFTPhx+GlWHOFUVU2OzA2srkk/4HMFqpLFkq04+lS4IpBaOPGuRD/iD8gugk/2zmeP2QGu/M3fAMwh6LIx80olRWrKpDQpwUIlObbi3NgBh2/EHqeTF8CDycPCPbD7sZkbmdVWBR1RoQHV3g88NEvhxFV/0XL/3yJ389NPSQHJUvrw66LvShws/JgKV/OEPhDp8rcpratnMHCkJx8/Q3QjKJr+/zoXkporNgZatIF2T5xT3PXDZeU8qEkjmwnWLIppJtLCUky84ap9bKpGxfs7QhO8U+/Yexxv0wQBbcEP1E=; 5:gR7t0ADkxDCGntPNvH6vd7VjwdHfNbPXuT/CLeiwDfpHhjXV2mQvkmCnkSzsGpYfKIOVvMNPrs23G5Vqg61J2l9fV8EEtxexJNWPLkgHcIAgwbWrDgrffAYPHbQ2loFvOHWoWeCdq3bNI34XHVnA/KV7QPE2T6GC+kgO7I5MuZ0=; 24:jZUAuTthT1I9Fuh8ucFizeLYy10JMiICmBHSOsytsGmkeVISK3XIKYP4BfA3u30GOCEu1yqKXb2p4Y2E+Lq+J4u3MDNbCh54GzFN3J9AL1g=; 7:jHg2qLogcxAwpeJj+2D0CnOzf5HKiyFN8EZr6dJ09Va2IYBiDQXGjjftOUSMUczp/0OO0TrYwgHzAJsKRUeqaCWhbQQTWsxDbihm6fZ0eErYOkTZDHVLrePznISJl/zNVZlq0JozxRKiGlY/CcKVQ4oLaTbAVLJ/Wpb3mClH4DnFBW9TS4x2JzgzgnCwn48/o+fT6BT1It3D91Psb7wrBp5yluhhQXgdTy8eBNSylwEpWLRKA2uqmjR4oaNeK+58 x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: bb8a1936-4ede-4cdf-dea8-08d51bdf3f93 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603238); SRVR:CY4PR21MB0117; x-ms-traffictypediagnostic: CY4PR21MB0117: x-exchange-antispam-report-test: UriScan:(10436049006162)(89211679590171)(33061846794335)(211936372134217)(153496737603132)(21748063052155)(146099531331640)(47284530071512); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(3231020)(10201501046)(100000703101)(100105400095)(920507026)(6055026)(61426038)(61427038)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(20161123555025)(20161123564025)(20161123560025)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0117; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0117; x-forefront-prvs: 0471B73328 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(47760400005)(189002)(199003)(85644002)(36304003)(24454002)(606006)(72206003)(53546010)(7736002)(74316002)(34040400001)(478600001)(8990500004)(561944003)(101416001)(2900100001)(10290500003)(5890100001)(106356001)(110136005)(54906003)(316002)(105586002)(97736004)(33656002)(5660300001)(1680700002)(93886005)(7696004)(81166006)(8676002)(81156014)(8936002)(790700001)(6116002)(2950100002)(3280700002)(2906002)(22452003)(3660700001)(966005)(4326008)(53946003)(102836003)(14454004)(68736007)(6506006)(53936002)(229853002)(6436002)(6246003)(9686003)(6306002)(54896002)(86612001)(189998001)(86362001)(575784001)(99286003)(54356999)(236005)(76176999)(77096006)(53386004)(55016002)(50986999)(19609705001)(25786009)(10090500001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0117; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05047CF8973075C3DB384542F5440CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: bb8a1936-4ede-4cdf-dea8-08d51bdf3f93 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Oct 2017 19:33:19.9574 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0117 Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 19:33:27 -0000 --_000_CY4PR21MB05047CF8973075C3DB384542F5440CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpbmtpbmcgYWJvdXQgdGhpcyBzb21lIG1vcmUsIEnigJltIHByb25lIHRvIGtlZXAgdGhlIGxh c3Qgc2VudGVuY2UsIGF0IGxlYXN0IGZvciB0aGUgbmV4dCBkcmFmdCwgc2luY2UgaXQgYWRkcyBz ZW1hbnRpYyBjbGFyaXR5IGZvciBpbXBsZW1lbnRlcnMgYW5kIHByb2ZpbGVycyB0aGF0IHdvdWxk IG90aGVyd2lzZSBiZSBsYWNraW5nLCB3aGljaCBjYW7igJl0IGhlbHAgaW50ZXJvcC4gIFRoZXni gJlsbCBiZSBtb3JlIGNoYW5jZXMgdG8gZGlzY3VzcyB0aGlzIGluIHRoZSBjb21pbmcgd2Vla3Mu DQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFBoaWwgSHVudCBbbWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tXQ0KU2VudDogV2VkbmVzZGF5LCBPY3RvYmVyIDI1LCAyMDE3IDExOjEwIEFNDQpU bzogTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPg0KQ2M6IFJpY2hhcmQg QmFja21hbiwgQW5uYWJlbGxlIDxyaWNoYW5uYUBhbWF6b24uY29tPjsgTWlrZSBKb25lcyA8TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPjsgQnJpYW4gQ2FtcGJlbGwgPGJjYW1wYmVsbEBwaW5n aWRlbnRpdHkuY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+ DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBSZXBsYWNpbmcgIm5iZiIgY2xhaW0gd2l0aCBhIG5l dyAidG9lIiBjbGFpbQ0KDQpJdCBpcyBub3QgY2xlYXIgaG93IHRvIHJldmlzZSB0aGUgZG9jdW1l bnQgd2l0aCByZWdhcmRzIHRvIHRoZSBzdWdnZXN0aW9uIGFnYWluc3QgdXNpbmcg4oCcaWF04oCd IHdoZW4g4oCcdG9l4oCdIGlzIG5vdCBhc3NlcnRlZC4NCg0KSWYgSSByZW1vdmUgdGhpcyBjbGFy aWZpY2F0aW9uLCBpdCBzZWVtcyB1bmNsZWFyIHdoYXQgdGhlIHRpbWUgb2YgdGhlIGV2ZW50IGlz IGRlZmluZWQgYXMuICBUaGVyZSBzZWVtIHRvIGJlIHR3byBvcHRpb25zOg0KDQpBLiBJZiDigJxp YXTigJ0gY2Fu4oCZdCBiZSBhc3N1bWVkIHRvIGJlIHRoZSB0aW1lIG9mIGV2ZW50LCB0aGVuIOKA nHRvZeKAnSBzaG91bGQgYmUgYSByZXF1aXJlZCBjbGFpbS4NCg0KQi4gRm9yIHRoZSBtYWpvcml0 eSBvZiB1c2UgY2FzZXMsIOKAnGlhdOKAnSBpcyBjb21tb25seSB1c2VkIHRvIG1hcmsgU0VUIGlz c3VhbmNlIGFuZCBldmVudCB0aW1lLiAg4oCcdG9l4oCdIGlzIG9ubHkgbmVlZGVkIHdoZW4gdGhl IHRpbWUgb2YgdGhlIGV2ZW50IGlzIGRpZmZlcmVudCAob24gYW4gZXhjZXB0aW9uYWwgYmFzaXMp Lg0KDQpTb21lIGNsYXJpZmljYXRpb24gZnJvbSB0aGUgZ3JvdXAgd291bGQgYmUgYXBwcmVjaWF0 ZWQuICBTaG91bGQgd2UgcHJvY2VlZCB3aXRoIEIsIG9yIHJldmlzZSB0aGUgdGV4dCB0byBBIChv ciBzb21lIG90aGVyIHByb3Bvc2FsKS4NCg0KVGhhbmtzLA0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jw b3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQpAaW5kZXBlbmRlbnRp ZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpw aGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9j dCAyMywgMjAxNywgYXQgNjoxNSBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29n bGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCg0KT24gTW9uLCBP Y3QgMjMsIDIwMTcgYXQgNjowNCBQTSwgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hh bm5hQGFtYXpvbi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+PiB3cm90ZToNCkFncmVl ZCBvdmVyYWxsLiBIYXZpbmcgcmVyZWFkIHRoZSBwcm9wb3NlZCB0ZXh0LCBJIHN1Z2dlc3Qgc3Ry aWtpbmcgdGhlIGxhc3Qgc2VudGVuY2UsIOKAnFdoZW4gbm90IGFzc2VydGVkLCB0aGUgdmFsdWUg b2Yg4oCcdG9l4oCdIE1BWSBiZSBhc3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0u 4oCdIEkgZG8gbm90IHRoaW5rIGl0IGlzIG5lY2Vzc2FyeSBvciBwYXJ0aWN1bGFybHkgaGVscGZ1 bCB0byBzdGFuZGFyZGl6ZSB0aGUgc2VtYW50aWNzIG9mIGEgbWlzc2luZyB0aW1lLW9mLWV2ZW50 IGNsYWltIGF0IHRoZSBTRVQgbGV2ZWwuDQoNCisxDQoNCg0KDQotLQ0KQW5uYWJlbGxlIFJpY2hh cmQgQmFja21hbg0KQW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2aWNlcw0KDQoNCkZyb206IElkLWV2 ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0bzppZC1ldmVudC1ib3VuY2VzQGll dGYub3JnPj4gb24gYmVoYWxmIG9mICJQaGlsIEh1bnQgKElETSkiIDxwaGlsLmh1bnRAb3JhY2xl LmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+Pg0KRGF0ZTogTW9uZGF5LCBPY3RvYmVy IDIzLCAyMDE3IGF0IDU6NDggUE0NClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpDYzogQnJpYW4g Q2FtcGJlbGwgPGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPG1haWx0bzpiY2FtcGJlbGxAcGlu Z2lkZW50aXR5LmNvbT4+LCBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9y ZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KDQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBS ZXBsYWNpbmcgIm5iZiIgY2xhaW0gd2l0aCBhIG5ldyAidG9lIiBjbGFpbQ0KDQoNCkFncmVlZCAr MSBvbiBCcmlhbidzIGVkaXRzLg0KDQpQaGlsDQoNCk9uIE9jdCAyMywgMjAxNywgYXQgNTowNSBQ TSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCkFubmFiZWxsZSBhbmQgSSBhZ3JlZWQgd2l0 aCB0aGlzIHByb3Bvc2VkIGNoYW5nZSAoYXMgY29ycmVjdGx5IHdvcmRzbWl0aGVkIGJ5IEJyaWFu KSBkdXJpbmcgb3VyIGluLXBlcnNvbiByZXZpZXcg4oCTIGFzIGFsc28gbm90ZWQgaW4gdGhlIHJl cGx5IHRvIE1hcml1c+KAmSBjb21tZW50cy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFRoYW5rcyBQaGlsIGFuZCBhbGws DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5j ZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBCcmlhbiBDYW1wYmVsbA0KU2VudDogVGh1cnNkYXks IFNlcHRlbWJlciAyOCwgMjAxNyA4OjIzIEFNDQpUbzogUGhpbCBIdW50IDxwaGlsLmh1bnRAb3Jh Y2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+Pg0KQ2M6IElEIEV2ZW50cyBNYWls aW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpT dWJqZWN0OiBSZTogW0lkLWV2ZW50XSBSZXBsYWNpbmcgIm5iZiIgY2xhaW0gd2l0aCBhIG5ldyAi dG9lIiBjbGFpbQ0KDQorMSB0byBTRVQgZGVmaW5pbmcgYSB0aW1lIG9mIGV2ZW50IGNsYWltIHJh dGhlciB0aGFuIHRyeWluZyB0byByZWRlZmluZSBhIHN0YW5kYXJkIGNsYWltLiBBbmQgd2hvIGRv ZXNuJ3QgbGlrZSBhIGNsYWltIG5hbWVkICJ0b2UiPw0KSG93ZXZlciwgdGhlIHRleHQgdGhlcmUg Zm9yIG5iZiBpcyBzdGlsbCBlZmZlY3RpdmVseSByZWRlZmluaW5nIGl0IGJ5IHNheWluZyBpdCBz aG91bGQgYmUgaWdub3JlZCwgd2hpY2ggaXNuJ3QgY29uc2lzdGVudCB3aXRoIHRoZSAiTVVTVCBO T1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmciIGZyb20gUkZDIDc1MTkuIEl0IHdvdWxkIGJl IG1vcmUgYXBwcm9wcmlhdGUgdG8gc2F5IHRoYXQgbmJmIHNob3VsZC9tdXN0IG5vdCBiZSBpbmNs dWRlZCBpbiBhIFNFVC4gT3IganVzdCBub3QgbWVudGlvbiBuYmYgYXQgYWxsLiBCdXQgZG9uJ3Qg Y2hhbmdlIHRoZSBtZWFuaW5nLg0KQWxzbyB0b2Ugd291bGQgbm90IGJlICJEZWZpbmVkIGJ5IFNl Y3Rpb24gNC4xLjUgW1JGQzc1MTldIiwgd2hpY2ggaXMgdGhlIG5iZiBzZWN0aW9uLiBUaGUgdmFs dWUgb2YgdGhlIHRvZSBjbGFpbSBpcyBhIE51bWVyaWNEYXRlLCB3aGljaCBpcyBkZWZpbmVkIGlu IFNlYyAyIFJGQzc1MTkuIEJ1dCB0b2UgaGFzIG5vIHJlbGF0aW9uIHRvIG5iZiBhbmQgbm8gcmVh c29uIHRvIHJlZmVyZW5jZSBuYmYuDQoNCk9uIFdlZCwgU2VwIDI3LCAyMDE3IGF0IDI6NTMgUE0s IFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tPj4gd3JvdGU6DQpEdXJpbmcgdGhlIE9wZW5JRCBSSVNDIEZhY2UgdG8gRmFjZSBtZWV0aW5n IGEgcXVlc3Rpb24gY2FtZSB1cCByZWdhcmRpbmcgU0VU4oCZcyByZWRlZmluaXRpb24gb2Yg4oCc bmJm4oCdIGFuZCB3aGV0aGVyIHRoYXQgcmVkZWZpbml0aW9uIHdhcyBhcHByb3ByaWF0ZS4NCg0K VGhlIGludGVudGlvbiBvZiBTRVRzIGRlZmluaXRpb24gaXMgdG8gYWxsb3cgU0VUIFRyYW5zbWl0 dGVycyB0byBpbmRpY2F0ZSB0aGF0IGFuIGV2ZW50IG1heSBoYXZlIG9jY3VycmVkIGFzIGVhcmx5 IGFzIGEgc3BlY2lmaWVkIGRhdGUg4oCUIGEgZGF0ZSB3aGljaCBpcyBkaWZmZXJlbnQgZnJvbSB0 aGUgaXNzdWFuY2UgZGF0ZSBvZiB0aGUgU0VULiBJbiBwYXJ0aWN1bGFyIHRoaXMgaXMgdXNlZnVs IGluIGNhc2VzIHdoZXJlIHRoZSBzdGF0ZSBjaGFuZ2UgaXMgYmVsaWV2ZWQgdG8gaGF2ZSBvY2N1 cnJlZCBlYXJsaWVyIHRoYW4gdGhlIHRpbWUgb2YgaXNzdWFuY2UgKGUuZy4gYmVjYXVzZSB0aGUg aW5jaWRlbnQgd2FzIGRpc2NvdmVyZWQgdGhyb3VnaCBhbiBhZG1pbmlzdHJhdGl2ZSByZXZpZXcg b3IgZGF0YSBhbmFseXNpcyB0byBoYXZlIG9jY3VycmVkIGluIHRoZSBwYXN0KS4NCg0KVGhlIGRl ZmluaXRpb24gZnJvbSBKV1QgaXM6DQo0LjEuNTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzUxOS0yM3Nl Y3Rpb24tMkQ0LjEuNSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRw a0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr Jm09TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPTAwc0VpdWVm d2hXYlhlUmZKa3Rqb3FONlJHT25pSGlRaXB4SFppQ0c2MncmZT0+LiAgIm5iZiIgKE5vdCBCZWZv cmUpIENsYWltDQoNCg0KDQoNCg0KICAgVGhlICJuYmYiIChub3QgYmVmb3JlKSBjbGFpbSBpZGVu dGlmaWVzIHRoZSB0aW1lIGJlZm9yZSB3aGljaCB0aGUgSldUDQoNCiAgIE1VU1QgTk9UIGJlIGFj Y2VwdGVkIGZvciBwcm9jZXNzaW5nLiAgVGhlIHByb2Nlc3Npbmcgb2YgdGhlICJuYmYiDQoNCiAg IGNsYWltIHJlcXVpcmVzIHRoYXQgdGhlIGN1cnJlbnQgZGF0ZS90aW1lIE1VU1QgYmUgYWZ0ZXIg b3IgZXF1YWwgdG8NCg0KICAgdGhlIG5vdC1iZWZvcmUgZGF0ZS90aW1lIGxpc3RlZCBpbiB0aGUg Im5iZiIgY2xhaW0uICBJbXBsZW1lbnRlcnMgTUFZDQoNCiAgIHByb3ZpZGUgZm9yIHNvbWUgc21h bGwgbGVld2F5LCB1c3VhbGx5IG5vIG1vcmUgdGhhbiBhIGZldyBtaW51dGVzLCB0bw0KDQogICBh Y2NvdW50IGZvciBjbG9jayBza2V3LiAgSXRzIHZhbHVlIE1VU1QgYmUgYSBudW1iZXIgY29udGFp bmluZyBhDQoNCiAgIE51bWVyaWNEYXRlIHZhbHVlLiAgVXNlIG9mIHRoaXMgY2xhaW0gaXMgT1BU SU9OQUwuDQoNCg0KQXMgZGVmaW5lZCBpbiBTRVQ6DQoNCiAgIG5iZg0KDQogICAgICBEZWZpbmVk IGJ5IFNlY3Rpb24gNC4xLjUgW1JGQzc1MTldPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2Vj dGlvbi0yRDQuMS41JmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBr S1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9MDBzRWl1ZWZ3 aFdiWGVSZkprdGpvcU42UkdPbmlIaVFpcHhIWmlDRzYydyZlPT4sIGEgbnVtYmVyIHdob3NlIHZh bHVlIGlzIGENCg0KICAgICAgTnVtZXJpY0RhdGUuICBJbiB0aGUgY29udGV4dCBvZiB0aGUgU0VU IHRva2VuIGl0IFNIQUxMIGJlDQoNCiAgICAgIGludGVycHJldGVkIHRvIG1lYW4gYSBkYXRlIGlu IHdoaWNoIHRoZSBldmVudCBpcyBiZWxpZXZlZCB0byBoYXZlDQoNCiAgICAgIG9jY3VycmVkIChp biB0aGUgcGFzdCkgb3Igd2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiAgTm90ZTogdGhlcmUNCg0K ICAgICAgTUFZIGJlIHNvbWUgY2FzZXMgd2hlcmUgIm5iZiIgaXMgc3RpbGwgc21hbGxlciB0aGFu ICJpYXQiIHN1Y2ggYXMNCg0KICAgICAgd2hlbiBpdCB0b29rIGFuIGV4dGVuZGVkIHRpbWUgZm9y IGEgU0VUIHRvIGJlIGlzc3VlZCAoZm9yIGV4YW1wbGUNCg0KICAgICAgYWZ0ZXIgc29tZSBhbmFs eXNpcykuICBUaGlzIGNsYWltIGlzIE9QVElPTkFMLg0KDQpUaGVyZSBpcyBhbiBhcmd1bWVudCB0 aGF0IHRoZSByZWRlZmluaXRpb24gd2lsbCBjYXVzZSBjb25mdXNpb24uDQoNClRoZSBwcm9wb3Nh bCBpcyB0byByZWdpc3RlciBhIGRpZmZlcmVudCBjbGFpbSBuYW1lIHN1Y2ggYXMg4oCcdG9l4oCd ICh0aW1lIG9mIGV2ZW50KS4gVGhlIHByb3Bvc2VkIG5ldw0KZGVmaW5pdGlvbjoNCg0KDQp0b2UN Cg0KICAgICAgRGVmaW5lZCBieSBTZWN0aW9uIDQuMS41IFtSRkM3NTE5XTxodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0 bWxfcmZjNzUxOS0yM3NlY3Rpb24tMkQ0LjEuNSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJm09TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2lj SDYxdyZzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25pSGlRaXB4SFppQ0c2MncmZT0+LCBh IG51bWJlciB3aG9zZSB2YWx1ZSBpcyBhDQoNCiAgICAgIE51bWVyaWNEYXRlLiAgVGhlIHZhbHVl IGlzIHRoZSBkYXRlIGFuZCB0aW1lIGluIHdoaWNoIHRoZSBldmVudCBpcyBiZWxpZXZlZCB0byBo YXZlDQoNCiAgICAgIG9jY3VycmVkIGluIHRoZSBwYXN0IG9yIHdpbGwgb2NjdXIgaW4gdGhlIGZ1 dHVyZS4gVGhpcyBjbGFpbSBpcyBPUFRJT05BTC4NCg0KICAgICAgV2hlbiBub3QgYXNzZXJ0ZWQs IHRoZSB2YWx1ZSBvZiDigJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhlIHZhbHVlIG9m IOKAnGlhdOKAnS4NCg0KDQoNCm5iZg0KDQogICAgICBUaGlzIGNsYWltIGlzIG5vdCB1c2VkIGlu IFNFVCBFdmVudHMuIElmIGFzc2VydGVkLCB0aGUgdmFsdWUgU0hPVUxEDQoNCiAgICAgIGJlIGln bm9yZWQuDQoNCg0KQXJlIHRoZXJlIGFueSBvYmplY3Rpb25zIHRvIHRoZSBwcm9wb3NlZCBjaGFu Z2U/DQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNl cyBBcmNoaXRlY3QNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVu ZGVudGlkLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09 TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPTFfWjdPdkF5YXhs ZXNDZExOQzVxc2E1WGo5UFpRLUxNYkNhX2htVG8yZU0mZT0+DQpwaGlsLmh1bnRAb3JhY2xlLmNv bTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCg0KX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZl bnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lk LTJEZXZlbnQmZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPU5r RG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmcz04QW9vRFdZMUZ3VEcz QmoyRUxXcXBUN1hBYVVZQVVUeGc3OGtkYjBWT044JmU9Pg0KDQoNCkNPTkZJREVOVElBTElUWSBO T1RJQ0U6IFRoaXMgZW1haWwgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIGFuZCBwcml2aWxlZ2Vk IG1hdGVyaWFsIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4g QW55IHJldmlldywgdXNlLCBkaXN0cmlidXRpb24gb3IgZGlzY2xvc3VyZSBieSBvdGhlcnMgaXMg c3RyaWN0bHkgcHJvaGliaXRlZC4gIElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNh dGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGJ5IGUt bWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkgZmlsZSBhdHRhY2htZW50cyBmcm9t IHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYu b3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9f aWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09 TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPThBb29EV1kxRndU RzNCajJFTFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZPTjgmZT0NCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQt ZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZv X2lkLTJEZXZlbnQmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZt PVhGYjg1dnVEazBoM1lnZDVxbHg0aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mcz0tekpMTnNfR19Q WE1idHV5QUFvNUtTbnFaYXU0QkhmNy1KRmZlN21ZcEJZJmU9Pg0KDQpfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJ ZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWls bWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBR Y3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xO S2U0Q19sTElHayZtPVhGYjg1dnVEazBoM1lnZDVxbHg0aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0m cz0tekpMTnNfR19QWE1idHV5QUFvNUtTbnFaYXU0QkhmNy1KRmZlN21ZcEJZJmU9DQoNCg== --_000_CY4PR21MB05047CF8973075C3DB384542F5440CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiU2Vnb2UgVUki Ow0KCXBhbm9zZS0xOjIgMTEgNSAyIDQgMiA0IDIgMiAzO30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpoNA0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGluZyA0IENoYXIiOw0KCW1zby1t YXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGlu aw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0 eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1y aWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGlu Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNw YW47fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUt Y29udmVydGVkLXNwYWNlO30NCnNwYW4uSGVhZGluZzRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJI ZWFkaW5nIDQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJbXNvLXN0eWxlLWxpbms6 IkhlYWRpbmcgNCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkgTGlnaHQiLHNhbnMtc2VyaWY7DQoJ Y29sb3I6IzJGNTQ5NjsNCglmb250LXN0eWxlOml0YWxpYzt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0 ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsN Cglmb250LWZhbWlseTpDb25zb2xhczt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29y ZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4N CjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0 aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ VGhpbmtpbmcgYWJvdXQgdGhpcyBzb21lIG1vcmUsIEnigJltIHByb25lIHRvIGtlZXAgdGhlIGxh c3Qgc2VudGVuY2UsIGF0IGxlYXN0IGZvciB0aGUgbmV4dCBkcmFmdCwgc2luY2UgaXQgYWRkcyBz ZW1hbnRpYyBjbGFyaXR5IGZvciBpbXBsZW1lbnRlcnMgYW5kIHByb2ZpbGVycyB0aGF0IHdvdWxk IG90aGVyd2lzZSBiZSBsYWNraW5nLCB3aGljaCBjYW7igJl0IGhlbHANCiBpbnRlcm9wLiZuYnNw OyBUaGV54oCZbGwgYmUgbW9yZSBjaGFuY2VzIHRvIGRpc2N1c3MgdGhpcyBpbiB0aGUgY29taW5n IHdlZWtzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBQaGlsIEh1bnQgW21haWx0bzpwaGlsLmh1 bnRAb3JhY2xlLmNvbV0gPGJyPg0KPGI+U2VudDo8L2I+IFdlZG5lc2RheSwgT2N0b2JlciAyNSwg MjAxNyAxMToxMCBBTTxicj4NCjxiPlRvOjwvYj4gTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7bXNjdXJ0 ZXNjdUBnb29nbGUuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gUmljaGFyZCBCYWNrbWFuLCBBbm5h YmVsbGUgJmx0O3JpY2hhbm5hQGFtYXpvbi5jb20mZ3Q7OyBNaWtlIEpvbmVzICZsdDtNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7OyBCcmlhbiBDYW1wYmVsbCAmbHQ7YmNhbXBiZWxsQHBp bmdpZGVudGl0eS5jb20mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gUmVwbGFjaW5n ICZxdW90O25iZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZxdW90OyBjbGFpbTxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXQgaXMgbm90IGNsZWFyIGhv dyB0byByZXZpc2UgdGhlIGRvY3VtZW50IHdpdGggcmVnYXJkcyB0byB0aGUgc3VnZ2VzdGlvbiBh Z2FpbnN0IHVzaW5nIOKAnGlhdOKAnSB3aGVuIOKAnHRvZeKAnSBpcyBub3QgYXNzZXJ0ZWQuJm5i c3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiBJIHJl bW92ZSB0aGlzIGNsYXJpZmljYXRpb24sIGl0IHNlZW1zIHVuY2xlYXIgd2hhdCB0aGUgdGltZSBv ZiB0aGUgZXZlbnQgaXMgZGVmaW5lZCBhcy4gJm5ic3A7VGhlcmUgc2VlbSB0byBiZSB0d28gb3B0 aW9uczo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkEuIElm IOKAnGlhdOKAnSBjYW7igJl0IGJlIGFzc3VtZWQgdG8gYmUgdGhlIHRpbWUgb2YgZXZlbnQsIHRo ZW4g4oCcdG9l4oCdIHNob3VsZCBiZSBhIHJlcXVpcmVkIGNsYWltLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CLiBGb3IgdGhlIG1ham9yaXR5 IG9mIHVzZSBjYXNlcywg4oCcaWF04oCdIGlzIGNvbW1vbmx5IHVzZWQgdG8gbWFyayBTRVQgaXNz dWFuY2UgYW5kIGV2ZW50IHRpbWUuICZuYnNwO+KAnHRvZeKAnSBpcyBvbmx5IG5lZWRlZCB3aGVu IHRoZSB0aW1lIG9mIHRoZSBldmVudCBpcyBkaWZmZXJlbnQgKG9uIGFuIGV4Y2VwdGlvbmFsIGJh c2lzKS48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNvbWUg Y2xhcmlmaWNhdGlvbiBmcm9tIHRoZSBncm91cCB3b3VsZCBiZSBhcHByZWNpYXRlZC4gJm5ic3A7 U2hvdWxkIHdlIHByb2NlZWQgd2l0aCBCLCBvciByZXZpc2UgdGhlIHRleHQgdG8gQSAob3Igc29t ZSBvdGhlciBwcm9wb3NhbCkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5QaGlsPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPk9y YWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbSI+d3d3LmluZGVw ZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJs YWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFj bGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P biBPY3QgMjMsIDIwMTcsIGF0IDY6MTUgUE0sIE1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9 Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIE9jdCAyMywgMjAxNyBhdCA2 OjA0IFBNLCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZTxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5hQGFt YXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj5yaWNoYW5uYUBhbWF6b24uY29tPC9hPiZndDs8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PG86cD48 L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4t bGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5BZ3JlZWQgb3ZlcmFsbC4gSGF2aW5nIHJlcmVh ZCB0aGUgcHJvcG9zZWQgdGV4dCwgSSBzdWdnZXN0IHN0cmlraW5nIHRoZSBsYXN0IHNlbnRlbmNl LCDigJxXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZhbHVlDQogb2Yg4oCcdG9l4oCdIE1BWSBiZSBh c3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0u4oCdIEkgZG8gbm90IHRoaW5rIGl0 IGlzIG5lY2Vzc2FyeSBvciBwYXJ0aWN1bGFybHkgaGVscGZ1bCB0byBzdGFuZGFyZGl6ZSB0aGUg c2VtYW50aWNzIG9mIGEgbWlzc2luZyB0aW1lLW9mLWV2ZW50IGNsYWltIGF0IHRoZSBTRVQgbGV2 ZWwuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj4mIzQzOzE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0 OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj4tLSZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OyxzZXJpZiI+QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBS b21hbiZxdW90OyxzZXJpZiI+QW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2aWNlczwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij5JZC1ldmVudA0KICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9y ZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0OyBvbiBi ZWhhbGYgb2YgJnF1b3Q7UGhpbCBIdW50IChJRE0pJnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNv bTwvYT4mZ3Q7PGJyPg0KPGI+RGF0ZTo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PC9iPk1vbmRheSwgT2N0b2JlciAyMywgMjAxNyBhdCA1OjQ4IFBNPGJy Pg0KPGI+VG86PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PjwvYj5NaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZn dDs8YnI+DQo8Yj5DYzo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PC9iPkJyaWFuIENhbXBiZWxsICZsdDs8YSBocmVmPSJtYWlsdG86YmNhbXBiZWxsQHBp bmdpZGVudGl0eS5jb20iIHRhcmdldD0iX2JsYW5rIj5iY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNv bTwvYT4mZ3Q7LCBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQt ZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7 PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+U3Vi amVjdDo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9i PlJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAmcXVvdDtuYmYmcXVvdDsgY2xhaW0gd2l0aCBhIG5l dyAmcXVvdDt0b2UmcXVvdDsgY2xhaW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+QWdyZWVkICYjNDM7MSBvbiBCcmlhbidzIGVkaXRzLiZuYnNwOzxi cj4NCjxicj4NClBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJv dHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCk9uIE9jdCAyMywgMjAxNywgYXQg NTowNSBQTSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkFubmFi ZWxsZSBhbmQgSSBhZ3JlZWQgd2l0aCB0aGlzIHByb3Bvc2VkIGNoYW5nZSAoYXMgY29ycmVjdGx5 IHdvcmRzbWl0aGVkIGJ5IEJyaWFuKSBkdXJpbmcgb3VyIGluLXBlcnNvbg0KIHJldmlldyDigJMg YXMgYWxzbyBub3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLjwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+VGhhbmtzDQogUGhpbCBhbmQgYWxsLDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPi0tDQogTWlrZTwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SWQtZXZlbnQNCiBbPGEgaHJlZj0ibWFpbHRvOmlkLWV2 ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5tYWlsdG86aWQtZXZlbnQtYm91 bmNlc0BpZXRmLm9yZzwvYT5dPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48L2I+QnJpYW4gQ2FtcGJlbGw8YnI+DQo8Yj5TZW50OjwvYj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VGh1cnNkYXksIFNl cHRlbWJlciAyOCwgMjAxNyA4OjIzIEFNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5QaGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFj bGUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPklEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9 Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYu b3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtJZC1ldmVudF0gUmVwbGFjaW5nICZxdW90O25i ZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZxdW90OyBjbGFpbTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206 MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mIzQzOzEgdG8gU0VUIGRlZmluaW5nIGEgdGltZSBv ZiBldmVudCBjbGFpbSByYXRoZXIgdGhhbiB0cnlpbmcgdG8gcmVkZWZpbmUgYSBzdGFuZGFyZCBj bGFpbS4gQW5kIHdobyBkb2Vzbid0IGxpa2UgYSBjbGFpbQ0KIG5hbWVkICZxdW90O3RvZSZxdW90 Oz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+SG93ZXZlciwgdGhlIHRleHQgdGhlcmUgZm9yIG5iZiBpcyBzdGlsbCBlZmZl Y3RpdmVseSByZWRlZmluaW5nIGl0IGJ5IHNheWluZyBpdCBzaG91bGQgYmUgaWdub3JlZCwgd2hp Y2ggaXNuJ3QgY29uc2lzdGVudA0KIHdpdGggdGhlICZxdW90O01VU1QgTk9UIGJlIGFjY2VwdGVk IGZvciBwcm9jZXNzaW5nJnF1b3Q7IGZyb20gUkZDIDc1MTkuIEl0IHdvdWxkIGJlIG1vcmUgYXBw cm9wcmlhdGUgdG8gc2F5IHRoYXQgbmJmIHNob3VsZC9tdXN0IG5vdCBiZSBpbmNsdWRlZCBpbiBh IFNFVC4gT3IganVzdCBub3QgbWVudGlvbiBuYmYgYXQgYWxsLiBCdXQgZG9uJ3QgY2hhbmdlIHRo ZSBtZWFuaW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5BbHNvIHRvZSB3b3VsZCBub3QgYmUgJnF1b3Q7RGVm aW5lZCBieSBTZWN0aW9uIDQuMS41IFtSRkM3NTE5XSZxdW90Oywgd2hpY2ggaXMgdGhlIG5iZiBz ZWN0aW9uLiBUaGUgdmFsdWUgb2YgdGhlIHRvZSBjbGFpbQ0KIGlzIGEgTnVtZXJpY0RhdGUsIHdo aWNoIGlzIGRlZmluZWQgaW4gU2VjIDIgUkZDNzUxOS4gQnV0IHRvZSBoYXMgbm8gcmVsYXRpb24g dG8gbmJmIGFuZCBubyByZWFzb24gdG8gcmVmZXJlbmNlIG5iZi4mbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIFdlZCwgU2VwIDI3LCAyMDE3IGF0IDI6 NTMgUE0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0Ow0KIHdyb3RlOjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFy Z2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+RHVyaW5nIHRoZSBPcGVuSUQgUklTQyBGYWNlIHRvIEZhY2UgbWVldGluZyBhIHF1ZXN0 aW9uIGNhbWUgdXAgcmVnYXJkaW5nIFNFVOKAmXMgcmVkZWZpbml0aW9uIG9mIOKAnG5iZuKAnSBh bmQgd2hldGhlcg0KIHRoYXQgcmVkZWZpbml0aW9uIHdhcyBhcHByb3ByaWF0ZS48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBpbnRlbnRpb24gb2YgU0VUcyBk ZWZpbml0aW9uIGlzIHRvIGFsbG93IFNFVCBUcmFuc21pdHRlcnMgdG8gaW5kaWNhdGUgdGhhdCBh biBldmVudCBtYXkgaGF2ZSBvY2N1cnJlZCBhcyBlYXJseQ0KIGFzIGEgc3BlY2lmaWVkIGRhdGUg 4oCUIGEgZGF0ZSB3aGljaCBpcyBkaWZmZXJlbnQgZnJvbSB0aGUgaXNzdWFuY2UgZGF0ZSBvZiB0 aGUgU0VULiBJbiBwYXJ0aWN1bGFyIHRoaXMgaXMgdXNlZnVsIGluIGNhc2VzIHdoZXJlIHRoZSBz dGF0ZSBjaGFuZ2UgaXMgYmVsaWV2ZWQgdG8gaGF2ZSBvY2N1cnJlZCBlYXJsaWVyIHRoYW4gdGhl IHRpbWUgb2YgaXNzdWFuY2UgKGUuZy4gYmVjYXVzZSB0aGUgaW5jaWRlbnQgd2FzIGRpc2NvdmVy ZWQgdGhyb3VnaA0KIGFuIGFkbWluaXN0cmF0aXZlIHJldmlldyBvciBkYXRhIGFuYWx5c2lzIHRv IGhhdmUgb2NjdXJyZWQgaW4gdGhlIHBhc3QpLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGUgZGVmaW5pdGlvbiBmcm9tIEpXVCBpczo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8aDQ+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3Jn X2h0bWxfcmZjNzUxOS0yM3NlY3Rpb24tMkQ0LjEuNSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPU5rRG82OVZfRnd5bFJsSE9NQ0Jq VUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmYW1wO3M9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdP bmlIaVFpcHhIWmlDRzYydyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Ozt0ZXh0LWRl Y29yYXRpb246bm9uZSI+NC4xLjU8L3NwYW4+PC9hPjwvc3Bhbj48YSBuYW1lPSJtXy0xMzAyMzQw NTEyMDkxMzAxNDU5X21fNDgxODQ0MDk0OTkwMDk4Ij48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPi4mbmJzcDsNCiAm cXVvdDtuYmYmcXVvdDsgKE5vdCBCZWZvcmUpIENsYWltPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3Nw YW4+PC9oND4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48 L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IFRoZSAmcXVvdDtuYmYmcXVvdDsgKG5vdCBi ZWZvcmUpIGNsYWltIGlkZW50aWZpZXMgdGhlIHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBKV1Q8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgTVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9y IHByb2Nlc3NpbmcuJm5ic3A7IFRoZSBwcm9jZXNzaW5nIG9mIHRoZSAmcXVvdDtuYmYmcXVvdDs8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgY2xhaW0gcmVxdWlyZXMgdGhhdCB0 aGUgY3VycmVudCBkYXRlL3RpbWUgTVVTVCBiZSBhZnRlciBvciBlcXVhbCB0bzxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyB0aGUgbm90LWJlZm9yZSBkYXRlL3RpbWUgbGlzdGVk IGluIHRoZSAmcXVvdDtuYmYmcXVvdDsgY2xhaW0uJm5ic3A7IEltcGxlbWVudGVycyBNQVk8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgcHJvdmlkZSBmb3Igc29tZSBzbWFsbCBs ZWV3YXksIHVzdWFsbHkgbm8gbW9yZSB0aGFuIGEgZmV3IG1pbnV0ZXMsIHRvPG86cD48L286cD48 L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGFjY291bnQgZm9yIGNsb2NrIHNrZXcuJm5ic3A7IEl0 cyB2YWx1ZSBNVVNUIGJlIGEgbnVtYmVyIGNvbnRhaW5pbmcgYTxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyBOdW1lcmljRGF0ZSB2YWx1ZS4mbmJzcDsgVXNlIG9mIHRoaXMgY2xh aW0gaXMgT1BUSU9OQUwuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkFzIGRlZmluZWQgaW4gU0VUOjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7IG5iZjxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBEZWZp bmVkIGJ5IDxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/ dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41 JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm YW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz0w MHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmFtcDtlPSIgdGFyZ2V0 PSJfYmxhbmsiPlNlY3Rpb24mbmJzcDs0LjEuNSBbUkZDNzUxOV08L2E+LCBhIG51bWJlciB3aG9z ZSB2YWx1ZSBpcyBhPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IE51bWVyaWNEYXRlLiZuYnNwOyBJbiB0aGUgY29udGV4dCBvZiB0aGUgU0VUIHRv a2VuIGl0IFNIQUxMIGJlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IGludGVycHJldGVkIHRvIG1lYW4gYSBkYXRlIGluIHdoaWNoIHRoZSBldmVu dCBpcyBiZWxpZXZlZCB0byBoYXZlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IG9jY3VycmVkIChpbiB0aGUgcGFzdCkgb3Igd2lsbCBvY2N1ciBp biB0aGUgZnV0dXJlLiZuYnNwOyBOb3RlOiB0aGVyZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBNQVkgYmUgc29tZSBjYXNlcyB3aGVyZSAmcXVv dDtuYmYmcXVvdDsgaXMgc3RpbGwgc21hbGxlciB0aGFuICZxdW90O2lhdCZxdW90OyBzdWNoIGFz PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHdo ZW4gaXQgdG9vayBhbiBleHRlbmRlZCB0aW1lIGZvciBhIFNFVCB0byBiZSBpc3N1ZWQgKGZvciBl eGFtcGxlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IGFmdGVyIHNvbWUgYW5hbHlzaXMpLiZuYnNwOyBUaGlzIGNsYWltIGlzIE9QVElPTkFMLjxv OnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhlcmUgaXMgYW4g YXJndW1lbnQgdGhhdCB0aGUgcmVkZWZpbml0aW9uIHdpbGwgY2F1c2UgY29uZnVzaW9uLiZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGUg cHJvcG9zYWwgaXMgdG8gcmVnaXN0ZXIgYSBkaWZmZXJlbnQgY2xhaW0gbmFtZSBzdWNoIGFzIOKA nHRvZeKAnSAodGltZSBvZiBldmVudCkuIFRoZSBwcm9wb3NlZCBuZXc8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPmRlZmluaXRpb246PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPnRvZTxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBEZWZpbmVkIGJ5IDxhIGhyZWY9Imh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMu aWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmFtcDtkPUR3TUdhUSZhbXA7 Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3ls UmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz0wMHNFaXVlZndoV2JYZVJmSmt0 am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPlNlY3Rpb24m bmJzcDs0LjEuNSBbUkZDNzUxOV08L2E+LCBhIG51bWJlciB3aG9zZSB2YWx1ZSBpcyBhPG86cD48 L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE51bWVyaWNE YXRlLiZuYnNwOyBUaGUgdmFsdWUgaXMgdGhlIGRhdGUgYW5kIHRpbWUgaW4gd2hpY2ggdGhlIGV2 ZW50IGlzIGJlbGlldmVkIHRvIGhhdmU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgb2NjdXJyZWQgaW4gdGhlIHBhc3Qgb3Igd2lsbCBvY2N1ciBp biB0aGUgZnV0dXJlLiBUaGlzIGNsYWltIGlzIE9QVElPTkFMLjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBXaGVuIG5vdCBhc3NlcnRlZCwgdGhl IHZhbHVlIG9mIOKAnHRvZeKAnSBNQVkgYmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCc aWF04oCdLjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPm5iZjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBUaGlzIGNsYWltIGlzIG5vdCB1c2VkIGluIFNFVCBFdmVudHMuIElmIGFzc2VydGVkLCB0 aGUgdmFsdWUgU0hPVUxEPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IGJlIGlnbm9yZWQuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkFyZSB0aGVyZSBhbnkg b2JqZWN0aW9ucyB0byB0aGUgcHJvcG9zZWQgY2hhbmdlPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5QaGlsPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9yYWNsZSBDb3Jwb3JhdGlv biwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij5AaW5kZXBlbmRlbnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVu dGlkLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJmFtcDttPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcm YW1wO3M9MV9aN092QXlheGxlc0NkTE5DNXFzYTVYajlQWlEtTE1iQ2FfaG1UbzJlTSZhbXA7ZT0i IHRhcmdldD0iX2JsYW5rIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xl LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4wcHQi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0i bWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5v cmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50 JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm YW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz04 QW9vRFdZMUZ3VEczQmoyRUxXcXBUN1hBYVVZQVVUeGc3OGtkYjBWT044JmFtcDtlPSIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8 L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 YnI+DQo8L3NwYW4+PGI+PGk+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojNTU1NTU1O2JvcmRlcjpu b25lIHdpbmRvd3RleHQgMS4wcHQ7cGFkZGluZzowaW4iPkNPTkZJREVOVElBTElUWSBOT1RJQ0U6 IFRoaXMgZW1haWwgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIGFuZCBwcml2aWxlZ2VkIG1hdGVy aWFsIGZvciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4NCiBBbnkg cmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVycyBpcyBzdHJp Y3RseSBwcm9oaWJpdGVkLiZuYnNwOyBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGNvbW11bmlj YXRpb24gaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBieSBl LW1haWwgYW5kIGRlbGV0ZSB0aGUgbWVzc2FnZSBhbmQgYW55IGZpbGUgYXR0YWNobWVudHMgZnJv bSB5b3VyIGNvbXB1dGVyLiBUaGFuayB5b3UuPC9zcGFuPjwvaT48L2I+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBs aXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9s aXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllS OFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVp dnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVD VmdIU2ljSDYxdyZhbXA7cz04QW9vRFdZMUZ3VEczQmoyRUxXcXBUN1hBYVVZQVVUeGc3OGtkYjBW T044JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJmFtcDttPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcm YW1wO3M9OEFvb0RXWTFGd1RHM0JqMkVMV3FwVDdYQWFVWUFVVHhnNzhrZGIwVk9OOCZhbXA7ZT08 L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxp c3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYu b3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVu dCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kw NTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr JmFtcDttPVhGYjg1dnVEazBoM1lnZDVxbHg0aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mYW1wO3M9 LXpKTE5zX0dfUFhNYnR1eUFBbzVLU25xWmF1NEJIZjctSkZmZTdtWXBCWSZhbXA7ZT0iIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50 PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K SWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVu dEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9h PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1YRmI4NXZ1RGswaDNZZ2Q1cWx4NGl1UjdMUjdldlZf QlUwZkxMMDVkWEJNJmFtcDtzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRCSGY3LUpGZmU3 bVlwQlkmYW1wO2U9Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZv X2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xO S2U0Q19sTElHayZhbXA7bT1YRmI4NXZ1RGswaDNZZ2Q1cWx4NGl1UjdMUjdldlZfQlUwZkxMMDVk WEJNJmFtcDtzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRCSGY3LUpGZmU3bVlwQlkmYW1w O2U9PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB05047CF8973075C3DB384542F5440CY4PR21MB0504namp_-- From nobody Wed Oct 25 13:47:17 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A96EC137ED6 for ; Wed, 25 Oct 2017 13:47:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.71 X-Spam-Level: X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vq0RiiX9hqA6 for ; Wed, 25 Oct 2017 13:47:12 -0700 (PDT) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 901151394FB for ; Wed, 25 Oct 2017 13:47:12 -0700 (PDT) Received: by mail-it0-x231.google.com with SMTP id f187so2711440itb.1 for ; Wed, 25 Oct 2017 13:47:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=RtieaDFA3d45b82OXMzwuboiAwEieW+Jp4HKXDr93Kc=; b=uOxOzOs0kDUdahJKRceZX70l3LE/mKETpDSekLbgCl8axUFnQheoKNAvKZ+Odzi1Ga if4HJhuH0Y3j8ZV+HcIVhMaQ0wrKKNzcqvkt4hmZW/O2j8rv+kRcPjUzrxhlLbNflVqL Cr0WZN96tQyk5TH4WeSfqlC6VFNbyfFOeCxH1AeR4kkvEbPGUIY+h6mHursWPxChjq+y TWD+kg2DX0zIfYLyFEkF/UT/0qGpA1ZfWuIyKB8aokzMSOKRxy1Tdc185vPurXSgpKtF lC3rgW0M+jxiTy85GyYR+TFGDvCSSKoip35gVIZ4GwMtLgmNS3B24RUl8HR8IqGc4Wbc kKtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=RtieaDFA3d45b82OXMzwuboiAwEieW+Jp4HKXDr93Kc=; b=XOus/rBgc/49aLtiFazkrbNAWUzJGBJEQ8LgMcFlBMo61liArhfTfzXpvGZZaJ5iSQ Z3oObvbzIR+3biRjI7y78EZ5FwF6XGQCZ2MHnPPjwQNZw86I+2OjyDnTo10lxeNMD9vJ 1wsAFnubp8iD/K0Dn2yVPmzK8+bS8m9ELT8tpRdEDKcrIyLOqGS9NfY/7QEFimTn5jid /R0qRkys++LVfG5msijcFJrhQZmgEy1bshYD+FgK04GTZN6A622E/6r9DjWCI7smBvGn z/HT17vWmBSRKOTbYhRR6UNoRGMbaF+9f0DSgfc93cddybTHl1TPq/D4hZfhUQwQ6Njr 3pEA== X-Gm-Message-State: AMCzsaWE83YdYeWvnTag4nvF9TLrrXUZyS8KqtRoikPxPcki/JuuZdcs Qq0vhbrBcwq0dpTp801vkJ4sej4WOyxG6LgpXOhl0g== X-Google-Smtp-Source: ABhQp+R4/WGLL0dhWBeNnSFtrWwavpcswEP2B3v/yWYR0X3wkR6fS95dBkt71WPh0XgJIXlxRw2jM250DHNt8q3nleI= X-Received: by 10.36.178.85 with SMTP id h21mr4198824iti.118.1508964431221; Wed, 25 Oct 2017 13:47:11 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Wed, 25 Oct 2017 13:46:50 -0700 (PDT) In-Reply-To: <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> From: Marius Scurtescu Date: Wed, 25 Oct 2017 13:46:50 -0700 Message-ID: To: Phil Hunt Cc: "Richard Backman, Annabelle" , Mike Jones , Brian Campbell , ID Events Mailing List Content-Type: multipart/alternative; boundary="f403045d9a14e78ca9055c65281e" Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 20:47:16 -0000 --f403045d9a14e78ca9055c65281e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt wrote: > It is not clear how to revise the document with regards to the suggestion > against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not ass= erted. > > If I remove this clarification, it seems unclear what the time of the > event is defined as. There seem to be two options: > > A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of ev= ent, then =E2=80=9Ctoe=E2=80=9D should be > a required claim. > Why? Why can't the Transmitter assert that an account was disabled and not provide a specific event time? I understand that an event time is desirable, but why required? > > B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly used = to mark SET > issuance and event time. =E2=80=9Ctoe=E2=80=9D is only needed when the t= ime of the event > is different (on an exceptional basis). > If SET issuance and event time are indeed the same then both claims should be present. I don't think iat should imply toe. > > Some clarification from the group would be appreciated. Should we procee= d > with B, or revise the text to A (or some other proposal). > > Thanks, > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > > On Oct 23, 2017, at 6:15 PM, Marius Scurtescu > wrote: > > On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle < > richanna@amazon.com> wrote: > >> Agreed overall. Having reread the proposed text, I suggest striking the >> last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2= =80=9D MAY be assumed to be >> the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is necess= ary or particularly helpful >> to standardize the semantics of a missing time-of-event claim at the SET >> level. >> > > +1 > > > >> >> >> -- >> >> Annabelle Richard Backman >> >> Amazon =E2=80=93 Identity Services >> >> >> >> >> >> *From: *Id-event on behalf of "Phil Hunt >> (IDM)" >> *Date: *Monday, October 23, 2017 at 5:48 PM >> *To: *Mike Jones >> *Cc: *Brian Campbell , ID Events Mailing >> List >> >> *Subject: *Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >> >> >> >> Agreed +1 on Brian's edits. >> >> Phil >> >> >> On Oct 23, 2017, at 5:05 PM, Mike Jones >> wrote: >> >> Annabelle and I agreed with this proposed change (as correctly >> wordsmithed by Brian) during our in-person review =E2=80=93 as also note= d in the >> reply to Marius=E2=80=99 comments. >> >> >> >> Thanks >> Phil and all, >> >> -- Mike >> >> >> >> *From:* Id-event [mailto:id-event-bounces@ietf.org >> ] *On Behalf Of *Brian Campbell >> *Sent:* Thursday, September 28, 2017 8:23 AM >> *To:* Phil Hunt >> *Cc:* ID Events Mailing List >> *Subject:* Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >> >> >> >> +1 to SET defining a time of event claim rather than trying to redefine = a >> standard claim. And who doesn't like a claim named "toe"? >> >> However, the text there for nbf is still effectively redefining it by >> saying it should be ignored, which isn't consistent with the "MUST NOT b= e >> accepted for processing" from RFC 7519. It would be more appropriate to = say >> that nbf should/must not be included in a SET. Or just not mention nbf a= t >> all. But don't change the meaning. >> >> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is the >> nbf section. The value of the toe claim is a NumericDate, which is defin= ed >> in Sec 2 RFC7519. But toe has no relation to nbf and no reason to refere= nce >> nbf. >> >> >> >> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt wrote: >> >> During the OpenID RISC Face to Face meeting a question came up regarding >> SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that red= efinition was appropriate. >> >> >> >> The intention of SETs definition is to allow SET Transmitters to indicat= e >> that an event may have occurred as early as a specified date =E2=80=94 a= date which >> is different from the issuance date of the SET. In particular this is >> useful in cases where the state change is believed to have occurred earl= ier >> than the time of issuance (e.g. because the incident was discovered thro= ugh >> an administrative review or data analysis to have occurred in the past). >> >> >> >> The definition from JWT is: >> 4.1.5 >> . >> "nbf" (Not Before) Claim >> >> >> >> >> >> The "nbf" (not before) claim identifies the time before which the JWT >> >> MUST NOT be accepted for processing. The processing of the "nbf" >> >> claim requires that the current date/time MUST be after or equal to >> >> the not-before date/time listed in the "nbf" claim. Implementers MAY >> >> provide for some small leeway, usually no more than a few minutes, to >> >> account for clock skew. Its value MUST be a number containing a >> >> NumericDate value. Use of this claim is OPTIONAL. >> >> >> >> >> >> As defined in SET: >> >> nbf >> >> Defined by Section 4.1.5 [RFC7519] , a number whose valu= e is a >> >> NumericDate. In the context of the SET token it SHALL be >> >> interpreted to mean a date in which the event is believed to have >> >> occurred (in the past) or will occur in the future. Note: there >> >> MAY be some cases where "nbf" is still smaller than "iat" such as >> >> when it took an extended time for a SET to be issued (for example >> >> after some analysis). This claim is OPTIONAL. >> >> >> >> There is an argument that the redefinition will cause confusion. >> >> >> >> The proposal is to register a different claim name such as =E2=80=9Ctoe= =E2=80=9D (time of >> event). The proposed new >> >> definition: >> >> >> >> toe >> >> Defined by Section 4.1.5 [RFC7519] , a number whose valu= e is a >> >> NumericDate. The value is the date and time in which the event is= believed to have >> >> occurred in the past or will occur in the future. This claim is OP= TIONAL. >> >> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assum= ed to be the value of =E2=80=9Ciat=E2=80=9D. >> >> >> >> nbf >> >> This claim is not used in SET Events. If asserted, the value SHOUL= D >> >> be ignored. >> >> >> >> >> >> Are there any objections to the proposed change? >> >> >> >> Phil >> >> >> >> Oracle Corporation, Identity Cloud Services Architect >> >> @independentid >> >> www.independentid.com >> >> >> phil.hunt@oracle.com >> >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> >> >> *CONFIDENTIALITY NOTICE: This email may contain confidential and >> privileged material for the sole use of the intended recipient(s). Any >> review, use, distribution or disclosure by others is strictly prohibited= . >> If you have received this communication in error, please notify the send= er >> immediately by e-mail and delete the message and any file attachments fr= om >> your computer. Thank you.* >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61 >> w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > XFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_ > PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D > > > --f403045d9a14e78ca9055c65281e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On W= ed, Oct 25, 2017 at 11:09 AM, Phil Hunt <phil.hunt@ora= cle.com> wrote:
It is not clear how to revise the document with r= egards to the suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9C= toe=E2=80=9D is not asserted.=C2=A0

If I remove this cla= rification, it seems unclear what the time of the event is defined as.=C2= =A0 There seem to be two options:

A. If =E2=80=9Ciat=E2= =80=9D can=E2=80=99t be assumed to be the time of event, then =E2=80=9Ctoe= =E2=80=9D should be a required claim.
Why? Why can't the Transmitter assert that an account was = disabled and not provide a specific event time? I understand that an event = time is desirable, but why required?

=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">

B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is = commonly used to mark SET issuance and event time. =C2=A0=E2=80=9Ctoe=E2=80= =9D is only needed when the time of the event is different (on an exception= al basis).

If SET issuanc= e and event time are indeed the same then both claims should be present. I = don't think iat should imply toe.
=C2=A0

Some clarification from the group would be appreciated.=C2=A0 Should= we proceed with B, or revise the text to A (or some other proposal).
=

Thanks,

=
Phil

Oracle Corporation, Identity Cloud Services Architect
@inde= pendentid
phil.hunt@oracle.com
<= /div>

On Oc= t 23, 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com>= wrote:

<= /div>
On Mon, Oct 23, 2017 at 6:04 PM, Richard Back= man, Annabelle= =C2=A0<richanna@amaz= on.com>=C2=A0wrote:

Agreed overa= ll. Having reread the proposed text, I suggest striking the last sentence, = =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assum= ed to be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is = necessary or particularly helpful to standardize the semantics of a missing= time-of-event claim at the SET level.

+1

=C2=A0

=C2=A0

<= div>

--=C2=A0

Annabelle Richard Backman

Amazon =E2=80=93 Identity Services

=C2=A0

= =C2=A0

From:=C2=A0Id-event <id-event-bounces@= ietf.org> on behalf of "Phil Hunt (IDM)" <phil.hunt@oracle.com>
Date:=C2=A0Monday, October 23,= 2017 at 5:48 PM
To:=C2=A0Mike Jones <Michael.Jones@microsoft.com>
Cc:=C2=A0Brian Campbell <bcampbell@pingidentity.com>, ID Events Ma= iling List <id-event@ietf.org>


Subject:=C2=A0Re: [Id-event]= Replacing "nbf" claim with a new "toe" claim=

=C2=A0

Ag= reed +1 on Brian's edits.=C2=A0

Phil


On Oct 23, 2017, a= t 5:05 PM, Mike Jones <Michael.Jones@= microsoft.com> wrote:

Annabelle and I agreed with this proposed change (as co= rrectly wordsmithed by Brian) during our in-person review =E2=80=93 as also= noted in the reply to Marius=E2=80=99 comments.

=C2=A0

=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2= =A0Thanks Phil and all,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- Mike<= /u>

=C2=A0

From:=C2=A0Id-event [mailto:id-event-bounces@ietf.org]=C2=A0On Behalf O= f=C2=A0Brian Campbell
Sent:=C2=A0Thursday, September 28, 2017 8:23 AM
To:= =C2=A0Phil Hunt <phil.hunt@oracle.com>
= Cc:=C2=A0= ID Events Mailing List <id-event@ietf.or= g>
Subject:=C2=A0Re: [Id-event] Replacing "nbf" claim wit= h a new "toe" claim

=C2= =A0

+1 to SET defining a time of event claim rather than trying to= redefine a standard claim. And who doesn't like a claim named "to= e"?

However, the text there for nbf is still effectively redefining it= by saying it should be ignored, which isn't consistent with the "= MUST NOT be accepted for processing" from RFC 7519. It would be more a= ppropriate to say that nbf should/must not be included in a SET. Or just no= t mention nbf at all. But don't change the meaning.

Also toe would not be "Defined by Section 4= .1.5 [RFC7519]", which is the nbf section. The value of the toe claim = is a NumericDate, which is defined in Sec 2 RFC7519. But toe has no relatio= n to nbf and no reason to reference nbf.=C2=A0

=

=C2=A0

= On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt <= phil.hunt@oracle.com> wrote:

During the OpenID RISC Face to Face meeting a question ca= me up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whe= ther that redefinition was appropriate.

=C2=A0

The int= ention of SETs definition is to allow SET Transmitters to indicate that an = event may have occurred as early as a specified date =E2=80=94 a date which= is different from the issuance date of the SET. In particular this is usef= ul in cases where the state change is believed to have occurred earlier tha= n the time of issuance (e.g. because the incident was discovered through an= administrative review or data analysis to have occurred in the past).

=C2=A0

The definition from JWT is:

=

4.1.5.=C2= =A0 "nbf" (Not Before) Claim

=C2=A0=

=C2=A0
=C2=A0=C2=A0 The &q=
uot;nbf" (not before) claim identifies the time before which the JWT
=C2=A0=C2=A0 MUST NOT be accepted for processing.=C2=
=A0 The processing of the "nbf"
=C2=A0=C2=
=A0 claim requires that the current date/time MUST be after or equal to<=
/u>
=C2=A0=C2=A0 the not-before date/time listed in the &q=
uot;nbf" claim.=C2=A0 Implementers MAY
=C2=A0=
=C2=A0 provide for some small leeway, usually no more than a few minutes, t=
o
=C2=A0=C2=A0 account for clock skew.=C2=A0 Its va=
lue MUST be a number containing a
=C2=A0=C2=A0 Nume=
ricDate value.=C2=A0 Use of this claim is OPTIONAL.

=C2=A0

=C2=A0

As= defined in SET:

=C2=A0=C2=A0 nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Section=C2=A04.1.5 [RFC7519], a number whose value is a=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 =
In the context of the SET token it SHALL be
=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 interpreted to mean a date in which the event is b=
elieved to have
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occu=
rred (in the past) or will occur in the future.=C2=A0 Note: there=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 MAY be some cases where "=
;nbf" is still smaller than "iat" such as
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 when it took an extended time for a SE=
T to be issued (for example
=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 after some analysis).=C2=A0 This claim is OPTIONAL.=

=C2=A0
=

There is an argument that the redefinition will caus= e confusion.=C2=A0

=C2= =A0

The proposal is to r= egister a different claim name such as =E2=80=9Ctoe=E2=80=9D (time of event= ). The proposed new

defi= nition:

=C2=A0= 

toe
=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 Defined by Section=C2=A04.1.5 [=
RFC7519], a number whose value is a
=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 The value is the date and time in =
which the event is believed to have
=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 occurred in the past or will occur in the future. This clai=
m is OPTIONAL.
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 When =
not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the v=
alue of =E2=80=9Ciat=E2=80=9D.
=C2=A0=

nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 This =
claim is not used in SET Events. If asserted, the value SHOULD
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 be ignored.
<= div>

=C2=A0

=C2=A0

A= re there any objections to the proposed change?

=C2=A0

<= div>
<= p class=3D"MsoNormal">Phil

=C2=A0

Oracle Corporation, Identity Cloud Services Architect

@independentid=

phil.hunt@oracle.com=

=C2=A0<= u>

<= br>_______________________________________________
Id-event mailing= list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

=C2=A0


CONFIDENTIALITY NOTICE: This email may contain confidential and = privileged material for the sole use of the intended recipient(s). Any revi= ew, use, distribution or disclosure by others is strictly prohibited.=C2=A0= If you have received this communication in error, please notify the sender= immediately by e-mail and delete the message and any file attachments from= your computer. Thank you.


_______________________________________________
Id-eve= nt mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


____________________________________________= ___
Id-event mailing list<= br style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-var= iant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;= text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Id-event@i= etf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3= A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c= =3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5b= iRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5ql= x4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf= 7-JFfe7mYpBY&e=3D<= /div>


= --f403045d9a14e78ca9055c65281e-- From nobody Wed Oct 25 13:56:20 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65D0B137ED6 for ; Wed, 25 Oct 2017 13:56:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.229 X-Spam-Level: X-Spam-Status: No, score=-2.229 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XKIvzfuVxFpZ for ; Wed, 25 Oct 2017 13:56:16 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1CA4137C4A for ; Wed, 25 Oct 2017 13:56:15 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9PKuCZ2003556 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 20:56:13 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9PKuCdx021524 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 20:56:12 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9PKuBKp028723; Wed, 25 Oct 2017 20:56:12 GMT Received: from [10.0.1.19] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 25 Oct 2017 13:56:11 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-B317E2DC-C8C0-417C-B85B-EC48DCA01D1E Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Wed, 25 Oct 2017 13:56:04 -0700 Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> To: Marius Scurtescu X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 20:56:19 -0000 --Apple-Mail-B317E2DC-C8C0-417C-B85B-EC48DCA01D1E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable In some cases, ordering of events against a single subject matters. Time is u= seful for this purpose though limited in the overall stream for ordering eve= nts overall.=20 For example account locked vs unlocked. Knowing what happened last would see= m important no? Phil > On Oct 25, 2017, at 1:46 PM, Marius Scurtescu wrot= e: >=20 >> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt wrote:= >> It is not clear how to revise the document with regards to the suggestion= against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not asser= ted.=20 >>=20 >> If I remove this clarification, it seems unclear what the time of the eve= nt is defined as. There seem to be two options: >>=20 >> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of ev= ent, then =E2=80=9Ctoe=E2=80=9D should be a required claim. >=20 > Why? Why can't the Transmitter assert that an account was disabled and not= provide a specific event time? I understand that an event time is desirable= , but why required? >=20 > =20 >>=20 >> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly used t= o mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D is only needed wh= en the time of the event is different (on an exceptional basis). >=20 > If SET issuance and event time are indeed the same then both claims should= be present. I don't think iat should imply toe. > =20 >>=20 >> Some clarification from the group would be appreciated. Should we procee= d with B, or revise the text to A (or some other proposal). >>=20 >> Thanks, >>=20 >> Phil >>=20 >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu wr= ote: >>>=20 >>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle wrote: >>>> Agreed overall. Having reread the proposed text, I suggest striking the= last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2=80=9D= MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not t= hink it is necessary or particularly helpful to standardize the semantics of= a missing time-of-event claim at the SET level. >>>>=20 >>>=20 >>> +1 >>>=20 >>> =20 >>>> =20 >>>>=20 >>>> --=20 >>>>=20 >>>> Annabelle Richard Backman >>>>=20 >>>> Amazon =E2=80=93 Identity Services >>>>=20 >>>> =20 >>>>=20 >>>> =20 >>>>=20 >>>> From: Id-event on behalf of "Phil Hunt (IDM= )" >>>> Date: Monday, October 23, 2017 at 5:48 PM >>>> To: Mike Jones >>>> Cc: Brian Campbell , ID Events Mailing List= >>>>=20 >>>>=20 >>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>>>=20 >>>> =20 >>>>=20 >>>> Agreed +1 on Brian's edits.=20 >>>>=20 >>>> Phil >>>>=20 >>>>=20 >>>> On Oct 23, 2017, at 5:05 PM, Mike Jones w= rote: >>>>=20 >>>> Annabelle and I agreed with this proposed change (as correctly wordsmit= hed by Brian) during our in-person review =E2=80=93 as also noted in the rep= ly to Marius=E2=80=99 comments. >>>>=20 >>>> =20 >>>>=20 >>>> Thanks P= hil and all, >>>>=20 >>>> -- Mike= >>>>=20 >>>> =20 >>>>=20 >>>> From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Brian Ca= mpbell >>>> Sent: Thursday, September 28, 2017 8:23 AM >>>> To: Phil Hunt >>>> Cc: ID Events Mailing List >>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>>>=20 >>>> =20 >>>>=20 >>>> +1 to SET defining a time of event claim rather than trying to redefine= a standard claim. And who doesn't like a claim named "toe"? >>>>=20 >>>> However, the text there for nbf is still effectively redefining it by s= aying it should be ignored, which isn't consistent with the "MUST NOT be acc= epted for processing" from RFC 7519. It would be more appropriate to say tha= t nbf should/must not be included in a SET. Or just not mention nbf at all. B= ut don't change the meaning. >>>>=20 >>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is th= e nbf section. The value of the toe claim is a NumericDate, which is defined= in Sec 2 RFC7519. But toe has no relation to nbf and no reason to reference= nbf.=20 >>>>=20 >>>> =20 >>>>=20 >>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt wrote= : >>>>=20 >>>> During the OpenID RISC Face to Face meeting a question came up regardin= g SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that redef= inition was appropriate. >>>>=20 >>>> =20 >>>>=20 >>>> The intention of SETs definition is to allow SET Transmitters to indica= te that an event may have occurred as early as a specified date =E2=80=94 a d= ate which is different from the issuance date of the SET. In particular this= is useful in cases where the state change is believed to have occurred earl= ier than the time of issuance (e.g. because the incident was discovered thro= ugh an administrative review or data analysis to have occurred in the past).= >>>>=20 >>>> =20 >>>>=20 >>>> The definition from JWT is: >>>>=20 >>>> 4.1.5. "nbf" (Not Before) Claim >>>>=20 >>>> =20 >>>> =20 >>>> The "nbf" (not before) claim identifies the time before which the JW= T >>>> MUST NOT be accepted for processing. The processing of the "nbf" >>>> claim requires that the current date/time MUST be after or equal to >>>> the not-before date/time listed in the "nbf" claim. Implementers MA= Y >>>> provide for some small leeway, usually no more than a few minutes, t= o >>>> account for clock skew. Its value MUST be a number containing a >>>> NumericDate value. Use of this claim is OPTIONAL. >>>> =20 >>>>=20 >>>> =20 >>>>=20 >>>> As defined in SET: >>>>=20 >>>> nbf >>>> Defined by Section 4.1.5 [RFC7519], a number whose value is a >>>> NumericDate. In the context of the SET token it SHALL be >>>> interpreted to mean a date in which the event is believed to have= >>>> occurred (in the past) or will occur in the future. Note: there >>>> MAY be some cases where "nbf" is still smaller than "iat" such as= >>>> when it took an extended time for a SET to be issued (for example= >>>> after some analysis). This claim is OPTIONAL. >>>> =20 >>>>=20 >>>> There is an argument that the redefinition will cause confusion.=20 >>>>=20 >>>> =20 >>>>=20 >>>> The proposal is to register a different claim name such as =E2=80=9Ctoe= =E2=80=9D (time of event). The proposed new >>>>=20 >>>> definition: >>>>=20 >>>> =20 >>>>=20 >>>> toe >>>> Defined by Section 4.1.5 [RFC7519], a number whose value is a >>>> NumericDate. The value is the date and time in which the event i= s believed to have >>>> occurred in the past or will occur in the future. This claim is O= PTIONAL. >>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assu= med to be the value of =E2=80=9Ciat=E2=80=9D. >>>> =20 >>>> nbf >>>> This claim is not used in SET Events. If asserted, the value SHOU= LD >>>> be ignored. >>>> =20 >>>>=20 >>>> =20 >>>>=20 >>>> Are there any objections to the proposed change? >>>>=20 >>>> =20 >>>>=20 >>>> Phil >>>>=20 >>>> =20 >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>>=20 >>>> @independentid >>>>=20 >>>> www.independentid.com >>>>=20 >>>> phil.hunt@oracle.com >>>>=20 >>>> =20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>>=20 >>>> =20 >>>>=20 >>>>=20 >>>> CONFIDENTIALITY NOTICE: This email may contain confidential and privile= ged material for the sole use of the intended recipient(s). Any review, use,= distribution or disclosure by others is strictly prohibited. If you have r= eceived this communication in error, please notify the sender immediately by= e-mail and delete the message and any file attachments from your computer. T= hank you. >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mai= lman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY0= 57SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHO= MCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&= e=3D >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>>=20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5q= lx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e= =3D >>=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN9T_T= yM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e=3D= =20 --Apple-Mail-B317E2DC-C8C0-417C-B85B-EC48DCA01D1E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
In some cases, ordering of events agai= nst a single subject matters. Time is useful for this purpose though limited= in the overall stream for ordering events overall. 

For example accou= nt locked vs unlocked. Knowing what happened last would seem important no?
Phil

On Oct 25, 2017, at 1:46 PM, Marius Scurtescu <<= a href=3D"mailto:mscurtescu@google.com">mscurtescu@google.com> wrote:=

On Wed, Oct 25, 2017 at 11:09 AM, Ph= il Hunt <phil.hunt@oracle.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #= ccc solid;padding-left:1ex">
It is not cl= ear how to revise the document with regards to the suggestion against using =E2= =80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not asserted. 
If I remove this clarification, it seems unclear what the time o= f the event is defined as.  There seem to be two options:

A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of= event, then =E2=80=9Ctoe=E2=80=9D should be a required claim.

Why? Why can't the Transmitter assert t= hat an account was disabled and not provide a specific event time? I underst= and that an event time is desirable, but why required?

<= div> 

B. For the majority of use cases, =E2=80=9Cia= t=E2=80=9D is commonly used to mark SET issuance and event time.  =E2=80= =9Ctoe=E2=80=9D is only needed when the time of the event is different (on a= n exceptional basis).

If S= ET issuance and event time are indeed the same then both claims should be pr= esent. I don't think iat should imply toe.
 

Some clarification from the group would be appreciated.  Shoul= d we proceed with B, or revise the text to A (or some other proposal).
=

Thanks,

Phil

Oracle Corporation, Ide= ntity Cloud Services Architect
@independentid
phil.hunt@oracle.com

On Oct= 23, 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wr= ote:

On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annab= elle = <richanna@amazon.com= > = wrote:

Agreed overall. Having reread the p= roposed text, I suggest striking the last sentence, =E2=80=9CWhen not assert= ed, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2= =80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is necessary or particularly h= elpful to standardize the semantics of a missing time-of-event claim at the S= ET level.


+1

<= /div>
 

 

-- <= /span>

Annabelle Richard Backman

Amazon =E2=80=93 Identity Services

 

 

From: Id-event <id-event-bounces@ietf= .org> on behalf of "Phil Hunt (IDM)" <p= hil.hunt@oracle.com>
Date: Monday, October 23, 2017 at 5:48 PMTo: Mike Jones <Michael.Jones@microso= ft.com>
Cc: Brian Campbell <= bcampbell@pingidentity.com>, ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Replacing "nbf" claim with a new "= toe" claim

 

Agreed +1 on Brian's edits. 

Phil


On Oct 2= 3, 2017, at 5:05 PM, Mike Jones <Michae= l.Jones@microsoft.com> wrote:

Annabelle and I agreed with this proposed change (= as correctly wordsmithed by Brian) during our in-person review =E2=80=93 as a= lso noted in the reply to Marius=E2=80=99 comments.

=

 

 = ;            &nb= sp;            &= nbsp;           =             &nbs= p;           &nb= sp; T= hanks Phil and all,

        &n= bsp;            =             = ;            &nb= sp;            &= nbsp;     -- Mike

 

<= p class=3D"MsoNormal">From: Id-event [mail= to:id-event-bounces@ietf.org] On Behalf Of Brian Campbell
Sent:<= /b> T= hursday, September 28, 2017 8:23 AM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event]= Replacing "nbf" claim with a new "toe" claim

 

+1 to SET defining a time of event claim rather tha= n trying to redefine a standard claim. And who doesn't like a claim named "t= oe"?

However, the text there for nbf is still effectively redefining it by sa= ying it should be ignored, which isn't consistent with the "MUST NOT be acce= pted for processing" from RFC 7519. It would be more appropriate to say that= nbf should/must not be included in a SET. Or just not mention nbf at all. B= ut don't change the meaning.

A= lso toe would not be "Defined by Section 4.1.5 [RFC7519]", which is the nbf s= ection. The value of the toe claim is a NumericDate, which is defined in Sec= 2 RFC7519. But toe has no relation to nbf and no reason to reference nbf.&n= bsp;

 =

On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt &= lt;phil.hunt@oracle.com> wrote:<= /u>

During the OpenID RISC Face to = Face meeting a question came up regarding SET=E2=80=99s redefinition of =E2=80= =9Cnbf=E2=80=9D and whether that redefinition was appropriate.=

 

The intention of SETs definition is to allow SET Transmitters to= indicate that an event may have occurred as early as a specified date =E2=80= =94 a date which is different from the issuance date of the SET. In particul= ar this is useful in cases where the state change is believed to have occurr= ed earlier than the time of issuance (e.g. because the incident was discover= ed through an administrative review or data analysis to have occurred in the= past).

 <= /u>

The definition from JWT is:<= u>

4.1.5.  "nbf" (Not Bef= ore) Claim

 
&nbs=
p;
   The "nbf" (not before) claim identif=
ies the time before which the JWT
   MUST N=
OT be accepted for processing.  The processing of the "nbf"
   claim requires that the current date/time MUST be a=
fter or equal to
   the not-before date/ti=
me listed in the "nbf" claim.  Implementers MAY
   provide for some small leeway, usually no more than a few minu= tes, to
   account for clock skew.  I=
ts value MUST be a number containing a
   N=
umericDate value.  Use of this claim is OPTIONAL.

 

 

As def= ined in SET:

   nbf=

      Defined by Section 4.1.5 [RFC7519], a number whose value is a
      NumericDate.  In the contex=
t of the SET token it SHALL be
   &nb=
sp;  interpreted to mean a date in which the event is believed to have<=
u>
      occurred (in the past=
) or will occur in the future.  Note: there
&nb=
sp;     MAY be some cases where "nbf" is still smaller t=
han "iat" such as
      whe=
n it took an extended time for a SET to be issued (for example=

      after some analysis).  This c=
laim is OPTIONAL.

 

There is an argument th= at the redefinition will cause confusion. 

=

 

The proposal is to register a different claim name such as =E2=80=9Ctoe= =E2=80=9D (time of event). The proposed new

definition:

 

toe
&n=
bsp;     Defined by Section&=
nbsp;4.1.5 [RFC7519], a number whose value is a
=
      NumericDate.  The value is the date and t=
ime in which the event is believed to have
 &nb=
sp;    occurred in the past or will occur in the future. This=
 claim is OPTIONAL.
      W=
hen not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be th=
e value of =E2=80=9Ciat=E2=80=9D.
 
nbf
      This=
 claim is not used in SET Events. If asserted, the value SHOULD
      be ignored.

 

 

Are th= ere any objections to the proposed change?

 

Phil

 

= Oracle Corporation, Identity Cloud Services Architect=

@independentid=

phil.hunt@oracle.com=

=

 


_________________________= ______________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mai= lman/listinfo/id-event

 


<= i>CONFIDENTIALITY NOTICE: This email ma= y contain confidential and privileged material for the sole use of the inten= ded recipient(s). Any review, use, distribution or disclosure by others is s= trictly prohibited.  If you have received this communication in error, p= lease notify the sender immediately by e-mail and delete the message and any= file attachments from your computer. Thank you.

=

_______________________________________________
Id-e= vent mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listin= fo/id-event


_______________________________________________<= br style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-vari= ant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;te= xt-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">Id-event mailing list
Id-event@ietf.org
https://urldefense.= proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_= id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLI= Gk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJ= LNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D


= --Apple-Mail-B317E2DC-C8C0-417C-B85B-EC48DCA01D1E-- From nobody Wed Oct 25 13:58:52 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E92F41395EA for ; Wed, 25 Oct 2017 13:58:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.71 X-Spam-Level: X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7FvsvFDqwy1x for ; Wed, 25 Oct 2017 13:58:47 -0700 (PDT) Received: from mail-it0-x236.google.com (mail-it0-x236.google.com [IPv6:2607:f8b0:4001:c0b::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 027B5137ED6 for ; Wed, 25 Oct 2017 13:58:46 -0700 (PDT) Received: by mail-it0-x236.google.com with SMTP id k70so11970502itk.0 for ; Wed, 25 Oct 2017 13:58:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=QmkPvf5TT2MpsE6bLU6VtST0N+uL6FDUNXOe9xtpPYU=; b=c3yMgfLdgZBRwbjfL6lvHEhaRJZyYf384MulnNjOs6bDJGmWb5vepKDdWI03PXFj7O gsjlpxEqP2nYXtHF23tS4XPE2iRTV/OXjw+UeMmdGI19xciAfzNucs3FcWyFsYiIS3Nl S4XoF5kUr0L70pdCNvuVP749bbOcCjfpeT/OdMWUGhdlv6Owz4gqndeTK+CwM7L2UqA3 tOZInL1Y4BvRTBUZThr/QnRo2vKyFsyWR69D9SEmL6Dr5Z0fPJtwO/AzApKDeFzz7obB aJ1W3oN2WcHSob2J4KwlX/3nY8srIHJu+nrdmDsM+g4giYWbXA2GXKJFyZrW2UgVpnL/ 5WUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=QmkPvf5TT2MpsE6bLU6VtST0N+uL6FDUNXOe9xtpPYU=; b=tREV9G7Dir1ifRqUW3/vOfLBNzZ0WZhEjSs0uD8/NEIoBwAtD7HLuFxhYyUjHIsKdQ AInQVuCMiC2x7YIXdXyIKe/6zbB+N9hJ8pZJfZgv1M2WQsl6h8ctniY4Sf+IN+jVk6OH 88exrDtZAE3xwa6/UdQ03hZ15epPlSfDeFxNnIJAL+NuhnMd6vj47yadiYDLHLBhkGl0 Zdl1Rlwnvsn/h+74VeWfONu6pCUgpu1QQcr3hx1l8OmDxxF+2RvzP++xL24WsNexP2g5 mvhbgOzJaTPlQWC9LpWNpDKBv9+Rci4A7teaYm72w/ZWYPHqHEUKPf3PnAsBEIOM1Bpq 7vUw== X-Gm-Message-State: AMCzsaVh11ofqH5cbhn9bzVwmhNHq0QRjGXXXy7buXfJ2jp2ePwHcez5 yN+eYMFXtI6oAAIaqKNS0k7e77Blp+PaKYvZk993hA== X-Google-Smtp-Source: ABhQp+RDemwIwnmzeZh/xraOD9uEWHkvnH8ieaA1N4tpyPbfcpDQ948QCewp7fiWxJ0Y00V6wBek3OScSi3N1vo6F9U= X-Received: by 10.36.29.19 with SMTP id 19mr3585605itj.86.1508965125998; Wed, 25 Oct 2017 13:58:45 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Wed, 25 Oct 2017 13:58:25 -0700 (PDT) In-Reply-To: <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> From: Marius Scurtescu Date: Wed, 25 Oct 2017 13:58:25 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List Content-Type: multipart/alternative; boundary="001a1143e54650e6ad055c65522f" Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 20:58:51 -0000 --001a1143e54650e6ad055c65522f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable As I said, I totally agree it is useful. But why required? Marius On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) wrote: > In some cases, ordering of events against a single subject matters. Time > is useful for this purpose though limited in the overall stream for > ordering events overall. > > For example account locked vs unlocked. Knowing what happened last would > seem important no? > > Phil > > On Oct 25, 2017, at 1:46 PM, Marius Scurtescu > wrote: > > On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt wrote: > >> It is not clear how to revise the document with regards to the suggestio= n >> against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not as= serted. >> >> If I remove this clarification, it seems unclear what the time of the >> event is defined as. There seem to be two options: >> >> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of e= vent, then =E2=80=9Ctoe=E2=80=9D should >> be a required claim. >> > > Why? Why can't the Transmitter assert that an account was disabled and no= t > provide a specific event time? I understand that an event time is > desirable, but why required? > > > >> >> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly used= to mark SET >> issuance and event time. =E2=80=9Ctoe=E2=80=9D is only needed when the = time of the event >> is different (on an exceptional basis). >> > > If SET issuance and event time are indeed the same then both claims shoul= d > be present. I don't think iat should imply toe. > > >> >> Some clarification from the group would be appreciated. Should we >> proceed with B, or revise the text to A (or some other proposal). >> >> Thanks, >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> >> phil.hunt@oracle.com >> >> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu >> wrote: >> >> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle < >> richanna@amazon.com> wrote: >> >>> Agreed overall. Having reread the proposed text, I suggest striking the >>> last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2= =80=9D MAY be assumed to be >>> the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is neces= sary or particularly helpful >>> to standardize the semantics of a missing time-of-event claim at the SE= T >>> level. >>> >> >> +1 >> >> >> >>> >>> >>> -- >>> >>> Annabelle Richard Backman >>> >>> Amazon =E2=80=93 Identity Services >>> >>> >>> >>> >>> >>> *From: *Id-event on behalf of "Phil Hunt >>> (IDM)" >>> *Date: *Monday, October 23, 2017 at 5:48 PM >>> *To: *Mike Jones >>> *Cc: *Brian Campbell , ID Events Mailing >>> List >>> >>> *Subject: *Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>> >>> >>> >>> Agreed +1 on Brian's edits. >>> >>> Phil >>> >>> >>> On Oct 23, 2017, at 5:05 PM, Mike Jones >>> wrote: >>> >>> Annabelle and I agreed with this proposed change (as correctly >>> wordsmithed by Brian) during our in-person review =E2=80=93 as also not= ed in the >>> reply to Marius=E2=80=99 comments. >>> >>> >>> >>> Thanks >>> Phil and all, >>> >>> -- Mike >>> >>> >>> >>> *From:* Id-event [mailto:id-event-bounces@ietf.org >>> ] *On Behalf Of *Brian Campbell >>> *Sent:* Thursday, September 28, 2017 8:23 AM >>> *To:* Phil Hunt >>> *Cc:* ID Events Mailing List >>> *Subject:* Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>> >>> >>> >>> +1 to SET defining a time of event claim rather than trying to redefine >>> a standard claim. And who doesn't like a claim named "toe"? >>> >>> However, the text there for nbf is still effectively redefining it by >>> saying it should be ignored, which isn't consistent with the "MUST NOT = be >>> accepted for processing" from RFC 7519. It would be more appropriate to= say >>> that nbf should/must not be included in a SET. Or just not mention nbf = at >>> all. But don't change the meaning. >>> >>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is th= e >>> nbf section. The value of the toe claim is a NumericDate, which is defi= ned >>> in Sec 2 RFC7519. But toe has no relation to nbf and no reason to refer= ence >>> nbf. >>> >>> >>> >>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt wrote= : >>> >>> During the OpenID RISC Face to Face meeting a question came up regardin= g >>> SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that re= definition was appropriate. >>> >>> >>> >>> The intention of SETs definition is to allow SET Transmitters to >>> indicate that an event may have occurred as early as a specified date = =E2=80=94 a >>> date which is different from the issuance date of the SET. In particula= r >>> this is useful in cases where the state change is believed to have occu= rred >>> earlier than the time of issuance (e.g. because the incident was discov= ered >>> through an administrative review or data analysis to have occurred in t= he >>> past). >>> >>> >>> >>> The definition from JWT is: >>> 4.1.5 >>> . >>> "nbf" (Not Before) Claim >>> >>> >>> >>> >>> >>> The "nbf" (not before) claim identifies the time before which the JW= T >>> >>> MUST NOT be accepted for processing. The processing of the "nbf" >>> >>> claim requires that the current date/time MUST be after or equal to >>> >>> the not-before date/time listed in the "nbf" claim. Implementers MA= Y >>> >>> provide for some small leeway, usually no more than a few minutes, t= o >>> >>> account for clock skew. Its value MUST be a number containing a >>> >>> NumericDate value. Use of this claim is OPTIONAL. >>> >>> >>> >>> >>> >>> As defined in SET: >>> >>> nbf >>> >>> Defined by Section 4.1.5 [RFC7519] , a number whose v= alue is a >>> >>> NumericDate. In the context of the SET token it SHALL be >>> >>> interpreted to mean a date in which the event is believed to have >>> >>> occurred (in the past) or will occur in the future. Note: there >>> >>> MAY be some cases where "nbf" is still smaller than "iat" such as >>> >>> when it took an extended time for a SET to be issued (for example >>> >>> after some analysis). This claim is OPTIONAL. >>> >>> >>> >>> There is an argument that the redefinition will cause confusion. >>> >>> >>> >>> The proposal is to register a different claim name such as =E2=80=9Ctoe= =E2=80=9D (time >>> of event). The proposed new >>> >>> definition: >>> >>> >>> >>> toe >>> >>> Defined by Section 4.1.5 [RFC7519] , a number whose v= alue is a >>> >>> NumericDate. The value is the date and time in which the event i= s believed to have >>> >>> occurred in the past or will occur in the future. This claim is O= PTIONAL. >>> >>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assu= med to be the value of =E2=80=9Ciat=E2=80=9D. >>> >>> >>> >>> nbf >>> >>> This claim is not used in SET Events. If asserted, the value SHOU= LD >>> >>> be ignored. >>> >>> >>> >>> >>> >>> Are there any objections to the proposed change? >>> >>> >>> >>> Phil >>> >>> >>> >>> Oracle Corporation, Identity Cloud Services Architect >>> >>> @independentid >>> >>> www.independentid.com >>> >>> >>> phil.hunt@oracle.com >>> >>> >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> >>> >>> >>> >>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>> privileged material for the sole use of the intended recipient(s). Any >>> review, use, distribution or disclosure by others is strictly prohibite= d. >>> If you have received this communication in error, please notify the sen= der >>> immediately by e-mail and delete the message and any file attachments f= rom >>> your computer. Thank you.* >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w >>> &s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> >>> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_ >> BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D >> >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN9T_ > TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU= &e=3D > > --001a1143e54650e6ad055c65522f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
As I said, I totally agree it is useful. But why required?=
<= /div>

--001a1143e54650e6ad055c65522f-- From nobody Wed Oct 25 14:02:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFABE137ED6 for ; Wed, 25 Oct 2017 14:02:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.229 X-Spam-Level: X-Spam-Status: No, score=-2.229 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jLMEHrOjR1qy for ; Wed, 25 Oct 2017 14:02:15 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A85E2139A33 for ; Wed, 25 Oct 2017 14:02:15 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9PL2CNA010363 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 21:02:12 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9PL2BHt008446 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 21:02:11 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9PL2Avr011203; Wed, 25 Oct 2017 21:02:10 GMT Received: from [10.0.1.19] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 25 Oct 2017 14:02:10 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-34B52DBC-B72C-453D-8A3E-ADCA1CEEDF7D Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Wed, 25 Oct 2017 14:02:05 -0700 Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> To: Marius Scurtescu X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 21:02:18 -0000 --Apple-Mail-34B52DBC-B72C-453D-8A3E-ADCA1CEEDF7D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable If an event doesn't have a time, did it occur? Phil > On Oct 25, 2017, at 1:58 PM, Marius Scurtescu wrot= e: >=20 > As I said, I totally agree it is useful. But why required? >=20 > Marius >=20 >> On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) w= rote: >> In some cases, ordering of events against a single subject matters. Time i= s useful for this purpose though limited in the overall stream for ordering e= vents overall.=20 >>=20 >> For example account locked vs unlocked. Knowing what happened last would s= eem important no? >>=20 >> Phil >>=20 >>> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu wr= ote: >>>=20 >>>> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt wrot= e: >>>> It is not clear how to revise the document with regards to the suggesti= on against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not ass= erted.=20 >>>>=20 >>>> If I remove this clarification, it seems unclear what the time of the e= vent is defined as. There seem to be two options: >>>>=20 >>>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of e= vent, then =E2=80=9Ctoe=E2=80=9D should be a required claim. >>>=20 >>> Why? Why can't the Transmitter assert that an account was disabled and n= ot provide a specific event time? I understand that an event time is desirab= le, but why required? >>>=20 >>> =20 >>>>=20 >>>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly use= d to mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D is only needed= when the time of the event is different (on an exceptional basis). >>>=20 >>> If SET issuance and event time are indeed the same then both claims shou= ld be present. I don't think iat should imply toe. >>> =20 >>>>=20 >>>> Some clarification from the group would be appreciated. Should we proc= eed with B, or revise the text to A (or some other proposal). >>>>=20 >>>> Thanks, >>>>=20 >>>> Phil >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>> @independentid >>>> www.independentid.com >>>> phil.hunt@oracle.com >>>>=20 >>>>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu w= rote: >>>>>=20 >>>>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle wrote: >>>>>> Agreed overall. Having reread the proposed text, I suggest striking t= he last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2=80= =9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do n= ot think it is necessary or particularly helpful to standardize the semantic= s of a missing time-of-event claim at the SET level. >>>>>>=20 >>>>>=20 >>>>> +1 >>>>>=20 >>>>> =20 >>>>>> =20 >>>>>>=20 >>>>>> --=20 >>>>>>=20 >>>>>> Annabelle Richard Backman >>>>>>=20 >>>>>> Amazon =E2=80=93 Identity Services >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> From: Id-event on behalf of "Phil Hunt (I= DM)" >>>>>> Date: Monday, October 23, 2017 at 5:48 PM >>>>>> To: Mike Jones >>>>>> Cc: Brian Campbell , ID Events Mailing Li= st >>>>>>=20 >>>>>>=20 >>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> Agreed +1 on Brian's edits.=20 >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>>=20 >>>>>> On Oct 23, 2017, at 5:05 PM, Mike Jones = wrote: >>>>>>=20 >>>>>> Annabelle and I agreed with this proposed change (as correctly wordsm= ithed by Brian) during our in-person review =E2=80=93 as also noted in the r= eply to Marius=E2=80=99 comments. >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> Thank= s Phil and all, >>>>>>=20 >>>>>> -- Mi= ke >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Brian C= ampbell >>>>>> Sent: Thursday, September 28, 2017 8:23 AM >>>>>> To: Phil Hunt >>>>>> Cc: ID Events Mailing List >>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> +1 to SET defining a time of event claim rather than trying to redefi= ne a standard claim. And who doesn't like a claim named "toe"? >>>>>>=20 >>>>>> However, the text there for nbf is still effectively redefining it by= saying it should be ignored, which isn't consistent with the "MUST NOT be a= ccepted for processing" from RFC 7519. It would be more appropriate to say t= hat nbf should/must not be included in a SET. Or just not mention nbf at all= . But don't change the meaning. >>>>>>=20 >>>>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is t= he nbf section. The value of the toe claim is a NumericDate, which is define= d in Sec 2 RFC7519. But toe has no relation to nbf and no reason to referenc= e nbf.=20 >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt wro= te: >>>>>>=20 >>>>>> During the OpenID RISC Face to Face meeting a question came up regard= ing SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that red= efinition was appropriate. >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> The intention of SETs definition is to allow SET Transmitters to indi= cate that an event may have occurred as early as a specified date =E2=80=94 a= date which is different from the issuance date of the SET. In particular th= is is useful in cases where the state change is believed to have occurred ea= rlier than the time of issuance (e.g. because the incident was discovered th= rough an administrative review or data analysis to have occurred in the past= ). >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> The definition from JWT is: >>>>>>=20 >>>>>> 4.1.5. "nbf" (Not Before) Claim >>>>>>=20 >>>>>> =20 >>>>>> =20 >>>>>> The "nbf" (not before) claim identifies the time before which the J= WT >>>>>> MUST NOT be accepted for processing. The processing of the "nbf" >>>>>> claim requires that the current date/time MUST be after or equal t= o >>>>>> the not-before date/time listed in the "nbf" claim. Implementers M= AY >>>>>> provide for some small leeway, usually no more than a few minutes,= to >>>>>> account for clock skew. Its value MUST be a number containing a >>>>>> NumericDate value. Use of this claim is OPTIONAL. >>>>>> =20 >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> As defined in SET: >>>>>>=20 >>>>>> nbf >>>>>> Defined by Section 4.1.5 [RFC7519], a number whose value is a >>>>>> NumericDate. In the context of the SET token it SHALL be >>>>>> interpreted to mean a date in which the event is believed to ha= ve >>>>>> occurred (in the past) or will occur in the future. Note: ther= e >>>>>> MAY be some cases where "nbf" is still smaller than "iat" such a= s >>>>>> when it took an extended time for a SET to be issued (for examp= le >>>>>> after some analysis). This claim is OPTIONAL. >>>>>> =20 >>>>>>=20 >>>>>> There is an argument that the redefinition will cause confusion.=20 >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> The proposal is to register a different claim name such as =E2=80=9Ct= oe=E2=80=9D (time of event). The proposed new >>>>>>=20 >>>>>> definition: >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> toe >>>>>> Defined by Section 4.1.5 [RFC7519], a number whose value is a >>>>>> NumericDate. The value is the date and time in which the event= is believed to have >>>>>> occurred in the past or will occur in the future. This claim is= OPTIONAL. >>>>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be as= sumed to be the value of =E2=80=9Ciat=E2=80=9D. >>>>>> =20 >>>>>> nbf >>>>>> This claim is not used in SET Events. If asserted, the value SH= OULD >>>>>> be ignored. >>>>>> =20 >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> Are there any objections to the proposed change? >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>=20 >>>>>> @independentid >>>>>>=20 >>>>>> www.independentid.com >>>>>>=20 >>>>>> phil.hunt@oracle.com >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>=20 >>>>>> =20 >>>>>>=20 >>>>>>=20 >>>>>> CONFIDENTIALITY NOTICE: This email may contain confidential and privi= leged material for the sole use of the intended recipient(s). Any review, us= e, distribution or disclosure by others is strictly prohibited. If you have= received this communication in error, please notify the sender immediately b= y e-mail and delete the message and any file attachments from your computer.= Thank you. >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_m= ailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkK= Y057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRl= HOMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON= 8&e=3D >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_ma= ilman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY= 057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd= 5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY= &e=3D >>>>=20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN9T= _TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e= =3D=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPIa2k8= 68J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338FdapSY&e=3D= =20 --Apple-Mail-34B52DBC-B72C-453D-8A3E-ADCA1CEEDF7D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
If an event doesn't have a time, did i= t occur?

Phil

On Oct 25, 2017, at 1:58 PM, Marius Scurt= escu <mscurtescu@google.com&= gt; wrote:

As I= said, I totally agree it is useful. But why required?

Marius

On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (I= DM) <phil.hunt@oracle.com> wrote:
In some cases, ordering of events against a s= ingle subject matters. Time is useful for this purpose though limited in the= overall stream for ordering events overall. 

For example account locked vs unlocked. Knowing what hap= pened last would seem important no?

Phil
=

On Oct 25, 2017, at 1:46 PM, Marius Scurtescu <mscurtescu@google.com> wrot= e:

On Wed, Oct 25, 2017 at 11:09 AM, P= hil Hunt <phil.hunt@oracle.com= > wrote:
It is not clear how to revise the document with regards to the su= ggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is n= ot asserted. 

If I remove this clarification, it see= ms unclear what the time of the event is defined as.  There seem to be t= wo options:

A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be a= ssumed to be the time of event, then =E2=80=9Ctoe=E2=80=9D should be a requi= red claim.

Why? Why can't t= he Transmitter assert that an account was disabled and not provide a specifi= c event time? I understand that an event time is desirable, but why required= ?

 

B. For the majority of= use cases, =E2=80=9Ciat=E2=80=9D is commonly used to mark SET issuance and e= vent time.  =E2=80=9Ctoe=E2=80=9D is only needed when the time of the e= vent is different (on an exceptional basis).
<= div>
If SET issuance and event time are indeed the same then b= oth claims should be present. I don't think iat should imply toe.
=  

Some clarification from the group would be a= ppreciated.  Should we proceed with B, or revise the text to A (or some= other proposal).

Thanks,

=
Phil

O= racle Corporation, Identity Cloud Services Architect
@independenti= d
phil.hunt@oracle.com
<= /div>

On Oct 23, 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Mon, Oct 23, 2017 at 6:04 PM, Richard B= ackman, Annabelle <richanna@amazon.com> wrote:

Agreed overall. Having reread the proposed text, I suggest strik= ing the last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe= =E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I= do not think it is necessary or particularly helpful to standardize the sem= antics of a missing time-of-event claim at the SET level.


+1

 

 

-- 

Annabelle Richard Backman


Phi= l


On Oct 23, 2017, at 5:05 PM, Mike Jones <Michael.Jones@micros= oft.com> wrote:

Annabelle and I agreed with this proposed change (as correctly w= ordsmithed by Brian) during our in-person review =E2=80=93 as also noted in t= he reply to Marius=E2=80=99 comments.

 

<= p class=3D"MsoNormal">   &= nbsp;            = ;            &nb= sp;           &n= bsp;            =            = Thanks Phil and all,

<= span style=3D"color:rgb(0,32,96)">       =             &nbs= p;           &nb= sp;            &= nbsp;            = ;       -- Mike

&n= bsp;

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Brian Campbell
Sent: = Thursday, September 28, 2017 8:23 AM
To: P= hil Hunt <phil.hunt@oracle.com>
Cc: ID Event= s Mailing List <id-event@ietf.org>
Subject: Re: [= Id-event] Replacing "nbf" claim with a new "toe" claim

 

+1 to SET defining a time of event claim r= ather than trying to redefine a standard claim. And who doesn't like a claim= named "toe"?

However, the text there for nbf is still effectively redefining= it by saying it should be ignored, which isn't consistent with the "MUST NO= T be accepted for processing" from RFC 7519. It would be more appropriate to= say that nbf should/must not be included in a SET. Or just not mention nbf a= t all. But don't change the meaning.

Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is t= he nbf section. The value of the toe claim is a NumericDate, which is define= d in Sec 2 RFC7519. But toe has no relation to nbf and no reason to referenc= e nbf. 

 

On Wed, Sep 27, 2017 at 2:53 PM, Phi= l Hunt <phil.hunt@oracle.com> wrote:

During the OpenID RISC Face to Face meeting a question c= ame up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whe= ther that redefinition was appropriate.

 

The inten= tion of SETs definition is to allow SET Transmitters to indicate that an eve= nt may have occurred as early as a specified date =E2=80=94 a date which is d= ifferent from the issuance date of the SET. In particular this is useful in c= ases where the state change is believed to have occurred earlier than the ti= me of issuance (e.g. because the incident was discovered through an administ= rative review or data analysis to have occurred in the past).<= /p>

 

The definition from JWT is:

<= h4><= span style=3D"font-size:10pt;font-family:'Courier New',serif;text-decoration= :none">4.1.5= .  "= nbf" (Not Before) Claim
 
 
   The "nbf" (not before) c=
laim identifies the time before which the JWT
 =
  MUST NOT be accepted for processing.  The processing of the "nbf=
"
   claim requires that the current date/=
time MUST be after or equal to
   the not-=
before date/time listed in the "nbf" claim.  Implementers MAY=

   provide for some small leeway, usually no more t=
han a few minutes, to
   account for clock=
 skew.  Its value MUST be a number containing a
   NumericDate value.  Use of this claim is OPTIONAL.=

 

 

As defined in SET:

   n=
bf
      Defined by Section&nbs=
p;4.1.5 [RFC7519], a number whose value is a
&nb=
sp;     NumericDate.  In the context of the SET tok=
en it SHALL be
      interp=
reted to mean a date in which the event is believed to have
      occurred (in the past) or will occur i=
n the future.  Note: there
   &n=
bsp;  MAY be some cases where "nbf" is still smaller than "iat" such as=

      when it took an exte=
nded time for a SET to be issued (for example
 =
     after some analysis).  This claim is OPTIONAL.=

 
There is an argument that the redefiniti=
on will cause confusion. 
 
The proposal=
 is to register a different claim name such as =E2=80=9Ctoe=E2=80=9D (time o=
f event). The proposed new
definition:
 
toe
   &=
nbsp;  Defined by Section 4.1.5 [RFC7519], a number whose value is=
 a
      NumericDate. =
 The value is the date and time in which the event is believed to have
      occurred in the past or wi=
ll occur in the future. This claim is OPTIONAL.
&nbs=
p;     When not asserted, the value of =E2=80=9Ctoe=E2=80=
=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.
 
nbf
 &n=
bsp;    This claim is not used in SET Events. If asserted, th=
e value SHOULD
      be ign=
ored.
 
 
=

Are there any objections to the proposed change?
 
=

Phil
 
Oracle Corporation, Identity Cloud Serv=
ices Architect
@independentid
p=
hil.hunt@oracle.com
 

_______________________________________________
I=
d-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/i=
d-event

 = ;


CONFIDENTIALITY NOTICE: This email may contain confidenti= al and privileged material for the sole use of the intended recipient(s). An= y review, use, distribution or disclosure by others is strictly prohibited.&= nbsp; If you have received this communication in error, please notify the se= nder immediately by e-mail and delete the message and any file attachments f= rom your computer. Thank you.


_______________________________________________
Id-event mai= ling list
Id-event@ietf.org
https://www.ietf.org/mailman/li= stinfo/id-event


_______________________________________________
<= span style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-va= riant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;= text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;floa= t:none;display:inline!important">Id-event mailing list
Id-event@= ietf.org
https://urldefense.proofpoint.com/v2/url?u=3D= https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5bi= RrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4= iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-J= Ffe7mYpBY&e=3D


_______________________________________________Id-event mailing list
Id-event@ietf.org
<= a href=3D"https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.or= g_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQc= xBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&= ;m=3Dmyl7g4hppkWgdjN9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwH= EtSkNgfogFmv_q6_o0qv8axU&e=3D" target=3D"_blank">https://urldefense.proo= fpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-<= wbr>2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YT= pkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&a= mp;m=3Dmyl7g4hppkWgdjN9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O= 5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e=3D

= --Apple-Mail-34B52DBC-B72C-453D-8A3E-ADCA1CEEDF7D-- From nobody Wed Oct 25 14:07:51 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84CF41398CF for ; Wed, 25 Oct 2017 14:07:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.71 X-Spam-Level: X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LwxBwge3DiMM for ; Wed, 25 Oct 2017 14:07:46 -0700 (PDT) Received: from mail-io0-x233.google.com (mail-io0-x233.google.com [IPv6:2607:f8b0:4001:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3030D137ED6 for ; Wed, 25 Oct 2017 14:07:46 -0700 (PDT) Received: by mail-io0-x233.google.com with SMTP id n137so2486687iod.6 for ; Wed, 25 Oct 2017 14:07:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ClAqS5JvzKU0raGlPwBIklowBiml3GKxPH2yrtUkR/A=; b=wS8y9YBTqnpqg6KAHdx7BhmDfqNpl5REx7m1ojnELd00fZrT5nKHdejep19XBZiDJ9 gNOYzBA7kmtXAKx3CNuATi3Tnoj+YcskmQJcIzJVVk37/COVmj2o5t6KXZUY/kLJzoTQ uTK5ZJQkPDuz/F0k5+qAZEHliyOLufYXJEBlSn55HXwLBKpKbQ07SVnk1zbO7dXKOHqU 2/108dso0DZeEMv9WtPEjihCQgHfIxJ5zaQ57dMlO1vMoH4xAOmbXOFGMqKesfD5PWgh yB7De3NRoj2w7zm/50WRx7arbp58yNdjJVs+uaNEQw5ZJAh37R2V6ruiAYv1souk8Usw VHtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ClAqS5JvzKU0raGlPwBIklowBiml3GKxPH2yrtUkR/A=; b=KQ9io7wQNCgDbpx4VbI1+oa5a77CTTJOr7V8ZsnfnhuNqoUFiM2iSyBM5n8QnNVcv9 ND8FQD8z566RFlM+Uhl8XIdTPH+YD88IHgcmUu0UcO+EXmDZesVrougeKVeqy9Aig3T7 Tv8Pk6BOz8G+Y2yonsmcPenrow8lRJaNyQOYN/8LQbr5mQeFSHV9GiDS1vP88t8gCEm/ tUzA+nPgejU2hmzIqrDYQTqVFHHzZ2DUM5MIA2N/v6n2osCwdiPJrWMce5Ugw1Y//PzZ kWAW0z7NXo+Zn5x/YhNF/Ml2+Wl96N9uEDcBe7o/VQCh0P+c2T6GxgcXOJhIEpN/25NW FBRg== X-Gm-Message-State: AMCzsaUEEiVnk3iN/ES6vPoSDZmpvO9w6Zwf9zl2ndLED6B2qlhIx0Fj rPSDtPdySKjl6kV1KGSXhumdHIYeGWVKOZTqaWUSGQ== X-Google-Smtp-Source: ABhQp+TbN5oapH9e+LSeYQ+M0qIai+UTpCRpjDv+nZ5/aY/drUDalljlTu4GvBmg6/4ocUw1wjJ/fkZhjD6HDQ4ddpE= X-Received: by 10.107.181.215 with SMTP id e206mr27465024iof.98.1508965664576; Wed, 25 Oct 2017 14:07:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Wed, 25 Oct 2017 14:07:23 -0700 (PDT) In-Reply-To: <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> From: Marius Scurtescu Date: Wed, 25 Oct 2017 14:07:23 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List Content-Type: multipart/alternative; boundary="001a114446cc6b1735055c65729a" Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 21:07:49 -0000 --001a114446cc6b1735055c65729a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) wrote: > If an event doesn't have a time, did it occur? > At undisclosed time and location :-) I think it is fine for "toe" to be SHOULD/RECOMMENDED, but not MUST/REQUIRED. > Phil > > On Oct 25, 2017, at 1:58 PM, Marius Scurtescu > wrote: > > As I said, I totally agree it is useful. But why required? > > Marius > > On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) > wrote: > >> In some cases, ordering of events against a single subject matters. Time >> is useful for this purpose though limited in the overall stream for >> ordering events overall. >> >> For example account locked vs unlocked. Knowing what happened last would >> seem important no? >> >> Phil >> >> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu >> wrote: >> >> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt wrote= : >> >>> It is not clear how to revise the document with regards to the >>> suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80= =9D is not asserted. >>> >>> If I remove this clarification, it seems unclear what the time of the >>> event is defined as. There seem to be two options: >>> >>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of = event, then =E2=80=9Ctoe=E2=80=9D should >>> be a required claim. >>> >> >> Why? Why can't the Transmitter assert that an account was disabled and >> not provide a specific event time? I understand that an event time is >> desirable, but why required? >> >> >> >>> >>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly use= d to mark SET >>> issuance and event time. =E2=80=9Ctoe=E2=80=9D is only needed when the= time of the event >>> is different (on an exceptional basis). >>> >> >> If SET issuance and event time are indeed the same then both claims >> should be present. I don't think iat should imply toe. >> >> >>> >>> Some clarification from the group would be appreciated. Should we >>> proceed with B, or revise the text to A (or some other proposal). >>> >>> Thanks, >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect >>> @independentid >>> www.independentid.com >>> >>> phil.hunt@oracle.com >>> >>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu >>> wrote: >>> >>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle < >>> richanna@amazon.com> wrote: >>> >>>> Agreed overall. Having reread the proposed text, I suggest striking th= e >>>> last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe= =E2=80=9D MAY be assumed to be >>>> the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is nece= ssary or particularly helpful >>>> to standardize the semantics of a missing time-of-event claim at the S= ET >>>> level. >>>> >>> >>> +1 >>> >>> >>> >>>> >>>> >>>> -- >>>> >>>> Annabelle Richard Backman >>>> >>>> Amazon =E2=80=93 Identity Services >>>> >>>> >>>> >>>> >>>> >>>> *From: *Id-event on behalf of "Phil Hunt >>>> (IDM)" >>>> *Date: *Monday, October 23, 2017 at 5:48 PM >>>> *To: *Mike Jones >>>> *Cc: *Brian Campbell , ID Events Mailing >>>> List >>>> >>>> *Subject: *Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>>> >>>> >>>> >>>> Agreed +1 on Brian's edits. >>>> >>>> Phil >>>> >>>> >>>> On Oct 23, 2017, at 5:05 PM, Mike Jones >>>> wrote: >>>> >>>> Annabelle and I agreed with this proposed change (as correctly >>>> wordsmithed by Brian) during our in-person review =E2=80=93 as also no= ted in the >>>> reply to Marius=E2=80=99 comments. >>>> >>>> >>>> >>>> Thanks >>>> Phil and all, >>>> >>>> -- Mik= e >>>> >>>> >>>> >>>> *From:* Id-event [mailto:id-event-bounces@ietf.org >>>> ] *On Behalf Of *Brian Campbell >>>> *Sent:* Thursday, September 28, 2017 8:23 AM >>>> *To:* Phil Hunt >>>> *Cc:* ID Events Mailing List >>>> *Subject:* Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >>>> >>>> >>>> >>>> +1 to SET defining a time of event claim rather than trying to redefin= e >>>> a standard claim. And who doesn't like a claim named "toe"? >>>> >>>> However, the text there for nbf is still effectively redefining it by >>>> saying it should be ignored, which isn't consistent with the "MUST NOT= be >>>> accepted for processing" from RFC 7519. It would be more appropriate t= o say >>>> that nbf should/must not be included in a SET. Or just not mention nbf= at >>>> all. But don't change the meaning. >>>> >>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is >>>> the nbf section. The value of the toe claim is a NumericDate, which is >>>> defined in Sec 2 RFC7519. But toe has no relation to nbf and no reason= to >>>> reference nbf. >>>> >>>> >>>> >>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt >>>> wrote: >>>> >>>> During the OpenID RISC Face to Face meeting a question came up >>>> regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whet= her that redefinition was >>>> appropriate. >>>> >>>> >>>> >>>> The intention of SETs definition is to allow SET Transmitters to >>>> indicate that an event may have occurred as early as a specified date = =E2=80=94 a >>>> date which is different from the issuance date of the SET. In particul= ar >>>> this is useful in cases where the state change is believed to have occ= urred >>>> earlier than the time of issuance (e.g. because the incident was disco= vered >>>> through an administrative review or data analysis to have occurred in = the >>>> past). >>>> >>>> >>>> >>>> The definition from JWT is: >>>> 4.1.5 >>>> . >>>> "nbf" (Not Before) Claim >>>> >>>> >>>> >>>> >>>> >>>> The "nbf" (not before) claim identifies the time before which the J= WT >>>> >>>> MUST NOT be accepted for processing. The processing of the "nbf" >>>> >>>> claim requires that the current date/time MUST be after or equal to >>>> >>>> the not-before date/time listed in the "nbf" claim. Implementers M= AY >>>> >>>> provide for some small leeway, usually no more than a few minutes, = to >>>> >>>> account for clock skew. Its value MUST be a number containing a >>>> >>>> NumericDate value. Use of this claim is OPTIONAL. >>>> >>>> >>>> >>>> >>>> >>>> As defined in SET: >>>> >>>> nbf >>>> >>>> Defined by Section 4.1.5 [RFC7519] , a number whose v= alue is a >>>> >>>> NumericDate. In the context of the SET token it SHALL be >>>> >>>> interpreted to mean a date in which the event is believed to hav= e >>>> >>>> occurred (in the past) or will occur in the future. Note: there >>>> >>>> MAY be some cases where "nbf" is still smaller than "iat" such a= s >>>> >>>> when it took an extended time for a SET to be issued (for exampl= e >>>> >>>> after some analysis). This claim is OPTIONAL. >>>> >>>> >>>> >>>> There is an argument that the redefinition will cause confusion. >>>> >>>> >>>> >>>> The proposal is to register a different claim name such as =E2=80=9Cto= e=E2=80=9D (time >>>> of event). The proposed new >>>> >>>> definition: >>>> >>>> >>>> >>>> toe >>>> >>>> Defined by Section 4.1.5 [RFC7519] , a number whose v= alue is a >>>> >>>> NumericDate. The value is the date and time in which the event = is believed to have >>>> >>>> occurred in the past or will occur in the future. This claim is = OPTIONAL. >>>> >>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be ass= umed to be the value of =E2=80=9Ciat=E2=80=9D. >>>> >>>> >>>> >>>> nbf >>>> >>>> This claim is not used in SET Events. If asserted, the value SHO= ULD >>>> >>>> be ignored. >>>> >>>> >>>> >>>> >>>> >>>> Are there any objections to the proposed change? >>>> >>>> >>>> >>>> Phil >>>> >>>> >>>> >>>> Oracle Corporation, Identity Cloud Services Architect >>>> >>>> @independentid >>>> >>>> www.independentid.com >>>> >>>> >>>> phil.hunt@oracle.com >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>> >>>> >>>> >>>> >>>> >>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>> privileged material for the sole use of the intended recipient(s). Any >>>> review, use, distribution or disclosure by others is strictly prohibit= ed. >>>> If you have received this communication in error, please notify the se= nder >>>> immediately by e-mail and delete the message and any file attachments = from >>>> your computer. Thank you.* >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>> WwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w >>>> &s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D >>>> >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event >>>> >>>> >>>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM >>> &s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D >>> >>> >>> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN9T_TyM3tQ98EeI6- >> 1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e=3D >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > k17XiXhDcASFiPIa2k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_ > nuacoh3xx338FdapSY&e=3D > > --001a114446cc6b1735055c65729a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On W= ed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) <phil.hu= nt@oracle.com> wrote:
If an event doesn't have a time, did it occur?

At undisclosed time and location = :-)

I think it is fine for "toe" to be S= HOULD/RECOMMENDED, but not MUST/REQUIRED.


Phil

On Oct 25, 2017, at 1:58 PM, Marius Scurtescu <mscurtescu@g= oogle.com> wrote:

As I said, I totally agree it is useful. But why required?
=

Marius
<= /div>
On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (= IDM) <phil.hunt@oracle.com> wrote:
=
In some cases, orderi= ng of events against a single subject matters. Time is useful for this purp= ose though limited in the overall stream for ordering events overall.=C2=A0=

For example account locked vs unlocked. Knowing what happened= last would seem important no?

Phil

On Oct 25, 2017, at 1:46 PM, Marius Scurtescu <= ;mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
It is not clear how to revise the document with regards to the sugg= estion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is no= t asserted.=C2=A0

If I remove this clarification, it see= ms unclear what the time of the event is defined as.=C2=A0 There seem to be= two options:

A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t = be assumed to be the time of event, then =E2=80=9Ctoe=E2=80=9D should be a = required claim.

Why? Why = can't the Transmitter assert that an account was disabled and not provi= de a specific event time? I understand that an event time is desirable, but= why required?

=C2=A0

B. For= the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly used to mark = SET issuance and event time. =C2=A0=E2=80=9Ctoe=E2=80=9D is only needed whe= n the time of the event is different (on an exceptional basis).
=

If SET issuance and event time are i= ndeed the same then both claims should be present. I don't think iat sh= ould imply toe.
=C2=A0

Some clarificat= ion from the group would be appreciated.=C2=A0 Should we proceed with B, or= revise the text to A (or some other proposal).

Th= anks,

Phil

Oracle Corporation, Identi= ty Cloud Services Architect
@independentid
<= a href=3D"mailto:phil.hunt@oracle.com" class=3D"m_4035401861108173736m_-743= 4075047681755444cremed cremed" target=3D"_blank">phil.hunt@oracle.com

On Oct 23, 2017, at 6:15 PM, Marius S= curtescu <mscurtescu@= google.com> wrote:

On Mon, Oct 23, = 2017 at 6:04 PM, Richard Backman, Annabelle=C2= =A0<richanna@amazon.com>=C2=A0<= /span>wrote:

Agreed overall. Having reread the proposed text, I suggest s= triking the last sentence, =E2=80=9CWhen not asserted, the value of =E2=80= =9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=E2= =80=9D I do not think it is necessary or particularly helpful to standardiz= e the semantics of a missing time-of-event claim at the SET level.


+1

=C2=A0<= /div>

=C2=A0

--=C2=A0

= = Amazon =E2=80=93 Identity Services

=C2=A0

=C2=A0=

From:=C2=A0= Id-event <id-event-bounces@ietf.org> on = behalf of "Phil Hunt (IDM)" <phil.hunt@oracle.com>
Date:=C2=A0Monday, October 23, 2017 at 5:48 PM
To:=C2=A0Mike Jones <Michael.Jones@microsoft.com>
Cc:<= span class=3D"m_4035401861108173736m_-7434075047681755444m_2511139720383718= 180Apple-converted-space">=C2=A0Brian Campbell <bcampbell@pingidentity.com>, = ID Events Mailing List <id-ev= ent@ietf.org>


Subject:=C2=A0Re: [Id-event] Replacing "nbf" claim w= ith a new "toe" claim

= =C2=A0

Agreed +1 on Brian's= edits.=C2=A0

Phil


On Oct 23, 2017, at 5:05 PM, Mike Jones = <Michael.Jones@micr= osoft.com> wrote:

Annabelle and I agreed with this proposed change (as correc= tly wordsmithed by Brian) during our in-person review =E2=80=93 as also not= ed in the reply to Marius=E2=80=99 comments.

=C2=A0=

=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0Thanks Phil and all,

= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0-- Mike

=C2= =A0

From:=C2=A0Id-event [mailto:id-event-bounces@ietf.org]=C2=A0On Behalf Of=C2=A0Brian Campbell
Sent:=C2=A0Thursday, September 28, 2017 8:23 AM
To:=C2=A0Phil Hunt <phil.hunt@oracle.com>
Cc:=C2= =A0ID Events Mailing List <id-event@ietf.org>
Subject:=C2=A0Re: [Id-event] Replacing "nbf" claim with a new &qu= ot;toe" claim

=C2=A0=

= +1 to SET defining a time of event claim rather than trying to redefine a s= tandard claim. And who doesn't like a claim named "toe"?

Howe= ver, the text there for nbf is still effectively redefining it by saying it= should be ignored, which isn't consistent with the "MUST NOT be a= ccepted for processing" from RFC 7519. It would be more appropriate to= say that nbf should/must not be included in a SET. Or just not mention nbf= at all. But don't change the meaning.

Also toe would not be "Defined by Section 4.1.5 [RFC751= 9]", which is the nbf section. The value of the toe claim is a Numeric= Date, which is defined in Sec 2 RFC7519. But toe has no relation to nbf and= no reason to reference nbf.=C2=A0

=C2=A0

On Wed, Sep = 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com> wrote:

During the OpenID RISC Face to Face meeting a quest= ion came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D a= nd whether that redefinition was appropriate.

=C2=A0

T= he intention of SETs definition is to allow SET Transmitters to indicate th= at an event may have occurred as early as a specified date =E2=80=94 a date= which is different from the issuance date of the SET. In particular this i= s useful in cases where the state change is believed to have occurred earli= er than the time of issuance (e.g. because the incident was discovered thro= ugh an administrative review or data analysis to have occurred in the past)= .

=C2=A0

The definition from JWT is:

4.1.5.=C2=A0 "nbf" (Not Before) Claim

= 
=C2=A0
=C2=A0
=C2=A0=
=C2=A0 The "nbf" (not before) claim identifies the time before wh=
ich the JWT
=C2=A0=C2=A0 MUST NOT be accepted for p=
rocessing.=C2=A0 The processing of the "nbf"
<= pre>=C2=A0=C2=A0 claim requires that the current date/time MUST be after or= equal to
=C2=A0=C2=A0 the not-before date/time lis=
ted in the "nbf" claim.=C2=A0 Implementers MAY
=C2=A0=C2=A0 provide for some small leeway, usually no more than a fe=
w minutes, to
=C2=A0=C2=A0 account for clock skew.=
=C2=A0 Its value MUST be a number containing a
=C2=
=A0=C2=A0 NumericDate value.=C2=A0 Use of this claim is OPTIONAL.=

=C2=A0
<= div>

=C2=A0

As defined in SET:

=C2=A0

definition:

toe
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Section=C2=A04.1.5 [RFC7519], a number whose =
value is a
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDa=
te.=C2=A0 The value is the date and time in which the event is believed to =
have
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occurred in the=
 past or will occur in the future. This claim is OPTIONAL.
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 When not asserted, the value of =E2=
=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=

=C2=A0
nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 This claim is not used in SET Event=
s. If asserted, the value SHOULD
=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 be ignored.
=C2=
=A0

=C2=A0<= u>

Are there any objections to the= proposed change?

=C2=A0=

<= div>

Ph= il

=C2=A0

Oracle Corpo= ration, Identity Cloud Services Architect

@independentid

phil.hunt@ora= cle.com

=C2=A0<= u>


_______________________________________________
Id-event = mailing list
Id-event@ietf.or= g
https://www.ietf.org= /mailman/listinfo/id-event

=C2=A0

CONFIDENTIALITY NOTIC= E: This email may contain confidential and privileged material for the sole= use of the intended recipient(s). Any review, use, distribution or disclos= ure by others is strictly prohibited.=C2=A0 If you have received this commu= nication in error, please notify the sender immediately by e-mail and delet= e the message and any file attachments from your computer. Thank you.

<= /div>

_______________________________________________
Id-e= vent mailing list
Id-event@ie= tf.org
https://www.ietf.org/mailman/listinfo/id-event


___________= ____________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www= .ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1= YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkI= TSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV= _BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY= &e=3D




--001a114446cc6b1735055c65729a-- From nobody Wed Oct 25 14:45:11 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBED4139561 for ; Wed, 25 Oct 2017 14:45:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.998 X-Spam-Level: X-Spam-Status: No, score=-6.998 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jyezq-I90v5E for ; Wed, 25 Oct 2017 14:45:07 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5A56132055 for ; Wed, 25 Oct 2017 14:45:06 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9PLj1C5022110 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 21:45:01 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9PLj0ew023732 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 21:45:01 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9PLj0Fa002503; Wed, 25 Oct 2017 21:45:00 GMT Received: from [10.0.1.19] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 25 Oct 2017 14:44:58 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-57A6FCEB-9E0D-4F0F-A400-E458C057A64B Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Wed, 25 Oct 2017 14:44:55 -0700 Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> To: Marius Scurtescu X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 21:45:10 -0000 --Apple-Mail-57A6FCEB-9E0D-4F0F-A400-E458C057A64B Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Are you proposing A with a should/recommended? It is more consistent but adds a lot of duplication in many cases where iat =3D= toe.=20 Phil > On Oct 25, 2017, at 2:07 PM, Marius Scurtescu wrot= e: >=20 >> On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) w= rote: >> If an event doesn't have a time, did it occur? >=20 > At undisclosed time and location :-) >=20 > I think it is fine for "toe" to be SHOULD/RECOMMENDED, but not MUST/REQUIR= ED. >=20 >>=20 >> Phil >>=20 >>> On Oct 25, 2017, at 1:58 PM, Marius Scurtescu wr= ote: >>>=20 >>> As I said, I totally agree it is useful. But why required? >>>=20 >>> Marius >>>=20 >>>> On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) = wrote: >>>> In some cases, ordering of events against a single subject matters. Tim= e is useful for this purpose though limited in the overall stream for orderi= ng events overall.=20 >>>>=20 >>>> For example account locked vs unlocked. Knowing what happened last woul= d seem important no? >>>>=20 >>>> Phil >>>>=20 >>>>> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu w= rote: >>>>>=20 >>>>>> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt wr= ote: >>>>>> It is not clear how to revise the document with regards to the sugges= tion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not a= sserted.=20 >>>>>>=20 >>>>>> If I remove this clarification, it seems unclear what the time of the= event is defined as. There seem to be two options: >>>>>>=20 >>>>>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time o= f event, then =E2=80=9Ctoe=E2=80=9D should be a required claim. >>>>>=20 >>>>> Why? Why can't the Transmitter assert that an account was disabled and= not provide a specific event time? I understand that an event time is desir= able, but why required? >>>>>=20 >>>>> =20 >>>>>>=20 >>>>>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly u= sed to mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D is only need= ed when the time of the event is different (on an exceptional basis). >>>>>=20 >>>>> If SET issuance and event time are indeed the same then both claims sh= ould be present. I don't think iat should imply toe. >>>>> =20 >>>>>>=20 >>>>>> Some clarification from the group would be appreciated. Should we pr= oceed with B, or revise the text to A (or some other proposal). >>>>>>=20 >>>>>> Thanks, >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>> @independentid >>>>>> www.independentid.com >>>>>> phil.hunt@oracle.com >>>>>>=20 >>>>>>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu wrote: >>>>>>>=20 >>>>>>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle wrote: >>>>>>>> Agreed overall. Having reread the proposed text, I suggest striking= the last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2= =80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I d= o not think it is necessary or particularly helpful to standardize the seman= tics of a missing time-of-event claim at the SET level. >>>>>>>>=20 >>>>>>>=20 >>>>>>> +1 >>>>>>>=20 >>>>>>> =20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> --=20 >>>>>>>>=20 >>>>>>>> Annabelle Richard Backman >>>>>>>>=20 >>>>>>>> Amazon =E2=80=93 Identity Services >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> From: Id-event on behalf of "Phil Hunt (= IDM)" >>>>>>>> Date: Monday, October 23, 2017 at 5:48 PM >>>>>>>> To: Mike Jones >>>>>>>> Cc: Brian Campbell , ID Events Mailing L= ist >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" clai= m >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> Agreed +1 on Brian's edits.=20 >>>>>>>>=20 >>>>>>>> Phil >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> On Oct 23, 2017, at 5:05 PM, Mike Jones wrote: >>>>>>>>=20 >>>>>>>> Annabelle and I agreed with this proposed change (as correctly word= smithed by Brian) during our in-person review =E2=80=93 as also noted in the= reply to Marius=E2=80=99 comments. >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> Tha= nks Phil and all, >>>>>>>>=20 >>>>>>>> -- M= ike >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Bria= n Campbell >>>>>>>> Sent: Thursday, September 28, 2017 8:23 AM >>>>>>>> To: Phil Hunt >>>>>>>> Cc: ID Events Mailing List >>>>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" clai= m >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> +1 to SET defining a time of event claim rather than trying to rede= fine a standard claim. And who doesn't like a claim named "toe"? >>>>>>>>=20 >>>>>>>> However, the text there for nbf is still effectively redefining it b= y saying it should be ignored, which isn't consistent with the "MUST NOT be a= ccepted for processing" from RFC 7519. It would be more appropriate to say t= hat nbf should/must not be included in a SET. Or just not mention nbf at all= . But don't change the meaning. >>>>>>>>=20 >>>>>>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which i= s the nbf section. The value of the toe claim is a NumericDate, which is def= ined in Sec 2 RFC7519. But toe has no relation to nbf and no reason to refer= ence nbf.=20 >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt w= rote: >>>>>>>>=20 >>>>>>>> During the OpenID RISC Face to Face meeting a question came up rega= rding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that r= edefinition was appropriate. >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> The intention of SETs definition is to allow SET Transmitters to in= dicate that an event may have occurred as early as a specified date =E2=80=94= a date which is different from the issuance date of the SET. In particular t= his is useful in cases where the state change is believed to have occurred e= arlier than the time of issuance (e.g. because the incident was discovered t= hrough an administrative review or data analysis to have occurred in the pas= t). >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> The definition from JWT is: >>>>>>>>=20 >>>>>>>> 4.1.5. "nbf" (Not Before) Claim >>>>>>>>=20 >>>>>>>> =20 >>>>>>>> =20 >>>>>>>> The "nbf" (not before) claim identifies the time before which th= e JWT >>>>>>>> MUST NOT be accepted for processing. The processing of the "nbf= " >>>>>>>> claim requires that the current date/time MUST be after or equal= to >>>>>>>> the not-before date/time listed in the "nbf" claim. Implementer= s MAY >>>>>>>> provide for some small leeway, usually no more than a few minute= s, to >>>>>>>> account for clock skew. Its value MUST be a number containing a= >>>>>>>> NumericDate value. Use of this claim is OPTIONAL. >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> As defined in SET: >>>>>>>>=20 >>>>>>>> nbf >>>>>>>> Defined by Section 4.1.5 [RFC7519], a number whose value is a= >>>>>>>> NumericDate. In the context of the SET token it SHALL be >>>>>>>> interpreted to mean a date in which the event is believed to h= ave >>>>>>>> occurred (in the past) or will occur in the future. Note: th= ere >>>>>>>> MAY be some cases where "nbf" is still smaller than "iat" suc= h as >>>>>>>> when it took an extended time for a SET to be issued (for exa= mple >>>>>>>> after some analysis). This claim is OPTIONAL. >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> There is an argument that the redefinition will cause confusion.=20= >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> The proposal is to register a different claim name such as =E2=80=9C= toe=E2=80=9D (time of event). The proposed new >>>>>>>>=20 >>>>>>>> definition: >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> toe >>>>>>>> Defined by Section 4.1.5 [RFC7519], a number whose value is a= >>>>>>>> NumericDate. The value is the date and time in which the eve= nt is believed to have >>>>>>>> occurred in the past or will occur in the future. This claim i= s OPTIONAL. >>>>>>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be a= ssumed to be the value of =E2=80=9Ciat=E2=80=9D. >>>>>>>> =20 >>>>>>>> nbf >>>>>>>> This claim is not used in SET Events. If asserted, the value S= HOULD >>>>>>>> be ignored. >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> Are there any objections to the proposed change? >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> Phil >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>>>=20 >>>>>>>> @independentid >>>>>>>>=20 >>>>>>>> www.independentid.com >>>>>>>>=20 >>>>>>>> phil.hunt@oracle.com >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>>=20 >>>>>>>> =20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> CONFIDENTIALITY NOTICE: This email may contain confidential and pri= vileged material for the sole use of the intended recipient(s). Any review, u= se, distribution or disclosure by others is strictly prohibited. If you hav= e received this communication in error, please notify the sender immediately= by e-mail and delete the message and any file attachments from your compute= r. Thank you. >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org= _mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTp= kKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_Fwyl= RlHOMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0V= ON8&e=3D >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>>>=20 >>>>>>>=20 >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org >>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_= mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpk= KY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Y= gd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYp= BY&e=3D >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_ma= ilman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY= 057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN= 9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU= &e=3D=20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPIa2= k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338FdapSY&e= =3D=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D3xoRnYeAqgWRqvjmh1f= FBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQb1_w6_6zUlq8CPRkegi1x_3G-knlbZk6kE&e=3D= =20 --Apple-Mail-57A6FCEB-9E0D-4F0F-A400-E458C057A64B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Are you proposing A with a should/recommended?

It is more consistent but= adds a lot of duplication in many cases where iat =3D toe. 

Phi= l

On Oct 25, 2017, at 2:07 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

<= /div>
On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (I= DM) <phil.hunt@oracle.com> wrote:
If an event doesn't have a t= ime, did it occur?

At undisc= losed time and location :-)

I think it is fine for "= toe" to be SHOULD/RECOMMENDED, but not MUST/REQUIRED.


Phil

On Oct 25, 2017, at 1:58 PM, Marius Scurtescu <mscur= tescu@google.com> wrote:

=
As I said, I totally agree it is useful. But why required?<= /div>

Marius

On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (I= DM) <phil.hunt@oracle.com> wrote:
In some cases, ordering of e= vents against a single subject matters. Time is useful for this purpose thou= gh limited in the overall stream for ordering events overall. 

<= /div>
For example account locked vs unlocked. Knowing what happened last would s= eem important no?

Phil

On Oct 25, 2017, at 1:46 PM, Marius Scurtescu <mscurtescu@goo= gle.com> wrote:

On Wed, Oct 25, 2= 017 at 11:09 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
It is not clear ho= w to revise the document with regards to the suggestion against using =E2=80= =9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not asserted. 

If I remove this clarification, it seems unclear what the time of t= he event is defined as.  There seem to be two options:

A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of ev= ent, then =E2=80=9Ctoe=E2=80=9D should be a required claim.

Why? Why can't the Transmitter assert that= an account was disabled and not provide a specific event time? I understand= that an event time is desirable, but why required?

 

B. For the majority of use cases, =E2=80=9Ciat=E2= =80=9D is commonly used to mark SET issuance and event time.  =E2=80=9C= toe=E2=80=9D is only needed when the time of the event is different (on an e= xceptional basis).

If SET i= ssuance and event time are indeed the same then both claims should be presen= t. I don't think iat should imply toe.
 

=
Some clarification from the group would be appreciated.  Should we= proceed with B, or revise the text to A (or some other proposal).

Thanks,

Phil
=

Oracle Corporation, Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
<= /div>

On Oct 23, 2017, at 6:15 PM, Marius Scu= rtescu <mscurtescu@goog= le.com> wrote:

On Mon, Oct 23, 2017 at 6:04= PM, Richard Backman, Annabelle <richanna@amazon.co= m> wrote:

Agreed overal= l. Having reread the proposed text, I suggest striking the last sentence, =E2= =80=9CWhen not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed t= o be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is neces= sary or particularly helpful to standardize the semantics of a missing time-= of-event claim at the SET level.


=
+1

 

 

-- <= /p>

Annabelle Richard Backman

Amazon =E2=80=93 Identity Services

 

 <= u>

= From: Id-event <id-event-bounces@ietf.org> on behalf of= "Phil Hunt (IDM)" <phil.hunt= @oracle.com>
Date: Mo= nday, October 23, 2017 at 5:48 PM
To: <= /span>Mike Jones <M= ichael.Jones@microsoft.com>
Cc: = Brian Campbell <bcampbell@pingidentity.com>, ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] R= eplacing "nbf" claim with a new "toe" claim

=  

Agreed +1 on Brian= 's edits. 

Phil


On Oct 23, 2017, at 5:05 PM, Mike Jones &= lt;Michael.Jones@microsof= t.com> wrote:

Annabelle and I agreed with this proposed change (as correctly wor= dsmithed by Brian) during our in-person review =E2=80=93 as also noted in th= e reply to Marius=E2=80=99 comments.

 

   &n= bsp;            =             &nbs= p;           &nb= sp;            &= nbsp;          Thanks Phil and all,

    =             &nbs= p;            &n= bsp;           &= nbsp;            = ;          -- Mike

 

From: Id-event [= mailto:id-event-bounces@iet= f.org] On Behalf Of Brian Campbell
Sent: Thursday, September 28, 2017 8:23 AM
To:<= /b> Phil Hunt <phil.hunt@oracle.com>
Cc: ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Replacing "nbf" claim with a new "= toe" claim

 

<= div>

+1 to SET d= efining a time of event claim rather than trying to redefine a standard clai= m. And who doesn't like a claim named "toe"?

However, the text there for nbf i= s still effectively redefining it by saying it should be ignored, which isn'= t consistent with the "MUST NOT be accepted for processing" from RFC 7519. I= t would be more appropriate to say that nbf should/must not be included in a= SET. Or just not mention nbf at all. But don't change the meaning.

Also toe would not be "Defined by Sect= ion 4.1.5 [RFC7519]", which is the nbf section. The value of the toe claim i= s a NumericDate, which is defined in Sec 2 RFC7519. But toe has no relation t= o nbf and no reason to reference nbf. 

 

On We= d, Sep 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com> wrote:

During the OpenID RISC Face to Face meeting a questi= on came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and= whether that redefinition was appropriate.

 

The in= tention of SETs definition is to allow SET Transmitters to indicate that an e= vent may have occurred as early as a specified date =E2=80=94 a date which i= s different from the issuance date of the SET. In particular this is useful i= n cases where the state change is believed to have occurred earlier than the= time of issuance (e.g. because the incident was discovered through an admin= istrative review or data analysis to have occurred in the past).

 

<= p class=3D"MsoNormal">The definition from JWT is:

4.1.5<= a name=3D"m_4035401861108173736_m_-7434075047681755444_m_2511139720383718180= _m_-1302340512091301459_m_4818440949900985753_section-4.1.5" class=3D"m_4035= 401861108173736m_-7434075047681755444m_2511139720383718180cremed m_403540186= 1108173736m_-7434075047681755444cremed cremed">.  "nbf" (Not Before) Claim

 
 =

   The "nbf" (not before) claim identifies the time bef=
ore which the JWT
   MUST NOT be accepted f=
or processing.  The processing of the "nbf"
&nb=
sp;  claim requires that the current date/time MUST be after or equal t=
o
   the not-before date/time listed in th=
e "nbf" claim.  Implementers MAY
   p=
rovide for some small leeway, usually no more than a few minutes, to<=
u>
   account for clock skew.  Its value MUST b=
e a number containing a
   NumericDate val=
ue.  Use of this claim is OPTIONAL.

 

=  

As defined in SET:= 

   nbf
&=
nbsp;     Defined by Section 4.1.5 [RFC7519], a number whose value is a<=
u>
      NumericDate.  In the co=
ntext of the SET token it SHALL be
   =
;   interpreted to mean a date in which the event is believed to h=
ave
      occurred (in the p=
ast) or will occur in the future.  Note: there
=
      MAY be some cases where "nbf" is still smalle=
r than "iat" such as
      w=
hen it took an extended time for a SET to be issued (for example
      after some analysis).  This=
 claim is OPTIONAL.

 =

There is an argument t= hat the redefinition will cause confusion. 

 

The proposal is to register a different claim name such as =E2=80=9Cto= e=E2=80=9D (time of event). The proposed new

definition:

 

toe
&n=
bsp;     Defined by Section 4.1.5 [RFC7519], a number whose value is a<=
u>
      NumericDate.  The value=
 is the date and time in which the event is believed to have
      occurred in the past or will occur i=
n the future. This claim is OPTIONAL.
  &n=
bsp;   When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY b=
e assumed to be the value of =E2=80=9Ciat=E2=80=9D.
=
 
nbf
   =
;   This claim is not used in SET Events. If asserted, the value S=
HOULD
      be ignored.<=
/u>
 
 
Are there any objections to the proposed change?
 
=

<=
div>
Phil
 
Oracle Corporation, Identity Cloud Services Archite=
ct
@independ=
entid
=

phil.hunt@oracle.com
=

 


___________________________________________= ____
Id-event mailing list
Id-e= vent@ietf.org
https://www.ietf.o= rg/mailman/listinfo/id-event

 

CONFIDENTIALITY NOTICE: This em= ail may contain confidential and privileged material for the sole use of the= intended recipient(s). Any review, use, distribution or disclosure by other= s is strictly prohibited.  If you have received this communication in e= rror, please notify the sender immediately by e-mail and delete the message a= nd any file attachments from your computer. Thank you.=


___________________= ____________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinf= o/id-event


_______________________________________________Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D



<= /div>
= --Apple-Mail-57A6FCEB-9E0D-4F0F-A400-E458C057A64B-- From nobody Wed Oct 25 14:53:25 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A71A13F47A for ; Wed, 25 Oct 2017 14:53:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bDPO73E8RAVu for ; Wed, 25 Oct 2017 14:53:19 -0700 (PDT) Received: from mail-it0-x22a.google.com (mail-it0-x22a.google.com [IPv6:2607:f8b0:4001:c0b::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57A8F139561 for ; Wed, 25 Oct 2017 14:53:19 -0700 (PDT) Received: by mail-it0-x22a.google.com with SMTP id f187so2901451itb.1 for ; Wed, 25 Oct 2017 14:53:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9RTuzT/fPKxUQ+rzx3YPJtf5ntTfYZ0B56OHjngB0gY=; b=M5Fq+Jdymk3qYXnCgAhvBRcIqRtPRMMH28D2T67xb5zwQLMUFqUnul2p+b5ika2HIU 1j6XN6YYr6CTKjxBFeV5KID10gdciHELqkRRqDZ12NbHWR1iwslBp2qN/tDJPA70zknV bPlb/QQmeRokxg1O2W2P61AHx8Ydwe9vFmPtrCKIDfqYrFy0DeXpCnGlbORzk39t+YMZ qS6jP/B0RKTYQVhUjeG/jVMKjNvc3nhohSOFm9+ql1u0d7/sSaDZUSkzPEbf+PKbL92Z lGGRrZ6/tnaUPN73d3JljaWHMVjM4vkL9ARH7qPWo1vnifxk4UPpAb0tSG+S7FeUk3dW 3kzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9RTuzT/fPKxUQ+rzx3YPJtf5ntTfYZ0B56OHjngB0gY=; b=bL8bykt9q2DPi2fZKdteBpu4XCK2JVQUGPM4WDI59HdSaMsoy7q0Q9luEO/TjBUIQV 6iAc0UBCDpkNrVwWVOtMobk6PB9I9EuIGWlxVnUb3K6glyXL624+joEEll8Ks9OaGJr0 G1vBE4Pw3nqfI3S4iEzClgkXv+EeRYXmt8PirdiKDOtbZVKR93nwh5fED7F9k+AcUke6 5JZmu0qyR5g+7fGoD+/axzFVMN8IFzHg11zh7JpOTPiHfvob+czM/KVSAKBxvF83vHg7 kfL3Fmi1JgcHNBXFyrZ9cEqLS4MHIUE/Z7yi506VWhkC5aTi4bWJ6hV9Y3dyTBh/h8ff IPUA== X-Gm-Message-State: AMCzsaUgcptBKefHcHSIg0/amDHocJiab+ppkm033N8NTJ7TMKgVieL5 d16Us8mLogLJ5SsOzTdbdwTjayEebThcajkH05GMOg== X-Google-Smtp-Source: ABhQp+Q6KKMvxTDlMapvGMhYfHvtWbK8kPk8b1r/XL29f+8VtWRw86oVtYZYUo63AvR5uRR1i8mdF0Hx7o0+4+veBbA= X-Received: by 10.36.105.65 with SMTP id e62mr4036280itc.16.1508968398160; Wed, 25 Oct 2017 14:53:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Wed, 25 Oct 2017 14:52:57 -0700 (PDT) In-Reply-To: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> From: Marius Scurtescu Date: Wed, 25 Oct 2017 14:52:57 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List Content-Type: multipart/alternative; boundary="001a1144528459ffd4055c66157c" Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 21:53:23 -0000 --001a1144528459ffd4055c66157c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) wrote: > > Are you proposing A with a should/recommended? > Yes > > It is more consistent but adds a lot of duplication in many cases where > iat =3D toe. > I don't think that should be a problem. > > Phil > > On Oct 25, 2017, at 2:07 PM, Marius Scurtescu > wrote: > > On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) > wrote: > >> If an event doesn't have a time, did it occur? >> > > At undisclosed time and location :-) > > I think it is fine for "toe" to be SHOULD/RECOMMENDED, but not > MUST/REQUIRED. > > >> Phil >> >> On Oct 25, 2017, at 1:58 PM, Marius Scurtescu >> wrote: >> >> As I said, I totally agree it is useful. But why required? >> >> Marius >> >> On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) >> wrote: >> >>> In some cases, ordering of events against a single subject matters. Tim= e >>> is useful for this purpose though limited in the overall stream for >>> ordering events overall. >>> >>> For example account locked vs unlocked. Knowing what happened last woul= d >>> seem important no? >>> >>> Phil >>> >>> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu >>> wrote: >>> >>> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt >>> wrote: >>> >>>> It is not clear how to revise the document with regards to the >>>> suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80= =9D is not asserted. >>>> >>>> If I remove this clarification, it seems unclear what the time of the >>>> event is defined as. There seem to be two options: >>>> >>>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time of= event, then =E2=80=9Ctoe=E2=80=9D should >>>> be a required claim. >>>> >>> >>> Why? Why can't the Transmitter assert that an account was disabled and >>> not provide a specific event time? I understand that an event time is >>> desirable, but why required? >>> >>> >>> >>>> >>>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly us= ed to mark SET >>>> issuance and event time. =E2=80=9Ctoe=E2=80=9D is only needed when th= e time of the event >>>> is different (on an exceptional basis). >>>> >>> >>> If SET issuance and event time are indeed the same then both claims >>> should be present. I don't think iat should imply toe. >>> >>> >>>> >>>> Some clarification from the group would be appreciated. Should we >>>> proceed with B, or revise the text to A (or some other proposal). >>>> >>>> Thanks, >>>> >>>> Phil >>>> >>>> Oracle Corporation, Identity Cloud Services Architect >>>> @independentid >>>> www.independentid.com >>>> >>>> phil.hunt@oracle.com >>>> >>>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu >>>> wrote: >>>> >>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle < >>>> richanna@amazon.com> wrote: >>>> >>>>> Agreed overall. Having reread the proposed text, I suggest striking >>>>> the last sentence, =E2=80=9CWhen not asserted, the value of =E2=80=9C= toe=E2=80=9D MAY be assumed to >>>>> be the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is = necessary or particularly >>>>> helpful to standardize the semantics of a missing time-of-event claim= at >>>>> the SET level. >>>>> >>>> >>>> +1 >>>> >>>> >>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> Annabelle Richard Backman >>>>> >>>>> Amazon =E2=80=93 Identity Services >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> *From: *Id-event on behalf of "Phil Hunt >>>>> (IDM)" >>>>> *Date: *Monday, October 23, 2017 at 5:48 PM >>>>> *To: *Mike Jones >>>>> *Cc: *Brian Campbell , ID Events Mailing >>>>> List >>>>> >>>>> *Subject: *Re: [Id-event] Replacing "nbf" claim with a new "toe" clai= m >>>>> >>>>> >>>>> >>>>> Agreed +1 on Brian's edits. >>>>> >>>>> Phil >>>>> >>>>> >>>>> On Oct 23, 2017, at 5:05 PM, Mike Jones >>>>> wrote: >>>>> >>>>> Annabelle and I agreed with this proposed change (as correctly >>>>> wordsmithed by Brian) during our in-person review =E2=80=93 as also n= oted in the >>>>> reply to Marius=E2=80=99 comments. >>>>> >>>>> >>>>> >>>>> Thank= s >>>>> Phil and all, >>>>> >>>>> -- >>>>> Mike >>>>> >>>>> >>>>> >>>>> *From:* Id-event [mailto:id-event-bounces@ietf.org >>>>> ] *On Behalf Of *Brian Campbell >>>>> *Sent:* Thursday, September 28, 2017 8:23 AM >>>>> *To:* Phil Hunt >>>>> *Cc:* ID Events Mailing List >>>>> *Subject:* Re: [Id-event] Replacing "nbf" claim with a new "toe" clai= m >>>>> >>>>> >>>>> >>>>> +1 to SET defining a time of event claim rather than trying to >>>>> redefine a standard claim. And who doesn't like a claim named "toe"? >>>>> >>>>> However, the text there for nbf is still effectively redefining it by >>>>> saying it should be ignored, which isn't consistent with the "MUST NO= T be >>>>> accepted for processing" from RFC 7519. It would be more appropriate = to say >>>>> that nbf should/must not be included in a SET. Or just not mention nb= f at >>>>> all. But don't change the meaning. >>>>> >>>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which is >>>>> the nbf section. The value of the toe claim is a NumericDate, which i= s >>>>> defined in Sec 2 RFC7519. But toe has no relation to nbf and no reaso= n to >>>>> reference nbf. >>>>> >>>>> >>>>> >>>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt >>>>> wrote: >>>>> >>>>> During the OpenID RISC Face to Face meeting a question came up >>>>> regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whe= ther that redefinition was >>>>> appropriate. >>>>> >>>>> >>>>> >>>>> The intention of SETs definition is to allow SET Transmitters to >>>>> indicate that an event may have occurred as early as a specified date= =E2=80=94 a >>>>> date which is different from the issuance date of the SET. In particu= lar >>>>> this is useful in cases where the state change is believed to have oc= curred >>>>> earlier than the time of issuance (e.g. because the incident was disc= overed >>>>> through an administrative review or data analysis to have occurred in= the >>>>> past). >>>>> >>>>> >>>>> >>>>> The definition from JWT is: >>>>> 4.1.5 >>>>> . >>>>> "nbf" (Not Before) Claim >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> The "nbf" (not before) claim identifies the time before which the = JWT >>>>> >>>>> MUST NOT be accepted for processing. The processing of the "nbf" >>>>> >>>>> claim requires that the current date/time MUST be after or equal t= o >>>>> >>>>> the not-before date/time listed in the "nbf" claim. Implementers = MAY >>>>> >>>>> provide for some small leeway, usually no more than a few minutes,= to >>>>> >>>>> account for clock skew. Its value MUST be a number containing a >>>>> >>>>> NumericDate value. Use of this claim is OPTIONAL. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> As defined in SET: >>>>> >>>>> nbf >>>>> >>>>> Defined by Section 4.1.5 [RFC7519] , a number whose v= alue is a >>>>> >>>>> NumericDate. In the context of the SET token it SHALL be >>>>> >>>>> interpreted to mean a date in which the event is believed to ha= ve >>>>> >>>>> occurred (in the past) or will occur in the future. Note: ther= e >>>>> >>>>> MAY be some cases where "nbf" is still smaller than "iat" such = as >>>>> >>>>> when it took an extended time for a SET to be issued (for examp= le >>>>> >>>>> after some analysis). This claim is OPTIONAL. >>>>> >>>>> >>>>> >>>>> There is an argument that the redefinition will cause confusion. >>>>> >>>>> >>>>> >>>>> The proposal is to register a different claim name such as =E2=80=9Ct= oe=E2=80=9D (time >>>>> of event). The proposed new >>>>> >>>>> definition: >>>>> >>>>> >>>>> >>>>> toe >>>>> >>>>> Defined by Section 4.1.5 [RFC7519] , a number whose v= alue is a >>>>> >>>>> NumericDate. The value is the date and time in which the event= is believed to have >>>>> >>>>> occurred in the past or will occur in the future. This claim is= OPTIONAL. >>>>> >>>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be as= sumed to be the value of =E2=80=9Ciat=E2=80=9D. >>>>> >>>>> >>>>> >>>>> nbf >>>>> >>>>> This claim is not used in SET Events. If asserted, the value SH= OULD >>>>> >>>>> be ignored. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> Are there any objections to the proposed change? >>>>> >>>>> >>>>> >>>>> Phil >>>>> >>>>> >>>>> >>>>> Oracle Corporation, Identity Cloud Services Architect >>>>> >>>>> @independentid >>>>> >>>>> www.independentid.com >>>>> >>>>> >>>>> phil.hunt@oracle.com >>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>>>> privileged material for the sole use of the intended recipient(s). An= y >>>>> review, use, distribution or disclosure by others is strictly prohibi= ted. >>>>> If you have received this communication in error, please notify the s= ender >>>>> immediately by e-mail and delete the message and any file attachments= from >>>>> your computer. Thank you.* >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>>> WwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w >>>>> &s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D >>>>> >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>> >>>>> >>>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>> WwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM >>>> &s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D >>>> >>>> >>>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN9T_TyM3tQ98EeI6-1v8uDSW5PqIw >>> &s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e=3D >>> >>> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPIa2k868J7D8w8RkO4wx0rjYi8wNo >> w&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338FdapSY&e=3D >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > 3xoRnYeAqgWRqvjmh1fFBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQb1_ > w6_6zUlq8CPRkegi1x_3G-knlbZk6kE&e=3D > > --001a1144528459ffd4055c66157c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On W= ed, Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) <phil.hu= nt@oracle.com> wrote:

Are you proposing A with a should/recommended?

Yes

=C2=A0

= It is more consistent but adds a lot of duplication in many cases where iat= =3D toe.=C2=A0

I don't= think that should be a problem.

=C2=A0

Phil

On Oct 2= 5, 2017, at 2:07 PM, Marius Scurtescu <mscurtescu@google.com> wr= ote:

On Wed, Oct 25, 2017 at 2:02 P= M, Phil Hunt (IDM) <phil.h= unt@oracle.com> wrote:
If an event doesn't have a time, did it occur?

At undisclosed time and location= :-)

I think it is fine for "toe" to be = SHOULD/RECOMMENDED, but not MUST/REQUIRED.


Phil

On Oct 25, 2017, at 1:58 PM, Marius Scurt= escu <mscurtescu@google.com> wrote:<= br>
As I said, I t= otally agree it is useful. But why required?

Marius

On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (= IDM) <phil.hunt@oracle.com= > wrote:
=
In some cases, ordering of events against a single subject matters. Ti= me is useful for this purpose though limited in the overall stream for orde= ring events overall.=C2=A0

For example account locked vs unlocked. Knowing what happened last w= ould seem important no?

Phil

On Oct 25, 2017, at 1:46 PM, Marius= Scurtescu <mscurtescu@google.com> w= rote:

On Wed, Oct 25, 2017 at 11:09= AM, Phil Hunt <phil.hunt@orac= le.com> wrote:
It is not clear how to revise the document with r= egards to the suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9C= toe=E2=80=9D is not asserted.=C2=A0

If I remove this cla= rification, it seems unclear what the time of the event is defined as.=C2= =A0 There seem to be two options:

A. If =E2=80=9Ciat=E2= =80=9D can=E2=80=99t be assumed to be the time of event, then =E2=80=9Ctoe= =E2=80=9D should be a required claim.
Why? Why can't the Transmitter assert that an account was = disabled and not provide a specific event time? I understand that an event = time is desirable, but why required?

=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">

B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is = commonly used to mark SET issuance and event time. =C2=A0=E2=80=9Ctoe=E2=80= =9D is only needed when the time of the event is different (on an exception= al basis).

If SET issuanc= e and event time are indeed the same then both claims should be present. I = don't think iat should imply toe.
=C2=A0

Some clarification from the group would be appreciated.=C2=A0 Should= we proceed with B, or revise the text to A (or some other proposal).
=

Thanks,

Phil

Orac= le Corporation, Identity Cloud Services Architect
@independentid<= /div>
phil.hunt@oracle.com

On Oct 23, 2017,= at 6:15 PM, Marius Scurtescu <mscurtescu@googl= e.com> wrote:

On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Anna= belle=C2=A0<richanna@amazon.com>=C2=A0wrote:

Agreed overall. Having reread the proposed = text, I suggest striking the last sentence, =E2=80=9CWhen not asserted, the= value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9C= iat=E2=80=9D.=E2=80=9D I do not think it is necessary or particularly helpf= ul to standardize the semantics of a missing time-of-event claim at the SET= level.


+1

=C2=A0

=C2=A0

--=C2=A0

Annabelle Richard Backman<= /u>

Amazon =E2=80=93 Identity Services<= /u>

=C2=A0

<= p class=3D"MsoNormal">=C2=A0

Fro= m:=C2=A0<= span style=3D"font-size:12pt">Id-event <id-event-bounces@ietf.org> on behalf of "Phil Hun= t (IDM)" <phil.hunt@oracle= .com>
Date:=C2= =A0Monday, October 23, 2017 at 5:48 PM
To:=C2=A0Mike Jones <Michael.Jones@microsoft.com>Cc:=C2=A0Bri= an Campbell <bcampbell@pi= ngidentity.com>, ID Events Mailing List <id-event@ietf.org>


Subject:=C2= =A0Re: [Id-event] Replacing "nbf" claim with a new &qu= ot;toe" claim

=C2=A0

Agreed +1 on Brian's edits.=C2=A0

Phil


On Oct 23, 2= 017, at 5:05 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Annabelle and I agreed with this pro= posed change (as correctly wordsmithed by Brian) during our in-person revie= w =E2=80=93 as also noted in the reply to Marius=E2=80=99 comments.<= u>

= =C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- Mike

=C2=A0

From:=C2=A0Id-event [mailto:id-event-bounces@ietf.org]=C2=A0On Behalf Of=C2=A0Brian Campbell
Sen= t:=C2=A0Thursday= , September 28, 2017 8:23 AM
To:=C2=A0Phil Hunt <phil.hunt@oracle.com>
Cc:=C2=A0ID Events Mailing List <id-event@ietf.org>
Subject:=C2=A0Re: [Id-event] Repl= acing "nbf" claim with a new "toe" claim<= /p>

=C2=A0

+1 to SET defining a time of ev= ent claim rather than trying to redefine a standard claim. And who doesn= 9;t like a claim named "toe"?

However, the text there for nbf is = still effectively redefining it by saying it should be ignored, which isn&#= 39;t consistent with the "MUST NOT be accepted for processing" fr= om RFC 7519. It would be more appropriate to say that nbf should/must not b= e included in a SET. Or just not mention nbf at all. But don't change t= he meaning.

Also toe would no= t be "Defined by Section 4.1.5 [RFC7519]", which is the nbf secti= on. The value of the toe claim is a NumericDate, which is defined in Sec 2 = RFC7519. But toe has no relation to nbf and no reason to reference nbf.=C2= =A0

=C2=A0=

On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt = <phil.hunt@oracle.com> w= rote:

During the O= penID RISC Face to Face meeting a question came up regarding SET=E2=80=99s = redefinition of =E2=80=9Cnbf=E2=80=9D and whether that redefinition was app= ropriate.

=C2=A0=

The intention of SETs definition is t= o allow SET Transmitters to indicate that an event may have occurred as ear= ly as a specified date =E2=80=94 a date which is different from the issuanc= e date of the SET. In particular this is useful in cases where the state ch= ange is believed to have occurred earlier than the time of issuance (e.g. b= ecause the incident was discovered through an administrative review or data= analysis to have occurred in the past).

=C2=A0

= The definition from JWT is:

4.1.5.=C2=A0 "nbf&= quot; (Not Before) Claim

=C2=A0=

=C2=A0
=C2=A0=C2=A0 The "nbf" =
(not before) claim identifies the time before which the JWT
=C2=A0=C2=A0 MUST NOT be accepted for processing.=C2=A0 The proces=
sing of the "nbf"
=C2=A0=C2=A0 claim requ=
ires that the current date/time MUST be after or equal to
=C2=A0=C2=A0 the not-before date/time listed in the "nbf" =
claim.=C2=A0 Implementers MAY
=C2=A0=C2=A0 provide =
for some small leeway, usually no more than a few minutes, to=

=C2=A0=C2=A0 account for clock skew.=C2=A0 Its value MUST be a n=
umber containing a
=C2=A0=C2=A0 NumericDate value.=
=C2=A0 Use of this claim is OPTIONAL.
=C2=A0

= =C2=A0

As defined in SET= :

=C2=A0=C2=A0 nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Section=C2=A04.1.5 [RFC7519], a number whose value is a
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 In=
 the context of the SET token it SHALL be
=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 interpreted to mean a date in which the event is beli=
eved to have
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occurre=
d (in the past) or will occur in the future.=C2=A0 Note: there
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 MAY be some cases where "nb=
f" is still smaller than "iat" such as
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 when it took an extended time for a SET t= o be issued (for example
=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 after some analysis).=C2=A0 This claim is OPTIONAL.
=C2=A0

There is an argument that the redefinition will cause c= onfusion.=C2=A0

=C2=A0

The proposal is to regist= er a different claim name such as =E2=80=9Ctoe=E2=80=9D (time of event). Th= e proposed new

definitio= n:

=C2=A0<= /p>

toe
=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 Defined by Section=C2=A04=
.1.5 [RFC7519], a number whose value is a
=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 The value is the date and ti=
me in which the event is believed to have
=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 occurred in the past or will occur in the future. Thi=
s claim is OPTIONAL.
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
 When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be=
 the value of =E2=80=9Ciat=E2=80=9D.
=C2=A0<=
u>
nbf
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
 This claim is not used in SET Events. If asserted, the value SHOULD=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 be ignored.<=
/pre>
=C2=A0
<= p class=3D"MsoNormal">=C2=A0

Are there any objections to the proposed change?

=C2=A0

=
=

Phil

<= p class=3D"MsoNormal">=C2=A0

Oracle Corporation, Identity Cloud Services Archite= ct

@indepen= dentid

phil.hunt@oracle.com

=C2=A0


___________________________________= ____________
Id-event mailing list
Id-event@ietf.org
http= s://www.ietf.org/mailman/listinfo/id-event

=C2=A0


CONF= IDENTIALITY NOTICE: This email may contain confidential and privileged mate= rial for the sole use of the intended recipient(s). Any review, use, distri= bution or disclosure by others is strictly prohibited.=C2=A0 If you have re= ceived this communication in error, please notify the sender immediately by= e-mail and delete the message and any file attachments from your computer.= Thank you.


_______________________________________________=
Id-event mailing list
Id-event= @ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_____________= __________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u= =3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwI= CAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJ= Bm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Yg= d5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau= 4BHf7-JFfe7mYpBY&e=3D


<= /div>



--001a1144528459ffd4055c66157c-- From nobody Wed Oct 25 14:58:58 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D45C31394F2 for ; Wed, 25 Oct 2017 14:58:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7 X-Spam-Level: X-Spam-Status: No, score=-7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sv7qk-VutM5E for ; Wed, 25 Oct 2017 14:58:53 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79147139F44 for ; Wed, 25 Oct 2017 14:58:53 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9PLwmG8002744 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 21:58:49 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9PLwmpJ029061 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 25 Oct 2017 21:58:48 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9PLwlbC026422; Wed, 25 Oct 2017 21:58:47 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 25 Oct 2017 14:58:46 -0700 From: Phil Hunt Message-Id: <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_620C089B-1E26-4242-8743-9FB73CEA8404" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 25 Oct 2017 14:58:44 -0700 In-Reply-To: Cc: "Richard Backman, Annabelle" , Brian Campbell , Mike Jones , ID Events Mailing List To: Marius Scurtescu References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 21:58:57 -0000 --Apple-Mail=_620C089B-1E26-4242-8743-9FB73CEA8404 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 OK=E2=80=A6.unless there is objection, I will revise the draft so that = =E2=80=9Ctoe=E2=80=9D will become a recommended attribute. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 25, 2017, at 2:52 PM, Marius Scurtescu = wrote: >=20 > On Wed, Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) > wrote: >=20 > Are you proposing A with a should/recommended? >=20 > Yes >=20 > =20 >=20 > It is more consistent but adds a lot of duplication in many cases = where iat =3D toe.=20 >=20 > I don't think that should be a problem. >=20 > =20 >=20 > Phil >=20 > On Oct 25, 2017, at 2:07 PM, Marius Scurtescu > wrote: >=20 >> On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) = > wrote: >> If an event doesn't have a time, did it occur? >>=20 >> At undisclosed time and location :-) >>=20 >> I think it is fine for "toe" to be SHOULD/RECOMMENDED, but not = MUST/REQUIRED. >>=20 >>=20 >> Phil >>=20 >> On Oct 25, 2017, at 1:58 PM, Marius Scurtescu > wrote: >>=20 >>> As I said, I totally agree it is useful. But why required? >>>=20 >>> Marius >>>=20 >>> On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) = > wrote: >>> In some cases, ordering of events against a single subject matters. = Time is useful for this purpose though limited in the overall stream for = ordering events overall.=20 >>>=20 >>> For example account locked vs unlocked. Knowing what happened last = would seem important no? >>>=20 >>> Phil >>>=20 >>> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu > wrote: >>>=20 >>>> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt > wrote: >>>> It is not clear how to revise the document with regards to the = suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D = is not asserted.=20 >>>>=20 >>>> If I remove this clarification, it seems unclear what the time of = the event is defined as. There seem to be two options: >>>>=20 >>>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the time = of event, then =E2=80=9Ctoe=E2=80=9D should be a required claim. >>>>=20 >>>> Why? Why can't the Transmitter assert that an account was disabled = and not provide a specific event time? I understand that an event time = is desirable, but why required? >>>>=20 >>>> =20 >>>>=20 >>>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly = used to mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D is only = needed when the time of the event is different (on an exceptional = basis). >>>>=20 >>>> If SET issuance and event time are indeed the same then both claims = should be present. I don't think iat should imply toe. >>>> =20 >>>>=20 >>>> Some clarification from the group would be appreciated. Should we = proceed with B, or revise the text to A (or some other proposal). >>>>=20 >>>> Thanks, >>>>=20 >>>> Phil >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>> @independentid >>>> www.independentid.com = phil.hunt@o= racle.com >>>>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu = > wrote: >>>>>=20 >>>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle = > wrote: >>>>> Agreed overall. Having reread the proposed text, I suggest = striking the last sentence, =E2=80=9CWhen not asserted, the value of = =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80= =9D.=E2=80=9D I do not think it is necessary or particularly helpful to = standardize the semantics of a missing time-of-event claim at the SET = level. >>>>>=20 >>>>>=20 >>>>> +1 >>>>>=20 >>>>> =20 >>>>>=20 >>>>> =20 >>>>>=20 >>>>> --=20 >>>>>=20 >>>>> Annabelle Richard Backman >>>>>=20 >>>>> Amazon =E2=80=93 Identity Services >>>>>=20 >>>>> =20 >>>>>=20 >>>>> =20 >>>>>=20 >>>>> From: Id-event > on behalf of "Phil Hunt (IDM)" = > >>>>> Date: Monday, October 23, 2017 at 5:48 PM >>>>> To: Mike Jones > >>>>> Cc: Brian Campbell >, ID Events Mailing List = > >>>>>=20 >>>>>=20 >>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" = claim >>>>>=20 >>>>> =20 >>>>>=20 >>>>> Agreed +1 on Brian's edits.=20 >>>>>=20 >>>>> Phil >>>>>=20 >>>>>=20 >>>>> On Oct 23, 2017, at 5:05 PM, Mike Jones = > = wrote: >>>>>=20 >>>>> Annabelle and I agreed with this proposed change (as correctly = wordsmithed by Brian) during our in-person review =E2=80=93 as also = noted in the reply to Marius=E2=80=99 comments. >>>>>=20 >>>>> =20 >>>>>=20 >>>>> = Thanks Phil and all, >>>>>=20 >>>>> -- = Mike >>>>>=20 >>>>> =20 >>>>>=20 >>>>> From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Brian Campbell >>>>> Sent: Thursday, September 28, 2017 8:23 AM >>>>> To: Phil Hunt > >>>>> Cc: ID Events Mailing List > >>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" = claim >>>>>=20 >>>>> =20 >>>>>=20 >>>>> +1 to SET defining a time of event claim rather than trying to = redefine a standard claim. And who doesn't like a claim named "toe"? >>>>>=20 >>>>> However, the text there for nbf is still effectively redefining it = by saying it should be ignored, which isn't consistent with the "MUST = NOT be accepted for processing" from RFC 7519. It would be more = appropriate to say that nbf should/must not be included in a SET. Or = just not mention nbf at all. But don't change the meaning. >>>>>=20 >>>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", which = is the nbf section. The value of the toe claim is a NumericDate, which = is defined in Sec 2 RFC7519. But toe has no relation to nbf and no = reason to reference nbf.=20 >>>>>=20 >>>>> =20 >>>>>=20 >>>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt > wrote: >>>>>=20 >>>>> During the OpenID RISC Face to Face meeting a question came up = regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and = whether that redefinition was appropriate. >>>>>=20 >>>>> =20 >>>>>=20 >>>>> The intention of SETs definition is to allow SET Transmitters to = indicate that an event may have occurred as early as a specified date = =E2=80=94 a date which is different from the issuance date of the SET. = In particular this is useful in cases where the state change is believed = to have occurred earlier than the time of issuance (e.g. because the = incident was discovered through an administrative review or data = analysis to have occurred in the past). >>>>>=20 >>>>> =20 >>>>>=20 >>>>> The definition from JWT is: >>>>>=20 >>>>> 4.1.5 = <>. "nbf" (Not Before) Claim >>>>>=20 >>>>> =20 >>>>> =20 >>>>> The "nbf" (not before) claim identifies the time before which = the JWT >>>>> MUST NOT be accepted for processing. The processing of the = "nbf" >>>>> claim requires that the current date/time MUST be after or = equal to >>>>> the not-before date/time listed in the "nbf" claim. = Implementers MAY >>>>> provide for some small leeway, usually no more than a few = minutes, to >>>>> account for clock skew. Its value MUST be a number containing = a >>>>> NumericDate value. Use of this claim is OPTIONAL. >>>>> =20 >>>>>=20 >>>>> =20 >>>>>=20 >>>>> As defined in SET: >>>>>=20 >>>>> nbf >>>>> Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a >>>>> NumericDate. In the context of the SET token it SHALL be >>>>> interpreted to mean a date in which the event is believed to = have >>>>> occurred (in the past) or will occur in the future. Note: = there >>>>> MAY be some cases where "nbf" is still smaller than "iat" = such as >>>>> when it took an extended time for a SET to be issued (for = example >>>>> after some analysis). This claim is OPTIONAL. >>>>> =20 >>>>>=20 >>>>> There is an argument that the redefinition will cause confusion.=20= >>>>>=20 >>>>> =20 >>>>>=20 >>>>> The proposal is to register a different claim name such as = =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new >>>>>=20 >>>>> definition: >>>>>=20 >>>>> =20 >>>>>=20 >>>>> toe >>>>> Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a >>>>> NumericDate. The value is the date and time in which the = event is believed to have >>>>> occurred in the past or will occur in the future. This claim = is OPTIONAL. >>>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be = assumed to be the value of =E2=80=9Ciat=E2=80=9D. >>>>> =20 >>>>> nbf >>>>> This claim is not used in SET Events. If asserted, the value = SHOULD >>>>> be ignored. >>>>> =20 >>>>>=20 >>>>> =20 >>>>>=20 >>>>> Are there any objections to the proposed change? >>>>>=20 >>>>> =20 >>>>>=20 >>>>> Phil >>>>>=20 >>>>> =20 >>>>>=20 >>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>=20 >>>>> @independentid >>>>>=20 >>>>> www.independentid.com = >>>>> phil.hunt@oracle.com >>>>> =20 >>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>> =20 >>>>>=20 >>>>>=20 >>>>> CONFIDENTIALITY NOTICE: This email may contain confidential and = privileged material for the sole use of the intended recipient(s). Any = review, use, distribution or disclosure by others is strictly = prohibited. If you have received this communication in error, please = notify the sender immediately by e-mail and delete the message and any = file attachments from your computer. Thank you. >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlH= OMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VO= N8&e=3D = >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd= 5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYp= BY&e=3D = >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN= 9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8a= xU&e=3D = =20 >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPI= a2k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338Fdap= SY&e=3D = =20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D3xoRnYeAqgWRqvj= mh1fFBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQb1_w6_6zUlq8CPRkegi1x_3G-knlbZk6= kE&e=3D = =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DG7gI1TT37IHsNVh= TNm8SVkvFsD3lZrMqjkCCQRflMqE&s=3DzFIfIcUn_tP00p6yc2nLmuvlLZKhAZXv-rJr4iK0d= -Y&e=3D = --Apple-Mail=_620C089B-1E26-4242-8743-9FB73CEA8404 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 OK=E2=80=A6.unless there is objection, I will revise the = draft so that =E2=80=9Ctoe=E2=80=9D will become a recommended = attribute.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 25, 2017, at 2:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, = Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:

Are you = proposing A with a should/recommended?

Yes

 

It is more consistent but adds a lot of duplication in many = cases where iat =3D toe. 

I don't think that = should be a problem.

 

Phil
On Oct 25, 2017, at 2:07 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt = (IDM) <phil.hunt@oracle.com> wrote:
If an event doesn't have a time, = did it occur?

At undisclosed time and location = :-)

I think it = is fine for "toe" to be SHOULD/RECOMMENDED, but not = MUST/REQUIRED.


Phil

On Oct = 25, 2017, at 1:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

As I said, I totally agree it is = useful. But why required?

Marius

On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt = (IDM) <phil.hunt@oracle.com> wrote:
In some cases, ordering of = events against a single subject matters. Time is useful for this purpose = though limited in the overall stream for ordering events = overall. 

For example account locked vs unlocked. = Knowing what happened last would seem important no?

Phil
On Oct 25, 2017, at 1:46 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
It is not clear how to = revise the document with regards to the suggestion against using = =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not = asserted. 

If I = remove this clarification, it seems unclear what the time of the event = is defined as.  There seem to be two options:

A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t= be assumed to be the time of event, then =E2=80=9Ctoe=E2=80=9D should = be a required claim.

Why? Why can't the Transmitter assert = that an account was disabled and not provide a specific event time? I = understand that an event time is desirable, but why required?

 

B. For the majority of use cases, = =E2=80=9Ciat=E2=80=9D is commonly used to mark SET issuance and event = time.  =E2=80=9Ctoe=E2=80=9D is only needed when the time of the = event is different (on an exceptional = basis).

If SET issuance and event time are = indeed the same then both claims should be present. I don't think iat = should imply toe.
 

Some clarification from = the group would be appreciated.  Should we proceed with B, or = revise the text to A (or some other proposal).

Thanks,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
= phil.hunt@oracle.com

On Oct 23, 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Mon, = Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle <richanna@amazon.com> wrote:

Agreed overall. Having reread the proposed text, I = suggest striking the last sentence, =E2=80=9CWhen not asserted, the = value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of = =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is necessary or = particularly helpful to standardize the semantics of a missing = time-of-event claim at the SET level.


+1

 

 

-- 

Annabelle Richard Backman

Amazon =E2=80=93= Identity Services

 

 

From: Id-event <id-event-bounces@ietf.org> on behalf of "Phil = Hunt (IDM)" <phil.hunt@oracle.com>
Date: Monday, = October 23, 2017 at 5:48 PM
To: Mike Jones = <Michael.Jones@microsoft.com>
Cc: Brian = Campbell <bcampbell@pingidentity.com>, ID Events Mailing = List <id-event@ietf.org>


Subject: Re: = [Id-event] Replacing "nbf" claim with a new "toe" claim

 

Agreed +1 on Brian's edits. 

Phil


On Oct 23, 2017, at 5:05 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Annabelle and I agreed with this proposed change (as = correctly wordsmithed by Brian) during our in-person review =E2=80=93 as = also noted in the reply to Marius=E2=80=99 comments.

 

          &nb= sp;            = ;                 &nb= sp;            = ;           Thanks Phil and = all,

          &nb= sp;            = ;                 &nb= sp;            = ;           -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.org] On = Behalf Of Brian = Campbell
Sent: Thursday, = September 28, 2017 8:23 AM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: ID Events = Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim

 

+1 to SET defining a = time of event claim rather than trying to redefine a standard claim. And = who doesn't like a claim named "toe"?

However, the text there for nbf is still effectively redefining = it by saying it should be ignored, which isn't consistent with the "MUST = NOT be accepted for processing" from RFC 7519. It would be more = appropriate to say that nbf should/must not be included in a SET. Or = just not mention nbf at all. But don't change the meaning.

Also = toe would not be "Defined by Section 4.1.5 [RFC7519]", which is the nbf = section. The value of the toe claim is a NumericDate, which is defined = in Sec 2 RFC7519. But toe has no relation to nbf and no reason to = reference nbf. 

 

On Wed, Sep = 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com> = wrote:

During the OpenID RISC Face to Face meeting a = question came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80= =9D and whether that redefinition was appropriate.

 

The intention of SETs definition is to allow SET = Transmitters to indicate that an event may have occurred as early as a = specified date =E2=80=94 a date which is different from the issuance = date of the SET. In particular this is useful in cases where the state = change is believed to have occurred earlier than the time of issuance = (e.g. because the incident was discovered through an administrative = review or data analysis to have occurred in the past).

 

The definition from JWT is:

4.1.5.  "nbf" (Not = Before) Claim

 
 
   The "nbf" (not before) claim identifies the time =
before which the JWT
   MUST NOT be accepted for processing.  The =
processing of the "nbf"
   claim requires that the current date/time MUST =
be after or equal to
   the not-before date/time listed in the "nbf" =
claim.  Implementers MAY
   provide for some small =
leeway, usually no more than a few minutes, to
   account for clock =
skew.  Its value MUST be a number containing a
   NumericDate =
value.  Use of this claim is OPTIONAL.

 

 

As = defined in SET:

   nbf
      =
Defined by Section 4.1.5 =
[RFC7519], a number whose value is a
      =
NumericDate.  In the context of the SET token it SHALL be
      interpreted to mean a date in =
which the event is believed to have
      =
occurred (in the past) or will occur in the future.  Note: there
      MAY be some cases where "nbf" =
is still smaller than "iat" such as
      when =
it took an extended time for a SET to be issued (for example
      after some analysis).  =
This claim is OPTIONAL.

 

There is an argument that the redefinition will = cause confusion. 

 

The = proposal is to register a different claim name such as =E2=80=9Ctoe=E2=80=9D= (time of event). The proposed new

definition:

 

toe
      Defined by Section 4.1.5 =
[RFC7519], a number whose value is a
      =
NumericDate.  The value is the date and time in which the event is =
believed to have
      occurred in the past or will =
occur in the future. This claim is OPTIONAL.
      When =
not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be =
the value of =E2=80=9Ciat=E2=80=9D.
 
nbf
      This =
claim is not used in SET Events. If asserted, the value SHOULD
      be ignored.

 

 

Are = there any objections to the proposed change?

 

Phil

 

Oracle Corporation, Identity Cloud = Services Architect

@independentid

www.independentid.com

phil.hunt@oracle.com

<= /div>

 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 


CONFIDENTIALITY NOTICE: This email = may contain confidential and privileged material for the sole use of the = intended recipient(s). Any review, use, distribution or disclosure by = others is strictly prohibited.  If you have received this = communication in error, please notify the sender immediately by e-mail = and delete the message and any file attachments from your computer. = Thank you.

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPIa2k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338FdapSY&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D3xoRnYeAqgWRqvjmh1fFBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQb1_w6_6zUlq8CPRkegi1x_3G-knlbZk6kE&e=3D 

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DG7gI1TT37IHsNVhTNm8SVkvFsD3lZrMqjkCCQRflMqE&s=3DzFIfIcUn_t= P00p6yc2nLmuvlLZKhAZXv-rJr4iK0d-Y&e=3D
= --Apple-Mail=_620C089B-1E26-4242-8743-9FB73CEA8404-- From nobody Wed Oct 25 15:09:04 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DAF713F486 for ; Wed, 25 Oct 2017 15:09:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kFjbAN3cQRrG for ; Wed, 25 Oct 2017 15:08:58 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0109.outbound.protection.outlook.com [104.47.37.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7679413A5D2 for ; Wed, 25 Oct 2017 15:08:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wemMz3yv1yZi4BAqfY53F83OmR35eVBq2NIWGY3JKiU=; b=hkWKA4txETD2EcBPzBCa8dkvR3V1ezEe/2396tOnwnFPAsCGe5xDKf5jpw+KnRO/YiVx0J73qe5i1wcUjjWqdmYs6R7MMMUrlMAw1P7NAs/jKmN6JhGMpt3aS0jwrM57pRo75gNRbenYMadb/0eEfkokqzioLP+/0InyN0yZMBQ= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0165.namprd21.prod.outlook.com (10.173.192.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.197.0; Wed, 25 Oct 2017 22:08:56 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0197.004; Wed, 25 Oct 2017 22:08:56 +0000 From: Mike Jones To: Phil Hunt , Marius Scurtescu CC: "Richard Backman, Annabelle" , Brian Campbell , ID Events Mailing List Thread-Topic: [Id-event] Replacing "nbf" claim with a new "toe" claim Thread-Index: AQHTN9KpAILmSZE0GUKb7XxJ9mLviKLKa5QAgCfaOrCAAA3yAIAABJuAgAADIYCAAq3GAIAAK9sAgAAClQCAAACogIAAAQaAgAABe4CAAAp9gIAAAj6AgAABngCAAAJKQA== Date: Wed, 25 Oct 2017 22:08:56 +0000 Message-ID: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> In-Reply-To: <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:4898:80e8:c::f6] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0165; 6:3xOgryx+n7ru3WIxMij5BCZolMwCUBzbfjliFhqDOVJ//QACq2NFNDJSpI0zGeccG7LpUCswiQxE0rzKUW5lad9mYKn0a/kQKJ2S6pLHMavQhKvdWkClX6IA8IWliaOgdhStg3Tw/7kaF0gnTZG/elCoCSXZUDOGomRtgNF+h5MwXzJi6U1ICUK4j1yyqnWPXEU/+gmt3+BFtTlgLXiHoz+dXYx8U+qawL/Ph5GySt75A7f+aCzXnhrjmPYJv9QINFOEMPEKyj4Y3+vry4UfyT6cxb8eJMA03IvfuEIAAq1KuW3doLqlSCOqogEU7JAcBOmEHB2IL18RTs8CHJrNFdx+F5/UjUVy1JKccb1XAj8=; 5:qJ3J9oa96GtcnG9qjGFRtkKwkNuXRycp7GSWyEfliQ36KkAZy7f0jpBjj8MRJJBZ08HRgoWmQZSLeEOzKlnhOJfFoFs0dxqgFnMkfoGNLT0qpkbZrd5nJNTbUKZwyfKiRk+0hBSqOizY8/T0w/X5DAlqxqHRbnCzSEGQRCWB7rQ=; 24:JIc0HUC66MUHTF8cy25V9PrgNM/YrJaEuh693elR3/e3z7AavcVSTsdgYWV1KWEdfmoZp0mIr8rUYvx5Q7F4Vwj4XgE+iWeqd3p8/SRwGD0=; 7:R2FhwwS1008IlKQ+8TJnGZae26qqSjCn5MBkogLSjHaf7/9/QGVgzFLL4lgirKfSE4/4rjAg8G3bxx1iZ7Z+t2OnhiVJ2G52+qnCAWOtztVSeVAnEhyGS3O4CAh3oWFVZPvkY7O92N0FZnMWADmq4XSMoRIX5HXtW86vTHX/8x4UdwmtjCIlYq7sclfCgb9B0t+aODxMYFEB0TA7V7mQbzXbraiyAlaykXufY5bSgMjpLh/OExpp7yTVqg7sy536 x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 1c7dffac-4933-4487-bd9b-08d51bf4fc5d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603238); SRVR:CY4PR21MB0165; x-ms-traffictypediagnostic: CY4PR21MB0165: x-exchange-antispam-report-test: UriScan:(10436049006162)(89211679590171)(33061846794335)(211936372134217)(153496737603132)(21748063052155)(146099531331640)(47284530071512); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(10201501046)(3002001)(93006095)(93001095)(3231020)(920507026)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123562025)(20161123558100)(20161123564025)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0165; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0165; x-forefront-prvs: 0471B73328 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39860400002)(376002)(47760400005)(199003)(189002)(36304003)(24454002)(85644002)(86362001)(54906003)(5890100001)(1680700002)(6436002)(2950100002)(229853002)(316002)(77096006)(6506006)(8936002)(81166006)(34040400001)(81156014)(74316002)(8676002)(606006)(68736007)(8990500004)(53546010)(2900100001)(101416001)(14454004)(110136005)(561944003)(7736002)(76176999)(33656002)(54356999)(25786009)(50986999)(97736004)(6116002)(102836003)(72206003)(5660300001)(966005)(10290500003)(22452003)(105586002)(106356001)(54896002)(478600001)(790700001)(6306002)(93886005)(7696004)(19609705001)(10090500001)(575784001)(9686003)(236005)(2906002)(6246003)(53386004)(86612001)(53936002)(4326008)(3660700001)(3280700002)(189998001)(99286003)(55016002)(53946003)(579004)(559001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0165; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05047D4D677ACB9DFC82D412F5440CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1c7dffac-4933-4487-bd9b-08d51bf4fc5d X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Oct 2017 22:08:56.1183 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0165 Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2017 22:09:02 -0000 --_000_CY4PR21MB05047D4D677ACB9DFC82D412F5440CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SeKAmW0gT0sgd2l0aCB0aGlzLCBhcyBsb25nIGFzIHlvdSBhbHNvIGFkZCBhIGNsYXJpZnlpbmcg bm90ZSBhbG9uZyB0aGVzZSBsaW5lczoNCiAgICAgICAgICAgICAgTk9URTogIFNvbWUgcHJvZmls ZXMgbWF5IGNob29zZSB0byBvbWl0IOKAnHRvZeKAnSBhbmQgY29udmV5IGV2ZW50IHRpbWUgaW5m b3JtYXRpb24gd2l0aCB0aGUg4oCcaWF04oCdIG9yIG90aGVyIGNsYWltcy4NCg0KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0K RnJvbTogUGhpbCBIdW50IFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBXZWRu ZXNkYXksIE9jdG9iZXIgMjUsIDIwMTcgMjo1OSBQTQ0KVG86IE1hcml1cyBTY3VydGVzY3UgPG1z Y3VydGVzY3VAZ29vZ2xlLmNvbT4NCkNjOiBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSA8cmlj aGFubmFAYW1hem9uLmNvbT47IEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5 LmNvbT47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT47IElEIEV2ZW50 cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gUmVwbGFjaW5nICJuYmYiIGNsYWltIHdpdGggYSBuZXcgInRvZSIgY2xhaW0NCg0KT0vigKYu dW5sZXNzIHRoZXJlIGlzIG9iamVjdGlvbiwgSSB3aWxsIHJldmlzZSB0aGUgZHJhZnQgc28gdGhh dCDigJx0b2XigJ0gd2lsbCBiZWNvbWUgYSByZWNvbW1lbmRlZCBhdHRyaWJ1dGUuDQoNClBoaWwN Cg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QN CkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVu ZGVudGlkLmNvbT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xl LmNvbT4NCg0KT24gT2N0IDI1LCAyMDE3LCBhdCAyOjUyIFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxt c2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3Rl Og0KDQpPbiBXZWQsIE9jdCAyNSwgMjAxNyBhdCAyOjQ0IFBNLCBQaGlsIEh1bnQgKElETSkgPHBo aWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0K DQpBcmUgeW91IHByb3Bvc2luZyBBIHdpdGggYSBzaG91bGQvcmVjb21tZW5kZWQ/DQoNClllcw0K DQoNCg0KSXQgaXMgbW9yZSBjb25zaXN0ZW50IGJ1dCBhZGRzIGEgbG90IG9mIGR1cGxpY2F0aW9u IGluIG1hbnkgY2FzZXMgd2hlcmUgaWF0ID0gdG9lLg0KDQpJIGRvbid0IHRoaW5rIHRoYXQgc2hv dWxkIGJlIGEgcHJvYmxlbS4NCg0KDQoNClBoaWwNCg0KT24gT2N0IDI1LCAyMDE3LCBhdCAyOjA3 IFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3Vy dGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KT24gV2VkLCBPY3QgMjUsIDIwMTcgYXQgMjowMiBQ TSwgUGhpbCBIdW50IChJRE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20+PiB3cm90ZToNCklmIGFuIGV2ZW50IGRvZXNuJ3QgaGF2ZSBhIHRpbWUsIGRp ZCBpdCBvY2N1cj8NCg0KQXQgdW5kaXNjbG9zZWQgdGltZSBhbmQgbG9jYXRpb24gOi0pDQoNCkkg dGhpbmsgaXQgaXMgZmluZSBmb3IgInRvZSIgdG8gYmUgU0hPVUxEL1JFQ09NTUVOREVELCBidXQg bm90IE1VU1QvUkVRVUlSRUQuDQoNCg0KUGhpbA0KDQpPbiBPY3QgMjUsIDIwMTcsIGF0IDE6NTgg UE0sIE1hcml1cyBTY3VydGVzY3UgPG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0 ZXNjdUBnb29nbGUuY29tPj4gd3JvdGU6DQpBcyBJIHNhaWQsIEkgdG90YWxseSBhZ3JlZSBpdCBp cyB1c2VmdWwuIEJ1dCB3aHkgcmVxdWlyZWQ/DQoNCk1hcml1cw0KDQpPbiBXZWQsIE9jdCAyNSwg MjAxNyBhdCAxOjU2IFBNLCBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KSW4gc29tZSBjYXNlcywgb3JkZXJp bmcgb2YgZXZlbnRzIGFnYWluc3QgYSBzaW5nbGUgc3ViamVjdCBtYXR0ZXJzLiBUaW1lIGlzIHVz ZWZ1bCBmb3IgdGhpcyBwdXJwb3NlIHRob3VnaCBsaW1pdGVkIGluIHRoZSBvdmVyYWxsIHN0cmVh bSBmb3Igb3JkZXJpbmcgZXZlbnRzIG92ZXJhbGwuDQoNCkZvciBleGFtcGxlIGFjY291bnQgbG9j a2VkIHZzIHVubG9ja2VkLiBLbm93aW5nIHdoYXQgaGFwcGVuZWQgbGFzdCB3b3VsZCBzZWVtIGlt cG9ydGFudCBubz8NCg0KUGhpbA0KDQpPbiBPY3QgMjUsIDIwMTcsIGF0IDE6NDYgUE0sIE1hcml1 cyBTY3VydGVzY3UgPG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29n bGUuY29tPj4gd3JvdGU6DQpPbiBXZWQsIE9jdCAyNSwgMjAxNyBhdCAxMTowOSBBTSwgUGhpbCBI dW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3 cm90ZToNCkl0IGlzIG5vdCBjbGVhciBob3cgdG8gcmV2aXNlIHRoZSBkb2N1bWVudCB3aXRoIHJl Z2FyZHMgdG8gdGhlIHN1Z2dlc3Rpb24gYWdhaW5zdCB1c2luZyDigJxpYXTigJ0gd2hlbiDigJx0 b2XigJ0gaXMgbm90IGFzc2VydGVkLg0KDQpJZiBJIHJlbW92ZSB0aGlzIGNsYXJpZmljYXRpb24s IGl0IHNlZW1zIHVuY2xlYXIgd2hhdCB0aGUgdGltZSBvZiB0aGUgZXZlbnQgaXMgZGVmaW5lZCBh cy4gIFRoZXJlIHNlZW0gdG8gYmUgdHdvIG9wdGlvbnM6DQoNCkEuIElmIOKAnGlhdOKAnSBjYW7i gJl0IGJlIGFzc3VtZWQgdG8gYmUgdGhlIHRpbWUgb2YgZXZlbnQsIHRoZW4g4oCcdG9l4oCdIHNo b3VsZCBiZSBhIHJlcXVpcmVkIGNsYWltLg0KDQpXaHk/IFdoeSBjYW4ndCB0aGUgVHJhbnNtaXR0 ZXIgYXNzZXJ0IHRoYXQgYW4gYWNjb3VudCB3YXMgZGlzYWJsZWQgYW5kIG5vdCBwcm92aWRlIGEg c3BlY2lmaWMgZXZlbnQgdGltZT8gSSB1bmRlcnN0YW5kIHRoYXQgYW4gZXZlbnQgdGltZSBpcyBk ZXNpcmFibGUsIGJ1dCB3aHkgcmVxdWlyZWQ/DQoNCg0KDQpCLiBGb3IgdGhlIG1ham9yaXR5IG9m IHVzZSBjYXNlcywg4oCcaWF04oCdIGlzIGNvbW1vbmx5IHVzZWQgdG8gbWFyayBTRVQgaXNzdWFu Y2UgYW5kIGV2ZW50IHRpbWUuICDigJx0b2XigJ0gaXMgb25seSBuZWVkZWQgd2hlbiB0aGUgdGlt ZSBvZiB0aGUgZXZlbnQgaXMgZGlmZmVyZW50IChvbiBhbiBleGNlcHRpb25hbCBiYXNpcykuDQoN CklmIFNFVCBpc3N1YW5jZSBhbmQgZXZlbnQgdGltZSBhcmUgaW5kZWVkIHRoZSBzYW1lIHRoZW4g Ym90aCBjbGFpbXMgc2hvdWxkIGJlIHByZXNlbnQuIEkgZG9uJ3QgdGhpbmsgaWF0IHNob3VsZCBp bXBseSB0b2UuDQoNCg0KU29tZSBjbGFyaWZpY2F0aW9uIGZyb20gdGhlIGdyb3VwIHdvdWxkIGJl IGFwcHJlY2lhdGVkLiAgU2hvdWxkIHdlIHByb2NlZWQgd2l0aCBCLCBvciByZXZpc2UgdGhlIHRl eHQgdG8gQSAob3Igc29tZSBvdGhlciBwcm9wb3NhbCkuDQoNClRoYW5rcywNCg0KUGhpbA0KDQpP cmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGlu ZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdN RmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1teWw3ZzRocHBrV2dkak45 VF9UeU0zdFE5OEVlSTYtMXY4dURTVzVQcUl3JnM9QTk3NjFyUFhmRmRlcXpKNHBSTi1CUV94MVVT bE0yYlFUWG9DTmVMRkFaQSZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1 bnRAb3JhY2xlLmNvbT4NCg0KT24gT2N0IDIzLCAyMDE3LCBhdCA2OjE1IFBNLCBNYXJpdXMgU2N1 cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNv bT4+IHdyb3RlOg0KDQpPbiBNb24sIE9jdCAyMywgMjAxNyBhdCA2OjA0IFBNLCBSaWNoYXJkIEJh Y2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmFAYW1hem9uLmNvbTxtYWlsdG86cmljaGFubmFAYW1h em9uLmNvbT4+IHdyb3RlOg0KQWdyZWVkIG92ZXJhbGwuIEhhdmluZyByZXJlYWQgdGhlIHByb3Bv c2VkIHRleHQsIEkgc3VnZ2VzdCBzdHJpa2luZyB0aGUgbGFzdCBzZW50ZW5jZSwg4oCcV2hlbiBu b3QgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBvZiDigJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUg dGhlIHZhbHVlIG9mIOKAnGlhdOKAnS7igJ0gSSBkbyBub3QgdGhpbmsgaXQgaXMgbmVjZXNzYXJ5 IG9yIHBhcnRpY3VsYXJseSBoZWxwZnVsIHRvIHN0YW5kYXJkaXplIHRoZSBzZW1hbnRpY3Mgb2Yg YSBtaXNzaW5nIHRpbWUtb2YtZXZlbnQgY2xhaW0gYXQgdGhlIFNFVCBsZXZlbC4NCg0KKzENCg0K DQoNCi0tDQpBbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuDQpBbWF6b24g4oCTIElkZW50aXR5IFNl cnZpY2VzDQoNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8bWFp bHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2YgIlBoaWwgSHVudCAo SURNKSIgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+ DQpEYXRlOiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgYXQgNTo0OCBQTQ0KVG86IE1pa2UgSm9u ZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPj4NCkNjOiBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5j b208bWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPj4sIElEIEV2ZW50cyBNYWlsaW5n IExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQoNClN1 YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAibmJmIiBjbGFpbSB3aXRoIGEgbmV3ICJ0 b2UiIGNsYWltDQoNCg0KQWdyZWVkICsxIG9uIEJyaWFuJ3MgZWRpdHMuDQoNClBoaWwNCg0KT24g T2N0IDIzLCAyMDE3LCBhdCA1OjA1IFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jv c29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KQW5u YWJlbGxlIGFuZCBJIGFncmVlZCB3aXRoIHRoaXMgcHJvcG9zZWQgY2hhbmdlIChhcyBjb3JyZWN0 bHkgd29yZHNtaXRoZWQgYnkgQnJpYW4pIGR1cmluZyBvdXIgaW4tcGVyc29uIHJldmlldyDigJMg YXMgYWxzbyBub3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLg0KDQogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgVGhhbmtzIFBoaWwgYW5kIGFsbCwNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50 IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJyaWFuIENh bXBiZWxsDQpTZW50OiBUaHVyc2RheSwgU2VwdGVtYmVyIDI4LCAyMDE3IDg6MjMgQU0NClRvOiBQ aGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bT4+DQpDYzogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAi bmJmIiBjbGFpbSB3aXRoIGEgbmV3ICJ0b2UiIGNsYWltDQoNCisxIHRvIFNFVCBkZWZpbmluZyBh IHRpbWUgb2YgZXZlbnQgY2xhaW0gcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHJlZGVmaW5lIGEgc3Rh bmRhcmQgY2xhaW0uIEFuZCB3aG8gZG9lc24ndCBsaWtlIGEgY2xhaW0gbmFtZWQgInRvZSI/DQpI b3dldmVyLCB0aGUgdGV4dCB0aGVyZSBmb3IgbmJmIGlzIHN0aWxsIGVmZmVjdGl2ZWx5IHJlZGVm aW5pbmcgaXQgYnkgc2F5aW5nIGl0IHNob3VsZCBiZSBpZ25vcmVkLCB3aGljaCBpc24ndCBjb25z aXN0ZW50IHdpdGggdGhlICJNVVNUIE5PVCBiZSBhY2NlcHRlZCBmb3IgcHJvY2Vzc2luZyIgZnJv bSBSRkMgNzUxOS4gSXQgd291bGQgYmUgbW9yZSBhcHByb3ByaWF0ZSB0byBzYXkgdGhhdCBuYmYg c2hvdWxkL211c3Qgbm90IGJlIGluY2x1ZGVkIGluIGEgU0VULiBPciBqdXN0IG5vdCBtZW50aW9u IG5iZiBhdCBhbGwuIEJ1dCBkb24ndCBjaGFuZ2UgdGhlIG1lYW5pbmcuDQpBbHNvIHRvZSB3b3Vs ZCBub3QgYmUgIkRlZmluZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV0iLCB3aGljaCBpcyB0 aGUgbmJmIHNlY3Rpb24uIFRoZSB2YWx1ZSBvZiB0aGUgdG9lIGNsYWltIGlzIGEgTnVtZXJpY0Rh dGUsIHdoaWNoIGlzIGRlZmluZWQgaW4gU2VjIDIgUkZDNzUxOS4gQnV0IHRvZSBoYXMgbm8gcmVs YXRpb24gdG8gbmJmIGFuZCBubyByZWFzb24gdG8gcmVmZXJlbmNlIG5iZi4NCg0KT24gV2VkLCBT ZXAgMjcsIDIwMTcgYXQgMjo1MyBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCkR1cmluZyB0aGUgT3BlbklEIFJJ U0MgRmFjZSB0byBGYWNlIG1lZXRpbmcgYSBxdWVzdGlvbiBjYW1lIHVwIHJlZ2FyZGluZyBTRVTi gJlzIHJlZGVmaW5pdGlvbiBvZiDigJxuYmbigJ0gYW5kIHdoZXRoZXIgdGhhdCByZWRlZmluaXRp b24gd2FzIGFwcHJvcHJpYXRlLg0KDQpUaGUgaW50ZW50aW9uIG9mIFNFVHMgZGVmaW5pdGlvbiBp cyB0byBhbGxvdyBTRVQgVHJhbnNtaXR0ZXJzIHRvIGluZGljYXRlIHRoYXQgYW4gZXZlbnQgbWF5 IGhhdmUgb2NjdXJyZWQgYXMgZWFybHkgYXMgYSBzcGVjaWZpZWQgZGF0ZSDigJQgYSBkYXRlIHdo aWNoIGlzIGRpZmZlcmVudCBmcm9tIHRoZSBpc3N1YW5jZSBkYXRlIG9mIHRoZSBTRVQuIEluIHBh cnRpY3VsYXIgdGhpcyBpcyB1c2VmdWwgaW4gY2FzZXMgd2hlcmUgdGhlIHN0YXRlIGNoYW5nZSBp cyBiZWxpZXZlZCB0byBoYXZlIG9jY3VycmVkIGVhcmxpZXIgdGhhbiB0aGUgdGltZSBvZiBpc3N1 YW5jZSAoZS5nLiBiZWNhdXNlIHRoZSBpbmNpZGVudCB3YXMgZGlzY292ZXJlZCB0aHJvdWdoIGFu IGFkbWluaXN0cmF0aXZlIHJldmlldyBvciBkYXRhIGFuYWx5c2lzIHRvIGhhdmUgb2NjdXJyZWQg aW4gdGhlIHBhc3QpLg0KDQpUaGUgZGVmaW5pdGlvbiBmcm9tIEpXVCBpczoNCjQuMS41PGh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0 Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmQ9RHdNR2FRJmM9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNl R0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZ dUNWZ0hTaWNINjF3JnM9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdPbmlIaVFpcHhIWmlDRzYy dyZlPT4uICAibmJmIiAoTm90IEJlZm9yZSkgQ2xhaW0NCg0KDQoNCg0KDQogICBUaGUgIm5iZiIg KG5vdCBiZWZvcmUpIGNsYWltIGlkZW50aWZpZXMgdGhlIHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBK V1QNCg0KICAgTVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcuICBUaGUgcHJvY2Vz c2luZyBvZiB0aGUgIm5iZiINCg0KICAgY2xhaW0gcmVxdWlyZXMgdGhhdCB0aGUgY3VycmVudCBk YXRlL3RpbWUgTVVTVCBiZSBhZnRlciBvciBlcXVhbCB0bw0KDQogICB0aGUgbm90LWJlZm9yZSBk YXRlL3RpbWUgbGlzdGVkIGluIHRoZSAibmJmIiBjbGFpbS4gIEltcGxlbWVudGVycyBNQVkNCg0K ICAgcHJvdmlkZSBmb3Igc29tZSBzbWFsbCBsZWV3YXksIHVzdWFsbHkgbm8gbW9yZSB0aGFuIGEg ZmV3IG1pbnV0ZXMsIHRvDQoNCiAgIGFjY291bnQgZm9yIGNsb2NrIHNrZXcuICBJdHMgdmFsdWUg TVVTVCBiZSBhIG51bWJlciBjb250YWluaW5nIGENCg0KICAgTnVtZXJpY0RhdGUgdmFsdWUuICBV c2Ugb2YgdGhpcyBjbGFpbSBpcyBPUFRJT05BTC4NCg0KDQpBcyBkZWZpbmVkIGluIFNFVDoNCg0K ICAgbmJmDQoNCiAgICAgIERlZmluZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV08aHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRm Lm9yZ19odG1sX3JmYzc1MTktMjNzZWN0aW9uLTJENC4xLjUmZD1Ed01HYVEmYz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VH SnhQRWl2empXd2xOS2U0Q19sTElHayZtPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1 Q1ZnSFNpY0g2MXcmcz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3 JmU9PiwgYSBudW1iZXIgd2hvc2UgdmFsdWUgaXMgYQ0KDQogICAgICBOdW1lcmljRGF0ZS4gIElu IHRoZSBjb250ZXh0IG9mIHRoZSBTRVQgdG9rZW4gaXQgU0hBTEwgYmUNCg0KICAgICAgaW50ZXJw cmV0ZWQgdG8gbWVhbiBhIGRhdGUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRvIGhh dmUNCg0KICAgICAgb2NjdXJyZWQgKGluIHRoZSBwYXN0KSBvciB3aWxsIG9jY3VyIGluIHRoZSBm dXR1cmUuICBOb3RlOiB0aGVyZQ0KDQogICAgICBNQVkgYmUgc29tZSBjYXNlcyB3aGVyZSAibmJm IiBpcyBzdGlsbCBzbWFsbGVyIHRoYW4gImlhdCIgc3VjaCBhcw0KDQogICAgICB3aGVuIGl0IHRv b2sgYW4gZXh0ZW5kZWQgdGltZSBmb3IgYSBTRVQgdG8gYmUgaXNzdWVkIChmb3IgZXhhbXBsZQ0K DQogICAgICBhZnRlciBzb21lIGFuYWx5c2lzKS4gIFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuDQoN ClRoZXJlIGlzIGFuIGFyZ3VtZW50IHRoYXQgdGhlIHJlZGVmaW5pdGlvbiB3aWxsIGNhdXNlIGNv bmZ1c2lvbi4NCg0KVGhlIHByb3Bvc2FsIGlzIHRvIHJlZ2lzdGVyIGEgZGlmZmVyZW50IGNsYWlt IG5hbWUgc3VjaCBhcyDigJx0b2XigJ0gKHRpbWUgb2YgZXZlbnQpLiBUaGUgcHJvcG9zZWQgbmV3 DQpkZWZpbml0aW9uOg0KDQoNCnRvZQ0KDQogICAgICBEZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjUg W1JGQzc1MTldPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmQ9RHdN R2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhP TUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdP bmlIaVFpcHhIWmlDRzYydyZlPT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGENCg0KICAgICAg TnVtZXJpY0RhdGUuICBUaGUgdmFsdWUgaXMgdGhlIGRhdGUgYW5kIHRpbWUgaW4gd2hpY2ggdGhl IGV2ZW50IGlzIGJlbGlldmVkIHRvIGhhdmUNCg0KICAgICAgb2NjdXJyZWQgaW4gdGhlIHBhc3Qg b3Igd2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiBUaGlzIGNsYWltIGlzIE9QVElPTkFMLg0KDQog ICAgICBXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZhbHVlIG9mIOKAnHRvZeKAnSBNQVkgYmUgYXNz dW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCcaWF04oCdLg0KDQoNCg0KbmJmDQoNCiAgICAgIFRo aXMgY2xhaW0gaXMgbm90IHVzZWQgaW4gU0VUIEV2ZW50cy4gSWYgYXNzZXJ0ZWQsIHRoZSB2YWx1 ZSBTSE9VTEQNCg0KICAgICAgYmUgaWdub3JlZC4NCg0KDQpBcmUgdGhlcmUgYW55IG9iamVjdGlv bnMgdG8gdGhlIHByb3Bvc2VkIGNoYW5nZT8NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24s IElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGluZGVwZW5kZW50aWQNCnd3dy5p bmRlcGVuZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJs P3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNW Z0hTaWNINjF3JnM9MV9aN092QXlheGxlc0NkTE5DNXFzYTVYajlQWlEtTE1iQ2FfaG1UbzJlTSZl PT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0K DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZl bnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJm09TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdI U2ljSDYxdyZzPThBb29EV1kxRndURzNCajJFTFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZPTjgmZT0+ DQoNCg0KQ09ORklERU5USUFMSVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25m aWRlbnRpYWwgYW5kIHByaXZpbGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUg aW50ZW5kZWQgcmVjaXBpZW50KHMpLiBBbnkgcmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBk aXNjbG9zdXJlIGJ5IG90aGVycyBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLiAgSWYgeW91IGhhdmUg cmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9uIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBz ZW5kZXIgaW1tZWRpYXRlbHkgYnkgZS1tYWlsIGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UgYW5kIGFu eSBmaWxlIGF0dGFjaG1lbnRzIGZyb20geW91ciBjb21wdXRlci4gVGhhbmsgeW91Lg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxp bmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0 Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNW Z0hTaWNINjF3JnM9OEFvb0RXWTFGd1RHM0JqMkVMV3FwVDdYQWFVWUFVVHhnNzhrZGIwVk9OOCZl PQ0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQt ZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3Lmll dGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3TUZhUSZjPVJvUDFZdW1DWENn YVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdK eFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09WEZiODV2dURrMGgzWWdkNXFseDRpdVI3TFI3ZXZWX0JV MGZMTDA1ZFhCTSZzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRCSGY3LUpGZmU3bVlwQlkm ZT0+DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09WEZiODV2dURrMGgzWWdkNXFseDRp dVI3TFI3ZXZWX0JVMGZMTDA1ZFhCTSZzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRCSGY3 LUpGZmU3bVlwQlkmZT0NCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZl bnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPW15bDdnNGhw cGtXZ2RqTjlUX1R5TTN0UTk4RWVJNi0xdjh1RFNXNVBxSXcmcz03TzVONXFCTkdLOEdNY2FyVXdI RXRTa05nZm9nRm12X3E2X28wcXY4YXhVJmU9DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGll dGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGlu Zm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRw a0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr Jm09azE3WGlYaERjQVNGaVBJYTJrODY4SjdEOHc4UmtPNHd4MHJqWWk4d05vdyZzPTVmeWxqcU9T VmlSUTl3bnlNWFVaX2ZRMV9udWFjb2gzeHgzMzhGZGFwU1kmZT0NCg0KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0K SWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFp bG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQ UWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3ds TktlNENfbExJR2smbT0zeG9SblllQXFnV1JxdmptaDFmRkJIYkZxd1BvMC1TMzFLWXJKMHNaSzdn JnM9T2duNXZXU0pRYjFfdzZfNnpVbHE4Q1BSa2VnaTF4XzNHLWtubGJaazZrRSZlPQ0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFp bGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5p ZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VH SnhQRWl2empXd2xOS2U0Q19sTElHayZtPUc3Z0kxVFQzN0lIc05WaFRObThTVmt2RnNEM2xack1x amtDQ1FSZmxNcUUmcz16RklmSWNVbl90UDAwcDZ5YzJuTG11dmxMWktoQVpYdi1ySnI0aUswZC1Z JmU9DQoNCg== --_000_CY4PR21MB05047D4D677ACB9DFC82D412F5440CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OiJTZWdvZSBVSSI7DQoJcGFub3NlLTE6MiAxMSA1IDIgNCAyIDQgMiAyIDM7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpoNA0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTsNCgltc28tc3R5bGUtbGluazoiSGVhZGluZyA0IENoYXIiOw0KCW1zby1t YXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGlu aw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KcHJlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0 eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1y aWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGlu Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNw YW47fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUt Y29udmVydGVkLXNwYWNlO30NCnNwYW4ubTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEw ODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtc3R5 bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTptXzE1NDU2MDk0MzUxMTA0NTY0NjhtXzQwMzU0MDE4 NjExMDgxNzM3MzZtXy03NDM0MDc1MDQ3NjgxNzU1NDQ0bV8yNTExMTM5NzIwMzgzNzE4MTgwYXBw bGUtc3R5bGUtc3Bhbjt9DQpzcGFuLm0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgx NzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZl cnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTptXzE1NDU2MDk0MzUxMTA0NTY0NjhtXzQwMzU0 MDE4NjExMDgxNzM3MzZtXy03NDM0MDc1MDQ3NjgxNzU1NDQ0bV8yNTExMTM5NzIwMzgzNzE4MTgw YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uSGVhZGluZzRDaGFyDQoJe21zby1zdHlsZS1u YW1lOiJIZWFkaW5nIDQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJbXNvLXN0eWxl LWxpbms6IkhlYWRpbmcgNCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkgTGlnaHQiLHNhbnMtc2Vy aWY7DQoJY29sb3I6IzJGNTQ5NjsNCglmb250LXN0eWxlOml0YWxpYzt9DQpzcGFuLkhUTUxQcmVm b3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsN Cgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIjsNCglmb250LWZhbWlseToiQ29uc29sYXMiLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTI1 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEu MGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHls ZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQi IHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0 IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojMDAyMDYwIj5J4oCZbSBPSyB3aXRoIHRoaXMsIGFzIGxvbmcgYXMgeW91IGFsc28gYWRk IGEgY2xhcmlmeWluZyBub3RlIGFsb25nIHRoZXNlIGxpbmVzOjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgTk9URTombmJzcDsgU29tZSBwcm9maWxlcyBtYXkgY2hvb3NlIHRv IG9taXQg4oCcdG9l4oCdIGFuZCBjb252ZXkgZXZlbnQgdGltZSBpbmZvcm1hdGlvbiB3aXRoIHRo ZSDigJxpYXTigJ0gb3Igb3RoZXIgY2xhaW1zLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YSBuYW1lPSJfTWFp bEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L2E+PC9wPg0KPHNwYW4gc3R5bGU9Im1zby1ib29rbWFyazpfTWFpbEVuZENvbXBv c2UiPjwvc3Bhbj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNv bGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gUGhpbCBIdW50IFttYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb21dIDxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXksIE9jdG9iZXIgMjUsIDIwMTcgMjo1 OSBQTTxicj4NCjxiPlRvOjwvYj4gTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7bXNjdXJ0ZXNjdUBnb29n bGUuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0 O3JpY2hhbm5hQGFtYXpvbi5jb20mZ3Q7OyBCcmlhbiBDYW1wYmVsbCAmbHQ7YmNhbXBiZWxsQHBp bmdpZGVudGl0eS5jb20mZ3Q7OyBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZn dDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gUmVwbGFjaW5nICZxdW90O25i ZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZxdW90OyBjbGFpbTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T0vigKYudW5sZXNzIHRoZXJlIGlzIG9iamVj dGlvbiwgSSB3aWxsIHJldmlzZSB0aGUgZHJhZnQgc28gdGhhdCDigJx0b2XigJ0gd2lsbCBiZWNv bWUgYSByZWNvbW1lbmRlZCBhdHRyaWJ1dGUuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJs YWNrIj5QaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2Vydmlj ZXMgQXJjaGl0ZWN0PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5pbmRlcGVuZGVu dGlkLmNvbSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5PbiBPY3QgMjUsIDIwMTcsIGF0IDI6NTIgUE0sIE1hcml1cyBTY3Vy dGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iPm1zY3VydGVz Y3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBXZWQs IE9jdCAyNSwgMjAxNyBhdCAyOjQ0IFBNLCBQaGlsIEh1bnQgKElETSk8c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGls Lmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9h PiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+d3Jv dGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhBcHBsZU1haWxT aWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+QXJlIHlv dSBwcm9wb3NpbmcgQSB3aXRoIGEgc2hvdWxkL3JlY29tbWVuZGVkPzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+WWVz PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYu MHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXYgaWQ9 Im1fMTU0NTYwOTQzNTExMDQ1NjQ2OEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXYgaWQ9Im1fMTU0NTYwOTQzNTExMDQ1NjQ2OEFwcGxlTWFpbFNpZ25hdHVyZSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JdCBpcyBtb3JlIGNvbnNp c3RlbnQgYnV0IGFkZHMgYSBsb3Qgb2YgZHVwbGljYXRpb24gaW4gbWFueSBjYXNlcyB3aGVyZSBp YXQgPSB0b2UuJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JIGRvbid0IHRoaW5rIHRoYXQgc2hvdWxkIGJl IGEgcHJvYmxlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPGRpdiBpZD0ibV8xNTQ1NjA5NDM1MTEwNDU2NDY4QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NClBoaWw8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJy Pg0KT24gT2N0IDI1LCAyMDE3LCBhdCAyOjA3IFBNLCBNYXJpdXMgU2N1cnRlc2N1ICZsdDs8YSBo cmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+bXNjdXJ0 ZXNjdUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj5PbiBXZWQsIE9jdCAyNSwgMjAxNyBhdCAyOjAyIFBNLCBQaGlsIEh1 bnQgKElETSk8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsi PnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6 MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+SWYgYW4gZXZlbnQgZG9lc24ndCBoYXZlIGEgdGltZSwgZGlkIGl0IG9jY3VyPzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+QXQgdW5kaXNjbG9zZWQgdGltZSBhbmQgbG9jYXRpb24gOi0pPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSB0aGluayBpdCBpcyBmaW5lIGZvciAm cXVvdDt0b2UmcXVvdDsgdG8gYmUgU0hPVUxEL1JFQ09NTUVOREVELCBidXQgbm90IE1VU1QvUkVR VUlSRUQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj48YnI+DQpQaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCk9uIE9jdCAyNSwgMjAxNywg YXQgMTo1OCBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVz Y3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4m Z3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkFzIEkgc2FpZCwgSSB0b3Rh bGx5IGFncmVlIGl0IGlzIHVzZWZ1bC4gQnV0IHdoeSByZXF1aXJlZD88bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj48YnIgY2xlYXI9ImFsbCI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk1hcml1czxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+T24gV2VkLCBPY3QgMjUsIDIwMTcgYXQg MTo1NiBQTSwgUGhpbCBIdW50IChJRE0pPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPiZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20i IHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xp ZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44 cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPkluIHNvbWUgY2FzZXMsIG9yZGVyaW5nIG9mIGV2ZW50cyBhZ2Fp bnN0IGEgc2luZ2xlIHN1YmplY3QgbWF0dGVycy4gVGltZSBpcyB1c2VmdWwgZm9yIHRoaXMgcHVy cG9zZSB0aG91Z2ggbGltaXRlZCBpbiB0aGUgb3ZlcmFsbCBzdHJlYW0gZm9yIG9yZGVyaW5nIGV2 ZW50cyBvdmVyYWxsLiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBp ZD0ibV8xNTQ1NjA5NDM1MTEwNDU2NDY4bV80MDM1NDAxODYxMTA4MTczNzM2bV8tNzQzNDA3NTA0 NzY4MTc1NTQ0NEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYg aWQ9Im1fMTU0NTYwOTQzNTExMDQ1NjQ2OG1fNDAzNTQwMTg2MTEwODE3MzczNm1fLTc0MzQwNzUw NDc2ODE3NTU0NDRBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+Rm9yIGV4YW1wbGUgYWNjb3VudCBsb2NrZWQgdnMgdW5sb2NrZWQuIEtu b3dpbmcgd2hhdCBoYXBwZW5lZCBsYXN0IHdvdWxkIHNlZW0gaW1wb3J0YW50IG5vPzxicj4NCjxi cj4NClBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KT24gT2N0IDI1LCAyMDE3LCBhdCAxOjQ2IFBNLCBNYXJpdXMg U2N1cnRlc2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBXZWQsIE9jdCAyNSwgMjAxNyBh dCAxMTowOSBBTSwgUGhpbCBIdW50PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPiZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRh cmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+SXQgaXMgbm90IGNsZWFyIGhvdyB0byByZXZpc2UgdGhlIGRvY3VtZW50IHdpdGgg cmVnYXJkcyB0byB0aGUgc3VnZ2VzdGlvbiBhZ2FpbnN0IHVzaW5nIOKAnGlhdOKAnSB3aGVuIOKA nHRvZeKAnSBpcyBub3QgYXNzZXJ0ZWQuJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPklmIEkgcmVtb3ZlIHRoaXMgY2xhcmlmaWNhdGlvbiwgaXQgc2VlbXMgdW5j bGVhciB3aGF0IHRoZSB0aW1lIG9mIHRoZSBldmVudCBpcyBkZWZpbmVkIGFzLiZuYnNwOyBUaGVy ZSBzZWVtIHRvIGJlIHR3byBvcHRpb25zOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5BLiBJZiDigJxpYXTigJ0gY2Fu4oCZdCBiZSBhc3N1bWVkIHRvIGJlIHRoZSB0aW1l IG9mIGV2ZW50LCB0aGVuIOKAnHRvZeKAnSBzaG91bGQgYmUgYSByZXF1aXJlZCBjbGFpbS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+V2h5PyBXaHkgY2FuJ3QgdGhlIFRyYW5zbWl0dGVyIGFzc2VydCB0 aGF0IGFuIGFjY291bnQgd2FzIGRpc2FibGVkIGFuZCBub3QgcHJvdmlkZSBhIHNwZWNpZmljIGV2 ZW50IHRpbWU/IEkgdW5kZXJzdGFuZCB0aGF0IGFuIGV2ZW50IHRpbWUgaXMgZGVzaXJhYmxlLCBi dXQgd2h5IHJlcXVpcmVkPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkIuIEZvciB0aGUgbWFqb3JpdHkgb2YgdXNl IGNhc2VzLCDigJxpYXTigJ0gaXMgY29tbW9ubHkgdXNlZCB0byBtYXJrIFNFVCBpc3N1YW5jZSBh bmQgZXZlbnQgdGltZS4gJm5ic3A74oCcdG9l4oCdIGlzIG9ubHkgbmVlZGVkIHdoZW4gdGhlIHRp bWUgb2YgdGhlIGV2ZW50IGlzIGRpZmZlcmVudCAob24gYW4gZXhjZXB0aW9uYWwNCiBiYXNpcyku PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPklmIFNFVCBpc3N1YW5jZSBhbmQgZXZlbnQgdGltZSBhcmUg aW5kZWVkIHRoZSBzYW1lIHRoZW4gYm90aCBjbGFpbXMgc2hvdWxkIGJlIHByZXNlbnQuIEkgZG9u J3QgdGhpbmsgaWF0IHNob3VsZCBpbXBseSB0b2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGlu IDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlNvbWUgY2xhcmlmaWNhdGlvbiBmcm9tIHRoZSBncm91 cCB3b3VsZCBiZSBhcHByZWNpYXRlZC4mbmJzcDsgU2hvdWxkIHdlIHByb2NlZWQgd2l0aCBCLCBv ciByZXZpc2UgdGhlIHRleHQgdG8gQSAob3Igc29tZSBvdGhlciBwcm9wb3NhbCkuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhhbmtzLDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5 IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkBpbmRlcGVuZGVu dGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1E d01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZh bXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPW15 bDdnNGhwcGtXZ2RqTjlUX1R5TTN0UTk4RWVJNi0xdjh1RFNXNVBxSXcmYW1wO3M9QTk3NjFyUFhm RmRlcXpKNHBSTi1CUV94MVVTbE0yYlFUWG9DTmVMRkFaQSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5r Ij53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2Js YW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+T24gT2N0IDIzLCAyMDE3LCBhdCA2OjE1IFBNLCBNYXJpdXMgU2N1 cnRlc2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIiB0YXJnZXQ9 Il9ibGFuayI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+T24gTW9uLCBPY3QgMjMsIDIwMTcgYXQgNjowNCBQTSwgUmljaGFyZCBC YWNrbWFuLCBBbm5hYmVsbGU8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQw MTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzpyaWNo YW5uYUBhbWF6b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+cmljaGFubmFAYW1hem9uLmNvbTwvYT4m Z3Q7PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZt LTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1 b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBp biI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+QWdyZWVkIG92ZXJhbGwuIEhhdmluZyByZXJlYWQgdGhlIHByb3Bvc2VkIHRleHQsIEkgc3Vn Z2VzdCBzdHJpa2luZyB0aGUgbGFzdCBzZW50ZW5jZSwg4oCcV2hlbiBub3QgYXNzZXJ0ZWQsIHRo ZSB2YWx1ZQ0KIG9mIOKAnHRvZeKAnSBNQVkgYmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg 4oCcaWF04oCdLuKAnSBJIGRvIG5vdCB0aGluayBpdCBpcyBuZWNlc3Nhcnkgb3IgcGFydGljdWxh cmx5IGhlbHBmdWwgdG8gc3RhbmRhcmRpemUgdGhlIHNlbWFudGljcyBvZiBhIG1pc3NpbmcgdGlt ZS1vZi1ldmVudCBjbGFpbSBhdCB0aGUgU0VUIGxldmVsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+JiM0MzsxPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJp ZiI+LS0mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtm b250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPkFubmFiZWxsZSBS aWNoYXJkIEJhY2ttYW48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPkFtYXpvbiDi gJMgSWRlbnRpdHkgU2VydmljZXM8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4w cHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+RnJvbTo8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEw ODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ SWQtZXZlbnQNCiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVo YWxmIG9mICZxdW90O1BoaWwgSHVudCAoSURNKSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208 L2E+Jmd0Ozxicj4NCjxiPkRhdGU6PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQw MzU0MDE4NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4 MGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5Nb25kYXksIE9jdG9iZXIg MjMsIDIwMTcgYXQgNTo0OCBQTTxicj4NCjxiPlRvOjxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTEx MDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3 MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+TWlrZSBK b25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFy Z2V0PSJfYmxhbmsiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+ Q2M6PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZt LTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5CcmlhbiBDYW1wYmVsbCAmbHQ7PGEgaHJlZj0ibWFpbHRv OmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+YmNhbXBiZWxsQHBp bmdpZGVudGl0eS5jb208L2E+Jmd0OywgSUQgRXZlbnRzIE1haWxpbmcNCiBMaXN0ICZsdDs8YSBo cmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBp ZXRmLm9yZzwvYT4mZ3Q7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PGJyPg0KPGI+U3ViamVjdDo8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAz NTQwMTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgw YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlJlOiBbSWQtZXZlbnRdIFJl cGxhY2luZyAmcXVvdDtuYmYmcXVvdDsgY2xhaW0gd2l0aCBhIG5ldyAmcXVvdDt0b2UmcXVvdDsg Y2xhaW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ QWdyZWVkICYjNDM7MSBvbiBCcmlhbidzIGVkaXRzLiZuYnNwOzxicj4NCjxicj4NClBoaWw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxicj4NCk9uIE9jdCAyMywgMjAxNywgYXQgNTowNSBQTSwgTWlrZSBKb25l cyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkFubmFiZWxsZSBhbmQgSSBhZ3JlZWQg d2l0aCB0aGlzIHByb3Bvc2VkIGNoYW5nZSAoYXMgY29ycmVjdGx5IHdvcmRzbWl0aGVkIGJ5IEJy aWFuKSBkdXJpbmcgb3VyIGluLXBlcnNvbg0KIHJldmlldyDigJMgYXMgYWxzbyBub3RlZCBpbiB0 aGUgcmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8c3Bh biBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3 NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+VGhhbmtzDQogUGhpbCBhbmQgYWxsLDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZt LTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPi0tDQogTWlrZTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1 NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+SWQtZXZlbnQNCiBbPGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50 LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5tYWlsdG86aWQtZXZlbnQtYm91bmNl c0BpZXRmLm9yZzwvYT5dPHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4 NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFuIGNsYXNz PSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3Njgx NzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48L2I+QnJpYW4NCiBDYW1wYmVsbDxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJt MTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1 NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5UaHVyc2RheSwgU2VwdGVtYmVyIDI4LCAyMDE3IDg6MjMgQU08YnI+DQo8Yj5Ubzo8L2I+PHNw YW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZtLTc0MzQw NzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPlBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0Ozxicj4N CjxiPkNjOjwvYj48c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEw ODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+SUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEg aHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRA aWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJtMTU0NTYw OTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1 MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTog W0lkLWV2ZW50XSBSZXBsYWNpbmcgJnF1b3Q7bmJmJnF1b3Q7IGNsYWltIHdpdGggYSBuZXcgJnF1 b3Q7dG9lJnF1b3Q7IGNsYWltPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiYj NDM7MSB0byBTRVQgZGVmaW5pbmcgYSB0aW1lIG9mIGV2ZW50IGNsYWltIHJhdGhlciB0aGFuIHRy eWluZyB0byByZWRlZmluZSBhIHN0YW5kYXJkIGNsYWltLiBBbmQgd2hvIGRvZXNuJ3QgbGlrZSBh IGNsYWltDQogbmFtZWQgJnF1b3Q7dG9lJnF1b3Q7PzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5Ib3dldmVyLCB0aGUgdGV4 dCB0aGVyZSBmb3IgbmJmIGlzIHN0aWxsIGVmZmVjdGl2ZWx5IHJlZGVmaW5pbmcgaXQgYnkgc2F5 aW5nIGl0IHNob3VsZCBiZSBpZ25vcmVkLCB3aGljaCBpc24ndCBjb25zaXN0ZW50DQogd2l0aCB0 aGUgJnF1b3Q7TVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcmcXVvdDsgZnJvbSBS RkMgNzUxOS4gSXQgd291bGQgYmUgbW9yZSBhcHByb3ByaWF0ZSB0byBzYXkgdGhhdCBuYmYgc2hv dWxkL211c3Qgbm90IGJlIGluY2x1ZGVkIGluIGEgU0VULiBPciBqdXN0IG5vdCBtZW50aW9uIG5i ZiBhdCBhbGwuIEJ1dCBkb24ndCBjaGFuZ2UgdGhlIG1lYW5pbmcuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkFs c28gdG9lIHdvdWxkIG5vdCBiZSAmcXVvdDtEZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjUgW1JGQzc1 MTldJnF1b3Q7LCB3aGljaCBpcyB0aGUgbmJmIHNlY3Rpb24uIFRoZSB2YWx1ZSBvZiB0aGUgdG9l IGNsYWltDQogaXMgYSBOdW1lcmljRGF0ZSwgd2hpY2ggaXMgZGVmaW5lZCBpbiBTZWMgMiBSRkM3 NTE5LiBCdXQgdG9lIGhhcyBubyByZWxhdGlvbiB0byBuYmYgYW5kIG5vIHJlYXNvbiB0byByZWZl cmVuY2UgbmJmLiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+T24gV2VkLCBTZXAgMjcsIDIwMTcgYXQgMjo1MyBQTSwgUGhpbCBIdW50ICZsdDs8YSBocmVm PSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRA b3JhY2xlLmNvbTwvYT4mZ3Q7DQogd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5EdXJpbmcgdGhlIE9wZW5JRCBSSVND IEZhY2UgdG8gRmFjZSBtZWV0aW5nIGEgcXVlc3Rpb24gY2FtZSB1cCByZWdhcmRpbmcgU0VU4oCZ cyByZWRlZmluaXRpb24gb2Yg4oCcbmJm4oCdIGFuZCB3aGV0aGVyDQogdGhhdCByZWRlZmluaXRp b24gd2FzIGFwcHJvcHJpYXRlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+VGhlIGludGVudGlvbiBvZiBTRVRzIGRlZmluaXRpb24gaXMgdG8gYWxsb3cgU0VUIFRy YW5zbWl0dGVycyB0byBpbmRpY2F0ZSB0aGF0IGFuIGV2ZW50IG1heSBoYXZlIG9jY3VycmVkIGFz IGVhcmx5DQogYXMgYSBzcGVjaWZpZWQgZGF0ZSDigJQgYSBkYXRlIHdoaWNoIGlzIGRpZmZlcmVu dCBmcm9tIHRoZSBpc3N1YW5jZSBkYXRlIG9mIHRoZSBTRVQuIEluIHBhcnRpY3VsYXIgdGhpcyBp cyB1c2VmdWwgaW4gY2FzZXMgd2hlcmUgdGhlIHN0YXRlIGNoYW5nZSBpcyBiZWxpZXZlZCB0byBo YXZlIG9jY3VycmVkIGVhcmxpZXIgdGhhbiB0aGUgdGltZSBvZiBpc3N1YW5jZSAoZS5nLiBiZWNh dXNlIHRoZSBpbmNpZGVudCB3YXMgZGlzY292ZXJlZCB0aHJvdWdoDQogYW4gYWRtaW5pc3RyYXRp dmUgcmV2aWV3IG9yIGRhdGEgYW5hbHlzaXMgdG8gaGF2ZSBvY2N1cnJlZCBpbiB0aGUgcGFzdCku PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBk ZWZpbml0aW9uIGZyb20gSldUIGlzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxoND48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQu MS41JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7 cz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmFtcDtlPSIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7O3RleHQtZGVjb3JhdGlvbjpub25lIj40LjEuNTwvc3Bhbj48 L2E+PC9zcGFuPjxhIG5hbWU9Im1fMTU0NTYwOTQzNTExMDQ1NjQ2OF9tXzQwMzU0MDE4NjExMDgx NzMiPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90OyI+LiZuYnNwOw0KICZxdW90O25iZiZxdW90OyAoTm90IEJlZm9yZSkg Q2xhaW08L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L2g0Pg0KPHByZT4mbmJzcDs8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsgVGhlICZxdW90O25iZiZxdW90OyAobm90IGJlZm9yZSkgY2xhaW0gaWRlbnRpZmllcyB0aGUg dGltZSBiZWZvcmUgd2hpY2ggdGhlIEpXVDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyBNVVNUIE5PVCBiZSBhY2NlcHRlZCBmb3IgcHJvY2Vzc2luZy4mbmJzcDsgVGhlIHByb2Nl c3Npbmcgb2YgdGhlICZxdW90O25iZiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyBjbGFpbSByZXF1aXJlcyB0aGF0IHRoZSBjdXJyZW50IGRhdGUvdGltZSBNVVNUIGJl IGFmdGVyIG9yIGVxdWFsIHRvPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRo ZSBub3QtYmVmb3JlIGRhdGUvdGltZSBsaXN0ZWQgaW4gdGhlICZxdW90O25iZiZxdW90OyBjbGFp bS4mbmJzcDsgSW1wbGVtZW50ZXJzIE1BWTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZu YnNwOyBwcm92aWRlIGZvciBzb21lIHNtYWxsIGxlZXdheSwgdXN1YWxseSBubyBtb3JlIHRoYW4g YSBmZXcgbWludXRlcywgdG88bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgYWNj b3VudCBmb3IgY2xvY2sgc2tldy4mbmJzcDsgSXRzIHZhbHVlIE1VU1QgYmUgYSBudW1iZXIgY29u dGFpbmluZyBhPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IE51bWVyaWNEYXRl IHZhbHVlLiZuYnNwOyBVc2Ugb2YgdGhpcyBjbGFpbSBpcyBPUFRJT05BTC48bzpwPjwvbzpwPjwv cHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+QXMgZGVmaW5lZCBpbiBTRVQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsgbmJmPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19o dG1sX3JmYzc1MTktMjNzZWN0aW9uLTJENC4xLjUmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1D WENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBG a0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVF QXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25p SGlRaXB4SFppQ0c2MncmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+U2VjdGlvbiZuYnNwOzQuMS41 IFtSRkM3NTE5XTwvYT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGE8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgTnVtZXJpY0RhdGUuJm5ic3A7 IEluIHRoZSBjb250ZXh0IG9mIHRoZSBTRVQgdG9rZW4gaXQgU0hBTEwgYmU8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgaW50ZXJwcmV0ZWQgdG8g bWVhbiBhIGRhdGUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRvIGhhdmU8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgb2NjdXJyZWQg KGluIHRoZSBwYXN0KSBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuJm5ic3A7IE5vdGU6IHRo ZXJlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IE1BWSBiZSBzb21lIGNhc2VzIHdoZXJlICZxdW90O25iZiZxdW90OyBpcyBzdGlsbCBzbWFsbGVy IHRoYW4gJnF1b3Q7aWF0JnF1b3Q7IHN1Y2ggYXM8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgd2hlbiBpdCB0b29rIGFuIGV4dGVuZGVkIHRpbWUg Zm9yIGEgU0VUIHRvIGJlIGlzc3VlZCAoZm9yIGV4YW1wbGU8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYWZ0ZXIgc29tZSBhbmFseXNpcykuJm5i c3A7IFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj5UaGVyZSBpcyBhbiBhcmd1bWVudCB0aGF0IHRoZSByZWRlZmluaXRp b24gd2lsbCBjYXVzZSBjb25mdXNpb24uJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBwcm9wb3NhbCBpcyB0byByZWdpc3RlciBhIGRp ZmZlcmVudCBjbGFpbSBuYW1lIHN1Y2ggYXMg4oCcdG9l4oCdICh0aW1lIG9mIGV2ZW50KS4gVGhl IHByb3Bvc2VkIG5ldzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ZGVmaW5pdGlvbjo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwcmU+dG9lPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1sX3JmYzc1MTktMjNzZWN0 aW9uLTJENC4xLjUmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xO S2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNI NjF3JmFtcDtzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25pSGlRaXB4SFppQ0c2MncmYW1w O2U9IiB0YXJnZXQ9Il9ibGFuayI+U2VjdGlvbiZuYnNwOzQuMS41IFtSRkM3NTE5XTwvYT4sIGEg bnVtYmVyIHdob3NlIHZhbHVlIGlzIGE8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgTnVtZXJpY0RhdGUuJm5ic3A7IFRoZSB2YWx1ZSBpcyB0aGUg ZGF0ZSBhbmQgdGltZSBpbiB3aGljaCB0aGUgZXZlbnQgaXMgYmVsaWV2ZWQgdG8gaGF2ZTxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvY2N1cnJl ZCBpbiB0aGUgcGFzdCBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuIFRoaXMgY2xhaW0gaXMg T1BUSU9OQUwuPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IFdoZW4gbm90IGFzc2VydGVkLCB0aGUgdmFsdWUgb2Yg4oCcdG9l4oCdIE1BWSBiZSBh c3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0uPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmU+bmJmPG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFRoaXMgY2xhaW0gaXMgbm90IHVzZWQg aW4gU0VUIEV2ZW50cy4gSWYgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBTSE9VTEQ8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYmUgaWdub3JlZC48bzpw PjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+QXJlIHRoZXJlIGFueSBvYmplY3Rpb25zIHRvIHRoZSBwcm9wb3NlZCBj aGFuZ2U/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBB cmNoaXRlY3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmFtcDtkPUR3TUdhUSZhbXA7Yz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxI T01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz0xX1o3T3ZBeWF4bGVzQ2RMTkM1cXNh NVhqOVBaUS1MTWJDYV9obVRvMmVNJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPnd3dy5pbmRlcGVu ZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEg aHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5o dW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVu dCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9y Z19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1D WENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBG a0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVF QXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPThBb29EV1kxRndURzNCajJFTFdxcFQ3WEFhVVlB VVR4Zzc4a2RiMFZPTjgmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjwvc3Bhbj48Yj48aT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtTZWdvZSBVSSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiM1NTU1NTU7Ym9yZGVyOm5vbmUgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5n OjBpbiI+Q09ORklERU5USUFMSVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25m aWRlbnRpYWwgYW5kIHByaXZpbGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUg aW50ZW5kZWQgcmVjaXBpZW50KHMpLg0KIEFueSByZXZpZXcsIHVzZSwgZGlzdHJpYnV0aW9uIG9y IGRpc2Nsb3N1cmUgYnkgb3RoZXJzIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuJm5ic3A7IElmIHlv dSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlm eSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdl IGFuZCBhbnkgZmlsZSBhdHRhY2htZW50cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS48 L3NwYW4+PC9pPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQt ZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+ DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJ Q0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1w O3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0Rv NjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPThBb29EV1kxRndU RzNCajJFTFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZPTjgmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+ aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cu aWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxI T01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz04QW9vRFdZMUZ3VEczQmoyRUxXcXBU N1hBYVVZQVVUeGc3OGtkYjBWT044JmFtcDtlPTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1l dmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4N CjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01G YVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7 cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVhGYjg1 dnVEazBoM1lnZDVxbHg0aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mYW1wO3M9LXpKTE5zX0dfUFhN YnR1eUFBbzVLU25xWmF1NEJIZjctSkZmZTdtWXBCWSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFp bGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9 Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhy ZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9f d3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1w O2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01 YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVhGYjg1dnVEazBo M1lnZDVxbHg0aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mYW1wO3M9LXpKTE5zX0dfUFhNYnR1eUFB bzVLU25xWmF1NEJIZjctSkZmZTdtWXBCWSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9y Z19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1D WENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBG a0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1YRmI4NXZ1RGswaDNZZ2Q1cWx4NGl1 UjdMUjdldlZfQlUwZkxMMDVkWEJNJmFtcDtzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRC SGY3LUpGZmU3bVlwQlkmYW1wO2U9PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWls aW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193 d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7 Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209bXlsN2c0aHBwa1dn ZGpOOVRfVHlNM3RROThFZUk2LTF2OHVEU1c1UHFJdyZhbXA7cz03TzVONXFCTkdLOEdNY2FyVXdI RXRTa05nZm9nRm12X3E2X28wcXY4YXhVJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZr SVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPW15bDdnNGhwcGtXZ2RqTjlUX1R5TTN0 UTk4RWVJNi0xdjh1RFNXNVBxSXcmYW1wO3M9N081TjVxQk5HSzhHTWNhclV3SEV0U2tOZ2ZvZ0Zt dl9xNl9vMHF2OGF4VSZhbXA7ZT08L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcg bGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5p ZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJv UDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJL dWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1rMTdYaVhoRGNBU0ZpUElh Mms4NjhKN0Q4dzhSa080d3gwcmpZaTh3Tm93JmFtcDtzPTVmeWxqcU9TVmlSUTl3bnlNWFVaX2ZR MV9udWFjb2gzeHgzMzhGZGFwU1kmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFp bG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNl R0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209azE3WGlYaERjQVNGaVBJYTJrODY4SjdEOHc4 UmtPNHd4MHJqWWk4d05vdyZhbXA7cz01ZnlsanFPU1ZpUlE5d255TVhVWl9mUTFfbnVhY29oM3h4 MzM4RmRhcFNZJmFtcDtlPTwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWls aW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193 d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7 Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209M3hvUm5ZZUFxZ1dS cXZqbWgxZkZCSGJGcXdQbzAtUzMxS1lySjBzWks3ZyZhbXA7cz1PZ241dldTSlFiMV93Nl82elVs cThDUFJrZWdpMXhfM0cta25sYlprNmtFJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZr SVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPTN4b1JuWWVBcWdXUnF2am1oMWZGQkhi RnF3UG8wLVMzMUtZckowc1pLN2cmYW1wO3M9T2duNXZXU0pRYjFfdzZfNnpVbHE4Q1BSa2VnaTF4 XzNHLWtubGJaazZrRSZhbXA7ZT08L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxp bmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+SWQtZXZlbnRA aWV0Zi5vcmc8L2E+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGlu Zm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4 QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3 bE5LZTRDX2xMSUdrJmFtcDttPUc3Z0kxVFQzN0lIc05WaFRObThTVmt2RnNEM2xack1xamtDQ1FS ZmxNcUUmYW1wO3M9ekZJZkljVW5fdFAwMHA2eWMybkxtdXZsTFpLaEFaWHYtckpyNGlLMGQtWSZh bXA7ZT0iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRl dmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBr S1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xM SUdrJmFtcDttPUc3Z0kxVFQzN0lIc05WaFRObThTVmt2RnNEM2xack1xamtDQ1FSZmxNcUUmYW1w O3M9ekZJZkljVW5fdFAwMHA2eWMybkxtdXZsTFpLaEFaWHYtckpyNGlLMGQtWSZhbXA7ZT08L3Nw YW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB05047D4D677ACB9DFC82D412F5440CY4PR21MB0504namp_-- From nobody Thu Oct 26 17:09:53 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1008B138B5E for ; Thu, 26 Oct 2017 17:09:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.298 X-Spam-Level: X-Spam-Status: No, score=-17.298 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M5DCzc68ZePC for ; Thu, 26 Oct 2017 17:09:49 -0700 (PDT) Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C3D713A302 for ; Thu, 26 Oct 2017 17:09:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1509062989; x=1540598989; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=MNchKRcrVEw+hYsxJP5v0IamR3Oawic8wcPReyvtDSs=; b=UoO7Sdknf5PyCt7+ccmjuTues2gu+ZufD0GqO68v0xRUr2l9A0TOyYSr Cc7PKLeEBRWpTcKmGbAxlqnurO0Y4s9neLV42UpktPR0Cl97VSm7zVRAT LPSrYajavJuMZEU1VYhUUhLN7v+SFtds0izuqsVAD7swX3ywpj5vbaDrb Y=; X-IronPort-AV: E=Sophos;i="5.44,302,1505779200"; d="scan'208,217";a="570442877" Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-2b-a7fdc47a.us-west-2.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Oct 2017 00:08:58 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan3.pdx.amazon.com [10.236.137.198]) by email-inbound-relay-2b-a7fdc47a.us-west-2.amazon.com (8.14.7/8.14.7) with ESMTP id v9R08s89030399 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 27 Oct 2017 00:08:57 GMT Received: from EX13D11UWC002.ant.amazon.com (10.43.162.174) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 27 Oct 2017 00:08:55 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC002.ant.amazon.com (10.43.162.174) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 27 Oct 2017 00:08:55 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Fri, 27 Oct 2017 00:08:54 +0000 From: "Richard Backman, Annabelle" To: Phil Hunt , Marius Scurtescu CC: Brian Campbell , Mike Jones , ID Events Mailing List Thread-Topic: [Id-event] Replacing "nbf" claim with a new "toe" claim Thread-Index: AQHTN9K/qlvLmS09/ky6I+v1p9U3wqLKa5QAgCfcawCAAAvBAIAABJkAgAADI4CAAq3GAIAAK9sAgAAClQCAAACogIAAAQaAgAABe4CAAAp9gIAAAj6AgAABngCAAbazAA== Date: Fri, 27 Oct 2017 00:08:54 +0000 Message-ID: References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> In-Reply-To: <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.162.246] Content-Type: multipart/alternative; boundary="_000_A4718B535081408B9624A1F31F6D1158amazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 00:09:52 -0000 --_000_A4718B535081408B9624A1F31F6D1158amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 V2hhdCBkb2VzIHRoZSDigJxNQVnigJ0gaW4gdGhpcyBzZW50ZW5jZSBtZWFuPw0KV2hlbiBub3Qg YXNzZXJ0ZWQsIHRoZSB2YWx1ZSBvZiDigJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhl IHZhbHVlIG9mIOKAnGlhdOKAnS4NCg0KSSBjYW4gdGhpbmsgb2YgYSBjb3VwbGUgd2F5cyB0byBy ZWFkIHRoaXMsIG5laXRoZXIgb2Ygd2hpY2ggc2VlbSBhcHByb3ByaWF0ZSBmb3IgU0VUOg0KDQog IDEuICBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbnMgY2FuIGRlY2xhcmUgdGhhdCB0aGVzZSBhcmUg dGhlIHNlbWFudGljcyBvZiBhIG1pc3Npbmcg4oCcdG9l4oCdIGNsYWltLCBidXQgaWYgdGhlIFBy b2ZpbGluZyBTcGVjaWZpY2F0aW9uIGRvZXMgbm90IGRvIHNvLCB0aGVuIHRoZSBzZW1hbnRpY3Mg YXJlIHN0aWxsIHVuZGVmaW5lZC4NCiAgICAgKiAgIFdoeSB3b3VsZCB0aGlzIG5lZWQgdG8gYmUg c3BlY2lmaWVkIGF0IGFsbD8NCiAgMi4gIFVubGVzcyBhIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9u IHNheXMgb3RoZXJ3aXNlLCB0aGVzZSBhcmUgdGhlIHNlbWFudGljcyBvZiBhIG1pc3Npbmcg4oCc dG9l4oCdIGNsYWltLg0KICAgICAqICAgV2hhdCBtYWtlcyB1cyB0aGluayB0aGF0IHRoaXMgaXMg YW4gYXBwcm9wcmlhdGUgZGVmYXVsdD8gRm9yIG1hbnkgUklTQyBldmVudHMsIHRoZSB0aW1lIG9m IGV2ZW50IHdpbGwgYmUgdW5rbm93biwgb3IgcHJvaGliaXRpdmVseSBleHBlbnNpdmUgdG8ga25v dy4gQXJlIHRoZSBzZW1hbnRpY3Mgb2YgYSBudWxsIOKAnHRvZeKAnSBjbGFpbSBhbGxvd2VkIHRv IGJlIGRpZmZlcmVudCBmcm9tIHRob3NlIG9mIGEgbWlzc2luZyBjbGFpbT8NCg0KLS0NCkFubmFi ZWxsZSBSaWNoYXJkIEJhY2ttYW4NCkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXMNCg0KDQpG cm9tOiBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPg0KRGF0ZTogV2VkbmVzZGF5LCBP Y3RvYmVyIDI1LCAyMDE3IGF0IDI6NTkgUE0NClRvOiBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRl c2N1QGdvb2dsZS5jb20+DQpDYzogIlJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIiA8cmljaGFu bmFAYW1hem9uLmNvbT4sIEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNv bT4sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4sIElEIEV2ZW50cyBN YWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0g UmVwbGFjaW5nICJuYmYiIGNsYWltIHdpdGggYSBuZXcgInRvZSIgY2xhaW0NCg0KT0vigKYudW5s ZXNzIHRoZXJlIGlzIG9iamVjdGlvbiwgSSB3aWxsIHJldmlzZSB0aGUgZHJhZnQgc28gdGhhdCDi gJx0b2XigJ0gd2lsbCBiZWNvbWUgYSByZWNvbW1lbmRlZCBhdHRyaWJ1dGUuDQoNClBoaWwNCg0K T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QNCkBp bmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cDovL3d3dy5pbmRlcGVuZGVu dGlkLmNvbT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bT4NCg0KT24gT2N0IDI1LCAyMDE3LCBhdCAyOjUyIFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1 cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0K DQpPbiBXZWQsIE9jdCAyNSwgMjAxNyBhdCAyOjQ0IFBNLCBQaGlsIEh1bnQgKElETSkgPHBoaWwu aHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KDQpB cmUgeW91IHByb3Bvc2luZyBBIHdpdGggYSBzaG91bGQvcmVjb21tZW5kZWQ/DQoNClllcw0KDQoN Cg0KSXQgaXMgbW9yZSBjb25zaXN0ZW50IGJ1dCBhZGRzIGEgbG90IG9mIGR1cGxpY2F0aW9uIGlu IG1hbnkgY2FzZXMgd2hlcmUgaWF0ID0gdG9lLg0KDQpJIGRvbid0IHRoaW5rIHRoYXQgc2hvdWxk IGJlIGEgcHJvYmxlbS4NCg0KDQoNClBoaWwNCg0KT24gT2N0IDI1LCAyMDE3LCBhdCAyOjA3IFBN LCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVz Y3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KT24gV2VkLCBPY3QgMjUsIDIwMTcgYXQgMjowMiBQTSwg UGhpbCBIdW50IChJRE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9y YWNsZS5jb20+PiB3cm90ZToNCklmIGFuIGV2ZW50IGRvZXNuJ3QgaGF2ZSBhIHRpbWUsIGRpZCBp dCBvY2N1cj8NCg0KQXQgdW5kaXNjbG9zZWQgdGltZSBhbmQgbG9jYXRpb24gOi0pDQoNCkkgdGhp bmsgaXQgaXMgZmluZSBmb3IgInRvZSIgdG8gYmUgU0hPVUxEL1JFQ09NTUVOREVELCBidXQgbm90 IE1VU1QvUkVRVUlSRUQuDQoNCg0KUGhpbA0KDQpPbiBPY3QgMjUsIDIwMTcsIGF0IDE6NTggUE0s IE1hcml1cyBTY3VydGVzY3UgPG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNj dUBnb29nbGUuY29tPj4gd3JvdGU6DQpBcyBJIHNhaWQsIEkgdG90YWxseSBhZ3JlZSBpdCBpcyB1 c2VmdWwuIEJ1dCB3aHkgcmVxdWlyZWQ/DQoNCk1hcml1cw0KDQpPbiBXZWQsIE9jdCAyNSwgMjAx NyBhdCAxOjU2IFBNLCBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KSW4gc29tZSBjYXNlcywgb3JkZXJpbmcg b2YgZXZlbnRzIGFnYWluc3QgYSBzaW5nbGUgc3ViamVjdCBtYXR0ZXJzLiBUaW1lIGlzIHVzZWZ1 bCBmb3IgdGhpcyBwdXJwb3NlIHRob3VnaCBsaW1pdGVkIGluIHRoZSBvdmVyYWxsIHN0cmVhbSBm b3Igb3JkZXJpbmcgZXZlbnRzIG92ZXJhbGwuDQoNCkZvciBleGFtcGxlIGFjY291bnQgbG9ja2Vk IHZzIHVubG9ja2VkLiBLbm93aW5nIHdoYXQgaGFwcGVuZWQgbGFzdCB3b3VsZCBzZWVtIGltcG9y dGFudCBubz8NCg0KUGhpbA0KDQpPbiBPY3QgMjUsIDIwMTcsIGF0IDE6NDYgUE0sIE1hcml1cyBT Y3VydGVzY3UgPG1zY3VydGVzY3VAZ29vZ2xlLmNvbTxtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUu Y29tPj4gd3JvdGU6DQpPbiBXZWQsIE9jdCAyNSwgMjAxNyBhdCAxMTowOSBBTSwgUGhpbCBIdW50 IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90 ZToNCkl0IGlzIG5vdCBjbGVhciBob3cgdG8gcmV2aXNlIHRoZSBkb2N1bWVudCB3aXRoIHJlZ2Fy ZHMgdG8gdGhlIHN1Z2dlc3Rpb24gYWdhaW5zdCB1c2luZyDigJxpYXTigJ0gd2hlbiDigJx0b2Xi gJ0gaXMgbm90IGFzc2VydGVkLg0KDQpJZiBJIHJlbW92ZSB0aGlzIGNsYXJpZmljYXRpb24sIGl0 IHNlZW1zIHVuY2xlYXIgd2hhdCB0aGUgdGltZSBvZiB0aGUgZXZlbnQgaXMgZGVmaW5lZCBhcy4g IFRoZXJlIHNlZW0gdG8gYmUgdHdvIG9wdGlvbnM6DQoNCkEuIElmIOKAnGlhdOKAnSBjYW7igJl0 IGJlIGFzc3VtZWQgdG8gYmUgdGhlIHRpbWUgb2YgZXZlbnQsIHRoZW4g4oCcdG9l4oCdIHNob3Vs ZCBiZSBhIHJlcXVpcmVkIGNsYWltLg0KDQpXaHk/IFdoeSBjYW4ndCB0aGUgVHJhbnNtaXR0ZXIg YXNzZXJ0IHRoYXQgYW4gYWNjb3VudCB3YXMgZGlzYWJsZWQgYW5kIG5vdCBwcm92aWRlIGEgc3Bl Y2lmaWMgZXZlbnQgdGltZT8gSSB1bmRlcnN0YW5kIHRoYXQgYW4gZXZlbnQgdGltZSBpcyBkZXNp cmFibGUsIGJ1dCB3aHkgcmVxdWlyZWQ/DQoNCg0KDQpCLiBGb3IgdGhlIG1ham9yaXR5IG9mIHVz ZSBjYXNlcywg4oCcaWF04oCdIGlzIGNvbW1vbmx5IHVzZWQgdG8gbWFyayBTRVQgaXNzdWFuY2Ug YW5kIGV2ZW50IHRpbWUuICDigJx0b2XigJ0gaXMgb25seSBuZWVkZWQgd2hlbiB0aGUgdGltZSBv ZiB0aGUgZXZlbnQgaXMgZGlmZmVyZW50IChvbiBhbiBleGNlcHRpb25hbCBiYXNpcykuDQoNCklm IFNFVCBpc3N1YW5jZSBhbmQgZXZlbnQgdGltZSBhcmUgaW5kZWVkIHRoZSBzYW1lIHRoZW4gYm90 aCBjbGFpbXMgc2hvdWxkIGJlIHByZXNlbnQuIEkgZG9uJ3QgdGhpbmsgaWF0IHNob3VsZCBpbXBs eSB0b2UuDQoNCg0KU29tZSBjbGFyaWZpY2F0aW9uIGZyb20gdGhlIGdyb3VwIHdvdWxkIGJlIGFw cHJlY2lhdGVkLiAgU2hvdWxkIHdlIHByb2NlZWQgd2l0aCBCLCBvciByZXZpc2UgdGhlIHRleHQg dG8gQSAob3Igc29tZSBvdGhlciBwcm9wb3NhbCkuDQoNClRoYW5rcywNCg0KUGhpbA0KDQpPcmFj bGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGluZGVw ZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdNRmFR JmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1teWw3ZzRocHBrV2dkak45VF9U eU0zdFE5OEVlSTYtMXY4dURTVzVQcUl3JnM9QTk3NjFyUFhmRmRlcXpKNHBSTi1CUV94MVVTbE0y YlFUWG9DTmVMRkFaQSZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRA b3JhY2xlLmNvbT4NCg0KT24gT2N0IDIzLCAyMDE3LCBhdCA2OjE1IFBNLCBNYXJpdXMgU2N1cnRl c2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+ IHdyb3RlOg0KDQpPbiBNb24sIE9jdCAyMywgMjAxNyBhdCA2OjA0IFBNLCBSaWNoYXJkIEJhY2tt YW4sIEFubmFiZWxsZSA8cmljaGFubmFAYW1hem9uLmNvbTxtYWlsdG86cmljaGFubmFAYW1hem9u LmNvbT4+IHdyb3RlOg0KQWdyZWVkIG92ZXJhbGwuIEhhdmluZyByZXJlYWQgdGhlIHByb3Bvc2Vk IHRleHQsIEkgc3VnZ2VzdCBzdHJpa2luZyB0aGUgbGFzdCBzZW50ZW5jZSwg4oCcV2hlbiBub3Qg YXNzZXJ0ZWQsIHRoZSB2YWx1ZSBvZiDigJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhl IHZhbHVlIG9mIOKAnGlhdOKAnS7igJ0gSSBkbyBub3QgdGhpbmsgaXQgaXMgbmVjZXNzYXJ5IG9y IHBhcnRpY3VsYXJseSBoZWxwZnVsIHRvIHN0YW5kYXJkaXplIHRoZSBzZW1hbnRpY3Mgb2YgYSBt aXNzaW5nIHRpbWUtb2YtZXZlbnQgY2xhaW0gYXQgdGhlIFNFVCBsZXZlbC4NCg0KKzENCg0KDQoN Ci0tDQpBbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuDQpBbWF6b24g4oCTIElkZW50aXR5IFNlcnZp Y2VzDQoNCg0KRnJvbTogSWQtZXZlbnQgPGlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRv OmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2YgIlBoaWwgSHVudCAoSURN KSIgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+DQpE YXRlOiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgYXQgNTo0OCBQTQ0KVG86IE1pa2UgSm9uZXMg PE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPj4NCkNjOiBCcmlhbiBDYW1wYmVsbCA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208 bWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPj4sIElEIEV2ZW50cyBNYWlsaW5nIExp c3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQoNClN1Ympl Y3Q6IFJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAibmJmIiBjbGFpbSB3aXRoIGEgbmV3ICJ0b2Ui IGNsYWltDQoNCg0KQWdyZWVkICsxIG9uIEJyaWFuJ3MgZWRpdHMuDQoNClBoaWwNCg0KT24gT2N0 IDIzLCAyMDE3LCBhdCA1OjA1IFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KQW5uYWJl bGxlIGFuZCBJIGFncmVlZCB3aXRoIHRoaXMgcHJvcG9zZWQgY2hhbmdlIChhcyBjb3JyZWN0bHkg d29yZHNtaXRoZWQgYnkgQnJpYW4pIGR1cmluZyBvdXIgaW4tcGVyc29uIHJldmlldyDigJMgYXMg YWxzbyBub3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFyaXVz4oCZIGNvbW1lbnRzLg0KDQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg VGhhbmtzIFBoaWwgYW5kIGFsbCwNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IElkLWV2ZW50IFtt YWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIEJyaWFuIENhbXBi ZWxsDQpTZW50OiBUaHVyc2RheSwgU2VwdGVtYmVyIDI4LCAyMDE3IDg6MjMgQU0NClRvOiBQaGls IEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+ DQpDYzogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlk LWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAibmJm IiBjbGFpbSB3aXRoIGEgbmV3ICJ0b2UiIGNsYWltDQoNCisxIHRvIFNFVCBkZWZpbmluZyBhIHRp bWUgb2YgZXZlbnQgY2xhaW0gcmF0aGVyIHRoYW4gdHJ5aW5nIHRvIHJlZGVmaW5lIGEgc3RhbmRh cmQgY2xhaW0uIEFuZCB3aG8gZG9lc24ndCBsaWtlIGEgY2xhaW0gbmFtZWQgInRvZSI/DQpIb3dl dmVyLCB0aGUgdGV4dCB0aGVyZSBmb3IgbmJmIGlzIHN0aWxsIGVmZmVjdGl2ZWx5IHJlZGVmaW5p bmcgaXQgYnkgc2F5aW5nIGl0IHNob3VsZCBiZSBpZ25vcmVkLCB3aGljaCBpc24ndCBjb25zaXN0 ZW50IHdpdGggdGhlICJNVVNUIE5PVCBiZSBhY2NlcHRlZCBmb3IgcHJvY2Vzc2luZyIgZnJvbSBS RkMgNzUxOS4gSXQgd291bGQgYmUgbW9yZSBhcHByb3ByaWF0ZSB0byBzYXkgdGhhdCBuYmYgc2hv dWxkL211c3Qgbm90IGJlIGluY2x1ZGVkIGluIGEgU0VULiBPciBqdXN0IG5vdCBtZW50aW9uIG5i ZiBhdCBhbGwuIEJ1dCBkb24ndCBjaGFuZ2UgdGhlIG1lYW5pbmcuDQpBbHNvIHRvZSB3b3VsZCBu b3QgYmUgIkRlZmluZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV0iLCB3aGljaCBpcyB0aGUg bmJmIHNlY3Rpb24uIFRoZSB2YWx1ZSBvZiB0aGUgdG9lIGNsYWltIGlzIGEgTnVtZXJpY0RhdGUs IHdoaWNoIGlzIGRlZmluZWQgaW4gU2VjIDIgUkZDNzUxOS4gQnV0IHRvZSBoYXMgbm8gcmVsYXRp b24gdG8gbmJmIGFuZCBubyByZWFzb24gdG8gcmVmZXJlbmNlIG5iZi4NCg0KT24gV2VkLCBTZXAg MjcsIDIwMTcgYXQgMjo1MyBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWls dG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCkR1cmluZyB0aGUgT3BlbklEIFJJU0Mg RmFjZSB0byBGYWNlIG1lZXRpbmcgYSBxdWVzdGlvbiBjYW1lIHVwIHJlZ2FyZGluZyBTRVTigJlz IHJlZGVmaW5pdGlvbiBvZiDigJxuYmbigJ0gYW5kIHdoZXRoZXIgdGhhdCByZWRlZmluaXRpb24g d2FzIGFwcHJvcHJpYXRlLg0KDQpUaGUgaW50ZW50aW9uIG9mIFNFVHMgZGVmaW5pdGlvbiBpcyB0 byBhbGxvdyBTRVQgVHJhbnNtaXR0ZXJzIHRvIGluZGljYXRlIHRoYXQgYW4gZXZlbnQgbWF5IGhh dmUgb2NjdXJyZWQgYXMgZWFybHkgYXMgYSBzcGVjaWZpZWQgZGF0ZSDigJQgYSBkYXRlIHdoaWNo IGlzIGRpZmZlcmVudCBmcm9tIHRoZSBpc3N1YW5jZSBkYXRlIG9mIHRoZSBTRVQuIEluIHBhcnRp Y3VsYXIgdGhpcyBpcyB1c2VmdWwgaW4gY2FzZXMgd2hlcmUgdGhlIHN0YXRlIGNoYW5nZSBpcyBi ZWxpZXZlZCB0byBoYXZlIG9jY3VycmVkIGVhcmxpZXIgdGhhbiB0aGUgdGltZSBvZiBpc3N1YW5j ZSAoZS5nLiBiZWNhdXNlIHRoZSBpbmNpZGVudCB3YXMgZGlzY292ZXJlZCB0aHJvdWdoIGFuIGFk bWluaXN0cmF0aXZlIHJldmlldyBvciBkYXRhIGFuYWx5c2lzIHRvIGhhdmUgb2NjdXJyZWQgaW4g dGhlIHBhc3QpLg0KDQpUaGUgZGVmaW5pdGlvbiBmcm9tIEpXVCBpczoNCjQuMS41PGh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5v cmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNW Z0hTaWNINjF3JnM9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdPbmlIaVFpcHhIWmlDRzYydyZl PT4uICAibmJmIiAoTm90IEJlZm9yZSkgQ2xhaW0NCg0KDQoNCg0KDQogICBUaGUgIm5iZiIgKG5v dCBiZWZvcmUpIGNsYWltIGlkZW50aWZpZXMgdGhlIHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBKV1QN Cg0KICAgTVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcuICBUaGUgcHJvY2Vzc2lu ZyBvZiB0aGUgIm5iZiINCg0KICAgY2xhaW0gcmVxdWlyZXMgdGhhdCB0aGUgY3VycmVudCBkYXRl L3RpbWUgTVVTVCBiZSBhZnRlciBvciBlcXVhbCB0bw0KDQogICB0aGUgbm90LWJlZm9yZSBkYXRl L3RpbWUgbGlzdGVkIGluIHRoZSAibmJmIiBjbGFpbS4gIEltcGxlbWVudGVycyBNQVkNCg0KICAg cHJvdmlkZSBmb3Igc29tZSBzbWFsbCBsZWV3YXksIHVzdWFsbHkgbm8gbW9yZSB0aGFuIGEgZmV3 IG1pbnV0ZXMsIHRvDQoNCiAgIGFjY291bnQgZm9yIGNsb2NrIHNrZXcuICBJdHMgdmFsdWUgTVVT VCBiZSBhIG51bWJlciBjb250YWluaW5nIGENCg0KICAgTnVtZXJpY0RhdGUgdmFsdWUuICBVc2Ug b2YgdGhpcyBjbGFpbSBpcyBPUFRJT05BTC4NCg0KDQpBcyBkZWZpbmVkIGluIFNFVDoNCg0KICAg bmJmDQoNCiAgICAgIERlZmluZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV08aHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9y Z19odG1sX3JmYzc1MTktMjNzZWN0aW9uLTJENC4xLjUmZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZtPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1Zn SFNpY0g2MXcmcz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmU9 PiwgYSBudW1iZXIgd2hvc2UgdmFsdWUgaXMgYQ0KDQogICAgICBOdW1lcmljRGF0ZS4gIEluIHRo ZSBjb250ZXh0IG9mIHRoZSBTRVQgdG9rZW4gaXQgU0hBTEwgYmUNCg0KICAgICAgaW50ZXJwcmV0 ZWQgdG8gbWVhbiBhIGRhdGUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRvIGhhdmUN Cg0KICAgICAgb2NjdXJyZWQgKGluIHRoZSBwYXN0KSBvciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1 cmUuICBOb3RlOiB0aGVyZQ0KDQogICAgICBNQVkgYmUgc29tZSBjYXNlcyB3aGVyZSAibmJmIiBp cyBzdGlsbCBzbWFsbGVyIHRoYW4gImlhdCIgc3VjaCBhcw0KDQogICAgICB3aGVuIGl0IHRvb2sg YW4gZXh0ZW5kZWQgdGltZSBmb3IgYSBTRVQgdG8gYmUgaXNzdWVkIChmb3IgZXhhbXBsZQ0KDQog ICAgICBhZnRlciBzb21lIGFuYWx5c2lzKS4gIFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuDQoNClRo ZXJlIGlzIGFuIGFyZ3VtZW50IHRoYXQgdGhlIHJlZGVmaW5pdGlvbiB3aWxsIGNhdXNlIGNvbmZ1 c2lvbi4NCg0KVGhlIHByb3Bvc2FsIGlzIHRvIHJlZ2lzdGVyIGEgZGlmZmVyZW50IGNsYWltIG5h bWUgc3VjaCBhcyDigJx0b2XigJ0gKHRpbWUgb2YgZXZlbnQpLiBUaGUgcHJvcG9zZWQgbmV3DQpk ZWZpbml0aW9uOg0KDQoNCnRvZQ0KDQogICAgICBEZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjUgW1JG Qzc1MTldPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmQ9RHdNR2FR JmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNC alVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdPbmlI aVFpcHhIWmlDRzYydyZlPT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGENCg0KICAgICAgTnVt ZXJpY0RhdGUuICBUaGUgdmFsdWUgaXMgdGhlIGRhdGUgYW5kIHRpbWUgaW4gd2hpY2ggdGhlIGV2 ZW50IGlzIGJlbGlldmVkIHRvIGhhdmUNCg0KICAgICAgb2NjdXJyZWQgaW4gdGhlIHBhc3Qgb3Ig d2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiBUaGlzIGNsYWltIGlzIE9QVElPTkFMLg0KDQogICAg ICBXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZhbHVlIG9mIOKAnHRvZeKAnSBNQVkgYmUgYXNzdW1l ZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCcaWF04oCdLg0KDQoNCg0KbmJmDQoNCiAgICAgIFRoaXMg Y2xhaW0gaXMgbm90IHVzZWQgaW4gU0VUIEV2ZW50cy4gSWYgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBT SE9VTEQNCg0KICAgICAgYmUgaWdub3JlZC4NCg0KDQpBcmUgdGhlcmUgYW55IG9iamVjdGlvbnMg dG8gdGhlIHByb3Bvc2VkIGNoYW5nZT8NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElk ZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRl cGVuZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVp dnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hT aWNINjF3JnM9MV9aN092QXlheGxlc0NkTE5DNXFzYTVYajlQWlEtTE1iQ2FfaG1UbzJlTSZlPT4N CnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQg bWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+ DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJm09TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2lj SDYxdyZzPThBb29EV1kxRndURzNCajJFTFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZPTjgmZT0+DQoN Cg0KQ09ORklERU5USUFMSVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRl bnRpYWwgYW5kIHByaXZpbGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50 ZW5kZWQgcmVjaXBpZW50KHMpLiBBbnkgcmV2aWV3LCB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNj bG9zdXJlIGJ5IG90aGVycyBpcyBzdHJpY3RseSBwcm9oaWJpdGVkLiAgSWYgeW91IGhhdmUgcmVj ZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9uIGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5k ZXIgaW1tZWRpYXRlbHkgYnkgZS1tYWlsIGFuZCBkZWxldGUgdGhlIG1lc3NhZ2UgYW5kIGFueSBm aWxlIGF0dGFjaG1lbnRzIGZyb20geW91ciBjb21wdXRlci4gVGhhbmsgeW91Lg0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcg bGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5v cmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVp dnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hT aWNINjF3JnM9OEFvb0RXWTFGd1RHM0JqMkVMV3FwVDdYQWFVWUFVVHhnNzhrZGIwVk9OOCZlPQ0K DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZl bnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJm09WEZiODV2dURrMGgzWWdkNXFseDRpdVI3TFI3ZXZWX0JVMGZM TDA1ZFhCTSZzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRCSGY3LUpGZmU3bVlwQlkmZT0+ DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1l dmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJv UDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09WEZiODV2dURrMGgzWWdkNXFseDRpdVI3 TFI3ZXZWX0JVMGZMTDA1ZFhCTSZzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVphdTRCSGY3LUpG ZmU3bVlwQlkmZT0NCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQm ZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9 SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPW15bDdnNGhwcGtX Z2RqTjlUX1R5TTN0UTk4RWVJNi0xdjh1RFNXNVBxSXcmcz03TzVONXFCTkdLOEdNY2FyVXdIRXRT a05nZm9nRm12X3E2X28wcXY4YXhVJmU9DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYu b3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9f aWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09 azE3WGlYaERjQVNGaVBJYTJrODY4SjdEOHc4UmtPNHd4MHJqWWk4d05vdyZzPTVmeWxqcU9TVmlS UTl3bnlNWFVaX2ZRMV9udWFjb2gzeHgzMzhGZGFwU1kmZT0NCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQt ZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4 QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktl NENfbExJR2smbT0zeG9SblllQXFnV1JxdmptaDFmRkJIYkZxd1BvMC1TMzFLWXJKMHNaSzdnJnM9 T2duNXZXU0pRYjFfdzZfNnpVbHE4Q1BSa2VnaTF4XzNHLWtubGJaazZrRSZlPQ0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGlu ZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRm Lm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZtPUc3Z0kxVFQzN0lIc05WaFRObThTVmt2RnNEM2xack1xamtD Q1FSZmxNcUUmcz16RklmSWNVbl90UDAwcDZ5YzJuTG11dmxMWktoQVpYdi1ySnI0aUswZC1ZJmU9 DQoNCg== --_000_A4718B535081408B9624A1F31F6D1158amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseToiU2Vnb2UgVUkiO30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KaDQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJ bXNvLXN0eWxlLWxpbms6IkhlYWRpbmcgNCBDaGFyIjsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IixzZXJpZjt9DQpwLk1zb0xp c3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJ e21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFw cGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxl LW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4ubTE1NDU2MDk0MzUxMTA0NTY0Njht NDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4 MTgwYXBwbGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTptXzE1NDU2MDk0MzUxMTA0NTY0 NjhtXzQwMzU0MDE4NjExMDgxNzM3MzZtXy03NDM0MDc1MDQ3NjgxNzU1NDQ0bV8yNTExMTM5NzIw MzgzNzE4MTgwYXBwbGUtc3R5bGUtc3Bhbjt9DQpzcGFuLm0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQw MzU0MDE4NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4 MGFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTptXzE1NDU2MDk0MzUxMTA0 NTY0NjhtXzQwMzU0MDE4NjExMDgxNzM3MzZtXy03NDM0MDc1MDQ3NjgxNzU1NDQ0bV8yNTExMTM5 NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uSGVhZGluZzRDaGFyDQoJ e21zby1zdHlsZS1uYW1lOiJIZWFkaW5nIDQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk7 DQoJbXNvLXN0eWxlLWxpbms6IkhlYWRpbmcgNCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkgTGln aHQiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzJGNTQ5NjsNCglmb250LXN0eWxlOml0YWxpYzt9DQpz cGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1h dHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhU TUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseToiQ291cmllciIsc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMjQNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lu cw0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0 ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NDIwMjI2NDc4 Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoyMDY4Nzcx Nzg2IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1 IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxl dmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQt aW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93 ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7 fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6 bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCm9sDQoJe21hcmdp bi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+DQo8 L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPldoYXQgZG9lcyB0aGUg4oCcTUFZ4oCdIGluIHRoaXMgc2VudGVuY2UgbWVhbj88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYi PldoZW4gbm90IGFzc2VydGVkLCB0aGUgdmFsdWUgb2Yg4oCcdG9l4oCdIE1BWSBiZSBhc3N1bWVk IHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBjYW4gdGhpbmsgb2YgYSBjb3Vw bGUgd2F5cyB0byByZWFkIHRoaXMsIG5laXRoZXIgb2Ygd2hpY2ggc2VlbSBhcHByb3ByaWF0ZSBm b3IgU0VUOjxvOnA+PC9vOnA+PC9wPg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9 IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MGluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj5Qcm9maWxpbmcgU3BlY2lmaWNhdGlv bnMgY2FuIGRlY2xhcmUgdGhhdCB0aGVzZSBhcmUgdGhlIHNlbWFudGljcyBvZiBhIG1pc3Npbmcg 4oCcdG9l4oCdIGNsYWltLCBidXQgaWYgdGhlIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uIGRvZXMg bm90IGRvIHNvLCB0aGVuIHRoZSBzZW1hbnRpY3MgYXJlIHN0aWxsIHVuZGVmaW5lZC48bzpwPjwv bzpwPg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9IjEiIHR5cGU9ImEiPg0KPGxp IGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0 OmwwIGxldmVsMiBsZm8xIj5XaHkgd291bGQgdGhpcyBuZWVkIHRvIGJlIHNwZWNpZmllZCBhdCBh bGw/PG86cD48L286cD48L2xpPjwvb2w+DQo8L2xpPjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+VW5sZXNz IGEgUHJvZmlsaW5nIFNwZWNpZmljYXRpb24gc2F5cyBvdGhlcndpc2UsIHRoZXNlIGFyZSB0aGUg c2VtYW50aWNzIG9mIGEgbWlzc2luZyDigJx0b2XigJ0gY2xhaW0uPG86cD48L286cD4NCjxvbCBz dHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSJhIj4NCjxsaSBjbGFzcz0iTXNv TGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDIg bGZvMSI+V2hhdCBtYWtlcyB1cyB0aGluayB0aGF0IHRoaXMgaXMgYW4gYXBwcm9wcmlhdGUgZGVm YXVsdD8gRm9yIG1hbnkgUklTQyBldmVudHMsIHRoZSB0aW1lIG9mIGV2ZW50IHdpbGwgYmUgdW5r bm93biwgb3IgcHJvaGliaXRpdmVseSBleHBlbnNpdmUgdG8ga25vdy4gQXJlIHRoZSBzZW1hbnRp Y3Mgb2YgYSBudWxsIOKAnHRvZeKAnQ0KIGNsYWltIGFsbG93ZWQgdG8gYmUgZGlmZmVyZW50IGZy b20gdGhvc2Ugb2YgYSBtaXNzaW5nIGNsYWltPzxvOnA+PC9vOnA+PC9saT48L29sPg0KPC9saT48 L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj4tLSZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+ QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2 aWNlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRE RiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5QaGlsIEh1 bnQgJmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5XZWRuZXNk YXksIE9jdG9iZXIgMjUsIDIwMTcgYXQgMjo1OSBQTTxicj4NCjxiPlRvOiA8L2I+TWFyaXVzIFNj dXJ0ZXNjdSAmbHQ7bXNjdXJ0ZXNjdUBnb29nbGUuY29tJmd0Ozxicj4NCjxiPkNjOiA8L2I+JnF1 b3Q7UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUmcXVvdDsgJmx0O3JpY2hhbm5hQGFtYXpvbi5j b20mZ3Q7LCBCcmlhbiBDYW1wYmVsbCAmbHQ7YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20mZ3Q7 LCBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7LCBJRCBFdmVu dHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0 OiA8L2I+UmU6IFtJZC1ldmVudF0gUmVwbGFjaW5nICZxdW90O25iZiZxdW90OyBjbGFpbSB3aXRo IGEgbmV3ICZxdW90O3RvZSZxdW90OyBjbGFpbTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PS+KApi51bmxlc3MgdGhlcmUgaXMgb2JqZWN0aW9u LCBJIHdpbGwgcmV2aXNlIHRoZSBkcmFmdCBzbyB0aGF0IOKAnHRvZeKAnSB3aWxsIGJlY29tZSBh IHJlY29tbWVuZGVkIGF0dHJpYnV0ZS4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+UGhpbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOmJsYWNrIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2Vz IEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+QGluZGVwZW5kZW50aWQ8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Imh0dHA6Ly93d3cuaW5kZXBlbmRlbnRp ZC5jb20iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Ij5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T24gT2N0IDI1LCAyMDE3LCBhdCAyOjUyIFBNLCBNYXJpdXMgU2N1cnRl c2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBnb29nbGUuY29tIj5tc2N1cnRlc2N1 QGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+T24gV2VkLCBP Y3QgMjUsIDIwMTcgYXQgMjo0NCBQTSwgUGhpbCBIdW50IChJRE0pPHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4m Z3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPndyb3Rl OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7 bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8xNTQ1NjA5NDM1MTEwNDU2NDY4QXBwbGVNYWlsU2ln bmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkFyZSB5b3Ug cHJvcG9zaW5nIEEgd2l0aCBhIHNob3VsZC9yZWNvbW1lbmRlZD88bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlllczxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2IGlkPSJt XzE1NDU2MDk0MzUxMTA0NTY0NjhBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2IGlkPSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhBcHBsZU1haWxTaWduYXR1cmUiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SXQgaXMgbW9yZSBjb25zaXN0 ZW50IGJ1dCBhZGRzIGEgbG90IG9mIGR1cGxpY2F0aW9uIGluIG1hbnkgY2FzZXMgd2hlcmUgaWF0 ID0gdG9lLiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSBkb24ndCB0aGluayB0aGF0IHNob3VsZCBiZSBh IHByb2JsZW0uPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4N CjxkaXYgaWQ9Im1fMTU0NTYwOTQzNTExMDQ1NjQ2OEFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpQaGlsPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4N Ck9uIE9jdCAyNSwgMjAxNywgYXQgMjowNyBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJl Zj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPm1zY3VydGVz Y3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+T24gV2VkLCBPY3QgMjUsIDIwMTcgYXQgMjowMiBQTSwgUGhpbCBIdW50 IChJRE0pPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZs dDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5w aGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1 b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3Bh ZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBp biI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PklmIGFuIGV2ZW50IGRvZXNuJ3QgaGF2ZSBhIHRpbWUsIGRpZCBpdCBvY2N1cj88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPkF0IHVuZGlzY2xvc2VkIHRpbWUgYW5kIGxvY2F0aW9uIDotKTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgdGhpbmsgaXQgaXMgZmluZSBmb3IgJnF1 b3Q7dG9lJnF1b3Q7IHRvIGJlIFNIT1VMRC9SRUNPTU1FTkRFRCwgYnV0IG5vdCBNVVNUL1JFUVVJ UkVELjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KUGhpbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1i b3R0b206MTIuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpPbiBPY3QgMjUsIDIwMTcsIGF0 IDE6NTggUE0sIE1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1 QGdvb2dsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5BcyBJIHNhaWQsIEkgdG90YWxs eSBhZ3JlZSBpdCBpcyB1c2VmdWwuIEJ1dCB3aHkgcmVxdWlyZWQ/PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5NYXJpdXM8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIFdlZCwgT2N0IDI1LCAyMDE3IGF0IDE6 NTYgUE0sIFBoaWwgSHVudCAoSURNKTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0 YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OzxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj53cm90ZTo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj5JbiBzb21lIGNhc2VzLCBvcmRlcmluZyBvZiBldmVudHMgYWdhaW5z dCBhIHNpbmdsZSBzdWJqZWN0IG1hdHRlcnMuIFRpbWUgaXMgdXNlZnVsIGZvciB0aGlzIHB1cnBv c2UgdGhvdWdoIGxpbWl0ZWQgaW4gdGhlIG92ZXJhbGwgc3RyZWFtIGZvciBvcmRlcmluZyBldmVu dHMgb3ZlcmFsbC4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9 Im1fMTU0NTYwOTQzNTExMDQ1NjQ2OG1fNDAzNTQwMTg2MTEwODE3MzczNm1fLTc0MzQwNzUwNDc2 ODE3NTU0NDRBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IGlk PSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhtXzQwMzU0MDE4NjExMDgxNzM3MzZtXy03NDM0MDc1MDQ3 NjgxNzU1NDQ0QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPkZvciBleGFtcGxlIGFjY291bnQgbG9ja2VkIHZzIHVubG9ja2VkLiBLbm93 aW5nIHdoYXQgaGFwcGVuZWQgbGFzdCB3b3VsZCBzZWVtIGltcG9ydGFudCBubz88YnI+DQo8YnI+ DQpQaGlsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxicj4NCk9uIE9jdCAyNSwgMjAxNywgYXQgMTo0NiBQTSwgTWFyaXVzIFNj dXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+T24gV2VkLCBPY3QgMjUsIDIwMTcgYXQg MTE6MDkgQU0sIFBoaWwgSHVudDxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJn ZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj53cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPkl0IGlzIG5vdCBjbGVhciBob3cgdG8gcmV2aXNlIHRoZSBkb2N1bWVudCB3aXRoIHJl Z2FyZHMgdG8gdGhlIHN1Z2dlc3Rpb24gYWdhaW5zdCB1c2luZyDigJxpYXTigJ0gd2hlbiDigJx0 b2XigJ0gaXMgbm90IGFzc2VydGVkLiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPklmIEkgcmVtb3ZlIHRoaXMgY2xhcmlmaWNhdGlvbiwgaXQgc2VlbXMgdW5j bGVhciB3aGF0IHRoZSB0aW1lIG9mIHRoZSBldmVudCBpcyBkZWZpbmVkIGFzLiZuYnNwOyBUaGVy ZSBzZWVtIHRvIGJlIHR3byBvcHRpb25zOg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPkEuIElmIOKAnGlhdOKAnSBjYW7igJl0IGJlIGFzc3VtZWQgdG8gYmUgdGhlIHRp bWUgb2YgZXZlbnQsIHRoZW4g4oCcdG9l4oCdIHNob3VsZCBiZSBhIHJlcXVpcmVkIGNsYWltLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90 ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj5XaHk/IFdoeSBjYW4ndCB0aGUgVHJhbnNtaXR0ZXIgYXNzZXJ0 IHRoYXQgYW4gYWNjb3VudCB3YXMgZGlzYWJsZWQgYW5kIG5vdCBwcm92aWRlIGEgc3BlY2lmaWMg ZXZlbnQgdGltZT8gSSB1bmRlcnN0YW5kIHRoYXQgYW4gZXZlbnQgdGltZSBpcyBkZXNpcmFibGUs IGJ1dCB3aHkgcmVxdWlyZWQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4i Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Qi4gRm9yIHRoZSBtYWpvcml0eSBvZiB1 c2UgY2FzZXMsIOKAnGlhdOKAnSBpcyBjb21tb25seSB1c2VkIHRvIG1hcmsgU0VUIGlzc3VhbmNl IGFuZCBldmVudCB0aW1lLiAmbmJzcDvigJx0b2XigJ0gaXMgb25seSBuZWVkZWQgd2hlbiB0aGUg dGltZSBvZiB0aGUgZXZlbnQgaXMgZGlmZmVyZW50IChvbiBhbiBleGNlcHRpb25hbA0KIGJhc2lz KS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SWYgU0VUIGlzc3VhbmNlIGFuZCBldmVudCB0aW1lIGFy ZSBpbmRlZWQgdGhlIHNhbWUgdGhlbiBib3RoIGNsYWltcyBzaG91bGQgYmUgcHJlc2VudC4gSSBk b24ndCB0aGluayBpYXQgc2hvdWxkIGltcGx5IHRvZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+U29tZSBjbGFyaWZpY2F0aW9uIGZyb20gdGhlIGdy b3VwIHdvdWxkIGJlIGFwcHJlY2lhdGVkLiZuYnNwOyBTaG91bGQgd2UgcHJvY2VlZCB3aXRoIEIs IG9yIHJldmlzZSB0aGUgdGV4dCB0byBBIChvciBzb21lIG90aGVyIHByb3Bvc2FsKS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGFua3MsPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+UGhpbDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRp dHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+QGluZGVwZW5k ZW50aWQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmFtcDtk PUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209 bXlsN2c0aHBwa1dnZGpOOVRfVHlNM3RROThFZUk2LTF2OHVEU1c1UHFJdyZhbXA7cz1BOTc2MXJQ WGZGZGVxeko0cFJOLUJRX3gxVVNsTTJiUVRYb0NOZUxGQVpBJmFtcDtlPSIgdGFyZ2V0PSJfYmxh bmsiPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2lu LWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj5PbiBPY3QgMjMsIDIwMTcsIGF0IDY6MTUgUE0sIE1hcml1cyBT Y3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iIHRhcmdl dD0iX2JsYW5rIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIE9jdCAyMywgMjAxNyBhdCA2OjA0IFBNLCBSaWNoYXJk IEJhY2ttYW4sIEFubmFiZWxsZTxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1 NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnJp Y2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj5yaWNoYW5uYUBhbWF6b24uY29tPC9h PiZndDs8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3Mzcz Nm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6 MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BZ3JlZWQgb3ZlcmFs bC4gSGF2aW5nIHJlcmVhZCB0aGUgcHJvcG9zZWQgdGV4dCwgSSBzdWdnZXN0IHN0cmlraW5nIHRo ZSBsYXN0IHNlbnRlbmNlLCDigJxXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZhbHVlIG9mIOKAnHRv ZeKAnSBNQVkgYmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCcaWF04oCdLuKAnSBJIGRv IG5vdA0KIHRoaW5rIGl0IGlzIG5lY2Vzc2FyeSBvciBwYXJ0aWN1bGFybHkgaGVscGZ1bCB0byBz dGFuZGFyZGl6ZSB0aGUgc2VtYW50aWNzIG9mIGEgbWlzc2luZyB0aW1lLW9mLWV2ZW50IGNsYWlt IGF0IHRoZSBTRVQgbGV2ZWwuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiYjNDM7MTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJn aW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyxzZXJpZiI+LS0mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7 LHNlcmlmIj5BbWF6b24g4oCTIElkZW50aXR5IFNlcnZpY2VzPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQiPkZyb206PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQw MzU0MDE4NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4 MGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48L2I+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPklkLWV2ZW50DQogJmx0OzxhIGhyZWY9Im1haWx0bzppZC1l dmVudC1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnQtYm91bmNlc0Bp ZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiAmcXVvdDtQaGlsIEh1bnQgKElETSkmcXVvdDsg Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsi PnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRlOjxzcGFuIGNsYXNzPSJt MTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1 NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48L2I+TW9uZGF5LCBPY3RvYmVyIDIzLCAyMDE3IGF0IDU6NDggUE08YnI+DQo8Yj5Ubzo8c3Bh biBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3 NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PC9iPk1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2 OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3 MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+QnJpYW4gQ2FtcGJl bGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPC9hPiZndDssIElEIEV2ZW50cyBN YWlsaW5nDQogTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJn ZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PGJyPg0KPGI+U3ViamVjdDo8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQw MTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlJlOiBbSWQtZXZlbnRdIFJlcGxh Y2luZyAmcXVvdDtuYmYmcXVvdDsgY2xhaW0gd2l0aCBhIG5ldyAmcXVvdDt0b2UmcXVvdDsgY2xh aW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj5BZ3JlZWQgJiM0MzsxIG9uIEJyaWFuJ3MgZWRpdHMuJm5ic3A7PGJyPg0KPGJy Pg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48 YnI+DQpPbiBPY3QgMjMsIDIwMTcsIGF0IDU6MDUgUE0sIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9 Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+QW5uYWJlbGxlIGFuZCBJIGFncmVlZCB3aXRoIHRoaXMgcHJvcG9zZWQgY2hhbmdl IChhcyBjb3JyZWN0bHkgd29yZHNtaXRoZWQgYnkgQnJpYW4pIGR1cmluZyBvdXIgaW4tcGVyc29u IHJldmlldyDigJMgYXMgYWxzbyBub3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFyaXVz4oCZDQogY29t bWVudHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2 NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4 MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlRoYW5rcw0KIFBoaWwg YW5kIGFsbCw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDs8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3Mzcz Nm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+LS0NCiBNaWtlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj5Gcm9tOjwvYj48 c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQz NDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+SWQtZXZlbnQgWzxhIGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2Vz QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5v cmc8L2E+XTxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTcz NzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Pbg0KIEJlaGFsZiBPZjxzcGFuIGNsYXNzPSJtMTU0 NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0 bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48 L2I+QnJpYW4gQ2FtcGJlbGw8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0ibTE1NDU2MDk0 MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTEx MTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+VGh1cnNk YXksIFNlcHRlbWJlciAyOCwgMjAxNyA4OjIzIEFNPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNz PSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3Njgx NzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5QaGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8 L2I+PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZt LTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPklEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1h aWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmlkLWV2ZW50QGlldGYub3Jn PC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0 NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIw MzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtJZC1ldmVu dF0gUmVwbGFjaW5nICZxdW90O25iZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZx dW90OyBjbGFpbTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+JiM0 MzsxIHRvIFNFVCBkZWZpbmluZyBhIHRpbWUgb2YgZXZlbnQgY2xhaW0gcmF0aGVyIHRoYW4gdHJ5 aW5nIHRvIHJlZGVmaW5lIGEgc3RhbmRhcmQgY2xhaW0uIEFuZCB3aG8gZG9lc24ndCBsaWtlIGEg Y2xhaW0gbmFtZWQgJnF1b3Q7dG9lJnF1b3Q7PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2luLWJv dHRvbToxMi4wcHQiPkhvd2V2ZXIsIHRoZSB0ZXh0IHRoZXJlIGZvciBuYmYgaXMgc3RpbGwgZWZm ZWN0aXZlbHkgcmVkZWZpbmluZyBpdCBieSBzYXlpbmcgaXQgc2hvdWxkIGJlIGlnbm9yZWQsIHdo aWNoIGlzbid0IGNvbnNpc3RlbnQgd2l0aCB0aGUgJnF1b3Q7TVVTVCBOT1QgYmUgYWNjZXB0ZWQg Zm9yIHByb2Nlc3NpbmcmcXVvdDsgZnJvbSBSRkMgNzUxOS4NCiBJdCB3b3VsZCBiZSBtb3JlIGFw cHJvcHJpYXRlIHRvIHNheSB0aGF0IG5iZiBzaG91bGQvbXVzdCBub3QgYmUgaW5jbHVkZWQgaW4g YSBTRVQuIE9yIGp1c3Qgbm90IG1lbnRpb24gbmJmIGF0IGFsbC4gQnV0IGRvbid0IGNoYW5nZSB0 aGUgbWVhbmluZy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij5BbHNvIHRvZSB3b3VsZCBub3QgYmUgJnF1b3Q7RGVmaW5lZCBieSBTZWN0aW9uIDQuMS41IFtS RkM3NTE5XSZxdW90Oywgd2hpY2ggaXMgdGhlIG5iZiBzZWN0aW9uLiBUaGUgdmFsdWUgb2YgdGhl IHRvZSBjbGFpbSBpcyBhIE51bWVyaWNEYXRlLCB3aGljaCBpcyBkZWZpbmVkIGluIFNlYyAyIFJG Qzc1MTkuIEJ1dCB0b2UgaGFzDQogbm8gcmVsYXRpb24gdG8gbmJmIGFuZCBubyByZWFzb24gdG8g cmVmZXJlbmNlIG5iZi4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5PbiBXZWQsIFNlcCAyNywgMjAxNyBhdCAyOjUzIFBNLCBQaGlsIEh1bnQg Jmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsi PnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPkR1cmluZyB0aGUgT3BlbklEIFJJU0MgRmFjZSB0byBGYWNlIG1l ZXRpbmcgYSBxdWVzdGlvbiBjYW1lIHVwIHJlZ2FyZGluZyBTRVTigJlzIHJlZGVmaW5pdGlvbiBv ZiDigJxuYmbigJ0gYW5kIHdoZXRoZXIgdGhhdCByZWRlZmluaXRpb24gd2FzIGFwcHJvcHJpYXRl LjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRoZSBp bnRlbnRpb24gb2YgU0VUcyBkZWZpbml0aW9uIGlzIHRvIGFsbG93IFNFVCBUcmFuc21pdHRlcnMg dG8gaW5kaWNhdGUgdGhhdCBhbiBldmVudCBtYXkgaGF2ZSBvY2N1cnJlZCBhcyBlYXJseSBhcyBh IHNwZWNpZmllZCBkYXRlIOKAlCBhIGRhdGUgd2hpY2ggaXMgZGlmZmVyZW50IGZyb20gdGhlIGlz c3VhbmNlDQogZGF0ZSBvZiB0aGUgU0VULiBJbiBwYXJ0aWN1bGFyIHRoaXMgaXMgdXNlZnVsIGlu IGNhc2VzIHdoZXJlIHRoZSBzdGF0ZSBjaGFuZ2UgaXMgYmVsaWV2ZWQgdG8gaGF2ZSBvY2N1cnJl ZCBlYXJsaWVyIHRoYW4gdGhlIHRpbWUgb2YgaXNzdWFuY2UgKGUuZy4gYmVjYXVzZSB0aGUgaW5j aWRlbnQgd2FzIGRpc2NvdmVyZWQgdGhyb3VnaCBhbiBhZG1pbmlzdHJhdGl2ZSByZXZpZXcgb3Ig ZGF0YSBhbmFseXNpcyB0byBoYXZlIG9jY3VycmVkIGluIHRoZQ0KIHBhc3QpLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+VGhlIGRlZmlu aXRpb24gZnJvbSBKV1QgaXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8aDQ+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzUxOS0yM3NlY3Rpb24tMkQ0LjEuNSZhbXA7ZD1E d01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZh bXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPU5r RG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmYW1wO3M9MDBzRWl1ZWZ3 aFdiWGVSZkprdGpvcU42UkdPbmlIaVFpcHhIWmlDRzYydyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyxzZXJpZjt0ZXh0LWRlY29yYXRpb246bm9uZSI+NC4xLjU8L3NwYW4+PC9hPjwv c3Bhbj48YSBuYW1lPSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhfbV80MDM1NDAxODYxMTA4MTczIj48 L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDssc2VyaWYiPi4mbmJzcDsNCiAmcXVvdDtuYmYmcXVvdDsgKE5vdCBCZWZvcmUp IENsYWltPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9oND4NCjxwcmU+Jm5ic3A7PG86cD48 L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7IFRoZSAmcXVvdDtuYmYmcXVvdDsgKG5vdCBiZWZvcmUpIGNsYWltIGlkZW50aWZpZXMgdGhl IHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBKV1Q8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsgTVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHByb2Nlc3NpbmcuJm5ic3A7IFRoZSBwcm9j ZXNzaW5nIG9mIHRoZSAmcXVvdDtuYmYmcXVvdDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsgY2xhaW0gcmVxdWlyZXMgdGhhdCB0aGUgY3VycmVudCBkYXRlL3RpbWUgTVVTVCBi ZSBhZnRlciBvciBlcXVhbCB0bzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyB0 aGUgbm90LWJlZm9yZSBkYXRlL3RpbWUgbGlzdGVkIGluIHRoZSAmcXVvdDtuYmYmcXVvdDsgY2xh aW0uJm5ic3A7IEltcGxlbWVudGVycyBNQVk8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsgcHJvdmlkZSBmb3Igc29tZSBzbWFsbCBsZWV3YXksIHVzdWFsbHkgbm8gbW9yZSB0aGFu IGEgZmV3IG1pbnV0ZXMsIHRvPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IGFj Y291bnQgZm9yIGNsb2NrIHNrZXcuJm5ic3A7IEl0cyB2YWx1ZSBNVVNUIGJlIGEgbnVtYmVyIGNv bnRhaW5pbmcgYTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBOdW1lcmljRGF0 ZSB2YWx1ZS4mbmJzcDsgVXNlIG9mIHRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuPG86cD48L286cD48 L3ByZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BcyBk ZWZpbmVkIGluIFNFVDo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+Jm5ic3A7 Jm5ic3A7IG5iZjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyBEZWZpbmVkIGJ5IDxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2Vj dGlvbi0yRDQuMS41JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hC S0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3ds TktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2lj SDYxdyZhbXA7cz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmFt cDtlPSIgdGFyZ2V0PSJfYmxhbmsiPlNlY3Rpb24mbmJzcDs0LjEuNSBbUkZDNzUxOV08L2E+LCBh IG51bWJlciB3aG9zZSB2YWx1ZSBpcyBhPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE51bWVyaWNEYXRlLiZuYnNwOyBJbiB0aGUgY29udGV4dCBv ZiB0aGUgU0VUIHRva2VuIGl0IFNIQUxMIGJlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGludGVycHJldGVkIHRvIG1lYW4gYSBkYXRlIGluIHdo aWNoIHRoZSBldmVudCBpcyBiZWxpZXZlZCB0byBoYXZlPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IG9jY3VycmVkIChpbiB0aGUgcGFzdCkgb3Ig d2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiZuYnNwOyBOb3RlOiB0aGVyZTxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBNQVkgYmUgc29tZSBjYXNl cyB3aGVyZSAmcXVvdDtuYmYmcXVvdDsgaXMgc3RpbGwgc21hbGxlciB0aGFuICZxdW90O2lhdCZx dW90OyBzdWNoIGFzPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IHdoZW4gaXQgdG9vayBhbiBleHRlbmRlZCB0aW1lIGZvciBhIFNFVCB0byBiZSBp c3N1ZWQgKGZvciBleGFtcGxlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IGFmdGVyIHNvbWUgYW5hbHlzaXMpLiZuYnNwOyBUaGlzIGNsYWltIGlz IE9QVElPTkFMLjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5UaGVyZSBpcyBhbiBhcmd1bWVudCB0aGF0IHRoZSByZWRlZmluaXRpb24g d2lsbCBjYXVzZSBjb25mdXNpb24uJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5UaGUgcHJvcG9zYWwgaXMgdG8gcmVnaXN0ZXIg YSBkaWZmZXJlbnQgY2xhaW0gbmFtZSBzdWNoIGFzIOKAnHRvZeKAnSAodGltZSBvZiBldmVudCku IFRoZSBwcm9wb3NlZCBuZXc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+ZGVmaW5pdGlvbjo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cHJlPnRvZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyBEZWZpbmVkIGJ5IDxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIz c2VjdGlvbi0yRDQuMS41JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBR Y3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpq V3dsTktlNENfbExJR2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdI U2ljSDYxdyZhbXA7cz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3 JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPlNlY3Rpb24mbmJzcDs0LjEuNSBbUkZDNzUxOV08L2E+ LCBhIG51bWJlciB3aG9zZSB2YWx1ZSBpcyBhPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IE51bWVyaWNEYXRlLiZuYnNwOyBUaGUgdmFsdWUgaXMg dGhlIGRhdGUgYW5kIHRpbWUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVkIHRvIGhhdmU8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgb2Nj dXJyZWQgaW4gdGhlIHBhc3Qgb3Igd2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiBUaGlzIGNsYWlt IGlzIE9QVElPTkFMLjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyBXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZhbHVlIG9mIOKAnHRvZeKAnSBNQVkg YmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCcaWF04oCdLjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPm5iZjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBUaGlzIGNsYWltIGlzIG5vdCB1 c2VkIGluIFNFVCBFdmVudHMuIElmIGFzc2VydGVkLCB0aGUgdmFsdWUgU0hPVUxEPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGJlIGlnbm9yZWQu PG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj5BcmUgdGhlcmUgYW55IG9iamVjdGlvbnMgdG8gdGhlIHByb3Bvc2VkIGNoYW5nZT88 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2Vy dmljZXMgQXJjaGl0ZWN0PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9 RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1O a0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPTFfWjdPdkF5 YXhsZXNDZExOQzVxc2E1WGo5UFpRLUxNYkNhX2htVG8yZU0mYW1wO2U9IiB0YXJnZXQ9Il9ibGFu ayI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9Im1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUu Y29tPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1h aWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21h aWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRT ZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVBdnBV akJwWll1Q1ZnSFNpY0g2MXcmYW1wO3M9OEFvb0RXWTFGd1RHM0JqMkVMV3FwVDdYQWFVWUFVVHhn NzhrZGIwVk9OOCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxicj4NCjxiPjxpPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7O2NvbG9yOiM1 NTU1NTU7Ym9yZGVyOm5vbmUgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBpbiI+Q09ORklERU5U SUFMSVRZIE5PVElDRTogVGhpcyBlbWFpbCBtYXkgY29udGFpbiBjb25maWRlbnRpYWwgYW5kIHBy aXZpbGVnZWQgbWF0ZXJpYWwgZm9yIHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBp ZW50KHMpLiBBbnkgcmV2aWV3LA0KIHVzZSwgZGlzdHJpYnV0aW9uIG9yIGRpc2Nsb3N1cmUgYnkg b3RoZXJzIGlzIHN0cmljdGx5IHByb2hpYml0ZWQuJm5ic3A7IElmIHlvdSBoYXZlIHJlY2VpdmVk IHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGlt bWVkaWF0ZWx5IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBtZXNzYWdlIGFuZCBhbnkgZmlsZSBh dHRhY2htZW50cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5rIHlvdS48L3NwYW4+PC9pPjwvYj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1l dmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4N CjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lD QWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7 cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPU5rRG82 OVZfRnd5bFJsSE9NQ0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmYW1wO3M9OEFvb0RXWTFGd1RH M0JqMkVMV3FwVDdYQWFVWUFVVHhnNzhrZGIwVk9OOCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5p ZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJv UDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJL dWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhP TUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPThBb29EV1kxRndURzNCajJFTFdxcFQ3 WEFhVVlBVVR4Zzc4a2RiMFZPTjgmYW1wO2U9PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVm PSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3 dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdNRmFRJmFtcDtj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJp UnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1YRmI4NXZ1RGswaDNZ Z2Q1cWx4NGl1UjdMUjdldlZfQlUwZkxMMDVkWEJNJmFtcDtzPS16SkxOc19HX1BYTWJ0dXlBQW81 S1NucVphdTRCSGY3LUpGZmU3bVlwQlkmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlz dDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PklkLWV2ZW50QGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRm Lm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZ dW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdD SDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1YRmI4NXZ1RGswaDNZZ2Q1cWx4 NGl1UjdMUjdldlZfQlUwZkxMMDVkWEJNJmFtcDtzPS16SkxOc19HX1BYTWJ0dXlBQW81S1NucVph dTRCSGY3LUpGZmU3bVlwQlkmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZs WllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209WEZiODV2dURrMGgzWWdkNXFseDRpdVI3TFI3ZXZW X0JVMGZMTDA1ZFhCTSZhbXA7cz0tekpMTnNfR19QWE1idHV5QUFvNUtTbnFaYXU0QkhmNy1KRmZl N21ZcEJZJmFtcDtlPTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhyZWY9Imh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPW15bDdnNGhwcGtXZ2RqTjlUX1R5 TTN0UTk4RWVJNi0xdjh1RFNXNVBxSXcmYW1wO3M9N081TjVxQk5HSzhHTWNhclV3SEV0U2tOZ2Zv Z0Ztdl9xNl9vMHF2OGF4VSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1teWw3ZzRocHBrV2dkak45VF9UeU0zdFE5OEVlSTYt MXY4dURTVzVQcUl3JmFtcDtzPTdPNU41cUJOR0s4R01jYXJVd0hFdFNrTmdmb2dGbXZfcTZfbzBx djhheFUmYW1wO2U9PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+ DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5JZC1l dmVudEBpZXRmLm9yZzwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdf bWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209azE3WGlYaERjQVNGaVBJYTJrODY4SjdE OHc4UmtPNHd4MHJqWWk4d05vdyZhbXA7cz01ZnlsanFPU1ZpUlE5d255TVhVWl9mUTFfbnVhY29o M3h4MzM4RmRhcFNZJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlz dGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQ UWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJmFtcDttPWsxN1hpWGhEY0FTRmlQSWEyazg2OEo3RDh3OFJrTzR3eDBy allpOHdOb3cmYW1wO3M9NWZ5bGpxT1NWaVJROXdueU1YVVpfZlExX251YWNvaDN4eDMzOEZkYXBT WSZhbXA7ZT08L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhyZWY9Imh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPTN4b1JuWWVBcWdXUnF2am1oMWZG QkhiRnF3UG8wLVMzMUtZckowc1pLN2cmYW1wO3M9T2duNXZXU0pRYjFfdzZfNnpVbHE4Q1BSa2Vn aTF4XzNHLWtubGJaazZrRSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZhbXA7bT0zeG9SblllQXFnV1JxdmptaDFmRkJIYkZxd1BvMC1T MzFLWXJKMHNaSzdnJmFtcDtzPU9nbjV2V1NKUWIxX3c2XzZ6VWxxOENQUmtlZ2kxeF8zRy1rbmxi Wms2a0UmYW1wO2U9PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8 YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3Jn PC9hPjxicj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5j b20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJE ZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRw a0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19s TElHayZhbXA7bT1HN2dJMVRUMzdJSHNOVmhUTm04U1ZrdkZzRDNsWnJNcWprQ0NRUmZsTXFFJmFt cDtzPXpGSWZJY1VuX3RQMDBwNnljMm5MbXV2bExaS2hBWlh2LXJKcjRpSzBkLVkmYW1wO2U9Ij48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJs P3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1w O2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JL MTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7 bT1HN2dJMVRUMzdJSHNOVmhUTm04U1ZrdkZzRDNsWnJNcWprQ0NRUmZsTXFFJmFtcDtzPXpGSWZJ Y1VuX3RQMDBwNnljMm5MbXV2bExaS2hBWlh2LXJKcjRpSzBkLVkmYW1wO2U9PC9zcGFuPjwvYT48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_A4718B535081408B9624A1F31F6D1158amazoncom_-- From nobody Thu Oct 26 17:21:32 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DE1713F417 for ; Thu, 26 Oct 2017 17:21:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gL9McEvSKQx4 for ; Thu, 26 Oct 2017 17:21:26 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6FFCD13B1A9 for ; Thu, 26 Oct 2017 17:21:26 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9R0LKRS023554 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Oct 2017 00:21:21 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9R0LJ7B020124 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Oct 2017 00:21:19 GMT Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9R0LJom014495; Fri, 27 Oct 2017 00:21:19 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 26 Oct 2017 17:21:18 -0700 From: Phil Hunt Message-Id: <5362E4A7-9EAA-49C6-B529-A8326CDD40CC@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_2DFAF4D1-5EF8-44FD-B376-C6390FE00562" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 26 Oct 2017 17:21:16 -0700 In-Reply-To: Cc: Marius Scurtescu , Brian Campbell , Mike Jones , ID Events Mailing List To: "Richard Backman, Annabelle" References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 00:21:31 -0000 --Apple-Mail=_2DFAF4D1-5EF8-44FD-B376-C6390FE00562 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 MAY is normative permssive option. =E2=80=9Cmay=E2=80=9D is used when = you are stating a fact. So in this case, Mike has changed the text to indicate that a client = may interpret =E2=80=9Ciat=E2=80=9D as the value of =E2=80=9Ctoe=E2=80=9D = when =E2=80=9Ctoe=E2=80=9D is not asserted. It is phrased this way so = that profiling specs can override. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 26, 2017, at 5:08 PM, Richard Backman, Annabelle = wrote: >=20 > What does the =E2=80=9CMAY=E2=80=9D in this sentence mean? > When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed = to be the value of =E2=80=9Ciat=E2=80=9D. > =20 > I can think of a couple ways to read this, neither of which seem = appropriate for SET: > Profiling Specifications can declare that these are the semantics of a = missing =E2=80=9Ctoe=E2=80=9D claim, but if the Profiling Specification = does not do so, then the semantics are still undefined. > Why would this need to be specified at all? > Unless a Profiling Specification says otherwise, these are the = semantics of a missing =E2=80=9Ctoe=E2=80=9D claim. > What makes us think that this is an appropriate default? For many RISC = events, the time of event will be unknown, or prohibitively expensive to = know. Are the semantics of a null =E2=80=9Ctoe=E2=80=9D claim allowed to = be different from those of a missing claim? > =20 > --=20 > Annabelle Richard Backman > Amazon =E2=80=93 Identity Services > =20 > =20 > From: Phil Hunt > Date: Wednesday, October 25, 2017 at 2:59 PM > To: Marius Scurtescu > Cc: "Richard Backman, Annabelle" , Brian Campbell = , Mike Jones , = ID Events Mailing List > Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim > =20 > OK=E2=80=A6.unless there is objection, I will revise the draft so that = =E2=80=9Ctoe=E2=80=9D will become a recommended attribute. > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 >> On Oct 25, 2017, at 2:52 PM, Marius Scurtescu > wrote: >> =20 >> On Wed, Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) = > wrote: >>> =20 >>> Are you proposing A with a should/recommended? >> =20 >> Yes >> =20 >> =20 >>> =20 >>> It is more consistent but adds a lot of duplication in many cases = where iat =3D toe.=20 >> =20 >> I don't think that should be a problem. >> =20 >> =20 >>>=20 >>> Phil >>>=20 >>> On Oct 25, 2017, at 2:07 PM, Marius Scurtescu > wrote: >>>=20 >>>> On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) = > wrote: >>>>> If an event doesn't have a time, did it occur? >>>> =20 >>>> At undisclosed time and location :-) >>>> =20 >>>> I think it is fine for "toe" to be SHOULD/RECOMMENDED, but not = MUST/REQUIRED. >>>> =20 >>>>>=20 >>>>> Phil >>>>>=20 >>>>> On Oct 25, 2017, at 1:58 PM, Marius Scurtescu = > wrote: >>>>>=20 >>>>>> As I said, I totally agree it is useful. But why required? >>>>>>=20 >>>>>> Marius >>>>>> =20 >>>>>> On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) = > wrote: >>>>>>> In some cases, ordering of events against a single subject = matters. Time is useful for this purpose though limited in the overall = stream for ordering events overall.=20 >>>>>>> =20 >>>>>>> For example account locked vs unlocked. Knowing what happened = last would seem important no? >>>>>>>=20 >>>>>>> Phil >>>>>>>=20 >>>>>>> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu = > wrote: >>>>>>>=20 >>>>>>>> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt = > wrote: >>>>>>>>> It is not clear how to revise the document with regards to the = suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80=9D = is not asserted.=20 >>>>>>>>> =20 >>>>>>>>> If I remove this clarification, it seems unclear what the time = of the event is defined as. There seem to be two options: >>>>>>>>> =20 >>>>>>>>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be the = time of event, then =E2=80=9Ctoe=E2=80=9D should be a required claim. >>>>>>>> =20 >>>>>>>> Why? Why can't the Transmitter assert that an account was = disabled and not provide a specific event time? I understand that an = event time is desirable, but why required? >>>>>>>> =20 >>>>>>>> =20 >>>>>>>>> =20 >>>>>>>>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is = commonly used to mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D = is only needed when the time of the event is different (on an = exceptional basis). >>>>>>>> =20 >>>>>>>> If SET issuance and event time are indeed the same then both = claims should be present. I don't think iat should imply toe. >>>>>>>> =20 >>>>>>>>> =20 >>>>>>>>> Some clarification from the group would be appreciated. = Should we proceed with B, or revise the text to A (or some other = proposal). >>>>>>>>> =20 >>>>>>>>> Thanks, >>>>>>>>> =20 >>>>>>>>> Phil >>>>>>>>> =20 >>>>>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>>>> @independentid >>>>>>>>> www.independentid.com = >>>>>>>>> phil.hunt@oracle.com >>>>>>>>> =20 >>>>>>>>>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu = > wrote: >>>>>>>>>> =20 >>>>>>>>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle = > wrote: >>>>>>>>>>> Agreed overall. Having reread the proposed text, I suggest = striking the last sentence, =E2=80=9CWhen not asserted, the value of = =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80= =9D.=E2=80=9D I do not think it is necessary or particularly helpful to = standardize the semantics of a missing time-of-event claim at the SET = level. >>>>>>>>>> =20 >>>>>>>>>> +1 >>>>>>>>>> =20 >>>>>>>>>> =20 >>>>>>>>>>> =20 >>>>>>>>>>> --=20 >>>>>>>>>>> Annabelle Richard Backman >>>>>>>>>>> Amazon =E2=80=93 Identity Services >>>>>>>>>>> =20 >>>>>>>>>>> =20 >>>>>>>>>>> From: Id-event > on behalf of "Phil Hunt (IDM)" = > >>>>>>>>>>> Date: Monday, October 23, 2017 at 5:48 PM >>>>>>>>>>> To: Mike Jones > >>>>>>>>>>> Cc: Brian Campbell >, ID Events Mailing List = > >>>>>>>>>>>=20 >>>>>>>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new = "toe" claim >>>>>>>>>>> =20 >>>>>>>>>>> =20 >>>>>>>>>>> Agreed +1 on Brian's edits.=20 >>>>>>>>>>>=20 >>>>>>>>>>> Phil >>>>>>>>>>>=20 >>>>>>>>>>> On Oct 23, 2017, at 5:05 PM, Mike Jones = > = wrote: >>>>>>>>>>>=20 >>>>>>>>>>>> Annabelle and I agreed with this proposed change (as = correctly wordsmithed by Brian) during our in-person review =E2=80=93 as = also noted in the reply to Marius=E2=80=99 comments. >>>>>>>>>>>> =20 >>>>>>>>>>>> = Thanks Phil and all, >>>>>>>>>>>> = -- Mike >>>>>>>>>>>> =20 >>>>>>>>>>>> From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Brian Campbell >>>>>>>>>>>> Sent: Thursday, September 28, 2017 8:23 AM >>>>>>>>>>>> To: Phil Hunt > >>>>>>>>>>>> Cc: ID Events Mailing List > >>>>>>>>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new = "toe" claim >>>>>>>>>>>> =20 >>>>>>>>>>>> +1 to SET defining a time of event claim rather than trying = to redefine a standard claim. And who doesn't like a claim named "toe"? >>>>>>>>>>>>=20 >>>>>>>>>>>> However, the text there for nbf is still effectively = redefining it by saying it should be ignored, which isn't consistent = with the "MUST NOT be accepted for processing" from RFC 7519. It would = be more appropriate to say that nbf should/must not be included in a = SET. Or just not mention nbf at all. But don't change the meaning. >>>>>>>>>>>>=20 >>>>>>>>>>>> Also toe would not be "Defined by Section 4.1.5 [RFC7519]", = which is the nbf section. The value of the toe claim is a NumericDate, = which is defined in Sec 2 RFC7519. But toe has no relation to nbf and no = reason to reference nbf.=20 >>>>>>>>>>>> =20 >>>>>>>>>>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt = > wrote: >>>>>>>>>>>>> During the OpenID RISC Face to Face meeting a question = came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D = and whether that redefinition was appropriate. >>>>>>>>>>>>> =20 >>>>>>>>>>>>> The intention of SETs definition is to allow SET = Transmitters to indicate that an event may have occurred as early as a = specified date =E2=80=94 a date which is different from the issuance = date of the SET. In particular this is useful in cases where the state = change is believed to have occurred earlier than the time of issuance = (e.g. because the incident was discovered through an administrative = review or data analysis to have occurred in the past). >>>>>>>>>>>>> =20 >>>>>>>>>>>>> The definition from JWT is: >>>>>>>>>>>>> 4.1.5 = <>. "nbf" (Not Before) Claim >>>>>>>>>>>>>=20 >>>>>>>>>>>>> =20 >>>>>>>>>>>>> =20 >>>>>>>>>>>>> The "nbf" (not before) claim identifies the time before = which the JWT >>>>>>>>>>>>> MUST NOT be accepted for processing. The processing of = the "nbf" >>>>>>>>>>>>> claim requires that the current date/time MUST be after = or equal to >>>>>>>>>>>>> the not-before date/time listed in the "nbf" claim. = Implementers MAY >>>>>>>>>>>>> provide for some small leeway, usually no more than a = few minutes, to >>>>>>>>>>>>> account for clock skew. Its value MUST be a number = containing a >>>>>>>>>>>>> NumericDate value. Use of this claim is OPTIONAL. >>>>>>>>>>>>> =20 >>>>>>>>>>>>> =20 >>>>>>>>>>>>> As defined in SET: >>>>>>>>>>>>> nbf >>>>>>>>>>>>> Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a >>>>>>>>>>>>> NumericDate. In the context of the SET token it = SHALL be >>>>>>>>>>>>> interpreted to mean a date in which the event is = believed to have >>>>>>>>>>>>> occurred (in the past) or will occur in the future. = Note: there >>>>>>>>>>>>> MAY be some cases where "nbf" is still smaller than = "iat" such as >>>>>>>>>>>>> when it took an extended time for a SET to be issued = (for example >>>>>>>>>>>>> after some analysis). This claim is OPTIONAL. >>>>>>>>>>>>> =20 >>>>>>>>>>>>> There is an argument that the redefinition will cause = confusion.=20 >>>>>>>>>>>>> =20 >>>>>>>>>>>>> The proposal is to register a different claim name such as = =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new >>>>>>>>>>>>> definition: >>>>>>>>>>>>> =20 >>>>>>>>>>>>> toe >>>>>>>>>>>>> Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a >>>>>>>>>>>>> NumericDate. The value is the date and time in = which the event is believed to have >>>>>>>>>>>>> occurred in the past or will occur in the future. = This claim is OPTIONAL. >>>>>>>>>>>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D = MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D. >>>>>>>>>>>>> =20 >>>>>>>>>>>>> nbf >>>>>>>>>>>>> This claim is not used in SET Events. If asserted, = the value SHOULD >>>>>>>>>>>>> be ignored. >>>>>>>>>>>>> =20 >>>>>>>>>>>>> =20 >>>>>>>>>>>>> Are there any objections to the proposed change? >>>>>>>>>>>>> =20 >>>>>>>>>>>>> Phil >>>>>>>>>>>>> =20 >>>>>>>>>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>>>>>>>> @independentid >>>>>>>>>>>>> www.independentid.com = >>>>>>>>>>>>> phil.hunt@oracle.com >>>>>>>>>>>>> =20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> Id-event mailing list >>>>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>>>>>>>>> =20 >>>>>>>>>>>>=20 >>>>>>>>>>>> CONFIDENTIALITY NOTICE: This email may contain confidential = and privileged material for the sole use of the intended recipient(s). = Any review, use, distribution or disclosure by others is strictly = prohibited. If you have received this communication in error, please = notify the sender immediately by e-mail and delete the message and any = file attachments from your computer. Thank you. >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> Id-event mailing list >>>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlH= OMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VO= N8&e=3D = >>>>>>>>>>>=20 >>>>>>>>>>> _______________________________________________ >>>>>>>>>>> Id-event mailing list >>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>>>>>>> =20 >>>>>>>>>> _______________________________________________ >>>>>>>>>> Id-event mailing list >>>>>>>>>> Id-event@ietf.org >>>>>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd= 5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYp= BY&e=3D = >>>>>>>>> =20 >>>>>>>>=20 >>>>>>>> =20 >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN= 9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8a= xU&e=3D = =20 >>>>>>=20 >>>>>> =20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPI= a2k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338Fdap= SY&e=3D = =20 >>>>=20 >>>> =20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D3xoRnYeAqgWRqvj= mh1fFBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQb1_w6_6zUlq8CPRkegi1x_3G-knlbZk6= kE&e=3D = =20 >>=20 >> =20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DG7gI1TT37IHsNVh= TNm8SVkvFsD3lZrMqjkCCQRflMqE&s=3DzFIfIcUn_tP00p6yc2nLmuvlLZKhAZXv-rJr4iK0d= -Y&e=3D = > =20 --Apple-Mail=_2DFAF4D1-5EF8-44FD-B376-C6390FE00562 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 MAY is normative permssive option.  =E2=80=9Cmay=E2=80=9D = is used when you are stating a fact.

So in this case, Mike has changed the = text to indicate that a client  may interpret =E2=80=9Ciat=E2=80=9D = as the value of =E2=80=9Ctoe=E2=80=9D when =E2=80=9Ctoe=E2=80=9D is not = asserted.  It is phrased this way so that profiling specs can = override.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 26, 2017, at 5:08 PM, Richard Backman, Annabelle = <richanna@amazon.com> wrote:

What does the = =E2=80=9CMAY=E2=80=9D in this sentence mean?
When not = asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the = value of =E2=80=9Ciat=E2=80=9D.
 
I can think of a couple ways to read = this, neither of which seem appropriate for SET:
  1. Profiling Specifications can declare that these = are the semantics of a missing =E2=80=9Ctoe=E2=80=9D claim, but if the = Profiling Specification does not do so, then the semantics are still = undefined.
    1. Why would this need to be = specified at all?
  2. Unless a Profiling = Specification says otherwise, these are the semantics of a missing = =E2=80=9Ctoe=E2=80=9D claim.
    1. What makes us think that this = is an appropriate default? For many RISC events, the time of event will = be unknown, or prohibitively expensive to know. Are the semantics of a = null =E2=80=9Ctoe=E2=80=9D claim allowed to be different from those of a = missing claim?
 
-- 
Annabelle Richard Backman
Amazon =E2=80=93 Identity Services
 
 
From: Phil Hunt <phil.hunt@oracle.com>
Date: Wednesday, October 25, = 2017 at 2:59 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: "Richard Backman, = Annabelle" <richanna@amazon.com>, Brian Campbell <bcampbell@pingidentity.com>, Mike Jones <Michael.Jones@microsoft.com>, ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim
 
OK=E2=80=A6.unless there is objection, I will revise the = draft so that =E2=80=9Ctoe=E2=80=9D will become a recommended = attribute.
 
Phil
 
Oracle Corporation, Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
 
On Oct = 25, 2017, at 2:52 PM, Marius Scurtescu <mscurtescu@google.com> = wrote:
 
On Wed, Oct 25, 2017 at 2:44 PM, Phil Hunt = (IDM) <phil.hunt@oracle.com> wrote:
 
Are you proposing A with = a should/recommended?
 
Yes
 
 
 
It is more consistent = but adds a lot of duplication in many cases where iat =3D toe. 
 
I don't think that = should be a problem.
 
 

Phil


On Oct 25, 2017, at 2:07 PM, Marius Scurtescu = <mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt = (IDM) <phil.hunt@oracle.com> wrote:
If an event doesn't have = a time, did it occur?
 
At undisclosed time and = location :-)
 
I think it is fine for = "toe" to be SHOULD/RECOMMENDED, but not MUST/REQUIRED.
 

Phil


On Oct 25, 2017, at 1:58 PM, Marius Scurtescu = <mscurtescu@google.com> wrote:

As I said, I = totally agree it is useful. But why required?

Marius
 
On Wed, Oct 25, = 2017 at 1:56 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
In some cases, ordering = of events against a single subject matters. Time is useful for this = purpose though limited in the overall stream for ordering events = overall. 
 
For example account locked vs unlocked. Knowing what happened = last would seem important no?

Phil


On Oct 25, 2017, at 1:46 PM, Marius Scurtescu = <mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
It is not clear how to revise the document with = regards to the suggestion against using =E2=80=9Ciat=E2=80=9D when = =E2=80=9Ctoe=E2=80=9D is not asserted. 
 
If I remove this = clarification, it seems unclear what the time of the event is defined = as.  There seem to be two options:
 
A. If =E2=80=9Ciat=E2=80=9D= can=E2=80=99t be assumed to be the time of event, then =E2=80=9Ctoe=E2=80= =9D should be a required claim.
 
Why? Why can't the = Transmitter assert that an account was disabled and not provide a = specific event time? I understand that an event time is desirable, but = why required?
 
 
 
B. For the majority = of use cases, =E2=80=9Ciat=E2=80=9D is commonly used to mark SET = issuance and event time.  =E2=80=9Ctoe=E2=80=9D is only needed when = the time of the event is different (on an exceptional basis).
 
If SET issuance and = event time are indeed the same then both claims should be present. I = don't think iat should imply toe.
 
 
Some clarification from = the group would be appreciated.  Should we proceed with B, or = revise the text to A (or some other proposal).
 
Thanks,
 
Phil
 
Oracle Corporation, = Identity Cloud Services Architect
@independentid
phil.hunt@oracle.com
 
On Oct 23, 2017, at = 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
 
On Mon, Oct 23, = 2017 at 6:04 PM, Richard Backman, Annabelle <richanna@amazon.com> wrote:
Agreed overall. Having reread the = proposed text, I suggest striking the last sentence, =E2=80=9CWhen not = asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the = value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is necessary = or particularly helpful to standardize the semantics of a missing = time-of-event claim at the SET level.
 
+1
 
 
 
-- 
Annabelle Richard = Backman
Amazon =E2=80=93 Identity Services
 
 
From: Id-event <id-event-bounces@ietf.org> on behalf of "Phil Hunt = (IDM)" <phil.hunt@oracle.com>
Date: Monday, October = 23, 2017 at 5:48 PM
To: Mike Jones = <Michael.Jones@microsoft.com>
Cc: Brian Campbell = <bcampbell@pingidentity.com>, ID Events Mailing List = <id-event@ietf.org>

Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim
 
 
Agreed +1 on Brian's edits. 

Phil


On Oct 23, 2017, at = 5:05 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Annabelle and I agreed with this proposed change (as = correctly wordsmithed by Brian) during our in-person review =E2=80=93 as = also noted in the reply to Marius=E2=80=99 comments.
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    Thanks Phil and = all,
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Id-event [mailto:id-event-bounces@ietf.org] On = Behalf Of Brian = Campbell
Sent: Thursday, September = 28, 2017 8:23 AM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: ID Events Mailing = List <id-event@ietf.org>
Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim
 

+1 to SET defining a time of event = claim rather than trying to redefine a standard claim. And who doesn't = like a claim named "toe"?

However, the text there for nbf is = still effectively redefining it by saying it should be ignored, which = isn't consistent with the "MUST NOT be accepted for processing" from RFC = 7519. It would be more appropriate to say that nbf should/must not be = included in a SET. Or just not mention nbf at all. But don't change the = meaning.

Also toe would not be "Defined by Section 4.1.5 [RFC7519]", = which is the nbf section. The value of the toe claim is a NumericDate, = which is defined in Sec 2 RFC7519. But toe has no relation to nbf and no = reason to reference nbf. 
 
On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
During = the OpenID RISC Face to Face meeting a question came up regarding = SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that = redefinition was appropriate.
 
The intention of SETs definition is to allow SET Transmitters = to indicate that an event may have occurred as early as a specified date = =E2=80=94 a date which is different from the issuance date of the SET. = In particular this is useful in cases where the state change is believed = to have occurred earlier than the time of issuance (e.g. because the = incident was discovered through an administrative review or data = analysis to have occurred in the past).
 
The definition from JWT is:

4.1.5.  "nbf" (Not Before) Claim

 
 
   The "nbf" (not before) claim identifies the time =
before which the JWT
   MUST NOT be accepted for processing.  The =
processing of the "nbf"
   claim requires that the current date/time MUST =
be after or equal to
   the not-before date/time listed in the "nbf" =
claim.  Implementers MAY
   provide for some small =
leeway, usually no more than a few minutes, to
   account for clock skew.  Its value MUST be =
a number containing a
   NumericDate value.  Use of this claim is =
OPTIONAL.
 
 
As defined in SET:
   nbf
      Defined by Section 4.1.5 [RFC7519], a number whose value is =
a
      NumericDate.  In the =
context of the SET token it SHALL be
      =
interpreted to mean a date in which the event is believed to have
      occurred (in the past) or will =
occur in the future.  Note: there
      MAY be =
some cases where "nbf" is still smaller than "iat" such as
      when it took an extended time =
for a SET to be issued (for example
      after =
some analysis).  This claim is OPTIONAL.
 
There is an argument that = the redefinition will cause confusion. 
 
The proposal is to register a different = claim name such as =E2=80=9Ctoe=E2=80=9D (time of event). The proposed = new
definition:
 
toe
      Defined by Section 4.1.5 [RFC7519], a number whose value is =
a
      NumericDate.  The value =
is the date and time in which the event is believed to have
      occurred in the past or will =
occur in the future. This claim is OPTIONAL.
      When not asserted, the value =
of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =
=E2=80=9Ciat=E2=80=9D.
 
nbf
      This claim is not used in SET =
Events. If asserted, the value SHOULD
      be =
ignored.
 
 
Are there any objections to the proposed change?
 
Phil
 
Oracle Corporation, Identity Cloud = Services Architect
@independentid
 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 

CONFIDENTIALITY NOTICE: This email may contain confidential = and privileged material for the sole use of the intended recipient(s). = Any review, use, distribution or disclosure by others is strictly = prohibited.  If you have received this communication in error, = please notify the sender immediately by e-mail and delete the message = and any file attachments from your computer. Thank = you.


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
_______________________________________________Id-event mailing list
Id-event@ietf.org
 
<= /div>
 
<= /div>
_______________________________________________
Id-event mailing list
Id-event@ietf.org
=
 
<= blockquote style=3D"margin-top: 5pt; margin-bottom: 5pt;" class=3D"" = type=3D"cite">
_______________________________________________
Id-event mailing list
Id-event@ietf.org
=
 
<= /div>
_______________________________________________
Id-event mailing list
Id-event@ietf.org
=
 
 
= --Apple-Mail=_2DFAF4D1-5EF8-44FD-B376-C6390FE00562-- From nobody Thu Oct 26 17:25:12 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67D5413F4CB for ; Thu, 26 Oct 2017 17:25:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IQywYGw8udek for ; Thu, 26 Oct 2017 17:25:02 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B864313F417 for ; Thu, 26 Oct 2017 17:25:02 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9R0Ox01015523 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Oct 2017 00:24:59 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9R0Owaa028094 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 27 Oct 2017 00:24:59 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9R0Ow6p016027; Fri, 27 Oct 2017 00:24:58 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 26 Oct 2017 17:24:57 -0700 From: Phil Hunt Message-Id: <867DAEEE-BC23-4459-8EDA-3293B5035FAE@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BA4C25AB-FA9C-493E-967C-9D1271C2DB1C" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 26 Oct 2017 17:24:55 -0700 In-Reply-To: <5362E4A7-9EAA-49C6-B529-A8326CDD40CC@oracle.com> Cc: Mike Jones , Brian Campbell , ID Events Mailing List , Marius Scurtescu To: "Richard Backman, Annabelle" References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> <5362E4A7-9EAA-49C6-B529-A8326CDD40CC@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 00:25:07 -0000 --Apple-Mail=_BA4C25AB-FA9C-493E-967C-9D1271C2DB1C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Apologies=E2=80=A6 I meant to say, Mike provided some better text = describing the optionality. That should be published shortly. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 26, 2017, at 5:21 PM, Phil Hunt wrote: >=20 > MAY is normative permssive option. =E2=80=9Cmay=E2=80=9D is used when = you are stating a fact. >=20 > So in this case, Mike has changed the text to indicate that a client = may interpret =E2=80=9Ciat=E2=80=9D as the value of =E2=80=9Ctoe=E2=80=9D = when =E2=80=9Ctoe=E2=80=9D is not asserted. It is phrased this way so = that profiling specs can override. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = phil.hunt@o= racle.com >> On Oct 26, 2017, at 5:08 PM, Richard Backman, Annabelle = > wrote: >>=20 >> What does the =E2=80=9CMAY=E2=80=9D in this sentence mean? >> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed = to be the value of =E2=80=9Ciat=E2=80=9D. >> =20 >> I can think of a couple ways to read this, neither of which seem = appropriate for SET: >> Profiling Specifications can declare that these are the semantics of = a missing =E2=80=9Ctoe=E2=80=9D claim, but if the Profiling = Specification does not do so, then the semantics are still undefined. >> Why would this need to be specified at all? >> Unless a Profiling Specification says otherwise, these are the = semantics of a missing =E2=80=9Ctoe=E2=80=9D claim. >> What makes us think that this is an appropriate default? For many = RISC events, the time of event will be unknown, or prohibitively = expensive to know. Are the semantics of a null =E2=80=9Ctoe=E2=80=9D = claim allowed to be different from those of a missing claim? >> =20 >> --=20 >> Annabelle Richard Backman >> Amazon =E2=80=93 Identity Services >> =20 >> =20 >> From: Phil Hunt > >> Date: Wednesday, October 25, 2017 at 2:59 PM >> To: Marius Scurtescu > >> Cc: "Richard Backman, Annabelle" >, Brian Campbell = >, Mike = Jones >, ID Events Mailing List = > >> Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim >> =20 >> OK=E2=80=A6.unless there is objection, I will revise the draft so = that =E2=80=9Ctoe=E2=80=9D will become a recommended attribute. >> =20 >> Phil >> =20 >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com = >> phil.hunt@oracle.com >> =20 >>> On Oct 25, 2017, at 2:52 PM, Marius Scurtescu > wrote: >>> =20 >>> On Wed, Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) = > wrote: >>>> =20 >>>> Are you proposing A with a should/recommended? >>> =20 >>> Yes >>> =20 >>> =20 >>>> =20 >>>> It is more consistent but adds a lot of duplication in many cases = where iat =3D toe.=20 >>> =20 >>> I don't think that should be a problem. >>> =20 >>> =20 >>>>=20 >>>> Phil >>>>=20 >>>> On Oct 25, 2017, at 2:07 PM, Marius Scurtescu = > wrote: >>>>=20 >>>>> On Wed, Oct 25, 2017 at 2:02 PM, Phil Hunt (IDM) = > wrote: >>>>>> If an event doesn't have a time, did it occur? >>>>> =20 >>>>> At undisclosed time and location :-) >>>>> =20 >>>>> I think it is fine for "toe" to be SHOULD/RECOMMENDED, but not = MUST/REQUIRED. >>>>> =20 >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>> On Oct 25, 2017, at 1:58 PM, Marius Scurtescu = > wrote: >>>>>>=20 >>>>>>> As I said, I totally agree it is useful. But why required? >>>>>>>=20 >>>>>>> Marius >>>>>>> =20 >>>>>>> On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) = > wrote: >>>>>>>> In some cases, ordering of events against a single subject = matters. Time is useful for this purpose though limited in the overall = stream for ordering events overall.=20 >>>>>>>> =20 >>>>>>>> For example account locked vs unlocked. Knowing what happened = last would seem important no? >>>>>>>>=20 >>>>>>>> Phil >>>>>>>>=20 >>>>>>>> On Oct 25, 2017, at 1:46 PM, Marius Scurtescu = > wrote: >>>>>>>>=20 >>>>>>>>> On Wed, Oct 25, 2017 at 11:09 AM, Phil Hunt = > wrote: >>>>>>>>>> It is not clear how to revise the document with regards to = the suggestion against using =E2=80=9Ciat=E2=80=9D when =E2=80=9Ctoe=E2=80= =9D is not asserted.=20 >>>>>>>>>> =20 >>>>>>>>>> If I remove this clarification, it seems unclear what the = time of the event is defined as. There seem to be two options: >>>>>>>>>> =20 >>>>>>>>>> A. If =E2=80=9Ciat=E2=80=9D can=E2=80=99t be assumed to be = the time of event, then =E2=80=9Ctoe=E2=80=9D should be a required = claim. >>>>>>>>> =20 >>>>>>>>> Why? Why can't the Transmitter assert that an account was = disabled and not provide a specific event time? I understand that an = event time is desirable, but why required? >>>>>>>>> =20 >>>>>>>>> =20 >>>>>>>>>> =20 >>>>>>>>>> B. For the majority of use cases, =E2=80=9Ciat=E2=80=9D is = commonly used to mark SET issuance and event time. =E2=80=9Ctoe=E2=80=9D = is only needed when the time of the event is different (on an = exceptional basis). >>>>>>>>> =20 >>>>>>>>> If SET issuance and event time are indeed the same then both = claims should be present. I don't think iat should imply toe. >>>>>>>>> =20 >>>>>>>>>> =20 >>>>>>>>>> Some clarification from the group would be appreciated. = Should we proceed with B, or revise the text to A (or some other = proposal). >>>>>>>>>> =20 >>>>>>>>>> Thanks, >>>>>>>>>> =20 >>>>>>>>>> Phil >>>>>>>>>> =20 >>>>>>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>>>>> @independentid >>>>>>>>>> www.independentid.com = >>>>>>>>>> phil.hunt@oracle.com >>>>>>>>>> =20 >>>>>>>>>>> On Oct 23, 2017, at 6:15 PM, Marius Scurtescu = > wrote: >>>>>>>>>>> =20 >>>>>>>>>>> On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, Annabelle = > wrote: >>>>>>>>>>>> Agreed overall. Having reread the proposed text, I suggest = striking the last sentence, =E2=80=9CWhen not asserted, the value of = =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80= =9D.=E2=80=9D I do not think it is necessary or particularly helpful to = standardize the semantics of a missing time-of-event claim at the SET = level. >>>>>>>>>>> =20 >>>>>>>>>>> +1 >>>>>>>>>>> =20 >>>>>>>>>>> =20 >>>>>>>>>>>> =20 >>>>>>>>>>>> --=20 >>>>>>>>>>>> Annabelle Richard Backman >>>>>>>>>>>> Amazon =E2=80=93 Identity Services >>>>>>>>>>>> =20 >>>>>>>>>>>> =20 >>>>>>>>>>>> From: Id-event > on behalf of "Phil Hunt (IDM)" = > >>>>>>>>>>>> Date: Monday, October 23, 2017 at 5:48 PM >>>>>>>>>>>> To: Mike Jones > >>>>>>>>>>>> Cc: Brian Campbell >, ID Events Mailing List = > >>>>>>>>>>>>=20 >>>>>>>>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new = "toe" claim >>>>>>>>>>>> =20 >>>>>>>>>>>> =20 >>>>>>>>>>>> Agreed +1 on Brian's edits.=20 >>>>>>>>>>>>=20 >>>>>>>>>>>> Phil >>>>>>>>>>>>=20 >>>>>>>>>>>> On Oct 23, 2017, at 5:05 PM, Mike Jones = > = wrote: >>>>>>>>>>>>=20 >>>>>>>>>>>>> Annabelle and I agreed with this proposed change (as = correctly wordsmithed by Brian) during our in-person review =E2=80=93 as = also noted in the reply to Marius=E2=80=99 comments. >>>>>>>>>>>>> =20 >>>>>>>>>>>>> = Thanks Phil and all, >>>>>>>>>>>>> = -- Mike >>>>>>>>>>>>> =20 >>>>>>>>>>>>> From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Brian Campbell >>>>>>>>>>>>> Sent: Thursday, September 28, 2017 8:23 AM >>>>>>>>>>>>> To: Phil Hunt > >>>>>>>>>>>>> Cc: ID Events Mailing List > >>>>>>>>>>>>> Subject: Re: [Id-event] Replacing "nbf" claim with a new = "toe" claim >>>>>>>>>>>>> =20 >>>>>>>>>>>>> +1 to SET defining a time of event claim rather than = trying to redefine a standard claim. And who doesn't like a claim named = "toe"? >>>>>>>>>>>>>=20 >>>>>>>>>>>>> However, the text there for nbf is still effectively = redefining it by saying it should be ignored, which isn't consistent = with the "MUST NOT be accepted for processing" from RFC 7519. It would = be more appropriate to say that nbf should/must not be included in a = SET. Or just not mention nbf at all. But don't change the meaning. >>>>>>>>>>>>>=20 >>>>>>>>>>>>> Also toe would not be "Defined by Section 4.1.5 = [RFC7519]", which is the nbf section. The value of the toe claim is a = NumericDate, which is defined in Sec 2 RFC7519. But toe has no relation = to nbf and no reason to reference nbf.=20 >>>>>>>>>>>>> =20 >>>>>>>>>>>>> On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt = > wrote: >>>>>>>>>>>>>> During the OpenID RISC Face to Face meeting a question = came up regarding SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D = and whether that redefinition was appropriate. >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> The intention of SETs definition is to allow SET = Transmitters to indicate that an event may have occurred as early as a = specified date =E2=80=94 a date which is different from the issuance = date of the SET. In particular this is useful in cases where the state = change is believed to have occurred earlier than the time of issuance = (e.g. because the incident was discovered through an administrative = review or data analysis to have occurred in the past). >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> The definition from JWT is: >>>>>>>>>>>>>> 4.1.5 = <>. "nbf" (Not Before) Claim >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> The "nbf" (not before) claim identifies the time = before which the JWT >>>>>>>>>>>>>> MUST NOT be accepted for processing. The processing = of the "nbf" >>>>>>>>>>>>>> claim requires that the current date/time MUST be = after or equal to >>>>>>>>>>>>>> the not-before date/time listed in the "nbf" claim. = Implementers MAY >>>>>>>>>>>>>> provide for some small leeway, usually no more than a = few minutes, to >>>>>>>>>>>>>> account for clock skew. Its value MUST be a number = containing a >>>>>>>>>>>>>> NumericDate value. Use of this claim is OPTIONAL. >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> As defined in SET: >>>>>>>>>>>>>> nbf >>>>>>>>>>>>>> Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a >>>>>>>>>>>>>> NumericDate. In the context of the SET token it = SHALL be >>>>>>>>>>>>>> interpreted to mean a date in which the event is = believed to have >>>>>>>>>>>>>> occurred (in the past) or will occur in the future. = Note: there >>>>>>>>>>>>>> MAY be some cases where "nbf" is still smaller than = "iat" such as >>>>>>>>>>>>>> when it took an extended time for a SET to be = issued (for example >>>>>>>>>>>>>> after some analysis). This claim is OPTIONAL. >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> There is an argument that the redefinition will cause = confusion.=20 >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> The proposal is to register a different claim name such = as =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new >>>>>>>>>>>>>> definition: >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> toe >>>>>>>>>>>>>> Defined by Section=C2=A04.1.5 [RFC7519] = , a number whose value is a >>>>>>>>>>>>>> NumericDate. The value is the date and time in = which the event is believed to have >>>>>>>>>>>>>> occurred in the past or will occur in the future. = This claim is OPTIONAL. >>>>>>>>>>>>>> When not asserted, the value of =E2=80=9Ctoe=E2=80=9D= MAY be assumed to be the value of =E2=80=9Ciat=E2=80=9D. >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> nbf >>>>>>>>>>>>>> This claim is not used in SET Events. If asserted, = the value SHOULD >>>>>>>>>>>>>> be ignored. >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> Are there any objections to the proposed change? >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> Phil >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>>>>>>>>> @independentid >>>>>>>>>>>>>> www.independentid.com = >>>>>>>>>>>>>> phil.hunt@oracle.com >>>>>>>>>>>>>> =20 >>>>>>>>>>>>>>=20 >>>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>>> Id-event mailing list >>>>>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>>>>>>>>>> =20 >>>>>>>>>>>>>=20 >>>>>>>>>>>>> CONFIDENTIALITY NOTICE: This email may contain = confidential and privileged material for the sole use of the intended = recipient(s). Any review, use, distribution or disclosure by others is = strictly prohibited. If you have received this communication in error, = please notify the sender immediately by e-mail and delete the message = and any file attachments from your computer. Thank you. >>>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>>> Id-event mailing list >>>>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DNkDo69V_FwylRlH= OMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1FwTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VO= N8&e=3D = >>>>>>>>>>>>=20 >>>>>>>>>>>> _______________________________________________ >>>>>>>>>>>> Id-event mailing list >>>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>>> https://www.ietf.org/mailman/listinfo/id-event = >>>>>>>>>>> =20 >>>>>>>>>>> _______________________________________________ >>>>>>>>>>> Id-event mailing list >>>>>>>>>>> Id-event@ietf.org >>>>>>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DXFb85vuDk0h3Ygd= 5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYp= BY&e=3D = >>>>>>>>>> =20 >>>>>>>>>=20 >>>>>>>>> =20 >>>>>>>>> _______________________________________________ >>>>>>>>> Id-event mailing list >>>>>>>>> Id-event@ietf.org >>>>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dmyl7g4hppkWgdjN= 9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNGK8GMcarUwHEtSkNgfogFmv_q6_o0qv8a= xU&e=3D = =20 >>>>>>>=20 >>>>>>> =20 >>>>>>> _______________________________________________ >>>>>>> Id-event mailing list >>>>>>> Id-event@ietf.org >>>>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dk17XiXhDcASFiPI= a2k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSViRQ9wnyMXUZ_fQ1_nuacoh3xx338Fdap= SY&e=3D = =20 >>>>>=20 >>>>> =20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D3xoRnYeAqgWRqvj= mh1fFBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQb1_w6_6zUlq8CPRkegi1x_3G-knlbZk6= kE&e=3D = =20 >>>=20 >>> =20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DG7gI1TT37IHsNVh= TNm8SVkvFsD3lZrMqjkCCQRflMqE&s=3DzFIfIcUn_tP00p6yc2nLmuvlLZKhAZXv-rJr4iK0d= -Y&e=3D = >> =20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DcIteJB5ZijM705L= taca_lGP4yuQYb6gfsfI9KWczkIA&s=3DgBMWCs2G910-j4L2BsK3V2ncAc3wjr-TQ05PpTlIz= SY&e=3D = --Apple-Mail=_BA4C25AB-FA9C-493E-967C-9D1271C2DB1C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Apologies=E2=80=A6 I meant to say, Mike provided some better = text describing the optionality.  That should be published = shortly.


Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 26, 2017, at 5:21 PM, Phil Hunt <phil.hunt@oracle.com> wrote:

MAY is normative permssive = option.  =E2=80=9Cmay=E2=80=9D is used when you are stating a = fact.

So in this = case, Mike has changed the text to indicate that a client  may = interpret =E2=80=9Ciat=E2=80=9D as the value of =E2=80=9Ctoe=E2=80=9D = when =E2=80=9Ctoe=E2=80=9D is not asserted.  It is phrased this way = so that profiling specs can override.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct = 26, 2017, at 5:08 PM, Richard Backman, Annabelle <richanna@amazon.com>= wrote:

What does the = =E2=80=9CMAY=E2=80=9D in this sentence mean?
When not = asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the = value of =E2=80=9Ciat=E2=80=9D.
 
I can think of a couple ways to read = this, neither of which seem appropriate for SET:
  1. Profiling Specifications can = declare that these are the semantics of a missing =E2=80=9Ctoe=E2=80=9D = claim, but if the Profiling Specification does not do so, then the = semantics are still undefined.
    1. Why would this need to be = specified at all?
  2. Unless a Profiling = Specification says otherwise, these are the semantics of a missing = =E2=80=9Ctoe=E2=80=9D claim.
    1. What makes us think that this = is an appropriate default? For many RISC events, the time of event will = be unknown, or prohibitively expensive to know. Are the semantics of a = null =E2=80=9Ctoe=E2=80=9D claim allowed to be different from those of a = missing claim?
 
-- 
Annabelle Richard Backman
Amazon =E2=80=93 Identity Services
 
 
From: Phil Hunt <phil.hunt@oracle.com>
Date: Wednesday, October 25, = 2017 at 2:59 PM
To: Marius Scurtescu <mscurtescu@google.com>
Cc: "Richard Backman, = Annabelle" <richanna@amazon.com>, Brian Campbell <bcampbell@pingidentity.com>, Mike Jones <Michael.Jones@microsoft.com>, ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim
 
OK=E2=80=A6.unless there is = objection, I will revise the draft so that =E2=80=9Ctoe=E2=80=9D will = become a recommended attribute.
 
Phil
 
Oracle Corporation, Identity = Cloud Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com
 
On Oct 25, 2017, at = 2:52 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
 
On Wed, Oct 25, 2017 at 2:44 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
 
Are you proposing A with a = should/recommended?
 
Yes
 
 
 
It is more consistent but adds a = lot of duplication in many cases where iat =3D toe. 
 
I don't think that should be a = problem.
 
 

Phil


On Oct 25, 2017, at 2:07 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 2:02 PM, = Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
If an = event doesn't have a time, did it occur?
 
At undisclosed time and location = :-)
 
I think it is fine for "toe" to be = SHOULD/RECOMMENDED, but not MUST/REQUIRED.
 

Phil


On Oct 25, 2017, at 1:58 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

As I said, = I totally agree it is useful. But why required?

Marius
 
On Wed, = Oct 25, 2017 at 1:56 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
In some = cases, ordering of events against a single subject matters. Time is = useful for this purpose though limited in the overall stream for = ordering events overall. 
 
For example account locked vs unlocked. Knowing what = happened last would seem important no?

Phil


On Oct 25, 2017, at 1:46 PM, = Marius Scurtescu <mscurtescu@google.com> wrote:

On Wed, Oct 25, 2017 at 11:09 AM, = Phil Hunt <phil.hunt@oracle.com> wrote:
It is not clear how to revise the = document with regards to the suggestion against using =E2=80=9Ciat=E2=80=9D= when =E2=80=9Ctoe=E2=80=9D is not asserted. 
 
If I remove this clarification, it = seems unclear what the time of the event is defined as.  There seem = to be two options:
 
A. If =E2=80=9Ciat=E2=80=9D can=E2=80= =99t be assumed to be the time of event, then =E2=80=9Ctoe=E2=80=9D = should be a required claim.
 
Why? Why can't the Transmitter = assert that an account was disabled and not provide a specific event = time? I understand that an event time is desirable, but why = required?
 
 
 
B. For the = majority of use cases, =E2=80=9Ciat=E2=80=9D is commonly used to mark = SET issuance and event time.  =E2=80=9Ctoe=E2=80=9D is only needed = when the time of the event is different (on an exceptional basis).
 
If SET issuance and event time are = indeed the same then both claims should be present. I don't think iat = should imply toe.
 
 
Some clarification from the group = would be appreciated.  Should we proceed with B, or revise the text = to A (or some other proposal).
 
Thanks,
 
Phil
 
Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com
 
On Oct 23, = 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
 
On Mon, Oct 23, 2017 at 6:04 PM, Richard Backman, = Annabelle <richanna@amazon.com> wrote:
Agreed overall. Having reread = the proposed text, I suggest striking the last sentence, =E2=80=9CWhen = not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be = the value of =E2=80=9Ciat=E2=80=9D.=E2=80=9D I do not think it is = necessary or particularly helpful to standardize the semantics of a = missing time-of-event claim at the SET level.
 
+1
 
 
 
-- 
Annabelle Richard = Backman
Amazon =E2=80=93 Identity Services
 
 
From: Id-event <id-event-bounces@ietf.org> on behalf of "Phil Hunt = (IDM)" <phil.hunt@oracle.com>
Date: Monday, October = 23, 2017 at 5:48 PM
To: Mike Jones = <Michael.Jones@microsoft.com>
Cc: Brian Campbell = <bcampbell@pingidentity.com>, ID Events Mailing List = <id-event@ietf.org>

Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim
 
 
Agreed +1 on Brian's edits. 

Phil


On Oct 23, 2017, at = 5:05 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Annabelle and I agreed with this proposed change (as = correctly wordsmithed by Brian) during our in-person review =E2=80=93 as = also noted in the reply to Marius=E2=80=99 comments.
 
           &n= bsp;           &nbs= p;            =             &n= bsp;           &nbs= p;   Thanks Phil and = all,
           &n= bsp;           &nbs= p;            =             &n= bsp;           &nbs= p;   -- Mike
 
From: Id-event [mailto:id-event-bounces@ietf.org] On = Behalf Of Brian = Campbell
Sent: Thursday, September = 28, 2017 8:23 AM
To: Phil Hunt <phil.hunt@oracle.com>
Cc: ID Events Mailing = List <id-event@ietf.org>
Subject: Re: [Id-event] = Replacing "nbf" claim with a new "toe" claim
 

+1 to SET defining a time of event = claim rather than trying to redefine a standard claim. And who doesn't = like a claim named "toe"?

However, the text there for nbf is = still effectively redefining it by saying it should be ignored, which = isn't consistent with the "MUST NOT be accepted for processing" from RFC = 7519. It would be more appropriate to say that nbf should/must not be = included in a SET. Or just not mention nbf at all. But don't change the = meaning.

Also toe would not be "Defined by Section 4.1.5 [RFC7519]", = which is the nbf section. The value of the toe claim is a NumericDate, = which is defined in Sec 2 RFC7519. But toe has no relation to nbf and no = reason to reference nbf. 
 
On = Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
During = the OpenID RISC Face to Face meeting a question came up regarding = SET=E2=80=99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that = redefinition was appropriate.
 
The intention of SETs definition is to allow SET = Transmitters to indicate that an event may have occurred as early as a = specified date =E2=80=94 a date which is different from the issuance = date of the SET. In particular this is useful in cases where the state = change is believed to have occurred earlier than the time of issuance = (e.g. because the incident was discovered through an administrative = review or data analysis to have occurred in the past).
 
The definition from JWT is:

4.1.5.  "nbf" (Not Before) Claim

 
 
   The "nbf" (not before) claim identifies the time =
before which the JWT
   MUST NOT be accepted for =
processing.  The processing of the "nbf"
   claim requires that the current date/time MUST be =
after or equal to
   the not-before date/time listed in =
the "nbf" claim.  Implementers MAY
   provide for some small =
leeway, usually no more than a few minutes, to
   account for clock skew.  Its value MUST be a =
number containing a
   NumericDate value.  Use of this =
claim is OPTIONAL.
 
 
As defined in SET:
   nbf
      =
Defined by Section 4.1.5 =
[RFC7519], a number whose value is a
      =
NumericDate.  In the context of the SET token it SHALL be
      interpreted to mean a date in =
which the event is believed to have
      =
occurred (in the past) or will occur in the future.  Note: =
there
      MAY be some cases where "nbf" is =
still smaller than "iat" such as
      when =
it took an extended time for a SET to be issued (for example
      after some analysis).  This =
claim is OPTIONAL.
 
There is an argument that the redefinition will = cause confusion. 
 
The proposal is to register a different claim name = such as =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new
definition:
 
toe
      Defined by Section 4.1.5 =
[RFC7519], a number whose value is a
      =
NumericDate.  The value is the date and time in which the event is =
believed to have
      occurred in the =
past or will occur in the future. This claim is OPTIONAL.
      When not asserted, the value of =
=E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80=9Ciat=E2=80=
=9D.
 
nbf
      This claim is not used in SET =
Events. If asserted, the value SHOULD
      be =
ignored.
 
 
Are there any objections to the proposed = change?
 
Phil
 
Oracle Corporation, Identity Cloud Services = Architect
@independentid
www.independentid.com
phil.hunt@oracle.com
 


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 

CONFIDENTIALITY NOTICE: This email may contain confidential and = privileged material for the sole use of the intended recipient(s). Any = review, use, distribution or disclosure by others is strictly = prohibited.  If you have received this communication in error, = please notify the sender immediately by e-mail and delete the message = and any file attachments from your computer. Thank = you.
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet= f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3DNkDo69V_FwylRlHOMCBjUEAvpUjBpZYuCVgHSicH61w&s=3D8AooDWY1F= wTG3Bj2ELWqpT7XAaUYAUTxg78kdb0VON8&e=3D


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet= f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJLNs_G_= PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D
 
<= /div>
 
<= /div>
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet= f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3Dmyl7g4hppkWgdjN9T_TyM3tQ98EeI6-1v8uDSW5PqIw&s=3D7O5N5qBNG= K8GMcarUwHEtSkNgfogFmv_q6_o0qv8axU&e=3D 
=
 
<= blockquote class=3D"" type=3D"cite" style=3D"margin-top: 5pt; = margin-bottom: 5pt;">
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet= f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3Dk17XiXhDcASFiPIa2k868J7D8w8RkO4wx0rjYi8wNow&s=3D5fyljqOSV= iRQ9wnyMXUZ_fQ1_nuacoh3xx338FdapSY&e=3D 
=
 
<= /div>
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet= f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_l= LIGk&m=3D3xoRnYeAqgWRqvjmh1fFBHbFqwPo0-S31KYrJ0sZK7g&s=3DOgn5vWSJQ= b1_w6_6zUlq8CPRkegi1x_3G-knlbZk6kE&e=3D 
=
 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ie= tf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvl= ZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_= lLIGk&m=3DG7gI1TT37IHsNVhTNm8SVkvFsD3lZrMqjkCCQRflMqE&s=3DzFIfIcUn= _tP00p6yc2nLmuvlLZKhAZXv-rJr4iK0d-Y&e=3D
 
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DcIteJB5ZijM705Ltaca_lGP4yuQYb6gfsfI9KWczkIA&s=3DgBMWCs2G91= 0-j4L2BsK3V2ncAc3wjr-TQ05PpTlIzSY&e=3D
= --Apple-Mail=_BA4C25AB-FA9C-493E-967C-9D1271C2DB1C-- From nobody Thu Oct 26 17:27:34 2017 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E0FEE13B1A9; Thu, 26 Oct 2017 17:27:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.63.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150906405185.22105.6005697314403584227@ietfa.amsl.com> Date: Thu, 26 Oct 2017 17:27:31 -0700 Archived-At: Subject: [Id-event] I-D Action: draft-ietf-secevent-token-03.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 00:27:32 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events WG of the IETF. Title : Security Event Token (SET) Authors : Phil Hunt William Denniss Morteza Ansari Michael B. Jones Filename : draft-ietf-secevent-token-03.txt Pages : 24 Date : 2017-10-26 Abstract: This specification defines the Security Event Token, which may be distributed via a protocol such as HTTP. The Security Event Token (SET) specification profiles the JSON Web Token (JWT), which can be optionally signed and/or encrypted. A SET describes a statement of fact from the perspective of an issuer that it intends to share with one or more receivers. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-secevent-token-03 https://datatracker.ietf.org/doc/html/draft-ietf-secevent-token-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-token-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Oct 26 17:32:31 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6915913F4CB for ; Thu, 26 Oct 2017 17:32:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mFdJuWBQsh05 for ; Thu, 26 Oct 2017 17:32:27 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A982213B1A9 for ; Thu, 26 Oct 2017 17:32:27 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9R0WQ2m031764 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 27 Oct 2017 00:32:27 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9R0WQ8b005371 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 27 Oct 2017 00:32:26 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v9R0WQYJ019266 for ; Fri, 27 Oct 2017 00:32:26 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 26 Oct 2017 17:32:26 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_0FBE915A-1CB6-4640-AC0F-04EB294353CC" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 26 Oct 2017 17:32:24 -0700 References: <150906405185.22105.6005697314403584227@ietfa.amsl.com> To: ID Events Mailing List In-Reply-To: <150906405185.22105.6005697314403584227@ietfa.amsl.com> Message-Id: <3009BDC9-745C-4A44-994D-688D2FC4BAA3@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-token-03.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 00:32:29 -0000 --Apple-Mail=_0FBE915A-1CB6-4640-AC0F-04EB294353CC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This draft incorporates feedback from comments and discussion since the = WGLC. * Corrected subscriber to Event Receiver * Removed =E2=80=9Cnbf=E2=80=9D claim * Introduced =E2=80=9Ctoe=E2=80=9D or time of event * Figure 3 moved =E2=80=9Csub=E2=80=9D to event payload in figure * Clarified use of nonce when differentiating from JWTs * Editorial improvements and clarifications Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 26, 2017, at 5:27 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Security Events WG of the IETF. >=20 > Title : Security Event Token (SET) > Authors : Phil Hunt > William Denniss > Morteza Ansari > Michael B. Jones > Filename : draft-ietf-secevent-token-03.txt > Pages : 24 > Date : 2017-10-26 >=20 > Abstract: > This specification defines the Security Event Token, which may be > distributed via a protocol such as HTTP. The Security Event Token > (SET) specification profiles the JSON Web Token (JWT), which can be > optionally signed and/or encrypted. A SET describes a statement of > fact from the perspective of an issuer that it intends to share with > one or more receivers. >=20 >=20 > The IETF datatracker status page for this draft is: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8= PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D= iE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3D13DdZOaFgaD-HGP2pOCNkOpTyR= nnTGRb7VnJexYAGCc&e=3D=20 >=20 > There are also htmlized versions available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ietf.org_html= _draft-2Dietf-2Dsecevent-2Dtoken-2D03&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8P= QcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D= iE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3DBksQtIbBnjpETfC7vLs92O1B3-= ZnlZQlMCrUBG8QbCA&e=3D=20 > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D03&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C= _lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3DVpIQD9_-bNURLCQ= Cxp-hVvXMul6YgqSO8Nxw1X1KHbg&e=3D=20 >=20 > A diff from the previous version is available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_rfcdif= f-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D03&d=3DDwICAg&c=3DRoP1YumCXCg= aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C= _lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3DaydXxUYGSvtw1dd= 4n39uYsU-QKVu9lBPPVYxIy2UjiU&e=3D=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > = https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.org_internet= -2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpn= ZwAfRFFI_QfqXJZy8&s=3DmUk0Dul3biGp6ditTT_cLwjqiqu1kyHHgYP2i8K5ymU&e=3D=20= >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DiE3v6CSLR7pkOg7= J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3DZNG7JDnbqH3z0vVbAlHsaF8rHDSCPzG-IUK3uQDwN= ME&e=3D=20 --Apple-Mail=_0FBE915A-1CB6-4640-AC0F-04EB294353CC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 This draft  incorporates feedback from comments and = discussion since the WGLC.

* Corrected subscriber to Event Receiver
*= Removed =E2=80=9Cnbf=E2=80=9D claim
* Introduced = =E2=80=9Ctoe=E2=80=9D or time of event
* Figure 3 = moved =E2=80=9Csub=E2=80=9D to event payload in figure
* Clarified use of nonce when differentiating from = JWTs
* Editorial improvements and = clarifications

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 26, 2017, at 5:27 PM, internet-drafts@ietf.org wrote:


A New Internet-Draft is available from the on-line = Internet-Drafts directories.
This draft is a work item of = the Security Events WG of the IETF.

=        Title =           : Security = Event Token (SET)
=        Authors =         : Phil Hunt
= =             &n= bsp;           &nbs= p;William Denniss
=             &n= bsp;           &nbs= p;Morteza Ansari
=             &n= bsp;           &nbs= p;Michael B. Jones
Filename =        : = draft-ietf-secevent-token-03.txt
Pages =           : 24
= Date =            : = 2017-10-26

Abstract:
=   This specification defines the Security Event Token, which = may be
  distributed via a protocol such as = HTTP.  The Security Event Token
  (SET) = specification profiles the JSON Web Token (JWT), which can be
  optionally signed and/or encrypted.  A SET = describes a statement of
  fact from the = perspective of an issuer that it intends to share with
=   one or more receivers.


The IETF datatracker status page for this draft is:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=3DDwICAg&c=3DR= oP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJx= PEivzjWwlNKe4C_lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&a= mp;s=3D13DdZOaFgaD-HGP2pOCNkOpTyRnnTGRb7VnJexYAGCc&e=3D

There are also htmlized versions available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ie= tf.org_html_draft-2Dietf-2Dsecevent-2Dtoken-2D03&d=3DDwICAg&c=3DRo= P1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxP= EivzjWwlNKe4C_lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&am= p;s=3DBksQtIbBnjpETfC7vLs92O1B3-ZnlZQlMCrUBG8QbCA&e=3D
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_html_draft-2Dietf-2Dsecevent-2Dtoken-2D03&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0= FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_Q= fqXJZy8&s=3DVpIQD9_-bNURLCQCxp-hVvXMul6YgqSO8Nxw1X1KHbg&e=3D =

A diff from the previous version is = available at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Dtoken-2D03&d=3DDwICAg&= amp;c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0= FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_Q= fqXJZy8&s=3DaydXxUYGSvtw1dd4n39uYsU-QKVu9lBPPVYxIy2UjiU&e=3D =


Please note that it may = take a couple of minutes from the time of submission
until = the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.o= rg_internet-2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5= YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D= iE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3DmUk0Dul3biGp6ditTT_cLw= jqiqu1kyHHgYP2i8K5ymU&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DiE3v6CSLR7pkOg7J2eBLwuzxpnZwAfRFFI_QfqXJZy8&s=3DZNG7JDnbqH= 3z0vVbAlHsaF8rHDSCPzG-IUK3uQDwNME&e=3D

= --Apple-Mail=_0FBE915A-1CB6-4640-AC0F-04EB294353CC-- From nobody Thu Oct 26 17:35:50 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FCFC13A415 for ; Thu, 26 Oct 2017 17:35:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.819 X-Spam-Level: X-Spam-Status: No, score=-11.819 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gQmHMlPyErN3 for ; Thu, 26 Oct 2017 17:35:44 -0700 (PDT) Received: from smtp-fw-6002.amazon.com (smtp-fw-6002.amazon.com [52.95.49.90]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D14A613F4CB for ; Thu, 26 Oct 2017 17:35:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1509064544; x=1540600544; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=PXoDLHlq9K4Xk0M3S3okhC6TcbHfVZgYRb0xYyDec7c=; b=HcRwhJo33nD5Qf96rkIcQkh/B551wVzyywuZip4STsG1prp57wcA+ywx Rnf6oETY1YLaKmsi6GW+AnCZ0hHsQ037pEG6mi2lvNazXPpqC4EVfVelL EKxE+zDxptTkGrNc98uAY+BnI1wwgOfs7ZDPXE4CnrPI0SogXFBDzSUyp M=; X-IronPort-AV: E=Sophos;i="5.44,302,1505779200"; d="scan'208,217";a="313392138" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2b-4ff6265a.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6002.iad6.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Oct 2017 00:35:35 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-2b-4ff6265a.us-west-2.amazon.com (8.14.7/8.14.7) with ESMTP id v9R0ZXR1049092 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 27 Oct 2017 00:35:34 GMT Received: from EX13D11UWC003.ant.amazon.com (10.43.162.162) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 27 Oct 2017 00:35:33 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC003.ant.amazon.com (10.43.162.162) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 27 Oct 2017 00:35:33 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Fri, 27 Oct 2017 00:35:33 +0000 From: "Richard Backman, Annabelle" To: Phil Hunt CC: ID Events Mailing List Thread-Topic: [Id-event] Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9aLyXLkAgASBbYA= Date: Fri, 27 Oct 2017 00:35:32 +0000 Message-ID: <47311FA7-125E-4F1C-AF3D-EE0DBF35574B@amazon.com> References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> In-Reply-To: <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.65] Content-Type: multipart/alternative; boundary="_000_47311FA7125E4F1CAF3DEE0DBF35574Bamazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 00:35:48 -0000 --_000_47311FA7125E4F1CAF3DEE0DBF35574Bamazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmVwbGllcyBpbmxpbmUNCg0KLS0NCkFubmFiZWxsZSBSaWNoYXJkIEJhY2ttYW4NCkFtYXpvbiDi gJMgSWRlbnRpdHkgU2VydmljZXMNCg0KDQpGcm9tOiBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFj bGUuY29tPg0KRGF0ZTogTW9uZGF5LCBPY3RvYmVyIDIzLCAyMDE3IGF0IDg6NDggUE0NClRvOiAi UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUiIDxyaWNoYW5uYUBhbWF6b24uY29tPg0KQ2M6IElE IEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJ ZC1ldmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD8NCg0KQW5uYWJl bGxlLA0KDQpJIGhhdmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHByb3Bvc2FsLg0K DQpQcm9maWxpbmcgSW5kZXBlbmRlbmNlIC8gS2VlcGluZyBFdmVudCBQYXlsb2FkcyBJbmRlcGVu ZGVudA0KDQpJbmRpY2F0aW5nIHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFuZGxlZCBieSBw cm9maWxlcyBsZWFkcyB0byBtb3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBhbmQgbW9yZSBp bXBvcnRhbnRseSBpbnRydWRlcyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBieSBzdWdnZXN0 aW5nIGEgc3ViLXNjaGVtYSBjcmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBhbmQgY29uZmxp Y3RzIHRoYXQgbWF5IGFkZCB0byBjb21wbGV4aXR5IGxhdGVyIG9uLiBUaGUgY3VycmVudCBmb3Jt YXQgYWxsb3dzIGEgcGFyc2VyIHRvIGRpc2NvdmVyIGFuZCB1bmxvYWQgb25lIG9yIG1vcmUgSlNP TiBwYXlsb2FkcyB3aGljaCBjYW4gZWFjaCBoYXZlIGluZGVwZW5kZW50IHN0cnVjdHVyZS4NCg0K W3JpY2hhbm5hXSBBcyBJIHNhaWQsIEnigJltIGZpbmUgd2l0aCBkZWZpbmluZyBhbiBleHRlbnNp b24gbWVjaGFuaXNtIGF0IHRoZSBTRVQgbGV2ZWwsIGlmIHBlb3BsZSB0aGluayBpdCBpcyBuZWNl c3Nhcnk7IEkgZG9u4oCZdCBoYXZlIGEgc3Ryb25nIG9waW5pb24gb25lIHdheSBvciB0aGUgb3Ro ZXIsIHNvIEkgcHJlc2VudGVkIHRoZSBzaW1wbGVyIG9wdGlvbiAoc2ltcGxlciBpbiB0ZXJtcyBv ZiBhbW91bnQgb2YgY29udGVudCBpbiB0aGUgU0VUIHNwZWMpLiBJIHRoaW5rIHRoYXQgd291bGQg Y2xlYXIgdXAgYW55IGludGVyb3BlcmFiaWxpdHkgYW5kIHJldXNhYmlsaXR5IGNvbmNlcm5zLiBB ZGQgc29tZSB0ZXh0IHRvIHRoZSBwcm9wb3NlZCBldmVudCBjbGFpbSBkZWZpbml0aW9uIGxpa2U6 DQoNClRoZSBvYmplY3QgTUFZIGNvbnRhaW4gYW4gImV4dGVuc2lvbnMiIG1lbWJlciwgd2hpY2gg aWYgcHJlc2VudCBpcyBhIEpTT04gb2JqZWN0IHdob3NlIGtleXMgYXJlIFVSSXMgaWRlbnRpZnlp bmcgZXZlbnQgZXh0ZW5zaW9ucyBkZWZpbmVkIGluIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9ucywg YW5kIHdob3NlIHZhbHVlcyBhcmUgSlNPTiBvYmplY3RzIHdob3NlIGNvbnRlbnRzIGFyZSBkZWZp bmVkIGluIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9ucy4NCg0KSeKAmW0gbm90IHN1cmUgaG93IG1h bmRhdGluZyBvbmUgb3IgdHdvIG1lbWJlcnMgb2YgdGhlIGV2ZW50IHBheWxvYWQgaXMgYSBtZWFu aW5nZnVsIGludHJ1c2lvbi4gSldUIGRlZmluZXMgNyBzdGFuZGFyZCBjbGFpbXMsIGFuZCB3ZSBz ZWVtIHRvIGdldCBhbG9uZyBqdXN0IGZpbmUgd2l0aCB0aGF0LiBbL3JpY2hhbm5hXQ0KDQpHZW5l cmFsIGV4dGVuc2lvbnMNCg0KVGhlIHByb3Bvc2FsIGFsc28gcnVsZXMgb3V0IGdlbmVyYWwgcHVy cG9zZSBleHRlbnNpb25zIG5vdCByZWxhdGVkIHRvIGFueSBzcGVjaWZpYyBldmVudC4gR2l2ZW4g dGhlIGVtZXJnZW5jZSBvZiBpdGVtcyBsaWtlIEdQUkQsIEkgd291bGQgbm90IHdhbnQgdG8gYmxv Y2sgdGhlIGFiaWxpdHkgdG8gYWRkIG1ldGEtZGF0YSBvciBvdGhlciBnZW5lcmFsIHB1cnBvc2Ug aXRlbXMuIFdlIGNhbiBhbHNvIGFudGljaXBhdGUgc29tZSBkZWxpdmVyeSBzY2VuYXJpb3Mgd2hl cmUgYWRkaXRpb25hbCBkYXRhIG1pZ2h0IGJlIHJlcXVpcmVkLiBFdmVuIHRob3VnaCB0aGVyZSBp cyBubyBjdXJyZW50IHBsYW5uZWQgdXNlLCBJIHNlZSBubyBnb29kIHJlYXNvbiB0byBydWxlIHRo aXMgb3V0Lg0KW3JpY2hhbm5hXSBJIHRoaW5rIHRoaXMgaXMgYSBnb29kIGFyZ3VtZW50IGZvciBk ZWZpbmluZyB0aGUgZXh0ZW5zaW9uIG1lY2hhbmlzbSBhdCB0aGUgU0VUIGxldmVsOyBzZWUgYWJv dmUuIFsvcmljaGFubmFdDQoNCk11bHRpcGxlIEV2ZW50cyBGcm9tIERpZmZlcmVudCBGYW1pbGll cyAodnMuIE11bHRpcGxlIEV2ZW50cyBmcm9tIGEgc2luZ2xlIGZhbWlseSBsaWtlIFJJU0MpDQoN CkluIG91ciBSSVNDIHNlc3Npb24gd2UgZGlzY3Vzc2VkIGV4cHJlc3NpbmcgbXVsdGlwbGUgZGlz dGluY3QgUklTQyBldmVudHMgaW4gb25lIFNFVC4gVGhlIGRpc2N1c3Npb24gd2FzIHRoYXQgb25s eSBvbmUgUklTQyBldmVudCBhdCBhIHRpbWUuIFdlIGRpZCBub3QgZGlzY3VzcyBvdGhlciBldmVu dCBwcm9maWxlcy4gSSBkb27igJl0IHNlZSBhIHJlYXNvbiB0byBydWxlIG91dCBtdWx0aS1ldmVu dHMgZnJvbSBkaWZmZXJlbnQgZmFtaWxpZXMgYXQgdGhlIFNFVCBsZXZlbC4gRWFjaCBwcm9maWxl IGlzIGV4cHJlc3Npbmcgc2xpZ2h0bHkgZGlmZmVyZW50IHRoaW5ncyBhYm91dCB0aGUgc2FtZSBl dmVudC4NCg0KSSBjYW4gZm9yc2VlIHNvbWUgY2FzZXMgd2hlcmUgaXQgaXMgbm90IGNsZWFyIHdo aWNoIGlzIHRoZSBwcmltYXJ5IGFuZCB3aGljaCBpcyB0aGUgZXh0ZW5zaW9uLiAgVGhlcmUgbWF5 IG5vdCBiZSBhIGNsZWFyIHdpbm5lci4NCltyaWNoYW5uYV0gRXhhbXBsZT8gVGhpcyBkZWZpZXMg bXkgdW5kZXJzdGFuZGluZyBvZiB3aGF0IHRoZSB3b3JkIOKAnGV4dGVuc2lvbuKAnSBtZWFucy4g SXTigJlzIGhhcmQgdG8gYXJndWUgdGhhdCB3ZSBjYW4gcHJvdmlkZSBhIHN0YW5kYXJkaXplZCBl eHRlbnNpb24gbWVjaGFuaXNtIGlmIGV2ZW50IGV4dGVuc2lvbnMgYXJlIGluZGlzdGluZ3Vpc2hh YmxlIGZyb20gcHJpbWFyeSBldmVudHMuIFsvcmljaGFubmFdDQoNCkEgY291cGxlIG9mIGV4YW1w bGVzICh0aGVzZSBhcmUgbmVjZXNzYXJpbHkgcmVhbOKApmp1c3QgcG9zc2liaWxpdGllcyk6DQoq IEl0IGlzIHByb2JhYmx5IHVzZWZ1bCB0byBiZSBhYmxlIHRvIGV4cHJlc3Mgc2ltbGFyL292ZXJs YXBwaW5nIGV2ZW50cyBmcm9tIGRpZmZlcmVudCBTRVQgcHJvZmlsZXMgaW4gb25lIFNFVC4gIEZv ciBleGFtcGxlIGEgQmFja2NoYW5uZWwgTG9nb3V0ICYgYSBSSVNDIHNlc3Npb24gY2FuY2VsIGV2 ZW50Lg0KW3JpY2hhbm5hXSBXaHkgaXMgaXQgbmVjZXNzYXJ5IG9yIGFwcHJvcHJpYXRlIHRvIGlu Y2x1ZGUgdGhlc2UgZXZlbnRzIGluIHRoZSBzYW1lIFNFVD8gVGhleSBhcmUgbGlrZWx5IGJlaW5n IGdlbmVyYXRlZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBhdCBkaWZmZXJlbnQgdGltZXMgb24gdGhl IHRyYW5zbWl0dGVy4oCZcyBzaWRlLCBjb25zdW1lZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBvbiB0 aGUgcmVjZWl2ZXLigJlzIHNpZGUsIGFuZCBwb3NzaWJseSBiZWluZyB0cmFuc21pdHRlZCBvdmVy IGRpZmZlcmVudCBldmVudCBzdHJlYW1zLiBJIGtub3cgdGhlIGxhdHRlciB3b3VsZCBiZSB0aGUg Y2FzZSBmb3IgdXMsIGFzIGEgcmVjZWl2ZXIuIEV2ZW4gaWYgaXTigJlzIG5vdCwgaXMgaXQgYnVy ZGVuc29tZSB0byBzZW5kIHRoZXNlIGV2ZW50cyBzZXBhcmF0ZWx5PyBXaGF0IHZhbHVlIGlzIGdh aW5lZCBpbiBjb21iaW5pbmcgdGhlbT8gWy9yaWNoYW5uYV0NCg0KKiBTQ0lNIG1heSB3YW50IHRv IHJlcHJlc2VudCBhIHNpbmdsZSB0cmFuc2FjdGlvbiBhcyBjYXVzaW5nIG11bHRpcGxlIHN0YXRl IGNoYW5nZXMgaW4gYW4gZXZlbnQgKGUuZy4gYSBwYXNzd29yZCBjaGFuZ2UgY2F1c2VzIG11bHRp cGxlIGVmZmVjdHMpLiBIYXZpbmcgdG8gY2hhc2UgZG93biBtdWx0aXBsZSBldmVudHMgYW5kIGNv cnJlbGF0ZSBieSDigJx0eG7igJ0gd291bGQgYmUgY2hhbGxlbmdpbmcgaW4gYSBtdWx0aS10aHJl YWRlZC9tdWx0aS1ub2RlIGRlbGl2ZXJ5IHN5c3RlbS4gIFRoZSBTQ0lNIGxpc3QgaGFzIG5vdCBk aXNjdXNzZWQgdGhpcywgYnV0IEkgd291bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhpcyBjYXBhYmls aXR5LiAgSU9XIC0gSnVzdCBiZWNhdXNlIFJJU0MgZG9lcyBub3Qgd2FudCB0byBleHByZXNzIG11 bHRpcGxlIGV2ZW50cyBkb2VzIG5vdCBtYWtlIHRoaXMgdHJ1ZSBmb3Igb3RoZXIgcHJvZmlsZXMu DQpbcmljaGFubmFdIFllcywgdGhpcyBpcyBwcmVjaXNlbHkgd2h5IEkgcmFpc2VkIHRoZSBxdWVz dGlvbjogdG8gZmluZCBvdXQgaWYgb3RoZXIgcHJvZmlsZXMgaGF2ZSBhIHVzZSBjYXNlIGZvciB0 aGlzLiBEb2VzIFNDSU0gaGF2ZSBhbiBhY3R1YWwgdXNlIGNhc2UsIG9yIGEgdGhlb3JldGljYWwg b25lPyBbL3JpY2hhbm5hXQ0KDQoqIFdlIG1heSB3aXNoIHRvIGluZGljYXRlIGEgU0NJTSBQYXNz d29yZCBSZXNldCB3YXMgcGVyZm9ybWVkIGFuZCBhIExvZ291dC9zZXNzaW9uIGNhbmNlbGxhdGlv biBpcyBleHByZXNzZWQgYXQgdGhlIHNhbWUgdGltZS4gIFRoZSBldmVudHMgYXJlIHJlbGF0ZWQg YnV0IGV4cHJlc3MgZGlmZmVyZW50IGRhdGEuDQpbcmljaGFubmFdIEFyZSBhIGdpdmVuIHRyYW5z bWl0dGVyL3JlY2VpdmVyIHBhaXIgZ3VhcmFudGVlZCB0byB1c2UgdGhlIHNhbWUgZXZlbnQgc3Ry ZWFtIGZvciBTQ0lNIGFuZCBCYWNrY2hhbm5lbCBMb2dvdXQ/IEkgdGhpbmsgeW914oCZcmUgZ29p bmcgdG8gcnVuIGludG8gaW50ZXJvcCBwcm9ibGVtcyBpZiB5b3UgbWFrZSB0aGF0IGFzc3VtcHRp b24uIFsvcmljaGFubmFdDQoNCkF2b2lkaW5nIENvbmZ1c2lvbiBGcm9tIFNpbWlsYXIgRXZlbnRz IE9yaWdpbmF0aW5nIGZyb20gdGhlIFNhbWUgVHJhbnNhY3Rpb24NCg0KSWYgZXZlbnRzIGFyZSBz ZW50IHNlcGFyYXRlbHksIHRoZW4gbW9yZSB0cmFja2luZyBvZiBzdGF0ZSAoZS5nLiBieSB0eG4p IHdvdWxkIGJlIHJlcXVpcmVkIHRvIGVuc3VyZSBzaW1pbGFyIGV2ZW50cyBhcmUgbm90IG1pc3Rh a2VuIG9yIGhhbmRsZWQgYXMgcmVwZWF0cy4gV2hpbGUgdHhuIHByb3ZpZGVzIHVzZWZ1bCBhdWRp dCBhbmFseXNpcyBjYXBhYmlsaXR5LCBJ4oCZbSBub3Qgc3VyZSBpdCBjYW4gYmUgdXNlZCBpbiBs aXZlIG9yIG5lYXItcmVhbCB0aW1lIHN5c3RlbXMgZ2l2ZW4gZGlzdHJpYnV0ZWQgbXVsdGktbm9k ZSwgbXVsdGktdGhyZWFkaW5nIGFyY2hpdGVjdHVyZXMuDQpbcmljaGFubmFdIEkgZG9u4oCZdCBm b3Jlc2VlIHR4biBjb3JyZWxhdGlvbiBiZWluZyBhbiBpc3N1ZSwgYnV0IGFkbWl0dGVkbHkgSeKA mXZlIG1vc3RseSB0aG91Z2h0IGFib3V0IHRoaXMgZnJvbSB0aGUgUklTQyBwZXJzcGVjdGl2ZSwg d2hlcmUgdGhlcmUgaXMgYSBzdHJvbmcgY29ycmVsYXRpb24gYmV0d2VlbiBldmVudCB2b2x1bWUg YW5kIHRlY2huaWNhbCBzb3BoaXN0aWNhdGlvbiBvZiB0aGUgcGFydGllcyBpbnZvbHZlZC4gV2hh dCBraW5kIG9mIGV2ZW50IHZvbHVtZSBpcyBleHBlY3RlZCBmb3IgU0NJTT8gV2hhdCBraW5kIG9m IGNvbmZ1c2lvbiBhcmUgeW91IHRoaW5raW5nIG9mPyBVbmxlc3MgeW914oCZcmUgZ29pbmcgdG8g c2F5IHRoYXQgZXZlbnRzIHRoYXQgYXJlIG5vdCB0cmFuc21pdHRlZCBpbiB0aGUgc2FtZSBTRVQg YXJlIG5vdCByZWxhdGVkLCB0aGVuIHJlY2VpdmVycyB3aWxsIGhhdmUgdG8gYmUgYWJsZSB0byBj b3JyZWxhdGUgaW4gcmVhbCB0aW1lIGVpdGhlciB3YXkuIFsvcmljaGFubmFdDQoNClByZXZpb3Vz IERpc2N1c3Npb24NCg0KSSBub3RlIHRoYXQgSSBvcmlnaW5hbGx5IHJhaXNlZCBoYXZpbmcgYW4g YXR0cmlidXRlIHRvIGRlc2lnbmF0ZSBwcmltYXJ5IGV2ZW50IGF0dHJpYnV0ZSB0byBhbGxldmlh dGUgeW91ciBjb25jZXJuLCBidXQgdGhpcyB3YXMgbm90IGFjY2VwdGVkLiBTZWU6DQoqIGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQvY3VycmVudC9tc2cwMDQw Ni5odG1sDQoqIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQv Y3VycmVudC9tc2cwMDE0MC5odG1sDQoNClRoZSBjb25zZW5zdXMsIGF0IGxlYXN0IGFzIEkgaW50 ZXJwcmV0ZWQgaXQgaXMgdXAgdG8gdGhlIHJlY2VpdmVyIHRvIGZpZ3VyZSB0aGlzIG91dCBiYXNl ZCBvbiB0aGUgZGVmaW5pdGlvbnMgaXQgaGFzIGZvciBlYWNoIGV2ZW50IFVSSSBhbmQgdGhlIHBy b2ZpbGVzIHRoZXkgcmVwcmVzZW50LiBJT1cgLSBSSVNDIGlzIGZyZWUgdG8gbGltaXQgdGhhdCBv bmx5IG9uZSBSSVNDIGV2ZW50IGJlIGV4cHJlc3NlZCBhdCBhIHRpbWUuDQoNCg0KUGhpbA0KDQpP cmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGlu ZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwOi8vd3d3LmluZGVwZW5kZW50 aWQuY29tPg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Pg0KDQpPbiBPY3QgMjMsIDIwMTcsIGF0IDc6MDIgUE0sIFJpY2hhcmQgQmFja21hbiwgQW5uYWJl bGxlIDxyaWNoYW5uYUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tPj4gd3Jv dGU6DQoNClRoZSBjdXJyZW50IGRyYWZ0IG9mIHRoZSBTRVQgc3BlYyBhbGxvd3MgZm9yIGV4cHJl c3NpbmcgbXVsdGlwbGUgZXZlbnRzIHdpdGhpbiB0aGUgc2FtZSB0b2tlbiwgd2hpY2ggaW50cm9k dWNlcyBhZGRpdGlvbmFsIGNvbXBsZXhpdHkgYW5kIHJvb20gZm9yIGFtYmlndW91cyBzZW1hbnRp Y3MuIFdl4oCZdmUgZGlzY3Vzc2VkIHRoaXMgaW4gdGhlIE9JREYgUklTQyB3b3JraW5nIGdyb3Vw IGFuZCB0aGUgY3VycmVudCBjb25zZW5zdXMgdGhlcmUgaXMgdGhhdCBSSVNDIHdpbGwgcmVxdWly ZSB0aGF0IFJJU0MgZXZlbnRzIG11c3QgYmUgdGhlIG9ubHkgZXZlbnQgaW4gdGhlIFNFVCwgaGF2 aW5nIGlkZW50aWZpZWQgd2F5cyB0byBjbGVhcmx5IGFuZCBlYXNpbHkgc3VwcG9ydCB0aGUgaGFu ZGZ1bCBvZiB1c2UgY2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgdG9rZW4gdGhhdCBwZW9w bGUgaGF2ZSByYWlzZWQuIFdpdGggdGhhdCBjb250ZXh0IGluIG1pbmQsIEkgcHJvcG9zZSBzdHJp a2luZyB0aGUgZGVmaW5pdGlvbiBvZiB0aGUg4oCcZXZlbnRz4oCdIGNsYWltIGZyb20gdGhlIFNl Y3VyaXR5IEV2ZW50IFRva2VuIHNwZWMsIGFuZCByZXBsYWNpbmcgaXQgd2l0aCB0aGUgZm9sbG93 aW5nIGRlZmluaXRpb24gZm9yIGFuIOKAnGV2ZW504oCdIGNsYWltIChzaW5ndWxhcik6DQoNCmV2 ZW50DQpBIEpTT04gb2JqZWN0IGNvbnRhaW5pbmcgYW4gImV2ZW50X3R5cGUiIG1lbWJlciB3aG9z ZSB2YWx1ZSBpcyBhIFVSSSByZXByZXNlbnRpbmcgYSB0eXBlIG9mIGV2ZW50IGRlZmluZWQgaW4g YSBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbi4gVGhlIG9iamVjdCBNQVkgb3RoZXJ3aXNlIGJlIGVt cHR5LCBvciBNQVkgY29udGFpbiBhZGRpdGlvbmFsIG1lbWJlcnMgYXMgZGVzY3JpYmVkIGJ5IHRo ZSBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbi4NCg0KSGVyZSBpcyB0aGUgZXhhbXBsZSBTRVQgZnJv bSBzZWN0aW9uIDIuMywgcmV3cml0dGVuIHdpdGggdGhpcyBjaGFuZ2UgbWluZDoNCnsNCiAgImp0 aSI6ICI0ZDM1NTllYzY3NTA0YWFiYTY1ZDQwYjAzNjNmYWFkOCIsDQogICJpYXQiOiAxNDU4NDk2 NDA0LA0KICJpc3MiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tPGh0dHBzOi8vc2NpbS5leGFt cGxlLmNvbS8+IiwNCiAgImF1ZCI6IFsNCiAgICAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0Zl ZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0KICAgICJodHRwczovL3NjaW0uZXhhbXBs ZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyINCiAgXSwNCg0KICAiZXZlbnQi OiB7DQogICAgImV2ZW50X3R5cGUiOiAidXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6Y3JlYXRl IiwNCiAgICAicmVmIjogImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5 NmJkNmFiNjFlNzUyMWQ5IiwNCiAgICAiYXR0cmlidXRlcyI6IFsiaWQiLCAibmFtZSIsICJ1c2Vy TmFtZSIsICJwYXNzd29yZCIsICJlbWFpbHMiXQ0KICB9DQp9DQoNCkRvZXMgYW55b25lIGluIHRo ZSB3b3JraW5nIGdyb3VwIGhhdmUgdXNlIGNhc2VzIGZvciBTRVRzIHRoYXQgY2Fubm90IGJlIG1l dCBieSB0aGlzIHByb3Bvc2VkIHRleHQ/IFdpdGhpbiBSSVNDLCB3ZSBpZGVudGlmaWVkIHRocmVl IHVzZSBjYXNlcywgd2l0aCBzb2x1dGlvbnMgb3V0bGluZWQgYmVsb3c6DQoNCkV4dGVuc2lvbnMN CkV2ZW50IGV4dGVuc2lvbiBtZWNoYW5pc21zIGNhbiBiZSBkZWZpbmVkIGludGVybmFsIHRvIHRo ZSBldmVudCBvYmplY3QuIEEgc2ltcGxlIGFwcHJvYWNoIHdvdWxkIGJlIHRvICBkZWZpbmUgYW4g 4oCcZXh0ZW5zaW9uc+KAnSBtZW1iZXIgdGhhdCBpcyBhIGxpc3Qgb2YgZXZlbnQgb2JqZWN0cyAo b3Igc2V0IHJlc2VtYmxpbmcgdGhlIOKAnGV2ZW50c+KAnSBjbGFpbSBhcyBkZWZpbmVkIGluIHRo ZSBjdXJyZW50IHNwZWMpLiBUaGlzIGhhcyB0aGUgYWR2YW50YWdlIG9mIG1ha2luZyBpdCBjbGVh ciBpbiB0aGUgZGF0YSBzdHJ1Y3R1cmUgdGhhdCB0aGVyZSBpcyBhIHNpbmdsZSBwcmltYXJ5IGV2 ZW50LCB3aXRoIHplcm8gb3IgbW9yZSBleHRlbnNpb25zLiBUaGVyZSBpcyBubyByb29tIGZvciBj b25mdXNpb24gb3ZlciB3aGljaCBldmVudCBpcyBwcmltYXJ5LCBvciBpZiB0aGVyZSBpcyBhIHBy aW1hcnkgZXZlbnQgYXQgYWxsLiBJIHdvdWxkIGJlIGZpbmUgd2l0aCBhZGRpbmcgc29tZXRoaW5n IGxpa2UgdGhpcyB0byBteSBwcm9wb3NlZCB0ZXh0LCBpZiB0aGVyZSBpcyBjb25zZW5zdXMgdGhh dCBpdCBpcyBicm9hZGx5IHVzZWZ1bC4NCg0KQWxpYXNlcw0KVGhpcyB1c2UgY2FzZSB3YXMgYnJv dWdodCB1cCBpbiB0aGUgY29udGV4dCBvZiBtaWdyYXRpbmcgY2xpZW50cyBmcm9tIGRyYWZ0IGV2 ZW50IG5hbWVzIHRvIHN0YW5kYXJkaXplZCBldmVudCBuYW1lcy4gSW4gdGhpcyBjYXNlLCB0aGUg ZXZlbnQgdHJhbnNtaXR0ZXIgY2FuIHRyYW5zbWl0IHR3byB0b2tlbnMgZm9yIHRoZSBsb2dpY2Fs IGV2ZW50LCBvbmUgdXNpbmcgdGhlIG9sZCBuYW1lIGFuZCBhbm90aGVyIHVzaW5nIHRoZSBuZXcg bmFtZS4NCg0KUmVsYXRlZCBFdmVudHMNClRoZSBTRVQgc3BlYyBkZWZpbmVzIHRoZSB0eG4gY2xh aW0gYXMgYSBtZWFucyBvZiBjb3JyZWxhdGluZyBpbmRlcGVuZGVudCB0b2tlbnMgdGhhdCByZWxh dGUgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC4NCg0KLS0NCkFubmFiZWxsZSBSaWNoYXJkIEJh Y2ttYW4NCkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXMNCg0KX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQt ZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4 QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktl NENfbExJR2smbT1zNWJ5QmU1S0FObkdWdUFiMW1BdXBFR29KbjhYRzVKSVVVd1dHRlNpYkVjJnM9 WDhvUlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZkNGVFWmZneW9JWSZlPQ0KDQo= --_000_47311FA7125E4F1CAF3DEE0DBF35574Bamazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <0BBFE7D5E631A74AA0C9AE9B6EB54B5E@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0K CXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250 LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAz IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNv bG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4u TXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1 cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwg bGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXBy aW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbWFyZ2lu LWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9 DQpzcGFuLmFwcGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5bGUtc3Bh bjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1j b252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCWNvbG9y OnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4w aW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjEN Cgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDAN Cgl7bXNvLWxpc3QtaWQ6OTkyMDI1NDk2Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1s aXN0LXRlbXBsYXRlLWlkczo0NjEwMTA1NzYgLTExMzI0NTI0MzIgNjc2OTg2OTEgNjc2OTg2OTMg Njc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0K QGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0 Oi4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJ bXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToi VGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0Oi43NWlu Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciLHNlcmlm O30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoxLjI1aW47DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJbWFyZ2luLWxlZnQ6MS43NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoyLjI1aW47DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyIsc2VyaWY7fQ0KQGxp c3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIuNzVpbjsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJn aW4tbGVmdDozLjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjMuNzVpbjsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IixzZXJpZjt9DQpAbGlzdCBsMDps ZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6NC4yNWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTQ4NjMxMjE1 MzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE4NTc0 MDc0NjQgLTExMjI3NDgwMTAgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2 OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21z by1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlk aS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciLHNlcmlmO30NCkBs aXN0IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyIsc2VyaWY7fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3IixzZXJpZjt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMg0KCXttc28tbGlzdC1p ZDoxNzUyNjU1MzQ3Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRl LWlkczo3OTE0MjA1NDYgMTM4MDc0ODAwIDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4 NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwyOmxldmVs MQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ bXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDI6bGV2ZWwy DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IixzZXJp Zjt9DQpAbGlzdCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDUNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciLHNlcmlmO30NCkBsaXN0IGwyOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30N CkBsaXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwyOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyIsc2VyaWY7fQ0KQGxpc3QgbDI6bGV2ZWw5DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJv dHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwvaGVh ZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPlJlcGxpZXMgaW5saW5lPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj4tLSZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90Oyxz ZXJpZiI+QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW1hem9uIOKAkyBJZGVudGl0 eSBTZXJ2aWNlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9t OiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Q aGlsIEh1bnQgJmx0O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5N b25kYXksIE9jdG9iZXIgMjMsIDIwMTcgYXQgODo0OCBQTTxicj4NCjxiPlRvOiA8L2I+JnF1b3Q7 UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUmcXVvdDsgJmx0O3JpY2hhbm5hQGFtYXpvbi5jb20m Z3Q7PGJyPg0KPGI+Q2M6IDwvYj5JRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtJZC1ldmVudF0gVXNlIGNhc2Vz IGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5uYWJlbGxlLCA8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZSBhIG51bWJlciBvZiBjb25jZXJucyB3 aXRoIHRoaXMgcHJvcG9zYWwuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlByb2ZpbGluZyBJbmRlcGVuZGVuY2UgLyBLZWVwaW5nIEV2ZW50IFBh eWxvYWRzIEluZGVwZW5kZW50PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5JbmRpY2F0aW5nIHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFuZGxlZCBieSBw cm9maWxlcyBsZWFkcyB0byBtb3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBhbmQgbW9yZSBp bXBvcnRhbnRseSBpbnRydWRlcyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBieSBzdWdnZXN0 aW5nIGEgc3ViLXNjaGVtYSBjcmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBhbmQgY29uZmxp Y3RzIHRoYXQgbWF5IGFkZA0KIHRvIGNvbXBsZXhpdHkgbGF0ZXIgb24uIFRoZSBjdXJyZW50IGZv cm1hdCBhbGxvd3MgYSBwYXJzZXIgdG8gZGlzY292ZXIgYW5kIHVubG9hZCBvbmUgb3IgbW9yZSBK U09OIHBheWxvYWRzIHdoaWNoIGNhbiBlYWNoIGhhdmUgaW5kZXBlbmRlbnQgc3RydWN0dXJlLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 I0MzNDZFMCI+W3JpY2hhbm5hXSBBcyBJIHNhaWQsIEnigJltIGZpbmUgd2l0aCBkZWZpbmluZyBh biBleHRlbnNpb24gbWVjaGFuaXNtIGF0IHRoZSBTRVQgbGV2ZWwsIGlmIHBlb3BsZSB0aGluayBp dCBpcyBuZWNlc3Nhcnk7IEkgZG9u4oCZdCBoYXZlIGEgc3Ryb25nIG9waW5pb24gb25lIHdheSBv ciB0aGUgb3RoZXIsIHNvIEkgcHJlc2VudGVkIHRoZSBzaW1wbGVyIG9wdGlvbiAoc2ltcGxlcg0K IGluIHRlcm1zIG9mIGFtb3VudCBvZiBjb250ZW50IGluIHRoZSBTRVQgc3BlYykuIEkgdGhpbmsg dGhhdCB3b3VsZCBjbGVhciB1cCBhbnkgaW50ZXJvcGVyYWJpbGl0eSBhbmQgcmV1c2FiaWxpdHkg Y29uY2VybnMuIEFkZCBzb21lIHRleHQgdG8gdGhlIHByb3Bvc2VkIGV2ZW50IGNsYWltIGRlZmlu aXRpb24gbGlrZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPlRoZSBvYmpl Y3QgTUFZIGNvbnRhaW4gYW4gJnF1b3Q7ZXh0ZW5zaW9ucyZxdW90OyBtZW1iZXIsIHdoaWNoIGlm IHByZXNlbnQgaXMgYSBKU09OIG9iamVjdCB3aG9zZSBrZXlzIGFyZSBVUklzIGlkZW50aWZ5aW5n IGV2ZW50IGV4dGVuc2lvbnMgZGVmaW5lZCBpbiBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbnMsIGFu ZCB3aG9zZSB2YWx1ZXMgYXJlIEpTT04gb2JqZWN0cyB3aG9zZSBjb250ZW50cw0KIGFyZSBkZWZp bmVkIGluIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9ucy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiNDMzQ2RTAiPknigJltIG5vdCBzdXJlIGhvdyBtYW5kYXRpbmcgb25lIG9yIHR3byBtZW1i ZXJzIG9mIHRoZSBldmVudCBwYXlsb2FkIGlzIGEgbWVhbmluZ2Z1bCBpbnRydXNpb24uIEpXVCBk ZWZpbmVzIDcgc3RhbmRhcmQgY2xhaW1zLCBhbmQgd2Ugc2VlbSB0byBnZXQgYWxvbmcganVzdCBm aW5lIHdpdGggdGhhdC4gWy9yaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+R2VuZXJh bCBleHRlbnNpb25zPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlRoZSBwcm9wb3NhbCBhbHNvIHJ1bGVzIG91dCBnZW5lcmFsIHB1cnBvc2UgZXh0 ZW5zaW9ucyBub3QgcmVsYXRlZCB0byBhbnkgc3BlY2lmaWMgZXZlbnQuIEdpdmVuIHRoZSBlbWVy Z2VuY2Ugb2YgaXRlbXMgbGlrZSBHUFJELCBJIHdvdWxkIG5vdCB3YW50IHRvIGJsb2NrIHRoZSBh YmlsaXR5IHRvIGFkZCBtZXRhLWRhdGEgb3Igb3RoZXIgZ2VuZXJhbCBwdXJwb3NlIGl0ZW1zLiBX ZSBjYW4gYWxzbyBhbnRpY2lwYXRlDQogc29tZSBkZWxpdmVyeSBzY2VuYXJpb3Mgd2hlcmUgYWRk aXRpb25hbCBkYXRhIG1pZ2h0IGJlIHJlcXVpcmVkLiBFdmVuIHRob3VnaCB0aGVyZSBpcyBubyBj dXJyZW50IHBsYW5uZWQgdXNlLCBJIHNlZSBubyBnb29kIHJlYXNvbiB0byBydWxlIHRoaXMgb3V0 LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiNDMzQ2RTAiPltyaWNoYW5uYV0gSSB0aGluayB0aGlzIGlzIGEgZ29vZCBhcmd1bWVudCBmb3Ig ZGVmaW5pbmcgdGhlIGV4dGVuc2lvbiBtZWNoYW5pc20gYXQgdGhlIFNFVCBsZXZlbDsgc2VlIGFi b3ZlLiBbL3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+TXVsdGlwbGUgRXZlbnRzIEZyb20gRGlmZmVyZW50IEZhbWls aWVzICh2cy4gTXVsdGlwbGUgRXZlbnRzIGZyb20gYSBzaW5nbGUgZmFtaWx5IGxpa2UgUklTQyk8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4g b3VyIFJJU0Mgc2Vzc2lvbiB3ZSBkaXNjdXNzZWQgZXhwcmVzc2luZyBtdWx0aXBsZSBkaXN0aW5j dCBSSVNDIGV2ZW50cyBpbiBvbmUgU0VULiBUaGUgZGlzY3Vzc2lvbiB3YXMgdGhhdCBvbmx5IG9u ZSBSSVNDIGV2ZW50IGF0IGEgdGltZS4gV2UgZGlkIG5vdCBkaXNjdXNzIG90aGVyIGV2ZW50IHBy b2ZpbGVzLiBJIGRvbuKAmXQgc2VlIGEgcmVhc29uIHRvIHJ1bGUgb3V0IG11bHRpLWV2ZW50cyBm cm9tIGRpZmZlcmVudA0KIGZhbWlsaWVzIGF0IHRoZSBTRVQgbGV2ZWwuIEVhY2ggcHJvZmlsZSBp cyBleHByZXNzaW5nIHNsaWdodGx5IGRpZmZlcmVudCB0aGluZ3MgYWJvdXQgdGhlIHNhbWUgZXZl bnQuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkkgY2FuIGZvcnNlZSBzb21lIGNhc2VzIHdoZXJlIGl0IGlzIG5vdCBjbGVhciB3aGlj aCBpcyB0aGUgcHJpbWFyeSBhbmQgd2hpY2ggaXMgdGhlIGV4dGVuc2lvbi4gJm5ic3A7VGhlcmUg bWF5IG5vdCBiZSBhIGNsZWFyIHdpbm5lci48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdIEV4YW1wbGU/IFRo aXMgZGVmaWVzIG15IHVuZGVyc3RhbmRpbmcgb2Ygd2hhdCB0aGUgd29yZCDigJxleHRlbnNpb27i gJ0gbWVhbnMuIEl04oCZcyBoYXJkIHRvIGFyZ3VlIHRoYXQgd2UgY2FuIHByb3ZpZGUgYSBzdGFu ZGFyZGl6ZWQgZXh0ZW5zaW9uIG1lY2hhbmlzbSBpZiBldmVudCBleHRlbnNpb25zIGFyZSBpbmRp c3Rpbmd1aXNoYWJsZSBmcm9tIHByaW1hcnkNCiBldmVudHMuIFsvcmljaGFubmFdPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BIGNv dXBsZSBvZiBleGFtcGxlcyAodGhlc2UgYXJlIG5lY2Vzc2FyaWx5IHJlYWzigKZqdXN0IHBvc3Np YmlsaXRpZXMpOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+KiBJdCBpcyBwcm9iYWJseSB1c2VmdWwgdG8gYmUgYWJsZSB0byBleHByZXNzIHNpbWxh ci9vdmVybGFwcGluZyBldmVudHMgZnJvbSBkaWZmZXJlbnQgU0VUIHByb2ZpbGVzIGluIG9uZSBT RVQuICZuYnNwO0ZvciBleGFtcGxlIGEgQmFja2NoYW5uZWwgTG9nb3V0ICZhbXA7IGEgUklTQyBz ZXNzaW9uIGNhbmNlbCBldmVudC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdIFdoeSBpcyBpdCBuZWNlc3Nh cnkgb3IgYXBwcm9wcmlhdGUgdG8gaW5jbHVkZSB0aGVzZSBldmVudHMgaW4gdGhlIHNhbWUgU0VU PyBUaGV5IGFyZSBsaWtlbHkgYmVpbmcgZ2VuZXJhdGVkIGJ5IGRpZmZlcmVudCBzeXN0ZW1zIGF0 IGRpZmZlcmVudCB0aW1lcyBvbiB0aGUgdHJhbnNtaXR0ZXLigJlzIHNpZGUsIGNvbnN1bWVkIGJ5 IGRpZmZlcmVudA0KIHN5c3RlbXMgb24gdGhlIHJlY2VpdmVy4oCZcyBzaWRlLCBhbmQgcG9zc2li bHkgYmVpbmcgdHJhbnNtaXR0ZWQgb3ZlciBkaWZmZXJlbnQgZXZlbnQgc3RyZWFtcy4gSSBrbm93 IHRoZSBsYXR0ZXIgd291bGQgYmUgdGhlIGNhc2UgZm9yIHVzLCBhcyBhIHJlY2VpdmVyLiBFdmVu IGlmIGl04oCZcyBub3QsIGlzIGl0IGJ1cmRlbnNvbWUgdG8gc2VuZCB0aGVzZSBldmVudHMgc2Vw YXJhdGVseT8gV2hhdCB2YWx1ZSBpcyBnYWluZWQgaW4gY29tYmluaW5nIHRoZW0/DQogWy9yaWNo YW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiogU0NJ TSBtYXkgd2FudCB0byByZXByZXNlbnQgYSBzaW5nbGUgdHJhbnNhY3Rpb24gYXMgY2F1c2luZyBt dWx0aXBsZSBzdGF0ZSBjaGFuZ2VzIGluIGFuIGV2ZW50IChlLmcuIGEgcGFzc3dvcmQgY2hhbmdl IGNhdXNlcyBtdWx0aXBsZSBlZmZlY3RzKS4gSGF2aW5nIHRvIGNoYXNlIGRvd24gbXVsdGlwbGUg ZXZlbnRzIGFuZCBjb3JyZWxhdGUgYnkg4oCcdHhu4oCdIHdvdWxkIGJlIGNoYWxsZW5naW5nIGlu IGEgbXVsdGktdGhyZWFkZWQvbXVsdGktbm9kZQ0KIGRlbGl2ZXJ5IHN5c3RlbS4gJm5ic3A7VGhl IFNDSU0gbGlzdCBoYXMgbm90IGRpc2N1c3NlZCB0aGlzLCBidXQgSSB3b3VsZCBub3Qgd2FudCB0 byBibG9jayB0aGlzIGNhcGFiaWxpdHkuICZuYnNwO0lPVyAtIEp1c3QgYmVjYXVzZSBSSVNDIGRv ZXMgbm90IHdhbnQgdG8gZXhwcmVzcyBtdWx0aXBsZSBldmVudHMgZG9lcyBub3QgbWFrZSB0aGlz IHRydWUgZm9yIG90aGVyIHByb2ZpbGVzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPltyaWNoYW5uYV0gWWVzLCB0aGlzIGlz IHByZWNpc2VseSB3aHkgSSByYWlzZWQgdGhlIHF1ZXN0aW9uOiB0byBmaW5kIG91dCBpZiBvdGhl ciBwcm9maWxlcyBoYXZlIGEgdXNlIGNhc2UgZm9yIHRoaXMuIERvZXMgU0NJTSBoYXZlIGFuIGFj dHVhbCB1c2UgY2FzZSwgb3IgYSB0aGVvcmV0aWNhbCBvbmU/IFsvcmljaGFubmFdPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiND MzQ2RTAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiogV2UgbWF5IHdpc2ggdG8gaW5kaWNhdGUgYSBTQ0lNIFBhc3N3b3Jk IFJlc2V0IHdhcyBwZXJmb3JtZWQgYW5kIGEgTG9nb3V0L3Nlc3Npb24gY2FuY2VsbGF0aW9uIGlz IGV4cHJlc3NlZCBhdCB0aGUgc2FtZSB0aW1lLiAmbmJzcDtUaGUgZXZlbnRzIGFyZSByZWxhdGVk IGJ1dCBleHByZXNzIGRpZmZlcmVudCBkYXRhLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPltyaWNo YW5uYV0gQXJlIGEgZ2l2ZW4gdHJhbnNtaXR0ZXIvcmVjZWl2ZXIgcGFpciBndWFyYW50ZWVkIHRv IHVzZSB0aGUgc2FtZSBldmVudCBzdHJlYW0gZm9yIFNDSU0gYW5kIEJhY2tjaGFubmVsIExvZ291 dD8gSSB0aGluayB5b3XigJlyZSBnb2luZyB0byBydW4gaW50byBpbnRlcm9wIHByb2JsZW1zIGlm IHlvdSBtYWtlIHRoYXQgYXNzdW1wdGlvbi4gWy9yaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+QXZvaWRpbmcgQ29uZnVzaW9uIEZyb20gU2ltaWxhciBFdmVudHMgT3JpZ2luYXRpbmcg ZnJvbSB0aGUgU2FtZSBUcmFuc2FjdGlvbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiBldmVudHMgYXJlIHNlbnQgc2VwYXJhdGVseSwgdGhl biBtb3JlIHRyYWNraW5nIG9mIHN0YXRlIChlLmcuIGJ5IHR4bikgd291bGQgYmUgcmVxdWlyZWQg dG8gZW5zdXJlIHNpbWlsYXIgZXZlbnRzIGFyZSBub3QgbWlzdGFrZW4gb3IgaGFuZGxlZCBhcyBy ZXBlYXRzLiBXaGlsZSB0eG4gcHJvdmlkZXMgdXNlZnVsIGF1ZGl0IGFuYWx5c2lzIGNhcGFiaWxp dHksIEnigJltIG5vdCBzdXJlIGl0IGNhbiBiZSB1c2VkDQogaW4gbGl2ZSBvciBuZWFyLXJlYWwg dGltZSBzeXN0ZW1zIGdpdmVuIGRpc3RyaWJ1dGVkIG11bHRpLW5vZGUsIG11bHRpLXRocmVhZGlu ZyBhcmNoaXRlY3R1cmVzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPltyaWNoYW5uYV0gSSBkb27i gJl0IGZvcmVzZWUgdHhuIGNvcnJlbGF0aW9uIGJlaW5nIGFuIGlzc3VlLCBidXQgYWRtaXR0ZWRs eSBJ4oCZdmUgbW9zdGx5IHRob3VnaHQgYWJvdXQgdGhpcyBmcm9tIHRoZSBSSVNDIHBlcnNwZWN0 aXZlLCB3aGVyZSB0aGVyZSBpcyBhIHN0cm9uZyBjb3JyZWxhdGlvbiBiZXR3ZWVuIGV2ZW50IHZv bHVtZSBhbmQgdGVjaG5pY2FsIHNvcGhpc3RpY2F0aW9uDQogb2YgdGhlIHBhcnRpZXMgaW52b2x2 ZWQuIFdoYXQga2luZCBvZiBldmVudCB2b2x1bWUgaXMgZXhwZWN0ZWQgZm9yIFNDSU0/IFdoYXQg a2luZCBvZiBjb25mdXNpb24gYXJlIHlvdSB0aGlua2luZyBvZj8gVW5sZXNzIHlvdeKAmXJlIGdv aW5nIHRvIHNheSB0aGF0IGV2ZW50cyB0aGF0IGFyZSBub3QgdHJhbnNtaXR0ZWQgaW4gdGhlIHNh bWUgU0VUIGFyZSBub3QgcmVsYXRlZCwgdGhlbiByZWNlaXZlcnMgd2lsbCBoYXZlIHRvIGJlIGFi bGUgdG8gY29ycmVsYXRlDQogaW4gcmVhbCB0aW1lIGVpdGhlciB3YXkuIFsvcmljaGFubmFdPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiNDMzQ2RTAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5QcmV2aW91cyBEaXNjdXNzaW9uPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgbm90ZSB0aGF0 IEkgb3JpZ2luYWxseSByYWlzZWQgaGF2aW5nIGFuIGF0dHJpYnV0ZSB0byBkZXNpZ25hdGUgcHJp bWFyeSBldmVudCBhdHRyaWJ1dGUgdG8gYWxsZXZpYXRlIHlvdXIgY29uY2VybiwgYnV0IHRoaXMg d2FzIG5vdCBhY2NlcHRlZC4gU2VlOiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+KiA8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYuaHRtbCI+DQpodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYu aHRtbDwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiombmJzcDs8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2Vi L2lkLWV2ZW50L2N1cnJlbnQvbXNnMDAxNDAuaHRtbCI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bC1hcmNoaXZlL3dlYi9pZC1ldmVudC9jdXJyZW50L21zZzAwMTQwLmh0bWw8L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBjb25zZW5z dXMsIGF0IGxlYXN0IGFzIEkgaW50ZXJwcmV0ZWQgaXQgaXMgdXAgdG8gdGhlIHJlY2VpdmVyIHRv IGZpZ3VyZSB0aGlzIG91dCBiYXNlZCBvbiB0aGUgZGVmaW5pdGlvbnMgaXQgaGFzIGZvciBlYWNo IGV2ZW50IFVSSSBhbmQgdGhlIHByb2ZpbGVzIHRoZXkgcmVwcmVzZW50LiBJT1cgLSBSSVNDIGlz IGZyZWUgdG8gbGltaXQgdGhhdCBvbmx5IG9uZSBSSVNDIGV2ZW50IGJlIGV4cHJlc3NlZCBhdA0K IGEgdGltZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xv dWQgU2VydmljZXMgQXJjaGl0ZWN0PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBl bmRlbnRpZDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0cDovL3d3dy5p bmRlcGVuZGVudGlkLmNvbSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gT2N0IDIzLCAyMDE3LCBhdCA3OjAyIFBNLCBSaWNoYXJkIEJh Y2ttYW4sIEFubmFiZWxsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20i PnJpY2hhbm5hQGFtYXpvbi5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5UaGUgY3Vy cmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMgYWxsb3dzIGZvciBleHByZXNzaW5nIG11bHRpcGxl IGV2ZW50cyB3aXRoaW4gdGhlIHNhbWUgdG9rZW4sIHdoaWNoIGludHJvZHVjZXMgYWRkaXRpb25h bCBjb21wbGV4aXR5IGFuZCByb29tIGZvciBhbWJpZ3VvdXMgc2VtYW50aWNzLiBXZeKAmXZlIGRp c2N1c3NlZCB0aGlzIGluIHRoZSBPSURGIFJJU0Mgd29ya2luZw0KIGdyb3VwIGFuZCB0aGUgY3Vy cmVudCBjb25zZW5zdXMgdGhlcmUgaXMgdGhhdCBSSVNDIHdpbGwgcmVxdWlyZSB0aGF0IFJJU0Mg ZXZlbnRzIG11c3QgYmUgdGhlIG9ubHkgZXZlbnQgaW4gdGhlIFNFVCwgaGF2aW5nIGlkZW50aWZp ZWQgd2F5cyB0byBjbGVhcmx5IGFuZCBlYXNpbHkgc3VwcG9ydCB0aGUgaGFuZGZ1bCBvZiB1c2Ug Y2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgdG9rZW4gdGhhdCBwZW9wbGUgaGF2ZSByYWlz ZWQuIFdpdGggdGhhdA0KIGNvbnRleHQgaW4gbWluZCwgSSBwcm9wb3NlIHN0cmlraW5nIHRoZSBk ZWZpbml0aW9uIG9mIHRoZSDigJxldmVudHPigJ0gY2xhaW0gZnJvbSB0aGUgU2VjdXJpdHkgRXZl bnQgVG9rZW4gc3BlYywgYW5kIHJlcGxhY2luZyBpdCB3aXRoIHRoZSBmb2xsb3dpbmcgZGVmaW5p dGlvbiBmb3IgYW4g4oCcZXZlbnTigJ0gY2xhaW0gKHNpbmd1bGFyKTo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyxzZXJpZiI+ZXZlbnQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxl ZnQ6MS4waW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+ QSBKU09OIG9iamVjdCBjb250YWluaW5nIGFuICZxdW90O2V2ZW50X3R5cGUmcXVvdDsgbWVtYmVy IHdob3NlIHZhbHVlIGlzIGEgVVJJIHJlcHJlc2VudGluZyBhIHR5cGUgb2YgZXZlbnQgZGVmaW5l ZCBpbiBhIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLiBUaGUgb2JqZWN0IE1BWSBvdGhlcndpc2Ug YmUgZW1wdHksDQogb3IgTUFZIGNvbnRhaW4gYWRkaXRpb25hbCBtZW1iZXJzIGFzIGRlc2NyaWJl ZCBieSB0aGUgUHJvZmlsaW5nIFNwZWNpZmljYXRpb24uPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmIj4mbmJzcDs8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5I ZXJlIGlzIHRoZSBleGFtcGxlIFNFVCBmcm9tIHNlY3Rpb24gMi4zLCByZXdyaXR0ZW4gd2l0aCB0 aGlzIGNoYW5nZSBtaW5kOjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+ezwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDssc2VyaWYiPiZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90OzRkMzU1OWVj Njc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4JnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDss c2VyaWYiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTY0MDQsPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyxzZXJpZiI+Jm5ic3A7JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJo dHRwczovL3NjaW0uZXhhbXBsZS5jb20vIj48c3BhbiBzdHlsZT0iY29sb3I6Izk1NEY3MiI+aHR0 cHM6Ly9zY2ltLmV4YW1wbGUuY29tPC9zcGFuPjwvYT4mcXVvdDssPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyxzZXJpZiI+Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWzwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDssc2VyaWYiPiZuYnNwOyAmbmJzcDsmbmJzcDsmcXVvdDs8YSBocmVmPSJodHRwczov L3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCI+PHNwYW4g c3R5bGU9ImNvbG9yOiM5NTRGNzIiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy85OGQ1 MjQ2MWZhNWJiYzg3OTU5M2I3NzU0PC9zcGFuPjwvYT4mcXVvdDssPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyxzZXJpZiI+Jm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ij48c3BhbiBz dHlsZT0iY29sb3I6Izk1NEY3MiI+aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYw NDUxNmIxZDA4NjQxZDc2NzZlZTc8L3NwYW4+PC9hPiZxdW90Ozwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDssc2VyaWYiPiZuYnNwOyBdLDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPiZu YnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPiZuYnNwOyAmcXVvdDtldmVudCZx dW90Ozogezwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDtldmVudF90eXBlJnF1b3Q7OiAmcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVu dDpjcmVhdGUmcXVvdDssPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5i c3A7Jm5ic3A7ICZxdW90O3JlZiZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4 YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkiPjxzcGFuIHN0eWxlPSJj b2xvcjojOTU0RjcyIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZi ZDZhYjYxZTc1MjFkOTwvc3Bhbj48L2E+JnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDss c2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDthdHRyaWJ1dGVzJnF1b3Q7OiBbJnF1b3Q7 aWQmcXVvdDssICZxdW90O25hbWUmcXVvdDssICZxdW90O3VzZXJOYW1lJnF1b3Q7LCAmcXVvdDtw YXNzd29yZCZxdW90OywgJnF1b3Q7ZW1haWxzJnF1b3Q7XTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDssc2VyaWYiPiZuYnNwOyB9PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJpZiI+fTwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hp dGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyxzZXJp ZiI+Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i YmFja2dyb3VuZDp3aGl0ZSI+RG9lcyBhbnlvbmUgaW4gdGhlIHdvcmtpbmcgZ3JvdXAgaGF2ZSB1 c2UgY2FzZXMgZm9yIFNFVHMgdGhhdCBjYW5ub3QgYmUgbWV0IGJ5IHRoaXMgcHJvcG9zZWQgdGV4 dD8gV2l0aGluIFJJU0MsIHdlIGlkZW50aWZpZWQgdGhyZWUgdXNlIGNhc2VzLCB3aXRoIHNvbHV0 aW9ucyBvdXRsaW5lZCBiZWxvdzo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxiPiZuYnNwOzwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxiPkV4dGVuc2lvbnM8L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5F dmVudCBleHRlbnNpb24gbWVjaGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0aGUg ZXZlbnQgb2JqZWN0LiBBIHNpbXBsZSBhcHByb2FjaCB3b3VsZCBiZSB0byAmbmJzcDtkZWZpbmUg YW4g4oCcZXh0ZW5zaW9uc+KAnSBtZW1iZXIgdGhhdCBpcyBhIGxpc3Qgb2YgZXZlbnQgb2JqZWN0 cyAob3Igc2V0IHJlc2VtYmxpbmcgdGhlIOKAnGV2ZW50c+KAnSBjbGFpbSBhcyBkZWZpbmVkDQog aW4gdGhlIGN1cnJlbnQgc3BlYykuIFRoaXMgaGFzIHRoZSBhZHZhbnRhZ2Ugb2YgbWFraW5nIGl0 IGNsZWFyIGluIHRoZSBkYXRhIHN0cnVjdHVyZSB0aGF0IHRoZXJlIGlzIGEgc2luZ2xlIHByaW1h cnkgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lvbnMuIFRoZXJlIGlzIG5vIHJvb20g Zm9yIGNvbmZ1c2lvbiBvdmVyIHdoaWNoIGV2ZW50IGlzIHByaW1hcnksIG9yIGlmIHRoZXJlIGlz IGEgcHJpbWFyeSBldmVudCBhdCBhbGwuIEkgd291bGQNCiBiZSBmaW5lIHdpdGggYWRkaW5nIHNv bWV0aGluZyBsaWtlIHRoaXMgdG8gbXkgcHJvcG9zZWQgdGV4dCwgaWYgdGhlcmUgaXMgY29uc2Vu c3VzIHRoYXQgaXQgaXMgYnJvYWRseSB1c2VmdWwuPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxiPkFsaWFzZXM8L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5U aGlzIHVzZSBjYXNlIHdhcyBicm91Z2h0IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBj bGllbnRzIGZyb20gZHJhZnQgZXZlbnQgbmFtZXMgdG8gc3RhbmRhcmRpemVkIGV2ZW50IG5hbWVz LiBJbiB0aGlzIGNhc2UsIHRoZSBldmVudCB0cmFuc21pdHRlciBjYW4gdHJhbnNtaXQgdHdvIHRv a2VucyBmb3IgdGhlIGxvZ2ljYWwgZXZlbnQsIG9uZSB1c2luZyB0aGUNCiBvbGQgbmFtZSBhbmQg YW5vdGhlciB1c2luZyB0aGUgbmV3IG5hbWUuPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxiPlJlbGF0ZWQgRXZlbnRzPC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0 ZSI+VGhlIFNFVCBzcGVjIGRlZmluZXMgdGhlIHR4biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJl bGF0aW5nIGluZGVwZW5kZW50IHRva2VucyB0aGF0IHJlbGF0ZSB0byB0aGUgc2FtZSBsb2dpY2Fs IGV2ZW50LjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3Vu ZDp3aGl0ZSI+Jm5ic3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWls eTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPi0tJm5ic3A7PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJv bWFuJnF1b3Q7LHNlcmlmIj5Bbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFu JnF1b3Q7LHNlcmlmIj5BbWF6b24g4oCTIElkZW50aXR5IFNlcnZpY2VzPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtiYWNrZ3JvdW5kOndo aXRlIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ SWQtZXZlbnQgbWFpbGluZyBsaXN0PC9zcGFuPjxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86 SWQtZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6Izk1NEY3MjtiYWNrZ3Jv dW5kOndoaXRlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVu dCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kw NTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr JmFtcDttPXM1YnlCZTVLQU5uR1Z1QWIxbUF1cEVHb0puOFhHNUpJVVV3V0dGU2liRWMmYW1wO3M9 WDhvUlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZkNGVFWmZneW9JWSZhbXA7ZT0iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6Izk1NEY3MjtiYWNrZ3JvdW5kOndoaXRlIj5odHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWls bWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VH SnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1zNWJ5QmU1S0FObkdWdUFiMW1BdXBFR29KbjhY RzVKSVVVd1dHRlNpYkVjJmFtcDtzPVg4b1JTcTNJemxGN2ppUkFlWmhYcFIzZVZJMEk1OFpGZDRl RVpmZ3lvSVkmYW1wO2U9PC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzwvc3Bhbj48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_47311FA7125E4F1CAF3DEE0DBF35574Bamazoncom_-- From nobody Fri Oct 27 11:58:40 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3FEB1380DB for ; Fri, 27 Oct 2017 11:58:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.799 X-Spam-Level: X-Spam-Status: No, score=-16.799 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-2.8, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hcB1YLN5B1Vc for ; Fri, 27 Oct 2017 11:58:34 -0700 (PDT) Received: from smtp-fw-9101.amazon.com (smtp-fw-9101.amazon.com [207.171.184.25]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF7DE139432 for ; Fri, 27 Oct 2017 11:58:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1509130714; x=1540666714; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=fJ8DAMz0NH6GsyPrGOa8RqX6xGzcytuFeP69JuPOr78=; b=la9NE8yflDFVtehFHwypArGu2yVWlZvSjY3xNGPugwZsAFBoEG7yqF5C jWr/5/3wkKNxaewxhNouYm+jJqcelz1TZsQrCMAnULHxEkk/OQfk1UfPV yJWaci3BvlERleuoQUVgvdwIJplw2FBaQaOpSTi3gjKOvM5NRKcrTyBa3 A=; X-IronPort-AV: E=Sophos;i="5.44,305,1505779200"; d="scan'208,217";a="714304474" Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-1a-67b371d8.us-east-1.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9101.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 27 Oct 2017 18:57:55 +0000 Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan3.iad.amazon.com [10.40.159.166]) by email-inbound-relay-1a-67b371d8.us-east-1.amazon.com (8.14.7/8.14.7) with ESMTP id v9RIveAu112552 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 27 Oct 2017 18:57:47 GMT Received: from EX13D11UWC001.ant.amazon.com (10.43.162.151) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 27 Oct 2017 18:57:47 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC001.ant.amazon.com (10.43.162.151) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 27 Oct 2017 18:57:46 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Fri, 27 Oct 2017 18:57:46 +0000 From: "Richard Backman, Annabelle" To: Phil Hunt CC: Mike Jones , Brian Campbell , ID Events Mailing List , Marius Scurtescu Thread-Topic: [Id-event] Replacing "nbf" claim with a new "toe" claim Thread-Index: AQHTN9K/qlvLmS09/ky6I+v1p9U3wqLKa5QAgCfcawCAAAvBAIAABJkAgAADI4CAAq3GAIAAK9sAgAAClQCAAACogIAAAQaAgAABe4CAAAp9gIAAAj6AgAABngCAAbazAIAAA3UAgAABBYCAATbtAA== Date: Fri, 27 Oct 2017 18:57:46 +0000 Message-ID: <455EBFAD-6A09-46D4-8340-A1DAD25462E9@amazon.com> References: <872C6059-123B-431C-9C6B-EBAAE3D6A3DA@oracle.com> <94C4A64D-59CF-4508-BE9F-9BE157FD44D7@oracle.com> <63F57E92-7838-489C-AC89-E1BC3D837F37@oracle.com> <7C1DF919-F867-476A-A90D-514BEC14A8CC@oracle.com> <23CF90BA-E01D-4896-B1F6-15AB575FFD37@oracle.com> <5362E4A7-9EAA-49C6-B529-A8326CDD40CC@oracle.com> <867DAEEE-BC23-4459-8EDA-3293B5035FAE@oracle.com> In-Reply-To: <867DAEEE-BC23-4459-8EDA-3293B5035FAE@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.160.192] Content-Type: multipart/alternative; boundary="_000_455EBFAD6A0946D48340A1DAD25462E9amazoncom_" MIME-Version: 1.0 Precedence: Bulk Archived-At: Subject: Re: [Id-event] Replacing "nbf" claim with a new "toe" claim X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 18:58:39 -0000 --_000_455EBFAD6A0946D48340A1DAD25462E9amazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBjYW4gYWNjZXB0IE1pa2XigJlzIG5ldyBwcm9wb3NlZCB0ZXh0Lg0KDQotLQ0KQW5uYWJlbGxl IFJpY2hhcmQgQmFja21hbg0KQW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2aWNlcw0KDQoNCkZyb206 IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgUGhpbCBI dW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCkRhdGU6IFRodXJzZGF5LCBPY3RvYmVyIDI2LCAy MDE3IGF0IDU6MjUgUE0NClRvOiAiUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUiIDxyaWNoYW5u YUBhbWF6b24uY29tPg0KQ2M6IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bT4sIEJyaWFuIENhbXBiZWxsIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4sIElEIEV2ZW50 cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPiwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNj dXJ0ZXNjdUBnb29nbGUuY29tPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gUmVwbGFjaW5nICJu YmYiIGNsYWltIHdpdGggYSBuZXcgInRvZSIgY2xhaW0NCg0KQXBvbG9naWVz4oCmIEkgbWVhbnQg dG8gc2F5LCBNaWtlIHByb3ZpZGVkIHNvbWUgYmV0dGVyIHRleHQgZGVzY3JpYmluZyB0aGUgb3B0 aW9uYWxpdHkuICBUaGF0IHNob3VsZCBiZSBwdWJsaXNoZWQgc2hvcnRseS4NCg0KDQpQaGlsDQoN Ck9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQpA aW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRl bnRpZC5jb20+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20+DQoNCk9uIE9jdCAyNiwgMjAxNywgYXQgNToyMSBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRA b3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCg0KTUFZIGlz IG5vcm1hdGl2ZSBwZXJtc3NpdmUgb3B0aW9uLiAg4oCcbWF54oCdIGlzIHVzZWQgd2hlbiB5b3Ug YXJlIHN0YXRpbmcgYSBmYWN0Lg0KDQpTbyBpbiB0aGlzIGNhc2UsIE1pa2UgaGFzIGNoYW5nZWQg dGhlIHRleHQgdG8gaW5kaWNhdGUgdGhhdCBhIGNsaWVudCAgbWF5IGludGVycHJldCDigJxpYXTi gJ0gYXMgdGhlIHZhbHVlIG9mIOKAnHRvZeKAnSB3aGVuIOKAnHRvZeKAnSBpcyBub3QgYXNzZXJ0 ZWQuICBJdCBpcyBwaHJhc2VkIHRoaXMgd2F5IHNvIHRoYXQgcHJvZmlsaW5nIHNwZWNzIGNhbiBv dmVycmlkZS4NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNl cnZpY2VzIEFyY2hpdGVjdA0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3Lmlu ZGVwZW5kZW50aWQuY29tJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1jSXRlSkI1WmlqTTcwNUx0YWNhX2xHUDR5dVFZYjZnZnNmSTlLV2N6a0lBJnM9SE1pSVFt U011OWxmc2xnS1F0MFlVWXJuVHZWVzNJbnBtaUM4c1BsSE12MCZlPT4NCnBoaWwuaHVudEBvcmFj bGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KT24gT2N0IDI2LCAyMDE3LCBh dCA1OjA4IFBNLCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmFAYW1hem9uLmNv bTxtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbT4+IHdyb3RlOg0KDQpXaGF0IGRvZXMgdGhlIOKA nE1BWeKAnSBpbiB0aGlzIHNlbnRlbmNlIG1lYW4/DQpXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZh bHVlIG9mIOKAnHRvZeKAnSBNQVkgYmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCcaWF0 4oCdLg0KDQpJIGNhbiB0aGluayBvZiBhIGNvdXBsZSB3YXlzIHRvIHJlYWQgdGhpcywgbmVpdGhl ciBvZiB3aGljaCBzZWVtIGFwcHJvcHJpYXRlIGZvciBTRVQ6DQoNCiAgMS4gIFByb2ZpbGluZyBT cGVjaWZpY2F0aW9ucyBjYW4gZGVjbGFyZSB0aGF0IHRoZXNlIGFyZSB0aGUgc2VtYW50aWNzIG9m IGEgbWlzc2luZyDigJx0b2XigJ0gY2xhaW0sIGJ1dCBpZiB0aGUgUHJvZmlsaW5nIFNwZWNpZmlj YXRpb24gZG9lcyBub3QgZG8gc28sIHRoZW4gdGhlIHNlbWFudGljcyBhcmUgc3RpbGwgdW5kZWZp bmVkLg0KDQogICAgICogICBXaHkgd291bGQgdGhpcyBuZWVkIHRvIGJlIHNwZWNpZmllZCBhdCBh bGw/DQoNCiAgMS4gIFVubGVzcyBhIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uIHNheXMgb3RoZXJ3 aXNlLCB0aGVzZSBhcmUgdGhlIHNlbWFudGljcyBvZiBhIG1pc3Npbmcg4oCcdG9l4oCdIGNsYWlt Lg0KDQogICAgICogICBXaGF0IG1ha2VzIHVzIHRoaW5rIHRoYXQgdGhpcyBpcyBhbiBhcHByb3By aWF0ZSBkZWZhdWx0PyBGb3IgbWFueSBSSVNDIGV2ZW50cywgdGhlIHRpbWUgb2YgZXZlbnQgd2ls bCBiZSB1bmtub3duLCBvciBwcm9oaWJpdGl2ZWx5IGV4cGVuc2l2ZSB0byBrbm93LiBBcmUgdGhl IHNlbWFudGljcyBvZiBhIG51bGwg4oCcdG9l4oCdIGNsYWltIGFsbG93ZWQgdG8gYmUgZGlmZmVy ZW50IGZyb20gdGhvc2Ugb2YgYSBtaXNzaW5nIGNsYWltPw0KDQotLQ0KQW5uYWJlbGxlIFJpY2hh cmQgQmFja21hbg0KQW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2aWNlcw0KDQoNCkZyb206IFBoaWwg SHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4N CkRhdGU6IFdlZG5lc2RheSwgT2N0b2JlciAyNSwgMjAxNyBhdCAyOjU5IFBNDQpUbzogTWFyaXVz IFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdvb2ds ZS5jb20+Pg0KQ2M6ICJSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSIgPHJpY2hhbm5hQGFtYXpv bi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+PiwgQnJpYW4gQ2FtcGJlbGwgPGJjYW1w YmVsbEBwaW5naWRlbnRpdHkuY29tPG1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4+ LCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwu Sm9uZXNAbWljcm9zb2Z0LmNvbT4+LCBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBp ZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gUmVwbGFjaW5nICJuYmYiIGNsYWltIHdpdGggYSBuZXcgInRvZSIgY2xhaW0NCg0KT0vigKYu dW5sZXNzIHRoZXJlIGlzIG9iamVjdGlvbiwgSSB3aWxsIHJldmlzZSB0aGUgZHJhZnQgc28gdGhh dCDigJx0b2XigJ0gd2lsbCBiZWNvbWUgYSByZWNvbW1lbmRlZCBhdHRyaWJ1dGUuDQoNClBoaWwN Cg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QN CkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZk PUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1K Qm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09SnFrR0czeGVHUzJW aTkyNHlKSWNPVEFMM3FNZW05RFB3TXFMWkNObnprUSZzPVhPUlJlWVNfTkYtdk5DeDI3RFVrLTV3 QW9EUGU0Y3ZHX25rRWFQWTYtSmsmZT0+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9jdCAyNSwgMjAxNywgYXQgMjo1MiBQTSwgTWFyaXVz IFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1haWx0bzptc2N1cnRlc2N1QGdvb2ds ZS5jb20+PiB3cm90ZToNCg0KT24gV2VkLCBPY3QgMjUsIDIwMTcgYXQgMjo0NCBQTSwgUGhpbCBI dW50IChJRE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20+PiB3cm90ZToNCg0KQXJlIHlvdSBwcm9wb3NpbmcgQSB3aXRoIGEgc2hvdWxkL3JlY29tbWVu ZGVkPw0KDQpZZXMNCg0KDQoNCkl0IGlzIG1vcmUgY29uc2lzdGVudCBidXQgYWRkcyBhIGxvdCBv ZiBkdXBsaWNhdGlvbiBpbiBtYW55IGNhc2VzIHdoZXJlIGlhdCA9IHRvZS4NCg0KSSBkb24ndCB0 aGluayB0aGF0IHNob3VsZCBiZSBhIHByb2JsZW0uDQoNCg0KDQpQaGlsDQoNCk9uIE9jdCAyNSwg MjAxNywgYXQgMjowNyBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29t PG1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCk9uIFdlZCwgT2N0IDI1LCAy MDE3IGF0IDI6MDIgUE0sIFBoaWwgSHVudCAoSURNKSA8cGhpbC5odW50QG9yYWNsZS5jb208bWFp bHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpJZiBhbiBldmVudCBkb2Vzbid0IGhh dmUgYSB0aW1lLCBkaWQgaXQgb2NjdXI/DQoNCkF0IHVuZGlzY2xvc2VkIHRpbWUgYW5kIGxvY2F0 aW9uIDotKQ0KDQpJIHRoaW5rIGl0IGlzIGZpbmUgZm9yICJ0b2UiIHRvIGJlIFNIT1VMRC9SRUNP TU1FTkRFRCwgYnV0IG5vdCBNVVNUL1JFUVVJUkVELg0KDQoNClBoaWwNCg0KT24gT2N0IDI1LCAy MDE3LCBhdCAxOjU4IFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208 bWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KQXMgSSBzYWlkLCBJIHRvdGFs bHkgYWdyZWUgaXQgaXMgdXNlZnVsLiBCdXQgd2h5IHJlcXVpcmVkPw0KDQpNYXJpdXMNCg0KT24g V2VkLCBPY3QgMjUsIDIwMTcgYXQgMTo1NiBQTSwgUGhpbCBIdW50IChJRE0pIDxwaGlsLmh1bnRA b3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3cm90ZToNCkluIHNvbWUg Y2FzZXMsIG9yZGVyaW5nIG9mIGV2ZW50cyBhZ2FpbnN0IGEgc2luZ2xlIHN1YmplY3QgbWF0dGVy cy4gVGltZSBpcyB1c2VmdWwgZm9yIHRoaXMgcHVycG9zZSB0aG91Z2ggbGltaXRlZCBpbiB0aGUg b3ZlcmFsbCBzdHJlYW0gZm9yIG9yZGVyaW5nIGV2ZW50cyBvdmVyYWxsLg0KDQpGb3IgZXhhbXBs ZSBhY2NvdW50IGxvY2tlZCB2cyB1bmxvY2tlZC4gS25vd2luZyB3aGF0IGhhcHBlbmVkIGxhc3Qg d291bGQgc2VlbSBpbXBvcnRhbnQgbm8/DQoNClBoaWwNCg0KT24gT2N0IDI1LCAyMDE3LCBhdCAx OjQ2IFBNLCBNYXJpdXMgU2N1cnRlc2N1IDxtc2N1cnRlc2N1QGdvb2dsZS5jb208bWFpbHRvOm1z Y3VydGVzY3VAZ29vZ2xlLmNvbT4+IHdyb3RlOg0KT24gV2VkLCBPY3QgMjUsIDIwMTcgYXQgMTE6 MDkgQU0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tPj4gd3JvdGU6DQpJdCBpcyBub3QgY2xlYXIgaG93IHRvIHJldmlzZSB0aGUgZG9j dW1lbnQgd2l0aCByZWdhcmRzIHRvIHRoZSBzdWdnZXN0aW9uIGFnYWluc3QgdXNpbmcg4oCcaWF0 4oCdIHdoZW4g4oCcdG9l4oCdIGlzIG5vdCBhc3NlcnRlZC4NCg0KSWYgSSByZW1vdmUgdGhpcyBj bGFyaWZpY2F0aW9uLCBpdCBzZWVtcyB1bmNsZWFyIHdoYXQgdGhlIHRpbWUgb2YgdGhlIGV2ZW50 IGlzIGRlZmluZWQgYXMuICBUaGVyZSBzZWVtIHRvIGJlIHR3byBvcHRpb25zOg0KDQpBLiBJZiDi gJxpYXTigJ0gY2Fu4oCZdCBiZSBhc3N1bWVkIHRvIGJlIHRoZSB0aW1lIG9mIGV2ZW50LCB0aGVu IOKAnHRvZeKAnSBzaG91bGQgYmUgYSByZXF1aXJlZCBjbGFpbS4NCg0KV2h5PyBXaHkgY2FuJ3Qg dGhlIFRyYW5zbWl0dGVyIGFzc2VydCB0aGF0IGFuIGFjY291bnQgd2FzIGRpc2FibGVkIGFuZCBu b3QgcHJvdmlkZSBhIHNwZWNpZmljIGV2ZW50IHRpbWU/IEkgdW5kZXJzdGFuZCB0aGF0IGFuIGV2 ZW50IHRpbWUgaXMgZGVzaXJhYmxlLCBidXQgd2h5IHJlcXVpcmVkPw0KDQoNCg0KQi4gRm9yIHRo ZSBtYWpvcml0eSBvZiB1c2UgY2FzZXMsIOKAnGlhdOKAnSBpcyBjb21tb25seSB1c2VkIHRvIG1h cmsgU0VUIGlzc3VhbmNlIGFuZCBldmVudCB0aW1lLiAg4oCcdG9l4oCdIGlzIG9ubHkgbmVlZGVk IHdoZW4gdGhlIHRpbWUgb2YgdGhlIGV2ZW50IGlzIGRpZmZlcmVudCAob24gYW4gZXhjZXB0aW9u YWwgYmFzaXMpLg0KDQpJZiBTRVQgaXNzdWFuY2UgYW5kIGV2ZW50IHRpbWUgYXJlIGluZGVlZCB0 aGUgc2FtZSB0aGVuIGJvdGggY2xhaW1zIHNob3VsZCBiZSBwcmVzZW50LiBJIGRvbid0IHRoaW5r IGlhdCBzaG91bGQgaW1wbHkgdG9lLg0KDQoNClNvbWUgY2xhcmlmaWNhdGlvbiBmcm9tIHRoZSBn cm91cCB3b3VsZCBiZSBhcHByZWNpYXRlZC4gIFNob3VsZCB3ZSBwcm9jZWVkIHdpdGggQiwgb3Ig cmV2aXNlIHRoZSB0ZXh0IHRvIEEgKG9yIHNvbWUgb3RoZXIgcHJvcG9zYWwpLg0KDQpUaGFua3Ms DQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBB cmNoaXRlY3QNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVu dGlkLmNvbSZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3 U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09bXls N2c0aHBwa1dnZGpOOVRfVHlNM3RROThFZUk2LTF2OHVEU1c1UHFJdyZzPUE5NzYxclBYZkZkZXF6 SjRwUk4tQlFfeDFVU2xNMmJRVFhvQ05lTEZBWkEmZT0+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9jdCAyMywgMjAxNywgYXQgNjoxNSBQ TSwgTWFyaXVzIFNjdXJ0ZXNjdSA8bXNjdXJ0ZXNjdUBnb29nbGUuY29tPG1haWx0bzptc2N1cnRl c2N1QGdvb2dsZS5jb20+PiB3cm90ZToNCg0KT24gTW9uLCBPY3QgMjMsIDIwMTcgYXQgNjowNCBQ TSwgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb208bWFpbHRv OnJpY2hhbm5hQGFtYXpvbi5jb20+PiB3cm90ZToNCkFncmVlZCBvdmVyYWxsLiBIYXZpbmcgcmVy ZWFkIHRoZSBwcm9wb3NlZCB0ZXh0LCBJIHN1Z2dlc3Qgc3RyaWtpbmcgdGhlIGxhc3Qgc2VudGVu Y2UsIOKAnFdoZW4gbm90IGFzc2VydGVkLCB0aGUgdmFsdWUgb2Yg4oCcdG9l4oCdIE1BWSBiZSBh c3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBvZiDigJxpYXTigJ0u4oCdIEkgZG8gbm90IHRoaW5rIGl0 IGlzIG5lY2Vzc2FyeSBvciBwYXJ0aWN1bGFybHkgaGVscGZ1bCB0byBzdGFuZGFyZGl6ZSB0aGUg c2VtYW50aWNzIG9mIGEgbWlzc2luZyB0aW1lLW9mLWV2ZW50IGNsYWltIGF0IHRoZSBTRVQgbGV2 ZWwuDQoNCisxDQoNCg0KDQotLQ0KQW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbg0KQW1hem9uIOKA kyBJZGVudGl0eSBTZXJ2aWNlcw0KDQoNCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2Vz QGlldGYub3JnPG1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPj4gb24gYmVoYWxmIG9m ICJQaGlsIEh1bnQgKElETSkiIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50 QG9yYWNsZS5jb20+Pg0KRGF0ZTogTW9uZGF5LCBPY3RvYmVyIDIzLCAyMDE3IGF0IDU6NDggUE0N ClRvOiBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+DQpDYzogQnJpYW4gQ2FtcGJlbGwgPGJjYW1wYmVsbEBw aW5naWRlbnRpdHkuY29tPG1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbT4+LCBJRCBF dmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0 Zi5vcmc+Pg0KDQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBSZXBsYWNpbmcgIm5iZiIgY2xhaW0g d2l0aCBhIG5ldyAidG9lIiBjbGFpbQ0KDQoNCkFncmVlZCArMSBvbiBCcmlhbidzIGVkaXRzLg0K DQpQaGlsDQoNCk9uIE9jdCAyMywgMjAxNywgYXQgNTowNSBQTSwgTWlrZSBKb25lcyA8TWljaGFl bC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+ PiB3cm90ZToNCkFubmFiZWxsZSBhbmQgSSBhZ3JlZWQgd2l0aCB0aGlzIHByb3Bvc2VkIGNoYW5n ZSAoYXMgY29ycmVjdGx5IHdvcmRzbWl0aGVkIGJ5IEJyaWFuKSBkdXJpbmcgb3VyIGluLXBlcnNv biByZXZpZXcg4oCTIGFzIGFsc28gbm90ZWQgaW4gdGhlIHJlcGx5IHRvIE1hcml1c+KAmSBjb21t ZW50cy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIFRoYW5rcyBQaGlsIGFuZCBhbGwsDQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpG cm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFs ZiBPZiBCcmlhbiBDYW1wYmVsbA0KU2VudDogVGh1cnNkYXksIFNlcHRlbWJlciAyOCwgMjAxNyA4 OjIzIEFNDQpUbzogUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20+Pg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGll dGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50 XSBSZXBsYWNpbmcgIm5iZiIgY2xhaW0gd2l0aCBhIG5ldyAidG9lIiBjbGFpbQ0KDQorMSB0byBT RVQgZGVmaW5pbmcgYSB0aW1lIG9mIGV2ZW50IGNsYWltIHJhdGhlciB0aGFuIHRyeWluZyB0byBy ZWRlZmluZSBhIHN0YW5kYXJkIGNsYWltLiBBbmQgd2hvIGRvZXNuJ3QgbGlrZSBhIGNsYWltIG5h bWVkICJ0b2UiPw0KSG93ZXZlciwgdGhlIHRleHQgdGhlcmUgZm9yIG5iZiBpcyBzdGlsbCBlZmZl Y3RpdmVseSByZWRlZmluaW5nIGl0IGJ5IHNheWluZyBpdCBzaG91bGQgYmUgaWdub3JlZCwgd2hp Y2ggaXNuJ3QgY29uc2lzdGVudCB3aXRoIHRoZSAiTVVTVCBOT1QgYmUgYWNjZXB0ZWQgZm9yIHBy b2Nlc3NpbmciIGZyb20gUkZDIDc1MTkuIEl0IHdvdWxkIGJlIG1vcmUgYXBwcm9wcmlhdGUgdG8g c2F5IHRoYXQgbmJmIHNob3VsZC9tdXN0IG5vdCBiZSBpbmNsdWRlZCBpbiBhIFNFVC4gT3IganVz dCBub3QgbWVudGlvbiBuYmYgYXQgYWxsLiBCdXQgZG9uJ3QgY2hhbmdlIHRoZSBtZWFuaW5nLg0K QWxzbyB0b2Ugd291bGQgbm90IGJlICJEZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjUgW1JGQzc1MTld Iiwgd2hpY2ggaXMgdGhlIG5iZiBzZWN0aW9uLiBUaGUgdmFsdWUgb2YgdGhlIHRvZSBjbGFpbSBp cyBhIE51bWVyaWNEYXRlLCB3aGljaCBpcyBkZWZpbmVkIGluIFNlYyAyIFJGQzc1MTkuIEJ1dCB0 b2UgaGFzIG5vIHJlbGF0aW9uIHRvIG5iZiBhbmQgbm8gcmVhc29uIHRvIHJlZmVyZW5jZSBuYmYu DQoNCk9uIFdlZCwgU2VwIDI3LCAyMDE3IGF0IDI6NTMgUE0sIFBoaWwgSHVudCA8cGhpbC5odW50 QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpEdXJpbmcg dGhlIE9wZW5JRCBSSVNDIEZhY2UgdG8gRmFjZSBtZWV0aW5nIGEgcXVlc3Rpb24gY2FtZSB1cCBy ZWdhcmRpbmcgU0VU4oCZcyByZWRlZmluaXRpb24gb2Yg4oCcbmJm4oCdIGFuZCB3aGV0aGVyIHRo YXQgcmVkZWZpbml0aW9uIHdhcyBhcHByb3ByaWF0ZS4NCg0KVGhlIGludGVudGlvbiBvZiBTRVRz IGRlZmluaXRpb24gaXMgdG8gYWxsb3cgU0VUIFRyYW5zbWl0dGVycyB0byBpbmRpY2F0ZSB0aGF0 IGFuIGV2ZW50IG1heSBoYXZlIG9jY3VycmVkIGFzIGVhcmx5IGFzIGEgc3BlY2lmaWVkIGRhdGUg 4oCUIGEgZGF0ZSB3aGljaCBpcyBkaWZmZXJlbnQgZnJvbSB0aGUgaXNzdWFuY2UgZGF0ZSBvZiB0 aGUgU0VULiBJbiBwYXJ0aWN1bGFyIHRoaXMgaXMgdXNlZnVsIGluIGNhc2VzIHdoZXJlIHRoZSBz dGF0ZSBjaGFuZ2UgaXMgYmVsaWV2ZWQgdG8gaGF2ZSBvY2N1cnJlZCBlYXJsaWVyIHRoYW4gdGhl IHRpbWUgb2YgaXNzdWFuY2UgKGUuZy4gYmVjYXVzZSB0aGUgaW5jaWRlbnQgd2FzIGRpc2NvdmVy ZWQgdGhyb3VnaCBhbiBhZG1pbmlzdHJhdGl2ZSByZXZpZXcgb3IgZGF0YSBhbmFseXNpcyB0byBo YXZlIG9jY3VycmVkIGluIHRoZSBwYXN0KS4NCg0KVGhlIGRlZmluaXRpb24gZnJvbSBKV1QgaXM6 DQo0LjEuNTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzUxOS0yM3NlY3Rpb24tMkQ0LjEuNSZkPUR3TUdh USZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09TmtEbzY5Vl9Gd3lsUmxIT01D QmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25p SGlRaXB4SFppQ0c2MncmZT0+LiAgIm5iZiIgKE5vdCBCZWZvcmUpIENsYWltDQoNCg0KDQoNCg0K ICAgVGhlICJuYmYiIChub3QgYmVmb3JlKSBjbGFpbSBpZGVudGlmaWVzIHRoZSB0aW1lIGJlZm9y ZSB3aGljaCB0aGUgSldUDQoNCiAgIE1VU1QgTk9UIGJlIGFjY2VwdGVkIGZvciBwcm9jZXNzaW5n LiAgVGhlIHByb2Nlc3Npbmcgb2YgdGhlICJuYmYiDQoNCiAgIGNsYWltIHJlcXVpcmVzIHRoYXQg dGhlIGN1cnJlbnQgZGF0ZS90aW1lIE1VU1QgYmUgYWZ0ZXIgb3IgZXF1YWwgdG8NCg0KICAgdGhl IG5vdC1iZWZvcmUgZGF0ZS90aW1lIGxpc3RlZCBpbiB0aGUgIm5iZiIgY2xhaW0uICBJbXBsZW1l bnRlcnMgTUFZDQoNCiAgIHByb3ZpZGUgZm9yIHNvbWUgc21hbGwgbGVld2F5LCB1c3VhbGx5IG5v IG1vcmUgdGhhbiBhIGZldyBtaW51dGVzLCB0bw0KDQogICBhY2NvdW50IGZvciBjbG9jayBza2V3 LiAgSXRzIHZhbHVlIE1VU1QgYmUgYSBudW1iZXIgY29udGFpbmluZyBhDQoNCiAgIE51bWVyaWNE YXRlIHZhbHVlLiAgVXNlIG9mIHRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuDQoNCg0KQXMgZGVmaW5l ZCBpbiBTRVQ6DQoNCiAgIG5iZg0KDQogICAgICBEZWZpbmVkIGJ5IFNlY3Rpb24gNC4xLjUgW1JG Qzc1MTldPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQuMS41JmQ9RHdNR2FR JmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1Oa0RvNjlWX0Z3eWxSbEhPTUNC alVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JnM9MDBzRWl1ZWZ3aFdiWGVSZkprdGpvcU42UkdPbmlI aVFpcHhIWmlDRzYydyZlPT4sIGEgbnVtYmVyIHdob3NlIHZhbHVlIGlzIGENCg0KICAgICAgTnVt ZXJpY0RhdGUuICBJbiB0aGUgY29udGV4dCBvZiB0aGUgU0VUIHRva2VuIGl0IFNIQUxMIGJlDQoN CiAgICAgIGludGVycHJldGVkIHRvIG1lYW4gYSBkYXRlIGluIHdoaWNoIHRoZSBldmVudCBpcyBi ZWxpZXZlZCB0byBoYXZlDQoNCiAgICAgIG9jY3VycmVkIChpbiB0aGUgcGFzdCkgb3Igd2lsbCBv Y2N1ciBpbiB0aGUgZnV0dXJlLiAgTm90ZTogdGhlcmUNCg0KICAgICAgTUFZIGJlIHNvbWUgY2Fz ZXMgd2hlcmUgIm5iZiIgaXMgc3RpbGwgc21hbGxlciB0aGFuICJpYXQiIHN1Y2ggYXMNCg0KICAg ICAgd2hlbiBpdCB0b29rIGFuIGV4dGVuZGVkIHRpbWUgZm9yIGEgU0VUIHRvIGJlIGlzc3VlZCAo Zm9yIGV4YW1wbGUNCg0KICAgICAgYWZ0ZXIgc29tZSBhbmFseXNpcykuICBUaGlzIGNsYWltIGlz IE9QVElPTkFMLg0KDQpUaGVyZSBpcyBhbiBhcmd1bWVudCB0aGF0IHRoZSByZWRlZmluaXRpb24g d2lsbCBjYXVzZSBjb25mdXNpb24uDQoNClRoZSBwcm9wb3NhbCBpcyB0byByZWdpc3RlciBhIGRp ZmZlcmVudCBjbGFpbSBuYW1lIHN1Y2ggYXMg4oCcdG9l4oCdICh0aW1lIG9mIGV2ZW50KS4gVGhl IHByb3Bvc2VkIG5ldw0KZGVmaW5pdGlvbjoNCg0KDQp0b2UNCg0KICAgICAgRGVmaW5lZCBieSBT ZWN0aW9uIDQuMS41IFtSRkM3NTE5XTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3Rvb2xzLmlldGYub3JnX2h0bWxfcmZjNzUxOS0yM3NlY3Rpb24t MkQ0LjEuNSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3 U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09TmtE bzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPTAwc0VpdWVmd2hXYlhl UmZKa3Rqb3FONlJHT25pSGlRaXB4SFppQ0c2MncmZT0+LCBhIG51bWJlciB3aG9zZSB2YWx1ZSBp cyBhDQoNCiAgICAgIE51bWVyaWNEYXRlLiAgVGhlIHZhbHVlIGlzIHRoZSBkYXRlIGFuZCB0aW1l IGluIHdoaWNoIHRoZSBldmVudCBpcyBiZWxpZXZlZCB0byBoYXZlDQoNCiAgICAgIG9jY3VycmVk IGluIHRoZSBwYXN0IG9yIHdpbGwgb2NjdXIgaW4gdGhlIGZ1dHVyZS4gVGhpcyBjbGFpbSBpcyBP UFRJT05BTC4NCg0KICAgICAgV2hlbiBub3QgYXNzZXJ0ZWQsIHRoZSB2YWx1ZSBvZiDigJx0b2Xi gJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhlIHZhbHVlIG9mIOKAnGlhdOKAnS4NCg0KDQoNCm5i Zg0KDQogICAgICBUaGlzIGNsYWltIGlzIG5vdCB1c2VkIGluIFNFVCBFdmVudHMuIElmIGFzc2Vy dGVkLCB0aGUgdmFsdWUgU0hPVUxEDQoNCiAgICAgIGJlIGlnbm9yZWQuDQoNCg0KQXJlIHRoZXJl IGFueSBvYmplY3Rpb25zIHRvIHRoZSBwcm9wb3NlZCBjaGFuZ2U/DQoNClBoaWwNCg0KT3JhY2xl IENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QNCkBpbmRlcGVu ZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZkPUR3TUdhUSZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09TmtEbzY5Vl9Gd3lsUmxIT01DQmpV RUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPTFfWjdPdkF5YXhsZXNDZExOQzVxc2E1WGo5UFpRLUxN YkNhX2htVG8yZU0mZT0+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9y YWNsZS5jb20+DQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklk LWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9p ZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMt M0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed01HYVEmYz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdD SDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPU5rRG82OVZfRnd5bFJsSE9NQ0JqVUVB dnBVakJwWll1Q1ZnSFNpY0g2MXcmcz04QW9vRFdZMUZ3VEczQmoyRUxXcXBUN1hBYVVZQVVUeGc3 OGtkYjBWT044JmU9Pg0KDQoNCkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZW1haWwgbWF5 IGNvbnRhaW4gY29uZmlkZW50aWFsIGFuZCBwcml2aWxlZ2VkIG1hdGVyaWFsIGZvciB0aGUgc29s ZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4gQW55IHJldmlldywgdXNlLCBkaXN0 cmlidXRpb24gb3IgZGlzY2xvc3VyZSBieSBvdGhlcnMgaXMgc3RyaWN0bHkgcHJvaGliaXRlZC4g IElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNl IG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGJ5IGUtbWFpbCBhbmQgZGVsZXRlIHRoZSBt ZXNzYWdlIGFuZCBhbnkgZmlsZSBhdHRhY2htZW50cyBmcm9tIHlvdXIgY29tcHV0ZXIuIFRoYW5r IHlvdS4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09TmtEbzY5Vl9Gd3lsUmxIT01DQmpV RUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZzPThBb29EV1kxRndURzNCajJFTFdxcFQ3WEFhVVlBVVR4 Zzc4a2RiMFZPTjgmZT0NCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5m by9pZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed01GYVEm Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJL dWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVhGYjg1dnVEazBoM1lnZDVxbHg0 aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mcz0tekpMTnNfR19QWE1idHV5QUFvNUtTbnFaYXU0Qkhm Ny1KRmZlN21ZcEJZJmU9Pg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZl bnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVhGYjg1dnVE azBoM1lnZDVxbHg0aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mcz0tekpMTnNfR19QWE1idHV5QUFv NUtTbnFaYXU0QkhmNy1KRmZlN21ZcEJZJmU9DQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRA aWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1teWw3ZzRocHBrV2dkak45VF9UeU0zdFE5OEVlSTYtMXY4dURTVzVQcUl3JnM9N081TjVx Qk5HSzhHTWNhclV3SEV0U2tOZ2ZvZ0Ztdl9xNl9vMHF2OGF4VSZlPQ0KDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19t YWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllS OFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empX d2xOS2U0Q19sTElHayZtPWsxN1hpWGhEY0FTRmlQSWEyazg2OEo3RDh3OFJrTzR3eDByallpOHdO b3cmcz01ZnlsanFPU1ZpUlE5d255TVhVWl9mUTFfbnVhY29oM3h4MzM4RmRhcFNZJmU9DQoNCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBt YWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4N Cmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1D WENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRT ZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09M3hvUm5ZZUFxZ1dScXZqbWgxZkZCSGJGcXdQbzAt UzMxS1lySjBzWks3ZyZzPU9nbjV2V1NKUWIxX3c2XzZ6VWxxOENQUmtlZ2kxeF8zRy1rbmxiWms2 a0UmZT0NCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18N CklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50 QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0Fn JmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1HN2dJMVRUMzdJSHNOVmhUTm04 U1ZrdkZzRDNsWnJNcWprQ0NRUmZsTXFFJnM9ekZJZkljVW5fdFAwMHA2eWMybkxtdXZsTFpLaEFa WHYtckpyNGlLMGQtWSZlPQ0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1h aWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRl dmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JL MTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09Y0l0ZUpC NVppak03MDVMdGFjYV9sR1A0eXVRWWI2Z2ZzZkk5S1djemtJQSZzPWdCTVdDczJHOTEwLWo0TDJC c0szVjJuY0FjM3dqci1UUTA1UHBUbEl6U1kmZT0NCg0K --_000_455EBFAD6A0946D48340A1DAD25462E9amazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <54F39ECB204D1347983467832F204028@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQt ZmFjZQ0KCXtmb250LWZhbWlseToiU2Vnb2UgVUkiO30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KaDQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJ bXNvLXN0eWxlLWxpbms6IkhlYWRpbmcgNCBDaGFyIjsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IixzZXJpZjt9DQpzcGFuLmFw cGxlLXN0eWxlLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtc3R5bGUtc3Bhbjt9DQpzcGFu LmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQt c3BhY2U7fQ0Kc3Bhbi5tMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03 NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UNCgl7bXNvLXN0eWxlLW5hbWU6bTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3 MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVy dGVkLXNwYWNlO30NCnNwYW4uSGVhZGluZzRDaGFyDQoJe21zby1zdHlsZS1uYW1lOiJIZWFkaW5n IDQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk7DQoJbXNvLXN0eWxlLWxpbms6IkhlYWRp bmcgNCI7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkgTGlnaHQiLHNhbnMtc2VyaWY7DQoJY29sb3I6 IzJGNTQ5NjsNCglmb250LXN0eWxlOml0YWxpYzt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFy DQoJe21zby1zdHlsZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUt cHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250 LWZhbWlseToiQ291cmllciIsc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjMNCgl7bXNvLXN0eWxl LXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l Ow0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0K QGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTgyMDYwODgwMzsNCgltc28tbGlzdC10ZW1wbGF0ZS1p ZHM6LTMxNjc5NTAyNjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0Kb2wNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwv aGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxp bms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SSBjYW4gYWNjZXB0IE1pa2XigJlzIG5ldyBwcm9wb3NlZCB0ZXh0LjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj4tLSZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+ QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2 aWNlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRE RiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5JZC1ldmVu dCAmbHQ7aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIFBoaWwgSHVu dCAmbHQ7cGhpbC5odW50QG9yYWNsZS5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlRodXJzZGF5 LCBPY3RvYmVyIDI2LCAyMDE3IGF0IDU6MjUgUE08YnI+DQo8Yj5UbzogPC9iPiZxdW90O1JpY2hh cmQgQmFja21hbiwgQW5uYWJlbGxlJnF1b3Q7ICZsdDtyaWNoYW5uYUBhbWF6b24uY29tJmd0Ozxi cj4NCjxiPkNjOiA8L2I+TWlrZSBKb25lcyAmbHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29t Jmd0OywgQnJpYW4gQ2FtcGJlbGwgJmx0O2JjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tJmd0Oywg SUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7LCBNYXJpdXMg U2N1cnRlc2N1ICZsdDttc2N1cnRlc2N1QGdvb2dsZS5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDog PC9iPlJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAmcXVvdDtuYmYmcXVvdDsgY2xhaW0gd2l0aCBh IG5ldyAmcXVvdDt0b2UmcXVvdDsgY2xhaW08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXBvbG9naWVz4oCmIEkgbWVhbnQgdG8gc2F5LCBNaWtl IHByb3ZpZGVkIHNvbWUgYmV0dGVyIHRleHQgZGVzY3JpYmluZyB0aGUgb3B0aW9uYWxpdHkuICZu YnNwO1RoYXQgc2hvdWxkIGJlIHB1Ymxpc2hlZCBzaG9ydGx5Lg0KPG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3Q8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5k ZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9y YWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIE9jdCAyNiwgMjAxNywgYXQgNToyMSBQTSwgUGhpbCBIdW50ICZsdDs8YSBocmVmPSJtYWls dG86cGhpbC5odW50QG9yYWNsZS5jb20iPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPk1BWSBpcyBub3JtYXRpdmUgcGVybXNzaXZlIG9wdGlvbi4gJm5ic3A74oCcbWF54oCdIGlz IHVzZWQgd2hlbiB5b3UgYXJlIHN0YXRpbmcgYSBmYWN0Ljwvc3Bhbj4NCjxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPlNvIGluIHRoaXMgY2FzZSwgTWlrZSBoYXMgY2hhbmdlZCB0aGUg dGV4dCB0byBpbmRpY2F0ZSB0aGF0IGEgY2xpZW50ICZuYnNwO21heSBpbnRlcnByZXQg4oCcaWF0 4oCdIGFzIHRoZSB2YWx1ZSBvZiDigJx0b2XigJ0gd2hlbiDigJx0b2XigJ0gaXMgbm90IGFzc2Vy dGVkLiAmbmJzcDtJdCBpcyBwaHJhc2VkIHRoaXMgd2F5IHNvIHRoYXQNCiBwcm9maWxpbmcgc3Bl Y3MgY2FuIG92ZXJyaWRlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5P cmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWYiPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3 dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPWNJdGVKQjVaaWpNNzA1THRhY2FfbEdQNHl1UVliNmdm c2ZJOUtXY3prSUEmYW1wO3M9SE1pSVFtU011OWxmc2xnS1F0MFlVWXJuVHZWVzNJbnBtaUM4c1Bs SE12MCZhbXA7ZT0iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+ cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5P biBPY3QgMjYsIDIwMTcsIGF0IDU6MDggUE0sIFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlICZs dDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbSI+cmljaGFubmFAYW1hem9uLmNv bTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3 aGl0ZSI+V2hhdCBkb2VzIHRoZSDigJxNQVnigJ0gaW4gdGhpcyBzZW50ZW5jZSBtZWFuPzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPldoZW4gbm90IGFzc2VydGVk LCB0aGUgdmFsdWUgb2Yg4oCcdG9l4oCdIE1BWSBiZSBhc3N1bWVkIHRvIGJlIHRoZSB2YWx1ZSBv ZiDigJxpYXTigJ0uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDss c2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5JIGNhbiB0aGluayBvZiBh IGNvdXBsZSB3YXlzIHRvIHJlYWQgdGhpcywgbmVpdGhlciBvZiB3aGljaCBzZWVtIGFwcHJvcHJp YXRlIGZvciBTRVQ6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxvbCBzdHlsZT0ibWFyZ2luLXRv cDowaW4iIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwwIGxldmVsMSBsZm8xO2JhY2tncm91bmQ6d2hpdGUi Pg0KUHJvZmlsaW5nIFNwZWNpZmljYXRpb25zIGNhbiBkZWNsYXJlIHRoYXQgdGhlc2UgYXJlIHRo ZSBzZW1hbnRpY3Mgb2YgYSBtaXNzaW5nIOKAnHRvZeKAnSBjbGFpbSwgYnV0IGlmIHRoZSBQcm9m aWxpbmcgU3BlY2lmaWNhdGlvbiBkb2VzIG5vdCBkbyBzbywgdGhlbiB0aGUgc2VtYW50aWNzIGFy ZSBzdGlsbCB1bmRlZmluZWQuDQo8bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxvbCBzdHlsZT0ibWFy Z2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDow aW4iIHN0YXJ0PSIxIiB0eXBlPSJhIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MGluO21zby1saXN0OmwwIGxldmVsMiBsZm8xO2JhY2tncm91bmQ6d2hpdGUiPg0K V2h5IHdvdWxkIHRoaXMgbmVlZCB0byBiZSBzcGVjaWZpZWQgYXQgYWxsPzxvOnA+PC9vOnA+PC9s aT48L29sPg0KPC9vbD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIyIiB0eXBl PSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1s aXN0OmwwIGxldmVsMSBsZm8xO2JhY2tncm91bmQ6d2hpdGUiPg0KVW5sZXNzIGEgUHJvZmlsaW5n IFNwZWNpZmljYXRpb24gc2F5cyBvdGhlcndpc2UsIHRoZXNlIGFyZSB0aGUgc2VtYW50aWNzIG9m IGEgbWlzc2luZyDigJx0b2XigJ0gY2xhaW0uDQo8bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxvbCBz dHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIyIiB0eXBlPSIxIj4NCjxvbCBzdHlsZT0ibWFy Z2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSJhIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MGluO21zby1saXN0OmwwIGxldmVsMiBsZm8yO2JhY2tncm91bmQ6 d2hpdGUiPg0KV2hhdCBtYWtlcyB1cyB0aGluayB0aGF0IHRoaXMgaXMgYW4gYXBwcm9wcmlhdGUg ZGVmYXVsdD8gRm9yIG1hbnkgUklTQyBldmVudHMsIHRoZSB0aW1lIG9mIGV2ZW50IHdpbGwgYmUg dW5rbm93biwgb3IgcHJvaGliaXRpdmVseSBleHBlbnNpdmUgdG8ga25vdy4gQXJlIHRoZSBzZW1h bnRpY3Mgb2YgYSBudWxsIOKAnHRvZeKAnSBjbGFpbSBhbGxvd2VkIHRvIGJlIGRpZmZlcmVudCBm cm9tIHRob3NlIG9mIGEgbWlzc2luZyBjbGFpbT88bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjwvb2w+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPi0tJm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW5uYWJl bGxlIFJpY2hhcmQgQmFja21hbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVv dDssc2VyaWYiPkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXM8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xp ZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48Yj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+RnJvbTo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ UGhpbCBIdW50ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPnBoaWwu aHVudEBvcmFjbGUuY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRlOjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+V2VkbmVzZGF5LCBPY3RvYmVyIDI1LCAy MDE3IGF0IDI6NTkgUE08YnI+DQo8Yj5Ubzo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PC9iPk1hcml1cyBTY3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0 bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvYT4mZ3Q7PGJy Pg0KPGI+Q2M6PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu PjwvYj4mcXVvdDtSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSZxdW90OyAmbHQ7PGEgaHJlZj0i bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iPnJpY2hhbm5hQGFtYXpvbi5jb208L2E+Jmd0Oywg QnJpYW4gQ2FtcGJlbGwgJmx0OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5 LmNvbSI+YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208L2E+Jmd0OywgTWlrZSBKb25lcyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPC9hPiZndDssDQogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEg aHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7 PGJyPg0KPGI+U3ViamVjdDo8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PC9iPlJlOiBbSWQtZXZlbnRdIFJlcGxhY2luZyAmcXVvdDtuYmYmcXVvdDsgY2xh aW0gd2l0aCBhIG5ldyAmcXVvdDt0b2UmcXVvdDsgY2xhaW08L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5P S+KApi51bmxlc3MgdGhlcmUgaXMgb2JqZWN0aW9uLCBJIHdpbGwgcmV2aXNlIHRoZSBkcmFmdCBz byB0aGF0IOKAnHRvZeKAnSB3aWxsIGJlY29tZSBhIHJlY29tbWVuZGVkIGF0dHJpYnV0ZS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5PcmFj bGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01H YVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7 cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPUpxa0dH M3hlR1MyVmk5MjR5SkljT1RBTDNxTWVtOURQd01xTFpDTm56a1EmYW1wO3M9WE9SUmVZU19ORi12 TkN4MjdEVWstNXdBb0RQZTRjdkdfbmtFYVBZNi1KayZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48YSBocmVmPSJtYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBv cmFjbGUuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPk9uIE9jdCAyNSwgMjAxNywgYXQgMjo1MiBQTSwgTWFy aXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1zY3VydGVzY3VAZ29vZ2xlLmNvbSI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+bXNjdXJ0ZXNjdUBnb29nbGUuY29tPC9zcGFuPjwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi Pk9uIFdlZCwgT2N0IDI1LCAyMDE3IGF0IDI6NDQgUE0sIFBoaWwgSHVudCAoSURNKTxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFp bHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdp bi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8xNTQ1NjA5NDM1MTEwNDU2 NDY4QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+QXJlIHlvdSBwcm9wb3Npbmcg QSB3aXRoIGEgc2hvdWxkL3JlY29tbWVuZGVkPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5ZZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxkaXY+DQo8ZGl2IGlkPSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhBcHBsZU1haWxTaWdu YXR1cmUiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8xNTQ1NjA5NDM1MTEwNDU2NDY4QXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0 ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+SXQgaXMgbW9yZSBjb25zaXN0ZW50IGJ1dCBhZGRzIGEgbG90 IG9mIGR1cGxpY2F0aW9uIGluIG1hbnkgY2FzZXMgd2hlcmUgaWF0ID0gdG9lLiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hp dGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JIGRvbid0IHRoaW5rIHRoYXQgc2hvdWxk IGJlIGEgcHJvYmxlbS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxl ZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1s ZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8ZGl2IGlkPSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhBcHBsZU1haWxT aWduYXR1cmUiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpQaGlsPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj48YnI+DQpPbiBPY3QgMjUsIDIwMTcsIGF0IDI6MDcgUE0sIE1hcml1cyBTY3Vy dGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5tc2N1cnRlc2N1QGdvb2dsZS5jb208 L3NwYW4+PC9hPiZndDsgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIFdlZCwgT2N0IDI1LCAy MDE3IGF0IDI6MDIgUE0sIFBoaWwgSHVudCAoSURNKTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5o dW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj5JZiBhbiBldmVudCBkb2Vzbid0IGhhdmUgYSB0aW1lLCBk aWQgaXQgb2NjdXI/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkF0IHVuZGlz Y2xvc2VkIHRpbWUgYW5kIGxvY2F0aW9uIDotKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SSB0aGluayBpdCBpcyBm aW5lIGZvciAmcXVvdDt0b2UmcXVvdDsgdG8gYmUgU0hPVUxEL1JFQ09NTUVOREVELCBidXQgbm90 IE1VU1QvUkVRVUlSRUQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpQaGlsPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48YnI+DQpPbiBPY3QgMjUsIDIwMTcsIGF0IDE6NTggUE0sIE1hcml1cyBT Y3VydGVzY3UgJmx0OzxhIGhyZWY9Im1haWx0bzptc2N1cnRlc2N1QGdvb2dsZS5jb20iIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5tc2N1cnRlc2N1QGdvb2dsZS5j b208L3NwYW4+PC9hPiZndDsgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5BcyBJIHNhaWQsIEkgdG90YWxseSBhZ3JlZSBp dCBpcyB1c2VmdWwuIEJ1dCB3aHkgcmVxdWlyZWQ/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxiciBjbGVhcj0iYWxsIj4NCjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk1h cml1czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj5PbiBXZWQsIE9jdCAyNSwgMjAxNyBhdCAxOjU2IFBNLCBQaGlsIEh1bnQgKElE TSk8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0Ozxh IGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7 PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SW4gc29t ZSBjYXNlcywgb3JkZXJpbmcgb2YgZXZlbnRzIGFnYWluc3QgYSBzaW5nbGUgc3ViamVjdCBtYXR0 ZXJzLiBUaW1lIGlzIHVzZWZ1bCBmb3IgdGhpcyBwdXJwb3NlIHRob3VnaCBsaW1pdGVkIGluIHRo ZSBvdmVyYWxsIHN0cmVhbSBmb3Igb3JkZXJpbmcNCiBldmVudHMgb3ZlcmFsbC4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdiBpZD0ibV8xNTQ1NjA5NDM1 MTEwNDU2NDY4bV80MDM1NDAxODYxMTA4MTczNzM2bV8tNzQzNDA3NTA0NzY4MTc1NTQ0NEFwcGxl TWFpbFNpZ25hdHVyZSI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tn cm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGlkPSJtXzE1NDU2MDk0MzUxMTA0NTY0NjhtXzQwMzU0 MDE4NjExMDgxNzM3MzZtXy03NDM0MDc1MDQ3NjgxNzU1NDQ0QXBwbGVNYWlsU2lnbmF0dXJlIj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+Rm9yIGV4YW1wbGUgYWNjb3VudCBsb2NrZWQgdnMgdW5sb2NrZWQuIEtu b3dpbmcgd2hhdCBoYXBwZW5lZCBsYXN0IHdvdWxkIHNlZW0gaW1wb3J0YW50IG5vPzxicj4NCjxi cj4NClBoaWw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0O2JhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCk9uIE9jdCAyNSwg MjAxNywgYXQgMTo0NiBQTSwgTWFyaXVzIFNjdXJ0ZXNjdSAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1z Y3VydGVzY3VAZ29vZ2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPm1zY3VydGVzY3VAZ29vZ2xlLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+T24gV2VkLCBPY3QgMjUsIDIwMTcgYXQgMTE6MDkgQU0sIFBoaWwgSHVudDxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJl Zj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDs8c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkl0IGlzIG5vdCBjbGVhciBo b3cgdG8gcmV2aXNlIHRoZSBkb2N1bWVudCB3aXRoIHJlZ2FyZHMgdG8gdGhlIHN1Z2dlc3Rpb24g YWdhaW5zdCB1c2luZyDigJxpYXTigJ0gd2hlbiDigJx0b2XigJ0gaXMgbm90IGFzc2VydGVkLiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPklmIEkgcmVtb3ZlIHRoaXMgY2xhcmlmaWNhdGlvbiwgaXQgc2VlbXMgdW5jbGVh ciB3aGF0IHRoZSB0aW1lIG9mIHRoZSBldmVudCBpcyBkZWZpbmVkIGFzLiZuYnNwOyBUaGVyZSBz ZWVtIHRvIGJlIHR3byBvcHRpb25zOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkEuIElmIOKAnGlhdOKAnSBjYW7igJl0IGJlIGFz c3VtZWQgdG8gYmUgdGhlIHRpbWUgb2YgZXZlbnQsIHRoZW4g4oCcdG9l4oCdIHNob3VsZCBiZSBh IHJlcXVpcmVkIGNsYWltLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPldoeT8gV2h5IGNhbid0IHRoZSBUcmFuc21pdHRlciBhc3NlcnQgdGhhdCBhbiBhY2NvdW50 IHdhcyBkaXNhYmxlZCBhbmQgbm90IHByb3ZpZGUgYSBzcGVjaWZpYyBldmVudCB0aW1lPyBJIHVu ZGVyc3RhbmQgdGhhdCBhbiBldmVudCB0aW1lIGlzIGRlc2lyYWJsZSwNCiBidXQgd2h5IHJlcXVp cmVkPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAj Q0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7 bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Qi4gRm9yIHRoZSBt YWpvcml0eSBvZiB1c2UgY2FzZXMsIOKAnGlhdOKAnSBpcyBjb21tb25seSB1c2VkIHRvIG1hcmsg U0VUIGlzc3VhbmNlIGFuZCBldmVudCB0aW1lLiAmbmJzcDvigJx0b2XigJ0gaXMgb25seSBuZWVk ZWQgd2hlbiB0aGUgdGltZSBvZiB0aGUgZXZlbnQgaXMNCiBkaWZmZXJlbnQgKG9uIGFuIGV4Y2Vw dGlvbmFsIGJhc2lzKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij5JZiBTRVQgaXNzdWFuY2UgYW5kIGV2ZW50IHRpbWUgYXJlIGluZGVlZCB0aGUgc2FtZSB0aGVu IGJvdGggY2xhaW1zIHNob3VsZCBiZSBwcmVzZW50LiBJIGRvbid0IHRoaW5rIGlhdCBzaG91bGQg aW1wbHkgdG9lLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+U29tZSBjbGFy aWZpY2F0aW9uIGZyb20gdGhlIGdyb3VwIHdvdWxkIGJlIGFwcHJlY2lhdGVkLiZuYnNwOyBTaG91 bGQgd2UgcHJvY2VlZCB3aXRoIEIsIG9yIHJldmlzZSB0aGUgdGV4dCB0byBBIChvciBzb21lIG90 aGVyIHByb3Bvc2FsKS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91 bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoYW5rcyw8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlBoaWw8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0 ZWN0PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPkBpbmRlcGVuZGVudGlkPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9 RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1t eWw3ZzRocHBrV2dkak45VF9UeU0zdFE5OEVlSTYtMXY4dURTVzVQcUl3JmFtcDtzPUE5NzYxclBY ZkZkZXF6SjRwUk4tQlFfeDFVU2xNMmJRVFhvQ05lTEZBWkEmYW1wO2U9IiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9zcGFu PjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNs ZS5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1 bnRAb3JhY2xlLmNvbTwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+T24gT2N0IDIzLCAyMDE3LCBhdCA2 OjE1IFBNLCBNYXJpdXMgU2N1cnRlc2N1ICZsdDs8YSBocmVmPSJtYWlsdG86bXNjdXJ0ZXNjdUBn b29nbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+bXNj dXJ0ZXNjdUBnb29nbGUuY29tPC9zcGFuPjwvYT4mZ3Q7DQogd3JvdGU6PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJi YWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBNb24sIE9jdCAyMywgMjAxNyBh dCA2OjA0IFBNLCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZTxzcGFuIGNsYXNzPSJtMTU0NTYw OTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1 MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7 PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5yaWNoYW5uYUBhbWF6b24uY29tPC9zcGFuPjwvYT4mZ3Q7 PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZtLTc0 MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4w cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ QWdyZWVkIG92ZXJhbGwuIEhhdmluZyByZXJlYWQgdGhlIHByb3Bvc2VkIHRleHQsIEkgc3VnZ2Vz dCBzdHJpa2luZyB0aGUgbGFzdCBzZW50ZW5jZSwg4oCcV2hlbiBub3QgYXNzZXJ0ZWQsIHRoZSB2 YWx1ZSBvZiDigJx0b2XigJ0gTUFZIGJlIGFzc3VtZWQgdG8gYmUgdGhlIHZhbHVlIG9mIOKAnGlh dOKAnS7igJ0gSSBkbyBub3QgdGhpbmsgaXQgaXMgbmVjZXNzYXJ5IG9yIHBhcnRpY3VsYXJseQ0K IGhlbHBmdWwgdG8gc3RhbmRhcmRpemUgdGhlIHNlbWFudGljcyBvZiBhIG1pc3NpbmcgdGltZS1v Zi1ldmVudCBjbGFpbSBhdCB0aGUgU0VUIGxldmVsLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPiYjNDM7MTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4m cXVvdDssc2VyaWYiPi0tJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyxzZXJpZiI+QW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPkFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXM8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5v bmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAw aW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+RnJvbTo8c3BhbiBjbGFzcz0ibTE1 NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0 NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SWQtZXZlbnQNCiAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9z cGFuPjwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiAmcXVvdDtQaGlsIEh1bnQgKElETSkmcXVvdDsgJmx0 OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4m Z3Q7PGJyPg0KPGI+RGF0ZTo8c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQw MTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPk1vbmRheSwgT2N0b2JlciAyMywg MjAxNyBhdCA1OjQ4IFBNPGJyPg0KPGI+VG86PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2 NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4 MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5NaWtlIEpvbmVz ICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIiB0YXJnZXQ9 Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1 MTEwNDU2NDY4bTQwMzU0MDE4NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEz OTcyMDM4MzcxODE4MGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5Ccmlh biBDYW1wYmVsbCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29t IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+YmNhbXBiZWxsQHBp bmdpZGVudGl0eS5jb208L3NwYW4+PC9hPiZndDssDQogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAm bHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48YnI+DQo8Yj5TdWJqZWN0OjxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1 NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+UmU6IFtJZC1ldmVudF0gUmVw bGFjaW5nICZxdW90O25iZiZxdW90OyBjbGFpbSB3aXRoIGEgbmV3ICZxdW90O3RvZSZxdW90OyBj bGFpbTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+QWdyZWVkICYjNDM7MSBvbiBCcmlhbidzIGVkaXRzLiZuYnNwOzxicj4N Cjxicj4NClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0O2JhY2tncm91bmQ6d2hp dGUiPjxicj4NCk9uIE9jdCAyMywgMjAxNywgYXQgNTowNSBQTSwgTWlrZSBKb25lcyAmbHQ7PGEg aHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwv c3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+QW5uYWJlbGxlIGFuZCBJIGFncmVlZCB3aXRoIHRoaXMgcHJv cG9zZWQgY2hhbmdlIChhcyBjb3JyZWN0bHkgd29yZHNtaXRoZWQgYnkgQnJpYW4pIGR1cmluZyBv dXIgaW4tcGVyc29uIHJldmlldyDigJMgYXMgYWxzbyBub3RlZCBpbiB0aGUgcmVwbHkgdG8gTWFy aXVz4oCZIGNvbW1lbnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8 c3BhbiBjbGFzcz0ibTE1NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQz NDA3NTA0NzY4MTc1NTQ0NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+VGhhbmtzDQogUGhpbCBhbmQgYWxsLDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9Im0xNTQ1NjA5NDM1MTEwNDU2NDY4bTQwMzU0MDE4 NjExMDgxNzM3MzZtLTc0MzQwNzUwNDc2ODE3NTU0NDRtMjUxMTEzOTcyMDM4MzcxODE4MGFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPi0tDQogTWlrZTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPjxiPkZyb206PC9iPjxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1 NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAz ODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5JZC1ldmVudCBbPGEg aHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5tYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9y Zzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYx MTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5Pbg0KIEJlaGFsZiBPZjxzcGFuIGNsYXNz PSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3Njgx NzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48L2I+QnJpYW4gQ2FtcGJlbGw8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0ibTE1 NDU2MDk0MzUxMTA0NTY0NjhtNDAzNTQwMTg2MTEwODE3MzczNm0tNzQzNDA3NTA0NzY4MTc1NTQ0 NG0yNTExMTM5NzIwMzgzNzE4MTgwYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ VGh1cnNkYXksIFNlcHRlbWJlciAyOCwgMjAxNyA4OjIzIEFNPGJyPg0KPGI+VG86PC9iPjxzcGFu IGNsYXNzPSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1 MDQ3NjgxNzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj5QaGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xl LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVu dEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJt MTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3NjgxNzU1 NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5JRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZC1ldmVu dEBpZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNz PSJtMTU0NTYwOTQzNTExMDQ1NjQ2OG00MDM1NDAxODYxMTA4MTczNzM2bS03NDM0MDc1MDQ3Njgx NzU1NDQ0bTI1MTExMzk3MjAzODM3MTgxODBhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj5SZTogW0lkLWV2ZW50XSBSZXBsYWNpbmcgJnF1b3Q7bmJmJnF1b3Q7IGNsYWltIHdpdGgg YSBuZXcgJnF1b3Q7dG9lJnF1b3Q7IGNsYWltPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRlIj4mIzQz OzEgdG8gU0VUIGRlZmluaW5nIGEgdGltZSBvZiBldmVudCBjbGFpbSByYXRoZXIgdGhhbiB0cnlp bmcgdG8gcmVkZWZpbmUgYSBzdGFuZGFyZCBjbGFpbS4gQW5kIHdobyBkb2Vzbid0IGxpa2UgYSBj bGFpbSBuYW1lZCAmcXVvdDt0b2UmcXVvdDs/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndo aXRlIj5Ib3dldmVyLCB0aGUgdGV4dCB0aGVyZSBmb3IgbmJmIGlzIHN0aWxsIGVmZmVjdGl2ZWx5 IHJlZGVmaW5pbmcgaXQgYnkgc2F5aW5nIGl0IHNob3VsZCBiZSBpZ25vcmVkLCB3aGljaCBpc24n dCBjb25zaXN0ZW50IHdpdGggdGhlICZxdW90O01VU1QgTk9UIGJlIGFjY2VwdGVkIGZvciBwcm9j ZXNzaW5nJnF1b3Q7IGZyb20gUkZDIDc1MTkuIEl0IHdvdWxkDQogYmUgbW9yZSBhcHByb3ByaWF0 ZSB0byBzYXkgdGhhdCBuYmYgc2hvdWxkL211c3Qgbm90IGJlIGluY2x1ZGVkIGluIGEgU0VULiBP ciBqdXN0IG5vdCBtZW50aW9uIG5iZiBhdCBhbGwuIEJ1dCBkb24ndCBjaGFuZ2UgdGhlIG1lYW5p bmcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+QWxzbyB0b2Ugd291bGQgbm90IGJlICZxdW90O0RlZmlu ZWQgYnkgU2VjdGlvbiA0LjEuNSBbUkZDNzUxOV0mcXVvdDssIHdoaWNoIGlzIHRoZSBuYmYgc2Vj dGlvbi4gVGhlIHZhbHVlIG9mIHRoZSB0b2UgY2xhaW0gaXMgYSBOdW1lcmljRGF0ZSwgd2hpY2gg aXMgZGVmaW5lZCBpbiBTZWMgMiBSRkM3NTE5LiBCdXQgdG9lIGhhcyBubyByZWxhdGlvbiB0byBu YmYgYW5kIG5vIHJlYXNvbg0KIHRvIHJlZmVyZW5jZSBuYmYuJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPk9u IFdlZCwgU2VwIDI3LCAyMDE3IGF0IDI6NTMgUE0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFp bHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFy Z2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i YmFja2dyb3VuZDp3aGl0ZSI+RHVyaW5nIHRoZSBPcGVuSUQgUklTQyBGYWNlIHRvIEZhY2UgbWVl dGluZyBhIHF1ZXN0aW9uIGNhbWUgdXAgcmVnYXJkaW5nIFNFVOKAmXMgcmVkZWZpbml0aW9uIG9m IOKAnG5iZuKAnSBhbmQgd2hldGhlciB0aGF0IHJlZGVmaW5pdGlvbiB3YXMgYXBwcm9wcmlhdGUu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tn cm91bmQ6d2hpdGUiPlRoZSBpbnRlbnRpb24gb2YgU0VUcyBkZWZpbml0aW9uIGlzIHRvIGFsbG93 IFNFVCBUcmFuc21pdHRlcnMgdG8gaW5kaWNhdGUgdGhhdCBhbiBldmVudCBtYXkgaGF2ZSBvY2N1 cnJlZCBhcyBlYXJseSBhcyBhIHNwZWNpZmllZCBkYXRlIOKAlCBhIGRhdGUgd2hpY2ggaXMgZGlm ZmVyZW50IGZyb20gdGhlIGlzc3VhbmNlIGRhdGUgb2YgdGhlIFNFVC4gSW4gcGFydGljdWxhcg0K IHRoaXMgaXMgdXNlZnVsIGluIGNhc2VzIHdoZXJlIHRoZSBzdGF0ZSBjaGFuZ2UgaXMgYmVsaWV2 ZWQgdG8gaGF2ZSBvY2N1cnJlZCBlYXJsaWVyIHRoYW4gdGhlIHRpbWUgb2YgaXNzdWFuY2UgKGUu Zy4gYmVjYXVzZSB0aGUgaW5jaWRlbnQgd2FzIGRpc2NvdmVyZWQgdGhyb3VnaCBhbiBhZG1pbmlz dHJhdGl2ZSByZXZpZXcgb3IgZGF0YSBhbmFseXNpcyB0byBoYXZlIG9jY3VycmVkIGluIHRoZSBw YXN0KS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5UaGUgZGVmaW5pdGlvbiBmcm9tIEpXVCBpczo8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGg0IHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fdG9vbHMuaWV0Zi5vcmdfaHRtbF9yZmM3NTE5LTIzc2VjdGlvbi0yRDQu MS41JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smYW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7 cz0wMHNFaXVlZndoV2JYZVJmSmt0am9xTjZSR09uaUhpUWlweEhaaUNHNjJ3JmFtcDtlPSIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7LHNlcmlmO2NvbG9yOnB1cnBsZTt0ZXh0LWRlY29yYXRpb246 bm9uZSI+NC4xLjU8L3NwYW4+PC9hPjwvc3Bhbj48YSBuYW1lPSJtXzE1NDU2MDk0MzUxMTA0NTY0 NjhfbV80MDM1NDAxODYxMTA4MTczIj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDssc2VyaWYiPi4mbmJzcDsNCiAmcXVv dDtuYmYmcXVvdDsgKE5vdCBCZWZvcmUpIENsYWltPC9zcGFuPjxvOnA+PC9vOnA+PC9oND4NCjxw cmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl IHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IFRoZSAmcXVvdDtuYmYmcXVvdDsg KG5vdCBiZWZvcmUpIGNsYWltIGlkZW50aWZpZXMgdGhlIHRpbWUgYmVmb3JlIHdoaWNoIHRoZSBK V1Q8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7 Jm5ic3A7IE1VU1QgTk9UIGJlIGFjY2VwdGVkIGZvciBwcm9jZXNzaW5nLiZuYnNwOyBUaGUgcHJv Y2Vzc2luZyBvZiB0aGUgJnF1b3Q7bmJmJnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBjbGFpbSByZXF1aXJlcyB0aGF0IHRo ZSBjdXJyZW50IGRhdGUvdGltZSBNVVNUIGJlIGFmdGVyIG9yIGVxdWFsIHRvPG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyB0aGUgbm90 LWJlZm9yZSBkYXRlL3RpbWUgbGlzdGVkIGluIHRoZSAmcXVvdDtuYmYmcXVvdDsgY2xhaW0uJm5i c3A7IEltcGxlbWVudGVycyBNQVk8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHByb3ZpZGUgZm9yIHNvbWUgc21hbGwgbGVld2F5LCB1 c3VhbGx5IG5vIG1vcmUgdGhhbiBhIGZldyBtaW51dGVzLCB0bzxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgYWNjb3VudCBmb3IgY2xv Y2sgc2tldy4mbmJzcDsgSXRzIHZhbHVlIE1VU1QgYmUgYSBudW1iZXIgY29udGFpbmluZyBhPG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNw OyBOdW1lcmljRGF0ZSB2YWx1ZS4mbmJzcDsgVXNlIG9mIHRoaXMgY2xhaW0gaXMgT1BUSU9OQUwu PG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ QXMgZGVmaW5lZCBpbiBTRVQ6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBuYmY8bzpwPjwvbzpw PjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1sX3JmYzc1MTkt MjNzZWN0aW9uLTJENC4xLjUmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4 UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2 empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNW Z0hTaWNINjF3JmFtcDtzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25pSGlRaXB4SFppQ0c2 MncmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+U2Vj dGlvbiZuYnNwOzQuMS41IFtSRkM3NTE5XTwvc3Bhbj48L2E+LCBhIG51bWJlciB3aG9zZSB2YWx1 ZSBpcyBhPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBOdW1lcmljRGF0ZS4mbmJzcDsgSW4gdGhlIGNv bnRleHQgb2YgdGhlIFNFVCB0b2tlbiBpdCBTSEFMTCBiZTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl IHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg aW50ZXJwcmV0ZWQgdG8gbWVhbiBhIGRhdGUgaW4gd2hpY2ggdGhlIGV2ZW50IGlzIGJlbGlldmVk IHRvIGhhdmU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IG9jY3VycmVkIChpbiB0aGUgcGFzdCkgb3Ig d2lsbCBvY2N1ciBpbiB0aGUgZnV0dXJlLiZuYnNwOyBOb3RlOiB0aGVyZTxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgTUFZIGJlIHNvbWUgY2FzZXMgd2hlcmUgJnF1b3Q7bmJmJnF1b3Q7IGlzIHN0aWxs IHNtYWxsZXIgdGhhbiAmcXVvdDtpYXQmcXVvdDsgc3VjaCBhczxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgd2hlbiBpdCB0b29rIGFuIGV4dGVuZGVkIHRpbWUgZm9yIGEgU0VUIHRvIGJlIGlzc3VlZCAo Zm9yIGV4YW1wbGU8bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0 ZSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGFmdGVyIHNvbWUgYW5hbHlzaXMpLiZu YnNwOyBUaGlzIGNsYWltIGlzIE9QVElPTkFMLjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPlRoZXJlIGlzIGFuIGFy Z3VtZW50IHRoYXQgdGhlIHJlZGVmaW5pdGlvbiB3aWxsIGNhdXNlIGNvbmZ1c2lvbi4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj5UaGUgcHJvcG9zYWwgaXMgdG8gcmVnaXN0ZXIgYSBkaWZmZXJl bnQgY2xhaW0gbmFtZSBzdWNoIGFzIOKAnHRvZeKAnSAodGltZSBvZiBldmVudCkuIFRoZSBwcm9w b3NlZCBuZXc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5kZWZpbml0aW9uOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj50b2U8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IERlZmluZWQgYnkgPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX190b29scy5pZXRmLm9yZ19odG1s X3JmYzc1MTktMjNzZWN0aW9uLTJENC4xLjUmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENn YVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lU U2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZw VWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPTAwc0VpdWVmd2hXYlhlUmZKa3Rqb3FONlJHT25pSGlR aXB4SFppQ0c2MncmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+U2VjdGlvbiZuYnNwOzQuMS41IFtSRkM3NTE5XTwvc3Bhbj48L2E+LCBhIG51bWJlciB3 aG9zZSB2YWx1ZSBpcyBhPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBOdW1lcmljRGF0ZS4mbmJzcDsg VGhlIHZhbHVlIGlzIHRoZSBkYXRlIGFuZCB0aW1lIGluIHdoaWNoIHRoZSBldmVudCBpcyBiZWxp ZXZlZCB0byBoYXZlPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hp dGUiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvY2N1cnJlZCBpbiB0aGUgcGFzdCBv ciB3aWxsIG9jY3VyIGluIHRoZSBmdXR1cmUuIFRoaXMgY2xhaW0gaXMgT1BUSU9OQUwuPG86cD48 L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyBXaGVuIG5vdCBhc3NlcnRlZCwgdGhlIHZhbHVlIG9mIOKAnHRvZeKA nSBNQVkgYmUgYXNzdW1lZCB0byBiZSB0aGUgdmFsdWUgb2Yg4oCcaWF04oCdLjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwv cHJlPg0KPHByZSBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+bmJmPG86cD48L286cD48L3ByZT4N CjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBUaGlzIGNsYWltIGlzIG5vdCB1c2VkIGluIFNFVCBFdmVudHMuIElmIGFzc2VydGVkLCB0 aGUgdmFsdWUgU0hPVUxEPG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBiZSBpZ25vcmVkLjxvOnA+PC9v OnA+PC9wcmU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPkFyZSB0aGVy ZSBhbnkgb2JqZWN0aW9ucyB0byB0aGUgcHJvcG9zZWQgY2hhbmdlPzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5PcmFjbGUgQ29ycG9yYXRp b24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3Vu ZDp3aGl0ZSI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPU5rRG82OVZfRnd5bFJsSE9N Q0JqVUVBdnBVakJwWll1Q1ZnSFNpY0g2MXcmYW1wO3M9MV9aN092QXlheGxlc0NkTE5DNXFzYTVY ajlQWlEtTE1iQ2FfaG1UbzJlTSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0ibWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRl Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRl Ij48YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxi cj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2 ZW50QGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2Uu cHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xp c3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4 UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2 empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNW Z0hTaWNINjF3JmFtcDtzPThBb29EV1kxRndURzNCajJFTFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZP TjgmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvc3Bhbj48L2E+PG86 cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48YnI+DQo8Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtTZWdvZSBVSSZxdW90Oztjb2xvcjojNTU1NTU1O2JvcmRlcjpub25lIHdp bmRvd3RleHQgMS4wcHQ7cGFkZGluZzowaW4iPkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMg ZW1haWwgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIGFuZCBwcml2aWxlZ2VkIG1hdGVyaWFsIGZv ciB0aGUgc29sZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4gQW55IHJldmlldywN CiB1c2UsIGRpc3RyaWJ1dGlvbiBvciBkaXNjbG9zdXJlIGJ5IG90aGVycyBpcyBzdHJpY3RseSBw cm9oaWJpdGVkLiZuYnNwOyBJZiB5b3UgaGF2ZSByZWNlaXZlZCB0aGlzIGNvbW11bmljYXRpb24g aW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBieSBlLW1haWwg YW5kIGRlbGV0ZSB0aGUgbWVzc2FnZSBhbmQgYW55IGZpbGUgYXR0YWNobWVudHMgZnJvbSB5b3Vy IGNvbXB1dGVyLiBUaGFuayB5b3UuPC9zcGFuPjwvaT48L2I+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxh IGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBo cmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFt cDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJt NWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1Oa0RvNjlWX0Z3 eWxSbEhPTUNCalVFQXZwVWpCcFpZdUNWZ0hTaWNINjF3JmFtcDtzPThBb29EV1kxRndURzNCajJF TFdxcFQ3WEFhVVlBVVR4Zzc4a2RiMFZPTjgmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50 JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm YW1wO209TmtEbzY5Vl9Gd3lsUmxIT01DQmpVRUF2cFVqQnBaWXVDVmdIU2ljSDYxdyZhbXA7cz04 QW9vRFdZMUZ3VEczQmoyRUxXcXBUN1hBYVVZQVVUeGc3OGtkYjBWT044JmFtcDtlPTwvc3Bhbj48 L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWJvdHRvbToxMi4wcHQ7YmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJy Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5JZC1ldmVudEBp ZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5m b19pZC0yRGV2ZW50JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hC S0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3ds TktlNENfbExJR2smYW1wO209WEZiODV2dURrMGgzWWdkNXFseDRpdVI3TFI3ZXZWX0JVMGZMTDA1 ZFhCTSZhbXA7cz0tekpMTnNfR19QWE1idHV5QUFvNUtTbnFaYXU0QkhmNy1KRmZlN21ZcEJZJmFt cDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L3NwYW4+PC9hPjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJy Pg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+SWQtZXZl bnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3Vu ZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBR Y3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpq V3dsTktlNENfbExJR2smYW1wO209WEZiODV2dURrMGgzWWdkNXFseDRpdVI3TFI3ZXZWX0JVMGZM TDA1ZFhCTSZhbXA7cz0tekpMTnNfR19QWE1idHV5QUFvNUtTbnFaYXU0QkhmNy1KRmZlN21ZcEJZ JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVhGYjg1dnVEazBoM1lnZDVxbHg0 aXVSN0xSN2V2Vl9CVTBmTEwwNWRYQk0mYW1wO3M9LXpKTE5zX0dfUFhNYnR1eUFBbzVLU25xWmF1 NEJIZjctSkZmZTdtWXBCWSZhbXA7ZT08L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5JZC1ldmVu dEBpZXRmLm9yZzwvc3Bhbj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3Rp bmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFj eEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empX d2xOS2U0Q19sTElHayZhbXA7bT1teWw3ZzRocHBrV2dkak45VF9UeU0zdFE5OEVlSTYtMXY4dURT VzVQcUl3JmFtcDtzPTdPNU41cUJOR0s4R01jYXJVd0hFdFNrTmdmb2dGbXZfcTZfbzBxdjhheFUm YW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5v cmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVt Q1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gw RmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209bXlsN2c0aHBwa1dnZGpOOVRfVHlN M3RROThFZUk2LTF2OHVEU1c1UHFJdyZhbXA7cz03TzVONXFCTkdLOEdNY2FyVXdIRXRTa05nZm9n Rm12X3E2X28wcXY4YXhVJmFtcDtlPTwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRv OklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdf bWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209azE3WGlYaERjQVNGaVBJYTJrODY4SjdE OHc4UmtPNHd4MHJqWWk4d05vdyZhbXA7cz01ZnlsanFPU1ZpUlE5d255TVhVWl9mUTFfbnVhY29o M3h4MzM4RmRhcFNZJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcm YW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1K Qm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPWsxN1hpWGhE Y0FTRmlQSWEyazg2OEo3RDh3OFJrTzR3eDByallpOHdOb3cmYW1wO3M9NWZ5bGpxT1NWaVJROXdu eU1YVVpfZlExX251YWNvaDN4eDMzOEZkYXBTWSZhbXA7ZT08L3NwYW4+PC9hPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3 aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3 SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFt cDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209M3hv Um5ZZUFxZ1dScXZqbWgxZkZCSGJGcXdQbzAtUzMxS1lySjBzWks3ZyZhbXA7cz1PZ241dldTSlFi MV93Nl82elVscThDUFJrZWdpMXhfM0cta25sYlprNmtFJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJmFtcDttPTN4b1JuWWVBcWdXUnF2am1oMWZGQkhiRnF3UG8wLVMzMUtZckowc1pLN2cm YW1wO3M9T2duNXZXU0pRYjFfdzZfNnpVbHE4Q1BSa2VnaTF4XzNHLWtubGJaazZrRSZhbXA7ZT08 L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2 ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxi cj4NCjwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQm YW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3 U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZh bXA7bT1HN2dJMVRUMzdJSHNOVmhUTm04U1ZrdkZzRDNsWnJNcWprQ0NRUmZsTXFFJmFtcDtzPXpG SWZJY1VuX3RQMDBwNnljMm5MbXV2bExaS2hBWlh2LXJKcjRpSzBkLVkmYW1wO2U9Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2 ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smYW1wO209RzdnSTFUVDM3SUhzTlZoVE5tOFNWa3ZGc0QzbFpyTXFqa0NDUVJmbE1xRSZhbXA7 cz16RklmSWNVbl90UDAwcDZ5YzJuTG11dmxMWktoQVpYdi1ySnI0aUswZC1ZJmFtcDtlPTwvc3Bh bj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJt YWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjwvc3Bh bj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJ Q0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1w O3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1jSXRl SkI1WmlqTTcwNUx0YWNhX2xHUDR5dVFZYjZnZnNmSTlLV2N6a0lBJmFtcDtzPWdCTVdDczJHOTEw LWo0TDJCc0szVjJuY0FjM3dqci1UUTA1UHBUbEl6U1kmYW1wO2U9Ij48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3 dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJp UnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1jSXRlSkI1WmlqTTcw NUx0YWNhX2xHUDR5dVFZYjZnZnNmSTlLV2N6a0lBJmFtcDtzPWdCTVdDczJHOTEwLWo0TDJCc0sz VjJuY0FjM3dqci1UUTA1UHBUbEl6U1kmYW1wO2U9PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRt bD4NCg== --_000_455EBFAD6A0946D48340A1DAD25462E9amazoncom_-- From nobody Sun Oct 29 11:28:57 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 884E313F5C6 for ; Sun, 29 Oct 2017 11:28:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eQJbNfgpHZIt for ; Sun, 29 Oct 2017 11:28:53 -0700 (PDT) Received: from mail-wr0-x22d.google.com (mail-wr0-x22d.google.com [IPv6:2a00:1450:400c:c0c::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52EC5138A38 for ; Sun, 29 Oct 2017 11:28:53 -0700 (PDT) Received: by mail-wr0-x22d.google.com with SMTP id l8so10428133wre.12 for ; Sun, 29 Oct 2017 11:28:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=6U4jwhTw5+ckoe4PuwV1kdVo/h3FCn9Adg/TiY7rAqc=; b=SP3gluXchNqxijP3M7R86smIqQGmpYk86yTCOcFA5rMzvcLxOjcDCr3r2DaEt4gQN1 GKA3v696S7qZLh+c/kgOXtQnCo+ucBIg0aStZQHSWVddiYUCQUmRn7s1AQTMxep5d/tG 2Z6GVOQ62aKN62tGqV99tfoAo+KVMJqGwN89OeoKJX6SIrlsC7ij71tloYm8qKygwSjU WddDbua6tH4F410TaMt6pJg3uQkklX6EmaHfWU3cjc2RdUhGUNyW/c98FOwoddAut8ww ka/Bj3dmq/bMYgcgmPpx1KTqTPnM6JH5SDZKYsTj79pKNoVIdjq408QQT2oayYE8An4S RQzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=6U4jwhTw5+ckoe4PuwV1kdVo/h3FCn9Adg/TiY7rAqc=; b=hNGpA/flHFecb2TJw7pKKzGFP+e+qnAjklz1KjgkCuxmi5tonxGm7Vi3knaWju46V/ 6C9mcZfi+Fl6DEt7dIotbFGwXPPvmaNiSbEOyvNY4zZZqtuDy7oTWRrtABwJqw64KA7j YAeV+JkJPeVkuW2vjd8sNOxLOrRd9pqzQXF7qfAxO4n0KvNw5J6VXFWsy1O+shhsZxK5 9DjjrrjVHSoYjiBt1YMsKAdg2WEMmiIdEQGRY9tEK+VwjwOkqSdFzLyGktSWAZnWWr74 5kjWwrlDYW3aXw81RLYq7lrqDz08d9aleGLVT082zw1cU0QQVzquQE1f5kX+5Jqxwx0b RGlQ== X-Gm-Message-State: AMCzsaWifBEipvtUpadAGuQFa+mLxABjMFMOyzH9Z1T9dT6qymEaItPP q6/DphD287VTw5bz/dRP8kBu7D7O X-Google-Smtp-Source: ABhQp+Q8wVzC38lZzXAkVyOih73XkkPTAa6iXXk+QEK7YXOQmE7TSsrs1GHoDl+3uBENG3LFVw6h0w== X-Received: by 10.223.198.130 with SMTP id j2mr5768290wrg.52.1509301731480; Sun, 29 Oct 2017 11:28:51 -0700 (PDT) Received: from [172.18.129.55] (bzq-202-11.red.bezeqint.net. [212.179.202.11]) by smtp.gmail.com with ESMTPSA id u52sm18681795wrb.68.2017.10.29.11.28.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 29 Oct 2017 11:28:50 -0700 (PDT) To: Mike Jones , Phil Hunt , "Richard Backman, Annabelle" Cc: ID Events Mailing List References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> From: Yaron Sheffer Message-ID: Date: Sun, 29 Oct 2017 20:28:48 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2017 18:28:56 -0000 In that case, let's add text to that effect, e.g. we could add to the definition of the "events" claim: Profiling specifications SHOULD define the allowed event statements, and MAY restrict their number. For example, some profiles may require this claim to contain only a single event statement. Thanks, Yaron On 24/10/17 22:10, Mike Jones wrote: > I agree with much of Phil’s rationale here. > > It’s fine for some profiles to say that the “events” set must be a > singleton.  That doesn’t have to be true for all events.  I think things > are fine as-is. > >                                                                 -- Mike > > *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt > *Sent:* Monday, October 23, 2017 8:47 PM > *To:* Richard Backman, Annabelle > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > Annabelle, > > I have a number of concerns with this proposal. > > Profiling Independence / Keeping Event Payloads Independent > > Indicating that extensions should be handled by profiles leads to more > inter-operability issues and more importantly intrudes on the Event > payload space by suggesting a sub-schema creates potential limitations > and conflicts that may add to complexity later on. The current format > allows a parser to discover and unload one or more JSON payloads which > can each have independent structure. > > General extensions > > The proposal also rules out general purpose extensions not related to > any specific event. Given the emergence of items like GPRD, I would not > want to block the ability to add meta-data or other general purpose > items. We can also anticipate some delivery scenarios where additional > data might be required. Even though there is no current planned use, I > see no good reason to rule this out. > > Multiple Events From Different Families (vs. Multiple Events from a > single family like RISC) > > In our RISC session we discussed expressing multiple distinct RISC > events in one SET. The discussion was that only one RISC event at a > time. We did not discuss other event profiles. I don’t see a reason to > rule out multi-events from different families at the SET level. Each > profile is expressing slightly different things about the same event. > > I can forsee some cases where it is not clear which is the primary and > which is the extension.  There may not be a clear winner. > > A couple of examples (these are necessarily real…just possibilities): > > * It is probably useful to be able to express simlar/overlapping events > from different SET profiles in one SET.  For example a Backchannel > Logout & a RISC session cancel event. > > * SCIM may want to represent a single transaction as causing multiple > state changes in an event (e.g. a password change causes multiple > effects). Having to chase down multiple events and correlate by “txn” > would be challenging in a multi-threaded/multi-node delivery system. >  The SCIM list has not discussed this, but I would not want to block > this capability.  IOW - Just because RISC does not want to express > multiple events does not make this true for other profiles. > > * We may wish to indicate a SCIM Password Reset was performed and a > Logout/session cancellation is expressed at the same time.  The events > are related but express different data. > > Avoiding Confusion From Similar Events Originating from the Same Transaction > > If events are sent separately, then more tracking of state (e.g. by txn) > would be required to ensure similar events are not mistaken or handled > as repeats. While txn provides useful audit analysis capability, I’m not > sure it can be used in live or near-real time systems given distributed > multi-node, multi-threading architectures. > > Previous Discussion > > I note that I originally raised having an attribute to designate primary > event attribute to alleviate your concern, but this was not accepted. See: > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html > > The consensus, at least as I interpreted it is up to the receiver to > figure this out based on the definitions it has for each event URI and > the profiles they represent. IOW - RISC is free to limit that only one > RISC event be expressed at a time. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > phil.hunt@oracle.com > > On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle > > wrote: > > The current draft of the SET spec allows for expressing multiple > events within the same token, which introduces additional complexity > and room for ambiguous semantics. We’ve discussed this in the OIDF > RISC working group and the current consensus there is that RISC will > require that RISC events must be the only event in the SET, having > identified ways to clearly and easily support the handful of use > cases for multiple events per token that people have raised. With > that context in mind, I propose striking the definition of the > “events” claim from the Security Event Token spec, and replacing it > with the following definition for an “event” claim (singular): > > event > > A JSON object containing an "event_type" member whose value is a URI > representing a type of event defined in a Profiling Specification. > The object MAY otherwise be empty, or MAY contain additional members > as described by the Profiling Specification. > > Here is the example SET from section 2.3, rewritten with this change > mind: > > { > >   "jti": "4d3559ec67504aaba65d40b0363faad8", > >   "iat": 1458496404, > >  "iss": "https://scim.example.com ", > >   "aud": [ > >     "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", > >     "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" > >   ], > >   "event": { > >     "event_type": "urn:ietf:params:scim:event:create", > >     "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9", > >     "attributes": ["id", "name", "userName", "password", "emails"] > >   } > > } > > Does anyone in the working group have use cases for SETs that cannot > be met by this proposed text? Within RISC, we identified three use > cases, with solutions outlined below: > > ** > > *Extensions* > > Event extension mechanisms can be defined internal to the event > object. A simple approach would be to  define an “extensions” member > that is a list of event objects (or set resembling the “events” > claim as defined in the current spec). This has the advantage of > making it clear in the data structure that there is a single primary > event, with zero or more extensions. There is no room for confusion > over which event is primary, or if there is a primary event at all. > I would be fine with adding something like this to my proposed text, > if there is consensus that it is broadly useful. > > *Aliases* > > This use case was brought up in the context of migrating clients > from draft event names to standardized event names. In this case, > the event transmitter can transmit two tokens for the logical event, > one using the old name and another using the new name. > > *Related Events* > > The SET spec defines the txn claim as a means of correlating > independent tokens that relate to the same logical event. > > -- > > Annabelle Richard Backman > > Amazon – Identity Services > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=s5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=X8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e= > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > From nobody Sun Oct 29 11:42:00 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C9E213FA29 for ; Sun, 29 Oct 2017 11:41:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pQjlTI7M98lN for ; Sun, 29 Oct 2017 11:41:58 -0700 (PDT) Received: from mail-wr0-x236.google.com (mail-wr0-x236.google.com [IPv6:2a00:1450:400c:c0c::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25C7513F8A7 for ; Sun, 29 Oct 2017 11:41:57 -0700 (PDT) Received: by mail-wr0-x236.google.com with SMTP id y9so10460092wrb.2 for ; Sun, 29 Oct 2017 11:41:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding:content-language; bh=gim7QglZMrAZWy8ynAbgG9Msu6G1c5qw43nF2y1G0WY=; b=t+dXbLc1aPX49BnTGJJD5rwIOLDeEnV25l/FSpL1X6aNS8nk9KM/x2IBCqgEo6QaQA addixgFf2ndDKfhtJ7prwdrbfwa5MrvOIvLPWP8BrCvXMRdSLe3yXJjZj8mJafOLKqq2 q3i/nXNEOeRUdM1Sae08w43wzngKgx/KRQ3Moqbufbc44acI/FPgQjXtrsDn6dUn8E2f hYySUaA8bulIpM8LxckjMtnM9lBEy0HBwTVh7c71av5NVRt1hNqOkH8YjL0kBAI7DJIL f7fYqhJUjm52Jc2GCJZnpprXsSS+U00IIBiz4wBkhEhTslIOA6aA8crUN+ytVtoFnmDs OeyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding:content-language; bh=gim7QglZMrAZWy8ynAbgG9Msu6G1c5qw43nF2y1G0WY=; b=uDmNGM4xEWv59HOV9ZeQ1K6gzP7dUUSIzl6ybk2woGV72yQW+fM3Y+DToMWrFplhrv e2hqiXKDh0pluAXY3kOmP4Eq+kDeiVcxy4SeoIofPEtO2MK8z75zVMPkoZeAF26AAQKo 4oviXe8footBK2ntxubOctjYD+84Y+e5c41Ar+9a0cr/S0Fc37dI6Zqk9yyoTHVNDH78 aDBJttKegjgJAkriFNQ5mAYwxdp9zRl9RRBgFVdarupNtLEpPS/aCnCQlbENOJyXdsjK R3Djp6sW5z1Ok40FULITdKn6kYyQvs0KkLY08NYN9BCwVDN90zCu++Xxc7Lny9HwlS41 HF1g== X-Gm-Message-State: AMCzsaUZLlOUo9oiCM4OYYR1PZGYf9PZLqu3hSCeB7o2BJ8ABApDdWS7 FdIGLKJKg1b4/p+J027xHLMDJ0Kw X-Google-Smtp-Source: ABhQp+RVqyNV9mwsxBdcQfx6Kq/cO8j2c+i/4pI8+ivWJV0HYYNMK0RAnEcsbvzmn7V24X7wpuYFdg== X-Received: by 10.223.189.13 with SMTP id j13mr5868115wrh.94.1509302515314; Sun, 29 Oct 2017 11:41:55 -0700 (PDT) Received: from [172.18.129.55] (bzq-202-11.red.bezeqint.net. [212.179.202.11]) by smtp.gmail.com with ESMTPSA id g65sm7548357wme.0.2017.10.29.11.41.54 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 29 Oct 2017 11:41:54 -0700 (PDT) To: SecEvent From: Yaron Sheffer Message-ID: Date: Sun, 29 Oct 2017 20:41:50 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: [Id-event] draft-ietf-secevent-token-03.txt nits X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2017 18:41:59 -0000 Hi Phil, you may have fixed these ones already... * Typo: "in and related specifications." (probably an xml2rfc-related bug) * "toe" is defined as "Numeric Data", should be "NumericDate". Thanks,     Yaron From nobody Sun Oct 29 12:53:11 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30CD513FB7F for ; Sun, 29 Oct 2017 12:53:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7 X-Spam-Level: X-Spam-Status: No, score=-7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ew30tQPa6BMk for ; Sun, 29 Oct 2017 12:53:07 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89B8813FB71 for ; Sun, 29 Oct 2017 12:53:07 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9TJr5hJ011182 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 29 Oct 2017 19:53:06 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9TJr5MX031624 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 29 Oct 2017 19:53:05 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9TJr42n004989; Sun, 29 Oct 2017 19:53:04 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 29 Oct 2017 12:53:04 -0700 From: Phil Hunt Message-Id: <21C0C7EA-2238-4F62-BF74-DE71C085002C@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_700EBB07-E9E0-4231-9DB5-C6610567D6D9" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Sun, 29 Oct 2017 12:53:01 -0700 In-Reply-To: Cc: SecEvent To: Yaron Sheffer References: X-Mailer: Apple Mail (2.3273) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] draft-ietf-secevent-token-03.txt nits X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2017 19:53:09 -0000 --Apple-Mail=_700EBB07-E9E0-4231-9DB5-C6610567D6D9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Found the issue and posted in github. It will be in the 04 update (post = Singapore?) Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 29, 2017, at 11:41 AM, Yaron Sheffer = wrote: >=20 > Hi Phil, you may have fixed these ones already... >=20 > * Typo: "in and related specifications." (probably an xml2rfc-related = bug) > * "toe" is defined as "Numeric Data", should be "NumericDate". >=20 > Thanks, > Yaron >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D2wUqkhv_lSq56B_= NM1cTEXFH4fdo4EDfbo7BhNfGWVw&s=3D1R2SjfhhSoL9VGKhRIT3Bjx13c8IYleULUUTMpspY= 5g&e=3D --Apple-Mail=_700EBB07-E9E0-4231-9DB5-C6610567D6D9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Found the issue and posted in github. It will be in the 04 = update (post Singapore?)


Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 29, 2017, at 11:41 AM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

Hi = Phil, you may have fixed these ones already...

* Typo: "in and related specifications." (probably an = xml2rfc-related bug)
* "toe" is defined as "Numeric Data", = should be "NumericDate".

Thanks,
    Yaron

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwIGaQ&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3D2wUqkhv_lSq56B_NM1cTEXFH4fdo4EDfbo7BhNfGWVw&s=3D1R2SjfhhSo= L9VGKhRIT3Bjx13c8IYleULUUTMpspY5g&e=3D

= --Apple-Mail=_700EBB07-E9E0-4231-9DB5-C6610567D6D9-- From nobody Sun Oct 29 13:16:05 2017 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 868EF13FBD4; Sun, 29 Oct 2017 13:15:59 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.63.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150930815951.11174.11101611329465136855@ietfa.amsl.com> Date: Sun, 29 Oct 2017 13:15:59 -0700 Archived-At: Subject: [Id-event] I-D Action: draft-ietf-secevent-delivery-01.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2017 20:16:00 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Events WG of the IETF. Title : SET Token Delivery Using HTTP Authors : Phil Hunt Marius Scurtescu Morteza Ansari Anthony Nadalin Annabelle Richard Backman Filename : draft-ietf-secevent-delivery-01.txt Pages : 26 Date : 2017-10-29 Abstract: This specification defines how a series of security event tokens (SETs) may be delivered to a previously registered receiver using HTTP POST over TLS initiated as a push to the receiver, or as a poll by the receiver. The specification also defines how delivery can be assured subject to the SET Token Receiver's need for assurance. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-secevent-delivery-01 https://datatracker.ietf.org/doc/html/draft-ietf-secevent-delivery-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-delivery-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Oct 29 13:18:12 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F3C713FBEA for ; Sun, 29 Oct 2017 13:18:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CYJsLOP5qlDl for ; Sun, 29 Oct 2017 13:18:07 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 514B613FBE0 for ; Sun, 29 Oct 2017 13:18:07 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9TKI6Ka021172 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Sun, 29 Oct 2017 20:18:06 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9TKI6Hc019701 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Sun, 29 Oct 2017 20:18:06 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9TKI5xf011945 for ; Sun, 29 Oct 2017 20:18:05 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 29 Oct 2017 13:18:05 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_F7D94F85-102C-4F48-B801-36C0974FFD4D" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Sun, 29 Oct 2017 13:18:01 -0700 References: <150930815951.11174.11101611329465136855@ietfa.amsl.com> To: ID Events Mailing List In-Reply-To: <150930815951.11174.11101611329465136855@ietfa.amsl.com> Message-Id: X-Mailer: Apple Mail (2.3273) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] I-D Action: draft-ietf-secevent-delivery-01.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2017 20:18:09 -0000 --Apple-Mail=_F7D94F85-102C-4F48-B801-36C0974FFD4D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Per the discussion at IETF99, the Verification Section (2.5) has been = removed. =20 Verification is now part of the Control Plane specification proposals. Regards, Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 29, 2017, at 1:15 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Security Events WG of the IETF. >=20 > Title : SET Token Delivery Using HTTP > Authors : Phil Hunt > Marius Scurtescu > Morteza Ansari > Anthony Nadalin > Annabelle Richard Backman > Filename : draft-ietf-secevent-delivery-01.txt > Pages : 26 > Date : 2017-10-29 >=20 > Abstract: > This specification defines how a series of security event tokens > (SETs) may be delivered to a previously registered receiver using > HTTP POST over TLS initiated as a push to the receiver, or as a poll > by the receiver. The specification also defines how delivery can be > assured subject to the SET Token Receiver's need for assurance. >=20 >=20 > The IETF datatracker status page for this draft is: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_draft-2Dietf-2Dsecevent-2Ddelivery_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA= &m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&s=3DstiBoHXdveUhl4g2mv6jg= b5WvjMxDTzwnBjvagiKtgw&e=3D >=20 > There are also htmlized versions available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ietf.org_html= _draft-2Dietf-2Dsecevent-2Ddelivery-2D01&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&= m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&s=3DGlGb37G2Ge85nOxmT2-vL9= ULxZ8ltaShWS2NyauiLRI&e=3D > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatracker.ietf.or= g_doc_html_draft-2Dietf-2Dsecevent-2Ddelivery-2D01&d=3DDwICAg&c=3DRoP1YumC= XCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1a= LcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&s=3D_s3zFv4wQ5T_= e4zfvsZpf3eRyI4ccwVag6S9JPKetHs&e=3D >=20 > A diff from the previous version is available at: > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_rfcdif= f-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Ddelivery-2D01&d=3DDwICAg&c=3DRoP1YumC= XCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1a= LcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&s=3DoS5S8IoCN-72= m6y8pIMeH-YAQaPpCA3JmrAX0o4nL08&e=3D >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > = https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.org_internet= -2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D= na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHF= FGYP1j219eiK5TK2w&s=3DDl2FSne8pueaEPSLFtY9IAz89LInQyHCB7UqB4M1UNg&e=3D >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DvrSZYLpxHK7IdZY= GXfbjWMydHFFGYP1j219eiK5TK2w&s=3DYb8Lv1YQcQtFEsQbCby-jReZ3c8rtOSbITX_qS7Q7= 5o&e=3D --Apple-Mail=_F7D94F85-102C-4F48-B801-36C0974FFD4D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Per the discussion at IETF99, the Verification Section (2.5) = has been removed.  

Verification is now part of the Control Plane specification = proposals.

Regards,

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 29, 2017, at 1:15 PM, internet-drafts@ietf.org wrote:


A New Internet-Draft is available from the on-line = Internet-Drafts directories.
This draft is a work item of = the Security Events WG of the IETF.

=        Title =           : SET Token = Delivery Using HTTP
=        Authors =         : Phil Hunt
= =             &n= bsp;           &nbs= p;Marius Scurtescu
=             &n= bsp;           &nbs= p;Morteza Ansari
=             &n= bsp;           &nbs= p;Anthony Nadalin
=             &n= bsp;           &nbs= p;Annabelle Richard Backman
Filename =        : = draft-ietf-secevent-delivery-01.txt
Pages =           : 26
= Date =            : = 2017-10-29

Abstract:
=   This specification defines how a series of security event = tokens
  (SETs) may be delivered to a = previously registered receiver using
  HTTP = POST over TLS initiated as a push to the receiver, or as a poll
  by the receiver.  The specification also = defines how delivery can be
  assured subject = to the SET Token Receiver's need for assurance.


The IETF datatracker status page for this = draft is:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Ddelivery_&d=3DDwICAg&c=3D= RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4Dpcty= XPpuYqPkAI1aLcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&= amp;s=3DstiBoHXdveUhl4g2mv6jgb5WvjMxDTzwnBjvagiKtgw&e=3D

There are also htmlized versions available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__tools.ie= tf.org_html_draft-2Dietf-2Dsecevent-2Ddelivery-2D01&d=3DDwICAg&c=3D= RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4Dpcty= XPpuYqPkAI1aLcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&= amp;s=3DGlGb37G2Ge85nOxmT2-vL9ULxZ8ltaShWS2NyauiLRI&e=3D
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__datatrac= ker.ietf.org_doc_html_draft-2Dietf-2Dsecevent-2Ddelivery-2D01&d=3DDwIC= Ag&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWma= nqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j2= 19eiK5TK2w&s=3D_s3zFv4wQ5T_e4zfvsZpf3eRyI4ccwVag6S9JPKetHs&e=3D
A diff from the previous version is available = at:
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dsecevent-2Ddelivery-2D01&d=3DDwIC= Ag&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWma= nqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j2= 19eiK5TK2w&s=3DoS5S8IoCN-72m6y8pIMeH-YAQaPpCA3JmrAX0o4nL08&e=3D

Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=3Dftp-3A__ftp.ietf.o= rg_internet-2Ddrafts_&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qI= rMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3D= vrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&s=3DDl2FSne8pueaEPSLFtY9IA= z89LInQyHCB7UqB4M1UNg&e=3D

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DvrSZYLpxHK7IdZYGXfbjWMydHFFGYP1j219eiK5TK2w&s=3DYb8Lv1YQcQ= tFEsQbCby-jReZ3c8rtOSbITX_qS7Q75o&e=3D

= --Apple-Mail=_F7D94F85-102C-4F48-B801-36C0974FFD4D-- From nobody Sun Oct 29 16:13:07 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5C9F13FC7D for ; Sun, 29 Oct 2017 16:13:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.739 X-Spam-Level: X-Spam-Status: No, score=-1.739 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2QOpNNaGnnIs for ; Sun, 29 Oct 2017 16:13:03 -0700 (PDT) Received: from mail-pf0-x22f.google.com (mail-pf0-x22f.google.com [IPv6:2607:f8b0:400e:c00::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 445BD13FC7B for ; Sun, 29 Oct 2017 16:13:03 -0700 (PDT) Received: by mail-pf0-x22f.google.com with SMTP id d28so9409875pfe.2 for ; Sun, 29 Oct 2017 16:13:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=So3AhRhz5+mlY5VBtlP5dBZcATIYN+M2zrSwcuDEdM0=; b=XvER2qSyRC+8/NOp3DQN3YK1yPQyveesxt5hqEWyOcecpjHDmA1h7bw4r3qTsc7yJs TVDpkd+r8i0ITMI3mRJBEaviZCZX/+05KjOH2YHP2b/Yn6nLX28rRgyp3hKBAIGgEtbB AY5+KapeOsjGyC/Bn8wbku1WZ2V8OkFLxQ9rAxNpazXRrTfzO5ueZntbGlrhbhRrrkr7 5CEGjBaFS/uJbxK83hS8phLokH6vk1VXYz+BVwzykJUgYVp5U6vlXvmxT1XCDXOsXG0s j3lAfyLzCoHqw0GhHmcDEPKDc/jmzSR0sLVCPtewRkVUuI0f2RC1gg0CxwEYcSDDJOUD +bng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=So3AhRhz5+mlY5VBtlP5dBZcATIYN+M2zrSwcuDEdM0=; b=Zgc87XFvCSImVbBvPmSRU+hlm5LSj4vCurNP5ojxueUVgFZSgSgnNNkYFoPmYN5ii0 8dVxDBrhcFvut+DGi9DM0g0ImHHemxDO61JQ9eRzG5fb0XxWvW7p4UM1P26NUcJao4+H 2shWqwO3B+dKxyot6DwSJKg0dcm8dIA2hU0wucEQUD5+bPoOGwIm0oV75yX8RQ26tLtz 1qU9bPRndb84uv++HKtltWVZgk+oh3EWH5vUOYZxRGrEOEMnW3c444JIcMrxuGqRGEj9 /lMxWDmoNdT1AA947hWnZYtdoSIINr7gN7zFT6N8+TLt77TOqgCEq++vW/j7OmWG5yfY cWxQ== X-Gm-Message-State: AMCzsaUdeH2pqHWuggdk7mM0pVsEaDNgATwEtUMo9JupJ+2yEJiY5WjP UUQqLvrbrL8ueYR7YOhxZxyohAHIndv0iF40qNQ= X-Google-Smtp-Source: ABhQp+TnVefuoCRoI2njPR0AHdC+RHhx+KdU+WFH3CoNbVTKWIxyLr0zyAon+/C9PWM4ij7gIF6FszBgaVztyfCaxGM= X-Received: by 10.101.83.201 with SMTP id z9mr6164805pgr.425.1509318782641; Sun, 29 Oct 2017 16:13:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Sun, 29 Oct 2017 16:12:42 -0700 (PDT) In-Reply-To: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> From: Dick Hardt Date: Sun, 29 Oct 2017 16:12:42 -0700 Message-ID: To: Yaron Sheffer Cc: Mike Jones , Phil Hunt , "Richard Backman, Annabelle" , ID Events Mailing List Content-Type: multipart/alternative; boundary="089e0824b1cce46ce7055cb7a9e4" Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Oct 2017 23:13:06 -0000 --089e0824b1cce46ce7055cb7a9e4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Phil: In your examples for having a plurality of events, you use the word "may", which leads me to question if a plurality of events is really required in SET. You posit that it will be difficult for a distributed system to correlate multiple SETs with the same "txn", but the distributed system will certainly need to correlate events on the same subject -- correlating events on the same "txn" on the same subject seems fairly simple. I think that a receiver will need to correlate multiple SEts on the same subject, so having multiple events in a SET is redundant, and adds complexity with no clear benefit that I can see. An implementor may choose to send multiple SETs, or send a single SET with multiple events, so a receiver will need to support both. I prefer we pick one way and minimize the code paths, and we will need to support correlating across multiple SETs, so that seems the best mechanism. Let me know if there is something I missed in my logic. /Dick On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer wrote: > In that case, let's add text to that effect, e.g. we could add to the > definition of the "events" claim: > > Profiling specifications SHOULD define the allowed event statements, and > MAY restrict their number. For example, some profiles may require this > claim to contain only a single event statement. > > Thanks, > Yaron > > On 24/10/17 22:10, Mike Jones wrote: > >> I agree with much of Phil=E2=80=99s rationale here. >> >> It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2= =80=9D set must be a >> singleton. That doesn=E2=80=99t have to be true for all events. I thin= k things >> are fine as-is. >> >> -- Mike >> >> *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil >> Hunt >> *Sent:* Monday, October 23, 2017 8:47 PM >> *To:* Richard Backman, Annabelle >> *Cc:* ID Events Mailing List >> *Subject:* Re: [Id-event] Use cases for multiple events per SET? >> >> Annabelle, >> >> I have a number of concerns with this proposal. >> >> Profiling Independence / Keeping Event Payloads Independent >> >> Indicating that extensions should be handled by profiles leads to more >> inter-operability issues and more importantly intrudes on the Event payl= oad >> space by suggesting a sub-schema creates potential limitations and >> conflicts that may add to complexity later on. The current format allows= a >> parser to discover and unload one or more JSON payloads which can each h= ave >> independent structure. >> >> General extensions >> >> The proposal also rules out general purpose extensions not related to an= y >> specific event. Given the emergence of items like GPRD, I would not want= to >> block the ability to add meta-data or other general purpose items. We ca= n >> also anticipate some delivery scenarios where additional data might be >> required. Even though there is no current planned use, I see no good rea= son >> to rule this out. >> >> Multiple Events From Different Families (vs. Multiple Events from a >> single family like RISC) >> >> In our RISC session we discussed expressing multiple distinct RISC event= s >> in one SET. The discussion was that only one RISC event at a time. We di= d >> not discuss other event profiles. I don=E2=80=99t see a reason to rule o= ut >> multi-events from different families at the SET level. Each profile is >> expressing slightly different things about the same event. >> >> I can forsee some cases where it is not clear which is the primary and >> which is the extension. There may not be a clear winner. >> >> A couple of examples (these are necessarily real=E2=80=A6just possibilit= ies): >> >> * It is probably useful to be able to express simlar/overlapping events >> from different SET profiles in one SET. For example a Backchannel Logou= t & >> a RISC session cancel event. >> >> * SCIM may want to represent a single transaction as causing multiple >> state changes in an event (e.g. a password change causes multiple effect= s). >> Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80= =9D would be >> challenging in a multi-threaded/multi-node delivery system. The SCIM l= ist >> has not discussed this, but I would not want to block this capability. = IOW >> - Just because RISC does not want to express multiple events does not ma= ke >> this true for other profiles. >> >> * We may wish to indicate a SCIM Password Reset was performed and a >> Logout/session cancellation is expressed at the same time. The events a= re >> related but express different data. >> >> Avoiding Confusion From Similar Events Originating from the Same >> Transaction >> >> If events are sent separately, then more tracking of state (e.g. by txn) >> would be required to ensure similar events are not mistaken or handled a= s >> repeats. While txn provides useful audit analysis capability, I=E2=80=99= m not sure >> it can be used in live or near-real time systems given distributed >> multi-node, multi-threading architectures. >> >> Previous Discussion >> >> I note that I originally raised having an attribute to designate primary >> event attribute to alleviate your concern, but this was not accepted. Se= e: >> >> * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html >> >> * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html >> >> The consensus, at least as I interpreted it is up to the receiver to >> figure this out based on the definitions it has for each event URI and t= he >> profiles they represent. IOW - RISC is free to limit that only one RISC >> event be expressed at a time. >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> >> @independentid >> >> www.independentid.com >> >> phil.hunt@oracle.com >> >> On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle >> > wrote: >> >> The current draft of the SET spec allows for expressing multiple >> events within the same token, which introduces additional complexity >> and room for ambiguous semantics. We=E2=80=99ve discussed this in th= e OIDF >> RISC working group and the current consensus there is that RISC will >> require that RISC events must be the only event in the SET, having >> identified ways to clearly and easily support the handful of use >> cases for multiple events per token that people have raised. With >> that context in mind, I propose striking the definition of the >> =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, a= nd replacing it >> with the following definition for an =E2=80=9Cevent=E2=80=9D claim (= singular): >> >> event >> >> A JSON object containing an "event_type" member whose value is a URI >> representing a type of event defined in a Profiling Specification. >> The object MAY otherwise be empty, or MAY contain additional members >> as described by the Profiling Specification. >> >> Here is the example SET from section 2.3, rewritten with this change >> mind: >> >> { >> >> "jti": "4d3559ec67504aaba65d40b0363faad8", >> >> "iat": 1458496404, >> >> "iss": "https://scim.example.com ", >> >> "aud": [ >> >> "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", >> >> "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" >> >> ], >> >> "event": { >> >> "event_type": "urn:ietf:params:scim:event:create", >> >> "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d= 9 >> ", >> >> "attributes": ["id", "name", "userName", "password", "emails"] >> >> } >> >> } >> >> Does anyone in the working group have use cases for SETs that cannot >> be met by this proposed text? Within RISC, we identified three use >> cases, with solutions outlined below: >> >> ** >> >> *Extensions* >> >> Event extension mechanisms can be defined internal to the event >> object. A simple approach would be to define an =E2=80=9Cextensions= =E2=80=9D member >> that is a list of event objects (or set resembling the =E2=80=9Ceven= ts=E2=80=9D >> claim as defined in the current spec). This has the advantage of >> making it clear in the data structure that there is a single primary >> event, with zero or more extensions. There is no room for confusion >> over which event is primary, or if there is a primary event at all. >> I would be fine with adding something like this to my proposed text, >> if there is consensus that it is broadly useful. >> >> *Aliases* >> >> This use case was brought up in the context of migrating clients >> from draft event names to standardized event names. In this case, >> the event transmitter can transmit two tokens for the logical event, >> one using the old name and another using the new name. >> >> *Related Events* >> >> The SET spec defines the txn claim as a means of correlating >> independent tokens that relate to the same logical event. >> >> -- >> Annabelle Richard Backman >> >> Amazon =E2=80=93 Identity Services >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibE >> c&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --089e0824b1cce46ce7055cb7a9e4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Phil:

In your examples for having a plu= rality of events, you use the word "may", which leads me to quest= ion if a plurality of events is really required in SET.

You posit that it will be difficult for a distributed system to corre= late multiple SETs with the same "txn", but the distributed syste= m will certainly need to correlate events on the same subject -- correlatin= g events on the same "txn" on the same subject seems fairly simpl= e.

I think that a receiver will need to correlate = multiple SEts on the same subject, so having multiple events in a SET is re= dundant, and adds complexity with no clear benefit that I can see.

An implementor may choose to send multiple SETs, or send a= single SET with multiple events, so a receiver will need to support both. = I prefer we pick one way and minimize the code paths, and we will need to s= upport correlating across multiple SETs, so that seems the best mechanism.<= /div>

Let me know if there is something I missed in my l= ogic.

/Dick


On Sun, Oct 29, 2017 at 11:= 28 AM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">In that case, let's add text to that effe= ct, e.g. we could add to the definition of the "events" claim:
Profiling specifications SHOULD define the allowed event statements, and MA= Y restrict their number. For example, some profiles may require this claim = to contain only a single event statement.

Thanks,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Yaron

On 24/10/17 22:10, Mike Jones wrote:
I agree with much of Phil=E2=80=99s rationale here.

It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a singleton.=C2=A0 That doesn=E2=80=99t have to be true for= all events.=C2=A0 I think things are fine as-is.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 -- Mike

*From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt *Sent:* Monday, October 23, 2017 8:47 PM
*To:* Richard Backman, Annabelle <richanna@amazon.com>
*Cc:* ID Events Mailing List <id-event@ietf.org>
*Subject:* Re: [Id-event] Use cases for multiple events per SET?

Annabelle,

I have a number of concerns with this proposal.

Profiling Independence / Keeping Event Payloads Independent

Indicating that extensions should be handled by profiles leads to more inte= r-operability issues and more importantly intrudes on the Event payload spa= ce by suggesting a sub-schema creates potential limitations and conflicts t= hat may add to complexity later on. The current format allows a parser to d= iscover and unload one or more JSON payloads which can each have independen= t structure.

General extensions

The proposal also rules out general purpose extensions not related to any s= pecific event. Given the emergence of items like GPRD, I would not want to = block the ability to add meta-data or other general purpose items. We can a= lso anticipate some delivery scenarios where additional data might be requi= red. Even though there is no current planned use, I see no good reason to r= ule this out.

Multiple Events From Different Families (vs. Multiple Events from a single = family like RISC)

In our RISC session we discussed expressing multiple distinct RISC events i= n one SET. The discussion was that only one RISC event at a time. We did no= t discuss other event profiles. I don=E2=80=99t see a reason to rule out mu= lti-events from different families at the SET level. Each profile is expres= sing slightly different things about the same event.

I can forsee some cases where it is not clear which is the primary and whic= h is the extension.=C2=A0 There may not be a clear winner.

A couple of examples (these are necessarily real=E2=80=A6just possibilities= ):

* It is probably useful to be able to express simlar/overlapping events fro= m different SET profiles in one SET.=C2=A0 For example a Backchannel Logout= & a RISC session cancel event.

* SCIM may want to represent a single transaction as causing multiple state= changes in an event (e.g. a password change causes multiple effects). Havi= ng to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80=9D wou= ld be challenging in a multi-threaded/multi-node delivery system.=C2=A0 =C2= =A0The SCIM list has not discussed this, but I would not want to block this= capability.=C2=A0 IOW - Just because RISC does not want to express multipl= e events does not make this true for other profiles.

* We may wish to indicate a SCIM Password Reset was performed and a Logout/= session cancellation is expressed at the same time.=C2=A0 The events are re= lated but express different data.

Avoiding Confusion From Similar Events Originating from the Same Transactio= n

If events are sent separately, then more tracking of state (e.g. by txn) wo= uld be required to ensure similar events are not mistaken or handled as rep= eats. While txn provides useful audit analysis capability, I=E2=80=99m not = sure it can be used in live or near-real time systems given distributed mul= ti-node, multi-threading architectures.

Previous Discussion

I note that I originally raised having an attribute to designate primary ev= ent attribute to alleviate your concern, but this was not accepted. See:
* https://www.ietf.org/mail-arch= ive/web/id-event/current/msg00406.html

* https://www.ietf.org/mail-arch= ive/web/id-event/current/msg00140.html

The consensus, at least as I interpreted it is up to the receiver to figure= this out based on the definitions it has for each event URI and the profil= es they represent. IOW - RISC is free to limit that only one RISC event be = expressed at a time.

Phil

Oracle Corporation, Identity Cloud Services Architect

@independentid

www.independentid.com <http://www.independentid.com>

phil.hunt@oracle.= com <mailto:phil.hunt@oracle.com>

=C2=A0 =C2=A0 On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle
=C2=A0 =C2=A0 <= richanna@amazon.com <mailto:richanna@amazon.com>> wrote:

=C2=A0 =C2=A0 The current draft of the SET spec allows for expressing multi= ple
=C2=A0 =C2=A0 events within the same token, which introduces additional com= plexity
=C2=A0 =C2=A0 and room for ambiguous semantics. We=E2=80=99ve discussed thi= s in the OIDF
=C2=A0 =C2=A0 RISC working group and the current consensus there is that RI= SC will
=C2=A0 =C2=A0 require that RISC events must be the only event in the SET, h= aving
=C2=A0 =C2=A0 identified ways to clearly and easily support the handful of = use
=C2=A0 =C2=A0 cases for multiple events per token that people have raised. = With
=C2=A0 =C2=A0 that context in mind, I propose striking the definition of th= e
=C2=A0 =C2=A0 =E2=80=9Cevents=E2=80=9D claim from the Security Event Token = spec, and replacing it
=C2=A0 =C2=A0 with the following definition for an =E2=80=9Cevent=E2=80=9D = claim (singular):

=C2=A0 =C2=A0 event

=C2=A0 =C2=A0 A JSON object containing an "event_type" member who= se value is a URI
=C2=A0 =C2=A0 representing a type of event defined in a Profiling Specifica= tion.
=C2=A0 =C2=A0 The object MAY otherwise be empty, or MAY contain additional = members
=C2=A0 =C2=A0 as described by the Profiling Specification.

=C2=A0 =C2=A0 Here is the example SET from section 2.3, rewritten with this= change
=C2=A0 =C2=A0 mind:

=C2=A0 =C2=A0 {

=C2=A0 =C2=A0 =C2=A0=C2=A0 "jti": "4d3559ec67504aaba65d40b03= 63faad8",

=C2=A0 =C2=A0 =C2=A0=C2=A0 "iat": 1458496404,

 =C2=A0 =C2=A0 =C2=A0=C2=A0"iss": "https://scim.example.com <https://scim.example.com/>",

=C2=A0 =C2=A0 =C2=A0=C2=A0 "aud": [

=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",

=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"
=C2=A0 =C2=A0 =C2=A0=C2=A0 ],

=C2=A0 =C2=A0 =C2=A0=C2=A0 "event": {

=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "event_type": "urn:ie= tf:params:scim:event:create",

=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e75= 21d9",

=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "attributes": ["id&qu= ot;, "name", "userName", "password", "em= ails"]

=C2=A0 =C2=A0 =C2=A0=C2=A0 }

=C2=A0 =C2=A0 }

=C2=A0 =C2=A0 Does anyone in the working group have use cases for SETs that= cannot
=C2=A0 =C2=A0 be met by this proposed text? Within RISC, we identified thre= e use
=C2=A0 =C2=A0 cases, with solutions outlined below:

 =C2=A0 =C2=A0 **

=C2=A0 =C2=A0 *Extensions*

=C2=A0 =C2=A0 Event extension mechanisms can be defined internal to the eve= nt
=C2=A0 =C2=A0 object. A simple approach would be to =C2=A0define an =E2=80= =9Cextensions=E2=80=9D member
=C2=A0 =C2=A0 that is a list of event objects (or set resembling the =E2=80= =9Cevents=E2=80=9D
=C2=A0 =C2=A0 claim as defined in the current spec). This has the advantage= of
=C2=A0 =C2=A0 making it clear in the data structure that there is a single = primary
=C2=A0 =C2=A0 event, with zero or more extensions. There is no room for con= fusion
=C2=A0 =C2=A0 over which event is primary, or if there is a primary event a= t all.
=C2=A0 =C2=A0 I would be fine with adding something like this to my propose= d text,
=C2=A0 =C2=A0 if there is consensus that it is broadly useful.

 =C2=A0 =C2=A0 *Aliases*

=C2=A0 =C2=A0 This use case was brought up in the context of migrating clie= nts
=C2=A0 =C2=A0 from draft event names to standardized event names. In this c= ase,
=C2=A0 =C2=A0 the event transmitter can transmit two tokens for the logical= event,
=C2=A0 =C2=A0 one using the old name and another using the new name.

 =C2=A0 =C2=A0 *Related Events*

=C2=A0 =C2=A0 The SET spec defines the txn claim as a means of correlating<= br> =C2=A0 =C2=A0 independent tokens that relate to the same logical event.

=C2=A0 =C2=A0 --
=C2=A0 =C2=A0 Annabelle Richard Backman

=C2=A0 =C2=A0 Amazon =E2=80=93 Identity Services

=C2=A0 =C2=A0 _______________________________________________
=C2=A0 =C2=A0 Id-event mailing list
 =C2=A0 =C2=A0 Id-eve= nt@ietf.org <mailto:Id-event@ietf.org>
=C2=A0 =C2=A0 https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A_= _www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D= RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH= 0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn= 8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfg= yoIY&e=3D



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-e= vent


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-e= vent



--
Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
--089e0824b1cce46ce7055cb7a9e4-- From nobody Sun Oct 29 17:25:59 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0F213FCD4 for ; Sun, 29 Oct 2017 17:25:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e64IVHSQc_vl for ; Sun, 29 Oct 2017 17:25:54 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03F9413FCD0 for ; Sun, 29 Oct 2017 17:25:53 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9U0Poxb026642 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 00:25:50 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9U0Pon8013896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 00:25:50 GMT Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9U0PnwA016930; Mon, 30 Oct 2017 00:25:49 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 29 Oct 2017 17:25:48 -0700 From: Phil Hunt Message-Id: <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_1061D42B-75BD-4A8F-8F9D-551FE61A7474" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Sun, 29 Oct 2017 17:25:46 -0700 In-Reply-To: Cc: Yaron Sheffer , Mike Jones , "Richard Backman, Annabelle" , ID Events Mailing List To: Dick Hardt References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 00:25:57 -0000 --Apple-Mail=_1061D42B-75BD-4A8F-8F9D-551FE61A7474 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I hope this answers your question. My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why = not. The question should be, what is the justification to make = =E2=80=9Cevents=E2=80=9D singular? There are many reasons for multiple events in a SET. Some are good, = some not so good. Some of the reasons... 1. Multiple event payloads expressing statements about largely the = *same*thing. For example, SCIM password reset AND RISC password reset. = A RISC Event and an OpenBanking Event. Is one a complement to the other? = Do they overlap or are they distinct? =20 2. Multiple events payloads expressing different statements about the = same transaction - RISC Password Reset and RISC Session Cancel 3. A new profile defines new event attributes to be added on to an = existing event type (a pure extension)=20 I think it is quite valid to allow 1 and 3. 2 could be limited by = specific profiles like RISC if they want. I am not in agreement that making event singular simplifies anything. = For one is makes extensions complex (another nested JSON structure) and = potentially conflicting.=20 If the WG wants to block 1 and 2 above, then I believe we have to = establish an event registry to ensure new Event profiles do not overlap = to eliminate the need to express multiple events. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: >=20 > Phil: >=20 > In your examples for having a plurality of events, you use the word = "may", which leads me to question if a plurality of events is really = required in SET. >=20 > You posit that it will be difficult for a distributed system to = correlate multiple SETs with the same "txn", but the distributed system = will certainly need to correlate events on the same subject -- = correlating events on the same "txn" on the same subject seems fairly = simple. >=20 > I think that a receiver will need to correlate multiple SEts on the = same subject, so having multiple events in a SET is redundant, and adds = complexity with no clear benefit that I can see. >=20 > An implementor may choose to send multiple SETs, or send a single SET = with multiple events, so a receiver will need to support both. I prefer = we pick one way and minimize the code paths, and we will need to support = correlating across multiple SETs, so that seems the best mechanism. >=20 > Let me know if there is something I missed in my logic. >=20 > /Dick >=20 >=20 > On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer > wrote: > In that case, let's add text to that effect, e.g. we could add to the = definition of the "events" claim: >=20 > Profiling specifications SHOULD define the allowed event statements, = and MAY restrict their number. For example, some profiles may require = this claim to contain only a single event statement. >=20 > Thanks, > Yaron >=20 > On 24/10/17 22:10, Mike Jones wrote: > I agree with much of Phil=E2=80=99s rationale here. >=20 > It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a singleton. That doesn=E2=80=99t have to be true for = all events. I think things are fine as-is. >=20 > -- = Mike >=20 > *From:* Id-event [mailto:id-event-bounces@ietf.org = ] *On Behalf Of *Phil Hunt > *Sent:* Monday, October 23, 2017 8:47 PM > *To:* Richard Backman, Annabelle > > *Cc:* ID Events Mailing List > > *Subject:* Re: [Id-event] Use cases for multiple events per SET? >=20 > Annabelle, >=20 > I have a number of concerns with this proposal. >=20 > Profiling Independence / Keeping Event Payloads Independent >=20 > Indicating that extensions should be handled by profiles leads to more = inter-operability issues and more importantly intrudes on the Event = payload space by suggesting a sub-schema creates potential limitations = and conflicts that may add to complexity later on. The current format = allows a parser to discover and unload one or more JSON payloads which = can each have independent structure. >=20 > General extensions >=20 > The proposal also rules out general purpose extensions not related to = any specific event. Given the emergence of items like GPRD, I would not = want to block the ability to add meta-data or other general purpose = items. We can also anticipate some delivery scenarios where additional = data might be required. Even though there is no current planned use, I = see no good reason to rule this out. >=20 > Multiple Events =46rom Different Families (vs. Multiple Events from a = single family like RISC) >=20 > In our RISC session we discussed expressing multiple distinct RISC = events in one SET. The discussion was that only one RISC event at a = time. We did not discuss other event profiles. I don=E2=80=99t see a = reason to rule out multi-events from different families at the SET = level. Each profile is expressing slightly different things about the = same event. >=20 > I can forsee some cases where it is not clear which is the primary and = which is the extension. There may not be a clear winner. >=20 > A couple of examples (these are necessarily real=E2=80=A6just = possibilities): >=20 > * It is probably useful to be able to express simlar/overlapping = events from different SET profiles in one SET. For example a = Backchannel Logout & a RISC session cancel event. >=20 > * SCIM may want to represent a single transaction as causing multiple = state changes in an event (e.g. a password change causes multiple = effects). Having to chase down multiple events and correlate by = =E2=80=9Ctxn=E2=80=9D would be challenging in a = multi-threaded/multi-node delivery system. The SCIM list has not = discussed this, but I would not want to block this capability. IOW - = Just because RISC does not want to express multiple events does not make = this true for other profiles. >=20 > * We may wish to indicate a SCIM Password Reset was performed and a = Logout/session cancellation is expressed at the same time. The events = are related but express different data. >=20 > Avoiding Confusion =46rom Similar Events Originating from the Same = Transaction >=20 > If events are sent separately, then more tracking of state (e.g. by = txn) would be required to ensure similar events are not mistaken or = handled as repeats. While txn provides useful audit analysis capability, = I=E2=80=99m not sure it can be used in live or near-real time systems = given distributed multi-node, multi-threading architectures. >=20 > Previous Discussion >=20 > I note that I originally raised having an attribute to designate = primary event attribute to alleviate your concern, but this was not = accepted. See: >=20 > * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html = >=20 > * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html = >=20 > The consensus, at least as I interpreted it is up to the receiver to = figure this out based on the definitions it has for each event URI and = the profiles they represent. IOW - RISC is free to limit that only one = RISC event be expressed at a time. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect >=20 > @independentid >=20 > www.independentid.com = = > >=20 > phil.hunt@oracle.com = > >=20 > On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle > = >> wrote: >=20 > The current draft of the SET spec allows for expressing multiple > events within the same token, which introduces additional = complexity > and room for ambiguous semantics. We=E2=80=99ve discussed this in = the OIDF > RISC working group and the current consensus there is that RISC = will > require that RISC events must be the only event in the SET, having > identified ways to clearly and easily support the handful of use > cases for multiple events per token that people have raised. With > that context in mind, I propose striking the definition of the > =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, = and replacing it > with the following definition for an =E2=80=9Cevent=E2=80=9D claim = (singular): >=20 > event >=20 > A JSON object containing an "event_type" member whose value is a = URI > representing a type of event defined in a Profiling Specification. > The object MAY otherwise be empty, or MAY contain additional = members > as described by the Profiling Specification. >=20 > Here is the example SET from section 2.3, rewritten with this = change > mind: >=20 > { >=20 > "jti": "4d3559ec67504aaba65d40b0363faad8", >=20 > "iat": 1458496404, >=20 > "iss": "https://scim.example.com = >", >=20 > "aud": [ >=20 > "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754 = ", >=20 > "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7 = " >=20 > ], >=20 > "event": { >=20 > "event_type": "urn:ietf:params:scim:event:create", >=20 > "ref": = "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 = ", >=20 > "attributes": ["id", "name", "userName", "password", = "emails"] >=20 > } >=20 > } >=20 > Does anyone in the working group have use cases for SETs that = cannot > be met by this proposed text? Within RISC, we identified three use > cases, with solutions outlined below: >=20 > ** >=20 > *Extensions* >=20 > Event extension mechanisms can be defined internal to the event > object. A simple approach would be to define an =E2=80=9Cextensions= =E2=80=9D member > that is a list of event objects (or set resembling the = =E2=80=9Cevents=E2=80=9D > claim as defined in the current spec). This has the advantage of > making it clear in the data structure that there is a single = primary > event, with zero or more extensions. There is no room for = confusion > over which event is primary, or if there is a primary event at = all. > I would be fine with adding something like this to my proposed = text, > if there is consensus that it is broadly useful. >=20 > *Aliases* >=20 > This use case was brought up in the context of migrating clients > from draft event names to standardized event names. In this case, > the event transmitter can transmit two tokens for the logical = event, > one using the old name and another using the new name. >=20 > *Related Events* >=20 > The SET spec defines the txn claim as a means of correlating > independent tokens that relate to the same logical event. >=20 > --=20 > Annabelle Richard Backman >=20 > Amazon =E2=80=93 Identity Services >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org = > > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuA= b1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyo= IY&e=3D = >=20 >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = >=20 >=20 >=20 > --=20 > Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj= -2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zbhcW001fK02E= Xs&e=3D = --Apple-Mail=_1061D42B-75BD-4A8F-8F9D-551FE61A7474 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
I hope this answers your question.

My =E2=80=9Cmay=E2=80=9D = was because I can=E2=80=99t see a reason why not. The question should = be, what is the justification to make =E2=80=9Cevents=E2=80=9D = singular?

There = are many reasons for multiple events in a SET.  Some are good, some = not so good. Some of the reasons...

1.  Multiple event payloads = expressing statements about largely the *same*thing. For example, SCIM = password reset AND RISC password reset.  A RISC Event and an = OpenBanking Event. Is one a complement to the other?  Do they = overlap or are they distinct?  
2. =  Multiple events payloads expressing different statements about the = same transaction - RISC Password Reset and RISC Session Cancel
3.  A new profile defines new event attributes to be = added on to an existing event type (a pure extension) 

I think it is quite = valid to allow 1 and 3.  2 could be limited by specific profiles = like RISC if they want.

I am not in agreement that making event singular simplifies = anything. For one is makes extensions complex (another nested JSON = structure) and potentially conflicting. 

If the WG wants to block 1 and 2 above, = then I believe we have to establish an event registry to ensure new = Event profiles do not overlap to eliminate the need to express multiple = events.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

On Oct 29, 2017, at 4:12 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Phil:

In = your examples for having a plurality of events, you use the word "may", = which leads me to question if a plurality of events is really required = in SET.

You = posit that it will be difficult for a distributed system to correlate = multiple SETs with the same "txn", but the distributed system will = certainly need to correlate events on the same subject -- correlating = events on the same "txn" on the same subject seems fairly = simple.

I = think that a receiver will need to correlate multiple SEts on the same = subject, so having multiple events in a SET is redundant, and adds = complexity with no clear benefit that I can see.

An implementor may choose to send = multiple SETs, or send a single SET with multiple events, so a receiver = will need to support both. I prefer we pick one way and minimize the = code paths, and we will need to support correlating across multiple = SETs, so that seems the best mechanism.

Let me know if there is something I = missed in my logic.

/Dick


On Sun, Oct 29, 2017 at 11:28 AM, Yaron = Sheffer <yaronf.ietf@gmail.com> wrote:
In that case, = let's add text to that effect, e.g. we could add to the definition of = the "events" claim:

Profiling = specifications SHOULD define the allowed event statements, and MAY = restrict their number. For example, some profiles may require this claim = to contain only a single event statement.

Thanks,
        Yaron

On 24/10/17 22:10, Mike Jones wrote:
I agree with much of Phil=E2=80=99= s rationale here.

It=E2=80=99s fine for = some profiles to say that the =E2=80=9Cevents=E2=80=9D set must be a = singleton.  That doesn=E2=80=99t have to be true for all = events.  I think things are fine as-is.

          &nb= sp;            = ;                 &nb= sp;            = ;            -- Mike

*From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of = *Phil Hunt
*Sent:* Monday, October 23, 2017 8:47 PM
*To:* Richard Backman, Annabelle <richanna@amazon.com>
*Cc:* ID Events = Mailing List <id-event@ietf.org>
*Subject:* Re: = [Id-event] Use cases for multiple events per SET?

Annabelle,

I have = a number of concerns with this proposal.

Profiling Independence / Keeping Event Payloads = Independent

Indicating that extensions = should be handled by profiles leads to more inter-operability issues and = more importantly intrudes on the Event payload space by suggesting a = sub-schema creates potential limitations and conflicts that may add to = complexity later on. The current format allows a parser to discover and = unload one or more JSON payloads which can each have independent = structure.

General extensions

The proposal also rules out general purpose = extensions not related to any specific event. Given the emergence of = items like GPRD, I would not want to block the ability to add meta-data = or other general purpose items. We can also anticipate some delivery = scenarios where additional data might be required. Even though there is = no current planned use, I see no good reason to rule this out.

Multiple Events =46rom Different Families (vs. = Multiple Events from a single family like RISC)

In our RISC session we discussed expressing multiple distinct = RISC events in one SET. The discussion was that only one RISC event at a = time. We did not discuss other event profiles. I don=E2=80=99t see a = reason to rule out multi-events from different families at the SET = level. Each profile is expressing slightly different things about the = same event.

I can forsee some cases where = it is not clear which is the primary and which is the extension.  = There may not be a clear winner.

A couple = of examples (these are necessarily real=E2=80=A6just possibilities):

* It is probably useful to be able to express = simlar/overlapping events from different SET profiles in one SET.  = For example a Backchannel Logout & a RISC session cancel event.

* SCIM may want to represent a single = transaction as causing multiple state changes in an event (e.g. a = password change causes multiple effects). Having to chase down multiple = events and correlate by =E2=80=9Ctxn=E2=80=9D would be challenging in a = multi-threaded/multi-node delivery system.   The SCIM list has = not discussed this, but I would not want to block this capability.  = IOW - Just because RISC does not want to express multiple events does = not make this true for other profiles.

* We = may wish to indicate a SCIM Password Reset was performed and a = Logout/session cancellation is expressed at the same time.  The = events are related but express different data.

Avoiding Confusion =46rom Similar Events Originating from the = Same Transaction

If events are sent = separately, then more tracking of state (e.g. by txn) would be required = to ensure similar events are not mistaken or handled as repeats. While = txn provides useful audit analysis capability, I=E2=80=99m not sure it = can be used in live or near-real time systems given distributed = multi-node, multi-threading architectures.

Previous Discussion

I note that = I originally raised having an attribute to designate primary event = attribute to alleviate your concern, but this was not accepted. See:

* https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html

* https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html

The consensus, at least as I interpreted it is = up to the receiver to figure this out based on the definitions it has = for each event URI and the profiles they represent. IOW - RISC is free = to limit that only one RISC event be expressed at a time.

Phil

Oracle = Corporation, Identity Cloud Services Architect

@independentid

www.independentid.com <http://www.independentid.com>

phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>
    On Oct 23, 2017, at 7:02 PM, Richard Backman, = Annabelle
    <richanna@amazon.com <mailto:richanna@amazon.com>> wrote:

    The current draft of the SET spec allows for = expressing multiple
    events within the same = token, which introduces additional complexity
  =   and room for ambiguous semantics. We=E2=80=99ve discussed this in = the OIDF
    RISC working group and the current = consensus there is that RISC will
    require = that RISC events must be the only event in the SET, having
    identified ways to clearly and easily support = the handful of use
    cases for multiple events = per token that people have raised. With
    that = context in mind, I propose striking the definition of the
    =E2=80=9Cevents=E2=80=9D claim from the = Security Event Token spec, and replacing it
    = with the following definition for an =E2=80=9Cevent=E2=80=9D claim = (singular):

    event

    A JSON object containing an = "event_type" member whose value is a URI
    = representing a type of event defined in a Profiling Specification.
    The object MAY otherwise be empty, or MAY = contain additional members
    as described by = the Profiling Specification.

    = Here is the example SET from section 2.3, rewritten with this change
    mind:

  =   {

       "jti": = "4d3559ec67504aaba65d40b0363faad8",

       "iat": 1458496404,
      "iss": "https://scim.example.com <https://scim.example.com/>",

       "aud": [

         "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",

         "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"

       ],

       "event": {

         "event_type": = "urn:ietf:params:scim:event:create",

         "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",

         "attributes": ["id", = "name", "userName", "password", "emails"]

       }

    }

    = Does anyone in the working group have use cases for SETs that cannot
    be met by this proposed text? Within RISC, we = identified three use
    cases, with solutions = outlined below:

    **

    *Extensions*

    Event extension mechanisms can = be defined internal to the event
    object. A = simple approach would be to  define an =E2=80=9Cextensions=E2=80=9D = member
    that is a list of event objects (or = set resembling the =E2=80=9Cevents=E2=80=9D
    = claim as defined in the current spec). This has the advantage of
    making it clear in the data structure that = there is a single primary
    event, with zero = or more extensions. There is no room for confusion
  =   over which event is primary, or if there is a primary event at = all.
    I would be fine with adding something = like this to my proposed text,
    if there is = consensus that it is broadly useful.

    *Aliases*

    This use case was brought up in = the context of migrating clients
    from draft = event names to standardized event names. In this case,
    the event transmitter can transmit two tokens = for the logical event,
    one using the old = name and another using the new name.

    *Related Events*

    The SET spec defines the txn = claim as a means of correlating
    independent = tokens that relate to the same logical event.

    -- 
  =   Annabelle Richard Backman

  =   Amazon =E2=80=93 Identity Services

    _______________________________________________
    Id-event = mailing list
    Id-event@ietf.org <mailto:Id-event@ietf.org>
    https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D



_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event



-- 
Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DYBCGlK9mjjhcFsj-2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV8= 02iMQ4wYB1f2rFUGu4zbhcW001fK02EXs&e=3D
= --Apple-Mail=_1061D42B-75BD-4A8F-8F9D-551FE61A7474-- From nobody Sun Oct 29 17:33:56 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 313BF13FCCA for ; Sun, 29 Oct 2017 17:33:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 45YAeIDqTEMA for ; Sun, 29 Oct 2017 17:33:50 -0700 (PDT) Received: from mail-pg0-x22a.google.com (mail-pg0-x22a.google.com [IPv6:2607:f8b0:400e:c05::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 213451394F5 for ; Sun, 29 Oct 2017 17:33:50 -0700 (PDT) Received: by mail-pg0-x22a.google.com with SMTP id 15so9974052pgc.12 for ; Sun, 29 Oct 2017 17:33:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=yMdOCRg4UX6mOH/Zj+/zVd8rZ7yS/5B+Gp3dNjYCpJA=; b=sSftGmxb7VtqTNDulPEIyAwz5w14Kdqtiw8DwDr1Q2NXk4hS1jRW/Rfy+VuhJ0Exk4 UxP8XlQGStcYkcPUbmnFB8rg3vzgrNN5izJIkyLKMmWIFa8S6w0ctfhJrykKXGFlR/rk R2FGyi2YWuHCZDC1WgP72Tz6Qvi0UGW7Xbb4LAYAMJ0yY2khdJUzNmsbcGX6bKUCJ4Zv mGJDKiKDKgFTUObTGRnqy0/jpiqaQWN7vMOhx05vOo+uanA1qyEhsr8pDww40lVeqQH9 Pwsz0lSUiSKhyWuLr11jXrggZEHNCfQMz7JgvHbfjGFdm/OygAmhreh0m7gW2cpILKeV 76Ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=yMdOCRg4UX6mOH/Zj+/zVd8rZ7yS/5B+Gp3dNjYCpJA=; b=Greh2GWuEWDQmQbbVLQXPsEFoh7hm1UaP++mfSql3wl1Bm+rSutvAjsDUtV1N+4ul8 /As/KT+NQwzuOJJOr+Txv5vgnlJD6X5vWI+v0y756tI5egJ85Q5YWWZRW8VHbcdKCdM1 pn66xf9jTYVqpLUqfndCrg8ocdI21Me+p/+3rvuPs1bKZJ7DX8gKU1ePBEXnK8GfPTRL t1ROYFJNirQzbXaQ/F/sJtFSkAtnAk+Y3kVqMJwVmUdShkJ4Butah//ctZP5gzd2D16a Fto0xf0EYrxTLuFdBvGfBPRZpPHOLaq1vdilPFBLC6iPg9Ct0KrtjZOrWLr4czoD2Vdk xC5Q== X-Gm-Message-State: AMCzsaXm6i3oJvOwtZVMYk9Fh34P78VjQCcDBINslGINguGCOsjvWUPl 3Wvpi9oxZBya4G/ipBmm8umIABI5z9V3BNb05ik= X-Google-Smtp-Source: ABhQp+TeppZYzqkfke23U+HQlmybWsrvBfdWDmnJjXGSRTOx8Vf2bxtMVLsRfPX8Lh5YGTXf2EXAFfn/6Qy51Y9B1Ys= X-Received: by 10.99.107.66 with SMTP id g63mr4434264pgc.371.1509323629412; Sun, 29 Oct 2017 17:33:49 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Sun, 29 Oct 2017 17:33:28 -0700 (PDT) In-Reply-To: <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> From: Dick Hardt Date: Sun, 29 Oct 2017 17:33:28 -0700 Message-ID: To: Phil Hunt Cc: Yaron Sheffer , Mike Jones , "Richard Backman, Annabelle" , ID Events Mailing List Content-Type: multipart/alternative; boundary="94eb2c1404c6c846ef055cb8cafc" Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 00:33:54 -0000 --94eb2c1404c6c846ef055cb8cafc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Oct 29, 2017 at 5:25 PM, Phil Hunt wrote: > I hope this answers your question. > > My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why not= . The question should be, > what is the justification to make =E2=80=9Cevents=E2=80=9D singular? > I strongly disagree. Added complexity should be justified. A singular event is less complex than a plurality of events. The complexity of plurality in the SET needs to be offset by simplicity somewhere else. > > There are many reasons for multiple events in a SET. Some are good, some > not so good. Some of the reasons... > > 1. Multiple event payloads expressing statements about largely the > *same*thing. For example, SCIM password reset AND RISC password reset. A > RISC Event and an OpenBanking Event. Is one a complement to the other? D= o > they overlap or are they distinct? > So will it be required that these MUST always be in the same SET? If we allow them to be different SETs, then an implementor is needing to support both mechanisms. > 2. Multiple events payloads expressing different statements about the > same transaction - RISC Password Reset and RISC Session Cancel > See above. > 3. A new profile defines new event attributes to be added on to an > existing event type (a pure extension) > I don't know why this would not be additional attributes in the same event. > > I think it is quite valid to allow 1 and 3. 2 could be limited by > specific profiles like RISC if they want. > > I am not in agreement that making event singular simplifies anything. For > one is makes extensions complex (another nested JSON structure) and > potentially conflicting. > I'm confused why you would not extend the event object. Adding an additional event as an extension seems very complex and non-intuitive. Perhaps I am missing something. Do you have an example to clarify? > > If the WG wants to block 1 and 2 above, then I believe we have to > establish an event registry to ensure new Event profiles do not overlap t= o > eliminate the need to express multiple events. > Each event has a URI already does it not? We already need to uniquely identify event semantics. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > > On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: > > Phil: > > In your examples for having a plurality of events, you use the word "may"= , > which leads me to question if a plurality of events is really required in > SET. > > You posit that it will be difficult for a distributed system to correlate > multiple SETs with the same "txn", but the distributed system will > certainly need to correlate events on the same subject -- correlating > events on the same "txn" on the same subject seems fairly simple. > > I think that a receiver will need to correlate multiple SEts on the same > subject, so having multiple events in a SET is redundant, and adds > complexity with no clear benefit that I can see. > > An implementor may choose to send multiple SETs, or send a single SET wit= h > multiple events, so a receiver will need to support both. I prefer we pic= k > one way and minimize the code paths, and we will need to support > correlating across multiple SETs, so that seems the best mechanism. > > Let me know if there is something I missed in my logic. > > /Dick > > > On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer > wrote: > >> In that case, let's add text to that effect, e.g. we could add to the >> definition of the "events" claim: >> >> Profiling specifications SHOULD define the allowed event statements, and >> MAY restrict their number. For example, some profiles may require this >> claim to contain only a single event statement. >> >> Thanks, >> Yaron >> >> On 24/10/17 22:10, Mike Jones wrote: >> >>> I agree with much of Phil=E2=80=99s rationale here. >>> >>> It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2= =80=9D set must be a >>> singleton. That doesn=E2=80=99t have to be true for all events. I thi= nk things >>> are fine as-is. >>> >>> -- Mik= e >>> >>> *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil >>> Hunt >>> *Sent:* Monday, October 23, 2017 8:47 PM >>> *To:* Richard Backman, Annabelle >>> *Cc:* ID Events Mailing List >>> *Subject:* Re: [Id-event] Use cases for multiple events per SET? >>> >>> Annabelle, >>> >>> I have a number of concerns with this proposal. >>> >>> Profiling Independence / Keeping Event Payloads Independent >>> >>> Indicating that extensions should be handled by profiles leads to more >>> inter-operability issues and more importantly intrudes on the Event pay= load >>> space by suggesting a sub-schema creates potential limitations and >>> conflicts that may add to complexity later on. The current format allow= s a >>> parser to discover and unload one or more JSON payloads which can each = have >>> independent structure. >>> >>> General extensions >>> >>> The proposal also rules out general purpose extensions not related to >>> any specific event. Given the emergence of items like GPRD, I would not >>> want to block the ability to add meta-data or other general purpose ite= ms. >>> We can also anticipate some delivery scenarios where additional data mi= ght >>> be required. Even though there is no current planned use, I see no good >>> reason to rule this out. >>> >>> Multiple Events From Different Families (vs. Multiple Events from a >>> single family like RISC) >>> >>> In our RISC session we discussed expressing multiple distinct RISC >>> events in one SET. The discussion was that only one RISC event at a tim= e. >>> We did not discuss other event profiles. I don=E2=80=99t see a reason t= o rule out >>> multi-events from different families at the SET level. Each profile is >>> expressing slightly different things about the same event. >>> >>> I can forsee some cases where it is not clear which is the primary and >>> which is the extension. There may not be a clear winner. >>> >>> A couple of examples (these are necessarily real=E2=80=A6just possibili= ties): >>> >>> * It is probably useful to be able to express simlar/overlapping events >>> from different SET profiles in one SET. For example a Backchannel Logo= ut & >>> a RISC session cancel event. >>> >>> * SCIM may want to represent a single transaction as causing multiple >>> state changes in an event (e.g. a password change causes multiple effec= ts). >>> Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2= =80=9D would be >>> challenging in a multi-threaded/multi-node delivery system. The SCIM = list >>> has not discussed this, but I would not want to block this capability. = IOW >>> - Just because RISC does not want to express multiple events does not m= ake >>> this true for other profiles. >>> >>> * We may wish to indicate a SCIM Password Reset was performed and a >>> Logout/session cancellation is expressed at the same time. The events = are >>> related but express different data. >>> >>> Avoiding Confusion From Similar Events Originating from the Same >>> Transaction >>> >>> If events are sent separately, then more tracking of state (e.g. by txn= ) >>> would be required to ensure similar events are not mistaken or handled = as >>> repeats. While txn provides useful audit analysis capability, I=E2=80= =99m not sure >>> it can be used in live or near-real time systems given distributed >>> multi-node, multi-threading architectures. >>> >>> Previous Discussion >>> >>> I note that I originally raised having an attribute to designate primar= y >>> event attribute to alleviate your concern, but this was not accepted. S= ee: >>> >>> * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html >>> >>> >>> * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html >>> >>> >>> The consensus, at least as I interpreted it is up to the receiver to >>> figure this out based on the definitions it has for each event URI and = the >>> profiles they represent. IOW - RISC is free to limit that only one RISC >>> event be expressed at a time. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect >>> >>> @independentid >>> >>> www.independentid.com >>> >>> >> >>> > >>> >>> phil.hunt@oracle.com >>> >>> On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle >>> > wrote: >>> >>> The current draft of the SET spec allows for expressing multiple >>> events within the same token, which introduces additional complexit= y >>> and room for ambiguous semantics. We=E2=80=99ve discussed this in t= he OIDF >>> RISC working group and the current consensus there is that RISC wil= l >>> require that RISC events must be the only event in the SET, having >>> identified ways to clearly and easily support the handful of use >>> cases for multiple events per token that people have raised. With >>> that context in mind, I propose striking the definition of the >>> =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, = and replacing it >>> with the following definition for an =E2=80=9Cevent=E2=80=9D claim = (singular): >>> >>> event >>> >>> A JSON object containing an "event_type" member whose value is a UR= I >>> representing a type of event defined in a Profiling Specification. >>> The object MAY otherwise be empty, or MAY contain additional member= s >>> as described by the Profiling Specification. >>> >>> Here is the example SET from section 2.3, rewritten with this chang= e >>> mind: >>> >>> { >>> >>> "jti": "4d3559ec67504aaba65d40b0363faad8", >>> >>> "iat": 1458496404, >>> >>> "iss": "https://scim.example.com ", >>> >>> "aud": [ >>> >>> "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", >>> >>> "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" >>> >>> ], >>> >>> "event": { >>> >>> "event_type": "urn:ietf:params:scim:event:create", >>> >>> "ref": "https://scim.example.com/User >>> s/44f6142df96bd6ab61e7521d9", >>> >>> "attributes": ["id", "name", "userName", "password", "emails"] >>> >>> } >>> >>> } >>> >>> Does anyone in the working group have use cases for SETs that canno= t >>> be met by this proposed text? Within RISC, we identified three use >>> cases, with solutions outlined below: >>> >>> ** >>> >>> *Extensions* >>> >>> Event extension mechanisms can be defined internal to the event >>> object. A simple approach would be to define an =E2=80=9Cextension= s=E2=80=9D member >>> that is a list of event objects (or set resembling the =E2=80=9Ceve= nts=E2=80=9D >>> claim as defined in the current spec). This has the advantage of >>> making it clear in the data structure that there is a single primar= y >>> event, with zero or more extensions. There is no room for confusion >>> over which event is primary, or if there is a primary event at all. >>> I would be fine with adding something like this to my proposed text= , >>> if there is consensus that it is broadly useful. >>> >>> *Aliases* >>> >>> This use case was brought up in the context of migrating clients >>> from draft event names to standardized event names. In this case, >>> the event transmitter can transmit two tokens for the logical event= , >>> one using the old name and another using the new name. >>> >>> *Related Events* >>> >>> The SET spec defines the txn claim as a means of correlating >>> independent tokens that relate to the same logical event. >>> >>> -- >>> Annabelle Richard Backman >>> >>> Amazon =E2=80=93 Identity Services >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps- >>> 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg& >>> c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D >>> JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVu >>> Ab1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I >>> 58ZFd4eEZfgyoIY&e=3D >>> >>> >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> >>> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> > > > > -- > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj- > 2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zb > hcW001fK02EXs&e=3D > > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c1404c6c846ef055cb8cafc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Sun, Oct 29, 2017 at 5:25 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
I hope this answers your question.

=
My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why = not. The question should be, what is the justification to make =E2=80=9Ceve= nts=E2=80=9D singular?

I strong= ly disagree. Added complexity should be justified. A singular event is less= complex than a plurality of events. The complexity of plurality in the SET= needs to be offset by simplicity somewhere else.=C2=A0
=C2=A0
=
There are many reasons for multiple events in a SET.=C2=A0 S= ome are good, some not so good. Some of the reasons...

=
1.=C2=A0 Multiple event payloads expressing statements about largely t= he *same*thing. For example, SCIM password reset AND RISC password reset.= =C2=A0 A RISC Event and an OpenBanking Event. Is one a complement to the ot= her?=C2=A0 Do they overlap or are they distinct? =C2=A0

So will it be required that these MUST always be i= n the same SET? If we allow them to be different SETs, then an implementor = is needing to support both mechanisms.
=C2=A0
2.=C2=A0 Multiple= events payloads expressing different statements about the same transaction= - RISC Password Reset and RISC Session Cancel

See above.
=C2=A0
3.=C2=A0 A new profile define= s new event attributes to be added on to an existing event type (a pure ext= ension)=C2=A0

I don't know = why this would not be additional attributes in the same event.
= =C2=A0

I think it is quite valid to allow 1 and 3. =C2=A02= could be limited by specific profiles like RISC if they want.
I am not in agreement that making event singular simplifies an= ything. For one is makes extensions complex (another nested JSON structure)= and potentially conflicting.=C2=A0

=
I'm confused why you would not extend the event object. Adding an = additional event as an extension seems very complex and non-intuitive. Perh= aps I am missing something. Do you have an example to clarify?
=C2=A0

If the WG wants to block 1 and 2 above= , then I believe we have to establish an event registry to ensure new Event= profiles do not overlap to eliminate the need to express multiple events.<= /div>

Each event has a URI already do= es it not? We already need to uniquely identify event semantics.
= =C2=A0


Phil:

In your examples for having a = plurality of events, you use the word "may", which leads me to qu= estion if a plurality of events is really required in SET.

You posit that it will be difficult for a distributed system to co= rrelate multiple SETs with the same "txn", but the distributed sy= stem will certainly need to correlate events on the same subject -- correla= ting events on the same "txn" on the same subject seems fairly si= mple.

I think that a receiver will need to correla= te multiple SEts on the same subject, so having multiple events in a SET is= redundant, and adds complexity with no clear benefit that I can see.
=

An implementor may choose to send multiple SETs, or sen= d a single SET with multiple events, so a receiver will need to support bot= h. I prefer we pick one way and minimize the code paths, and we will need t= o support correlating across multiple SETs, so that seems the best mechanis= m.

Let me know if there is something I missed in m= y logic.

/Dick


On Sun, Oct 29, 2017 at 11:28 A= M, Yaron Sheffer=C2=A0<yaronf.ietf@gmail.com>=C2=A0wrote:
In that case, let's add text to that effect, e.g. we could a= dd to the definition of the "events" claim:

Profiling spec= ifications SHOULD define the allowed event statements, and MAY restrict the= ir number. For example, some profiles may require this claim to contain onl= y a single event statement.

Thanks,
=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0Yaro= n

On 24/10/17 22:10, Mike Jones wrote:
I agree w= ith much of Phil=E2=80=99s rationale here.

It=E2=80=99s fine for som= e profiles to say that the =E2=80=9Cevents=E2=80=9D set must be a singleton= .=C2=A0 That doesn=E2=80=99t have to be true for all events.=C2=A0 I think = things are fine as-is.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- Mike

*From:* Id-e= vent [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt
*Sent:* Mo= nday, October 23, 2017 8:47 PM
*To:* Richard Backman, Annabelle <richanna@amazon.com>
*Cc:* ID Events Mailing List <id-event@ietf.org>
*Subject:* Re: [Id-event= ] Use cases for multiple events per SET?

Annabelle,

I h= ave a number of concerns with this proposal.

Profiling Independence = / Keeping Event Payloads Independent

Indicating that extensions shou= ld be handled by profiles leads to more inter-operability issues and more i= mportantly intrudes on the Event payload space by suggesting a sub-schema c= reates potential limitations and conflicts that may add to complexity later= on. The current format allows a parser to discover and unload one or more = JSON payloads which can each have independent structure.

General ext= ensions

The proposal also rules out general purpose extensions not r= elated to any specific event. Given the emergence of items like GPRD, I wou= ld not want to block the ability to add meta-data or other general purpose = items. We can also anticipate some delivery scenarios where additional data= might be required. Even though there is no current planned use, I see no g= ood reason to rule this out.

Multiple Events From Different Families= (vs. Multiple Events from a single family like RISC)

In our RISC se= ssion we discussed expressing multiple distinct RISC events in one SET. The= discussion was that only one RISC event at a time. We did not discuss othe= r event profiles. I don=E2=80=99t see a reason to rule out multi-events fro= m different families at the SET level. Each profile is expressing slightly = different things about the same event.

I can forsee some cases where= it is not clear which is the primary and which is the extension.=C2=A0 The= re may not be a clear winner.

A couple of examples (these are necess= arily real=E2=80=A6just possibilities):

* It is probably useful to b= e able to express simlar/overlapping events from different SET profiles in = one SET.=C2=A0 For example a Backchannel Logout & a RISC session cancel= event.

* SCIM may want to represent a single transaction as causing= multiple state changes in an event (e.g. a password change causes multiple= effects). Having to chase down multiple events and correlate by =E2=80=9Ct= xn=E2=80=9D would be challenging in a multi-threaded/multi-node delivery sy= stem.=C2=A0 =C2=A0The SCIM list has not discussed this, but I would not wan= t to block this capability.=C2=A0 IOW - Just because RISC does not want to = express multiple events does not make this true for other profiles.

= * We may wish to indicate a SCIM Password Reset was performed and a Logout/= session cancellation is expressed at the same time.=C2=A0 The events are re= lated but express different data.

Avoiding Confusion From Similar Ev= ents Originating from the Same Transaction

If events are sent separa= tely, then more tracking of state (e.g. by txn) would be required to ensure= similar events are not mistaken or handled as repeats. While txn provides = useful audit analysis capability, I=E2=80=99m not sure it can be used in li= ve or near-real time systems given distributed multi-node, multi-threading = architectures.

Previous Discussion

I note that I originally r= aised having an attribute to designate primary event attribute to alleviate= your concern, but this was not accepted. See:

*=C2=A0https://www.ietf.org/mail-archive/web/id-event/current/msg004= 06.html

*=C2=A0https://www.ietf.org/mail-= archive/web/id-event/current/msg00140.html

The consensus, a= t least as I interpreted it is up to the receiver to figure this out based = on the definitions it has for each event URI and the profiles they represen= t. IOW - RISC is free to limit that only one RISC event be expressed at a t= ime.

Phil

Oracle Corporation, Identity Cloud Services Archite= ct

@independentid

www.independentid.com=C2=A0<http://www.independentid.com>
=
phil.hunt@ora= cle.com=C2= =A0<mailto:phil.hunt@oracle.com>

=C2=A0 =C2=A0 On Oct 23,= 2017, at 7:02 PM, Richard Backman, Annabelle
=C2=A0 =C2=A0= <richanna@amaz= on.com=C2= =A0<mailto:richanna@amazon.com>> wrote:

=C2=A0 =C2=A0 The cur= rent draft of the SET spec allows for expressing multiple
=C2=A0 =C2=A0 = events within the same token, which introduces additional complexity
=C2= =A0 =C2=A0 and room for ambiguous semantics. We=E2=80=99ve discussed this i= n the OIDF
=C2=A0 =C2=A0 RISC working group and the current consensus th= ere is that RISC will
=C2=A0 =C2=A0 require that RISC events must be the= only event in the SET, having
=C2=A0 =C2=A0 identified ways to clearly = and easily support the handful of use
=C2=A0 =C2=A0 cases for multiple e= vents per token that people have raised. With
=C2=A0 =C2=A0 that context= in mind, I propose striking the definition of the
=C2=A0 =C2=A0 =E2=80= =9Cevents=E2=80=9D claim from the Security Event Token spec, and replacing = it
=C2=A0 =C2=A0 with the following definition for an =E2=80=9Cevent=E2= =80=9D claim (singular):

=C2=A0 =C2=A0 event

=C2=A0 =C2=A0 A = JSON object containing an "event_type" member whose value is a UR= I
=C2=A0 =C2=A0 representing a type of event defined in a Profiling Spec= ification.
=C2=A0 =C2=A0 The object MAY otherwise be empty, or MAY conta= in additional members
=C2=A0 =C2=A0 as described by the Profiling Specif= ication.

=C2=A0 =C2=A0 Here is the example SET from section 2.3, rew= ritten with this change
=C2=A0 =C2=A0 mind:

=C2=A0 =C2=A0=C2=A0{

= =C2=A0 =C2=A0 =C2=A0=C2=A0 "jti": "4d3559ec67504aaba65d40b03= 63faad8",

=C2=A0 =C2=A0 =C2=A0=C2=A0 "iat": 1458= 496404,

=C2=A0 =C2=A0 =C2=A0=C2=A0"iss": "http= s://scim.example.com=C2=A0<https://scim.example.com/>",

=C2=A0 =C2=A0 =C2=A0=C2=A0 "aud": [

=C2=A0 =C2= =A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://s= cim.example.com/Feeds/98d52461fa5bbc879593b7754",
=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"
=C2=A0 =C2=A0 =C2=A0=C2=A0 ],

=C2=A0 =C2=A0 =C2=A0=C2=A0 "= ;event": {

=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "event_t= ype": "urn:ietf:params:scim:event:create",

=C2= =A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d= 9",

=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "attributes= ": ["id", "name", "userName", "pass= word", "emails"]

=C2=A0 =C2=A0 =C2=A0=C2=A0 }

= =C2=A0 =C2=A0 }

=C2=A0 =C2=A0 Does anyone in the working group have = use cases for SETs that cannot
=C2=A0 =C2=A0 be met by this proposed tex= t? Within RISC, we identified three use
=C2=A0 =C2=A0 cases, with soluti= ons outlined below:

=C2=A0 =C2=A0 **

=C2=A0 =C2=A0 *Ex= tensions*

=C2=A0 =C2=A0 Event extension mechanisms can be defi= ned internal to the event
=C2=A0 =C2=A0 object. A simple approach would = be to =C2=A0define an =E2=80=9Cextensions=E2=80=9D member
=C2=A0 =C2=A0 = that is a list of event objects (or set resembling the =E2=80=9Cevents=E2= =80=9D
=C2=A0 =C2=A0 claim as defined in the current spec). This has the= advantage of
=C2=A0 =C2=A0 making it clear in the data structure that t= here is a single primary
=C2=A0 =C2=A0 event, with zero or more extensio= ns. There is no room for confusion
=C2=A0 =C2=A0 over which event is pri= mary, or if there is a primary event at all.
=C2=A0 =C2=A0 I would be fi= ne with adding something like this to my proposed text,
=C2=A0 =C2=A0 if= there is consensus that it is broadly useful.

=C2=A0 =C2=A0 = *Aliases*

=C2=A0 =C2=A0 This use case was brought up in the co= ntext of migrating clients
=C2=A0 =C2=A0 from draft event names to stand= ardized event names. In this case,
=C2=A0 =C2=A0 the event transmitter c= an transmit two tokens for the logical event,
=C2=A0 =C2=A0 one using th= e old name and another using the new name.

=C2=A0 =C2=A0 *Rel= ated Events*

=C2=A0 =C2=A0 The SET spec defines the txn claim = as a means of correlating
=C2=A0 =C2=A0 independent tokens that relate t= o the same logical event.

=C2=A0 =C2=A0 --=C2=A0
=C2=A0 =C2=A0 Annabelle = Richard Backman

=C2=A0 =C2=A0 Amazon =E2=80=93 Identity Services
=
=C2=A0 =C2=A0 _______________________________________________
= =C2=A0 =C2=A0 Id-event mailing list
=C2=A0 =C2=A0=C2=A0Id-event@ietf.org=C2=A0<mailto:Id-event@ietf.org&= gt;
=C2=A0 =C2=A0=C2=A0https://urldefense.proofpoint.com/v2/url?u=3Dhttps= -3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&= c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5= biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1= mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58= ZFd4eEZfgyoIY&e=3D



___________________________= ____________________
Id-event mailing list
Id-event@ietf.org
http= s://www.ietf.org/mailman/listinfo/id-event


_______________________________________________
Id-event mai= ling list
Id-even= t@ietf.org
https://www.ietf.org/mailman/listinfo/id-ev= ent



--=C2=A0
Subsc= ribe to the=C2= =A0HARDTWARE=C2=A0mail list to learn abou= t projects I am working on!
_______________________________________= ________
Id-event mailing list
Id-event@ietf.org<= br style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-var= iant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;= text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
https://urld= efense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_l= istinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh= 8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkA= I1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj-2tDkn31Auxuruib9KATkRlQG1iw&= amp;s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zbhcW001fK02EXs&e=3D<= /div>




--
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
--94eb2c1404c6c846ef055cb8cafc-- From nobody Sun Oct 29 22:54:52 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AB0213F65E for ; Sun, 29 Oct 2017 22:54:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6txgGnY9kwi8 for ; Sun, 29 Oct 2017 22:54:48 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DA241394F2 for ; Sun, 29 Oct 2017 22:54:48 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9U5slQu022728 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 30 Oct 2017 05:54:47 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9U5skx7002305 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Mon, 30 Oct 2017 05:54:46 GMT Received: from abhmp0001.oracle.com (abhmp0001.oracle.com [141.146.116.7]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9U5skn9003296 for ; Mon, 30 Oct 2017 05:54:46 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 29 Oct 2017 22:54:46 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_80702EE9-720F-4878-8A44-E6C8B6B6819A" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: <9147E40E-F92D-4768-83BA-7B249F650622@oracle.com> References: <150934210364.3373.13486172105253394404.idtracker@ietfa.amsl.com> To: ID Events Mailing List Date: Sun, 29 Oct 2017 22:54:44 -0700 X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: [Id-event] Fwd: New Version Notification for draft-hunt-secevent-stream-mgmt-00.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 05:54:50 -0000 --Apple-Mail=_80702EE9-720F-4878-8A44-E6C8B6B6819A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii As requested, the Control Plane API draft that was originally part of = draft-hunt-secevent-distribution has been broken out as a separate draft = below. This draft includes sections from the distribution draft plus extensive = addition of examples showing different ways profilers, implementers and = deployers can manage subjects depending on their requirements. The spec = provides significant discussion on extensibility for profiling drafts = and the extension of Stream configuration to support new delivery = methods. The intention is to demonstrate how the proposal supports all = of the published use cases from SCIM (draft-hunt-secevent-usecases) and = RISC (draft-scurtescu-secevents-risc-use-cases. While the draft is somewhat long, the amount of normative language is = minimal (as this is a profile of SCIM). The bulk of this document is = taken up in about 35 figures showing simple examples of how to use the = Control Plane, along with schema and data definitions required for SEC = EVENT Streams. This draft is an alternative proposal to = draft-scurtescu-secevent-event-stream-mgmt-api published for discussion = at IETF100. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com = phil.hunt@oracle.com = > Begin forwarded message: >=20 > From: internet-drafts@ietf.org > Subject: New Version Notification for = draft-hunt-secevent-stream-mgmt-00.txt > Date: October 29, 2017 at 10:41:43 PM PDT > To: "Phil Hunt" >=20 >=20 > A new version of I-D, draft-hunt-secevent-stream-mgmt-00.txt > has been successfully submitted by Phil Hunt and posted to the > IETF repository. >=20 > Name: draft-hunt-secevent-stream-mgmt > Revision: 00 > Title: SET Security Event Stream Management and = Provisioning > Document date: 2017-10-29 > Group: Individual Submission > Pages: 48 > URL: = https://www.ietf.org/internet-drafts/draft-hunt-secevent-stream-mgmt-00.tx= t > Status: = https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ > Htmlized: = https://tools.ietf.org/html/draft-hunt-secevent-stream-mgmt-00 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-hunt-secevent-stream-mgmt-00 >=20 >=20 > Abstract: > This specification defines a "control plane" service which enables a > client (e.g. an Event Receiver) to establish, monitor, and manage a > Security Event Token Stream. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 --Apple-Mail=_80702EE9-720F-4878-8A44-E6C8B6B6819A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii As requested, the Control Plane API draft that was originally = part of draft-hunt-secevent-distribution has been broken out as a = separate draft below.

This draft includes sections from the distribution draft plus = extensive addition of examples showing different ways profilers, = implementers and deployers can manage subjects depending on their = requirements. The spec provides significant discussion on extensibility = for profiling drafts and the extension of Stream configuration to = support new delivery methods. The intention is to demonstrate how the = proposal supports all of the published use cases from SCIM = (draft-hunt-secevent-usecases) and RISC = (draft-scurtescu-secevents-risc-use-cases.

While the draft is somewhat long, the = amount of normative language is minimal (as this is a profile of SCIM). = The bulk of this document is taken up in about 35 figures showing simple = examples of how to use the Control Plane, along with schema and data = definitions required for SEC EVENT Streams.

This draft is an alternative proposal = to draft-scurtescu-secevent-event-stream-mgmt-api published for = discussion at IETF100.

Phil

Oracle Corporation, Identity Cloud = Services Architect
@independentid
www.independentid.com
phil.hunt@oracle.com

Begin forwarded message:

From: = internet-drafts@ietf.org
Subject: = New Version = Notification for draft-hunt-secevent-stream-mgmt-00.txt
Date: = October 29, 2017 at 10:41:43 PM = PDT
To: = "Phil Hunt" <phil.hunt@yahoo.com>


A new version = of I-D, draft-hunt-secevent-stream-mgmt-00.txt
has been = successfully submitted by Phil Hunt and posted to the
IETF = repository.

Name: = draft-hunt-secevent-stream-mgmt
Revision: 00
Title:= = SET Security Event Stream Management and Provisioning
Document date: 2017-10-29
Group:= = Individual Submission
Pages: 48
URL: =            https://www.ietf.org/internet-drafts/draft-hunt-secevent-stream= -mgmt-00.txt
Status: =         https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgm= t/
Htmlized:       https://tools.ietf.org/html/draft-hunt-secevent-stream-mgmt-00<= /a>
Htmlized:       https://datatracker.ietf.org/doc/html/draft-hunt-secevent-strea= m-mgmt-00


Abstract:
  This specification defines a "control plane" = service which enables a
  client (e.g. an Event = Receiver) to establish, monitor, and manage a
=   Security Event Token Stream.




Please note that it may take a = couple of minutes from the time of submission
until the = htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat


= --Apple-Mail=_80702EE9-720F-4878-8A44-E6C8B6B6819A-- From nobody Sun Oct 29 22:59:31 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AB9D13FDAD for ; Sun, 29 Oct 2017 22:59:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j-HqoRa_yFtE for ; Sun, 29 Oct 2017 22:59:27 -0700 (PDT) Received: from mail-pg0-x22c.google.com (mail-pg0-x22c.google.com [IPv6:2607:f8b0:400e:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC39F1394F2 for ; Sun, 29 Oct 2017 22:59:26 -0700 (PDT) Received: by mail-pg0-x22c.google.com with SMTP id b192so10677268pga.2 for ; Sun, 29 Oct 2017 22:59:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=AAkTdyMweP73eboUQRT0wDRovC7KM2ocagh27cddzZ8=; b=jOPIselB9MjD/kgLX6/+FK/O+YCVHfCDnUmZjz0c11IB2r2bc79ioPzyaBISHLQJEj IT9a4JNtKxZXH3o8Fvpzad/szwcht67BN75DMfyYMlsCM/Rvp6ZBoggo6Se3Jpvwqr0i 6q/GycanmGAlFQnatfHehF47N3LCVgMjVJ9IRSonqFHoWusNFKNsbY3DQChAVitVNG1M ANWLpWOBf6gfbDQLPiKt/UH0jMSadeoMLTZ0xNweOOYCziypFKalPFBrAklOmQ0xYIEG HyLifKKrpw3YtJIU5diPnGlNr4IyPTXFBEn1tj9KXYzdq1JiIpWM2m3z1FAonOp5gVar 5eUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=AAkTdyMweP73eboUQRT0wDRovC7KM2ocagh27cddzZ8=; b=TexAsaJjLOcFxbtxBoyX3y6hY52UHFeMdlo/VQtraUZ+s6GvavMzOxxn/tioar6dHX qk9Hg0e5qQGJKV7+/gjOpI8q7NNxcT7oZkwvE4vt1ecjDZa5TcMBxM1OnHebRyAnlGU+ RvZniAqQGe4cBd1/N96aKxG/88Q2cmS0FOnI0drg79uZnUoL5TwYAeDMmtL4b9M9scGK w+qyReWEhRtazwugio6UCebasTYujNr94PLTRv3RVdISQhyrILp+ysApSt2coaJB5bka yXRhl13LYfWli1QvNsic/0DwQ2ewrCbtwLXLRjV4jip7n6vCsMo+jNZ8wbjLgnobMsUM ciAA== X-Gm-Message-State: AMCzsaVggll4RjEECQgM0TDaqwpLsLq4egFPaQQq8XmQ9FfC/2QwEkH6 SsFBZ+uRzs78ldDqlNU+asVE5HPv8nYXzIPi94U= X-Google-Smtp-Source: ABhQp+SXkdQEvdY7DKVz9Tu9HCzk3y65NHC3sups76yGrIU1sCrPTlhW8jad8qAppBtSXxz1R7IEc15fM+IdU0RhevM= X-Received: by 10.99.107.66 with SMTP id g63mr5054175pgc.371.1509343166284; Sun, 29 Oct 2017 22:59:26 -0700 (PDT) MIME-Version: 1.0 References: <150934210364.3373.13486172105253394404.idtracker@ietfa.amsl.com> <9147E40E-F92D-4768-83BA-7B249F650622@oracle.com> In-Reply-To: <9147E40E-F92D-4768-83BA-7B249F650622@oracle.com> From: Dick Hardt Date: Mon, 30 Oct 2017 05:59:15 +0000 Message-ID: To: ID Events Mailing List , Phil Hunt Content-Type: multipart/alternative; boundary="94eb2c1404c645490d055cbd578c" Archived-At: Subject: Re: [Id-event] Fwd: New Version Notification for draft-hunt-secevent-stream-mgmt-00.txt X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 05:59:29 -0000 --94eb2c1404c645490d055cbd578c Content-Type: text/plain; charset="UTF-8" Thanks Phil On Sun, Oct 29, 2017 at 10:54 PM Phil Hunt wrote: > As requested, the Control Plane API draft that was originally part of > draft-hunt-secevent-distribution has been broken out as a separate draft > below. > > This draft includes sections from the distribution draft plus extensive > addition of examples showing different ways profilers, implementers and > deployers can manage subjects depending on their requirements. The spec > provides significant discussion on extensibility for profiling drafts and > the extension of Stream configuration to support new delivery methods. The > intention is to demonstrate how the proposal supports all of the published > use cases from SCIM (draft-hunt-secevent-usecases) and RISC > (draft-scurtescu-secevents-risc-use-cases. > > While the draft is somewhat long, the amount of normative language is > minimal (as this is a profile of SCIM). The bulk of this document is taken > up in about 35 figures showing simple examples of how to use the Control > Plane, along with schema and data definitions required for SEC EVENT > Streams. > > This draft is an alternative proposal to > draft-scurtescu-secevent-event-stream-mgmt-api published for discussion at > IETF100. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > > Begin forwarded message: > > *From: *internet-drafts@ietf.org > *Subject: **New Version Notification for > draft-hunt-secevent-stream-mgmt-00.txt* > *Date: *October 29, 2017 at 10:41:43 PM PDT > *To: *"Phil Hunt" > > > A new version of I-D, draft-hunt-secevent-stream-mgmt-00.txt > has been successfully submitted by Phil Hunt and posted to the > IETF repository. > > Name: draft-hunt-secevent-stream-mgmt > Revision: 00 > Title: SET Security Event Stream Management and Provisioning > Document date: 2017-10-29 > Group: Individual Submission > Pages: 48 > URL: > https://www.ietf.org/internet-drafts/draft-hunt-secevent-stream-mgmt-00.txt > Status: > https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ > Htmlized: > https://tools.ietf.org/html/draft-hunt-secevent-stream-mgmt-00 > Htmlized: > https://datatracker.ietf.org/doc/html/draft-hunt-secevent-stream-mgmt-00 > > > Abstract: > This specification defines a "control plane" service which enables a > client (e.g. an Event Receiver) to establish, monitor, and manage a > Security Event Token Stream. > > > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c1404c645490d055cbd578c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks Phil

On Sun, Oct 29, 2017 at 10:54 PM Phil Hunt <phil.hunt@oracle.com> wrote:
As requested, the Control= Plane API draft that was originally part of draft-hunt-secevent-distributi= on has been broken out as a separate draft below.

This d= raft includes sections from the distribution draft plus extensive addition = of examples showing different ways profilers, implementers and deployers ca= n manage subjects depending on their requirements. The spec provides signif= icant discussion on extensibility for profiling drafts and the extension of= Stream configuration to support new delivery methods. The intention is to = demonstrate how the proposal supports all of the published use cases from S= CIM (draft-hunt-secevent-usecases) and RISC (draft-scurtescu-secevents-risc= -use-cases.

While the draft is somewhat long, the = amount of normative language is minimal (as this is a profile of SCIM). The= bulk of this document is taken up in about 35 figures showing simple examp= les of how to use the Control Plane, along with schema and data definitions= required for SEC EVENT Streams.

This draft is an = alternative proposal to draft-scurtescu-secevent-event-stream-mgmt-api publ= ished for discussion at IETF100.

Phil

Oracle Corporation, Identity Cloud Services Architect
@ind= ependentid
phil.hunt@oracle.com
<= /div>

Begin forwarded message:

Subject: = New Version Notification for draft-hunt-secevent-stream-mgmt-00.txt<= br>
Date: October 29, 2017 at 10:41:43 PM PDT
To: "Phil Hunt" <<= a href=3D"mailto:phil.hunt@yahoo.com" target=3D"_blank">phil.hunt@yahoo.com= >


A new version of I-D, draft-hunt= -secevent-stream-mgmt-00.txt
has been successfully submitted by Phil Hun= t and posted to the
IETF repository.

Name: draft-hunt-secevent-stream-mgmt
Revision: 00<= br>Title: SET Security Event Stream Manage= ment and Provisioning
Document date: 2017-10-29
Group= : Individual Submission
Pages:= 48
URL: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0https://www.ietf.= org/internet-drafts/draft-hunt-secevent-stream-mgmt-00.txt
Status: = =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https:= //datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/
Htmlized= : =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0https://tools.ietf.= org/html/draft-hunt-secevent-stream-mgmt-00
Htmlized: =C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0https://datatracker.iet= f.org/doc/html/draft-hunt-secevent-stream-mgmt-00


Abstract:<= br> =C2=A0=C2=A0This specification defines a "control plane" serv= ice which enables a
=C2=A0=C2=A0client (e.g. an Event Receiver) to esta= blish, monitor, and manage a
=C2=A0=C2=A0Security Event Token Stream.



Please note that it may take a couple of minutes from the= time of submission
until the htmlized version and diff are available at= tools.ietf.org.
The IETF Secretariat


<= /div>_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--
Subscribe to the HARDTWARE mail list to learn about projects I= am working on!
--94eb2c1404c645490d055cbd578c-- From nobody Mon Oct 30 09:08:52 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA9965422 for ; Mon, 30 Oct 2017 09:08:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.818 X-Spam-Level: X-Spam-Status: No, score=-11.818 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wktsuulg_G9E for ; Mon, 30 Oct 2017 09:08:45 -0700 (PDT) Received: from smtp-fw-6001.amazon.com (smtp-fw-6001.amazon.com [52.95.48.154]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6DA413FE6F for ; Mon, 30 Oct 2017 08:57:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1509379038; x=1540915038; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=b/E5Kg7VJVBxVLsWhSvlHUC+kYZ13GBZRy9PKFLynBQ=; b=NqUMX/DWc+atx+2IiwWxvbT0PmiBzRCnm1ysHwzOCVH2NKLxleQExNqu 8UbxSnRNnG/bX08HCajaa8Xye7Sz14sH6sFnjWu0ieSZYkAJlUL7WIvHX 4QPa+vHIRIFFL1tVOvNBAtewND4nIk7I2Glws3hpcVnv2WASLSokq+r9/ Y=; X-IronPort-AV: E=Sophos;i="5.44,320,1505779200"; d="scan'208,217";a="316374343" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2b-5bdc5131.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6001.iad6.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 30 Oct 2017 15:57:06 +0000 Received: from EX13MTAUWC001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan2.pdx.amazon.com [10.236.137.194]) by email-inbound-relay-2b-5bdc5131.us-west-2.amazon.com (8.14.7/8.14.7) with ESMTP id v9UFv7h4065811 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 30 Oct 2017 15:57:07 GMT Received: from EX13D11UWC001.ant.amazon.com (10.43.162.151) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 30 Oct 2017 15:57:07 +0000 Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC001.ant.amazon.com (10.43.162.151) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Mon, 30 Oct 2017 15:57:07 +0000 Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Mon, 30 Oct 2017 15:57:07 +0000 From: "Richard Backman, Annabelle" To: Phil Hunt , Dick Hardt CC: Yaron Sheffer , Mike Jones , ID Events Mailing List Thread-Topic: [Id-event] Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9aLyXLkAgAEBjXCAB9BnAIAAT1IAgAAUagCAAQQ9AA== Date: Mon, 30 Oct 2017 15:57:07 +0000 Message-ID: <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> In-Reply-To: <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.26.0.170902 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.43.161.83] Content-Type: multipart/alternative; boundary="_000_65C74B5D9BDE4FEA9D020F041DC11A0Famazoncom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 16:08:51 -0000 --_000_65C74B5D9BDE4FEA9D020F041DC11A0Famazoncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmVwbGllcyBpbmxpbmUuDQoNCi0tDQpBbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuDQpJZGVudGl0 eSBTZXJ2aWNlcw0KDQoNCkZyb206IFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb20+DQpE YXRlOiBTdW5kYXksIE9jdG9iZXIgMjksIDIwMTcgYXQgNToyNSBQTQ0KVG86IERpY2sgSGFyZHQg PGRpY2suaGFyZHRAZ21haWwuY29tPg0KQ2M6IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdt YWlsLmNvbT4sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4sICJSaWNo YXJkIEJhY2ttYW4sIEFubmFiZWxsZSIgPHJpY2hhbm5hQGFtYXpvbi5jb20+LCBJRCBFdmVudHMg TWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRd IFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/DQoNCkkgaG9wZSB0aGlzIGFu c3dlcnMgeW91ciBxdWVzdGlvbi4NCg0KTXkg4oCcbWF54oCdIHdhcyBiZWNhdXNlIEkgY2Fu4oCZ dCBzZWUgYSByZWFzb24gd2h5IG5vdC4gVGhlIHF1ZXN0aW9uIHNob3VsZCBiZSwgd2hhdCBpcyB0 aGUganVzdGlmaWNhdGlvbiB0byBtYWtlIOKAnGV2ZW50c+KAnSBzaW5ndWxhcj8NCltyaWNoYW5u YV1UaGUgc2luZ3VsYXIg4oCcZXZlbnTigJ0gY2xhaW0gaGFzIGNsZWFyZXIgc2VtYW50aWNzIGFu ZCBpcyBlYXNpZXIgdG8gcHJvY2Vzcy4gV2Ugc2hvdWxkIG9wdCBmb3IgZWFzaWVyIHNvbHV0aW9u cyB1bmxlc3MgdGhlcmUgYXJlIHVzZSBjYXNlcyB0aGF0IHJlcXVpcmUgbW9yZSBjb21wbGV4aXR5 LlsvcmljaGFubmFdDQoNClRoZXJlIGFyZSBtYW55IHJlYXNvbnMgZm9yIG11bHRpcGxlIGV2ZW50 cyBpbiBhIFNFVC4gIFNvbWUgYXJlIGdvb2QsIHNvbWUgbm90IHNvIGdvb2QuIFNvbWUgb2YgdGhl IHJlYXNvbnMuLi4NCg0KMS4gIE11bHRpcGxlIGV2ZW50IHBheWxvYWRzIGV4cHJlc3Npbmcgc3Rh dGVtZW50cyBhYm91dCBsYXJnZWx5IHRoZSAqc2FtZSp0aGluZy4gRm9yIGV4YW1wbGUsIFNDSU0g cGFzc3dvcmQgcmVzZXQgQU5EIFJJU0MgcGFzc3dvcmQgcmVzZXQuICBBIFJJU0MgRXZlbnQgYW5k IGFuIE9wZW5CYW5raW5nIEV2ZW50LiBJcyBvbmUgYSBjb21wbGVtZW50IHRvIHRoZSBvdGhlcj8g IERvIHRoZXkgb3ZlcmxhcCBvciBhcmUgdGhleSBkaXN0aW5jdD8NCltyaWNoYW5uYV1Db3B5L3Bh c3RlZCBmcm9tIG15IGVhcmxpZXIgZW1haWw6DQpXaHkgaXMgaXQgbmVjZXNzYXJ5IG9yIGFwcHJv cHJpYXRlIHRvIGluY2x1ZGUgdGhlc2UgZXZlbnRzIGluIHRoZSBzYW1lIFNFVD8gVGhleSBhcmUg bGlrZWx5IGJlaW5nIGdlbmVyYXRlZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBhdCBkaWZmZXJlbnQg dGltZXMgb24gdGhlIHRyYW5zbWl0dGVy4oCZcyBzaWRlLCBjb25zdW1lZCBieSBkaWZmZXJlbnQg c3lzdGVtcyBvbiB0aGUgcmVjZWl2ZXLigJlzIHNpZGUsIGFuZCBwb3NzaWJseSBiZWluZyB0cmFu c21pdHRlZCBvdmVyIGRpZmZlcmVudCBldmVudCBzdHJlYW1zLiBJIGtub3cgdGhlIGxhdHRlciB3 b3VsZCBiZSB0aGUgY2FzZSBmb3IgdXMsIGFzIGEgcmVjZWl2ZXIuIEV2ZW4gaWYgaXTigJlzIG5v dCwgaXMgaXQgYnVyZGVuc29tZSB0byBzZW5kIHRoZXNlIGV2ZW50cyBzZXBhcmF0ZWx5PyBXaGF0 IHZhbHVlIGlzIGdhaW5lZCBpbiBjb21iaW5pbmcgdGhlbT8NCg0KQWRkaXRpb25hbGx5LCBzaW5j ZSB0aGUgc2lnbmF0dXJlIGlzIG92ZXIgdGhlIFNFVCBhbmQgbm90IHRoZSBldmVudCBvYmplY3Rz LCBSZWNlaXZlcnMgaW5kZXBlbmRlbnRseSByb3V0ZSBzZXBhcmF0ZSBldmVudHMgZnJvbSBhIHNp bmdsZSB0b2tlbiB3aXRob3V0IGVpdGhlciBsb3NpbmcgdGhlIGFiaWxpdHkgdG8gdmVyaWZ5IHRo ZSBhdXRoZW50aWNpdHkgb2YgdGhlIGV2ZW50IG9yIHNoYXJpbmcgYWxsIGluZm9ybWF0aW9uIGlu IHRoZSBTRVQgd2l0aCBldmVyeSBzeXN0ZW0gaGFuZGxpbmcgYW55IGV2ZW50IGluIHRoZSB0b2tl bi5bL3JpY2hhbm5hXQ0KDQoyLiAgTXVsdGlwbGUgZXZlbnRzIHBheWxvYWRzIGV4cHJlc3Npbmcg ZGlmZmVyZW50IHN0YXRlbWVudHMgYWJvdXQgdGhlIHNhbWUgdHJhbnNhY3Rpb24gLSBSSVNDIFBh c3N3b3JkIFJlc2V0IGFuZCBSSVNDIFNlc3Npb24gQ2FuY2VsDQpbcmljaGFubmFdU2FtZSBhcyBh Ym92ZVsvcmljaGFubmFdDQoNCjMuICBBIG5ldyBwcm9maWxlIGRlZmluZXMgbmV3IGV2ZW50IGF0 dHJpYnV0ZXMgdG8gYmUgYWRkZWQgb24gdG8gYW4gZXhpc3RpbmcgZXZlbnQgdHlwZSAoYSBwdXJl IGV4dGVuc2lvbikNCltyaWNoYW5uYV1JIGhhdmUgc3VnZ2VzdGVkIGEgd2F5IHRvIHN1cHBvcnQg ZXh0ZW5zaW9ucyB3aXRoaW4gYW4gZXZlbnQgYm9keSwgbXVsdGlwbGUgdGltZXMgbm93LiBJZiB5 b3Ugc2VlIHByb2JsZW1zIHdpdGggaXQsIHBsZWFzZSBwb2ludCB0aGVtIG91dC5bL3JpY2hhbm5h XQ0KDQpJIHRoaW5rIGl0IGlzIHF1aXRlIHZhbGlkIHRvIGFsbG93IDEgYW5kIDMuICAyIGNvdWxk IGJlIGxpbWl0ZWQgYnkgc3BlY2lmaWMgcHJvZmlsZXMgbGlrZSBSSVNDIGlmIHRoZXkgd2FudC4N Cg0KSSBhbSBub3QgaW4gYWdyZWVtZW50IHRoYXQgbWFraW5nIGV2ZW50IHNpbmd1bGFyIHNpbXBs aWZpZXMgYW55dGhpbmcuIEZvciBvbmUgaXMgbWFrZXMgZXh0ZW5zaW9ucyBjb21wbGV4IChhbm90 aGVyIG5lc3RlZCBKU09OIHN0cnVjdHVyZSkgYW5kIHBvdGVudGlhbGx5IGNvbmZsaWN0aW5nLg0K W3JpY2hhbm5hXQ0KV2F5cyB0aGF0IG11bHRpcGxlLWV2ZW50IFNFVHMgYXJlIG1vcmUgY29tcGxp Y2F0ZWQ6DQoNCiAgMS4gIEl0IHJlc3VsdHMgaW4gYSBtb3JlIGNvbXBsZXggc3RydWN0dXJlIGZv ciB0aGUgc2luZ2xlIGV2ZW50IHVzZSBjYXNlLCB3aGljaCBJIHRoaW5rIHdlIGFsbCBhZ3JlZSBp cyB0aGUgbWFqb3JpdHkgdXNlIGNhc2UuDQogIDIuICBNdWx0aXBsZS1ldmVudCBTRVRzIGhhdmUg YW1iaWd1b3VzIHNlbWFudGljcy4gVGhlIHByZXNlbmNlIG9mIHR3byBldmVudHMgQSBhbmQgQiBp biB0aGUgc2FtZSBTRVQgY291bGQgbWVhbiBhbnkgb2Y6DQoNCiAgICAgKiAgIFRoZXkgYXJlIHJl bGF0ZWQgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudCAoaS5lLiB0aGUgc2FtZSB0aGluZyBhcyBp ZiB0aGV5IHdlcmUgZnJvbSBkaWZmZXJlbnQgU0VUcyB0aGF0IGhhdmUgYSBjb21tb24gdHhuKS4N CiAgICAgKiAgIEEgaXMgYW4gZXh0ZW5zaW9uIG9mIEIuDQogICAgICogICBCIGlzIGFuIGV4dGVu c2lvbiBvZiBBLg0KICAgICAqICAgVGhleSBhcmUgYWxpYXNlcyBmb3Igb25lIGFub3RoZXIuDQog ICAgICogICBUaGV5IGFyZSBub3QgYWN0dWFsbHkgcmVsYXRlZCB0byBvbmUgYW5vdGhlciBpbiBh bnkgd2F5Lg0KDQogIDEuICBDbGFpbSBzZW1hbnRpY3MgYmVjb21lIGhhcmRlciB0byBkZWZpbmUs IGFzIGRpZmZlcmVudCBwcm9maWxlcyBtYXkgd2FudCB0byB1c2UgdGhlIHNhbWUgY2xhaW1zIGlu IGRpZmZlcmVudCB3YXlzLg0KDQpJZiB0aGUgV0cgd2FudHMgdG8gYmxvY2sgMSBhbmQgMiBhYm92 ZSwgdGhlbiBJIGJlbGlldmUgd2UgaGF2ZSB0byBlc3RhYmxpc2ggYW4gZXZlbnQgcmVnaXN0cnkg dG8gZW5zdXJlIG5ldyBFdmVudCBwcm9maWxlcyBkbyBub3Qgb3ZlcmxhcCB0byBlbGltaW5hdGUg dGhlIG5lZWQgdG8gZXhwcmVzcyBtdWx0aXBsZSBldmVudHMuDQpbcmljaGFubmFdSeKAmW0gbm90 IHN1cmUgd2hhdCB5b3UgbWVhbiBieSB0aGlzLiBBcmUgeW91IHJlZmVycmluZyB0byBldmVudCBu YW1lcz8gVGhvc2UgYXJlIGFscmVhZHkgZGVmaW5lZCBieSB0aGUgc3BlYyB0byBiZSBVUklzLlsv cmljaGFubmFdDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2Vy dmljZXMgQXJjaGl0ZWN0DQpAaW5kZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0 dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb20+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9jdCAyOSwgMjAxNywgYXQgNDoxMiBQTSwgRGlj ayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29t Pj4gd3JvdGU6DQoNClBoaWw6DQoNCkluIHlvdXIgZXhhbXBsZXMgZm9yIGhhdmluZyBhIHBsdXJh bGl0eSBvZiBldmVudHMsIHlvdSB1c2UgdGhlIHdvcmQgIm1heSIsIHdoaWNoIGxlYWRzIG1lIHRv IHF1ZXN0aW9uIGlmIGEgcGx1cmFsaXR5IG9mIGV2ZW50cyBpcyByZWFsbHkgcmVxdWlyZWQgaW4g U0VULg0KDQpZb3UgcG9zaXQgdGhhdCBpdCB3aWxsIGJlIGRpZmZpY3VsdCBmb3IgYSBkaXN0cmli dXRlZCBzeXN0ZW0gdG8gY29ycmVsYXRlIG11bHRpcGxlIFNFVHMgd2l0aCB0aGUgc2FtZSAidHhu IiwgYnV0IHRoZSBkaXN0cmlidXRlZCBzeXN0ZW0gd2lsbCBjZXJ0YWlubHkgbmVlZCB0byBjb3Jy ZWxhdGUgZXZlbnRzIG9uIHRoZSBzYW1lIHN1YmplY3QgLS0gY29ycmVsYXRpbmcgZXZlbnRzIG9u IHRoZSBzYW1lICJ0eG4iIG9uIHRoZSBzYW1lIHN1YmplY3Qgc2VlbXMgZmFpcmx5IHNpbXBsZS4N Cg0KSSB0aGluayB0aGF0IGEgcmVjZWl2ZXIgd2lsbCBuZWVkIHRvIGNvcnJlbGF0ZSBtdWx0aXBs ZSBTRXRzIG9uIHRoZSBzYW1lIHN1YmplY3QsIHNvIGhhdmluZyBtdWx0aXBsZSBldmVudHMgaW4g YSBTRVQgaXMgcmVkdW5kYW50LCBhbmQgYWRkcyBjb21wbGV4aXR5IHdpdGggbm8gY2xlYXIgYmVu ZWZpdCB0aGF0IEkgY2FuIHNlZS4NCg0KQW4gaW1wbGVtZW50b3IgbWF5IGNob29zZSB0byBzZW5k IG11bHRpcGxlIFNFVHMsIG9yIHNlbmQgYSBzaW5nbGUgU0VUIHdpdGggbXVsdGlwbGUgZXZlbnRz LCBzbyBhIHJlY2VpdmVyIHdpbGwgbmVlZCB0byBzdXBwb3J0IGJvdGguIEkgcHJlZmVyIHdlIHBp Y2sgb25lIHdheSBhbmQgbWluaW1pemUgdGhlIGNvZGUgcGF0aHMsIGFuZCB3ZSB3aWxsIG5lZWQg dG8gc3VwcG9ydCBjb3JyZWxhdGluZyBhY3Jvc3MgbXVsdGlwbGUgU0VUcywgc28gdGhhdCBzZWVt cyB0aGUgYmVzdCBtZWNoYW5pc20uDQoNCkxldCBtZSBrbm93IGlmIHRoZXJlIGlzIHNvbWV0aGlu ZyBJIG1pc3NlZCBpbiBteSBsb2dpYy4NCg0KL0RpY2sNCg0KDQpPbiBTdW4sIE9jdCAyOSwgMjAx NyBhdCAxMToyOCBBTSwgWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0 bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+PiB3cm90ZToNCkluIHRoYXQgY2FzZSwgbGV0J3MgYWRk IHRleHQgdG8gdGhhdCBlZmZlY3QsIGUuZy4gd2UgY291bGQgYWRkIHRvIHRoZSBkZWZpbml0aW9u IG9mIHRoZSAiZXZlbnRzIiBjbGFpbToNCg0KUHJvZmlsaW5nIHNwZWNpZmljYXRpb25zIFNIT1VM RCBkZWZpbmUgdGhlIGFsbG93ZWQgZXZlbnQgc3RhdGVtZW50cywgYW5kIE1BWSByZXN0cmljdCB0 aGVpciBudW1iZXIuIEZvciBleGFtcGxlLCBzb21lIHByb2ZpbGVzIG1heSByZXF1aXJlIHRoaXMg Y2xhaW0gdG8gY29udGFpbiBvbmx5IGEgc2luZ2xlIGV2ZW50IHN0YXRlbWVudC4NCg0KVGhhbmtz LA0KICAgICAgICBZYXJvbg0KDQpPbiAyNC8xMC8xNyAyMjoxMCwgTWlrZSBKb25lcyB3cm90ZToN CkkgYWdyZWUgd2l0aCBtdWNoIG9mIFBoaWzigJlzIHJhdGlvbmFsZSBoZXJlLg0KDQpJdOKAmXMg ZmluZSBmb3Igc29tZSBwcm9maWxlcyB0byBzYXkgdGhhdCB0aGUg4oCcZXZlbnRz4oCdIHNldCBt dXN0IGJlIGEgc2luZ2xldG9uLiAgVGhhdCBkb2VzbuKAmXQgaGF2ZSB0byBiZSB0cnVlIGZvciBh bGwgZXZlbnRzLiAgSSB0aGluayB0aGluZ3MgYXJlIGZpbmUgYXMtaXMuDQoNCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0g TWlrZQ0KDQoqRnJvbToqIElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9y ZzxtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz5dICpPbiBCZWhhbGYgT2YgKlBoaWwg SHVudA0KKlNlbnQ6KiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgODo0NyBQTQ0KKlRvOiogUmlj aGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb208bWFpbHRvOnJpY2hh bm5hQGFtYXpvbi5jb20+Pg0KKkNjOiogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRA aWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NCipTdWJqZWN0OiogUmU6IFtJZC1l dmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD8NCg0KQW5uYWJlbGxl LA0KDQpJIGhhdmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHByb3Bvc2FsLg0KDQpQ cm9maWxpbmcgSW5kZXBlbmRlbmNlIC8gS2VlcGluZyBFdmVudCBQYXlsb2FkcyBJbmRlcGVuZGVu dA0KDQpJbmRpY2F0aW5nIHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFuZGxlZCBieSBwcm9m aWxlcyBsZWFkcyB0byBtb3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBhbmQgbW9yZSBpbXBv cnRhbnRseSBpbnRydWRlcyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBieSBzdWdnZXN0aW5n IGEgc3ViLXNjaGVtYSBjcmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBhbmQgY29uZmxpY3Rz IHRoYXQgbWF5IGFkZCB0byBjb21wbGV4aXR5IGxhdGVyIG9uLiBUaGUgY3VycmVudCBmb3JtYXQg YWxsb3dzIGEgcGFyc2VyIHRvIGRpc2NvdmVyIGFuZCB1bmxvYWQgb25lIG9yIG1vcmUgSlNPTiBw YXlsb2FkcyB3aGljaCBjYW4gZWFjaCBoYXZlIGluZGVwZW5kZW50IHN0cnVjdHVyZS4NCg0KR2Vu ZXJhbCBleHRlbnNpb25zDQoNClRoZSBwcm9wb3NhbCBhbHNvIHJ1bGVzIG91dCBnZW5lcmFsIHB1 cnBvc2UgZXh0ZW5zaW9ucyBub3QgcmVsYXRlZCB0byBhbnkgc3BlY2lmaWMgZXZlbnQuIEdpdmVu IHRoZSBlbWVyZ2VuY2Ugb2YgaXRlbXMgbGlrZSBHUFJELCBJIHdvdWxkIG5vdCB3YW50IHRvIGJs b2NrIHRoZSBhYmlsaXR5IHRvIGFkZCBtZXRhLWRhdGEgb3Igb3RoZXIgZ2VuZXJhbCBwdXJwb3Nl IGl0ZW1zLiBXZSBjYW4gYWxzbyBhbnRpY2lwYXRlIHNvbWUgZGVsaXZlcnkgc2NlbmFyaW9zIHdo ZXJlIGFkZGl0aW9uYWwgZGF0YSBtaWdodCBiZSByZXF1aXJlZC4gRXZlbiB0aG91Z2ggdGhlcmUg aXMgbm8gY3VycmVudCBwbGFubmVkIHVzZSwgSSBzZWUgbm8gZ29vZCByZWFzb24gdG8gcnVsZSB0 aGlzIG91dC4NCg0KTXVsdGlwbGUgRXZlbnRzIEZyb20gRGlmZmVyZW50IEZhbWlsaWVzICh2cy4g TXVsdGlwbGUgRXZlbnRzIGZyb20gYSBzaW5nbGUgZmFtaWx5IGxpa2UgUklTQykNCg0KSW4gb3Vy IFJJU0Mgc2Vzc2lvbiB3ZSBkaXNjdXNzZWQgZXhwcmVzc2luZyBtdWx0aXBsZSBkaXN0aW5jdCBS SVNDIGV2ZW50cyBpbiBvbmUgU0VULiBUaGUgZGlzY3Vzc2lvbiB3YXMgdGhhdCBvbmx5IG9uZSBS SVNDIGV2ZW50IGF0IGEgdGltZS4gV2UgZGlkIG5vdCBkaXNjdXNzIG90aGVyIGV2ZW50IHByb2Zp bGVzLiBJIGRvbuKAmXQgc2VlIGEgcmVhc29uIHRvIHJ1bGUgb3V0IG11bHRpLWV2ZW50cyBmcm9t IGRpZmZlcmVudCBmYW1pbGllcyBhdCB0aGUgU0VUIGxldmVsLiBFYWNoIHByb2ZpbGUgaXMgZXhw cmVzc2luZyBzbGlnaHRseSBkaWZmZXJlbnQgdGhpbmdzIGFib3V0IHRoZSBzYW1lIGV2ZW50Lg0K DQpJIGNhbiBmb3JzZWUgc29tZSBjYXNlcyB3aGVyZSBpdCBpcyBub3QgY2xlYXIgd2hpY2ggaXMg dGhlIHByaW1hcnkgYW5kIHdoaWNoIGlzIHRoZSBleHRlbnNpb24uICBUaGVyZSBtYXkgbm90IGJl IGEgY2xlYXIgd2lubmVyLg0KDQpBIGNvdXBsZSBvZiBleGFtcGxlcyAodGhlc2UgYXJlIG5lY2Vz c2FyaWx5IHJlYWzigKZqdXN0IHBvc3NpYmlsaXRpZXMpOg0KDQoqIEl0IGlzIHByb2JhYmx5IHVz ZWZ1bCB0byBiZSBhYmxlIHRvIGV4cHJlc3Mgc2ltbGFyL292ZXJsYXBwaW5nIGV2ZW50cyBmcm9t IGRpZmZlcmVudCBTRVQgcHJvZmlsZXMgaW4gb25lIFNFVC4gIEZvciBleGFtcGxlIGEgQmFja2No YW5uZWwgTG9nb3V0ICYgYSBSSVNDIHNlc3Npb24gY2FuY2VsIGV2ZW50Lg0KDQoqIFNDSU0gbWF5 IHdhbnQgdG8gcmVwcmVzZW50IGEgc2luZ2xlIHRyYW5zYWN0aW9uIGFzIGNhdXNpbmcgbXVsdGlw bGUgc3RhdGUgY2hhbmdlcyBpbiBhbiBldmVudCAoZS5nLiBhIHBhc3N3b3JkIGNoYW5nZSBjYXVz ZXMgbXVsdGlwbGUgZWZmZWN0cykuIEhhdmluZyB0byBjaGFzZSBkb3duIG11bHRpcGxlIGV2ZW50 cyBhbmQgY29ycmVsYXRlIGJ5IOKAnHR4buKAnSB3b3VsZCBiZSBjaGFsbGVuZ2luZyBpbiBhIG11 bHRpLXRocmVhZGVkL211bHRpLW5vZGUgZGVsaXZlcnkgc3lzdGVtLiAgIFRoZSBTQ0lNIGxpc3Qg aGFzIG5vdCBkaXNjdXNzZWQgdGhpcywgYnV0IEkgd291bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhp cyBjYXBhYmlsaXR5LiAgSU9XIC0gSnVzdCBiZWNhdXNlIFJJU0MgZG9lcyBub3Qgd2FudCB0byBl eHByZXNzIG11bHRpcGxlIGV2ZW50cyBkb2VzIG5vdCBtYWtlIHRoaXMgdHJ1ZSBmb3Igb3RoZXIg cHJvZmlsZXMuDQoNCiogV2UgbWF5IHdpc2ggdG8gaW5kaWNhdGUgYSBTQ0lNIFBhc3N3b3JkIFJl c2V0IHdhcyBwZXJmb3JtZWQgYW5kIGEgTG9nb3V0L3Nlc3Npb24gY2FuY2VsbGF0aW9uIGlzIGV4 cHJlc3NlZCBhdCB0aGUgc2FtZSB0aW1lLiAgVGhlIGV2ZW50cyBhcmUgcmVsYXRlZCBidXQgZXhw cmVzcyBkaWZmZXJlbnQgZGF0YS4NCg0KQXZvaWRpbmcgQ29uZnVzaW9uIEZyb20gU2ltaWxhciBF dmVudHMgT3JpZ2luYXRpbmcgZnJvbSB0aGUgU2FtZSBUcmFuc2FjdGlvbg0KDQpJZiBldmVudHMg YXJlIHNlbnQgc2VwYXJhdGVseSwgdGhlbiBtb3JlIHRyYWNraW5nIG9mIHN0YXRlIChlLmcuIGJ5 IHR4bikgd291bGQgYmUgcmVxdWlyZWQgdG8gZW5zdXJlIHNpbWlsYXIgZXZlbnRzIGFyZSBub3Qg bWlzdGFrZW4gb3IgaGFuZGxlZCBhcyByZXBlYXRzLiBXaGlsZSB0eG4gcHJvdmlkZXMgdXNlZnVs IGF1ZGl0IGFuYWx5c2lzIGNhcGFiaWxpdHksIEnigJltIG5vdCBzdXJlIGl0IGNhbiBiZSB1c2Vk IGluIGxpdmUgb3IgbmVhci1yZWFsIHRpbWUgc3lzdGVtcyBnaXZlbiBkaXN0cmlidXRlZCBtdWx0 aS1ub2RlLCBtdWx0aS10aHJlYWRpbmcgYXJjaGl0ZWN0dXJlcy4NCg0KUHJldmlvdXMgRGlzY3Vz c2lvbg0KDQpJIG5vdGUgdGhhdCBJIG9yaWdpbmFsbHkgcmFpc2VkIGhhdmluZyBhbiBhdHRyaWJ1 dGUgdG8gZGVzaWduYXRlIHByaW1hcnkgZXZlbnQgYXR0cmlidXRlIHRvIGFsbGV2aWF0ZSB5b3Vy IGNvbmNlcm4sIGJ1dCB0aGlzIHdhcyBub3QgYWNjZXB0ZWQuIFNlZToNCg0KKiBodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYuaHRt bDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3 dy5pZXRmLm9yZ19tYWlsLTJEYXJjaGl2ZV93ZWJfaWQtMkRldmVudF9jdXJyZW50X21zZzAwNDA2 Lmh0bWwmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElf Sm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0ds SzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz1TM3NNVmlxTXZFZ253R2JK d09RTnljck95cjdTZWZwcV9Nb0ZPS2NFZUNFJmU9Pg0KDQoqIGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQvY3VycmVudC9tc2cwMDE0MC5odG1sPGh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2ZW50X2N1cnJlbnRfbXNnMDAxNDAuaHRtbCZkPUR3 TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVG VnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNq LTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPUd5OWd5Um9JSXRhLWNTaFY3Yk4xNjFheTR5 RTZyOUcxX0FhX05lQm55bGcmZT0+DQoNClRoZSBjb25zZW5zdXMsIGF0IGxlYXN0IGFzIEkgaW50 ZXJwcmV0ZWQgaXQgaXMgdXAgdG8gdGhlIHJlY2VpdmVyIHRvIGZpZ3VyZSB0aGlzIG91dCBiYXNl ZCBvbiB0aGUgZGVmaW5pdGlvbnMgaXQgaGFzIGZvciBlYWNoIGV2ZW50IFVSSSBhbmQgdGhlIHBy b2ZpbGVzIHRoZXkgcmVwcmVzZW50LiBJT1cgLSBSSVNDIGlzIGZyZWUgdG8gbGltaXQgdGhhdCBv bmx5IG9uZSBSSVNDIGV2ZW50IGJlIGV4cHJlc3NlZCBhdCBhIHRpbWUuDQoNClBoaWwNCg0KT3Jh Y2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QNCg0KQGlu ZGVwZW5kZW50aWQNCg0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mZD1E d01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1 RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0dsSzltampoY0Zz ai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz05TlA1bmFtZzZySVZ6d3VuOWMtMXEwd2hz eVh3U3Z0SEIwZjJkS2tmQ1g4JmU9PiA8aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVw ZW5kZW50aWQuY29tJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVC NjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEm bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JnM9OU5QNW5hbWc2 cklWend1bjljLTFxMHdoc3lYd1N2dEhCMGYyZEtrZkNYOCZlPT4+DQoNCnBoaWwuaHVudEBvcmFj bGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4gPG1haWx0bzpwaGlsLmh1bnRAb3Jh Y2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+Pg0KDQogICAgT24gT2N0IDIzLCAy MDE3LCBhdCA3OjAyIFBNLCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZQ0KICAgIDxyaWNoYW5u YUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tPiA8bWFpbHRvOnJpY2hhbm5h QGFtYXpvbi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+Pj4gd3JvdGU6DQoNCiAgICBU aGUgY3VycmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMgYWxsb3dzIGZvciBleHByZXNzaW5nIG11 bHRpcGxlDQogICAgZXZlbnRzIHdpdGhpbiB0aGUgc2FtZSB0b2tlbiwgd2hpY2ggaW50cm9kdWNl cyBhZGRpdGlvbmFsIGNvbXBsZXhpdHkNCiAgICBhbmQgcm9vbSBmb3IgYW1iaWd1b3VzIHNlbWFu dGljcy4gV2XigJl2ZSBkaXNjdXNzZWQgdGhpcyBpbiB0aGUgT0lERg0KICAgIFJJU0Mgd29ya2lu ZyBncm91cCBhbmQgdGhlIGN1cnJlbnQgY29uc2Vuc3VzIHRoZXJlIGlzIHRoYXQgUklTQyB3aWxs DQogICAgcmVxdWlyZSB0aGF0IFJJU0MgZXZlbnRzIG11c3QgYmUgdGhlIG9ubHkgZXZlbnQgaW4g dGhlIFNFVCwgaGF2aW5nDQogICAgaWRlbnRpZmllZCB3YXlzIHRvIGNsZWFybHkgYW5kIGVhc2ls eSBzdXBwb3J0IHRoZSBoYW5kZnVsIG9mIHVzZQ0KICAgIGNhc2VzIGZvciBtdWx0aXBsZSBldmVu dHMgcGVyIHRva2VuIHRoYXQgcGVvcGxlIGhhdmUgcmFpc2VkLiBXaXRoDQogICAgdGhhdCBjb250 ZXh0IGluIG1pbmQsIEkgcHJvcG9zZSBzdHJpa2luZyB0aGUgZGVmaW5pdGlvbiBvZiB0aGUNCiAg ICDigJxldmVudHPigJ0gY2xhaW0gZnJvbSB0aGUgU2VjdXJpdHkgRXZlbnQgVG9rZW4gc3BlYywg YW5kIHJlcGxhY2luZyBpdA0KICAgIHdpdGggdGhlIGZvbGxvd2luZyBkZWZpbml0aW9uIGZvciBh biDigJxldmVudOKAnSBjbGFpbSAoc2luZ3VsYXIpOg0KDQogICAgZXZlbnQNCg0KICAgIEEgSlNP TiBvYmplY3QgY29udGFpbmluZyBhbiAiZXZlbnRfdHlwZSIgbWVtYmVyIHdob3NlIHZhbHVlIGlz IGEgVVJJDQogICAgcmVwcmVzZW50aW5nIGEgdHlwZSBvZiBldmVudCBkZWZpbmVkIGluIGEgUHJv ZmlsaW5nIFNwZWNpZmljYXRpb24uDQogICAgVGhlIG9iamVjdCBNQVkgb3RoZXJ3aXNlIGJlIGVt cHR5LCBvciBNQVkgY29udGFpbiBhZGRpdGlvbmFsIG1lbWJlcnMNCiAgICBhcyBkZXNjcmliZWQg YnkgdGhlIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLg0KDQogICAgSGVyZSBpcyB0aGUgZXhhbXBs ZSBTRVQgZnJvbSBzZWN0aW9uIDIuMywgcmV3cml0dGVuIHdpdGggdGhpcyBjaGFuZ2UNCiAgICBt aW5kOg0KDQogICAgew0KDQogICAgICAgImp0aSI6ICI0ZDM1NTllYzY3NTA0YWFiYTY1ZDQwYjAz NjNmYWFkOCIsDQoNCiAgICAgICAiaWF0IjogMTQ1ODQ5NjQwNCwNCg0KICAgICAgImlzcyI6ICJo dHRwczovL3NjaW0uZXhhbXBsZS5jb208aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tLz4gPGh0dHBz Oi8vc2NpbS5leGFtcGxlLmNvbS8+IiwNCg0KICAgICAgICJhdWQiOiBbDQoNCiAgICAgICAgICJo dHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIs DQoNCiAgICAgICAgICJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFk MDg2NDFkNzY3NmVlNyINCg0KICAgICAgIF0sDQoNCiAgICAgICAiZXZlbnQiOiB7DQoNCiAgICAg ICAgICJldmVudF90eXBlIjogInVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OmNyZWF0ZSIsDQoN CiAgICAgICAgICJyZWYiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJk Zjk2YmQ2YWI2MWU3NTIxZDkiLA0KDQogICAgICAgICAiYXR0cmlidXRlcyI6IFsiaWQiLCAibmFt ZSIsICJ1c2VyTmFtZSIsICJwYXNzd29yZCIsICJlbWFpbHMiXQ0KDQogICAgICAgfQ0KDQogICAg fQ0KDQogICAgRG9lcyBhbnlvbmUgaW4gdGhlIHdvcmtpbmcgZ3JvdXAgaGF2ZSB1c2UgY2FzZXMg Zm9yIFNFVHMgdGhhdCBjYW5ub3QNCiAgICBiZSBtZXQgYnkgdGhpcyBwcm9wb3NlZCB0ZXh0PyBX aXRoaW4gUklTQywgd2UgaWRlbnRpZmllZCB0aHJlZSB1c2UNCiAgICBjYXNlcywgd2l0aCBzb2x1 dGlvbnMgb3V0bGluZWQgYmVsb3c6DQoNCiAgICAqKg0KDQogICAgKkV4dGVuc2lvbnMqDQoNCiAg ICBFdmVudCBleHRlbnNpb24gbWVjaGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0 aGUgZXZlbnQNCiAgICBvYmplY3QuIEEgc2ltcGxlIGFwcHJvYWNoIHdvdWxkIGJlIHRvICBkZWZp bmUgYW4g4oCcZXh0ZW5zaW9uc+KAnSBtZW1iZXINCiAgICB0aGF0IGlzIGEgbGlzdCBvZiBldmVu dCBvYmplY3RzIChvciBzZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCdDQogICAgY2xhaW0g YXMgZGVmaW5lZCBpbiB0aGUgY3VycmVudCBzcGVjKS4gVGhpcyBoYXMgdGhlIGFkdmFudGFnZSBv Zg0KICAgIG1ha2luZyBpdCBjbGVhciBpbiB0aGUgZGF0YSBzdHJ1Y3R1cmUgdGhhdCB0aGVyZSBp cyBhIHNpbmdsZSBwcmltYXJ5DQogICAgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lv bnMuIFRoZXJlIGlzIG5vIHJvb20gZm9yIGNvbmZ1c2lvbg0KICAgIG92ZXIgd2hpY2ggZXZlbnQg aXMgcHJpbWFyeSwgb3IgaWYgdGhlcmUgaXMgYSBwcmltYXJ5IGV2ZW50IGF0IGFsbC4NCiAgICBJ IHdvdWxkIGJlIGZpbmUgd2l0aCBhZGRpbmcgc29tZXRoaW5nIGxpa2UgdGhpcyB0byBteSBwcm9w b3NlZCB0ZXh0LA0KICAgIGlmIHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkg dXNlZnVsLg0KDQogICAgKkFsaWFzZXMqDQoNCiAgICBUaGlzIHVzZSBjYXNlIHdhcyBicm91Z2h0 IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRzDQogICAgZnJvbSBkcmFmdCBl dmVudCBuYW1lcyB0byBzdGFuZGFyZGl6ZWQgZXZlbnQgbmFtZXMuIEluIHRoaXMgY2FzZSwNCiAg ICB0aGUgZXZlbnQgdHJhbnNtaXR0ZXIgY2FuIHRyYW5zbWl0IHR3byB0b2tlbnMgZm9yIHRoZSBs b2dpY2FsIGV2ZW50LA0KICAgIG9uZSB1c2luZyB0aGUgb2xkIG5hbWUgYW5kIGFub3RoZXIgdXNp bmcgdGhlIG5ldyBuYW1lLg0KDQogICAgKlJlbGF0ZWQgRXZlbnRzKg0KDQogICAgVGhlIFNFVCBz cGVjIGRlZmluZXMgdGhlIHR4biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJlbGF0aW5nDQogICAg aW5kZXBlbmRlbnQgdG9rZW5zIHRoYXQgcmVsYXRlIHRvIHRoZSBzYW1lIGxvZ2ljYWwgZXZlbnQu DQoNCiAgICAtLQ0KICAgIEFubmFiZWxsZSBSaWNoYXJkIEJhY2ttYW4NCg0KICAgIEFtYXpvbiDi gJMgSWRlbnRpdHkgU2VydmljZXMNCg0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQogICAgSWQtZXZlbnQgbWFpbGluZyBsaXN0DQogICAgSWQtZXZl bnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPiA8bWFpbHRvOklkLWV2ZW50QGll dGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4+DQogICAgaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9s aXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktD WDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENf bExJR2smbT1zNWJ5QmU1S0FObkdWdUFiMW1BdXBFR29KbjhYRzVKSVVVd1dHRlNpYkVjJnM9WDhv UlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZkNGVFWmZneW9JWSZlPQ0KDQoNCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxp bmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDxodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWls bWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBa aDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkx YUxjTE40S1pOQSZtPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcm cz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmU9Pg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFp bGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21h aWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4 UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtB STFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFp dyZzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZLMDJFWHMmZT0+DQoNCg0K DQotLQ0KU3Vic2NyaWJlIHRvIHRoZSBIQVJEVFdBUkU8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2hhcmR0d2FyZS5jb21fJmQ9RHdNRmFRJmM9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFX Tnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1 eHVydWliOUtBVGtSbFFHMWl3JnM9TFlONzJHZ0tWaEhzVDZ0QXFCZS1lTW9XTXZ5XzdkZkZuMXVa MEhLNll1USZlPT4gbWFpbCBsaXN0IHRvIGxlYXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2lu ZyBvbiENCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdt YW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtu MzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6Ymhj VzAwMWZLMDJFWHMmZT0NCg0K --_000_65C74B5D9BDE4FEA9D020F041DC11A0Famazoncom_ Content-Type: text/html; charset="utf-8" Content-ID: <4B58CA4C44E8F5439C48E586F9A0D63A@amazon.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHls ZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGlu ZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0 UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsNCglt YXJnaW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41aW47 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1z dHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UN Cgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHls ZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNv LXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1z dHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNl Y3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAx LjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3Qg RGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjIxMDYwNzU4NDE7DQoJbXNv LWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi01NjgwMTQ5ODAgNjc2 OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3 MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFs cGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6 LTkuMHB0O30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBs aXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlz dCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDgN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9t YW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRv bTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4N Cjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1 cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPlJlcGxpZXMgaW5saW5lLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+LS0mbmJzcDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2Vy aWYiPkFubmFiZWxsZSBSaWNoYXJkIEJhY2ttYW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWls eTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPklkZW50aXR5IFNlcnZpY2VzPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0 O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkZyb206IDwvc3Bhbj48L2I+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPlBoaWwgSHVudCAmbHQ7 cGhpbC5odW50QG9yYWNsZS5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlN1bmRheSwgT2N0b2Jl ciAyOSwgMjAxNyBhdCA1OjI1IFBNPGJyPg0KPGI+VG86IDwvYj5EaWNrIEhhcmR0ICZsdDtkaWNr LmhhcmR0QGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5DYzogPC9iPllhcm9uIFNoZWZmZXIgJmx0O3lh cm9uZi5pZXRmQGdtYWlsLmNvbSZndDssIE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbSZndDssICZxdW90O1JpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlJnF1b3Q7ICZs dDtyaWNoYW5uYUBhbWF6b24uY29tJmd0OywgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7aWQt ZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlJlOiBbSWQtZXZlbnRdIFVz ZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/PG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGhvcGUgdGhpcyBhbnN3 ZXJzIHlvdXIgcXVlc3Rpb24uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk15IOKAnG1heeKAnSB3YXMgYmVjYXVzZSBJIGNhbuKAmXQgc2VlIGEg cmVhc29uIHdoeSBub3QuIFRoZSBxdWVzdGlvbiBzaG91bGQgYmUsIHdoYXQgaXMgdGhlIGp1c3Rp ZmljYXRpb24gdG8gbWFrZSDigJxldmVudHPigJ0gc2luZ3VsYXI/PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+W3JpY2hhbm5h XVRoZSBzaW5ndWxhciDigJxldmVudOKAnSBjbGFpbSBoYXMgY2xlYXJlciBzZW1hbnRpY3MgYW5k IGlzIGVhc2llciB0byBwcm9jZXNzLiBXZSBzaG91bGQgb3B0IGZvciBlYXNpZXIgc29sdXRpb25z IHVubGVzcyB0aGVyZSBhcmUgdXNlIGNhc2VzIHRoYXQgcmVxdWlyZSBtb3JlIGNvbXBsZXhpdHku Wy9yaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRoZXJlIGFyZSBtYW55IHJlYXNvbnMgZm9yIG11bHRpcGxlIGV2ZW50 cyBpbiBhIFNFVC4gJm5ic3A7U29tZSBhcmUgZ29vZCwgc29tZSBub3Qgc28gZ29vZC4gU29tZSBv ZiB0aGUgcmVhc29ucy4uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4xLiAmbmJzcDtNdWx0aXBsZSBldmVudCBwYXlsb2FkcyBleHByZXNzaW5n IHN0YXRlbWVudHMgYWJvdXQgbGFyZ2VseSB0aGUgKnNhbWUqdGhpbmcuIEZvciBleGFtcGxlLCBT Q0lNIHBhc3N3b3JkIHJlc2V0IEFORCBSSVNDIHBhc3N3b3JkIHJlc2V0LiAmbmJzcDtBIFJJU0Mg RXZlbnQgYW5kIGFuIE9wZW5CYW5raW5nIEV2ZW50LiBJcyBvbmUgYSBjb21wbGVtZW50IHRvIHRo ZSBvdGhlcj8gJm5ic3A7RG8gdGhleSBvdmVybGFwIG9yIGFyZQ0KIHRoZXkgZGlzdGluY3Q/ICZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiNDMzQ2RTAiPltyaWNoYW5uYV1Db3B5L3Bhc3RlZCBmcm9tIG15IGVhcmxpZXIgZW1haWw6 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOiNDMzQ2RTAiPldoeSBpcyBpdCBuZWNlc3Nhcnkgb3IgYXBwcm9wcmlhdGUgdG8gaW5j bHVkZSB0aGVzZSBldmVudHMgaW4gdGhlIHNhbWUgU0VUPyBUaGV5IGFyZSBsaWtlbHkgYmVpbmcg Z2VuZXJhdGVkIGJ5IGRpZmZlcmVudCBzeXN0ZW1zIGF0IGRpZmZlcmVudCB0aW1lcyBvbiB0aGUg dHJhbnNtaXR0ZXLigJlzIHNpZGUsIGNvbnN1bWVkIGJ5IGRpZmZlcmVudCBzeXN0ZW1zIG9uDQog dGhlIHJlY2VpdmVy4oCZcyBzaWRlLCBhbmQgcG9zc2libHkgYmVpbmcgdHJhbnNtaXR0ZWQgb3Zl ciBkaWZmZXJlbnQgZXZlbnQgc3RyZWFtcy4gSSBrbm93IHRoZSBsYXR0ZXIgd291bGQgYmUgdGhl IGNhc2UgZm9yIHVzLCBhcyBhIHJlY2VpdmVyLiBFdmVuIGlmIGl04oCZcyBub3QsIGlzIGl0IGJ1 cmRlbnNvbWUgdG8gc2VuZCB0aGVzZSBldmVudHMgc2VwYXJhdGVseT8gV2hhdCB2YWx1ZSBpcyBn YWluZWQgaW4gY29tYmluaW5nIHRoZW0/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0 NkUwIj5BZGRpdGlvbmFsbHksIHNpbmNlIHRoZSBzaWduYXR1cmUgaXMgb3ZlciB0aGUgU0VUIGFu ZCBub3QgdGhlIGV2ZW50IG9iamVjdHMsIFJlY2VpdmVycyBpbmRlcGVuZGVudGx5IHJvdXRlIHNl cGFyYXRlIGV2ZW50cyBmcm9tIGEgc2luZ2xlIHRva2VuIHdpdGhvdXQgZWl0aGVyIGxvc2luZyB0 aGUgYWJpbGl0eSB0byB2ZXJpZnkgdGhlIGF1dGhlbnRpY2l0eSBvZiB0aGUNCiBldmVudCBvciBz aGFyaW5nIGFsbCBpbmZvcm1hdGlvbiBpbiB0aGUgU0VUIHdpdGggZXZlcnkgc3lzdGVtIGhhbmRs aW5nIGFueSBldmVudCBpbiB0aGUgdG9rZW4uWy9yaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Mi4gJm5ic3A7TXVsdGlwbGUgZXZlbnRzIHBheWxvYWRzIGV4cHJlc3NpbmcgZGlmZmVy ZW50IHN0YXRlbWVudHMgYWJvdXQgdGhlIHNhbWUgdHJhbnNhY3Rpb24gLSBSSVNDIFBhc3N3b3Jk IFJlc2V0IGFuZCBSSVNDIFNlc3Npb24gQ2FuY2VsPGJyPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiND MzQ2RTAiPltyaWNoYW5uYV1TYW1lIGFzIGFib3ZlWy9yaWNoYW5uYV08YnI+DQo8YnI+DQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4z LiAmbmJzcDtBIG5ldyBwcm9maWxlIGRlZmluZXMgbmV3IGV2ZW50IGF0dHJpYnV0ZXMgdG8gYmUg YWRkZWQgb24gdG8gYW4gZXhpc3RpbmcgZXZlbnQgdHlwZSAoYSBwdXJlIGV4dGVuc2lvbikmbmJz cDs8YnI+DQo8c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+W3JpY2hhbm5hXUkgaGF2ZSBzdWdn ZXN0ZWQgYSB3YXkgdG8gc3VwcG9ydCBleHRlbnNpb25zIHdpdGhpbiBhbiBldmVudCBib2R5LCBt dWx0aXBsZSB0aW1lcyBub3cuIElmIHlvdSBzZWUgcHJvYmxlbXMgd2l0aCBpdCwgcGxlYXNlIHBv aW50IHRoZW0gb3V0LlsvcmljaGFubmFdPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIGl0IGlzIHF1aXRlIHZhbGlkIHRv IGFsbG93IDEgYW5kIDMuICZuYnNwOzIgY291bGQgYmUgbGltaXRlZCBieSBzcGVjaWZpYyBwcm9m aWxlcyBsaWtlIFJJU0MgaWYgdGhleSB3YW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFtIG5vdCBpbiBhZ3JlZW1lbnQgdGhhdCBtYWtp bmcgZXZlbnQgc2luZ3VsYXIgc2ltcGxpZmllcyBhbnl0aGluZy4gRm9yIG9uZSBpcyBtYWtlcyBl eHRlbnNpb25zIGNvbXBsZXggKGFub3RoZXIgbmVzdGVkIEpTT04gc3RydWN0dXJlKSBhbmQgcG90 ZW50aWFsbHkgY29uZmxpY3RpbmcuJm5ic3A7PGJyPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2 RTAiPltyaWNoYW5uYV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+V2F5cyB0aGF0IG11bHRpcGxlLWV2ZW50IFNF VHMgYXJlIG1vcmUgY29tcGxpY2F0ZWQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPG9sIHN0eWxl PSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6 bDAgbGV2ZWwxIGxmbzEiPg0KSXQgcmVzdWx0cyBpbiBhIG1vcmUgY29tcGxleCBzdHJ1Y3R1cmUg Zm9yIHRoZSBzaW5nbGUgZXZlbnQgdXNlIGNhc2UsIHdoaWNoIEkgdGhpbmsgd2UgYWxsIGFncmVl IGlzIHRoZSBtYWpvcml0eSB1c2UgY2FzZS48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttYXJnaW4tbGVmdDowaW47bXNvLWxp c3Q6bDAgbGV2ZWwxIGxmbzEiPg0KTXVsdGlwbGUtZXZlbnQgU0VUcyBoYXZlIGFtYmlndW91cyBz ZW1hbnRpY3MuIFRoZSBwcmVzZW5jZSBvZiB0d28gZXZlbnRzIEEgYW5kIEIgaW4gdGhlIHNhbWUg U0VUIGNvdWxkIG1lYW4gYW55IG9mOjxvOnA+PC9vOnA+PC9saT48L29sPg0KPG9sIHN0eWxlPSJt YXJnaW4tdG9wOjBpbiIgc3RhcnQ9IjIiIHR5cGU9IjEiPg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9w OjBpbiIgc3RhcnQ9IjEiIHR5cGU9ImEiPg0KPGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBz dHlsZT0iY29sb3I6I0MzNDZFMDttYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwyIGxm bzEiPg0KVGhleSBhcmUgcmVsYXRlZCB0byB0aGUgc2FtZSBsb2dpY2FsIGV2ZW50IChpLmUuIHRo ZSBzYW1lIHRoaW5nIGFzIGlmIHRoZXkgd2VyZSBmcm9tIGRpZmZlcmVudCBTRVRzIHRoYXQgaGF2 ZSBhIGNvbW1vbiB0eG4pLjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3Jh cGgiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZl bDIgbGZvMSI+DQpBIGlzIGFuIGV4dGVuc2lvbiBvZiBCLjxvOnA+PC9vOnA+PC9saT48bGkgY2xh c3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21hcmdpbi1sZWZ0OjBp bjttc28tbGlzdDpsMCBsZXZlbDIgbGZvMSI+DQpCIGlzIGFuIGV4dGVuc2lvbiBvZiBBLjxvOnA+ PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJjb2xvcjojQzM0 NkUwO21hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDIgbGZvMSI+DQpUaGV5IGFyZSBh bGlhc2VzIGZvciBvbmUgYW5vdGhlci48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6 bDAgbGV2ZWwyIGxmbzEiPg0KVGhleSBhcmUgbm90IGFjdHVhbGx5IHJlbGF0ZWQgdG8gb25lIGFu b3RoZXIgaW4gYW55IHdheS48bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjwvb2w+DQo8b2wgc3R5bGU9 Im1hcmdpbi10b3A6MGluIiBzdGFydD0iMyIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQ YXJhZ3JhcGgiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDps MCBsZXZlbDEgbGZvMSI+DQpDbGFpbSBzZW1hbnRpY3MgYmVjb21lIGhhcmRlciB0byBkZWZpbmUs IGFzIGRpZmZlcmVudCBwcm9maWxlcyBtYXkgd2FudCB0byB1c2UgdGhlIHNhbWUgY2xhaW1zIGlu IGRpZmZlcmVudCB3YXlzLjxvOnA+PC9vOnA+PC9saT48L29sPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB0aGUgV0cgd2FudHMgdG8gYmxvY2sgMSBhbmQgMiBhYm92 ZSwgdGhlbiBJIGJlbGlldmUgd2UgaGF2ZSB0byBlc3RhYmxpc2ggYW4gZXZlbnQgcmVnaXN0cnkg dG8gZW5zdXJlIG5ldyBFdmVudCBwcm9maWxlcyBkbyBub3Qgb3ZlcmxhcCB0byBlbGltaW5hdGUg dGhlIG5lZWQgdG8gZXhwcmVzcyBtdWx0aXBsZSBldmVudHMuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZF MCI+W3JpY2hhbm5hXUnigJltIG5vdCBzdXJlIHdoYXQgeW91IG1lYW4gYnkgdGhpcy4gQXJlIHlv dSByZWZlcnJpbmcgdG8gZXZlbnQgbmFtZXM/IFRob3NlIGFyZSBhbHJlYWR5IGRlZmluZWQgYnkg dGhlIHNwZWMgdG8gYmUgVVJJcy5bL3JpY2hhbm5hXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0 aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3Q8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6YmxhY2siPkBpbmRlcGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBo cmVmPSJodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208 L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9 Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE9jdCAyOSwgMjAx NywgYXQgNDoxMiBQTSwgRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRA Z21haWwuY29tIj5kaWNrLmhhcmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+UGhp bDoNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiB5b3VyIGV4YW1w bGVzIGZvciBoYXZpbmcgYSBwbHVyYWxpdHkgb2YgZXZlbnRzLCB5b3UgdXNlIHRoZSB3b3JkICZx dW90O21heSZxdW90Oywgd2hpY2ggbGVhZHMgbWUgdG8gcXVlc3Rpb24gaWYgYSBwbHVyYWxpdHkg b2YgZXZlbnRzIGlzIHJlYWxseSByZXF1aXJlZCBpbiBTRVQuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+WW91IHBvc2l0IHRoYXQgaXQgd2lsbCBiZSBkaWZm aWN1bHQgZm9yIGEgZGlzdHJpYnV0ZWQgc3lzdGVtIHRvIGNvcnJlbGF0ZSBtdWx0aXBsZSBTRVRz IHdpdGggdGhlIHNhbWUgJnF1b3Q7dHhuJnF1b3Q7LCBidXQgdGhlIGRpc3RyaWJ1dGVkIHN5c3Rl bSB3aWxsIGNlcnRhaW5seSBuZWVkIHRvIGNvcnJlbGF0ZSBldmVudHMNCiBvbiB0aGUgc2FtZSBz dWJqZWN0IC0tIGNvcnJlbGF0aW5nIGV2ZW50cyBvbiB0aGUgc2FtZSAmcXVvdDt0eG4mcXVvdDsg b24gdGhlIHNhbWUgc3ViamVjdCBzZWVtcyBmYWlybHkgc2ltcGxlLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgdGhpbmsgdGhhdCBhIHJlY2VpdmVyIHdp bGwgbmVlZCB0byBjb3JyZWxhdGUgbXVsdGlwbGUgU0V0cyBvbiB0aGUgc2FtZSBzdWJqZWN0LCBz byBoYXZpbmcgbXVsdGlwbGUgZXZlbnRzIGluIGEgU0VUIGlzIHJlZHVuZGFudCwgYW5kIGFkZHMg Y29tcGxleGl0eSB3aXRoIG5vIGNsZWFyIGJlbmVmaXQNCiB0aGF0IEkgY2FuIHNlZS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5BbiBpbXBsZW1lbnRvciBt YXkgY2hvb3NlIHRvIHNlbmQgbXVsdGlwbGUgU0VUcywgb3Igc2VuZCBhIHNpbmdsZSBTRVQgd2l0 aCBtdWx0aXBsZSBldmVudHMsIHNvIGEgcmVjZWl2ZXIgd2lsbCBuZWVkIHRvIHN1cHBvcnQgYm90 aC4gSSBwcmVmZXIgd2UgcGljayBvbmUgd2F5IGFuZCBtaW5pbWl6ZQ0KIHRoZSBjb2RlIHBhdGhz LCBhbmQgd2Ugd2lsbCBuZWVkIHRvIHN1cHBvcnQgY29ycmVsYXRpbmcgYWNyb3NzIG11bHRpcGxl IFNFVHMsIHNvIHRoYXQgc2VlbXMgdGhlIGJlc3QgbWVjaGFuaXNtLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkxldCBtZSBrbm93IGlmIHRoZXJlIGlzIHNv bWV0aGluZyBJIG1pc3NlZCBpbiBteSBsb2dpYy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj4vRGljazxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIFN1biwgT2N0IDI5 LCAyMDE3IGF0IDExOjI4IEFNLCBZYXJvbiBTaGVmZmVyPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZA Z21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDs8 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+d3JvdGU6PG86 cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJn aW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWYiPkluIHRoYXQgY2FzZSwgbGV0J3MgYWRkIHRleHQgdG8gdGhhdCBlZmZl Y3QsIGUuZy4gd2UgY291bGQgYWRkIHRvIHRoZSBkZWZpbml0aW9uIG9mIHRoZSAmcXVvdDtldmVu dHMmcXVvdDsgY2xhaW06PGJyPg0KPGJyPg0KUHJvZmlsaW5nIHNwZWNpZmljYXRpb25zIFNIT1VM RCBkZWZpbmUgdGhlIGFsbG93ZWQgZXZlbnQgc3RhdGVtZW50cywgYW5kIE1BWSByZXN0cmljdCB0 aGVpciBudW1iZXIuIEZvciBleGFtcGxlLCBzb21lIHByb2ZpbGVzIG1heSByZXF1aXJlIHRoaXMg Y2xhaW0gdG8gY29udGFpbiBvbmx5IGEgc2luZ2xlIGV2ZW50IHN0YXRlbWVudC48YnI+DQo8YnI+ DQpUaGFua3MsPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPllhcm9uPGJyPg0KPGJyPg0KT24gMjQv MTAvMTcgMjI6MTAsIE1pa2UgSm9uZXMgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4w cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmln aHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBw dCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+SSBhZ3JlZSB3aXRoIG11Y2ggb2YgUGhpbOKAmXMgcmF0aW9u YWxlIGhlcmUuPGJyPg0KPGJyPg0KSXTigJlzIGZpbmUgZm9yIHNvbWUgcHJvZmlsZXMgdG8gc2F5 IHRoYXQgdGhlIOKAnGV2ZW50c+KAnSBzZXQgbXVzdCBiZSBhIHNpbmdsZXRvbi4mbmJzcDsgVGhh dCBkb2VzbuKAmXQgaGF2ZSB0byBiZSB0cnVlIGZvciBhbGwgZXZlbnRzLiZuYnNwOyBJIHRoaW5r IHRoaW5ncyBhcmUgZmluZSBhcy1pcy48YnI+DQo8YnI+DQombmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+LS0gTWlrZTxicj4NCjxicj4NCipGcm9tOiogSWQtZXZlbnQgW21haWx0bzo8 YSBocmVmPSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L2E+XSAqT24gQmVoYWxmIE9mICpQaGlsIEh1bnQ8 YnI+DQoqU2VudDoqIE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyA4OjQ3IFBNPGJyPg0KKlRvOiog UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0OzxhIGhyZWY9Im1haWx0bzpyaWNoYW5uYUBh bWF6b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+cmljaGFubmFAYW1hem9uLmNvbTwvYT4mZ3Q7PGJy Pg0KKkNjOiogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2 ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxi cj4NCipTdWJqZWN0OiogUmU6IFtJZC1ldmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVu dHMgcGVyIFNFVD88YnI+DQo8YnI+DQpBbm5hYmVsbGUsPGJyPg0KPGJyPg0KSSBoYXZlIGEgbnVt YmVyIG9mIGNvbmNlcm5zIHdpdGggdGhpcyBwcm9wb3NhbC48YnI+DQo8YnI+DQpQcm9maWxpbmcg SW5kZXBlbmRlbmNlIC8gS2VlcGluZyBFdmVudCBQYXlsb2FkcyBJbmRlcGVuZGVudDxicj4NCjxi cj4NCkluZGljYXRpbmcgdGhhdCBleHRlbnNpb25zIHNob3VsZCBiZSBoYW5kbGVkIGJ5IHByb2Zp bGVzIGxlYWRzIHRvIG1vcmUgaW50ZXItb3BlcmFiaWxpdHkgaXNzdWVzIGFuZCBtb3JlIGltcG9y dGFudGx5IGludHJ1ZGVzIG9uIHRoZSBFdmVudCBwYXlsb2FkIHNwYWNlIGJ5IHN1Z2dlc3Rpbmcg YSBzdWItc2NoZW1hIGNyZWF0ZXMgcG90ZW50aWFsIGxpbWl0YXRpb25zIGFuZCBjb25mbGljdHMg dGhhdCBtYXkgYWRkIHRvIGNvbXBsZXhpdHkgbGF0ZXINCiBvbi4gVGhlIGN1cnJlbnQgZm9ybWF0 IGFsbG93cyBhIHBhcnNlciB0byBkaXNjb3ZlciBhbmQgdW5sb2FkIG9uZSBvciBtb3JlIEpTT04g cGF5bG9hZHMgd2hpY2ggY2FuIGVhY2ggaGF2ZSBpbmRlcGVuZGVudCBzdHJ1Y3R1cmUuPGJyPg0K PGJyPg0KR2VuZXJhbCBleHRlbnNpb25zPGJyPg0KPGJyPg0KVGhlIHByb3Bvc2FsIGFsc28gcnVs ZXMgb3V0IGdlbmVyYWwgcHVycG9zZSBleHRlbnNpb25zIG5vdCByZWxhdGVkIHRvIGFueSBzcGVj aWZpYyBldmVudC4gR2l2ZW4gdGhlIGVtZXJnZW5jZSBvZiBpdGVtcyBsaWtlIEdQUkQsIEkgd291 bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhlIGFiaWxpdHkgdG8gYWRkIG1ldGEtZGF0YSBvciBvdGhl ciBnZW5lcmFsIHB1cnBvc2UgaXRlbXMuIFdlIGNhbiBhbHNvIGFudGljaXBhdGUgc29tZSBkZWxp dmVyeSBzY2VuYXJpb3MNCiB3aGVyZSBhZGRpdGlvbmFsIGRhdGEgbWlnaHQgYmUgcmVxdWlyZWQu IEV2ZW4gdGhvdWdoIHRoZXJlIGlzIG5vIGN1cnJlbnQgcGxhbm5lZCB1c2UsIEkgc2VlIG5vIGdv b2QgcmVhc29uIHRvIHJ1bGUgdGhpcyBvdXQuPGJyPg0KPGJyPg0KTXVsdGlwbGUgRXZlbnRzIEZy b20gRGlmZmVyZW50IEZhbWlsaWVzICh2cy4gTXVsdGlwbGUgRXZlbnRzIGZyb20gYSBzaW5nbGUg ZmFtaWx5IGxpa2UgUklTQyk8YnI+DQo8YnI+DQpJbiBvdXIgUklTQyBzZXNzaW9uIHdlIGRpc2N1 c3NlZCBleHByZXNzaW5nIG11bHRpcGxlIGRpc3RpbmN0IFJJU0MgZXZlbnRzIGluIG9uZSBTRVQu IFRoZSBkaXNjdXNzaW9uIHdhcyB0aGF0IG9ubHkgb25lIFJJU0MgZXZlbnQgYXQgYSB0aW1lLiBX ZSBkaWQgbm90IGRpc2N1c3Mgb3RoZXIgZXZlbnQgcHJvZmlsZXMuIEkgZG9u4oCZdCBzZWUgYSBy ZWFzb24gdG8gcnVsZSBvdXQgbXVsdGktZXZlbnRzIGZyb20gZGlmZmVyZW50IGZhbWlsaWVzIGF0 IHRoZQ0KIFNFVCBsZXZlbC4gRWFjaCBwcm9maWxlIGlzIGV4cHJlc3Npbmcgc2xpZ2h0bHkgZGlm ZmVyZW50IHRoaW5ncyBhYm91dCB0aGUgc2FtZSBldmVudC48YnI+DQo8YnI+DQpJIGNhbiBmb3Jz ZWUgc29tZSBjYXNlcyB3aGVyZSBpdCBpcyBub3QgY2xlYXIgd2hpY2ggaXMgdGhlIHByaW1hcnkg YW5kIHdoaWNoIGlzIHRoZSBleHRlbnNpb24uJm5ic3A7IFRoZXJlIG1heSBub3QgYmUgYSBjbGVh ciB3aW5uZXIuPGJyPg0KPGJyPg0KQSBjb3VwbGUgb2YgZXhhbXBsZXMgKHRoZXNlIGFyZSBuZWNl c3NhcmlseSByZWFs4oCmanVzdCBwb3NzaWJpbGl0aWVzKTo8YnI+DQo8YnI+DQoqIEl0IGlzIHBy b2JhYmx5IHVzZWZ1bCB0byBiZSBhYmxlIHRvIGV4cHJlc3Mgc2ltbGFyL292ZXJsYXBwaW5nIGV2 ZW50cyBmcm9tIGRpZmZlcmVudCBTRVQgcHJvZmlsZXMgaW4gb25lIFNFVC4mbmJzcDsgRm9yIGV4 YW1wbGUgYSBCYWNrY2hhbm5lbCBMb2dvdXQgJmFtcDsgYSBSSVNDIHNlc3Npb24gY2FuY2VsIGV2 ZW50Ljxicj4NCjxicj4NCiogU0NJTSBtYXkgd2FudCB0byByZXByZXNlbnQgYSBzaW5nbGUgdHJh bnNhY3Rpb24gYXMgY2F1c2luZyBtdWx0aXBsZSBzdGF0ZSBjaGFuZ2VzIGluIGFuIGV2ZW50IChl LmcuIGEgcGFzc3dvcmQgY2hhbmdlIGNhdXNlcyBtdWx0aXBsZSBlZmZlY3RzKS4gSGF2aW5nIHRv IGNoYXNlIGRvd24gbXVsdGlwbGUgZXZlbnRzIGFuZCBjb3JyZWxhdGUgYnkg4oCcdHhu4oCdIHdv dWxkIGJlIGNoYWxsZW5naW5nIGluIGEgbXVsdGktdGhyZWFkZWQvbXVsdGktbm9kZQ0KIGRlbGl2 ZXJ5IHN5c3RlbS4mbmJzcDsgJm5ic3A7VGhlIFNDSU0gbGlzdCBoYXMgbm90IGRpc2N1c3NlZCB0 aGlzLCBidXQgSSB3b3VsZCBub3Qgd2FudCB0byBibG9jayB0aGlzIGNhcGFiaWxpdHkuJm5ic3A7 IElPVyAtIEp1c3QgYmVjYXVzZSBSSVNDIGRvZXMgbm90IHdhbnQgdG8gZXhwcmVzcyBtdWx0aXBs ZSBldmVudHMgZG9lcyBub3QgbWFrZSB0aGlzIHRydWUgZm9yIG90aGVyIHByb2ZpbGVzLjxicj4N Cjxicj4NCiogV2UgbWF5IHdpc2ggdG8gaW5kaWNhdGUgYSBTQ0lNIFBhc3N3b3JkIFJlc2V0IHdh cyBwZXJmb3JtZWQgYW5kIGEgTG9nb3V0L3Nlc3Npb24gY2FuY2VsbGF0aW9uIGlzIGV4cHJlc3Nl ZCBhdCB0aGUgc2FtZSB0aW1lLiZuYnNwOyBUaGUgZXZlbnRzIGFyZSByZWxhdGVkIGJ1dCBleHBy ZXNzIGRpZmZlcmVudCBkYXRhLjxicj4NCjxicj4NCkF2b2lkaW5nIENvbmZ1c2lvbiBGcm9tIFNp bWlsYXIgRXZlbnRzIE9yaWdpbmF0aW5nIGZyb20gdGhlIFNhbWUgVHJhbnNhY3Rpb248YnI+DQo8 YnI+DQpJZiBldmVudHMgYXJlIHNlbnQgc2VwYXJhdGVseSwgdGhlbiBtb3JlIHRyYWNraW5nIG9m IHN0YXRlIChlLmcuIGJ5IHR4bikgd291bGQgYmUgcmVxdWlyZWQgdG8gZW5zdXJlIHNpbWlsYXIg ZXZlbnRzIGFyZSBub3QgbWlzdGFrZW4gb3IgaGFuZGxlZCBhcyByZXBlYXRzLiBXaGlsZSB0eG4g cHJvdmlkZXMgdXNlZnVsIGF1ZGl0IGFuYWx5c2lzIGNhcGFiaWxpdHksIEnigJltIG5vdCBzdXJl IGl0IGNhbiBiZSB1c2VkIGluIGxpdmUgb3IgbmVhci1yZWFsDQogdGltZSBzeXN0ZW1zIGdpdmVu IGRpc3RyaWJ1dGVkIG11bHRpLW5vZGUsIG11bHRpLXRocmVhZGluZyBhcmNoaXRlY3R1cmVzLjxi cj4NCjxicj4NClByZXZpb3VzIERpc2N1c3Npb248YnI+DQo8YnI+DQpJIG5vdGUgdGhhdCBJIG9y aWdpbmFsbHkgcmFpc2VkIGhhdmluZyBhbiBhdHRyaWJ1dGUgdG8gZGVzaWduYXRlIHByaW1hcnkg ZXZlbnQgYXR0cmlidXRlIHRvIGFsbGV2aWF0ZSB5b3VyIGNvbmNlcm4sIGJ1dCB0aGlzIHdhcyBu b3QgYWNjZXB0ZWQuIFNlZTo8YnI+DQo8YnI+DQoqPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWwtMkRhcmNoaXZlX3dl Yl9pZC0yRGV2ZW50X2N1cnJlbnRfbXNnMDA0MDYuaHRtbCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdt YW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0y dERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9UzNzTVZpcU12RWdud0diSndPUU55Y3JP eXI3U2VmcHFfTW9GT0tjRWVDRSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYuaHRtbDwv YT48YnI+DQo8YnI+DQoqPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/ dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2ZW50X2N1 cnJlbnRfbXNnMDAxNDAuaHRtbCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBw dVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5 S0FUa1JsUUcxaXcmYW1wO3M9R3k5Z3lSb0lJdGEtY1NoVjdiTjE2MWF5NHlFNnI5RzFfQWFfTmVC bnlsZyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFy Y2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDAxNDAuaHRtbDwvYT48YnI+DQo8YnI+DQpU aGUgY29uc2Vuc3VzLCBhdCBsZWFzdCBhcyBJIGludGVycHJldGVkIGl0IGlzIHVwIHRvIHRoZSBy ZWNlaXZlciB0byBmaWd1cmUgdGhpcyBvdXQgYmFzZWQgb24gdGhlIGRlZmluaXRpb25zIGl0IGhh cyBmb3IgZWFjaCBldmVudCBVUkkgYW5kIHRoZSBwcm9maWxlcyB0aGV5IHJlcHJlc2VudC4gSU9X IC0gUklTQyBpcyBmcmVlIHRvIGxpbWl0IHRoYXQgb25seSBvbmUgUklTQyBldmVudCBiZSBleHBy ZXNzZWQgYXQgYSB0aW1lLjxicj4NCjxicj4NClBoaWw8YnI+DQo8YnI+DQpPcmFjbGUgQ29ycG9y YXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxicj4NCjxicj4NCkBpbmRl cGVuZGVudGlkPGJyPg0KPGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01G YVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7 cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0ds SzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9OU5QNW5hbWc2cklW end1bjljLTFxMHdoc3lYd1N2dEhCMGYyZEtrZkNYOCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj53 d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPiZsdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmFtcDtkPUR3TUZh USZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDty PW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xL OW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz05TlA1bmFtZzZySVZ6 d3VuOWMtMXEwd2hzeVh3U3Z0SEIwZjJkS2tmQ1g4JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+Jmd0Ozxicj4NCjxicj4NCjxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFj bGUuY29tPC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj4mbHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDs8YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7IE9uIE9jdCAyMywgMjAxNywgYXQgNzowMiBQTSwgUmljaGFyZCBCYWNrbWFuLCBBbm5h YmVsbGU8YnI+DQombmJzcDsgJm5ic3A7ICZsdDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1h em9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJpY2hhbm5hQGFtYXpvbi5jb208L2E+PHNwYW4gY2xh c3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZsdDttYWlsdG86PGEgaHJl Zj0ibWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj5yaWNoYW5uYUBh bWF6b24uY29tPC9hPiZndDsmZ3Q7IHdyb3RlOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgVGhl IGN1cnJlbnQgZHJhZnQgb2YgdGhlIFNFVCBzcGVjIGFsbG93cyBmb3IgZXhwcmVzc2luZyBtdWx0 aXBsZTxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnRzIHdpdGhpbiB0aGUgc2FtZSB0b2tlbiwgd2hp Y2ggaW50cm9kdWNlcyBhZGRpdGlvbmFsIGNvbXBsZXhpdHk8YnI+DQombmJzcDsgJm5ic3A7IGFu ZCByb29tIGZvciBhbWJpZ3VvdXMgc2VtYW50aWNzLiBXZeKAmXZlIGRpc2N1c3NlZCB0aGlzIGlu IHRoZSBPSURGPGJyPg0KJm5ic3A7ICZuYnNwOyBSSVNDIHdvcmtpbmcgZ3JvdXAgYW5kIHRoZSBj dXJyZW50IGNvbnNlbnN1cyB0aGVyZSBpcyB0aGF0IFJJU0Mgd2lsbDxicj4NCiZuYnNwOyAmbmJz cDsgcmVxdWlyZSB0aGF0IFJJU0MgZXZlbnRzIG11c3QgYmUgdGhlIG9ubHkgZXZlbnQgaW4gdGhl IFNFVCwgaGF2aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyBpZGVudGlmaWVkIHdheXMgdG8gY2xlYXJs eSBhbmQgZWFzaWx5IHN1cHBvcnQgdGhlIGhhbmRmdWwgb2YgdXNlPGJyPg0KJm5ic3A7ICZuYnNw OyBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciB0b2tlbiB0aGF0IHBlb3BsZSBoYXZlIHJh aXNlZC4gV2l0aDxicj4NCiZuYnNwOyAmbmJzcDsgdGhhdCBjb250ZXh0IGluIG1pbmQsIEkgcHJv cG9zZSBzdHJpa2luZyB0aGUgZGVmaW5pdGlvbiBvZiB0aGU8YnI+DQombmJzcDsgJm5ic3A7IOKA nGV2ZW50c+KAnSBjbGFpbSBmcm9tIHRoZSBTZWN1cml0eSBFdmVudCBUb2tlbiBzcGVjLCBhbmQg cmVwbGFjaW5nIGl0PGJyPg0KJm5ic3A7ICZuYnNwOyB3aXRoIHRoZSBmb2xsb3dpbmcgZGVmaW5p dGlvbiBmb3IgYW4g4oCcZXZlbnTigJ0gY2xhaW0gKHNpbmd1bGFyKTo8YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7IGV2ZW50PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBBIEpTT04gb2JqZWN0IGNv bnRhaW5pbmcgYW4gJnF1b3Q7ZXZlbnRfdHlwZSZxdW90OyBtZW1iZXIgd2hvc2UgdmFsdWUgaXMg YSBVUkk8YnI+DQombmJzcDsgJm5ic3A7IHJlcHJlc2VudGluZyBhIHR5cGUgb2YgZXZlbnQgZGVm aW5lZCBpbiBhIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLjxicj4NCiZuYnNwOyAmbmJzcDsgVGhl IG9iamVjdCBNQVkgb3RoZXJ3aXNlIGJlIGVtcHR5LCBvciBNQVkgY29udGFpbiBhZGRpdGlvbmFs IG1lbWJlcnM8YnI+DQombmJzcDsgJm5ic3A7IGFzIGRlc2NyaWJlZCBieSB0aGUgUHJvZmlsaW5n IFNwZWNpZmljYXRpb24uPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBIZXJlIGlzIHRoZSBleGFt cGxlIFNFVCBmcm9tIHNlY3Rpb24gMi4zLCByZXdyaXR0ZW4gd2l0aCB0aGlzIGNoYW5nZTxicj4N CiZuYnNwOyAmbmJzcDsgbWluZDo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7PHNwYW4gY2xhc3M9 ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPns8YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7ICZuYnNwOyZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90OzRkMzU1OWVjNjc1MDRh YWJhNjVkNDBiMDM2M2ZhYWQ4JnF1b3Q7LDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7 Jm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjQwNCw8YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7ICZuYnNwOyZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9z Y2ltLmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNv bTwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0 OzxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRw czovL3NjaW0uZXhhbXBsZS5jb20vPC9hPiZndDsmcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPGJyPg0KPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNi Nzc1NDwvYT4mcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsgJm5i c3A7Jm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0ZlZWRzLzVk NzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhh bXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4mcXVvdDs8YnI+DQo8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyBdLDxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50JnF1b3Q7OiB7PGJyPg0KPGJyPg0KJm5ic3A7ICZu YnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnRfdHlwZSZxdW90OzogJnF1 b3Q7dXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6Y3JlYXRlJnF1b3Q7LDxicj4NCjxicj4NCiZu YnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3JlZiZxdW90OzogJnF1 b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJkZjk2YmQ2 YWI2MWU3NTIxZDkiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNl cnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOTwvYT4mcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXR0cmlidXRlcyZxdW90Ozog WyZxdW90O2lkJnF1b3Q7LCAmcXVvdDtuYW1lJnF1b3Q7LCAmcXVvdDt1c2VyTmFtZSZxdW90Oywg JnF1b3Q7cGFzc3dvcmQmcXVvdDssICZxdW90O2VtYWlscyZxdW90O108YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyZuYnNwOyB9PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyB9PGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwOyBEb2VzIGFueW9uZSBpbiB0aGUgd29ya2luZyBncm91cCBoYXZl IHVzZSBjYXNlcyBmb3IgU0VUcyB0aGF0IGNhbm5vdDxicj4NCiZuYnNwOyAmbmJzcDsgYmUgbWV0 IGJ5IHRoaXMgcHJvcG9zZWQgdGV4dD8gV2l0aGluIFJJU0MsIHdlIGlkZW50aWZpZWQgdGhyZWUg dXNlPGJyPg0KJm5ic3A7ICZuYnNwOyBjYXNlcywgd2l0aCBzb2x1dGlvbnMgb3V0bGluZWQgYmVs b3c6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAqKjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsg KkV4dGVuc2lvbnMqPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBFdmVudCBleHRlbnNpb24gbWVj aGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0aGUgZXZlbnQ8YnI+DQombmJzcDsg Jm5ic3A7IG9iamVjdC4gQSBzaW1wbGUgYXBwcm9hY2ggd291bGQgYmUgdG8gJm5ic3A7ZGVmaW5l IGFuIOKAnGV4dGVuc2lvbnPigJ0gbWVtYmVyPGJyPg0KJm5ic3A7ICZuYnNwOyB0aGF0IGlzIGEg bGlzdCBvZiBldmVudCBvYmplY3RzIChvciBzZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCd PGJyPg0KJm5ic3A7ICZuYnNwOyBjbGFpbSBhcyBkZWZpbmVkIGluIHRoZSBjdXJyZW50IHNwZWMp LiBUaGlzIGhhcyB0aGUgYWR2YW50YWdlIG9mPGJyPg0KJm5ic3A7ICZuYnNwOyBtYWtpbmcgaXQg Y2xlYXIgaW4gdGhlIGRhdGEgc3RydWN0dXJlIHRoYXQgdGhlcmUgaXMgYSBzaW5nbGUgcHJpbWFy eTxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lvbnMu IFRoZXJlIGlzIG5vIHJvb20gZm9yIGNvbmZ1c2lvbjxicj4NCiZuYnNwOyAmbmJzcDsgb3ZlciB3 aGljaCBldmVudCBpcyBwcmltYXJ5LCBvciBpZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQgYXQg YWxsLjxicj4NCiZuYnNwOyAmbmJzcDsgSSB3b3VsZCBiZSBmaW5lIHdpdGggYWRkaW5nIHNvbWV0 aGluZyBsaWtlIHRoaXMgdG8gbXkgcHJvcG9zZWQgdGV4dCw8YnI+DQombmJzcDsgJm5ic3A7IGlm IHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkgdXNlZnVsLjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDsgKkFsaWFzZXMqPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBUaGlzIHVz ZSBjYXNlIHdhcyBicm91Z2h0IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRz PGJyPg0KJm5ic3A7ICZuYnNwOyBmcm9tIGRyYWZ0IGV2ZW50IG5hbWVzIHRvIHN0YW5kYXJkaXpl ZCBldmVudCBuYW1lcy4gSW4gdGhpcyBjYXNlLDxicj4NCiZuYnNwOyAmbmJzcDsgdGhlIGV2ZW50 IHRyYW5zbWl0dGVyIGNhbiB0cmFuc21pdCB0d28gdG9rZW5zIGZvciB0aGUgbG9naWNhbCBldmVu dCw8YnI+DQombmJzcDsgJm5ic3A7IG9uZSB1c2luZyB0aGUgb2xkIG5hbWUgYW5kIGFub3RoZXIg dXNpbmcgdGhlIG5ldyBuYW1lLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgKlJlbGF0ZWQgRXZl bnRzKjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgVGhlIFNFVCBzcGVjIGRlZmluZXMgdGhlIHR4 biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJlbGF0aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyBpbmRl cGVuZGVudCB0b2tlbnMgdGhhdCByZWxhdGUgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC48YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7IC0tPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPjxicj4NCiZuYnNwOyAmbmJzcDsgQW5uYWJlbGxlIFJpY2hhcmQgQmFj a21hbjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgQW1hem9uIOKAkyBJZGVudGl0eSBTZXJ2aWNl czxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188YnI+DQombmJzcDsgJm5ic3A7IElkLWV2ZW50IG1haWxpbmcgbGlz dDxicj4NCiZuYnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPiZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCiZu YnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3 SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFt cDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209czVi eUJlNUtBTm5HVnVBYjFtQXVwRUdvSm44WEc1SklVVXdXR0ZTaWJFYyZhbXA7cz1YOG9SU3EzSXps RjdqaVJBZVpoWHBSM2VWSTBJNThaRmQ0ZUVaZmd5b0lZJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXM1YnlCZTVLQU5uR1Z1 QWIxbUF1cEVHb0puOFhHNUpJVVV3V0dGU2liRWMmYW1wO3M9WDhvUlNxM0l6bEY3amlSQWVaaFhw UjNlVkkwSTU4WkZkNGVFWmZneW9JWSZhbXA7ZT08L2E+PGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1l dmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRm Lm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZ dW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFu cVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnRE a24zMUF1eHVydWliOUtBVGtSbFFHMWl3JmFtcDtzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVH dTR6YmhjVzAwMWZLMDJFWHMmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9 Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01GYVEmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpC VFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zz ai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9V3JNdVFSd0xWODAyaU1RNHdZQjFm MnJGVUd1NHpiaGNXMDAxZkswMkVYcyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3NwYW4+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+LS08c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+U3Vi c2NyaWJlIHRvIHRoZTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cC0zQV9faGFyZHR3YXJlLmNvbV8mYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0 eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVy dWliOUtBVGtSbFFHMWl3JmFtcDtzPUxZTjcyR2dLVmhIc1Q2dEFxQmUtZU1vV012eV83ZGZGbjF1 WjBISzZZdVEmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+SEFSRFRXQVJFPC9hPjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5tYWlsDQogbGlzdCB0byBsZWFy biBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hPG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxi cj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+ DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFt cDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElf Sm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1w O209WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz1Xck11 UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmFtcDtlPSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBz LTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNB ZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDty PW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xL OW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz1Xck11UVJ3TFY4MDJp TVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmFtcDtlPTwvc3Bhbj48L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_65C74B5D9BDE4FEA9D020F041DC11A0Famazoncom_-- From nobody Mon Oct 30 12:09:45 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F297F13F5BA for ; Mon, 30 Oct 2017 12:09:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.999 X-Spam-Level: X-Spam-Status: No, score=-6.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D4WgL0c-pib3 for ; Mon, 30 Oct 2017 12:09:37 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48B2413F637 for ; Mon, 30 Oct 2017 12:09:25 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9UJ9KUU009628 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 19:09:20 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v9UJ9KZ2031732 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 19:09:20 GMT Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9UJ9JGW029698; Mon, 30 Oct 2017 19:09:19 GMT Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 30 Oct 2017 12:09:19 -0700 From: Phil Hunt Message-Id: <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_6C6D0DF4-AC2D-4D27-A222-CE9BFD70AD41" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Mon, 30 Oct 2017 12:09:17 -0700 In-Reply-To: <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> Cc: Dick Hardt , Yaron Sheffer , Mike Jones , ID Events Mailing List To: "Richard Backman, Annabelle" References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 19:09:43 -0000 --Apple-Mail=_6C6D0DF4-AC2D-4D27-A222-CE9BFD70AD41 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Annabelle/Dick, Thanks for the comments. I think we need to examine the consequences of = the proposal in JSON. As I stated, what causes most of the issue is the proposed extension = mechanism in the payload (possibly using events in a recursive way). = Does it follow the old format or the new? Let=E2=80=99s consider a use case where we have an identity management = system that uses SCIM, but the SCIM system is also the underlying data = store for Connect. A Password reset might generate the following event = which has an extension (conveying reset count) AND overlapping statement = from RISC. BOTH of which might be important to a similar receiver using = SCIM and OIDC. =20 The 03 spec currently would allow: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "events": { "urn:ietf:params:scim:event:passwordReset": { "id":"44f6142df96bd6ab61e7521d9"}, "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5}, "http://schemas.openid.net/secevent/risc/event-type/\ account-credential-change-required": { =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" } } } In the above - each payload is a =E2=80=98peer' and issued without = preference by the transmitter. The receiver can assign priority in its = own context if that matters. The new proposal: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "event": { =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRese= t=E2=80=9D, "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, =E2=80=9Cevents=E2=80=9D:{ ->note =E2=80=A6is this the old or new structure? <- "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5}, "http://schemas.openid.net/secevent/risc/event-type/\ account-credential-change-required": { =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" } } } =20 } In the above, sub-events or extensions have a different format. The same = complaint about the original stands. *OR* (if the receiver cares about RISC more). Note that this leads to a = triple nested structure. { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "event": { = =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/even= t-type/\ account-credential-change-required=E2=80=9D, =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, =E2=80=9Cevents=E2=80=9D:{ "urn:ietf:params:scim:event:passwordReset": {=20 "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, =E2=80=9Cevents=E2=80=9D:{ "https://example.com/scim/event/passwordResetExt": { "resetAttempts":5}, =20 } =20 } } =20 } } In the above, the extension is placed inside the event it extends. It = follows the old format (or should it follow the new?) *OR* Following the top layer pattern of singular event Note that this = leads to a triple nested structure. { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "event": { = =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/even= t-type/\ account-credential-change-required=E2=80=9D, =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, =E2=80=9Cevent=E2=80=9D:{ =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordR= eset=E2=80=9D, "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, =E2=80=9Cevent=E2=80=9D:{ = =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/passwordReset= Ext=E2=80=9D, "resetAttempts":5=20 } } =20 } } This format follows the proposed singular event format recursively and = is 3 layers deep. Note that the parser has to continue to search the = document for things that aren=E2=80=99t there as it has to stop when no = =E2=80=9Cevent=E2=80=9D attribute is found rather than iterate over an = array. Phil Oracle Corporation, Identity Cloud Services Architect @independentid www.independentid.com phil.hunt@oracle.com > On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle = wrote: >=20 > Replies inline. > =20 > --=20 > Annabelle Richard Backman > Identity Services > =20 > =20 > From: Phil Hunt > > Date: Sunday, October 29, 2017 at 5:25 PM > To: Dick Hardt > > Cc: Yaron Sheffer >, Mike Jones >, "Richard Backman, Annabelle" = >, ID Events Mailing = List > > Subject: Re: [Id-event] Use cases for multiple events per SET? > =20 > I hope this answers your question. > =20 > My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why = not. The question should be, what is the justification to make = =E2=80=9Cevents=E2=80=9D singular? > [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer = semantics and is easier to process. We should opt for easier solutions = unless there are use cases that require more complexity.[/richanna] > =20 > There are many reasons for multiple events in a SET. Some are good, = some not so good. Some of the reasons... > =20 > 1. Multiple event payloads expressing statements about largely the = *same*thing. For example, SCIM password reset AND RISC password reset. = A RISC Event and an OpenBanking Event. Is one a complement to the other? = Do they overlap or are they distinct? =20 > [richanna]Copy/pasted from my earlier email: > Why is it necessary or appropriate to include these events in the same = SET? They are likely being generated by different systems at different = times on the transmitter=E2=80=99s side, consumed by different systems = on the receiver=E2=80=99s side, and possibly being transmitted over = different event streams. I know the latter would be the case for us, as = a receiver. Even if it=E2=80=99s not, is it burdensome to send these = events separately? What value is gained in combining them? > =20 > Additionally, since the signature is over the SET and not the event = objects, Receivers independently route separate events from a single = token without either losing the ability to verify the authenticity of = the event or sharing all information in the SET with every system = handling any event in the token.[/richanna] > =20 > 2. Multiple events payloads expressing different statements about the = same transaction - RISC Password Reset and RISC Session Cancel > [richanna]Same as above[/richanna] >=20 > 3. A new profile defines new event attributes to be added on to an = existing event type (a pure extension)=20 > [richanna]I have suggested a way to support extensions within an event = body, multiple times now. If you see problems with it, please point them = out.[/richanna] > =20 > I think it is quite valid to allow 1 and 3. 2 could be limited by = specific profiles like RISC if they want. > =20 > I am not in agreement that making event singular simplifies anything. = For one is makes extensions complex (another nested JSON structure) and = potentially conflicting.=20 > [richanna] > Ways that multiple-event SETs are more complicated: > It results in a more complex structure for the single event use case, = which I think we all agree is the majority use case. > Multiple-event SETs have ambiguous semantics. The presence of two = events A and B in the same SET could mean any of: > They are related to the same logical event (i.e. the same thing as if = they were from different SETs that have a common txn). > A is an extension of B. > B is an extension of A. > They are aliases for one another. > They are not actually related to one another in any way. > Claim semantics become harder to define, as different profiles may = want to use the same claims in different ways. > =20 > If the WG wants to block 1 and 2 above, then I believe we have to = establish an event registry to ensure new Event profiles do not overlap = to eliminate the need to express multiple events. > [richanna]I=E2=80=99m not sure what you mean by this. Are you = referring to event names? Those are already defined by the spec to be = URIs.[/richanna] > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com = > phil.hunt@oracle.com > =20 >> On Oct 29, 2017, at 4:12 PM, Dick Hardt > wrote: >> =20 >> Phil: >> =20 >> In your examples for having a plurality of events, you use the word = "may", which leads me to question if a plurality of events is really = required in SET. >> =20 >> You posit that it will be difficult for a distributed system to = correlate multiple SETs with the same "txn", but the distributed system = will certainly need to correlate events on the same subject -- = correlating events on the same "txn" on the same subject seems fairly = simple. >> =20 >> I think that a receiver will need to correlate multiple SEts on the = same subject, so having multiple events in a SET is redundant, and adds = complexity with no clear benefit that I can see. >> =20 >> An implementor may choose to send multiple SETs, or send a single SET = with multiple events, so a receiver will need to support both. I prefer = we pick one way and minimize the code paths, and we will need to support = correlating across multiple SETs, so that seems the best mechanism. >> =20 >> Let me know if there is something I missed in my logic. >> =20 >> /Dick >> =20 >> =20 >> On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer = > wrote: >>> In that case, let's add text to that effect, e.g. we could add to = the definition of the "events" claim: >>>=20 >>> Profiling specifications SHOULD define the allowed event statements, = and MAY restrict their number. For example, some profiles may require = this claim to contain only a single event statement. >>>=20 >>> Thanks, >>> Yaron >>>=20 >>> On 24/10/17 22:10, Mike Jones wrote: >>>> I agree with much of Phil=E2=80=99s rationale here. >>>>=20 >>>> It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2= =80=9D set must be a singleton. That doesn=E2=80=99t have to be true = for all events. I think things are fine as-is. >>>>=20 >>>> -- = Mike >>>>=20 >>>> *From:* Id-event [mailto:id-event-bounces@ietf.org = ] *On Behalf Of *Phil Hunt >>>> *Sent:* Monday, October 23, 2017 8:47 PM >>>> *To:* Richard Backman, Annabelle > >>>> *Cc:* ID Events Mailing List > >>>> *Subject:* Re: [Id-event] Use cases for multiple events per SET? >>>>=20 >>>> Annabelle, >>>>=20 >>>> I have a number of concerns with this proposal. >>>>=20 >>>> Profiling Independence / Keeping Event Payloads Independent >>>>=20 >>>> Indicating that extensions should be handled by profiles leads to = more inter-operability issues and more importantly intrudes on the Event = payload space by suggesting a sub-schema creates potential limitations = and conflicts that may add to complexity later on. The current format = allows a parser to discover and unload one or more JSON payloads which = can each have independent structure. >>>>=20 >>>> General extensions >>>>=20 >>>> The proposal also rules out general purpose extensions not related = to any specific event. Given the emergence of items like GPRD, I would = not want to block the ability to add meta-data or other general purpose = items. We can also anticipate some delivery scenarios where additional = data might be required. Even though there is no current planned use, I = see no good reason to rule this out. >>>>=20 >>>> Multiple Events =46rom Different Families (vs. Multiple Events from = a single family like RISC) >>>>=20 >>>> In our RISC session we discussed expressing multiple distinct RISC = events in one SET. The discussion was that only one RISC event at a = time. We did not discuss other event profiles. I don=E2=80=99t see a = reason to rule out multi-events from different families at the SET = level. Each profile is expressing slightly different things about the = same event. >>>>=20 >>>> I can forsee some cases where it is not clear which is the primary = and which is the extension. There may not be a clear winner. >>>>=20 >>>> A couple of examples (these are necessarily real=E2=80=A6just = possibilities): >>>>=20 >>>> * It is probably useful to be able to express simlar/overlapping = events from different SET profiles in one SET. For example a = Backchannel Logout & a RISC session cancel event. >>>>=20 >>>> * SCIM may want to represent a single transaction as causing = multiple state changes in an event (e.g. a password change causes = multiple effects). Having to chase down multiple events and correlate by = =E2=80=9Ctxn=E2=80=9D would be challenging in a = multi-threaded/multi-node delivery system. The SCIM list has not = discussed this, but I would not want to block this capability. IOW - = Just because RISC does not want to express multiple events does not make = this true for other profiles. >>>>=20 >>>> * We may wish to indicate a SCIM Password Reset was performed and a = Logout/session cancellation is expressed at the same time. The events = are related but express different data. >>>>=20 >>>> Avoiding Confusion =46rom Similar Events Originating from the Same = Transaction >>>>=20 >>>> If events are sent separately, then more tracking of state (e.g. by = txn) would be required to ensure similar events are not mistaken or = handled as repeats. While txn provides useful audit analysis capability, = I=E2=80=99m not sure it can be used in live or near-real time systems = given distributed multi-node, multi-threading architectures. >>>>=20 >>>> Previous Discussion >>>>=20 >>>> I note that I originally raised having an attribute to designate = primary event attribute to alleviate your concern, but this was not = accepted. See: >>>>=20 >>>> * = https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html = >>>>=20 >>>> * = https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html = >>>>=20 >>>> The consensus, at least as I interpreted it is up to the receiver = to figure this out based on the definitions it has for each event URI = and the profiles they represent. IOW - RISC is free to limit that only = one RISC event be expressed at a time. >>>>=20 >>>> Phil >>>>=20 >>>> Oracle Corporation, Identity Cloud Services Architect >>>>=20 >>>> @independentid >>>>=20 >>>> www.independentid.com = = > >>>>=20 >>>> phil.hunt@oracle.com = > >>>>=20 >>>> On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle >>>> = >> wrote: >>>>=20 >>>> The current draft of the SET spec allows for expressing = multiple >>>> events within the same token, which introduces additional = complexity >>>> and room for ambiguous semantics. We=E2=80=99ve discussed this = in the OIDF >>>> RISC working group and the current consensus there is that RISC = will >>>> require that RISC events must be the only event in the SET, = having >>>> identified ways to clearly and easily support the handful of = use >>>> cases for multiple events per token that people have raised. = With >>>> that context in mind, I propose striking the definition of the >>>> =E2=80=9Cevents=E2=80=9D claim from the Security Event Token = spec, and replacing it >>>> with the following definition for an =E2=80=9Cevent=E2=80=9D = claim (singular): >>>>=20 >>>> event >>>>=20 >>>> A JSON object containing an "event_type" member whose value is = a URI >>>> representing a type of event defined in a Profiling = Specification. >>>> The object MAY otherwise be empty, or MAY contain additional = members >>>> as described by the Profiling Specification. >>>>=20 >>>> Here is the example SET from section 2.3, rewritten with this = change >>>> mind: >>>>=20 >>>> { >>>>=20 >>>> "jti": "4d3559ec67504aaba65d40b0363faad8", >>>>=20 >>>> "iat": 1458496404, >>>>=20 >>>> "iss": "https://scim.example.com = >", >>>>=20 >>>> "aud": [ >>>>=20 >>>> "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754 = ", >>>>=20 >>>> "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7 = " >>>>=20 >>>> ], >>>>=20 >>>> "event": { >>>>=20 >>>> "event_type": "urn:ietf:params:scim:event:create", >>>>=20 >>>> "ref": = "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 = ", >>>>=20 >>>> "attributes": ["id", "name", "userName", "password", = "emails"] >>>>=20 >>>> } >>>>=20 >>>> } >>>>=20 >>>> Does anyone in the working group have use cases for SETs that = cannot >>>> be met by this proposed text? Within RISC, we identified three = use >>>> cases, with solutions outlined below: >>>>=20 >>>> ** >>>>=20 >>>> *Extensions* >>>>=20 >>>> Event extension mechanisms can be defined internal to the event >>>> object. A simple approach would be to define an = =E2=80=9Cextensions=E2=80=9D member >>>> that is a list of event objects (or set resembling the = =E2=80=9Cevents=E2=80=9D >>>> claim as defined in the current spec). This has the advantage = of >>>> making it clear in the data structure that there is a single = primary >>>> event, with zero or more extensions. There is no room for = confusion >>>> over which event is primary, or if there is a primary event at = all. >>>> I would be fine with adding something like this to my proposed = text, >>>> if there is consensus that it is broadly useful. >>>>=20 >>>> *Aliases* >>>>=20 >>>> This use case was brought up in the context of migrating = clients >>>> from draft event names to standardized event names. In this = case, >>>> the event transmitter can transmit two tokens for the logical = event, >>>> one using the old name and another using the new name. >>>>=20 >>>> *Related Events* >>>>=20 >>>> The SET spec defines the txn claim as a means of correlating >>>> independent tokens that relate to the same logical event. >>>>=20 >>>> --=20 >>>> Annabelle Richard Backman >>>>=20 >>>> Amazon =E2=80=93 Identity Services >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org = > >>>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuA= b1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyo= IY&e=3D = >>>>=20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://www.ietf.org/mailman/listinfo/id-event = >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event = >>=20 >>=20 >> =20 >> --=20 >> Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj= -2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zbhcW001fK02E= Xs&e=3D = > =20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU-a5HBND0HaTX4a= nNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp-MJ20ui2nm46QS= z0&e=3D = --Apple-Mail=_6C6D0DF4-AC2D-4D27-A222-CE9BFD70AD41 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Annabelle/Dick,

Thanks for the comments. I think we = need to examine the consequences of the proposal in JSON.

As I stated, what causes most of the = issue is the proposed extension mechanism in the payload (possibly using = events in a recursive way). Does it follow the old format or the = new?

Let=E2=80=99s =  consider a use case where we have an identity management system = that uses SCIM, but the SCIM system is also the underlying data store = for Connect.  A Password reset might generate the following event = which has an extension (conveying reset count) AND overlapping statement = from RISC.  BOTH of which might be important to a similar receiver = using SCIM and OIDC.  

The 03 spec currently would = allow:

{
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7"
   ],
   "events": {
     "urn:ietf:params:scim:event:passwordReset":
       { "id":"44f6142df96bd6ab61e7521d9"},
     "https://example.com/scim/event/passwordResetExt":
       { "resetAttempts":5},
     "http://schemas.openid.net/secevent/risc/event-type/\
      =
 account-credential-change-required": {
         =
=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
         =
=E2=80=9Ciss=E2=80=9D:"https://idp.example.com/"
       }
  }
}

In the above - each payload is a =E2=80=98peer' and issued =
without preference by the transmitter. The receiver can assign priority =
in its own context if that matters.

The new proposal:

{
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7"
   ],
   "event": {
     =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRese=
t=E2=80=9D,
     "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
     =
=E2=80=9Cevents=E2=80=9D:{
     ->note =E2=80=A6is this the old or new =
structure? <-
       "https://example.com/scim/event/passwordResetExt":
         { =
"resetAttempts":5},
=
       "http://schemas.openid.net/secevent/risc/event-type/\
        =
 account-credential-change-required": {
         =
=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
         =
=E2=80=9Ciss=E2=80=9D:"https://idp.example.com/"
       =
}
    =
 }
   =
}    =

}

In the above, sub-events or extensions =
have a different format. The same complaint about the original =
stands.

*OR* (if the receiver cares =
about RISC more).  Note that this leads to a triple nested =
structure.

{
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7"
   ],
   "event": {
     =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-type/\=

         =
    account-credential-change-required=E2=80=9D,
      =
=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
      =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,
      =
=E2=80=9Cevents=E2=80=9D:{
        =
"urn:ietf:params:scim:event:passwordReset":
        { 
          "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
          =
=E2=80=9Cevents=E2=80=9D:{
             "https://example.com/scim/event/passwordResetExt":
               { =
"resetAttempts":5},  =

    =
      }=
}
} 
   =
}
}

In the above, the extension is placed inside the event it = extends. It follows the old format (or should it follow the = new?)
*OR* Following the top layer =
pattern of singular event  Note that this leads to a triple nested =
structure.

{
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7"
   ],
   "event": {
     =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-type/\=

            =
 account-credential-change-required=E2=80=9D,
      =
=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
      =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,
      =
=E2=80=9Cevent=E2=80=9D:{
        =
=E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordReset=E2=80=
=9D,
        "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
<=
pre class=3D"newpage" style=3D"font-size: 13.333333015441895px; =
margin-top: 0px; margin-bottom: 0px; break-before: page;">        =
=E2=80=9Cevent=E2=80=9D:{
          =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/passwordResetExt=E2=80=9D,
          =
"resetAttempts":5 =

        }
      }     

   =
}
}

This format follows the = proposed singular event format recursively and is 3 layers deep. Note = that the parser has to continue to search the document for things that = aren=E2=80=99t there as it has to stop when no =E2=80=9Cevent=E2=80=9D = attribute is found rather than iterate over an array.

Phil

Oracle Corporation, Identity Cloud Services = Architect
@independentid
www.independentid.com
phil.hunt@oracle.com
On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle = <richanna@amazon.com> wrote:

Replies inline.
 
-- 
Annabelle Richard = Backman
Identity Services
 
 
From: Phil Hunt <phil.hunt@oracle.com>
Date: Sunday, October 29, = 2017 at 5:25 PM
To: Dick Hardt <dick.hardt@gmail.com>
Cc: Yaron Sheffer <yaronf.ietf@gmail.com>, = Mike Jones <Michael.Jones@microsoft.com>, "Richard Backman, = Annabelle" <richanna@amazon.com>, ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Use = cases for multiple events per SET?
 
I hope this answers your question.
 
My =E2=80=9Cmay=E2=80=9D was because I = can=E2=80=99t see a reason why not. The question should be, what is the = justification to make =E2=80=9Cevents=E2=80=9D singular?
[richanna]The singular = =E2=80=9Cevent=E2=80=9D claim has clearer semantics and is easier to = process. We should opt for easier solutions unless there are use cases = that require more complexity.[/richanna]
 
There are many reasons for multiple = events in a SET.  Some are good, some not so good. Some of the = reasons...
 
1.  Multiple event payloads expressing statements about = largely the *same*thing. For example, SCIM password reset AND RISC = password reset.  A RISC Event and an OpenBanking Event. Is one a = complement to the other?  Do they overlap or are they distinct? =  
[richanna]Copy/pasted from my earlier email:
Why is it necessary or = appropriate to include these events in the same SET? They are likely = being generated by different systems at different times on the = transmitter=E2=80=99s side, consumed by different systems on the = receiver=E2=80=99s side, and possibly being transmitted over different = event streams. I know the latter would be the case for us, as a = receiver. Even if it=E2=80=99s not, is it burdensome to send these = events separately? What value is gained in combining them?
 
Additionally, since the signature is over the SET and not the = event objects, Receivers independently route separate events from a = single token without either losing the ability to verify the = authenticity of the event or sharing all information in the SET with = every system handling any event in the token.[/richanna]
 
2.  Multiple events payloads = expressing different statements about the same transaction - RISC = Password Reset and RISC Session Cancel
[richanna]Same as above[/richanna]

3.  A new profile = defines new event attributes to be added on to an existing event type (a = pure extension) 
[richanna]I have suggested a way to support extensions = within an event body, multiple times now. If you see problems with it, = please point them out.[/richanna]
 
I think it is quite valid to allow 1 = and 3.  2 could be limited by specific profiles like RISC if they = want.
 
I am not in agreement that making event singular simplifies = anything. For one is makes extensions complex (another nested JSON = structure) and potentially conflicting. 
[richanna]
Ways that multiple-event = SETs are more complicated:
  1. It results in a more complex structure for the = single event use case, which I think we all agree is the majority use = case.
  2. Multiple-event SETs have = ambiguous semantics. The presence of two events A and B in the same SET = could mean any of:
    1. They are related to the same logical event (i.e. the = same thing as if they were from different SETs that have a common = txn).
    2. A is an extension of = B.
    3. B is an extension of = A.
    4. They are aliases for one = another.
    5. They are not actually = related to one another in any way.
  • Claim semantics become harder to define, as = different profiles may want to use the same claims in different = ways.
    •  
    If the WG wants to block 1 and 2 above, then I believe we = have to establish an event registry to ensure new Event profiles do not = overlap to eliminate the need to express multiple events.
    [richanna]I=E2=80=99m not sure what you mean by this. Are you = referring to event names? Those are already defined by the spec to be = URIs.[/richanna]
    Phil
     
    Oracle Corporation, Identity Cloud Services Architect
    @independentid
    phil.hunt@oracle.com
     
    On Oct = 29, 2017, at 4:12 PM, Dick Hardt <dick.hardt@gmail.com> = wrote:
     
    Phil:
     
    In your examples for = having a plurality of events, you use the word "may", which leads me to = question if a plurality of events is really required in SET.
     
    You posit that it will = be difficult for a distributed system to correlate multiple SETs with = the same "txn", but the distributed system will certainly need to = correlate events on the same subject -- correlating events on the same = "txn" on the same subject seems fairly simple.
     
    I think that a receiver = will need to correlate multiple SEts on the same subject, so having = multiple events in a SET is redundant, and adds complexity with no clear = benefit that I can see.
     
    An implementor may = choose to send multiple SETs, or send a single SET with multiple events, = so a receiver will need to support both. I prefer we pick one way and = minimize the code paths, and we will need to support correlating across = multiple SETs, so that seems the best mechanism.
     
    Let me know if there is = something I missed in my logic.
     
    /Dick
     
     
    On Sun, Oct 29, 2017 at 11:28 AM, Yaron = Sheffer <yaronf.ietf@gmail.com> wrote:
    In that case, let's add text to that effect, e.g. we could = add to the definition of the "events" claim:

    Profiling specifications SHOULD define the allowed event = statements, and MAY restrict their number. For example, some profiles = may require this claim to contain only a single event statement.

    Thanks,
          =   Yaron

    On 24/10/17 22:10, Mike Jones wrote:

    I= agree with much of Phil=E2=80=99s rationale here.

    It=E2=80=99s fine for some profiles to say that the = =E2=80=9Cevents=E2=80=9D set must be a singleton.  That doesn=E2=80=99= t have to be true for all events.  I think things are fine = as-is.

              &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;     -- Mike

    *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt
    *Sent:* Monday, October 23, 2017 8:47 PM
    *To:* = Richard Backman, Annabelle <richanna@amazon.com>
    *Cc:* ID Events = Mailing List <id-event@ietf.org>
    *Subject:* Re: = [Id-event] Use cases for multiple events per SET?

    Annabelle,

    I have a number of = concerns with this proposal.

    Profiling = Independence / Keeping Event Payloads Independent

    Indicating that extensions should be handled by profiles = leads to more inter-operability issues and more importantly intrudes on = the Event payload space by suggesting a sub-schema creates potential = limitations and conflicts that may add to complexity later on. The = current format allows a parser to discover and unload one or more JSON = payloads which can each have independent structure.

    General extensions

    The proposal = also rules out general purpose extensions not related to any specific = event. Given the emergence of items like GPRD, I would not want to block = the ability to add meta-data or other general purpose items. We can also = anticipate some delivery scenarios where additional data might be = required. Even though there is no current planned use, I see no good = reason to rule this out.

    Multiple Events = =46rom Different Families (vs. Multiple Events from a single family like = RISC)

    In our RISC session we discussed = expressing multiple distinct RISC events in one SET. The discussion was = that only one RISC event at a time. We did not discuss other event = profiles. I don=E2=80=99t see a reason to rule out multi-events from = different families at the SET level. Each profile is expressing slightly = different things about the same event.

    I = can forsee some cases where it is not clear which is the primary and = which is the extension.  There may not be a clear winner.

    A couple of examples (these are necessarily = real=E2=80=A6just possibilities):

    * It is = probably useful to be able to express simlar/overlapping events from = different SET profiles in one SET.  For example a Backchannel = Logout & a RISC session cancel event.

    * = SCIM may want to represent a single transaction as causing multiple = state changes in an event (e.g. a password change causes multiple = effects). Having to chase down multiple events and correlate by = =E2=80=9Ctxn=E2=80=9D would be challenging in a = multi-threaded/multi-node delivery system.   The SCIM list has = not discussed this, but I would not want to block this capability.  = IOW - Just because RISC does not want to express multiple events does = not make this true for other profiles.

    * We = may wish to indicate a SCIM Password Reset was performed and a = Logout/session cancellation is expressed at the same time.  The = events are related but express different data.

    Avoiding Confusion =46rom Similar Events Originating from the = Same Transaction

    If events are sent = separately, then more tracking of state (e.g. by txn) would be required = to ensure similar events are not mistaken or handled as repeats. While = txn provides useful audit analysis capability, I=E2=80=99m not sure it = can be used in live or near-real time systems given distributed = multi-node, multi-threading architectures.

    Previous Discussion

    I note that = I originally raised having an attribute to designate primary event = attribute to alleviate your concern, but this was not accepted. See:

    * https://www.ietf.org/mail-archive/web/id-event/current/msg00406= .html

    * https://www.ietf.org/mail-archive/web/id-event/current/msg00140= .html

    The consensus, at least as I = interpreted it is up to the receiver to figure this out based on the = definitions it has for each event URI and the profiles they represent. = IOW - RISC is free to limit that only one RISC event be expressed at a = time.

    Phil

    Oracle Corporation, Identity Cloud Services Architect

    @independentid

    www.independentid.com <http://www.independentid.com>

    phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>

        On Oct 23, 2017, at 7:02 PM, Richard Backman, = Annabelle
        <richanna@amazon.com <mailto:richanna@amazon.com>> wrote:

        The current draft of the SET spec allows for = expressing multiple
        events within the same = token, which introduces additional complexity
      =   and room for ambiguous semantics. We=E2=80=99ve discussed this in = the OIDF
        RISC working group and the current = consensus there is that RISC will
        require = that RISC events must be the only event in the SET, having
        identified ways to clearly and easily support = the handful of use
        cases for multiple events = per token that people have raised. With
        that = context in mind, I propose striking the definition of the
        =E2=80=9Cevents=E2=80=9D claim from the = Security Event Token spec, and replacing it
        = with the following definition for an =E2=80=9Cevent=E2=80=9D claim = (singular):

        event

        A JSON object containing an = "event_type" member whose value is a URI
        = representing a type of event defined in a Profiling Specification.
        The object MAY otherwise be empty, or MAY = contain additional members
        as described by = the Profiling Specification.

        = Here is the example SET from section 2.3, rewritten with this change
        mind:

      =   {

           "jti": = "4d3559ec67504aaba65d40b0363faad8",

      =      "iat": 1458496404,

     =     "iss": "https://scim.example.com <https://scim.example.com/>",

           "aud": [

             "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",<= br class=3D"">
             "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"
           ],

           "event": {

             = "event_type": "urn:ietf:params:scim:event:create",

             "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",<= br class=3D"">
             = "attributes": ["id", "name", "userName", "password", "emails"]

           }

        }

        = Does anyone in the working group have use cases for SETs that cannot
        be met by this proposed text? Within RISC, we = identified three use
        cases, with solutions = outlined below:

        **

        *Extensions*

        Event extension mechanisms can be defined = internal to the event
        object. A simple = approach would be to  define an =E2=80=9Cextensions=E2=80=9D = member
        that is a list of event objects (or = set resembling the =E2=80=9Cevents=E2=80=9D
        = claim as defined in the current spec). This has the advantage of
        making it clear in the data structure that = there is a single primary
        event, with zero = or more extensions. There is no room for confusion
      =   over which event is primary, or if there is a primary event at = all.
        I would be fine with adding something = like this to my proposed text,
        if there is = consensus that it is broadly useful.

      =   *Aliases*

        This use = case was brought up in the context of migrating clients
        from draft event names to standardized event = names. In this case,
        the event transmitter = can transmit two tokens for the logical event,
      =   one using the old name and another using the new name.

        *Related Events*
        The SET spec defines the txn claim as a means = of correlating
        independent tokens that = relate to the same logical event.

      =   -- 
        Annabelle Richard Backman

        Amazon =E2=80=93 Identity Services

        = _______________________________________________
      =   Id-event mailing list
        Id-event@ietf.org     <mailto:Id-event@ietf.org>
        https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3Izl= F7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D



    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


     
    -- 
    Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DYBCGlK9mjjhcFsj-2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV8= 02iMQ4wYB1f2rFUGu4zbhcW001fK02EXs&e=3D
     
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4K= ZNA&m=3DU-a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYN= RAnqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e=3D

    = --Apple-Mail=_6C6D0DF4-AC2D-4D27-A222-CE9BFD70AD41-- From nobody Mon Oct 30 14:10:04 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10B3E13FB85 for ; Mon, 30 Oct 2017 14:09:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Ixna0xmpmtR for ; Mon, 30 Oct 2017 14:09:46 -0700 (PDT) Received: from mail-pg0-x22f.google.com (mail-pg0-x22f.google.com [IPv6:2607:f8b0:400e:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DBEF13FB82 for ; Mon, 30 Oct 2017 14:09:23 -0700 (PDT) Received: by mail-pg0-x22f.google.com with SMTP id 15so12709152pgc.12 for ; Mon, 30 Oct 2017 14:09:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=eWogMeg4CqEBFpQs3Zp7o81XMCibjM2hOG/91/lLR0I=; b=Z8Kb7g3fcoC3qgv5VZyI7MF9Nvus2C5uCtdDAVDsdEAjHM4l2HFCdM47Rm2xrCqiIc CL7wf2/iHTok0yEDgo3NC2/EYoGHeiYVV34FcaVzkeFCVUwqBdJGzOGDrkCJbXPXI6PE 0h8sbt+e/lER1ZjMZzqv36A53C28i9tYZMh/myBUbQLSaUX4qAF5UZNvuwAyIsYnzfQf 5x5R/Y75fAV0d8w1Q/TAJUHbehuY7NF3SFOW+lRnx8tbqTKv9IfBQB8XV7UTMi/JxqKi nzjtTRN4ERFdBQ5FJEWhslKp+ZdQ08ZnsQpFjUHfIbtVfYS3c+xAL76cfaQqsYQ1x213 rFIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=eWogMeg4CqEBFpQs3Zp7o81XMCibjM2hOG/91/lLR0I=; b=qe13GOAjLuyG5WMX+jqBpyHgpfuD5SrSlhY0aRpN9nu6DoKl09D3nObLP6mzsnMF6K o1jS9B81u3hXOAJZhYL1Sd5lWtlcrkyDfBsHXFLMkhxZnXP1IB7vGGzj0DbR85ptNKUz 9LxyOfgQWvjZ/k55A1Klrd5DFWURxReRi93U5wH6HCZ6kInwNx2XYlByUsqfCqKr+njZ vIhWKXQ0E3sf9Dwla+tX4s07rzDaVOvwa4FUoFotQV7SBjktYfxwPlfj9GemspgRJ2Ag b6jpBb3FjIVlqc5G/8WiEVrxttIZBFuyRF5PTN5VUTo2uM8pqT51BAf1txkWfblojjHS 9pyA== X-Gm-Message-State: AMCzsaUSTAZIDWf8kyiHD08oDB0Q3fTK8ebDCldebPxRC2bNAA9wBNQv vsij6/M3nxRC9Jc8vURcQFVz2jxnPnM8LgLvXPxpvQ== X-Google-Smtp-Source: ABhQp+Qctc3qHrRu9OYVN/oVnmCgPN+gWywHkos2FgDK74gXLknIMrefiMNl5/cFZ2aZmiS79TZJ7uow1pC6cciozlU= X-Received: by 10.101.67.3 with SMTP id j3mr8738338pgq.278.1509397762843; Mon, 30 Oct 2017 14:09:22 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Mon, 30 Oct 2017 14:09:02 -0700 (PDT) From: Dick Hardt Date: Mon, 30 Oct 2017 14:09:02 -0700 Message-ID: To: SecEvent , Mike Jones , Phil Hunt , Annabelle Richard , Marius Scurtescu Content-Type: multipart/alternative; boundary="089e08200a687aa9ce055cca0d7d" Archived-At: Subject: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:09:49 -0000 --089e08200a687aa9ce055cca0d7d Content-Type: text/plain; charset="UTF-8" Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me know who is presenting what where it is xxx Thanks! Here are the documents we will be discussing: https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ https://datatracker.ietf.org/doc/draft-scurtescu-secevent-event-stream-mgmt-api/ https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ /Dick ----- IETF 100 Singapore Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 Agenda Setting Dick Hardt (chair) 13:30 - 13:40 Security Event Token (SET) xxx 13:40 - 14:00 SET Delivery using HTTP xxx 14:00 - 14:20 Chair Slides on Managment APIs Dick Hardt (chair) 14:20 - 14:30 Management API for SET Event Streams xxx 14:30 - 14:50 SET Stream Managment and Provisioning Phil Hunt 14:50 - 15:10 Management API Discussion Dick Hardt (chair) 15:10 - 15:20 AOB Dick Hardt (chair) 15:20 - 15:30 --089e08200a687aa9ce055cca0d7d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Here is the draft agenda. Mike, Phil, Marius, Annabel= le - please let me know who is presenting what where it is xxx
    Thanks!

    Here are the documents we wil= l be discussing:


    /Dick

    --= ---
    IETF 100 Singapore
    Bras Basah Monday Nov 13, 2017, = 13:30 - 15:30

    Agenda Setting=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick = Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:40
    Security E= vent Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 xxx=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A013:40 - 14:00=C2=A0 =C2=A0
    SET Delivery using HTTP=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0xxx=C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:00 - 14:2= 0=C2=A0
    Chair Slides on Managment APIs=C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 14:20 - 14:30
    Management API for SET Event Streams=C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:30 - 1= 4:50=C2=A0
    SET Stream Managment and Provisioning=C2=A0 =C2=A0Phil= Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:50 - = 15:10=C2=A0 =C2=A0=C2=A0
    Management API Discussion=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 = =C2=A0 =C2=A0 15:10 - 15:20
    AOB=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:20= - 15:30



    --089e08200a687aa9ce055cca0d7d-- From nobody Mon Oct 30 14:22:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B34413FBB0 for ; Mon, 30 Oct 2017 14:22:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wVI6ckxPiq47 for ; Mon, 30 Oct 2017 14:22:48 -0700 (PDT) Received: from mail-pg0-x236.google.com (mail-pg0-x236.google.com [IPv6:2607:f8b0:400e:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C81D113FBA8 for ; Mon, 30 Oct 2017 14:22:47 -0700 (PDT) Received: by mail-pg0-x236.google.com with SMTP id v78so12752596pgb.5 for ; Mon, 30 Oct 2017 14:22:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=/yQPFss2ahcmZ3Rdyso5lniyzBXoLCOtk1Ue2aByLyQ=; b=WGY9pewe7UW6PHvftQAc+uUhEEDfWyQab5VBVTmm2TCreykTlJLWGPvMlr6Od0dv4X AEby7RsAxb9QeIL9djd1mjF8dV7qtTqtT5AQRpRY26jCP9Mfvy5yqpIrDEBRb31d7f+z H4QmOIoXWc+vnzDXBipLp2ojxptxlJeK1QAOEE8D9CNvbM21+hJ/jIbKKFqjvp8rkwtn T6gUkAxaAzzbx4khRKcrM3Gjl7Fi3Ftbv91UBToIKk2vLPzUORJumq6TVEFVbxMbiMH+ h3dDh4Z20XkdYxRy5u/oYzgDfFdjnJjAlIjPg6WqPTbbc1dLEEkCDa8oI/edAjfS4vZL Wetw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=/yQPFss2ahcmZ3Rdyso5lniyzBXoLCOtk1Ue2aByLyQ=; b=LIOXI/lOiml1IcC/JiV7+9s2JGqJQkEMLkeiQo+USLvbhOeRIFfsG6WXpnDoDsfSeP IIhesee4Ae6U7n7yCNNQTmqgk3h39lLgN3MGpbgC7cpIM1LdiGqBRrpld+KIutkOKGoe l78uBLBmr1iyYOxZc+RzJPe1TtFIyNJ8gL7aP93OpLhMVwSFql7wdFygkgzurvGC3HRe ML/ioI8GeoFro10JECDvEer8tl6y8Ov/eFO7vLoodqKMkn0396WlOp2p5XeNdod4vu9A GwQYIiMrrZUmE6emm5p7Y19mMj/U1RAKGsNB1E/BT0QqQyO9M1wa/im0IwP/6PSMBPLN 61rw== X-Gm-Message-State: AMCzsaU1W4jWN1sLM96ZHSF5sdvA2qxiYrbGu5Thqx1h6UtA9WM33u1l 7KSyTYB9x6l1Lg3QJOrqdymGg6xbUwgG7LGphts= X-Google-Smtp-Source: ABhQp+TPvNDNCz8yg7dYAmhavc7pQKbfcLuQ9s7I9//PMaZo25xFeTvx0VsL1dhQBlqS1znDy66i+wINqpUubxVdIc8= X-Received: by 10.84.212.136 with SMTP id e8mr8349552pli.205.1509398566909; Mon, 30 Oct 2017 14:22:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Mon, 30 Oct 2017 14:22:26 -0700 (PDT) In-Reply-To: <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> From: Dick Hardt Date: Mon, 30 Oct 2017 14:22:26 -0700 Message-ID: To: Phil Hunt Cc: "Richard Backman, Annabelle" , Yaron Sheffer , Mike Jones , ID Events Mailing List Content-Type: multipart/alternative; boundary="f403045d24f667bd0a055cca3d6a" Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:22:52 -0000 --f403045d24f667bd0a055cca3d6a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Phil Correct me if I am misunderstanding, but there is a RISC profile event "http://schemas.openid.net/secevent/risc/event-type/ account-credential-= change-required=E2=80=9D and an SCIM profile event "https://example.com/scim/event/passwordResetExt=E2=80=9D I'm suggesting that two different events would be sent. Embedding one in the other does not make sense. Also, I think it is simpler to have event_type be at the same level as even= t { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "event_type": "https://example.com/scim/event/passwordResetExt", "event": { "id":"44f6142df96bd6ab61e7521d9", "resetAttempts":5 } } { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "event_type": " http://schemas.openid.net/secevent/risc/event-type/account-credential-chang= e-required ", "event": { =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" } } On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt wrote: > Annabelle/Dick, > > Thanks for the comments. I think we need to examine the consequences of > the proposal in JSON. > > As I stated, what causes most of the issue is the proposed extension > mechanism in the payload (possibly using events in a recursive way). Does > it follow the old format or the new? > > Let=E2=80=99s consider a use case where we have an identity management s= ystem > that uses SCIM, but the SCIM system is also the underlying data store for > Connect. A Password reset might generate the following event which has a= n > extension (conveying reset count) AND overlapping statement from RISC. > BOTH of which might be important to a similar receiver using SCIM and OID= C. > > > *The 03 spec currently would allow:* > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "events": { > "urn:ietf:params:scim:event:passwordReset": > { "id":"44f6142df96bd6ab61e7521d9"}, > "https://example.com/scim/event/passwordResetExt": > { "resetAttempts":5}, > > "http://schemas.openid.net/secevent/risc/event-type/\ > account-credential-change-required": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > } > } > > > In the above - each payload is a =E2=80=98peer' and issued without prefer= ence by the transmitter. The receiver can assign priority in its own contex= t if that matters. > > > *The new proposal:* > > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event": { > =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRes= et=E2=80=9D, > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevents=E2=80=9D:{ > > ->note =E2=80=A6is this the old or new structure? <- > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > "http://schemas.openid.net/secevent/risc/event-type/\ > account-credential-change-required": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > } > > } > > > In the above, sub-events or extensions have a different format. The same = complaint about the original stands. > > > **OR* (if the receiver cares about RISC more). Note that this leads to a= triple nested structure.* > > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ > > account-credential-change-required=E2=80=9D, > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, > > =E2=80=9Cevents=E2=80=9D:{ > > "urn:ietf:params:scim:event:passwordReset": > { > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevents=E2=80=9D:{ > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > } > > } > } > > } > } > > > In the above, the extension is placed inside the event it extends. It > follows the old format (or should it follow the new?) > > **OR* Following the top layer pattern of singular event Note that this l= eads to a triple nested structure.* > > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ > > account-credential-change-required=E2=80=9D, > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, > > =E2=80=9Cevent=E2=80=9D:{ > > =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:password= Reset=E2=80=9D, > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevent=E2=80=9D:{ > > =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/pa= sswordResetExt=E2=80=9D, > > "resetAttempts":5 > > } > } > > } > } > > > This format follows the proposed singular event format recursively and is > 3 layers deep. Note that the parser has to continue to search the documen= t > for things that aren=E2=80=99t there as it has to stop when no =E2=80=9Ce= vent=E2=80=9D attribute is > found rather than iterate over an array. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > phil.hunt@oracle.com > > On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle < > richanna@amazon.com> wrote: > > Replies inline. > > -- > Annabelle Richard Backman > Identity Services > > > *From: *Phil Hunt > *Date: *Sunday, October 29, 2017 at 5:25 PM > *To: *Dick Hardt > *Cc: *Yaron Sheffer , Mike Jones < > Michael.Jones@microsoft.com>, "Richard Backman, Annabelle" < > richanna@amazon.com>, ID Events Mailing List > *Subject: *Re: [Id-event] Use cases for multiple events per SET? > > I hope this answers your question. > > My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why not= . The question should be, > what is the justification to make =E2=80=9Cevents=E2=80=9D singular? > [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer semantic= s and is easier > to process. We should opt for easier solutions unless there are use cases > that require more complexity.[/richanna] > > There are many reasons for multiple events in a SET. Some are good, some > not so good. Some of the reasons... > > 1. Multiple event payloads expressing statements about largely the > *same*thing. For example, SCIM password reset AND RISC password reset. A > RISC Event and an OpenBanking Event. Is one a complement to the other? D= o > they overlap or are they distinct? > [richanna]Copy/pasted from my earlier email: > Why is it necessary or appropriate to include these events in the same > SET? They are likely being generated by different systems at different > times on the transmitter=E2=80=99s side, consumed by different systems on= the > receiver=E2=80=99s side, and possibly being transmitted over different ev= ent > streams. I know the latter would be the case for us, as a receiver. Even = if > it=E2=80=99s not, is it burdensome to send these events separately? What = value is > gained in combining them? > > Additionally, since the signature is over the SET and not the event > objects, Receivers independently route separate events from a single toke= n > without either losing the ability to verify the authenticity of the event > or sharing all information in the SET with every system handling any even= t > in the token.[/richanna] > > 2. Multiple events payloads expressing different statements about the > same transaction - RISC Password Reset and RISC Session Cancel > [richanna]Same as above[/richanna] > > 3. A new profile defines new event attributes to be added on to an > existing event type (a pure extension) > [richanna]I have suggested a way to support extensions within an event > body, multiple times now. If you see problems with it, please point them > out.[/richanna] > > I think it is quite valid to allow 1 and 3. 2 could be limited by > specific profiles like RISC if they want. > > I am not in agreement that making event singular simplifies anything. For > one is makes extensions complex (another nested JSON structure) and > potentially conflicting. > [richanna] > Ways that multiple-event SETs are more complicated: > > 1. It results in a more complex structure for the single event use > case, which I think we all agree is the majority use case. > 2. Multiple-event SETs have ambiguous semantics. The presence of two > events A and B in the same SET could mean any of: > > > 1. They are related to the same logical event (i.e. the same thing as > if they were from different SETs that have a common txn). > 2. A is an extension of B. > 3. B is an extension of A. > 4. They are aliases for one another. > 5. They are not actually related to one another in any way. > > > 1. Claim semantics become harder to define, as different profiles may > want to use the same claims in different ways. > > > If the WG wants to block 1 and 2 above, then I believe we have to > establish an event registry to ensure new Event profiles do not overlap t= o > eliminate the need to express multiple events. > [richanna]I=E2=80=99m not sure what you mean by this. Are you referring t= o event > names? Those are already defined by the spec to be URIs.[/richanna] > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > > phil.hunt@oracle.com > > > On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: > > Phil: > > In your examples for having a plurality of events, you use the word "may"= , > which leads me to question if a plurality of events is really required in > SET. > > You posit that it will be difficult for a distributed system to correlate > multiple SETs with the same "txn", but the distributed system will > certainly need to correlate events on the same subject -- correlating > events on the same "txn" on the same subject seems fairly simple. > > I think that a receiver will need to correlate multiple SEts on the same > subject, so having multiple events in a SET is redundant, and adds > complexity with no clear benefit that I can see. > > An implementor may choose to send multiple SETs, or send a single SET wit= h > multiple events, so a receiver will need to support both. I prefer we pic= k > one way and minimize the code paths, and we will need to support > correlating across multiple SETs, so that seems the best mechanism. > > Let me know if there is something I missed in my logic. > > /Dick > > > On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer > wrote: > > In that case, let's add text to that effect, e.g. we could add to the > definition of the "events" claim: > > Profiling specifications SHOULD define the allowed event statements, and > MAY restrict their number. For example, some profiles may require this > claim to contain only a single event statement. > > Thanks, > Yaron > > On 24/10/17 22:10, Mike Jones wrote: > > I agree with much of Phil=E2=80=99s rationale here. > > It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a > singleton. That doesn=E2=80=99t have to be true for all events. I think= things > are fine as-is. > > -- Mike > > *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil > Hunt > *Sent:* Monday, October 23, 2017 8:47 PM > *To:* Richard Backman, Annabelle > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > Annabelle, > > I have a number of concerns with this proposal. > > Profiling Independence / Keeping Event Payloads Independent > > Indicating that extensions should be handled by profiles leads to more > inter-operability issues and more importantly intrudes on the Event paylo= ad > space by suggesting a sub-schema creates potential limitations and > conflicts that may add to complexity later on. The current format allows = a > parser to discover and unload one or more JSON payloads which can each ha= ve > independent structure. > > General extensions > > The proposal also rules out general purpose extensions not related to any > specific event. Given the emergence of items like GPRD, I would not want = to > block the ability to add meta-data or other general purpose items. We can > also anticipate some delivery scenarios where additional data might be > required. Even though there is no current planned use, I see no good reas= on > to rule this out. > > Multiple Events From Different Families (vs. Multiple Events from a singl= e > family like RISC) > > In our RISC session we discussed expressing multiple distinct RISC events > in one SET. The discussion was that only one RISC event at a time. We did > not discuss other event profiles. I don=E2=80=99t see a reason to rule ou= t > multi-events from different families at the SET level. Each profile is > expressing slightly different things about the same event. > > I can forsee some cases where it is not clear which is the primary and > which is the extension. There may not be a clear winner. > > A couple of examples (these are necessarily real=E2=80=A6just possibiliti= es): > > * It is probably useful to be able to express simlar/overlapping events > from different SET profiles in one SET. For example a Backchannel Logout= & > a RISC session cancel event. > > * SCIM may want to represent a single transaction as causing multiple > state changes in an event (e.g. a password change causes multiple effects= ). > Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80= =9D would be > challenging in a multi-threaded/multi-node delivery system. The SCIM li= st > has not discussed this, but I would not want to block this capability. I= OW > - Just because RISC does not want to express multiple events does not mak= e > this true for other profiles. > > * We may wish to indicate a SCIM Password Reset was performed and a > Logout/session cancellation is expressed at the same time. The events ar= e > related but express different data. > > Avoiding Confusion From Similar Events Originating from the Same > Transaction > > If events are sent separately, then more tracking of state (e.g. by txn) > would be required to ensure similar events are not mistaken or handled as > repeats. While txn provides useful audit analysis capability, I=E2=80=99m= not sure > it can be used in live or near-real time systems given distributed > multi-node, multi-threading architectures. > > Previous Discussion > > I note that I originally raised having an attribute to designate primary > event attribute to alleviate your concern, but this was not accepted. See= : > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html > > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html > > > The consensus, at least as I interpreted it is up to the receiver to > figure this out based on the definitions it has for each event URI and th= e > profiles they represent. IOW - RISC is free to limit that only one RISC > event be expressed at a time. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > > > > > phil.hunt@oracle.com > > On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle > > wrote: > > The current draft of the SET spec allows for expressing multiple > events within the same token, which introduces additional complexity > and room for ambiguous semantics. We=E2=80=99ve discussed this in the= OIDF > RISC working group and the current consensus there is that RISC will > require that RISC events must be the only event in the SET, having > identified ways to clearly and easily support the handful of use > cases for multiple events per token that people have raised. With > that context in mind, I propose striking the definition of the > =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, an= d replacing it > with the following definition for an =E2=80=9Cevent=E2=80=9D claim (s= ingular): > > event > > A JSON object containing an "event_type" member whose value is a URI > representing a type of event defined in a Profiling Specification. > The object MAY otherwise be empty, or MAY contain additional members > as described by the Profiling Specification. > > Here is the example SET from section 2.3, rewritten with this change > mind: > > { > > "jti": "4d3559ec67504aaba65d40b0363faad8", > > "iat": 1458496404, > > "iss": "https://scim.example.com ", > > "aud": [ > > "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > "event_type": "urn:ietf:params:scim:event:create", > > "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 > ", > > "attributes": ["id", "name", "userName", "password", "emails"] > > } > > } > > Does anyone in the working group have use cases for SETs that cannot > be met by this proposed text? Within RISC, we identified three use > cases, with solutions outlined below: > > ** > > *Extensions* > > Event extension mechanisms can be defined internal to the event > object. A simple approach would be to define an =E2=80=9Cextensions= =E2=80=9D member > that is a list of event objects (or set resembling the =E2=80=9Cevent= s=E2=80=9D > claim as defined in the current spec). This has the advantage of > making it clear in the data structure that there is a single primary > event, with zero or more extensions. There is no room for confusion > over which event is primary, or if there is a primary event at all. > I would be fine with adding something like this to my proposed text, > if there is consensus that it is broadly useful. > > *Aliases* > > This use case was brought up in the context of migrating clients > from draft event names to standardized event names. In this case, > the event transmitter can transmit two tokens for the logical event, > one using the old name and another using the new name. > > *Related Events* > > The SET spec defines the txn claim as a means of correlating > independent tokens that relate to the same logical event. > > -- > Annabelle Richard Backman > > Amazon =E2=80=93 Identity Services > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps- > 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > s5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3D > X8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > -- > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj- > 2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zb > hcW001fK02EXs&e=3D > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU- > a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp= - > MJ20ui2nm46QSz0&e=3D > > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --f403045d24f667bd0a055cca3d6a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hi Phil

    Correct me if I am misunderstan= ding, but there is a RISC profile event=C2=A0

    "http://schemas.openid.net/secevent/risc/<=
wbr>event-type/account-credential-change-required=E2=80=9D

    and an SCIM prof= ile event

    I'm suggesting that two different= events would be sent. Embedding one in the other does not make sense.
    <= /div>

    Also, I think it is simpler to have event_type be = at the same level as event

    {
    = =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
    =C2=A0 "iat": 145= 8496025,
    =C2=A0 "= iss": "https://scim.example.= com",
    =C2=A0 = "aud": [
    =
    =C2=A0 =C2=A0],
    <= font face=3D"monospace, monospace">=C2=A0 =C2=A0"event_type": &qu= ot;https://exam= ple.com/scim/event/passwordResetExt",
    =C2=A0 =C2=A0"event": {=C2=A0=C2=A0
    =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0"id":"44f6142df96bd6ab61e7521d9",
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0"resetAttempts":5
    =C2=A0 =C2=A0 =C2=A0 =C2=A0}
    }

    =
    {
    =C2=A0 "jti": "3d0c3cf7975= 84bd193bd0fb1bd4e7d30",
    =C2=A0 "iat": 1458496025,
    =C2=A0 "iss": "https://scim.example.com",
    =C2=A0 "aud": [
    = =C2=A0 =C2=A0],
    =C2=A0 =C2=A0&q= uot;event": {
    =C2= =A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80= =9D,
    =C2=A0 =C2=A0 =C2= =A0 =C2=A0=E2=80=9Ciss=E2=80=9D:"= https://idp.example.com/"=C2=A0 =C2=A0 =C2=A0 =C2=A0
    <= div>=C2=A0 =C2=A0 =C2=A0 =C2=A0}=
    }





    On Mon, Oc= t 30, 2017 at 12:09 PM, Phil Hunt <phil.hunt@oracle.com> = wrote:
    Annabelle/Dick,

    Thanks for the comments. I = think we need to examine the consequences of the proposal in JSON.

    As I stated, what causes most of the issue is the proposed exte= nsion mechanism in the payload (possibly using events in a recursive way). = Does it follow the old format or the new?

    Let=E2=80=99s = =C2=A0consider a use case where we have an identity management system that = uses SCIM, but the SCIM system is also the underlying data store for Connec= t.=C2=A0 A Password reset might generate the following event which has an e= xtension (conveying reset count) AND overlapping statement from RISC.=C2=A0= BOTH of which might be important to a similar receiver using SCIM and OIDC= . =C2=A0

    The 03 spec currently would allow:= 

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5b=
bc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d=
08641d7676ee7"
   ],
   "events": {
     "urn:ietf:params:scim:event:passwordReset":
       { "id":"44f6142df96bd6ab61e7521d9"},
     "https://example.com/scim/event/passwordResetExt"=
;:
       { "resetAttempts":5},
      =
   "http://schemas.openid.net/secevent/risc/event-type/=
\
    =C2=A0 =C2=A0 =C2=A0 =C2=A0account-credential-change-required=
": {
             =E2=80=9Csub=E2=
=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
             =E2=80=9Ciss=E2=80=9D:"https://idp=
.example.com/"
         =
  }
  }
}

    In the above - each payload is a =E2=80=98peer' a=
nd issued without preference by the transmitter. The receiver can assign pr=
iority in its own context if that matters.

    The=
 new proposal:

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5b=
bc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d=
08641d7676ee7"
   ],
   "event": {
     =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:pas=
swordReset=E2=80=9D,
     "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
    =

         =E2=80=9Cevents=E2=80=9D:{<=
/pre>
         ->note =E2=80=A6is =
this the old or new structure? <-
           "https://example.com/scim/event/passwordReset=
Ext":
             { &=
quot;resetAttempts":5},
           "=
;http://schemas.openid.net/secevent/risc/event-type/\=C2=A0 =C2=A0 =C2=A0   =C2=A0account-credential-change-required"=
;: {
             =E2=80=9Csub=E2=80=
=9D:=E2=80=9D7375626A656374=E2=80=9D,
             =E2=80=9Ciss=E2=80=9D:"https://idp.ex=
ample.com/"
           }=

         }
       }  =
  
    }

    In the ab=
ove, sub-events or extensions have a different format. The same complaint a=
bout the original stands.
    =

    *OR* (if the recei=
ver cares about RISC more).  Note that this leads to a triple nested struct=
ure.

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5b=
bc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d=
08641d7676ee7"
   ],
   "event": {
       =
  =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-type/\
    =C2=A0 =C2=A0 =C2=A0       =C2=A0account-credential-change-required=E2=80=9D,
          =E2=80=9Csub=E2=80=9D:=E2=80=
=9D7375626A656374=E2=80=9D,
          =E2=80=9Ciss=E2=80=9D:"https://=
idp.example.com/=E2=80=9C,
          =E2=80=9Cevents=E2=80=9D:{
            "urn:ietf:params:scim:event:passwordRe=
set":
        {=C2=A0
        =
      "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
              =E2=80=9Cevents=E2=80=
=9D:{
                 "https://example.com/scim/event/passwordResetExt":
                   { "resetAttempts&=
quot;:5},  
              }      
       =
     }
          }     

       }
}

    In the above, the extension is placed inside the event it extends. =
It follows the old format (or should it follow the new?)
    =

    *OR* Following the top layer p=
attern of singular event  Note that this leads to a triple nested structure=
.

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5b=
bc879593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d=
08641d7676ee7"
   ],
   "event": {
       =
  =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-type/\
    =C2=A0 =C2=A0 =C2=A0       =C2=
=A0account-credential-change-required=E2=80=9D,
          =E2=80=9Csub=E2=
=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
          =E2=
=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,<=
/font>
          =E2=80=9Cevent=E2=80=9D:{
            =E2=80=9Cevent_type=E2=80=9D=
:"urn:ietf:params:scim:event:passwordReset=E2=80=9D,
    =

            "id":=E2=80=9D44f6142df9=
6bd6ab61e7521d9=E2=80=9D,
            =E2=80=9Cevent=E2=80=9D:{
              =E2=80=9Cevent_type=E2=80=9D:"https://exampl=
e.com/scim/event/passwordResetExt=E2=80=9D,
              "resetAttempts":5 
            }
          }     

       }
}

    =

    This format follows the proposed singu=
lar event format recursively and is 3 layers deep. Note that the parser has=
 to continue to search the document for things that aren=E2=80=99t there as=
 it has to stop when no =E2=80=9Cevent=E2=80=9D attribute is found rather t=
han iterate over an array.

    Phil

    Oracle Corporation, Identity Cl=
oud Services Architect
    @independentid
    www.independentid.com
    phil.hunt@oracle.com
    <=
/span>

    On Oc=
t 30, 2017, at 8:57 AM, Richard Backman, Annabelle <richanna@amazon.com> wrote:
    =

    Replies inline.
    =C2=A0
    --=C2=A0
    Annabell=
e Richard Backman
    Identity Services<=
/u>
    =C2=A0
    =
=C2=A0
    From:=C2=A0Phil Hunt <phil.hunt@oracle.com<=
/a>>
    Date:=C2=A0Sunday, October 29, 2017 at 5:25 PM
    To:=C2=A0Dick Hard=
t <    dick.hardt@gmail.com>
    Cc=
:=C2=A0Yaron Sheffer <yaronf.ietf@gmail.com<=
/a>>, Mike Jones <Michael.Jone=
s@microsoft.com>, "Richard Backman, Annabelle" <richanna@amazon.com>, ID Events Mailing List=
 <id-event@ietf.org>
    Subject:<=
span class=3D"m_4026236456080349644Apple-converted-space">=C2=A0    =
Re: [Id-event] Use cases for multiple events per SET?<=
/div>
    =C2=A0
    =
I hope this answers your question.
    =
=C2=A0
    My =E2=80=9Cmay=E2=80=9D was=
 because I can=E2=80=99t see a reason why not. The question should be, what=
 is the justification to make =E2=80=9Cevents=E2=80=9D singular?<=
/u>
    [richanna]The sing=
ular =E2=80=9Cevent=E2=80=9D claim has clearer semantics and is easier to p=
rocess. We should opt for easier solutions unless there are use cases that =
require more complexity.[/richanna]
    =C2=A0
    There are many reaso=
ns for multiple events in a SET.=C2=A0 Some are good, some not so good. Som=
e of the reasons...
    =C2=A0
    1.=C2=A0 Multiple event payloads expressing=
 statements about largely the *same*thing. For example, SCIM password reset=
 AND RISC password reset.=C2=A0 A RISC Event and an OpenBanking Event. Is o=
ne a complement to the other?=C2=A0 Do they overlap or are they distinct? =
=C2=A0
    [=
richanna]Copy/pasted from my earlier email:
    Why is it necessary or appropria=
te to include these events in the same SET? They are likely being generated=
 by different systems at different times on the transmitter=E2=80=99s side,=
 consumed by different systems on the receiver=E2=80=99s side, and possibly=
 being transmitted over different event streams. I know the latter would be=
 the case for us, as a receiver. Even if it=E2=80=99s not, is it burdensome=
 to send these events separately? What value is gained in combining them?
    =C2=A0
    Additionally, since the signature is over the SET and not the event obj=
ects, Receivers independently route separate events from a single token wit=
hout either losing the ability to verify the authenticity of the event or s=
haring all information in the SET with every system handling any event in t=
he token.[/richanna]
    =C2=A0
    =
2.=C2=A0 Multiple events payloads expressing different statements about the=
 same transaction - RISC Password Reset and RISC Session Cancel
    [richanna]Same as above[/richanna]

    =

    3.=C2=A0 A new profile defines=
 new event attributes to be added on to an existing event type (a pure exte=
nsion)=C2=A0
    [richanna]I have sugg=
ested a way to support extensions within an event body, multiple times now.=
 If you see problems with it, please point them out.[/richanna]
    =C2=A0
    I think it is quite valid to allow 1 and 3. =C2=A02 could be limite=
d by specific profiles like RISC if they want.
    =C2=A0
    I am not in agre=
ement that making event singular simplifies anything. For one is makes exte=
nsions complex (another nested JSON structure) and potentially conflicting.=
=C2=A0
    [richanna]
    Ways that multipl=
e-event SETs are more complicated:
    1. It results in a=
 more complex structure for the single event use case, which I think we all=
 agree is the majority use case.
    2. Multiple-event SETs =
have ambiguous semantics. The presence of two events A and B in the same SE=
T could mean any of:
      1. They are related to the same logical =
event (i.e. the same thing as if they were from different SETs that have a =
common txn).
      2. A is an extension of B.
      3. B is an extension of A.
      4. They are aliases for on=
e another.
      5. They are not actually related to one anoth=
er in any way.
    1. Claim semantics become harder to =
define, as different profiles may want to use the same claims in different =
ways.
    =C2=A0
    If the WG wants to block 1 and 2 above, then I believ=
e we have to establish an event registry to ensure new Event profiles do no=
t overlap to eliminate the need to express multiple events.
    [richanna]I=
=E2=80=99m not sure what you mean by this. Are you referring to event names=
? Those are already defined by the spec to be URIs.[/richanna]
    =

    Phil<=
/span>
    =C2=A0
    Oracle Corporation, Identity Cloud Services Archite=
ct
    @independentid
    <=
/div>
    =C2=A0
    =
On Oct 29, 2017, at 4:12 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
    =
=C2=A0
    Phil:
    =
=C2=A0
    In your examples for having a plurality =
of events, you use the word "may", which leads me to question if =
a plurality of events is really required in SET.
    =

    =C2=A0
    You posit that it will =
be difficult for a distributed system to correlate multiple SETs with the s=
ame "txn", but the distributed system will certainly need to corr=
elate events on the same subject -- correlating events on the same "tx=
n" on the same subject seems fairly simple.
    =

    =C2=A0
    I think that a receiver=
 will need to correlate multiple SEts on the same subject, so having multip=
le events in a SET is redundant, and adds complexity with no clear benefit =
that I can see.
    =C2=A0
    An implementor may choose to send multiple SETs, or send=
 a single SET with multiple events, so a receiver will need to support both=
. I prefer we pick one way and minimize the code paths, and we will need to=
 support correlating across multiple SETs, so that seems the best mechanism=
.
    =C2=A0
    Let me know if there is something I missed in my logic.
    =C2=A0
    =
/Dick=

    =C2=A0
    <=
div>
    =C2=A0
    On Sun, Oct 29, 2017 at 11:28 AM, Yar=
on Sheffer=C2=A0=
<yaronf.ietf@gmail.com&=
gt;=C2=A0=
wrote:
    In that =
case, let's add text to that effect, e.g. we could add to the definitio=
n of the "events" claim:

    Profiling specifications SHOULD d=
efine the allowed event statements, and MAY restrict their number. For exam=
ple, some profiles may require this claim to contain only a single event st=
atement.

    Thanks,
    =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0Yaron

    On 24/10/17=
 22:10, Mike Jones wrote:
    I agree with much of Phil=E2=80=99s rationale here=
.

    It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevent=
s=E2=80=9D set must be a singleton.=C2=A0 That doesn=E2=80=99t have to be t=
rue for all events.=C2=A0 I think things are fine as-is.

    =C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=
=A0-- Mike

    *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt*Sent:* Monday, October 23, 2017 8:47 PM
    *To:* Richard Backman, Annabel=
le <richanna@amazon.com>
    *Cc:* =
ID Events Mailing List <id-event@ietf.org>
    *Subject:* Re: [Id-event] Use cases for multiple events per SET?<=
br>
    Annabelle,

    I have a number of concerns with this proposal.
    Profiling Independence / Keeping Event Payloads Independent

    Ind=
icating that extensions should be handled by profiles leads to more inter-o=
perability issues and more importantly intrudes on the Event payload space =
by suggesting a sub-schema creates potential limitations and conflicts that=
 may add to complexity later on. The current format allows a parser to disc=
over and unload one or more JSON payloads which can each have independent s=
tructure.

    General extensions

    The proposal also rules out gene=
ral purpose extensions not related to any specific event. Given the emergen=
ce of items like GPRD, I would not want to block the ability to add meta-da=
ta or other general purpose items. We can also anticipate some delivery sce=
narios where additional data might be required. Even though there is no cur=
rent planned use, I see no good reason to rule this out.

    Multiple Ev=
ents From Different Families (vs. Multiple Events from a single family like=
 RISC)

    In our RISC session we discussed expressing multiple distinct=
 RISC events in one SET. The discussion was that only one RISC event at a t=
ime. We did not discuss other event profiles. I don=E2=80=99t see a reason =
to rule out multi-events from different families at the SET level. Each pro=
file is expressing slightly different things about the same event.

    I=
 can forsee some cases where it is not clear which is the primary and which=
 is the extension.=C2=A0 There may not be a clear winner.

    A couple o=
f examples (these are necessarily real=E2=80=A6just possibilities):

    =
* It is probably useful to be able to express simlar/overlapping events fro=
m different SET profiles in one SET.=C2=A0 For example a Backchannel Logout=
 & a RISC session cancel event.

    * SCIM may want to represent a s=
ingle transaction as causing multiple state changes in an event (e.g. a pas=
sword change causes multiple effects). Having to chase down multiple events=
 and correlate by =E2=80=9Ctxn=E2=80=9D would be challenging in a multi-thr=
eaded/multi-node delivery system.=C2=A0 =C2=A0The SCIM list has not discuss=
ed this, but I would not want to block this capability.=C2=A0 IOW - Just be=
cause RISC does not want to express multiple events does not make this true=
 for other profiles.

    * We may wish to indicate a SCIM Password Reset=
 was performed and a Logout/session cancellation is expressed at the same t=
ime.=C2=A0 The events are related but express different data.

    Avoidi=
ng Confusion From Similar Events Originating from the Same Transaction
    <=
br>If events are sent separately, then more tracking of state (e.g. by txn)=
 would be required to ensure similar events are not mistaken or handled as =
repeats. While txn provides useful audit analysis capability, I=E2=80=99m n=
ot sure it can be used in live or near-real time systems given distributed =
multi-node, multi-threading architectures.

    Previous Discussion
    I note that I originally raised having an attribute to designate primary =
event attribute to alleviate your concern, but this was not accepted. See:<=
br>
    *=C2=A0    https://www.i=
etf.org/mail-archive/web/id-event/current/msg00406.html
    *=C2=A0=
https://www.ietf.or=
g/mail-archive/web/id-event/current/msg00140.html

    The =
consensus, at least as I interpreted it is up to the receiver to figure thi=
s out based on the definitions it has for each event URI and the profiles t=
hey represent. IOW - RISC is free to limit that only one RISC event be expr=
essed at a time.

    Phil

    Oracle Corporation, Identity Cloud Serv=
ices Architect

    @independentid

    www.independentid.c=
om=C2=A0<http://www.independentid.com>

    phil.hunt@oracle.com=C2=A0<mailto:phil.hunt@oracle.com>

    =C2=A0 =C2=A0 On Oct=
 23, 2017, at 7:02 PM, Richard Backman, Annabelle
    =C2=A0 =C2=A0 <richanna@amazon.com=C2=A0<mailto:richanna@amazon.com>> wrote:

    =C2=A0 =C2=
=A0 The current draft of the SET spec allows for expressing multiple
    =C2=
=A0 =C2=A0 events within the same token, which introduces additional comple=
xity
    =C2=A0 =C2=A0 and room for ambiguous semantics. We=E2=80=99ve discu=
ssed this in the OIDF
    =C2=A0 =C2=A0 RISC working group and the current c=
onsensus there is that RISC will
    =C2=A0 =C2=A0 require that RISC events =
must be the only event in the SET, having
    =C2=A0 =C2=A0 identified ways =
to clearly and easily support the handful of use
    =C2=A0 =C2=A0 cases for=
 multiple events per token that people have raised. With
    =C2=A0 =C2=A0 t=
hat context in mind, I propose striking the definition of the
    =C2=A0 =C2=
=A0 =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, and =
replacing it
    =C2=A0 =C2=A0 with the following definition for an =E2=80=
=9Cevent=E2=80=9D claim (singular):

    =C2=A0 =C2=A0 event

    =C2=
=A0 =C2=A0 A JSON object containing an "event_type" member whose =
value is a URI
    =C2=A0 =C2=A0 representing a type of event defined in a P=
rofiling Specification.
    =C2=A0 =C2=A0 The object MAY otherwise be empty,=
 or MAY contain additional members
    =C2=A0 =C2=A0 as described by the Pro=
filing Specification.

    =C2=A0 =C2=A0 Here is the example SET from sec=
tion 2.3, rewritten with this change
    =C2=A0 =C2=A0 mind:

    =C2=A0 =
=C2=A0=C2=A0{

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "jti": "4d3559ec=
67504aaba65d40b0363faad8",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 &quo=
t;iat": 1458496404,

    =C2=A0 =C2=A0 =C2=A0=C2=A0"iss": =
"https://scim.example.com=C2=A0<https://scim.example.com/>",

    =
=C2=A0 =C2=A0 =C2=A0=C2=A0 "aud": [

    =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/98d52461fa5bbc879593b7=
754",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.=
com/Feeds/5d7604516b1d08641d7676ee7"

    =C2=A0 =C2=
=A0 =C2=A0=C2=A0 ],

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "event": {<=
br>
    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "event_type": "=
;urn:ietf:params:scim:event:create",

    =C2=A0 =C2=A0 =C2=A0=
=C2=A0=C2=A0=C2=A0 "ref": "https://scim.example.com/Users/44f614=
2df96bd6ab61e7521d9",

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=
=A0 "attributes": ["id", "name", "userNa=
me", "password", "emails"]

    =C2=A0 =C2=A0 =
=C2=A0=C2=A0 }

    =C2=A0 =C2=A0 }

    =C2=A0 =C2=A0 Does anyone in t=
he working group have use cases for SETs that cannot
    =C2=A0 =C2=A0 be me=
t by this proposed text? Within RISC, we identified three use
    =C2=A0 =C2=
=A0 cases, with solutions outlined below:

    =C2=A0 =C2=A0 **

    =
=C2=A0 =C2=A0 *Extensions*

    =C2=A0 =C2=A0 Event extension mechanisms =
can be defined internal to the event
    =C2=A0 =C2=A0 object. A simple appr=
oach would be to =C2=A0define an =E2=80=9Cextensions=E2=80=9D member
    =C2=
=A0 =C2=A0 that is a list of event objects (or set resembling the =E2=80=9C=
events=E2=80=9D
    =C2=A0 =C2=A0 claim as defined in the current spec). Thi=
s has the advantage of
    =C2=A0 =C2=A0 making it clear in the data structu=
re that there is a single primary
    =C2=A0 =C2=A0 event, with zero or more=
 extensions. There is no room for confusion
    =C2=A0 =C2=A0 over which eve=
nt is primary, or if there is a primary event at all.
    =C2=A0 =C2=A0 I wo=
uld be fine with adding something like this to my proposed text,
    =C2=A0 =
=C2=A0 if there is consensus that it is broadly useful.

    =C2=A0 =C2=
=A0 *Aliases*

    =C2=A0 =C2=A0 This use case was brought up in the cont=
ext of migrating clients
    =C2=A0 =C2=A0 from draft event names to standar=
dized event names. In this case,
    =C2=A0 =C2=A0 the event transmitter can=
 transmit two tokens for the logical event,
    =C2=A0 =C2=A0 one using the =
old name and another using the new name.

    =C2=A0 =C2=A0 *Related Even=
ts*

    =C2=A0 =C2=A0 The SET spec defines the txn claim as a means of c=
orrelating
    =C2=A0 =C2=A0 independent tokens that relate to the same logi=
cal event.

    =C2=A0 =C2=A0 --=C2=A0
    =C2=A0 =C2=A0 Annabelle Richard Backman<=
br>
    =C2=A0 =C2=A0 Amazon =E2=80=93 Identity Services

    =C2=A0 =C2=
=A0 _______________________________________________
    =C2=A0 =C2=A0 I=
d-event mailing list
    =C2=A0 =C2=A0=C2=A0Id-event@iet=
f.org=C2=A0<=
/span><mailto:Id-event@ietf.org>=
;
    =C2=A0 =C2=A0=C2=A0https://urldefense.pr=
oofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_i=
d-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL=
IGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3D<=
wbr>X8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D


    _______________________________________________
    Id-event mail=
ing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-eve=
nt

    _____________________________=
__________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.=
ietf.org/mailman/listinfo/id-event


    =C2=
=A0
    --=C2=A0
    Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am =
working on!
    <=
/div>
    =C2=A0
    _________________________________= ______________
    Id-event mailing list
    Id-event@ietf.org
    = https://urldefense.proof= point.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-<= wbr>2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIr= MUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA= &m=3DU-a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e=3D

    <= /div>


    --
    Subscribe to the HARDTWARE mail list to learn about projects I am wo= rking on!
    --f403045d24f667bd0a055cca3d6a-- From nobody Mon Oct 30 14:26:20 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2D6113FB8D for ; Mon, 30 Oct 2017 14:26:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YNn0otIFBbu2 for ; Mon, 30 Oct 2017 14:26:14 -0700 (PDT) Received: from mail-pg0-x22f.google.com (mail-pg0-x22f.google.com [IPv6:2607:f8b0:400e:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE72B13FB67 for ; Mon, 30 Oct 2017 14:26:14 -0700 (PDT) Received: by mail-pg0-x22f.google.com with SMTP id b192so12768796pga.2 for ; Mon, 30 Oct 2017 14:26:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=DvfTo4d4aIPIm/dbfHR9Wp774B7K30AodLjj2KBj/A0=; b=ciZMH7wLABuO0JR+6N4cSERgbzHfn3QygA1Y0eRnWh1naY3K2ZcsO3/hxY54LXoyKr i3VEnXUy9T81ohNXJeOMjsJVNoDU4Z0w9KDeNylLdaFiL6LXCWREv5JevjtW0qZ8Rjkf j2VUX8GSsdCMRMH1+kRPLC9DPl0Eu1UGLISVnRA6yCIQ679A0qU+B4TqXFRdJj9FFzz8 ZOtiOz4kmliaCYZl0vnwWPwMCP+4Fu81152jDDMp6MWNJaZqipW0US2D7QS2ZO2i2sXP kO5qtB4f9ejTbTf+f86gFHboF/e1CeJNm2VcPjG7UiFaREL84BXVvud47fPZOo4BWnI9 Om5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=DvfTo4d4aIPIm/dbfHR9Wp774B7K30AodLjj2KBj/A0=; b=QRVI2zUeLvPO9/uah4wTOsNB7Pasxp2gwBtrNatDoxQF4mAbkb4bWu0aKejAF7TTSU edLQNpNOKd83fG1rS/PhTbokqQMkb75+vcUEXEWHK2kzBI6QJN0QlceHEUcMngXkEkMA uPFrp4XyWl6fF+SJ/0fG+Aoe7O946GhbFfpzQh7IQ20Lx+HaYke/RKPkTkrI/8Kzh66b pY+7mtI3FGt4JN92u4ePVBBFQQ7qquQ6Zp+aN4aoshx5XvY+idwsfcdzTU1ixeGwaRDA 3zZjxAU3isRXuNpDCGUpi7FFNbjtffuMXNx2iT8dsyNSsrYUX/ZgevcTH4w3PE0hb5Ut ERxQ== X-Gm-Message-State: AMCzsaXBqFyHAVysgeyviRmUw76KEVjAReQO7td40eWUtdv6M5UtFM94 WaInjA1qHTfV0Rt18/jLGuamcDdmBlhfNSpUQb4= X-Google-Smtp-Source: ABhQp+Q1yT7DCSEDJWAYBJ8BIjdAEwr97vyetn6U2SVwyaR6LVfJwnWP9hX3IuA4BBoCahfe2hfuPqKI9u1uimsE1rY= X-Received: by 10.159.207.147 with SMTP id z19mr8309980plo.441.1509398774068; Mon, 30 Oct 2017 14:26:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Mon, 30 Oct 2017 14:25:53 -0700 (PDT) In-Reply-To: References: From: Dick Hardt Date: Mon, 30 Oct 2017 14:25:53 -0700 Message-ID: To: SecEvent , Mike Jones , Phil Hunt , Annabelle Richard , Marius Scurtescu Content-Type: multipart/alternative; boundary="089e0828c024c0bbaa055cca490d" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:26:19 -0000 --089e0828c024c0bbaa055cca490d Content-Type: text/plain; charset="UTF-8" resending with fixed width formating for agenda for easier reading. :) On Mon, Oct 30, 2017 at 2:09 PM, Dick Hardt wrote: > Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me > know who is presenting what where it is xxx > > Thanks! > > Here are the documents we will be discussing: > > https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > https://datatracker.ietf.org/doc/draft-scurtescu-secevent- > event-stream-mgmt-api/ > https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ > > /Dick > > ----- > IETF 100 Singapore > Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 > > Agenda Setting Dick Hardt (chair) 13:30 - > 13:40 > Security Event Token (SET) xxx 13:40 - > 14:00 > SET Delivery using HTTP xxx 14:00 - > 14:20 > Chair Slides on Managment APIs Dick Hardt (chair) 14:20 - > 14:30 > Management API for SET Event Streams xxx 14:30 - > 14:50 > SET Stream Managment and Provisioning Phil Hunt 14:50 - > 15:10 > Management API Discussion Dick Hardt (chair) 15:10 - > 15:20 > AOB Dick Hardt (chair) 15:20 - > 15:30 > > > > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --089e0828c024c0bbaa055cca490d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    resending with fixed width formating for agenda for easier= reading. :)

    O= n Mon, Oct 30, 2017 at 2:09 PM, Dick Hardt <dick.hardt@gmail.com>= ; wrote:
    Her= e is the draft agenda. Mike, Phil, Marius, Annabelle - please let me know w= ho is presenting what where it is xxx

    Thanks!

    Here are the documents we will be discussing:

    <= a href=3D"https://datatracker.ietf.org/doc/draft-scurtescu-secevent-event-s= tream-mgmt-api/" target=3D"_blank">https://datatracker.ietf.org/doc/dr= aft-scurtescu-secevent-event-stream-mgmt-api/

    /Dick

    =
    -----
    IETF 100 Singapore=
    Bras Basah Monday Nov= 13, 2017, 13:30 - 15:30

    Agenda Setting= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:= 40
    Security Event Toke= n (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A013:40 = - 14:00=C2=A0 =C2=A0
    S= ET Delivery using HTTP=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A014:00 - 14:20=C2=A0
    Chair Slides on Managment APIs=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 14:20 - 14:30
    Management API for SET Eve= nt Streams=C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:30 - 14:50=C2=A0
    SET Stream Managment and Provisioning=C2= =A0 =C2=A0Phil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A014:50 - 15:10=C2=A0 =C2=A0=C2=A0
    Management API Discussion=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:10= - 15:20
    AOB=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 = =C2=A0 =C2=A0 =C2=A0 15:20 - 15:30






    --
    Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
    --089e0828c024c0bbaa055cca490d-- From nobody Mon Oct 30 14:30:26 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 602EF13FBC3 for ; Mon, 30 Oct 2017 14:30:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pwhAcZrsoS6E for ; Mon, 30 Oct 2017 14:30:17 -0700 (PDT) Received: from mail-io0-x231.google.com (mail-io0-x231.google.com [IPv6:2607:f8b0:4001:c06::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A1A813FBBF for ; Mon, 30 Oct 2017 14:30:17 -0700 (PDT) Received: by mail-io0-x231.google.com with SMTP id 101so30503836ioj.3 for ; Mon, 30 Oct 2017 14:30:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=P2jWswR/L15APXLEO3CLhHBnwdikgxUXfGLldg6Pyn8=; b=bhQ6AtGuUa8rrFsPucmnGFU+8oHy25qYc2pjw+D6NRoNgpE1wPrn9afr2uAHwLV6ye CrlfpcQ7mSIb53BixBQCCOF5C5CoDX3fObzy6PsPua+JsekUEMYxCH9XVU+tUHlhlOpc YEAB02P3GZjde8YZM6AB9NZFO1qPOEd6YqCU0pJBpuv2X6YXkZxmwwd4BR3PnB0LoY20 cL7w3bZLJkbYr7joUhmbKFpachA8+rTrSuMXHHi8rXtNW57/oHOrPxDMIThLSC7wRJN+ 6e4LGyul++Q4rKXcfx1Lv5HCuhkl06F7VeghTzo39lUwqVVAYkSLkiB0cNFx0fuBDf8L 1LUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=P2jWswR/L15APXLEO3CLhHBnwdikgxUXfGLldg6Pyn8=; b=MQUC4ZomfaHjC3SgRlN1fWAhVsfqPbpeKxI6XXlzoKETkG4/SHbcOl0KXqCUWbcWnN R7dQGkniKvqzXEsjNjn5gZb5BONrR5bfB3Y9bfZYHZh3Lz4fNXSxQHw+cA+7MhYdFgBK k92U2MKp/0etA/UX/3lvEz/2Z+XDDKxDexRhekeH2G9SeszCp5nG8Marhbi6SaAFeC7l 9V6gMq216xDJ1/DIgZn5b/nWhiO9cnPSnl/xhgCkSF3Hp/9r3utNIyfcUo7+LkA9061U lShHcuYRJBpS4NystNEsxawdPwAKCqrImO1Pjue9PeyklblzUvdXIkKfWtPd4hqCbUoQ 9BGA== X-Gm-Message-State: AMCzsaWg78vK0s6jISZ9FqlYeKOnmKKrpGD65v3hacAdxGVxrK9Hoi3k qTLOGyF6OMdU/cfXkpd1K3BTkaO7vuVSTGQav7w7Vg== X-Google-Smtp-Source: ABhQp+SPoBLEgWcNPGQZSEZ1nx6ZYKnl9uSF/aOAfUbGUM4KEhEjtlzBDhbhMKwViVvEnQ2k5qxvHuhI8aKRGVeM3CM= X-Received: by 10.107.163.15 with SMTP id m15mr13099808ioe.61.1509399015898; Mon, 30 Oct 2017 14:30:15 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Mon, 30 Oct 2017 14:29:55 -0700 (PDT) In-Reply-To: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> From: Marius Scurtescu Date: Mon, 30 Oct 2017 14:29:55 -0700 Message-ID: To: Dick Hardt Cc: Phil Hunt , Yaron Sheffer , "Richard Backman, Annabelle" , Mike Jones , ID Events Mailing List Content-Type: multipart/alternative; boundary="001a11402f142b7ee0055cca5826" Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:30:24 -0000 --001a11402f142b7ee0055cca5826 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I started writing something very similar. What Dick says. I totally support single events at this point, even though at the beginning I was challenging this approach. We do have to formally define an extension mechanism. Extension attributes could be simply merged into the target event as in Dick's example. Or, I think Annabelle suggested (if I understood correctly) that we could have a defined "extensions" attribute which is a dictionary with keys being extension URIs and values being name/value pairs. In this case the first event would look something like: { "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", "iat": 1458496025, "iss": "https://scim.example.com", "aud": [ "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" ], "event_type": "https://example.com/scim/event/passwordResetExt", "event": { "id":"44f6142df96bd6ab61e7521d9", "extensions": { "https://example.com/scim/event/passwordResetExt=E2=80=9D: { "resetAttempts":5, } } } } Marius On Mon, Oct 30, 2017 at 2:22 PM, Dick Hardt wrote: > Hi Phil > > Correct me if I am misunderstanding, but there is a RISC profile event > > > "http://schemas.openid.net/secevent/risc/event-type/ account-credential-change-required=E2= =80=9D > > > and an SCIM profile event > > "https://example.com/scim/event/passwordResetExt=E2=80=9D > > > I'm suggesting that two different events would be sent. Embedding one in > the other does not make sense. > > Also, I think it is simpler to have event_type be at the same level as > event > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event_type": "https://example.com/scim/event/passwordResetExt", > "event": { > "id":"44f6142df96bd6ab61e7521d9", > "resetAttempts":5 > } > } > > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event_type": "http://schemas.openid.net/secevent/risc/event-type/ > account-credential-change-required", > "event": { > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > } > } > > > > > > On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt wrote: > >> Annabelle/Dick, >> >> Thanks for the comments. I think we need to examine the consequences of >> the proposal in JSON. >> >> As I stated, what causes most of the issue is the proposed extension >> mechanism in the payload (possibly using events in a recursive way). Doe= s >> it follow the old format or the new? >> >> Let=E2=80=99s consider a use case where we have an identity management = system >> that uses SCIM, but the SCIM system is also the underlying data store fo= r >> Connect. A Password reset might generate the following event which has = an >> extension (conveying reset count) AND overlapping statement from RISC. >> BOTH of which might be important to a similar receiver using SCIM and OI= DC. >> >> >> *The 03 spec currently would allow:* >> >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "events": { >> "urn:ietf:params:scim:event:passwordReset": >> { "id":"44f6142df96bd6ab61e7521d9"}, >> "https://example.com/scim/event/passwordResetExt": >> { "resetAttempts":5}, >> >> "http://schemas.openid.net/secevent/risc/event-type/\ >> account-credential-change-required": { >> >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" >> >> } >> } >> } >> >> >> In the above - each payload is a =E2=80=98peer' and issued without prefe= rence by the transmitter. The receiver can assign priority in its own conte= xt if that matters. >> >> >> *The new proposal:* >> >> >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "event": { >> =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRe= set=E2=80=9D, >> "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, >> >> =E2=80=9Cevents=E2=80=9D:{ >> >> ->note =E2=80=A6is this the old or new structure? <- >> >> "https://example.com/scim/event/passwordResetExt": >> >> { "resetAttempts":5}, >> >> "http://schemas.openid.net/secevent/risc/event-type/\ >> account-credential-change-required": { >> >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" >> >> } >> >> } >> >> } >> >> } >> >> >> In the above, sub-events or extensions have a different format. The same= complaint about the original stands. >> >> >> **OR* (if the receiver cares about RISC more). Note that this leads to = a triple nested structure.* >> >> >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "event": { >> >> =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ri= sc/event-type/\ >> >> account-credential-change-required=E2=80=9D, >> >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, >> >> =E2=80=9Cevents=E2=80=9D:{ >> >> "urn:ietf:params:scim:event:passwordReset": >> { >> >> "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, >> >> =E2=80=9Cevents=E2=80=9D:{ >> >> "https://example.com/scim/event/passwordResetExt": >> >> { "resetAttempts":5}, >> >> } >> >> } >> } >> >> } >> } >> >> >> In the above, the extension is placed inside the event it extends. It >> follows the old format (or should it follow the new?) >> >> **OR* Following the top layer pattern of singular event Note that this = leads to a triple nested structure.* >> >> >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "event": { >> >> =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ri= sc/event-type/\ >> >> account-credential-change-required=E2=80=9D, >> >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, >> >> =E2=80=9Cevent=E2=80=9D:{ >> >> =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwor= dReset=E2=80=9D, >> >> "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, >> >> =E2=80=9Cevent=E2=80=9D:{ >> >> =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/p= asswordResetExt=E2=80=9D, >> >> "resetAttempts":5 >> >> } >> } >> >> } >> } >> >> >> This format follows the proposed singular event format recursively and i= s >> 3 layers deep. Note that the parser has to continue to search the docume= nt >> for things that aren=E2=80=99t there as it has to stop when no =E2=80=9C= event=E2=80=9D attribute is >> found rather than iterate over an array. >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >> On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle < >> richanna@amazon.com> wrote: >> >> Replies inline. >> >> -- >> Annabelle Richard Backman >> Identity Services >> >> >> *From: *Phil Hunt >> *Date: *Sunday, October 29, 2017 at 5:25 PM >> *To: *Dick Hardt >> *Cc: *Yaron Sheffer , Mike Jones < >> Michael.Jones@microsoft.com>, "Richard Backman, Annabelle" < >> richanna@amazon.com>, ID Events Mailing List >> *Subject: *Re: [Id-event] Use cases for multiple events per SET? >> >> I hope this answers your question. >> >> My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why no= t. The question should >> be, what is the justification to make =E2=80=9Cevents=E2=80=9D singular? >> [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer semanti= cs and is easier >> to process. We should opt for easier solutions unless there are use case= s >> that require more complexity.[/richanna] >> >> There are many reasons for multiple events in a SET. Some are good, som= e >> not so good. Some of the reasons... >> >> 1. Multiple event payloads expressing statements about largely the >> *same*thing. For example, SCIM password reset AND RISC password reset. = A >> RISC Event and an OpenBanking Event. Is one a complement to the other? = Do >> they overlap or are they distinct? >> [richanna]Copy/pasted from my earlier email: >> Why is it necessary or appropriate to include these events in the same >> SET? They are likely being generated by different systems at different >> times on the transmitter=E2=80=99s side, consumed by different systems o= n the >> receiver=E2=80=99s side, and possibly being transmitted over different e= vent >> streams. I know the latter would be the case for us, as a receiver. Even= if >> it=E2=80=99s not, is it burdensome to send these events separately? What= value is >> gained in combining them? >> >> Additionally, since the signature is over the SET and not the event >> objects, Receivers independently route separate events from a single tok= en >> without either losing the ability to verify the authenticity of the even= t >> or sharing all information in the SET with every system handling any eve= nt >> in the token.[/richanna] >> >> 2. Multiple events payloads expressing different statements about the >> same transaction - RISC Password Reset and RISC Session Cancel >> [richanna]Same as above[/richanna] >> >> 3. A new profile defines new event attributes to be added on to an >> existing event type (a pure extension) >> [richanna]I have suggested a way to support extensions within an event >> body, multiple times now. If you see problems with it, please point them >> out.[/richanna] >> >> I think it is quite valid to allow 1 and 3. 2 could be limited by >> specific profiles like RISC if they want. >> >> I am not in agreement that making event singular simplifies anything. Fo= r >> one is makes extensions complex (another nested JSON structure) and >> potentially conflicting. >> [richanna] >> Ways that multiple-event SETs are more complicated: >> >> 1. It results in a more complex structure for the single event use >> case, which I think we all agree is the majority use case. >> 2. Multiple-event SETs have ambiguous semantics. The presence of two >> events A and B in the same SET could mean any of: >> >> >> 1. They are related to the same logical event (i.e. the same thing as >> if they were from different SETs that have a common txn). >> 2. A is an extension of B. >> 3. B is an extension of A. >> 4. They are aliases for one another. >> 5. They are not actually related to one another in any way. >> >> >> 1. Claim semantics become harder to define, as different profiles may >> want to use the same claims in different ways. >> >> >> If the WG wants to block 1 and 2 above, then I believe we have to >> establish an event registry to ensure new Event profiles do not overlap = to >> eliminate the need to express multiple events. >> [richanna]I=E2=80=99m not sure what you mean by this. Are you referring = to event >> names? Those are already defined by the spec to be URIs.[/richanna] >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> >> phil.hunt@oracle.com >> >> >> On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: >> >> Phil: >> >> In your examples for having a plurality of events, you use the word >> "may", which leads me to question if a plurality of events is really >> required in SET. >> >> You posit that it will be difficult for a distributed system to correlat= e >> multiple SETs with the same "txn", but the distributed system will >> certainly need to correlate events on the same subject -- correlating >> events on the same "txn" on the same subject seems fairly simple. >> >> I think that a receiver will need to correlate multiple SEts on the same >> subject, so having multiple events in a SET is redundant, and adds >> complexity with no clear benefit that I can see. >> >> An implementor may choose to send multiple SETs, or send a single SET >> with multiple events, so a receiver will need to support both. I prefer = we >> pick one way and minimize the code paths, and we will need to support >> correlating across multiple SETs, so that seems the best mechanism. >> >> Let me know if there is something I missed in my logic. >> >> /Dick >> >> >> On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer >> wrote: >> >> In that case, let's add text to that effect, e.g. we could add to the >> definition of the "events" claim: >> >> Profiling specifications SHOULD define the allowed event statements, and >> MAY restrict their number. For example, some profiles may require this >> claim to contain only a single event statement. >> >> Thanks, >> Yaron >> >> On 24/10/17 22:10, Mike Jones wrote: >> >> I agree with much of Phil=E2=80=99s rationale here. >> >> It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2= =80=9D set must be a >> singleton. That doesn=E2=80=99t have to be true for all events. I thin= k things >> are fine as-is. >> >> -- Mike >> >> *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil >> Hunt >> *Sent:* Monday, October 23, 2017 8:47 PM >> *To:* Richard Backman, Annabelle >> *Cc:* ID Events Mailing List >> *Subject:* Re: [Id-event] Use cases for multiple events per SET? >> >> Annabelle, >> >> I have a number of concerns with this proposal. >> >> Profiling Independence / Keeping Event Payloads Independent >> >> Indicating that extensions should be handled by profiles leads to more >> inter-operability issues and more importantly intrudes on the Event payl= oad >> space by suggesting a sub-schema creates potential limitations and >> conflicts that may add to complexity later on. The current format allows= a >> parser to discover and unload one or more JSON payloads which can each h= ave >> independent structure. >> >> General extensions >> >> The proposal also rules out general purpose extensions not related to an= y >> specific event. Given the emergence of items like GPRD, I would not want= to >> block the ability to add meta-data or other general purpose items. We ca= n >> also anticipate some delivery scenarios where additional data might be >> required. Even though there is no current planned use, I see no good rea= son >> to rule this out. >> >> Multiple Events From Different Families (vs. Multiple Events from a >> single family like RISC) >> >> In our RISC session we discussed expressing multiple distinct RISC event= s >> in one SET. The discussion was that only one RISC event at a time. We di= d >> not discuss other event profiles. I don=E2=80=99t see a reason to rule o= ut >> multi-events from different families at the SET level. Each profile is >> expressing slightly different things about the same event. >> >> I can forsee some cases where it is not clear which is the primary and >> which is the extension. There may not be a clear winner. >> >> A couple of examples (these are necessarily real=E2=80=A6just possibilit= ies): >> >> * It is probably useful to be able to express simlar/overlapping events >> from different SET profiles in one SET. For example a Backchannel Logou= t & >> a RISC session cancel event. >> >> * SCIM may want to represent a single transaction as causing multiple >> state changes in an event (e.g. a password change causes multiple effect= s). >> Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80= =9D would be >> challenging in a multi-threaded/multi-node delivery system. The SCIM l= ist >> has not discussed this, but I would not want to block this capability. = IOW >> - Just because RISC does not want to express multiple events does not ma= ke >> this true for other profiles. >> >> * We may wish to indicate a SCIM Password Reset was performed and a >> Logout/session cancellation is expressed at the same time. The events a= re >> related but express different data. >> >> Avoiding Confusion From Similar Events Originating from the Same >> Transaction >> >> If events are sent separately, then more tracking of state (e.g. by txn) >> would be required to ensure similar events are not mistaken or handled a= s >> repeats. While txn provides useful audit analysis capability, I=E2=80=99= m not sure >> it can be used in live or near-real time systems given distributed >> multi-node, multi-threading architectures. >> >> Previous Discussion >> >> I note that I originally raised having an attribute to designate primary >> event attribute to alleviate your concern, but this was not accepted. Se= e: >> >> * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html >> >> >> * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html >> >> >> The consensus, at least as I interpreted it is up to the receiver to >> figure this out based on the definitions it has for each event URI and t= he >> profiles they represent. IOW - RISC is free to limit that only one RISC >> event be expressed at a time. >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect >> >> @independentid >> >> www.independentid.com >> >> > >> > >> >> phil.hunt@oracle.com >> >> On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle >> > wrote: >> >> The current draft of the SET spec allows for expressing multiple >> events within the same token, which introduces additional complexity >> and room for ambiguous semantics. We=E2=80=99ve discussed this in th= e OIDF >> RISC working group and the current consensus there is that RISC will >> require that RISC events must be the only event in the SET, having >> identified ways to clearly and easily support the handful of use >> cases for multiple events per token that people have raised. With >> that context in mind, I propose striking the definition of the >> =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, a= nd replacing it >> with the following definition for an =E2=80=9Cevent=E2=80=9D claim (= singular): >> >> event >> >> A JSON object containing an "event_type" member whose value is a URI >> representing a type of event defined in a Profiling Specification. >> The object MAY otherwise be empty, or MAY contain additional members >> as described by the Profiling Specification. >> >> Here is the example SET from section 2.3, rewritten with this change >> mind: >> >> { >> >> "jti": "4d3559ec67504aaba65d40b0363faad8", >> >> "iat": 1458496404, >> >> "iss": "https://scim.example.com ", >> >> "aud": [ >> >> "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", >> >> "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" >> >> ], >> >> "event": { >> >> "event_type": "urn:ietf:params:scim:event:create", >> >> "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d= 9 >> ", >> >> "attributes": ["id", "name", "userName", "password", "emails"] >> >> } >> >> } >> >> Does anyone in the working group have use cases for SETs that cannot >> be met by this proposed text? Within RISC, we identified three use >> cases, with solutions outlined below: >> >> ** >> >> *Extensions* >> >> Event extension mechanisms can be defined internal to the event >> object. A simple approach would be to define an =E2=80=9Cextensions= =E2=80=9D member >> that is a list of event objects (or set resembling the =E2=80=9Ceven= ts=E2=80=9D >> claim as defined in the current spec). This has the advantage of >> making it clear in the data structure that there is a single primary >> event, with zero or more extensions. There is no room for confusion >> over which event is primary, or if there is a primary event at all. >> I would be fine with adding something like this to my proposed text, >> if there is consensus that it is broadly useful. >> >> *Aliases* >> >> This use case was brought up in the context of migrating clients >> from draft event names to standardized event names. In this case, >> the event transmitter can transmit two tokens for the logical event, >> one using the old name and another using the new name. >> >> *Related Events* >> >> The SET spec defines the txn claim as a means of correlating >> independent tokens that relate to the same logical event. >> >> -- >> Annabelle Richard Backman >> >> Amazon =E2=80=93 Identity Services >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. >> ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCg >> aWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPE >> ivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFS >> ibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> >> >> -- >> Subscribe to the HARDTWARE >> >> mail list to learn about projects I am working on! >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYq >> PkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj-2tDkn31Auxuruib9KATkRlQG1i >> w&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zbhcW001fK02EXs&e=3D >> >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYq >> PkAI1aLcLN4KZNA&m=3DU-a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGie >> c&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e=3D >> >> >> > > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a11402f142b7ee0055cca5826 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    --001a11402f142b7ee0055cca5826-- From nobody Mon Oct 30 14:33:19 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E81213FBE2 for ; Mon, 30 Oct 2017 14:33:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.229 X-Spam-Level: X-Spam-Status: No, score=-2.229 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PvAjdOBqygp2 for ; Mon, 30 Oct 2017 14:33:01 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F091C13FBC3 for ; Mon, 30 Oct 2017 14:32:51 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9ULWkh0002487 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 21:32:47 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9ULWkNE008660 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 21:32:46 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9ULWjuS023319; Mon, 30 Oct 2017 21:32:45 GMT Received: from [10.0.1.19] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 30 Oct 2017 14:32:45 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-6A1E0718-1884-4F71-BA5E-80EC262B8D5C Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Mon, 30 Oct 2017 14:32:40 -0700 Cc: SecEvent , Mike Jones , Annabelle Richard , Marius Scurtescu Content-Transfer-Encoding: 7bit Message-Id: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> References: To: Dick Hardt X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:33:05 -0000 --Apple-Mail-6A1E0718-1884-4F71-BA5E-80EC262B8D5C Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Dick, I believe Mike won't be able to make the monday meeting. so Mike and I are w= orking on a presentation for the current state of set that I will do.=20 Not much has happened with delivery other than removing verify event (becaus= e that was going in control plane). I can do that very quickly.=20 I do have concerns about config on control planes and delivery streams when f= irewalls are involved. I will include a couple of slides on this that may be= important to control plane discussion.=20 I can do my control plane ID draft proposal after marius/annabelle's. It wil= l be similar to the deck we discussed at the amazon hq f2f.=20 Phil > On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: >=20 > Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me kn= ow who is presenting what where it is xxx >=20 > Thanks! >=20 > Here are the documents we will be discussing: >=20 > https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > https://datatracker.ietf.org/doc/draft-scurtescu-secevent-event-stream-mgm= t-api/ > https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ >=20 > /Dick >=20 > ----- > IETF 100 Singapore > Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 >=20 > Agenda Setting Dick Hardt (chair) 13:30 - 1= 3:40 > Security Event Token (SET) xxx 13:40 - 1= 4:00 =20 > SET Delivery using HTTP xxx 14:00 - 1= 4:20=20 > Chair Slides on Managment APIs Dick Hardt (chair) 14:20 - 1= 4:30 > Management API for SET Event Streams xxx 14:30 - 1= 4:50=20 > SET Stream Managment and Provisioning Phil Hunt 14:50 - 1= 5:10 =20 > Management API Discussion Dick Hardt (chair) 15:10 - 1= 5:20 > AOB Dick Hardt (chair) 15:20 - 1= 5:30 >=20 >=20 >=20 --Apple-Mail-6A1E0718-1884-4F71-BA5E-80EC262B8D5C Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
    Dick,

    I believe Mike won't be able to= make the monday meeting. so Mike and I are working on a presentation for th= e current state of set that I will do. 

    Not much has happened with del= ivery other than removing verify event (because that was going in control pl= ane). I can do that very quickly. 
    =
    I do have concerns about config on c= ontrol planes and delivery streams when firewalls are involved. I will inclu= de a couple of slides on this that may be important to control plane discuss= ion. 

    I can do my control plane ID draft proposal after marius/annabel= le's. It will be similar to the deck we discussed at the amazon hq f2f. = ;

    Phil
    Here is the draf= t agenda. Mike, Phil, Marius, Annabelle - please let me know who is presenti= ng what where it is xxx

    Thanks!

    Here are the documents we will be discussing:

    https://datatracker= .ietf.org/doc/draft-ietf-secevent-delivery/

    /D= ick

    -----
    IETF 100 Singapore
    Br= as Basah Monday Nov 13, 2017, 13:30 - 15:30

    Agenda S= etting                    &= nbsp;     Dick Hardt (chair)        13:30 - 13= :40
    Security Event Token (SET)          &= nbsp;   xxx                &nbs= p;      13:40 - 14:00   
    SET Delivery usi= ng HTTP                 xxx&nbs= p;                     &nb= sp;14:00 - 14:20 
    Chair Slides on Managment APIs   =       Dick Hardt (chair)        14:20 - 1= 4:30
    Management API for SET Event Streams    xxx  &= nbsp;                    1= 4:30 - 14:50 
    SET Stream Managment and Provisioning  &nb= sp;Phil Hunt                 14= :50 - 15:10    
    Management API Discussion  &nb= sp;            Dick Hardt (chair)   =     15:10 - 15:20
    AOB         =                      = ;      Dick Hardt (chair)        15:20 - 1= 5:30



    = --Apple-Mail-6A1E0718-1884-4F71-BA5E-80EC262B8D5C-- From nobody Mon Oct 30 14:40:09 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FA9013FB78 for ; Mon, 30 Oct 2017 14:40:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RpWteeTwxJea for ; Mon, 30 Oct 2017 14:40:00 -0700 (PDT) Received: from mail-pf0-x233.google.com (mail-pf0-x233.google.com [IPv6:2607:f8b0:400e:c00::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 056AC13F5C3 for ; Mon, 30 Oct 2017 14:40:00 -0700 (PDT) Received: by mail-pf0-x233.google.com with SMTP id n14so12048283pfh.8 for ; Mon, 30 Oct 2017 14:40:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=KDhm865okdUcaUEc2DgenbnmnCCGJDCGz3wXX0gPCeY=; b=egGAEW22ELcf2NV9erANK72KRdry+T4N/awcRIyoh2tLIPXh9z+ZzPvddRbyibfg1O gx+1nEZeu1IqIsw9UtcYZuqXiaMvSUli8lulhfjypT2I5F4WoiRmv8axQ8CIiazR3S8+ 4+LLKmvYPjbdEp1w/dFOBPi9IOUcsxd1HCe9cLBZ+Y3A3Fw8XADU9Dy5OZz92Aqt7ZWb YTIUSRU2jUqbTu8kvTKCauX1NjEJoKaIZqIktksNnbnAECzzcwx4FzdVfA/yxwc2wyz2 m0k9zfztOh2lVA7YkAwGrbCoW/Mj9SXfK0vgJ89vGiiHpWmioviJeU5Y0qeoqYDVZfuu j2PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=KDhm865okdUcaUEc2DgenbnmnCCGJDCGz3wXX0gPCeY=; b=jBaVDl1satb7HjcdvriG1aBm0AnEdSmm+XaA7ZGkAiTMc41KtKBxa8CEtHbrD2dxXV uODickzdocS+w1ivfLxKC5M4z0Ml0SyhVcecfNeQEy8rnPdHekbO+D288fIAavDovn49 klpCGKMNXoXDfyEoaP1noo6QfsETI5qq0FNy9QpQic3BEgR+kdeOZT3JsJxWFosmv+ne iI4zG6ln9gSvTanJkALktjs5TxVgbT4FyYRkrhUsXKu1XYBY/NlrAvlnWtBjbU2iN7pn 1DitUQkxUnutb/nOPpAHkXvfAjTjz/IRNC9P89XQEw7sXsm/N8xnPD4Vk71wONBjsu/W Du2A== X-Gm-Message-State: AMCzsaWZD0vpu3M460KFFIayBySCPLhZiCcTu9qfNJt+wGG5CxU0U9Sg brIvgzDRQgztD2oHOtyS48G1psONCJL+tlJtyqE= X-Google-Smtp-Source: ABhQp+SmJedq4tuWga+AFL5jY7kwl3Y5fnVDBR8ymAn43TeHzgxYDk4wjyzp7wTX+TQhUONrmpsypfaXPnLmSRPA4zw= X-Received: by 10.84.178.195 with SMTP id z61mr8359937plb.361.1509399599475; Mon, 30 Oct 2017 14:39:59 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Mon, 30 Oct 2017 14:39:38 -0700 (PDT) In-Reply-To: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> References: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> From: Dick Hardt Date: Mon, 30 Oct 2017 14:39:38 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: SecEvent , Mike Jones , Annabelle Richard , Marius Scurtescu Content-Type: multipart/alternative; boundary="94eb2c11a66cf37340055cca7a9a" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:40:02 -0000 --94eb2c11a66cf37340055cca7a9a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if one of the other authors will do the Delivery. On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) wrote: > Dick, > > I believe Mike won't be able to make the monday meeting. so Mike and I ar= e > working on a presentation for the current state of set that I will do. > > Not much has happened with delivery other than removing verify event > (because that was going in control plane). I can do that very quickly. > > I do have concerns about config on control planes and delivery streams > when firewalls are involved. I will include a couple of slides on this th= at > may be important to control plane discussion. > > I can do my control plane ID draft proposal after marius/annabelle's. It > will be similar to the deck we discussed at the amazon hq f2f. > > Phil > > On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: > > Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me > know who is presenting what where it is xxx > > Thanks! > > Here are the documents we will be discussing: > > https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ > > https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ > > https://datatracker.ietf.org/doc/draft-scurtescu-secevent- > event-stream-mgmt-api/ > > https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ > > > /Dick > > ----- > IETF 100 Singapore > Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 > > Agenda Setting Dick Hardt (chair) 13:30 - > 13:40 > Security Event Token (SET) xxx 13:40 - > 14:00 > SET Delivery using HTTP xxx 14:00 - > 14:20 > Chair Slides on Managment APIs Dick Hardt (chair) 14:20 - > 14:30 > Management API for SET Event Streams xxx 14:30 - > 14:50 > SET Stream Managment and Provisioning Phil Hunt 14:50 - > 15:10 > Management API Discussion Dick Hardt (chair) 15:10 - > 15:20 > AOB Dick Hardt (chair) 15:20 - > 15:30 > > > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c11a66cf37340055cca7a9a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Hey Phil, Thanks! I'll slot you in for the SET slot. L= et's see if one of the other authors will do the Delivery.

    On Mon, Oct 30, 2017 at = 2:32 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
    Dick,

    I believe Mike won't be able to make th= e monday meeting. so Mike and I are working on a presentation for the curre= nt state of set that I will do.=C2=A0

    Not much has happened with delivery other than removing verify event= (because that was going in control plane). I can do that very quickly.=C2= =A0

    I do have concerns about co= nfig on control planes and delivery streams when firewalls are involved. I = will include a couple of slides on this that may be important to control pl= ane discussion.=C2=A0

    I can do = my control plane ID draft proposal after marius/annabelle's. It will be= similar to the deck we discussed at the amazon hq f2f.=C2=A0

    Phil

    On Oct 30, 2017, at 2:09 P= M, Dick Hardt <dick.hardt@gmail.com> wrote:

    Here is the draft agenda. Mike, Phil, Marius, A= nnabelle - please let me know who is presenting what where it is xxx
    <= div>
    Thanks!

    Here are the documents = we will be discussing:

    https://datatracker.ietf.org/doc/draft-sc= urtescu-secevent-event-stream-mgmt-api/

    /Dick

    -----
    IETF 100 Singapore
    Bras Basah Monday Nov 13, 2017, 13:30 - 15:3= 0

    Agenda Setting=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick Hardt (chair)= =C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:40
    Security Event Token (S= ET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A013:40 - 14:0= 0=C2=A0 =C2=A0
    SET Delivery using HTTP=C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:00 - 14:20=C2=A0
    Chair Slides on Managment APIs=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick Ha= rdt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 14:20 - 14:30
    Management A= PI for SET Event Streams=C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:30 - 14:50=C2=A0
    <= div>SET Stream Managment and Provisioning=C2=A0 =C2=A0Phil Hunt=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:50 - 15:10=C2=A0 =C2= =A0=C2=A0
    Management API Discussion=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15= :10 - 15:20
    AOB=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:20 - 15:30
    =






    --
    Subscribe to the HARD= TWARE mail list to learn about projects I am working on!
    --94eb2c11a66cf37340055cca7a9a-- From nobody Mon Oct 30 14:42:15 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0A6C13FBC2 for ; Mon, 30 Oct 2017 14:42:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.997 X-Spam-Level: X-Spam-Status: No, score=-6.997 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YxDttjw5htpX for ; Mon, 30 Oct 2017 14:42:10 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3F2A13FBB7 for ; Mon, 30 Oct 2017 14:42:09 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v9ULg6NE003774 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 21:42:06 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v9ULg5si016417 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 30 Oct 2017 21:42:05 GMT Received: from abhmp0007.oracle.com (abhmp0007.oracle.com [141.146.116.13]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v9ULg5Nw026601; Mon, 30 Oct 2017 21:42:05 GMT Received: from [10.0.1.19] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 30 Oct 2017 14:42:04 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-342DCA52-F072-4A8B-A838-90C64B330164 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14G60) In-Reply-To: Date: Mon, 30 Oct 2017 14:41:59 -0700 Cc: Yaron Sheffer , "Richard Backman, Annabelle" , Mike Jones , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> To: Dick Hardt X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Oct 2017 21:42:14 -0000 --Apple-Mail-342DCA52-F072-4A8B-A838-90C64B330164 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Inline... Phil > On Oct 30, 2017, at 2:22 PM, Dick Hardt wrote: >=20 > Hi Phil >=20 > Correct me if I am misunderstanding, but there is a RISC profile event=20 >=20 > "http://schemas.openid.net/secevent/risc/event-type/account-credential-cha= nge-required=E2=80=9D >=20 > and an SCIM profile event >=20 > "https://example.com/scim/event/passwordResetExt=E2=80=9D >=20 > I'm suggesting that two different events would be sent. Embedding one in t= he other does not make sense. It is a hypothetical example. Just because you disagree on this does not= mean others are not valid.=20 I just picked overlapping proposals that have different meaning (but not the= same) to illustrate the difference from issuing a single set with different= events.=20 As I have stated this is very different from asserting multiple distinct eve= nts in one SET.=20 >=20 > Also, I think it is simpler to have event_type be at the same level as eve= nt may be. I was working from Annabelle's proposed format.=20 >=20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event_type": "https://example.com/scim/event/passwordResetExt", > "event": { =20 > "id":"44f6142df96bd6ab61e7521d9", > "resetAttempts":5 > } > } >=20 > { > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > "iat": 1458496025, > "iss": "https://scim.example.com", > "aud": [ > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > ], > "event_type": "http://schemas.openid.net/secevent/risc/event-type/accou= nt-credential-change-required", > "event": { > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" =20 > } > } >=20 >=20 >=20 >=20 >=20 >> On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt wrote:= >> Annabelle/Dick, >>=20 >> Thanks for the comments. I think we need to examine the consequences of t= he proposal in JSON. >>=20 >> As I stated, what causes most of the issue is the proposed extension mech= anism in the payload (possibly using events in a recursive way). Does it fol= low the old format or the new? >>=20 >> Let=E2=80=99s consider a use case where we have an identity management s= ystem that uses SCIM, but the SCIM system is also the underlying data store f= or Connect. A Password reset might generate the following event which has a= n extension (conveying reset count) AND overlapping statement from RISC. BO= TH of which might be important to a similar receiver using SCIM and OIDC. =20= >>=20 >> The 03 spec currently would allow: >>=20 >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "events": { >> "urn:ietf:params:scim:event:passwordReset": >> { "id":"44f6142df96bd6ab61e7521d9"}, >> "https://example.com/scim/event/passwordResetExt": >> { "resetAttempts":5}, >> "http://schemas.openid.net/secevent/risc/event-type/\ >> account-credential-change-required": { >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" >> } >> } >> } >>=20 >> In the above - each payload is a =E2=80=98peer' and issued without prefer= ence by the transmitter. The receiver can assign priority in its own context= if that matters. >>=20 >> The new proposal: >>=20 >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "event": { >> =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRes= et=E2=80=9D, >> "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, >> =E2=80=9Cevents=E2=80=9D:{ >> ->note =E2=80=A6is this the old or new structure? <- >> "https://example.com/scim/event/passwordResetExt": >> { "resetAttempts":5}, >> "http://schemas.openid.net/secevent/risc/event-type/\ >> account-credential-change-required": { >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" >> } >> } >> } =20 >> } >>=20 >> In the above, sub-events or extensions have a different format. The same c= omplaint about the original stands. >>=20 >> *OR* (if the receiver cares about RISC more). Note that this leads to a t= riple nested structure. >>=20 >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "event": { >> =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ >> account-credential-change-required=E2=80=9D, >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, >> =E2=80=9Cevents=E2=80=9D:{ >> "urn:ietf:params:scim:event:passwordReset": >> {=20 >> "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, >> =E2=80=9Cevents=E2=80=9D:{ >> "https://example.com/scim/event/passwordResetExt": >> { "resetAttempts":5}, =20 >> } =20 >> } >> } =20 >> } >> } >>=20 >> In the above, the extension is placed inside the event it extends. It fol= lows the old format (or should it follow the new?) >> *OR* Following the top layer pattern of singular event Note that this le= ads to a triple nested structure. >>=20 >> { >> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", >> "iat": 1458496025, >> "iss": "https://scim.example.com", >> "aud": [ >> "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", >> "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" >> ], >> "event": { >> =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ >> account-credential-change-required=E2=80=9D, >> =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, >> =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, >> =E2=80=9Cevent=E2=80=9D:{ >> =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:password= Reset=E2=80=9D, >> "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, >> =E2=80=9Cevent=E2=80=9D:{ >> =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/pa= sswordResetExt=E2=80=9D, >> "resetAttempts":5=20 >> } >> } =20 >> } >> } >>=20 >> This format follows the proposed singular event format recursively and is= 3 layers deep. Note that the parser has to continue to search the document f= or things that aren=E2=80=99t there as it has to stop when no =E2=80=9Cevent= =E2=80=9D attribute is found rather than iterate over an array. >>=20 >> Phil >>=20 >> Oracle Corporation, Identity Cloud Services Architect >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >>> On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle wrote: >>>=20 >>> Replies inline. >>> =20 >>> --=20 >>> Annabelle Richard Backman >>> Identity Services >>> =20 >>> =20 >>> From: Phil Hunt >>> Date: Sunday, October 29, 2017 at 5:25 PM >>> To: Dick Hardt >>> Cc: Yaron Sheffer , Mike Jones , "Richard Backman, Annabelle" , ID Events M= ailing List >>> Subject: Re: [Id-event] Use cases for multiple events per SET? >>> =20 >>> I hope this answers your question. >>> =20 >>> My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why no= t. The question should be, what is the justification to make =E2=80=9Cevents= =E2=80=9D singular? >>> [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer semanti= cs and is easier to process. We should opt for easier solutions unless there= are use cases that require more complexity.[/richanna] >>> =20 >>> There are many reasons for multiple events in a SET. Some are good, som= e not so good. Some of the reasons... >>> =20 >>> 1. Multiple event payloads expressing statements about largely the *sam= e*thing. For example, SCIM password reset AND RISC password reset. A RISC E= vent and an OpenBanking Event. Is one a complement to the other? Do they ov= erlap or are they distinct? =20 >>> [richanna]Copy/pasted from my earlier email: >>> Why is it necessary or appropriate to include these events in the same S= ET? They are likely being generated by different systems at different times o= n the transmitter=E2=80=99s side, consumed by different systems on the recei= ver=E2=80=99s side, and possibly being transmitted over different event stre= ams. I know the latter would be the case for us, as a receiver. Even if it=E2= =80=99s not, is it burdensome to send these events separately? What value is= gained in combining them? >>> =20 >>> Additionally, since the signature is over the SET and not the event obje= cts, Receivers independently route separate events from a single token witho= ut either losing the ability to verify the authenticity of the event or shar= ing all information in the SET with every system handling any event in the t= oken.[/richanna] >>> =20 >>> 2. Multiple events payloads expressing different statements about the s= ame transaction - RISC Password Reset and RISC Session Cancel >>> [richanna]Same as above[/richanna] >>>=20 >>> 3. A new profile defines new event attributes to be added on to an exis= ting event type (a pure extension)=20 >>> [richanna]I have suggested a way to support extensions within an event b= ody, multiple times now. If you see problems with it, please point them out.= [/richanna] >>> =20 >>> I think it is quite valid to allow 1 and 3. 2 could be limited by speci= fic profiles like RISC if they want. >>> =20 >>> I am not in agreement that making event singular simplifies anything. Fo= r one is makes extensions complex (another nested JSON structure) and potent= ially conflicting.=20 >>> [richanna] >>> Ways that multiple-event SETs are more complicated: >>> It results in a more complex structure for the single event use case, wh= ich I think we all agree is the majority use case. >>> Multiple-event SETs have ambiguous semantics. The presence of two events= A and B in the same SET could mean any of: >>> They are related to the same logical event (i.e. the same thing as if th= ey were from different SETs that have a common txn). >>> A is an extension of B. >>> B is an extension of A. >>> They are aliases for one another. >>> They are not actually related to one another in any way. >>> Claim semantics become harder to define, as different profiles may want t= o use the same claims in different ways. >>> =20 >>> If the WG wants to block 1 and 2 above, then I believe we have to establ= ish an event registry to ensure new Event profiles do not overlap to elimina= te the need to express multiple events. >>> [richanna]I=E2=80=99m not sure what you mean by this. Are you referring t= o event names? Those are already defined by the spec to be URIs.[/richanna] >>> Phil >>> =20 >>> Oracle Corporation, Identity Cloud Services Architect >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> =20 >>>> On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: >>>> =20 >>>> Phil: >>>> =20 >>>> In your examples for having a plurality of events, you use the word "ma= y", which leads me to question if a plurality of events is really required i= n SET. >>>> =20 >>>> You posit that it will be difficult for a distributed system to correla= te multiple SETs with the same "txn", but the distributed system will certai= nly need to correlate events on the same subject -- correlating events on th= e same "txn" on the same subject seems fairly simple. >>>> =20 >>>> I think that a receiver will need to correlate multiple SEts on the sam= e subject, so having multiple events in a SET is redundant, and adds complex= ity with no clear benefit that I can see. >>>> =20 >>>> An implementor may choose to send multiple SETs, or send a single SET w= ith multiple events, so a receiver will need to support both. I prefer we pi= ck one way and minimize the code paths, and we will need to support correlat= ing across multiple SETs, so that seems the best mechanism. >>>> =20 >>>> Let me know if there is something I missed in my logic. >>>> =20 >>>> /Dick >>>> =20 >>>> =20 >>>>> On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer wrote: >>>>> In that case, let's add text to that effect, e.g. we could add to the d= efinition of the "events" claim: >>>>>=20 >>>>> Profiling specifications SHOULD define the allowed event statements, a= nd MAY restrict their number. For example, some profiles may require this cl= aim to contain only a single event statement. >>>>>=20 >>>>> Thanks, >>>>> Yaron >>>>>=20 >>>>>> On 24/10/17 22:10, Mike Jones wrote: >>>>>> I agree with much of Phil=E2=80=99s rationale here. >>>>>>=20 >>>>>> It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2= =80=9D set must be a singleton. That doesn=E2=80=99t have to be true for al= l events. I think things are fine as-is. >>>>>>=20 >>>>>> -- M= ike >>>>>>=20 >>>>>> *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Ph= il Hunt >>>>>> *Sent:* Monday, October 23, 2017 8:47 PM >>>>>> *To:* Richard Backman, Annabelle >>>>>> *Cc:* ID Events Mailing List >>>>>> *Subject:* Re: [Id-event] Use cases for multiple events per SET? >>>>>>=20 >>>>>> Annabelle, >>>>>>=20 >>>>>> I have a number of concerns with this proposal. >>>>>>=20 >>>>>> Profiling Independence / Keeping Event Payloads Independent >>>>>>=20 >>>>>> Indicating that extensions should be handled by profiles leads to mor= e inter-operability issues and more importantly intrudes on the Event payloa= d space by suggesting a sub-schema creates potential limitations and conflic= ts that may add to complexity later on. The current format allows a parser t= o discover and unload one or more JSON payloads which can each have independ= ent structure. >>>>>>=20 >>>>>> General extensions >>>>>>=20 >>>>>> The proposal also rules out general purpose extensions not related to= any specific event. Given the emergence of items like GPRD, I would not wan= t to block the ability to add meta-data or other general purpose items. We c= an also anticipate some delivery scenarios where additional data might be re= quired. Even though there is no current planned use, I see no good reason to= rule this out. >>>>>>=20 >>>>>> Multiple Events =46rom Different Families (vs. Multiple Events from a= single family like RISC) >>>>>>=20 >>>>>> In our RISC session we discussed expressing multiple distinct RISC ev= ents in one SET. The discussion was that only one RISC event at a time. We d= id not discuss other event profiles. I don=E2=80=99t see a reason to rule ou= t multi-events from different families at the SET level. Each profile is exp= ressing slightly different things about the same event. >>>>>>=20 >>>>>> I can forsee some cases where it is not clear which is the primary an= d which is the extension. There may not be a clear winner. >>>>>>=20 >>>>>> A couple of examples (these are necessarily real=E2=80=A6just possibi= lities): >>>>>>=20 >>>>>> * It is probably useful to be able to express simlar/overlapping even= ts from different SET profiles in one SET. For example a Backchannel Logout= & a RISC session cancel event. >>>>>>=20 >>>>>> * SCIM may want to represent a single transaction as causing multiple= state changes in an event (e.g. a password change causes multiple effects).= Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80=9D= would be challenging in a multi-threaded/multi-node delivery system. The S= CIM list has not discussed this, but I would not want to block this capabili= ty. IOW - Just because RISC does not want to express multiple events does n= ot make this true for other profiles. >>>>>>=20 >>>>>> * We may wish to indicate a SCIM Password Reset was performed and a L= ogout/session cancellation is expressed at the same time. The events are re= lated but express different data. >>>>>>=20 >>>>>> Avoiding Confusion =46rom Similar Events Originating from the Same Tr= ansaction >>>>>>=20 >>>>>> If events are sent separately, then more tracking of state (e.g. by t= xn) would be required to ensure similar events are not mistaken or handled a= s repeats. While txn provides useful audit analysis capability, I=E2=80=99m n= ot sure it can be used in live or near-real time systems given distributed m= ulti-node, multi-threading architectures. >>>>>>=20 >>>>>> Previous Discussion >>>>>>=20 >>>>>> I note that I originally raised having an attribute to designate prim= ary event attribute to alleviate your concern, but this was not accepted. Se= e: >>>>>>=20 >>>>>> * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.htm= l >>>>>>=20 >>>>>> * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.htm= l >>>>>>=20 >>>>>> The consensus, at least as I interpreted it is up to the receiver to f= igure this out based on the definitions it has for each event URI and the pr= ofiles they represent. IOW - RISC is free to limit that only one RISC event b= e expressed at a time. >>>>>>=20 >>>>>> Phil >>>>>>=20 >>>>>> Oracle Corporation, Identity Cloud Services Architect >>>>>>=20 >>>>>> @independentid >>>>>>=20 >>>>>> www.independentid.com >>>>>>=20 >>>>>> phil.hunt@oracle.com >>>>>>=20 >>>>>> On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle >>>>>> > wrote: >>>>>>=20 >>>>>> The current draft of the SET spec allows for expressing multiple >>>>>> events within the same token, which introduces additional complex= ity >>>>>> and room for ambiguous semantics. We=E2=80=99ve discussed this in= the OIDF >>>>>> RISC working group and the current consensus there is that RISC w= ill >>>>>> require that RISC events must be the only event in the SET, havin= g >>>>>> identified ways to clearly and easily support the handful of use >>>>>> cases for multiple events per token that people have raised. With= >>>>>> that context in mind, I propose striking the definition of the >>>>>> =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec= , and replacing it >>>>>> with the following definition for an =E2=80=9Cevent=E2=80=9D clai= m (singular): >>>>>>=20 >>>>>> event >>>>>>=20 >>>>>> A JSON object containing an "event_type" member whose value is a U= RI >>>>>> representing a type of event defined in a Profiling Specification= . >>>>>> The object MAY otherwise be empty, or MAY contain additional memb= ers >>>>>> as described by the Profiling Specification. >>>>>>=20 >>>>>> Here is the example SET from section 2.3, rewritten with this cha= nge >>>>>> mind: >>>>>>=20 >>>>>> { >>>>>>=20 >>>>>> "jti": "4d3559ec67504aaba65d40b0363faad8", >>>>>>=20 >>>>>> "iat": 1458496404, >>>>>>=20 >>>>>> "iss": "https://scim.example.com ", >>>>>>=20 >>>>>> "aud": [ >>>>>>=20 >>>>>> "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", >>>>>>=20 >>>>>> "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" >>>>>>=20 >>>>>> ], >>>>>>=20 >>>>>> "event": { >>>>>>=20 >>>>>> "event_type": "urn:ietf:params:scim:event:create", >>>>>>=20 >>>>>> "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e75= 21d9", >>>>>>=20 >>>>>> "attributes": ["id", "name", "userName", "password", "emails= "] >>>>>>=20 >>>>>> } >>>>>>=20 >>>>>> } >>>>>>=20 >>>>>> Does anyone in the working group have use cases for SETs that can= not >>>>>> be met by this proposed text? Within RISC, we identified three us= e >>>>>> cases, with solutions outlined below: >>>>>>=20 >>>>>> ** >>>>>>=20 >>>>>> *Extensions* >>>>>>=20 >>>>>> Event extension mechanisms can be defined internal to the event >>>>>> object. A simple approach would be to define an =E2=80=9Cextensi= ons=E2=80=9D member >>>>>> that is a list of event objects (or set resembling the =E2=80=9Ce= vents=E2=80=9D >>>>>> claim as defined in the current spec). This has the advantage of >>>>>> making it clear in the data structure that there is a single prim= ary >>>>>> event, with zero or more extensions. There is no room for confusi= on >>>>>> over which event is primary, or if there is a primary event at al= l. >>>>>> I would be fine with adding something like this to my proposed te= xt, >>>>>> if there is consensus that it is broadly useful. >>>>>>=20 >>>>>> *Aliases* >>>>>>=20 >>>>>> This use case was brought up in the context of migrating clients >>>>>> from draft event names to standardized event names. In this case,= >>>>>> the event transmitter can transmit two tokens for the logical eve= nt, >>>>>> one using the old name and another using the new name. >>>>>>=20 >>>>>> *Related Events* >>>>>>=20 >>>>>> The SET spec defines the txn claim as a means of correlating >>>>>> independent tokens that relate to the same logical event. >>>>>>=20 >>>>>> --=20 >>>>>> Annabelle Richard Backman >>>>>>=20 >>>>>> Amazon =E2=80=93 Identity Services >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5Y= TpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KAN= nGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZf= gyoIY&e=3D >>>>>>=20 >>>>>>=20 >>>>>>=20 >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>>=20 >>>>>=20 >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>=20 >>>>=20 >>>>=20 >>>> =20 >>>> --=20 >>>> Subscribe to the HARDTWARE mail list to learn about projects I am worki= ng on! >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mai= lman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65e= apI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj-= 2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zbhcW001fK02EXs&= e=3D >>>=20 >>> =20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65ea= pI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU-a5HBND0HaTX4anN= ZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e= =3D >>=20 >=20 >=20 >=20 > --=20 > Subscribe to the HARDTWARE mail list to learn about projects I am working o= n! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI= _JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DiyVnrZmr9_uGCQ6MD0z= F2ymRQS6lK67yF_8u8_qSC_w&s=3DOe0qfLEX83vtXM7Wl2cYBe-Gg1DVPjhXjVJkfhVRzwc&e=3D= --Apple-Mail-342DCA52-F072-4A8B-A838-90C64B330164 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
    Inline...

    Phil

    On= Oct 30, 2017, at 2:22 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

    <ph>It is a hypoth= etical example. Just because you disagree on this does not mean others are n= ot valid. 

    I just picked overlapping proposals that h= ave different meaning (but not the same) to illustrate the difference from i= ssuing a single set with different events. 

    As= I have stated this is very different from asserting multiple distinct event= s in one SET. 
    =
    Also, I think it is simpler to have event_type be at the same= level as event

    <ph>may b= e. I was working from Annabelle's proposed format. 


    =





    On Mon, Oct 30, 2017 at 12:09 PM, Phil Hun= t <phil.hunt@oracle.com> wrote:
    Annabelle/Dick,
    Thanks for the comments. I think we need to examine the conseque= nces of the proposal in JSON.

    As I stated, what causes m= ost of the issue is the proposed extension mechanism in the payload (possibl= y using events in a recursive way). Does it follow the old format or the new= ?

    Let=E2=80=99s  consider a use case where we have a= n identity management system that uses SCIM, but the SCIM system is also the= underlying data store for Connect.  A Password reset might generate th= e following event which has an extension (conveying reset count) AND overlap= ping statement from RISC.  BOTH of which might be important to a simila= r receiver using SCIM and OIDC.  

    The 03 sp= ec currently would allow:

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://sci=
m.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc87959=
3b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7=
676ee7"
   ],
   "events": {
     "urn:ietf:params:scim:event:passwordReset":
       { "id":"44f6142df96bd6ab61e7521d9"},
     "https://example.com/scim/event/passwordResetExt":
       { "resetAttempts":5},
         "http://schemas.openid.=
net/secevent/risc/event-type/\
           accoun=
t-credential-change-required": {
             =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
             =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/"
           }
  }
}

    In the above - each payload is a =E2=80=98peer' and issued=
 without preference by the transmitter. The receiver can assign priority in i=
ts own context if that matters.

    The new proposal:=


    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://sci=
m.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc87959=
3b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7=
676ee7"
   ],
   "event": {
     =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordR=
eset=E2=80=9D,
     "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
         =E2=80=9Cevents=E2=80=9D:{
         ->note =E2=80=A6is this the old or n=
ew structure? <-
           "=
https://example.com/scim/event/passwordResetExt":
             { "resetAttempts":5},
           "http://schemas.openid.net/secevent/risc/event-type/\
    &n=
bsp;        account-credential-change-required": {
             =E2=80=9Csub=E2=80=9D:=E2=80=9D7=
375626A656374=E2=80=9D,
             =E2=
=80=9Ciss=E2=80=9D:"https://idp.example.com/"
           }
         }
       }    
    }

    In the above, sub-events or extensions have a dif=
ferent format. The same complaint about the original stands.

    *OR* (if the receiver cares about RISC more).  Note that this l=
eads to a triple nested structure.

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://sci=
m.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc87959=
3b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7=
676ee7"
   ],
   "event": {
         =E2=80=9Ce=
vent_type=E2=80=9D:"http://schemas.openid.net/sece=
vent/risc/event-type/\
                 =
account-credential-change-required=E2=80=9D,
          =E2=
=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
          =E2=80=9Ciss=E2=80=9D:"=
https://idp.example.com/=E2=80=9C,
          =E2=80=9Cevents=E2=80=9D:{
            "urn:ietf:params:scim:event:passwordR=
eset":
        { 
          =
    "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
              =E2=80=9Cevents=E2=80=9D:{
                 "https://example.com/scim=
/event/passwordResetExt":
                   { "resetAttempts":5}, =
 
              }      
            }
          }     

       }
}

    In the above, the extension is placed inside the event it extends. It= follows the old format (or should it follow the new?)
    *OR* Following the top layer patter=
n of singular event  Note that this leads to a triple nested structure.<=
/font>

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://sci=
m.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc87959=
3b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641d7=
676ee7"
   ],
   "event": {
         =E2=80=9Ce=
vent_type=E2=80=9D:"http://schemas.openid.net/sece=
vent/risc/event-type/\
                 account-credential-change-required=E2=80=9D,
          =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
          =E2=80=9Ciss=E2=80=9D:"https://idp.example.com=
/=E2=80=9C,
          =E2=80=9Cevent=
=E2=80=9D:{
            =E2=80=9Cevent_t=
ype=E2=80=9D:"urn:ietf:params:scim:event:passwordReset=E2=80=9D,=

            "id":=E2=80=9D44f6142df96bd6ab61e7=
521d9=E2=80=9D,
          =
  =E2=80=9Cevent=E2=80=9D:{
     =
         =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event=
/passwordResetExt=E2=80=9D,
              "resetAttempts":5 =

            }
          }     

       }
}

    <=
/pre>This format follows the proposed singula=
r event format recursively and is 3 layers deep. Note that the parser has to=
 continue to search the document for things that aren=E2=80=99t there as it h=
as to stop when no =E2=80=9Cevent=E2=80=9D attribute is found rather than it=
erate over an array.

    Phil

    Oracle Corporation, Identity Cloud Serv= ices Architect
    @independentid
    www.in= dependentid.com
    phil.hunt@oracle.com
    On Oct= 30, 2017, at 8:57 AM, Richard Backman, Annabelle <richanna@amazon.com> wrote:
    <= br class=3D"m_4026236456080349644Apple-interchange-newline">
    Replie= s inline.
     
    =
    = -- 
    Annabelle Richard Backman
    Identity Services
     
     
    From: = Phil Hunt <= phil.hunt@oracle.com>
    Date: Sunday, October 29, 2017 at 5:25 PM<= br>To: Dick Hardt <dick.hardt@gmail.com<= /a>>
    Cc:=  Yaron Sheffer <    yaronf.iet= f@gmail.com>, Mike Jones <Mi= chael.Jones@microsoft.com>, "Richard Backman, Annabelle" <richanna@amazon.com>, ID Events Mailing List <= id-event@ietf.org>
    Subject: Re: [Id-= event] Use cases for multiple events per SET?
     
    I hope this an= swers your question.
     <= /u>
    My =E2=80=9Cmay=E2=80=9D was because I can=E2=80= =99t see a reason why not. The question should be, what is the justification= to make =E2=80=9Cevents=E2=80=9D singular?
    [richanna]The singular =E2=80=9Cevent=E2=80= =9D claim has clearer semantics and is easier to process. We should opt for e= asier solutions unless there are use cases that require more complexity.[/ri= channa]
     
    There are many reasons for multiple events in a SET.=   Some are good, some not so good. Some of the reasons...=
     
    1.&n= bsp; Multiple event payloads expressing statements about largely the *same*t= hing. For example, SCIM password reset AND RISC password reset.  A RISC= Event and an OpenBanking Event. Is one a complement to the other?  Do t= hey overlap or are they distinct?  
    [richanna]Copy/pasted from my earlier email:<= u>
    Why= is it necessary or appropriate to include these events in the same SET? The= y are likely being generated by different systems at different times on the t= ransmitter=E2=80=99s side, consumed by different systems on the receiver=E2=80= =99s side, and possibly being transmitted over different event streams. I kn= ow the latter would be the case for us, as a receiver. Even if it=E2=80=99s n= ot, is it burdensome to send these events separately? What value is gained i= n combining them?
     
    Additionally, since the signature is over the SET and not= the event objects, Receivers independently route separate events from a sin= gle token without either losing the ability to verify the authenticity of th= e event or sharing all information in the SET with every system handling any= event in the token.[/richanna]
     
    2.  Multiple events payloads expressing different statements abou= t the same transaction - RISC Password Reset and RISC Session Cancel
    [richanna]Same as above[/richanna]

    =
    3.  A new profile define= s new event attributes to be added on to an existing event type (a pure exte= nsion) 
    [richanna]I have sugge= sted a way to support extensions within an event body, multiple times now. I= f you see problems with it, please point them out.[/richanna]<= /span>
     
     
    I am not in agreement that m= aking event singular simplifies anything. For one is makes extensions comple= x (another nested JSON structure) and potentially conflicting. 
    [richanna]
    Ways that multiple-event SETs are m= ore complicated:
    1. It results in a more complex structure f= or the single event use case, which I think we all agree is the majority use= case.
    2. Multiple-event SETs have ambiguous semantics. The= presence of two events A and B in the same SET could mean any of:=
      1. They are related to the same logical event (i.e. the same thing as if th= ey were from different SETs that have a common txn).
      2. A i= s an extension of B.
      3. B is an extension of A.
      4. They are aliases for one another.
      5. They are not a= ctually related to one another in any way.
    1. Claim sema= ntics become harder to define, as different profiles may want to use the sam= e claims in different ways.
     
    If the WG wants to block 1 and 2 ab= ove, then I believe we have to establish an event registry to ensure new Eve= nt profiles do not overlap to eliminate the need to express multiple events.=
    [richanna]I=E2=80=99m not sure what you mean by this. Are you referring to= event names? Those are already defined by the spec to be URIs.[/richanna]
    <= /u>
    Phil
     
    Oracle Corporation, Identity Cloud Services Archi= tect
    @independentid
    =
     
    On Oct 29, 2017, at 4= :12 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
    Phil:
     
    =
    In your examples for having a plurality of events, you use the word "may", w= hich leads me to question if a plurality of events is really required in SET= .
     
    Y= ou posit that it will be difficult for a distributed system to correlate mul= tiple SETs with the same "txn", but the distributed system will certainly ne= ed to correlate events on the same subject -- correlating events on the same= "txn" on the same subject seems fairly simple.
     
    I think that a receiver will ne= ed to correlate multiple SEts on the same subject, so having multiple events= in a SET is redundant, and adds complexity with no clear benefit that I can= see.
     
    An implementor may choose to send multiple SETs, or send a single SET wit= h multiple events, so a receiver will need to support both. I prefer we pick= one way and minimize the code paths, and we will need to support correlatin= g across multiple SETs, so that seems the best mechanism.
     
    Let me know if there i= s something I missed in my logic.
    &nb= sp;
    /Dick
    =  
     
    In that case, let's add text to that effect, e.g. we could a= dd to the definition of the "events" claim:

    Profiling specifications S= HOULD define the allowed event statements, and MAY restrict their number. Fo= r example, some profiles may require this claim to contain only a single eve= nt statement.

    Thanks,
            Yaron

    On 24/10= /17 22:10, Mike Jones wrote:

    I agree with much of Phil=E2=80=99s rationale here.
    It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2= =80=9D set must be a singleton.  That doesn=E2=80=99t have to be true f= or all events.  I think things are fine as-is.

       = ;            &nb= sp;            &= nbsp;           =             &nbs= p;                -- Mike=

    *From:* Id-event [mailto:id-even= t-bounces@ietf.org] *On Behalf Of *Phil Hunt
    *Sent:* Monday, Oct= ober 23, 2017 8:47 PM
    *To:* Richard Backman, Annabelle <richanna@amazon.com>
    *Cc:* ID Events Mailing List &= lt;id-event@ietf.org>
    *Subject:* Re: [= Id-event] Use cases for multiple events per SET?

    Annabelle,

    I h= ave a number of concerns with this proposal.

    Profiling Independence /= Keeping Event Payloads Independent

    Indicating that extensions should= be handled by profiles leads to more inter-operability issues and more impo= rtantly intrudes on the Event payload space by suggesting a sub-schema creat= es potential limitations and conflicts that may add to complexity later on. T= he current format allows a parser to discover and unload one or more JSON pa= yloads which can each have independent structure.

    General extensions<= br>
    The proposal also rules out general purpose extensions not related to= any specific event. Given the emergence of items like GPRD, I would not wan= t to block the ability to add meta-data or other general purpose items. We c= an also anticipate some delivery scenarios where additional data might be re= quired. Even though there is no current planned use, I see no good reason to= rule this out.

    Multiple Events =46rom Different Families (vs. Multip= le Events from a single family like RISC)

    In our RISC session we disc= ussed expressing multiple distinct RISC events in one SET. The discussion wa= s that only one RISC event at a time. We did not discuss other event profile= s. I don=E2=80=99t see a reason to rule out multi-events from different fami= lies at the SET level. Each profile is expressing slightly different things a= bout the same event.

    I can forsee some cases where it is not clear wh= ich is the primary and which is the extension.  There may not be a clea= r winner.

    A couple of examples (these are necessarily real=E2=80=A6ju= st possibilities):

    * It is probably useful to be able to express siml= ar/overlapping events from different SET profiles in one SET.  For exam= ple a Backchannel Logout & a RISC session cancel event.

    * SCIM ma= y want to represent a single transaction as causing multiple state changes i= n an event (e.g. a password change causes multiple effects). Having to chase= down multiple events and correlate by =E2=80=9Ctxn=E2=80=9D would be challe= nging in a multi-threaded/multi-node delivery system.   The SCIM l= ist has not discussed this, but I would not want to block this capability.&n= bsp; IOW - Just because RISC does not want to express multiple events does n= ot make this true for other profiles.

    * We may wish to indicate a SCI= M Password Reset was performed and a Logout/session cancellation is expresse= d at the same time.  The events are related but express different data.=

    Avoiding Confusion =46rom Similar Events Originating from the Same T= ransaction

    If events are sent separately, then more tracking of state= (e.g. by txn) would be required to ensure similar events are not mistaken o= r handled as repeats. While txn provides useful audit analysis capability, I= =E2=80=99m not sure it can be used in live or near-real time systems given d= istributed multi-node, multi-threading architectures.

    Previous Discus= sion

    I note that I originally raised having an attribute to designate= primary event attribute to alleviate your concern, but this was not accepte= d. See:

    *&= nbsp;https://www.i= etf.org/mail-archive/web/id-event/current/msg00406.html
    * https://www.ietf.org/mail-<= wbr>archive/web/id-event/current/msg00140.html

    The consensus= , at least as I interpreted it is up to the receiver to figure this out base= d on the definitions it has for each event URI and the profiles they represe= nt. IOW - RISC is free to limit that only one RISC event be expressed at a t= ime.

    Phil

    Oracle Corporation, Identity Cloud Services Architec= t

    @independentid

    www.independentid.com <http://<= wbr>www.independentid.com>

    phil= .hunt@oracle.com <mailto:phil.hunt@ora= cle.com>

        On Oct 23, 2017, at 7:02 PM, Richard Ba= ckman, Annabelle
        <richanna= @amazon.com&n= bsp;<mailto:richanna@amazon.com= >> wrote:

        The current draft of the SET spec a= llows for expressing multiple
        events within the same token,= which introduces additional complexity
        and room for ambigu= ous semantics. We=E2=80=99ve discussed this in the OIDF
        RIS= C working group and the current consensus there is that RISC will
      &= nbsp; require that RISC events must be the only event in the SET, having
    =     identified ways to clearly and easily support the handful of u= se
        cases for multiple events per token that people have rai= sed. With
        that context in mind, I propose striking the defi= nition of the
        =E2=80=9Cevents=E2=80=9D claim from the Secur= ity Event Token spec, and replacing it
        with the following d= efinition for an =E2=80=9Cevent=E2=80=9D claim (singular):

      &nb= sp; event

        A JSON object containing an "event_type" memb= er whose value is a URI
        representing a type of event define= d in a Profiling Specification.
        The object MAY otherwise be= empty, or MAY contain additional members
        as described by t= he Profiling Specification.

        Here is the example SET fro= m section 2.3, rewritten with this change
        mind:

    &nbs= p;   {

           "jti": "4d3559ec67504aaba65d40= b0363faad8",

           "iat": 1458496404,
          "iss": "https://sci= m.example.com=  <https://scim.example.com/= >",

           "aud": [

        &= nbsp;    "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754<= /a>",

             "    https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"

           ],
           "event": {

          &nbs= p;  "event_type": "urn:ietf:params:scim:event:create",

    &nbs= p;        "ref": "https://scim.example.com/Users/44f6142d= f96bd6ab61e7521d9",

             "attri= butes": ["id", "name", "userName", "password", "emails"]

       = ;    }

        }

        Does anyone in t= he working group have use cases for SETs that cannot
        be met= by this proposed text? Within RISC, we identified three use
       = ; cases, with solutions outlined below:

        **

     = ;   *Extensions*

        Event extension mechanisms can be= defined internal to the event
        object. A simple approach wo= uld be to  define an =E2=80=9Cextensions=E2=80=9D member
      &nbs= p; that is a list of event objects (or set resembling the =E2=80=9Cevents=E2= =80=9D
        claim as defined in the current spec). This has the a= dvantage of
        making it clear in the data structure that ther= e is a single primary
        event, with zero or more extensions. T= here is no room for confusion
        over which event is primary, o= r if there is a primary event at all.
        I would be fine with a= dding something like this to my proposed text,
        if there is c= onsensus that it is broadly useful.

        *Aliases*

    &n= bsp;   This use case was brought up in the context of migrating clients=
        from draft event names to standardized event names. In thi= s case,
        the event transmitter can transmit two tokens for t= he logical event,
        one using the old name and another using t= he new name.

        *Related Events*

        The S= ET spec defines the txn claim as a means of correlating
        ind= ependent tokens that relate to the same logical event.

        -= -     Annabelle Richard Backman

        Amazon =E2=80=93= Identity Services

        _______________________________= ________________
        Id-event mailing list
            Id-event@ietf.org <mailto:Id<= wbr>-event@ietf.org>
        https://ur= ldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_= listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSib= Ec&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D



    _______________________________________________
    Id-= event mailing list
    Id-event@ietf.org
    <= a href=3D"https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.or= g_mailman_listinfo_id-2Devent&d=3DDwMFaQ&c=3DRoP1YumCXCgaWHvlZYR8PZh= 8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&= ;m=3DYBCGlK9mjjhcFsj-2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB= 1f2rFUGu4zbhcW001fK02EXs&e=3D" style=3D"color:purple;text-decoration:und= erline" target=3D"_blank">https://www.ietf.org/mailman/listinfo/id-even= t


    _______________________________________________
    Id-event mailing list
    = Id-event@ietf.org
    https://www.ietf.org/mai= lman/listinfo/id-event

     
    _____________________________= __________________
    Id-event mailing list
    Id-event@ietf.org
    https://urldefense.proofpoint.com/v2/ur= l?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DD= wICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D= na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU-a5HBND0= HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZ= VHKp-MJ20ui2nm46QSz0&e=3D




    --
    Subsc= ribe to the HARDTWARE mail list to learn abou= t projects I am working on!
    = --Apple-Mail-342DCA52-F072-4A8B-A838-90C64B330164-- From nobody Tue Oct 31 00:21:04 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E30301BF914 for ; Tue, 31 Oct 2017 00:21:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.711 X-Spam-Level: X-Spam-Status: No, score=-0.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8VCncNiVIFJ for ; Tue, 31 Oct 2017 00:20:59 -0700 (PDT) Received: from mail-yw0-x234.google.com (mail-yw0-x234.google.com [IPv6:2607:f8b0:4002:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60B431BF911 for ; Tue, 31 Oct 2017 00:20:59 -0700 (PDT) Received: by mail-yw0-x234.google.com with SMTP id w5so13876154ywg.11 for ; Tue, 31 Oct 2017 00:20:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=apPkXHkDmEoh3EnyNYvUQI+5pHYuYpD5og1BMfFpKPM=; b=BrD82AsNrQRnbVTRkyburLErl84fVGTjQdsm/PhjaT4RTwgNQjrR3JLzBtG1GYpYyT oYcCI05oFZTg/qeTMqPB3OrYwyYZJDCqb/Wd8wKWX9Erth0MOOb2CYxS/M5PdYlNG5zD cENv74HSpyHIlA/N2BvblwqS+kXblv0mOSwFVoRvUE5aD1s9p8Y0LXdiSJ5daaEXY9Bj YfRSz1J525V5BN60yAPAwL6aTGM7X7gL13fAsiCAjO0udj0OevAXzTCyOYiLrB8XKXlK qHJr0yxBVOh+PT9F8zm5enhAlmI+AoEaV8QZmtVRdSFUVIOayp1fg6FTXOfq0B4Hbvz4 ljAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=apPkXHkDmEoh3EnyNYvUQI+5pHYuYpD5og1BMfFpKPM=; b=ij1hpwUw43lexGov2oK5Hw3OAA9N6GQVs09EfgVBBRfrYwLGwyfdSB4+3hrDnEZMpN 4vyRzDppQkwfDhUSr5nRc/NAr1qJ99J6rLRkZEtbDrTTsPIA/4/vS/5Z6qM9z63MWpQe 8lyCYE7zosF035XzTh8s9xPb2dNACNHwBXXZvYXZlFyDlbQC1K5qaW3HfUmJ+WrfXI0X u+eCyKBH7qi2Att5ucIJucmJyXI++Lkh8Bv3uwQ3uoljur1L8cIBtDSn3d5ppAGFDPay 63Pp1kclGHfS6cEfrwTRnNM6u/4OK8mSz4Jl23GsY2ON0EED4njtD7LEiQW8u/5CRieX YFag== X-Gm-Message-State: AMCzsaX+Xv44obh1hZODyIUms2Of4aLzJMFaqKlNeWywX0vmMTxC3zWi fOp0p9DzsOs73rnFEYeMucMYilUW3sW1Jax80/oxfg== X-Google-Smtp-Source: ABhQp+Qafg29zhDG6JO1TELOWkFkg6/YJkSjn/oQ8XfKdo4I1bBkN+PTybyGCMQz7HN4RoRKSkHG1SAw8OD/mrAGi4I= X-Received: by 10.129.175.12 with SMTP id n12mr628524ywh.151.1509434458152; Tue, 31 Oct 2017 00:20:58 -0700 (PDT) MIME-Version: 1.0 Received: by 10.37.4.3 with HTTP; Tue, 31 Oct 2017 00:20:57 -0700 (PDT) In-Reply-To: References: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> From: Adam Dawes Date: Tue, 31 Oct 2017 00:20:57 -0700 Message-ID: To: Dick Hardt Cc: "Phil Hunt (IDM)" , Mike Jones , Annabelle Richard , SecEvent , Marius Scurtescu Content-Type: multipart/alternative; boundary="f403045ede84b149b0055cd2984a" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Oct 2017 07:21:03 -0000 --f403045ede84b149b0055cd2984a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks for sending out the agenda. >From our perspective, there are two important issues that are blocking implementation and I think it would be very helpful to shift the agenda a bit so we have more time to discuss these. It would be very beneficial to implementors if we could resolve these issues so we can finish our services and start to receive operational feedback on the specs. - Management API resolution. We have two approaches (Phil's and Marius/Annabelle's ). The management API is the key to being able to scale our implementation = and start interop with multiple providers. Perhaps Phil and Marius/Annabelle can each provide a summary of their drafts and we can have try to reach consensus. - Single/multiple event per SET This is currently being discussed on list and within RISC working group. It would be helpful to also nail this down to free up our engineers to build this right the first time instead of making a guessing and having = the community later choose differently. In addition, but less critically, we'd like to propose the following topics too: - "toe" SET attribute - authorization header for push delivery - receiver configures full authorization header as static/bearer header - composite subject claim defined in SET - present RISC approach as example On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt wrote: > Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if one of > the other authors will do the Delivery. > > On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) > wrote: > >> Dick, >> >> I believe Mike won't be able to make the monday meeting. so Mike and I >> are working on a presentation for the current state of set that I will d= o. >> >> Not much has happened with delivery other than removing verify event >> (because that was going in control plane). I can do that very quickly. >> >> I do have concerns about config on control planes and delivery streams >> when firewalls are involved. I will include a couple of slides on this t= hat >> may be important to control plane discussion. >> >> I can do my control plane ID draft proposal after marius/annabelle's. It >> will be similar to the deck we discussed at the amazon hq f2f. >> >> Phil >> >> On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: >> >> Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me >> know who is presenting what where it is xxx >> >> Thanks! >> >> Here are the documents we will be discussing: >> >> https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ >> >> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >> >> https://datatracker.ietf.org/doc/draft-scurtescu-secevent-ev >> ent-stream-mgmt-api/ >> >> https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ >> >> >> /Dick >> >> ----- >> IETF 100 Singapore >> Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 >> >> Agenda Setting Dick Hardt (chair) 13:30 = - >> 13:40 >> Security Event Token (SET) xxx 13:40 = - >> 14:00 >> SET Delivery using HTTP xxx 14:00 = - >> 14:20 >> Chair Slides on Managment APIs Dick Hardt (chair) 14:20 = - >> 14:30 >> Management API for SET Event Streams xxx 14:30 = - >> 14:50 >> SET Stream Managment and Provisioning Phil Hunt 14:50 = - >> 15:10 >> Management API Discussion Dick Hardt (chair) 15:10 = - >> 15:20 >> AOB Dick Hardt (chair) 15:20 = - >> 15:30 >> >> >> >> > > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --=20 Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 --f403045ede84b149b0055cd2984a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Thanks for sending out the agenda.

    From= our perspective, there are two important issues that are blocking implemen= tation and I think it would be very helpful to shift the agenda a bit so we= have more time to discuss these. It would be very beneficial to implemento= rs if we could resolve these issues so we can finish our services and start= to receive operational feedback on the specs.=C2=A0
    • Mana= gement API resolution. We have two approaches (Phil's=C2=A0 and Marius/Annabelle's). The management API is the key t= o being able to scale our implementation and start interop with multiple pr= oviders. Perhaps Phil and Marius/Annabelle can each provide a summary of th= eir drafts and we can have try to reach consensus.
    • Single/multiple = event per SET
      This is currently being discussed on list and within RISC = working group. It would be helpful to also nail this down to free up our en= gineers to build this right the first time instead of making a guessing and= having the community later choose differently.=C2=A0
    In addition,= but less critically, we'd like to propose the following topics too:
    • "toe" SET attribute
    • authorization header for pus= h delivery
      • receiver configures full authorization header as sta= tic/bearer header
    • composite subject claim defined in SET
      • <= ul>
    • present RISC approach as example

    On Mon, Oct 30, 2017 at 2:= 39 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
    Hey Phil, Thanks! I'll slot y= ou in for the SET slot. Let's see if one of the other authors will do t= he Delivery.

    On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
    Dick,

    I believe Mike won't be ab= le to make the monday meeting. so Mike and I are working on a presentation = for the current state of set that I will do.=C2=A0

    Not much has = happened with delivery other than removing verify event (because that was g= oing in control plane). I can do that very quickly.=C2=A0

    I do h= ave concerns about config on control planes and delivery streams when firew= alls are involved. I will include a couple of slides on this that may be im= portant to control plane discussion.=C2=A0

    I can do my control p= lane ID draft proposal after marius/annabelle's. It will be similar to = the deck we discussed at the amazon hq f2f.=C2=A0

    Phil

    On Oct = 30, 2017, at 2:09 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

    Here is the draft agenda. Mi= ke, Phil, Marius, Annabelle - please let me know who is presenting what whe= re it is xxx

    Thanks!

    Here= are the documents we will be discussing:

    https://datatracker.ietf.o= rg/doc/draft-scurtescu-secevent-event-stream-mgmt-api/

    /Dick

    -----
    IETF 100 Singapore
    Bras Basah Monday Nov 13= , 2017, 13:30 - 15:30

    Agenda Setting=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:40
    S= ecurity Event Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 x= xx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A013:40 - 14:00=C2=A0 =C2=A0
    SET Delivery using HTTP=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0xxx=C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:00= - 14:20=C2=A0
    Chair Slides on Managment APIs=C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 14:20 - 14:30<= /div>
    Management API for SET Event Streams=C2=A0 =C2=A0 xxx=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014= :30 - 14:50=C2=A0
    SET Stream Managment and Provisioning=C2=A0 =C2= =A0Phil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01= 4:50 - 15:10=C2=A0 =C2=A0=C2=A0
    Management API Discussion=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 = =C2=A0 =C2=A0 =C2=A0 15:10 - 15:20
    AOB=C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2= =A0 15:20 - 15:30






    --
    Subscribe to the HARDTWARE mail list to l= earn about projects I am working on!
    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event




    --
    --f403045ede84b149b0055cd2984a-- From nobody Tue Oct 31 09:21:34 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E04213F8CB for ; Tue, 31 Oct 2017 09:21:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.011 X-Spam-Level: X-Spam-Status: No, score=-0.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dwQA7CgXEGta for ; Tue, 31 Oct 2017 09:21:30 -0700 (PDT) Received: from mail-io0-x230.google.com (mail-io0-x230.google.com [IPv6:2607:f8b0:4001:c06::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 051D213F8B1 for ; Tue, 31 Oct 2017 09:21:29 -0700 (PDT) Received: by mail-io0-x230.google.com with SMTP id 134so36355698ioo.0 for ; Tue, 31 Oct 2017 09:21:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=JfKTqxlGnA9u1p4543ifmm2rPZDJS5RpMMsSVrvKqSo=; b=cvP0nwu/soFTW5lzqgQrJsaR1My37/fnAiQd9ExMoHgwWK7GzJor9GTAFVMNA+NHEH RZGuYjLMfHkvBh3JnzCGhIyUCla5ZOsu79Tbf19Ye7VJgeg8V14mwZgdQ6dG/inEtyBF R4hv5Bd8M+PkHGtvOd3LA0S4KZUQo60Aew5ltNiyijfkJzVQflYYgo3ywwJIs2ocOr8z kYkpy8InZW8+a9qPT49xPTQHer4HJfhUrps+d1BfuSv3pCbAUOmaQmWGIj71sVZyBGdr C35Tm6C8wnYeJcOiVl2a6Uj6gPPaBjxr9vvkzmd1NyiNvGsKJJBuF6IAW+X6lg0gHwRo I+SA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=JfKTqxlGnA9u1p4543ifmm2rPZDJS5RpMMsSVrvKqSo=; b=huEaFO2fMoM8u1Y/9qFq600CHosSJfSia5vflZzfslP/pioCkzWiT5SkJ8+swHe/OA VSTiOB1MVKLvQkDHc0vtnj6hvFO5+PrJrZ3TBltvuSuqGCv/oYaIq8bK4C+DThTp+3S1 +OQW7YIVgtCHxK1Xw/igBIEu56nrpw03bfLx13h4CS5jBg3KlesF/CHBDXHz3+qYeza5 f61luRMoO0YtOH/Sl7UXbfqV3P6UEJdw3tng6MYSXyWC2pUN7bxNdGTp3EAvdPIThmEY KyjYhyESf1Qc1Wz200CvLIZebBX1TK2sSpPHzFlo2pknn6epjQpnV4rzO7Is4xoAeC6p +Zvg== X-Gm-Message-State: AMCzsaUlNRdncLdvmgqlLnbXue+skcwC0MI2XyAjOQuNyIUP1+Qr1iVZ OhmI2ug0yRHOpKhTplxPngxWcuW6NGoZEgK4P1JMcOKfZzA= X-Google-Smtp-Source: ABhQp+RxrGSYMTGMTQtqaJZoitP1rGZtAtTjuZfBHgeixpn6zhylj9ZraykuWDLJ+zozHqYfLKxNc+HqVasWq1QaeME= X-Received: by 10.107.163.15 with SMTP id m15mr3266455ioe.61.1509466888874; Tue, 31 Oct 2017 09:21:28 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Tue, 31 Oct 2017 09:21:08 -0700 (PDT) In-Reply-To: References: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> From: Marius Scurtescu Date: Tue, 31 Oct 2017 09:21:08 -0700 Message-ID: To: Dick Hardt Cc: "Phil Hunt (IDM)" , SecEvent , Mike Jones , Annabelle Richard Content-Type: multipart/alternative; boundary="001a11402f14b6ea3e055cda251b" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Oct 2017 16:21:32 -0000 --001a11402f14b6ea3e055cda251b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable For https://datatracker.ietf.org/doc/draft-scurtescu-secevent-event-stream-mgmt= -api/ Annabelle and I are proposing a two part presentation: I will present the current draft and changes since Prague, Annabelle will then present a concrete example of profiling this management API spec in RISC. The delta on the delivery spec is relatively small, I am happy to present that as well. Marius On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt wrote: > Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if one of > the other authors will do the Delivery. > > On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) > wrote: > >> Dick, >> >> I believe Mike won't be able to make the monday meeting. so Mike and I >> are working on a presentation for the current state of set that I will d= o. >> >> Not much has happened with delivery other than removing verify event >> (because that was going in control plane). I can do that very quickly. >> >> I do have concerns about config on control planes and delivery streams >> when firewalls are involved. I will include a couple of slides on this t= hat >> may be important to control plane discussion. >> >> I can do my control plane ID draft proposal after marius/annabelle's. It >> will be similar to the deck we discussed at the amazon hq f2f. >> >> Phil >> >> On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: >> >> Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me >> know who is presenting what where it is xxx >> >> Thanks! >> >> Here are the documents we will be discussing: >> >> https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ >> >> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >> >> https://datatracker.ietf.org/doc/draft-scurtescu-secevent-ev >> ent-stream-mgmt-api/ >> >> https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ >> >> >> /Dick >> >> ----- >> IETF 100 Singapore >> Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 >> >> Agenda Setting Dick Hardt (chair) 13:30 = - >> 13:40 >> Security Event Token (SET) xxx 13:40 = - >> 14:00 >> SET Delivery using HTTP xxx 14:00 = - >> 14:20 >> Chair Slides on Managment APIs Dick Hardt (chair) 14:20 = - >> 14:30 >> Management API for SET Event Streams xxx 14:30 = - >> 14:50 >> SET Stream Managment and Provisioning Phil Hunt 14:50 = - >> 15:10 >> Management API Discussion Dick Hardt (chair) 15:10 = - >> 15:20 >> AOB Dick Hardt (chair) 15:20 = - >> 15:30 >> >> >> >> > > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > --001a11402f14b6ea3e055cda251b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    For=C2=A0https://datatracker.ietf.org/do= c/draft-scurtescu-secevent-event-stream-mgmt-api/ Annabelle and I are p= roposing a two part presentation: I will present the current draft and chan= ges since Prague, Annabelle will then present a concrete example of profili= ng this management API spec in RISC.

    The delta on the de= livery spec is relatively small, I am happy to present that as well.

    Marius

    On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt = <dick.hardt@gmail.com> wrot= e:
    He= y Phil, Thanks! I'll slot you in for the SET slot. Let's see if one= of the other authors will do the Delivery.

    On Mon, Oct 30= , 2017 at 2:32 PM, Phil Hunt (IDM) <phil.= hunt@oracle.com> wrote:
    Dick,

    I belie= ve Mike won't be able to make the monday meeting. so Mike and I are wor= king on a presentation for the current state of set that I will do.=C2=A0

    Not much has happened with delivery other than removi= ng verify event (because that was going in control plane). I can do that ve= ry quickly.=C2=A0

    I do have concerns about config on= control planes and delivery streams when firewalls are involved. I will in= clude a couple of slides on this that may be important to control plane dis= cussion.=C2=A0

    I can do my control plane ID draft pr= oposal after marius/annabelle's. It will be similar to the deck we disc= ussed at the amazon hq f2f.=C2=A0

    Ph= il

    On Oct 30, 2017, at 2:09 PM, Dick Hardt <dick.hardt@g= mail.com> wrote:

    Here is the draft agenda. Mike, Phil, Marius, Annabelle - pl= ease let me know who is presenting what where it is xxx

    Thanks!

    Here are the documents we will be di= scussing:

    -----
    IETF 100 Singapore
    Bras Basah Mo= nday Nov 13, 2017, 13:30 - 15:30

    Agenda Setting=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:40
    Security Event Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A013:40 - 14:00=C2=A0 =C2=A0
    SET Delivery u= sing HTTP=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0xxx= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A014:00 - 14:20=C2=A0
    Chair Slides on Managment APIs=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2= =A0 14:20 - 14:30
    Management API for SET Event Streams=C2=A0 =C2= =A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A014:30 - 14:50=C2=A0
    SET Stream Managment and Pro= visioning=C2=A0 =C2=A0Phil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A014:50 - 15:10=C2=A0 =C2=A0=C2=A0
    Management A= PI Discussion=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Ha= rdt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:10 - 15:20
    AOB=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2= =A0 =C2=A0 =C2=A0 =C2=A0 15:20 - 15:30


    <= div>



    --
    Subscribe to the HARDTWARE mail l= ist to learn about projects I am working on!
    <= /div>

    --001a11402f14b6ea3e055cda251b-- From nobody Tue Oct 31 12:49:07 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0008B13EF5E for ; Tue, 31 Oct 2017 12:49:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eVyNOVJA1cRl for ; Tue, 31 Oct 2017 12:48:59 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0097.outbound.protection.outlook.com [104.47.37.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0D2A13F614 for ; Tue, 31 Oct 2017 12:48:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8aIoko8AHpZiVMRnWa12T51b/RkBWFOeTPmMsCwVOdw=; b=ZwZV5+GbgyfiFVR9kh9TfQQ83TzLh2GjVK8hW9FgMdJrtLyS7xo0aTU0fRzUO9Z7OzBE81thQtynSN6hEEW3VaXRzgRJmUKlxCZ6BexsR2LHAQlqMASL2Lij5pfXyQdFVgDZUjQPS7q0zQuS22qrOoIl9RB2gR0ZIXq270yjrq8= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0837.namprd21.prod.outlook.com (10.173.192.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.218.2; Tue, 31 Oct 2017 19:48:57 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0218.004; Tue, 31 Oct 2017 19:48:57 +0000 From: Mike Jones To: "Phil Hunt (IDM)" , Dick Hardt CC: Yaron Sheffer , "Richard Backman, Annabelle" , ID Events Mailing List Thread-Topic: [Id-event] Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9aLyXLkAgAEBjXCAB9BnAIAAT1IAgAAUagCAAQQ9AIAANauAgAAlNACAAAV2gIABcZJQ Date: Tue, 31 Oct 2017 19:48:57 +0000 Message-ID: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> In-Reply-To: <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.34.251.19] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0837; 6:HLsj7BvYNEEhX1EbaSFY7X2Hsw67Inf27A4kZHM9BDo21Tz5QQpFXRzUF80w+DTxVxPGPQJXLDpXhmpAvAPj5suYbf6ehaQpiqst5sGRj0SeObZzrpF/6Ex9Ec3LrxuheZmP/Xy7QxdLQQdQf60FDTbV2RRElyC7MgrvY173vNo8Zw/y78807PwSy8cM+EY30lqMoigaUb2KrPYVvPM0aH56MK6kNqZU0qgkTGXO/0SFp3kOL6eY1++xe2+NBTsgr1JDqnYAy3i1rEZ/txSDZH6eMQZJloPV3WhcBOBHA06jYDdZ8XtGrhyJiuGzPw2+opwnx5dTnxZOd+/OAbfPqPHpqucBSVnQGhfsr4Xcv+s=; 5:P3qxc6JBwgE2I3UPOWzy5EesyPqG2Ph4HfZmbyOiSpyQ9+yjBsMAzpmbECwgglrsE584qXSSm5+Hl3V+bc/7nn1DJ7CzIoO/AqDf2w/TPSHw0W9aJ9PERW3oKbaaiSQpqeZRhHGrNjhIjslf0W21fT33Kl9OYy5gMB8pL7KulYQ=; 24:n6HiOIKNYLqM5iOMPOs0O+cjffX7U69f4xkQVz79GXbfBx0prXVXVeqm1J1EoUnB9dKj7xOxAPdSIZ6WNSGLdY5OqtVyPctQTXALGiQ9PPY=; 7:BgYUtZfhBnKtQWxiqK+/vyvpkcXPKS8IdQrzXP+4e6pdXeUcWh40WYWJ0S/OQULewhazkRwtUJkg/8xYuiwImTuX9WOo65vhYiaBJLGGeHblRZDke9eh+iL8yHUNh2I0MRqEsboB3nAYwvIvy2x8ByCkLzkmgwRbR5lMf70UB5x8ZUmJVv4NclCb0l+2b/7qm2jm1kfYj4NuVY/13Bvr4yzHYrl6aKkDUjFQM6dqgHTmFK0YWgCYjnVr5GEBAo2I x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: b4d25578-3a1c-4cd7-5e0a-08d520986cb5 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(2017052603238); SRVR:CY4PR21MB0837; x-ms-traffictypediagnostic: CY4PR21MB0837: x-exchange-antispam-report-test: UriScan:(10436049006162)(89211679590171)(192374486261705)(33061846794335)(100405760836317)(21748063052155)(5213294742642)(146099531331640)(47284530071512)(17755550239193); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(10201501046)(3002001)(3231020)(93006095)(93001095)(100000703101)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123558100)(20161123560025)(20161123562025)(20161123555025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0837; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0837; x-forefront-prvs: 04772EA191 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(346002)(39860400002)(47760400005)(51914003)(24454002)(51444003)(189002)(199003)(6116002)(2950100002)(9686003)(189998001)(229853002)(316002)(606006)(19609705001)(55016002)(236005)(50986999)(66066001)(110136005)(74316002)(93886005)(33656002)(54906003)(6306002)(76176999)(14454004)(7736002)(105586002)(6506006)(54356999)(8990500004)(5660300001)(3280700002)(6436002)(77096006)(101416001)(54896002)(99286003)(53946003)(22452003)(16200700003)(4326008)(561944003)(478600001)(3660700001)(39060400002)(53386004)(7696004)(6246003)(2900100001)(2906002)(25786009)(53936002)(86612001)(72206003)(551934003)(106356001)(551544002)(81156014)(86362001)(10290500003)(966005)(790700001)(3846002)(102836003)(81166006)(8936002)(575784001)(68736007)(53546010)(8676002)(97736004)(10090500001)(579004)(569006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0837; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504620D605B64EF1ACF1496F55E0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: b4d25578-3a1c-4cd7-5e0a-08d520986cb5 X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Oct 2017 19:48:57.2017 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0837 Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Oct 2017 19:49:05 -0000 --_000_CY4PR21MB0504620D605B64EF1ACF1496F55E0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXTigJlzIGhhcmQgZm9yIG1lIHRvIGV2ZW4gZXhwcmVzcyBteSBsZXZlbCBvZiBmcnVzdHJhdGlv biB3aXRoIHRoZSByZWNlbnQgYXR0ZW1wdHMgdG8gb25jZSBhZ2FpbiByZWRlc2lnbiB0aGUgU2Vj RXZlbnQgVG9rZW4gc3BlYy4gIFdl4oCZdmUgYmVlbiBhdCB0aGlzIGZvciBtdWx0aXBsZSB5ZWFy cyBiZWNhdXNlIHBlb3BsZSBrZWVwIHRyeWluZyB0byByZXZpc2l0IGRlY2lzaW9ucyB0aGF0IHdl cmUgbG9uZyBhZ28gbWFkZSBieSBjb25zZW5zdXMuICBJdOKAmXMgYmVlbiBzdGFibGUgZm9yIG92 ZXIgYSB5ZWFyIGFuZCB0aGUgbWFqb3JpdHkgb2YgV0dMQyByZXNwb25kZW50cyBzYWlkIHNvbWUg dmFyaWFudCBvZiDigJxXb3JrcyBmb3IgbWUg4oCTIHNoaXAgaXQh4oCdDQoNClRoZXJl4oCZcyBu b3Qgc3VmZmljaWVudCBqdXN0aWZpY2F0aW9uIHRvIHRyeSB0byB1bmRvIGNvbnNlbnN1cyBwb3Np dGlvbnMgdGhhdCBoYXZlIGJlZW4gZGViYXRlZCBhbmQgYWZmaXJtZWQgb3ZlciBhbmQgb3Zlci4g IENvdW50ZW5hbmNpbmcgd2hvbGVzYWxlIGNoYW5nZXMgYXQgdGhpcyBsYXRlIGRhdGUgaXMgY291 bnRlcnByb2R1Y3RpdmUgaW4gdGhlIGV4dHJlbWUhDQoNCkl04oCZcyBmYXIgYmV0dGVyIHRoYW4g Z29vZCBlbm91Z2ggYXMtaXMuICBJbiBteSBleHBlcmllbmNlLCBpZiB3ZSBzdGFydCByZWRlc2ln bmluZyBpdCwgaXQgd2lsbCByZXN1bHQgaW4gYW5vdGhlciB5ZWFy4oCZcyBkZWxheS4gIEl0IGRv ZXMgc29tZXRoaW5nIHNpbXBsZSBhbmQgdXNlZnVsLiAgUGxlYXNlLCBsZXTigJlzIGp1c3Qgc2hp cCBpdCwgc28gcGVvcGxlIGNhbiByZWx5IG9uIGl0Lg0KDQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBQaGlsIEh1 bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0NClNlbnQ6IE1vbmRheSwgT2N0 b2JlciAzMCwgMjAxNyAyOjQyIFBNDQpUbzogRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5j b20+DQpDYzogWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPjsgUmljaGFyZCBC YWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb20+OyBNaWtlIEpvbmVzIDxNaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVu dEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlw bGUgZXZlbnRzIHBlciBTRVQ/DQoNCklubGluZS4uLg0KDQpQaGlsDQoNCk9uIE9jdCAzMCwgMjAx NywgYXQgMjoyMiBQTSwgRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRp Y2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6DQpIaSBQaGlsDQoNCkNvcnJlY3QgbWUgaWYgSSBh bSBtaXN1bmRlcnN0YW5kaW5nLCBidXQgdGhlcmUgaXMgYSBSSVNDIHByb2ZpbGUgZXZlbnQNCg0K DQoNCiJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS88 aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVt YXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1QyZkPUR3TUZhUSZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdt YW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09aXlWbnJabXI5X3VHQ1E2TUQwekYy eW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTI1bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlESno0 MHRDUmpGYWxoa3cmZT0+YWNjb3VudC1jcmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZOKAnQ0KDQoN CmFuZCBhbiBTQ0lNIHByb2ZpbGUgZXZlbnQNCg0KDQoiaHR0cHM6Ly9leGFtcGxlLmNvbS9zY2lt L2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHTigJ0NCg0KDQpJJ20gc3VnZ2VzdGluZyB0aGF0IHR3byBk aWZmZXJlbnQgZXZlbnRzIHdvdWxkIGJlIHNlbnQuIEVtYmVkZGluZyBvbmUgaW4gdGhlIG90aGVy IGRvZXMgbm90IG1ha2Ugc2Vuc2UuDQo8cGg+SXQgaXMgYSBoeXBvdGhldGljYWwgZXhhbXBsZS4g SnVzdCBiZWNhdXNlIHlvdSBkaXNhZ3JlZSBvbiB0aGlzIGRvZXMgbm90IG1lYW4gb3RoZXJzIGFy ZSBub3QgdmFsaWQuDQoNCkkganVzdCBwaWNrZWQgb3ZlcmxhcHBpbmcgcHJvcG9zYWxzIHRoYXQg aGF2ZSBkaWZmZXJlbnQgbWVhbmluZyAoYnV0IG5vdCB0aGUgc2FtZSkgdG8gaWxsdXN0cmF0ZSB0 aGUgZGlmZmVyZW5jZSBmcm9tIGlzc3VpbmcgYSBzaW5nbGUgc2V0IHdpdGggZGlmZmVyZW50IGV2 ZW50cy4NCg0KQXMgSSBoYXZlIHN0YXRlZCB0aGlzIGlzIHZlcnkgZGlmZmVyZW50IGZyb20gYXNz ZXJ0aW5nIG11bHRpcGxlIGRpc3RpbmN0IGV2ZW50cyBpbiBvbmUgU0VULg0KDQoNCkFsc28sIEkg dGhpbmsgaXQgaXMgc2ltcGxlciB0byBoYXZlIGV2ZW50X3R5cGUgYmUgYXQgdGhlIHNhbWUgbGV2 ZWwgYXMgZXZlbnQNCg0KPHBoPm1heSBiZS4gSSB3YXMgd29ya2luZyBmcm9tIEFubmFiZWxsZSdz IHByb3Bvc2VkIGZvcm1hdC4NCg0KDQp7DQogICJqdGkiOiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQw ZmIxYmQ0ZTdkMzAiLA0KICAiaWF0IjogMTQ1ODQ5NjAyNSwNCiAgImlzcyI6ICJodHRwczovL3Nj aW0uZXhhbXBsZS5jb20iLA0KICAiYXVkIjogWw0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5j b20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIsDQogICAgImh0dHBzOi8vamh1Yi5l eGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ig0KICAgXSwNCiAgICJl dmVudF90eXBlIjogImh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0 RXh0IiwNCiAgICJldmVudCI6IHsNCiAgICAgICAgICJpZCI6IjQ0ZjYxNDJkZjk2YmQ2YWI2MWU3 NTIxZDkiLA0KICAgICAgICAgInJlc2V0QXR0ZW1wdHMiOjUNCiAgICAgICB9DQp9DQoNCnsNCiAg Imp0aSI6ICIzZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCIsDQogICJpYXQiOiAxNDU4 NDk2MDI1LA0KICAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbSIsDQogICJhdWQiOiBb DQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5 M2I3NzU0IiwNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIx ZDA4NjQxZDc2NzZlZTciDQogICBdLA0KICAgImV2ZW50X3R5cGUiOiAiaHR0cDovL3NjaGVtYXMu b3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvYWNjb3VudC1jcmVkZW50aWFsLWNo YW5nZS1yZXF1aXJlZDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlX2Fj Y291bnQtMkRjcmVkZW50aWFsLTJEY2hhbmdlLTJEcmVxdWlyZWQmZD1Ed01GYVEmYz1Sb1AxWXVt Q1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTRE cGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxL Njd5Rl84dThfcVNDX3cmcz1uUXk5ZXpQUmpER2R2UlRDYWlEdGk0T0hlbEgzREtnVUNUS2pGMkdR LXNvJmU9PiIsDQogICAiZXZlbnQiOiB7DQogICAgICAg4oCcc3Vi4oCdOuKAnTczNzU2MjZBNjU2 Mzc04oCdLA0KICAgICAgIOKAnGlzc+KAnToiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIg0KICAg ICAgIH0NCn0NCg0KDQoNCg0KDQpPbiBNb24sIE9jdCAzMCwgMjAxNyBhdCAxMjowOSBQTSwgUGhp bCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+ PiB3cm90ZToNCkFubmFiZWxsZS9EaWNrLA0KDQpUaGFua3MgZm9yIHRoZSBjb21tZW50cy4gSSB0 aGluayB3ZSBuZWVkIHRvIGV4YW1pbmUgdGhlIGNvbnNlcXVlbmNlcyBvZiB0aGUgcHJvcG9zYWwg aW4gSlNPTi4NCg0KQXMgSSBzdGF0ZWQsIHdoYXQgY2F1c2VzIG1vc3Qgb2YgdGhlIGlzc3VlIGlz IHRoZSBwcm9wb3NlZCBleHRlbnNpb24gbWVjaGFuaXNtIGluIHRoZSBwYXlsb2FkIChwb3NzaWJs eSB1c2luZyBldmVudHMgaW4gYSByZWN1cnNpdmUgd2F5KS4gRG9lcyBpdCBmb2xsb3cgdGhlIG9s ZCBmb3JtYXQgb3IgdGhlIG5ldz8NCg0KTGV04oCZcyAgY29uc2lkZXIgYSB1c2UgY2FzZSB3aGVy ZSB3ZSBoYXZlIGFuIGlkZW50aXR5IG1hbmFnZW1lbnQgc3lzdGVtIHRoYXQgdXNlcyBTQ0lNLCBi dXQgdGhlIFNDSU0gc3lzdGVtIGlzIGFsc28gdGhlIHVuZGVybHlpbmcgZGF0YSBzdG9yZSBmb3Ig Q29ubmVjdC4gIEEgUGFzc3dvcmQgcmVzZXQgbWlnaHQgZ2VuZXJhdGUgdGhlIGZvbGxvd2luZyBl dmVudCB3aGljaCBoYXMgYW4gZXh0ZW5zaW9uIChjb252ZXlpbmcgcmVzZXQgY291bnQpIEFORCBv dmVybGFwcGluZyBzdGF0ZW1lbnQgZnJvbSBSSVNDLiAgQk9USCBvZiB3aGljaCBtaWdodCBiZSBp bXBvcnRhbnQgdG8gYSBzaW1pbGFyIHJlY2VpdmVyIHVzaW5nIFNDSU0gYW5kIE9JREMuDQoNClRo ZSAwMyBzcGVjIGN1cnJlbnRseSB3b3VsZCBhbGxvdzoNCg0KDQp7DQoNCiAgImp0aSI6ICIzZDBj M2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCIsDQoNCiAgImlhdCI6IDE0NTg0OTYwMjUsDQoN CiAgImlzcyI6ICJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iLA0KDQogICJhdWQiOiBbDQoNCiAg ICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3 NTQiLA0KDQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQw ODY0MWQ3Njc2ZWU3Ig0KDQogICBdLA0KDQogICAiZXZlbnRzIjogew0KDQogICAgICJ1cm46aWV0 ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJlc2V0IjoNCg0KICAgICAgIHsgImlkIjoiNDRm NjE0MmRmOTZiZDZhYjYxZTc1MjFkOSJ9LA0KDQogICAgICJodHRwczovL2V4YW1wbGUuY29tL3Nj aW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dCI6DQoNCiAgICAgICB7ICJyZXNldEF0dGVtcHRzIjo1 fSwNCg0KICAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50 LXR5cGUvXDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0z QV9fc2NoZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVDJmQ9 RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5h NUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1peVZuclptcjlfdUdD UTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9MjVsMDlzSDhZVjQyeHpnVS1DWFNnOHhI OXR2eURKejQwdENSakZhbGhrdyZlPT4NCiAgICAgICBhY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdl LXJlcXVpcmVkIjogew0KDQogICAgICAgICDigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0s DQoNCiAgICAgICAgIOKAnGlzc+KAnToiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIg0KDQogICAg ICAgfQ0KDQogIH0NCg0KfQ0KDQoNCg0KSW4gdGhlIGFib3ZlIC0gZWFjaCBwYXlsb2FkIGlzIGEg 4oCYcGVlcicgYW5kIGlzc3VlZCB3aXRob3V0IHByZWZlcmVuY2UgYnkgdGhlIHRyYW5zbWl0dGVy LiBUaGUgcmVjZWl2ZXIgY2FuIGFzc2lnbiBwcmlvcml0eSBpbiBpdHMgb3duIGNvbnRleHQgaWYg dGhhdCBtYXR0ZXJzLg0KDQoNCg0KVGhlIG5ldyBwcm9wb3NhbDoNCg0KDQoNCnsNCg0KICAianRp IjogIjNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwIiwNCg0KICAiaWF0IjogMTQ1ODQ5 NjAyNSwNCg0KICAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbSIsDQoNCiAgImF1ZCI6 IFsNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4 Nzk1OTNiNzc1NCIsDQoNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYw NDUxNmIxZDA4NjQxZDc2NzZlZTciDQoNCiAgIF0sDQoNCiAgICJldmVudCI6IHsNCg0KICAgICDi gJxldmVudF90eXBl4oCdOiJ1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJlc2V0 4oCdLA0KDQogICAgICJpZCI64oCdNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOeKAnSwNCg0KICAg ICDigJxldmVudHPigJ06ew0KDQogICAgIC0+bm90ZSDigKZpcyB0aGlzIHRoZSBvbGQgb3IgbmV3 IHN0cnVjdHVyZT8gPC0NCg0KICAgICAgICJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQv cGFzc3dvcmRSZXNldEV4dCI6DQoNCiAgICAgICAgIHsgInJlc2V0QXR0ZW1wdHMiOjV9LA0KDQog ICAgICAgImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBl L1w8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3Nj aGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1QyZkPUR3TUZh USZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpC VFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09aXlWbnJabXI5X3VHQ1E2TUQw ekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTI1bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlE Sno0MHRDUmpGYWxoa3cmZT0+DQogICAgICAgICBhY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdlLXJl cXVpcmVkIjogew0KDQogICAgICAgICDigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sDQoN CiAgICAgICAgIOKAnGlzc+KAnToiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIg0KDQogICAgICAg fQ0KDQogICAgIH0NCg0KICAgfQ0KDQp9DQoNCg0KDQpJbiB0aGUgYWJvdmUsIHN1Yi1ldmVudHMg b3IgZXh0ZW5zaW9ucyBoYXZlIGEgZGlmZmVyZW50IGZvcm1hdC4gVGhlIHNhbWUgY29tcGxhaW50 IGFib3V0IHRoZSBvcmlnaW5hbCBzdGFuZHMuDQoNCg0KDQoqT1IqIChpZiB0aGUgcmVjZWl2ZXIg Y2FyZXMgYWJvdXQgUklTQyBtb3JlKS4gIE5vdGUgdGhhdCB0aGlzIGxlYWRzIHRvIGEgdHJpcGxl IG5lc3RlZCBzdHJ1Y3R1cmUuDQoNCg0KDQp7DQoNCiAgImp0aSI6ICIzZDBjM2NmNzk3NTg0YmQx OTNiZDBmYjFiZDRlN2QzMCIsDQoNCiAgImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAgImlzcyI6ICJo dHRwczovL3NjaW0uZXhhbXBsZS5jb20iLA0KDQogICJhdWQiOiBbDQoNCiAgICAiaHR0cHM6Ly9q aHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0KDQogICAg Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3 Ig0KDQogICBdLA0KDQogICAiZXZlbnQiOiB7DQoNCiAgICAg4oCcZXZlbnRfdHlwZeKAnToiaHR0 cDovL3NjaGVtYXMub3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvXDxodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVu aWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVDJmQ9RHdNRmFRJmM9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0 RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZs SzY3eUZfOHU4X3FTQ193JnM9MjVsMDlzSDhZVjQyeHpnVS1DWFNnOHhIOXR2eURKejQwdENSakZh bGhrdyZlPT4NCg0KICAgICAgICAgICAgIGFjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWly ZWTigJ0sDQoNCiAgICAgIOKAnHN1YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSwNCg0KICAgICAg 4oCcaXNz4oCdOiJodHRwczovL2lkcC5leGFtcGxlLmNvbS/igJwsDQoNCiAgICAgIOKAnGV2ZW50 c+KAnTp7DQoNCiAgICAgICAgInVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVz ZXQiOg0KDQogICAgICAgIHsNCg0KICAgICAgICAgICJpZCI64oCdNDRmNjE0MmRmOTZiZDZhYjYx ZTc1MjFkOeKAnSwNCg0KICAgICAgICAgIOKAnGV2ZW50c+KAnTp7DQoNCiAgICAgICAgICAgICAi aHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiOg0KDQogICAg ICAgICAgICAgICB7ICJyZXNldEF0dGVtcHRzIjo1fSwNCg0KICAgICAgICAgIH0NCg0KICAgICAg ICB9DQoNCiAgICAgIH0NCg0KICAgfQ0KDQp9DQoNCg0KDQpJbiB0aGUgYWJvdmUsIHRoZSBleHRl bnNpb24gaXMgcGxhY2VkIGluc2lkZSB0aGUgZXZlbnQgaXQgZXh0ZW5kcy4gSXQgZm9sbG93cyB0 aGUgb2xkIGZvcm1hdCAob3Igc2hvdWxkIGl0IGZvbGxvdyB0aGUgbmV3PykNCg0KKk9SKiBGb2xs b3dpbmcgdGhlIHRvcCBsYXllciBwYXR0ZXJuIG9mIHNpbmd1bGFyIGV2ZW50ICBOb3RlIHRoYXQg dGhpcyBsZWFkcyB0byBhIHRyaXBsZSBuZXN0ZWQgc3RydWN0dXJlLg0KDQoNCg0Kew0KDQogICJq dGkiOiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAiLA0KDQogICJpYXQiOiAxNDU4 NDk2MDI1LA0KDQogICJpc3MiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiwNCg0KICAiYXVk IjogWw0KDQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJi Yzg3OTU5M2I3NzU0IiwNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3 NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyINCg0KICAgXSwNCg0KICAgImV2ZW50Ijogew0KDQogICAg IOKAnGV2ZW50X3R5cGXigJ06Imh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlz Yy9ldmVudC10eXBlL1w8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8t MjU1QyZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9K bkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09aXlWbnJa bXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTI1bDA5c0g4WVY0Mnh6Z1Ut Q1hTZzh4SDl0dnlESno0MHRDUmpGYWxoa3cmZT0+DQoNCiAgICAgICAgICAgICBhY2NvdW50LWNy ZWRlbnRpYWwtY2hhbmdlLXJlcXVpcmVk4oCdLA0KDQogICAgICDigJxzdWLigJ064oCdNzM3NTYy NkE2NTYzNzTigJ0sDQoNCiAgICAgIOKAnGlzc+KAnToiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v 4oCcLA0KDQogICAgICDigJxldmVudOKAnTp7DQoNCiAgICAgICAg4oCcZXZlbnRfdHlwZeKAnToi dXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6cGFzc3dvcmRSZXNldOKAnSwNCg0KICAgICAgICAi aWQiOuKAnTQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDnigJ0sDQoNCiAgICAgICAg4oCcZXZlbnTi gJ06ew0KDQogICAgICAgICAg4oCcZXZlbnRfdHlwZeKAnToiaHR0cHM6Ly9leGFtcGxlLmNvbS9z Y2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHTigJ0sDQoNCiAgICAgICAgICAicmVzZXRBdHRlbXB0 cyI6NQ0KDQogICAgICAgIH0NCg0KICAgICAgfQ0KDQogICB9DQoNCn0NCg0KDQoNClRoaXMgZm9y bWF0IGZvbGxvd3MgdGhlIHByb3Bvc2VkIHNpbmd1bGFyIGV2ZW50IGZvcm1hdCByZWN1cnNpdmVs eSBhbmQgaXMgMyBsYXllcnMgZGVlcC4gTm90ZSB0aGF0IHRoZSBwYXJzZXIgaGFzIHRvIGNvbnRp bnVlIHRvIHNlYXJjaCB0aGUgZG9jdW1lbnQgZm9yIHRoaW5ncyB0aGF0IGFyZW7igJl0IHRoZXJl IGFzIGl0IGhhcyB0byBzdG9wIHdoZW4gbm8g4oCcZXZlbnTigJ0gYXR0cmlidXRlIGlzIGZvdW5k IHJhdGhlciB0aGFuIGl0ZXJhdGUgb3ZlciBhbiBhcnJheS4NCg0KDQpQaGlsDQoNCk9yYWNsZSBD b3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQpAaW5kZXBlbmRl bnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mZD1Ed01GYVEmYz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFu cVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnlt UlFTNmxLNjd5Rl84dThfcVNDX3cmcz05c1loZ3BFemI3eFBsUUZtQ0NYTm1IbzZmUU45SUJ1LVNI SmFtZ19CNEhzJmU9Pg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tPg0KDQpPbiBPY3QgMzAsIDIwMTcsIGF0IDg6NTcgQU0sIFJpY2hhcmQgQmFja21hbiwg QW5uYWJlbGxlIDxyaWNoYW5uYUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29t Pj4gd3JvdGU6DQoNClJlcGxpZXMgaW5saW5lLg0KDQotLQ0KQW5uYWJlbGxlIFJpY2hhcmQgQmFj a21hbg0KSWRlbnRpdHkgU2VydmljZXMNCg0KDQpGcm9tOiBQaGlsIEh1bnQgPHBoaWwuaHVudEBv cmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+DQpEYXRlOiBTdW5kYXksIE9j dG9iZXIgMjksIDIwMTcgYXQgNToyNSBQTQ0KVG86IERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21h aWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+DQpDYzogWWFyb24gU2hlZmZlciA8 eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+PiwgTWlr ZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb20+PiwgIlJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIiA8cmljaGFubmFA YW1hem9uLmNvbTxtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbT4+LCBJRCBFdmVudHMgTWFpbGlu ZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KU3Vi amVjdDogUmU6IFtJZC1ldmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNF VD8NCg0KSSBob3BlIHRoaXMgYW5zd2VycyB5b3VyIHF1ZXN0aW9uLg0KDQpNeSDigJxtYXnigJ0g d2FzIGJlY2F1c2UgSSBjYW7igJl0IHNlZSBhIHJlYXNvbiB3aHkgbm90LiBUaGUgcXVlc3Rpb24g c2hvdWxkIGJlLCB3aGF0IGlzIHRoZSBqdXN0aWZpY2F0aW9uIHRvIG1ha2Ug4oCcZXZlbnRz4oCd IHNpbmd1bGFyPw0KW3JpY2hhbm5hXVRoZSBzaW5ndWxhciDigJxldmVudOKAnSBjbGFpbSBoYXMg Y2xlYXJlciBzZW1hbnRpY3MgYW5kIGlzIGVhc2llciB0byBwcm9jZXNzLiBXZSBzaG91bGQgb3B0 IGZvciBlYXNpZXIgc29sdXRpb25zIHVubGVzcyB0aGVyZSBhcmUgdXNlIGNhc2VzIHRoYXQgcmVx dWlyZSBtb3JlIGNvbXBsZXhpdHkuWy9yaWNoYW5uYV0NCg0KVGhlcmUgYXJlIG1hbnkgcmVhc29u cyBmb3IgbXVsdGlwbGUgZXZlbnRzIGluIGEgU0VULiAgU29tZSBhcmUgZ29vZCwgc29tZSBub3Qg c28gZ29vZC4gU29tZSBvZiB0aGUgcmVhc29ucy4uLg0KDQoxLiAgTXVsdGlwbGUgZXZlbnQgcGF5 bG9hZHMgZXhwcmVzc2luZyBzdGF0ZW1lbnRzIGFib3V0IGxhcmdlbHkgdGhlICpzYW1lKnRoaW5n LiBGb3IgZXhhbXBsZSwgU0NJTSBwYXNzd29yZCByZXNldCBBTkQgUklTQyBwYXNzd29yZCByZXNl dC4gIEEgUklTQyBFdmVudCBhbmQgYW4gT3BlbkJhbmtpbmcgRXZlbnQuIElzIG9uZSBhIGNvbXBs ZW1lbnQgdG8gdGhlIG90aGVyPyAgRG8gdGhleSBvdmVybGFwIG9yIGFyZSB0aGV5IGRpc3RpbmN0 Pw0KW3JpY2hhbm5hXUNvcHkvcGFzdGVkIGZyb20gbXkgZWFybGllciBlbWFpbDoNCldoeSBpcyBp dCBuZWNlc3Nhcnkgb3IgYXBwcm9wcmlhdGUgdG8gaW5jbHVkZSB0aGVzZSBldmVudHMgaW4gdGhl IHNhbWUgU0VUPyBUaGV5IGFyZSBsaWtlbHkgYmVpbmcgZ2VuZXJhdGVkIGJ5IGRpZmZlcmVudCBz eXN0ZW1zIGF0IGRpZmZlcmVudCB0aW1lcyBvbiB0aGUgdHJhbnNtaXR0ZXLigJlzIHNpZGUsIGNv bnN1bWVkIGJ5IGRpZmZlcmVudCBzeXN0ZW1zIG9uIHRoZSByZWNlaXZlcuKAmXMgc2lkZSwgYW5k IHBvc3NpYmx5IGJlaW5nIHRyYW5zbWl0dGVkIG92ZXIgZGlmZmVyZW50IGV2ZW50IHN0cmVhbXMu IEkga25vdyB0aGUgbGF0dGVyIHdvdWxkIGJlIHRoZSBjYXNlIGZvciB1cywgYXMgYSByZWNlaXZl ci4gRXZlbiBpZiBpdOKAmXMgbm90LCBpcyBpdCBidXJkZW5zb21lIHRvIHNlbmQgdGhlc2UgZXZl bnRzIHNlcGFyYXRlbHk/IFdoYXQgdmFsdWUgaXMgZ2FpbmVkIGluIGNvbWJpbmluZyB0aGVtPw0K DQpBZGRpdGlvbmFsbHksIHNpbmNlIHRoZSBzaWduYXR1cmUgaXMgb3ZlciB0aGUgU0VUIGFuZCBu b3QgdGhlIGV2ZW50IG9iamVjdHMsIFJlY2VpdmVycyBpbmRlcGVuZGVudGx5IHJvdXRlIHNlcGFy YXRlIGV2ZW50cyBmcm9tIGEgc2luZ2xlIHRva2VuIHdpdGhvdXQgZWl0aGVyIGxvc2luZyB0aGUg YWJpbGl0eSB0byB2ZXJpZnkgdGhlIGF1dGhlbnRpY2l0eSBvZiB0aGUgZXZlbnQgb3Igc2hhcmlu ZyBhbGwgaW5mb3JtYXRpb24gaW4gdGhlIFNFVCB3aXRoIGV2ZXJ5IHN5c3RlbSBoYW5kbGluZyBh bnkgZXZlbnQgaW4gdGhlIHRva2VuLlsvcmljaGFubmFdDQoNCjIuICBNdWx0aXBsZSBldmVudHMg cGF5bG9hZHMgZXhwcmVzc2luZyBkaWZmZXJlbnQgc3RhdGVtZW50cyBhYm91dCB0aGUgc2FtZSB0 cmFuc2FjdGlvbiAtIFJJU0MgUGFzc3dvcmQgUmVzZXQgYW5kIFJJU0MgU2Vzc2lvbiBDYW5jZWwN CltyaWNoYW5uYV1TYW1lIGFzIGFib3ZlWy9yaWNoYW5uYV0NCjMuICBBIG5ldyBwcm9maWxlIGRl ZmluZXMgbmV3IGV2ZW50IGF0dHJpYnV0ZXMgdG8gYmUgYWRkZWQgb24gdG8gYW4gZXhpc3Rpbmcg ZXZlbnQgdHlwZSAoYSBwdXJlIGV4dGVuc2lvbikNCltyaWNoYW5uYV1JIGhhdmUgc3VnZ2VzdGVk IGEgd2F5IHRvIHN1cHBvcnQgZXh0ZW5zaW9ucyB3aXRoaW4gYW4gZXZlbnQgYm9keSwgbXVsdGlw bGUgdGltZXMgbm93LiBJZiB5b3Ugc2VlIHByb2JsZW1zIHdpdGggaXQsIHBsZWFzZSBwb2ludCB0 aGVtIG91dC5bL3JpY2hhbm5hXQ0KDQpJIHRoaW5rIGl0IGlzIHF1aXRlIHZhbGlkIHRvIGFsbG93 IDEgYW5kIDMuICAyIGNvdWxkIGJlIGxpbWl0ZWQgYnkgc3BlY2lmaWMgcHJvZmlsZXMgbGlrZSBS SVNDIGlmIHRoZXkgd2FudC4NCg0KSSBhbSBub3QgaW4gYWdyZWVtZW50IHRoYXQgbWFraW5nIGV2 ZW50IHNpbmd1bGFyIHNpbXBsaWZpZXMgYW55dGhpbmcuIEZvciBvbmUgaXMgbWFrZXMgZXh0ZW5z aW9ucyBjb21wbGV4IChhbm90aGVyIG5lc3RlZCBKU09OIHN0cnVjdHVyZSkgYW5kIHBvdGVudGlh bGx5IGNvbmZsaWN0aW5nLg0KW3JpY2hhbm5hXQ0KV2F5cyB0aGF0IG11bHRpcGxlLWV2ZW50IFNF VHMgYXJlIG1vcmUgY29tcGxpY2F0ZWQ6DQoNCiAgMS4gIEl0IHJlc3VsdHMgaW4gYSBtb3JlIGNv bXBsZXggc3RydWN0dXJlIGZvciB0aGUgc2luZ2xlIGV2ZW50IHVzZSBjYXNlLCB3aGljaCBJIHRo aW5rIHdlIGFsbCBhZ3JlZSBpcyB0aGUgbWFqb3JpdHkgdXNlIGNhc2UuDQogIDIuICBNdWx0aXBs ZS1ldmVudCBTRVRzIGhhdmUgYW1iaWd1b3VzIHNlbWFudGljcy4gVGhlIHByZXNlbmNlIG9mIHR3 byBldmVudHMgQSBhbmQgQiBpbiB0aGUgc2FtZSBTRVQgY291bGQgbWVhbiBhbnkgb2Y6DQoNCiAg ICAgKiAgIFRoZXkgYXJlIHJlbGF0ZWQgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudCAoaS5lLiB0 aGUgc2FtZSB0aGluZyBhcyBpZiB0aGV5IHdlcmUgZnJvbSBkaWZmZXJlbnQgU0VUcyB0aGF0IGhh dmUgYSBjb21tb24gdHhuKS4NCiAgICAgKiAgIEEgaXMgYW4gZXh0ZW5zaW9uIG9mIEIuDQogICAg ICogICBCIGlzIGFuIGV4dGVuc2lvbiBvZiBBLg0KICAgICAqICAgVGhleSBhcmUgYWxpYXNlcyBm b3Igb25lIGFub3RoZXIuDQogICAgICogICBUaGV5IGFyZSBub3QgYWN0dWFsbHkgcmVsYXRlZCB0 byBvbmUgYW5vdGhlciBpbiBhbnkgd2F5Lg0KDQogIDEuICBDbGFpbSBzZW1hbnRpY3MgYmVjb21l IGhhcmRlciB0byBkZWZpbmUsIGFzIGRpZmZlcmVudCBwcm9maWxlcyBtYXkgd2FudCB0byB1c2Ug dGhlIHNhbWUgY2xhaW1zIGluIGRpZmZlcmVudCB3YXlzLg0KDQpJZiB0aGUgV0cgd2FudHMgdG8g YmxvY2sgMSBhbmQgMiBhYm92ZSwgdGhlbiBJIGJlbGlldmUgd2UgaGF2ZSB0byBlc3RhYmxpc2gg YW4gZXZlbnQgcmVnaXN0cnkgdG8gZW5zdXJlIG5ldyBFdmVudCBwcm9maWxlcyBkbyBub3Qgb3Zl cmxhcCB0byBlbGltaW5hdGUgdGhlIG5lZWQgdG8gZXhwcmVzcyBtdWx0aXBsZSBldmVudHMuDQpb cmljaGFubmFdSeKAmW0gbm90IHN1cmUgd2hhdCB5b3UgbWVhbiBieSB0aGlzLiBBcmUgeW91IHJl ZmVycmluZyB0byBldmVudCBuYW1lcz8gVGhvc2UgYXJlIGFscmVhZHkgZGVmaW5lZCBieSB0aGUg c3BlYyB0byBiZSBVUklzLlsvcmljaGFubmFdDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwg SWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQpAaW5kZXBlbmRlbnRpZA0Kd3d3Lmlu ZGVwZW5kZW50aWQuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/ dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQ cHVZcVBrQUkxYUxjTE40S1pOQSZtPVUtYTVIQk5EMEhhVFg0YW5OWmZ6WDdwRHNmSzVmMGg5bVo5 Q1pra0dpZWMmcz1LQndLUEZucVlfUTk1Q1RBX19XR0NZR1R4ckQ3QUdDeHVlb1BYbktFVVQwJmU9 Pg0KcGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPg0KDQpP biBPY3QgMjksIDIwMTcsIGF0IDQ6MTIgUE0sIERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwu Y29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdyb3RlOg0KDQpQaGlsOg0KDQpJbiB5 b3VyIGV4YW1wbGVzIGZvciBoYXZpbmcgYSBwbHVyYWxpdHkgb2YgZXZlbnRzLCB5b3UgdXNlIHRo ZSB3b3JkICJtYXkiLCB3aGljaCBsZWFkcyBtZSB0byBxdWVzdGlvbiBpZiBhIHBsdXJhbGl0eSBv ZiBldmVudHMgaXMgcmVhbGx5IHJlcXVpcmVkIGluIFNFVC4NCg0KWW91IHBvc2l0IHRoYXQgaXQg d2lsbCBiZSBkaWZmaWN1bHQgZm9yIGEgZGlzdHJpYnV0ZWQgc3lzdGVtIHRvIGNvcnJlbGF0ZSBt dWx0aXBsZSBTRVRzIHdpdGggdGhlIHNhbWUgInR4biIsIGJ1dCB0aGUgZGlzdHJpYnV0ZWQgc3lz dGVtIHdpbGwgY2VydGFpbmx5IG5lZWQgdG8gY29ycmVsYXRlIGV2ZW50cyBvbiB0aGUgc2FtZSBz dWJqZWN0IC0tIGNvcnJlbGF0aW5nIGV2ZW50cyBvbiB0aGUgc2FtZSAidHhuIiBvbiB0aGUgc2Ft ZSBzdWJqZWN0IHNlZW1zIGZhaXJseSBzaW1wbGUuDQoNCkkgdGhpbmsgdGhhdCBhIHJlY2VpdmVy IHdpbGwgbmVlZCB0byBjb3JyZWxhdGUgbXVsdGlwbGUgU0V0cyBvbiB0aGUgc2FtZSBzdWJqZWN0 LCBzbyBoYXZpbmcgbXVsdGlwbGUgZXZlbnRzIGluIGEgU0VUIGlzIHJlZHVuZGFudCwgYW5kIGFk ZHMgY29tcGxleGl0eSB3aXRoIG5vIGNsZWFyIGJlbmVmaXQgdGhhdCBJIGNhbiBzZWUuDQoNCkFu IGltcGxlbWVudG9yIG1heSBjaG9vc2UgdG8gc2VuZCBtdWx0aXBsZSBTRVRzLCBvciBzZW5kIGEg c2luZ2xlIFNFVCB3aXRoIG11bHRpcGxlIGV2ZW50cywgc28gYSByZWNlaXZlciB3aWxsIG5lZWQg dG8gc3VwcG9ydCBib3RoLiBJIHByZWZlciB3ZSBwaWNrIG9uZSB3YXkgYW5kIG1pbmltaXplIHRo ZSBjb2RlIHBhdGhzLCBhbmQgd2Ugd2lsbCBuZWVkIHRvIHN1cHBvcnQgY29ycmVsYXRpbmcgYWNy b3NzIG11bHRpcGxlIFNFVHMsIHNvIHRoYXQgc2VlbXMgdGhlIGJlc3QgbWVjaGFuaXNtLg0KDQpM ZXQgbWUga25vdyBpZiB0aGVyZSBpcyBzb21ldGhpbmcgSSBtaXNzZWQgaW4gbXkgbG9naWMuDQoN Ci9EaWNrDQoNCg0KT24gU3VuLCBPY3QgMjksIDIwMTcgYXQgMTE6MjggQU0sIFlhcm9uIFNoZWZm ZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tPj4g d3JvdGU6DQpJbiB0aGF0IGNhc2UsIGxldCdzIGFkZCB0ZXh0IHRvIHRoYXQgZWZmZWN0LCBlLmcu IHdlIGNvdWxkIGFkZCB0byB0aGUgZGVmaW5pdGlvbiBvZiB0aGUgImV2ZW50cyIgY2xhaW06DQoN ClByb2ZpbGluZyBzcGVjaWZpY2F0aW9ucyBTSE9VTEQgZGVmaW5lIHRoZSBhbGxvd2VkIGV2ZW50 IHN0YXRlbWVudHMsIGFuZCBNQVkgcmVzdHJpY3QgdGhlaXIgbnVtYmVyLiBGb3IgZXhhbXBsZSwg c29tZSBwcm9maWxlcyBtYXkgcmVxdWlyZSB0aGlzIGNsYWltIHRvIGNvbnRhaW4gb25seSBhIHNp bmdsZSBldmVudCBzdGF0ZW1lbnQuDQoNClRoYW5rcywNCiAgICAgICAgWWFyb24NCg0KT24gMjQv MTAvMTcgMjI6MTAsIE1pa2UgSm9uZXMgd3JvdGU6DQpJIGFncmVlIHdpdGggbXVjaCBvZiBQaGls 4oCZcyByYXRpb25hbGUgaGVyZS4NCg0KSXTigJlzIGZpbmUgZm9yIHNvbWUgcHJvZmlsZXMgdG8g c2F5IHRoYXQgdGhlIOKAnGV2ZW50c+KAnSBzZXQgbXVzdCBiZSBhIHNpbmdsZXRvbi4gIFRoYXQg ZG9lc27igJl0IGhhdmUgdG8gYmUgdHJ1ZSBmb3IgYWxsIGV2ZW50cy4gIEkgdGhpbmsgdGhpbmdz IGFyZSBmaW5lIGFzLWlzLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KKkZyb206KiBJZC1ldmVudCBb bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNA aWV0Zi5vcmc+XSAqT24gQmVoYWxmIE9mICpQaGlsIEh1bnQNCipTZW50OiogTW9uZGF5LCBPY3Rv YmVyIDIzLCAyMDE3IDg6NDcgUE0NCipUbzoqIFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIDxy aWNoYW5uYUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tPj4NCipDYzoqIElE IEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBp ZXRmLm9yZz4+DQoqU3ViamVjdDoqIFJlOiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlw bGUgZXZlbnRzIHBlciBTRVQ/DQoNCkFubmFiZWxsZSwNCg0KSSBoYXZlIGEgbnVtYmVyIG9mIGNv bmNlcm5zIHdpdGggdGhpcyBwcm9wb3NhbC4NCg0KUHJvZmlsaW5nIEluZGVwZW5kZW5jZSAvIEtl ZXBpbmcgRXZlbnQgUGF5bG9hZHMgSW5kZXBlbmRlbnQNCg0KSW5kaWNhdGluZyB0aGF0IGV4dGVu c2lvbnMgc2hvdWxkIGJlIGhhbmRsZWQgYnkgcHJvZmlsZXMgbGVhZHMgdG8gbW9yZSBpbnRlci1v cGVyYWJpbGl0eSBpc3N1ZXMgYW5kIG1vcmUgaW1wb3J0YW50bHkgaW50cnVkZXMgb24gdGhlIEV2 ZW50IHBheWxvYWQgc3BhY2UgYnkgc3VnZ2VzdGluZyBhIHN1Yi1zY2hlbWEgY3JlYXRlcyBwb3Rl bnRpYWwgbGltaXRhdGlvbnMgYW5kIGNvbmZsaWN0cyB0aGF0IG1heSBhZGQgdG8gY29tcGxleGl0 eSBsYXRlciBvbi4gVGhlIGN1cnJlbnQgZm9ybWF0IGFsbG93cyBhIHBhcnNlciB0byBkaXNjb3Zl ciBhbmQgdW5sb2FkIG9uZSBvciBtb3JlIEpTT04gcGF5bG9hZHMgd2hpY2ggY2FuIGVhY2ggaGF2 ZSBpbmRlcGVuZGVudCBzdHJ1Y3R1cmUuDQoNCkdlbmVyYWwgZXh0ZW5zaW9ucw0KDQpUaGUgcHJv cG9zYWwgYWxzbyBydWxlcyBvdXQgZ2VuZXJhbCBwdXJwb3NlIGV4dGVuc2lvbnMgbm90IHJlbGF0 ZWQgdG8gYW55IHNwZWNpZmljIGV2ZW50LiBHaXZlbiB0aGUgZW1lcmdlbmNlIG9mIGl0ZW1zIGxp a2UgR1BSRCwgSSB3b3VsZCBub3Qgd2FudCB0byBibG9jayB0aGUgYWJpbGl0eSB0byBhZGQgbWV0 YS1kYXRhIG9yIG90aGVyIGdlbmVyYWwgcHVycG9zZSBpdGVtcy4gV2UgY2FuIGFsc28gYW50aWNp cGF0ZSBzb21lIGRlbGl2ZXJ5IHNjZW5hcmlvcyB3aGVyZSBhZGRpdGlvbmFsIGRhdGEgbWlnaHQg YmUgcmVxdWlyZWQuIEV2ZW4gdGhvdWdoIHRoZXJlIGlzIG5vIGN1cnJlbnQgcGxhbm5lZCB1c2Us IEkgc2VlIG5vIGdvb2QgcmVhc29uIHRvIHJ1bGUgdGhpcyBvdXQuDQoNCk11bHRpcGxlIEV2ZW50 cyBGcm9tIERpZmZlcmVudCBGYW1pbGllcyAodnMuIE11bHRpcGxlIEV2ZW50cyBmcm9tIGEgc2lu Z2xlIGZhbWlseSBsaWtlIFJJU0MpDQoNCkluIG91ciBSSVNDIHNlc3Npb24gd2UgZGlzY3Vzc2Vk IGV4cHJlc3NpbmcgbXVsdGlwbGUgZGlzdGluY3QgUklTQyBldmVudHMgaW4gb25lIFNFVC4gVGhl IGRpc2N1c3Npb24gd2FzIHRoYXQgb25seSBvbmUgUklTQyBldmVudCBhdCBhIHRpbWUuIFdlIGRp ZCBub3QgZGlzY3VzcyBvdGhlciBldmVudCBwcm9maWxlcy4gSSBkb27igJl0IHNlZSBhIHJlYXNv biB0byBydWxlIG91dCBtdWx0aS1ldmVudHMgZnJvbSBkaWZmZXJlbnQgZmFtaWxpZXMgYXQgdGhl IFNFVCBsZXZlbC4gRWFjaCBwcm9maWxlIGlzIGV4cHJlc3Npbmcgc2xpZ2h0bHkgZGlmZmVyZW50 IHRoaW5ncyBhYm91dCB0aGUgc2FtZSBldmVudC4NCg0KSSBjYW4gZm9yc2VlIHNvbWUgY2FzZXMg d2hlcmUgaXQgaXMgbm90IGNsZWFyIHdoaWNoIGlzIHRoZSBwcmltYXJ5IGFuZCB3aGljaCBpcyB0 aGUgZXh0ZW5zaW9uLiAgVGhlcmUgbWF5IG5vdCBiZSBhIGNsZWFyIHdpbm5lci4NCg0KQSBjb3Vw bGUgb2YgZXhhbXBsZXMgKHRoZXNlIGFyZSBuZWNlc3NhcmlseSByZWFs4oCmanVzdCBwb3NzaWJp bGl0aWVzKToNCg0KKiBJdCBpcyBwcm9iYWJseSB1c2VmdWwgdG8gYmUgYWJsZSB0byBleHByZXNz IHNpbWxhci9vdmVybGFwcGluZyBldmVudHMgZnJvbSBkaWZmZXJlbnQgU0VUIHByb2ZpbGVzIGlu IG9uZSBTRVQuICBGb3IgZXhhbXBsZSBhIEJhY2tjaGFubmVsIExvZ291dCAmIGEgUklTQyBzZXNz aW9uIGNhbmNlbCBldmVudC4NCg0KKiBTQ0lNIG1heSB3YW50IHRvIHJlcHJlc2VudCBhIHNpbmds ZSB0cmFuc2FjdGlvbiBhcyBjYXVzaW5nIG11bHRpcGxlIHN0YXRlIGNoYW5nZXMgaW4gYW4gZXZl bnQgKGUuZy4gYSBwYXNzd29yZCBjaGFuZ2UgY2F1c2VzIG11bHRpcGxlIGVmZmVjdHMpLiBIYXZp bmcgdG8gY2hhc2UgZG93biBtdWx0aXBsZSBldmVudHMgYW5kIGNvcnJlbGF0ZSBieSDigJx0eG7i gJ0gd291bGQgYmUgY2hhbGxlbmdpbmcgaW4gYSBtdWx0aS10aHJlYWRlZC9tdWx0aS1ub2RlIGRl bGl2ZXJ5IHN5c3RlbS4gICBUaGUgU0NJTSBsaXN0IGhhcyBub3QgZGlzY3Vzc2VkIHRoaXMsIGJ1 dCBJIHdvdWxkIG5vdCB3YW50IHRvIGJsb2NrIHRoaXMgY2FwYWJpbGl0eS4gIElPVyAtIEp1c3Qg YmVjYXVzZSBSSVNDIGRvZXMgbm90IHdhbnQgdG8gZXhwcmVzcyBtdWx0aXBsZSBldmVudHMgZG9l cyBub3QgbWFrZSB0aGlzIHRydWUgZm9yIG90aGVyIHByb2ZpbGVzLg0KDQoqIFdlIG1heSB3aXNo IHRvIGluZGljYXRlIGEgU0NJTSBQYXNzd29yZCBSZXNldCB3YXMgcGVyZm9ybWVkIGFuZCBhIExv Z291dC9zZXNzaW9uIGNhbmNlbGxhdGlvbiBpcyBleHByZXNzZWQgYXQgdGhlIHNhbWUgdGltZS4g IFRoZSBldmVudHMgYXJlIHJlbGF0ZWQgYnV0IGV4cHJlc3MgZGlmZmVyZW50IGRhdGEuDQoNCkF2 b2lkaW5nIENvbmZ1c2lvbiBGcm9tIFNpbWlsYXIgRXZlbnRzIE9yaWdpbmF0aW5nIGZyb20gdGhl IFNhbWUgVHJhbnNhY3Rpb24NCg0KSWYgZXZlbnRzIGFyZSBzZW50IHNlcGFyYXRlbHksIHRoZW4g bW9yZSB0cmFja2luZyBvZiBzdGF0ZSAoZS5nLiBieSB0eG4pIHdvdWxkIGJlIHJlcXVpcmVkIHRv IGVuc3VyZSBzaW1pbGFyIGV2ZW50cyBhcmUgbm90IG1pc3Rha2VuIG9yIGhhbmRsZWQgYXMgcmVw ZWF0cy4gV2hpbGUgdHhuIHByb3ZpZGVzIHVzZWZ1bCBhdWRpdCBhbmFseXNpcyBjYXBhYmlsaXR5 LCBJ4oCZbSBub3Qgc3VyZSBpdCBjYW4gYmUgdXNlZCBpbiBsaXZlIG9yIG5lYXItcmVhbCB0aW1l IHN5c3RlbXMgZ2l2ZW4gZGlzdHJpYnV0ZWQgbXVsdGktbm9kZSwgbXVsdGktdGhyZWFkaW5nIGFy Y2hpdGVjdHVyZXMuDQoNClByZXZpb3VzIERpc2N1c3Npb24NCg0KSSBub3RlIHRoYXQgSSBvcmln aW5hbGx5IHJhaXNlZCBoYXZpbmcgYW4gYXR0cmlidXRlIHRvIGRlc2lnbmF0ZSBwcmltYXJ5IGV2 ZW50IGF0dHJpYnV0ZSB0byBhbGxldmlhdGUgeW91ciBjb25jZXJuLCBidXQgdGhpcyB3YXMgbm90 IGFjY2VwdGVkLiBTZWU6DQoNCiogaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbC1hcmNoaXZlL3dl Yi9pZC1ldmVudC9jdXJyZW50L21zZzAwNDA2Lmh0bWw8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbC0yRGFyY2hpdmVf d2ViX2lkLTJEZXZlbnRfY3VycmVudF9tc2cwMDQwNi5odG1sJmQ9RHdNRmFRJmM9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBj dHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWli OUtBVGtSbFFHMWl3JnM9UzNzTVZpcU12RWdud0diSndPUU55Y3JPeXI3U2VmcHFfTW9GT0tjRWVD RSZlPT4NCg0KKiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50 L2N1cnJlbnQvbXNnMDAxNDAuaHRtbDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsLTJEYXJjaGl2ZV93ZWJfaWQtMkRl dmVudF9jdXJyZW50X21zZzAwMTQwLmh0bWwmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllS OFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBr QUkxYUxjTE40S1pOQSZtPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcx aXcmcz1HeTlneVJvSUl0YS1jU2hWN2JOMTYxYXk0eUU2cjlHMV9BYV9OZUJueWxnJmU9Pg0KDQpU aGUgY29uc2Vuc3VzLCBhdCBsZWFzdCBhcyBJIGludGVycHJldGVkIGl0IGlzIHVwIHRvIHRoZSBy ZWNlaXZlciB0byBmaWd1cmUgdGhpcyBvdXQgYmFzZWQgb24gdGhlIGRlZmluaXRpb25zIGl0IGhh cyBmb3IgZWFjaCBldmVudCBVUkkgYW5kIHRoZSBwcm9maWxlcyB0aGV5IHJlcHJlc2VudC4gSU9X IC0gUklTQyBpcyBmcmVlIHRvIGxpbWl0IHRoYXQgb25seSBvbmUgUklTQyBldmVudCBiZSBleHBy ZXNzZWQgYXQgYSB0aW1lLg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkg Q2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0DQoNCkBpbmRlcGVuZGVudGlkDQoNCnd3dy5pbmRlcGVu ZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQ a0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFH MWl3JnM9OU5QNW5hbWc2cklWend1bjljLTFxMHdoc3lYd1N2dEhCMGYyZEtrZkNYOCZlPT4gPGh0 dHA6Ly93d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZkPUR3TUZhUSZjPVJv UDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5x V055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFB dXh1cnVpYjlLQVRrUmxRRzFpdyZzPTlOUDVuYW1nNnJJVnp3dW45Yy0xcTB3aHN5WHdTdnRIQjBm MmRLa2ZDWDgmZT0+Pg0KDQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9y YWNsZS5jb20+IDxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tPj4NCg0KICAgIE9uIE9jdCAyMywgMjAxNywgYXQgNzowMiBQTSwgUmljaGFyZCBC YWNrbWFuLCBBbm5hYmVsbGUNCiAgICA8cmljaGFubmFAYW1hem9uLmNvbTxtYWlsdG86cmljaGFu bmFAYW1hem9uLmNvbT4gPG1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5u YUBhbWF6b24uY29tPj4+IHdyb3RlOg0KDQogICAgVGhlIGN1cnJlbnQgZHJhZnQgb2YgdGhlIFNF VCBzcGVjIGFsbG93cyBmb3IgZXhwcmVzc2luZyBtdWx0aXBsZQ0KICAgIGV2ZW50cyB3aXRoaW4g dGhlIHNhbWUgdG9rZW4sIHdoaWNoIGludHJvZHVjZXMgYWRkaXRpb25hbCBjb21wbGV4aXR5DQog ICAgYW5kIHJvb20gZm9yIGFtYmlndW91cyBzZW1hbnRpY3MuIFdl4oCZdmUgZGlzY3Vzc2VkIHRo aXMgaW4gdGhlIE9JREYNCiAgICBSSVNDIHdvcmtpbmcgZ3JvdXAgYW5kIHRoZSBjdXJyZW50IGNv bnNlbnN1cyB0aGVyZSBpcyB0aGF0IFJJU0Mgd2lsbA0KICAgIHJlcXVpcmUgdGhhdCBSSVNDIGV2 ZW50cyBtdXN0IGJlIHRoZSBvbmx5IGV2ZW50IGluIHRoZSBTRVQsIGhhdmluZw0KICAgIGlkZW50 aWZpZWQgd2F5cyB0byBjbGVhcmx5IGFuZCBlYXNpbHkgc3VwcG9ydCB0aGUgaGFuZGZ1bCBvZiB1 c2UNCiAgICBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciB0b2tlbiB0aGF0IHBlb3BsZSBo YXZlIHJhaXNlZC4gV2l0aA0KICAgIHRoYXQgY29udGV4dCBpbiBtaW5kLCBJIHByb3Bvc2Ugc3Ry aWtpbmcgdGhlIGRlZmluaXRpb24gb2YgdGhlDQogICAg4oCcZXZlbnRz4oCdIGNsYWltIGZyb20g dGhlIFNlY3VyaXR5IEV2ZW50IFRva2VuIHNwZWMsIGFuZCByZXBsYWNpbmcgaXQNCiAgICB3aXRo IHRoZSBmb2xsb3dpbmcgZGVmaW5pdGlvbiBmb3IgYW4g4oCcZXZlbnTigJ0gY2xhaW0gKHNpbmd1 bGFyKToNCg0KICAgIGV2ZW50DQoNCiAgICBBIEpTT04gb2JqZWN0IGNvbnRhaW5pbmcgYW4gImV2 ZW50X3R5cGUiIG1lbWJlciB3aG9zZSB2YWx1ZSBpcyBhIFVSSQ0KICAgIHJlcHJlc2VudGluZyBh IHR5cGUgb2YgZXZlbnQgZGVmaW5lZCBpbiBhIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLg0KICAg IFRoZSBvYmplY3QgTUFZIG90aGVyd2lzZSBiZSBlbXB0eSwgb3IgTUFZIGNvbnRhaW4gYWRkaXRp b25hbCBtZW1iZXJzDQogICAgYXMgZGVzY3JpYmVkIGJ5IHRoZSBQcm9maWxpbmcgU3BlY2lmaWNh dGlvbi4NCg0KICAgIEhlcmUgaXMgdGhlIGV4YW1wbGUgU0VUIGZyb20gc2VjdGlvbiAyLjMsIHJl d3JpdHRlbiB3aXRoIHRoaXMgY2hhbmdlDQogICAgbWluZDoNCg0KICAgIHsNCg0KICAgICAgICJq dGkiOiAiNGQzNTU5ZWM2NzUwNGFhYmE2NWQ0MGIwMzYzZmFhZDgiLA0KDQogICAgICAgImlhdCI6 IDE0NTg0OTY0MDQsDQoNCiAgICAgICJpc3MiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tPGh0 dHBzOi8vc2NpbS5leGFtcGxlLmNvbS8+IDxodHRwczovL3NjaW0uZXhhbXBsZS5jb20vPiIsDQoN CiAgICAgICAiYXVkIjogWw0KDQogICAgICAgICAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0Zl ZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0KDQogICAgICAgICAiaHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciDQoNCiAgICAgICBd LA0KDQogICAgICAgImV2ZW50Ijogew0KDQogICAgICAgICAiZXZlbnRfdHlwZSI6ICJ1cm46aWV0 ZjpwYXJhbXM6c2NpbTpldmVudDpjcmVhdGUiLA0KDQogICAgICAgICAicmVmIjogImh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5IiwNCg0KICAg ICAgICAgImF0dHJpYnV0ZXMiOiBbImlkIiwgIm5hbWUiLCAidXNlck5hbWUiLCAicGFzc3dvcmQi LCAiZW1haWxzIl0NCg0KICAgICAgIH0NCg0KICAgIH0NCg0KICAgIERvZXMgYW55b25lIGluIHRo ZSB3b3JraW5nIGdyb3VwIGhhdmUgdXNlIGNhc2VzIGZvciBTRVRzIHRoYXQgY2Fubm90DQogICAg YmUgbWV0IGJ5IHRoaXMgcHJvcG9zZWQgdGV4dD8gV2l0aGluIFJJU0MsIHdlIGlkZW50aWZpZWQg dGhyZWUgdXNlDQogICAgY2FzZXMsIHdpdGggc29sdXRpb25zIG91dGxpbmVkIGJlbG93Og0KDQog ICAgKioNCg0KICAgICpFeHRlbnNpb25zKg0KDQogICAgRXZlbnQgZXh0ZW5zaW9uIG1lY2hhbmlz bXMgY2FuIGJlIGRlZmluZWQgaW50ZXJuYWwgdG8gdGhlIGV2ZW50DQogICAgb2JqZWN0LiBBIHNp bXBsZSBhcHByb2FjaCB3b3VsZCBiZSB0byAgZGVmaW5lIGFuIOKAnGV4dGVuc2lvbnPigJ0gbWVt YmVyDQogICAgdGhhdCBpcyBhIGxpc3Qgb2YgZXZlbnQgb2JqZWN0cyAob3Igc2V0IHJlc2VtYmxp bmcgdGhlIOKAnGV2ZW50c+KAnQ0KICAgIGNsYWltIGFzIGRlZmluZWQgaW4gdGhlIGN1cnJlbnQg c3BlYykuIFRoaXMgaGFzIHRoZSBhZHZhbnRhZ2Ugb2YNCiAgICBtYWtpbmcgaXQgY2xlYXIgaW4g dGhlIGRhdGEgc3RydWN0dXJlIHRoYXQgdGhlcmUgaXMgYSBzaW5nbGUgcHJpbWFyeQ0KICAgIGV2 ZW50LCB3aXRoIHplcm8gb3IgbW9yZSBleHRlbnNpb25zLiBUaGVyZSBpcyBubyByb29tIGZvciBj b25mdXNpb24NCiAgICBvdmVyIHdoaWNoIGV2ZW50IGlzIHByaW1hcnksIG9yIGlmIHRoZXJlIGlz IGEgcHJpbWFyeSBldmVudCBhdCBhbGwuDQogICAgSSB3b3VsZCBiZSBmaW5lIHdpdGggYWRkaW5n IHNvbWV0aGluZyBsaWtlIHRoaXMgdG8gbXkgcHJvcG9zZWQgdGV4dCwNCiAgICBpZiB0aGVyZSBp cyBjb25zZW5zdXMgdGhhdCBpdCBpcyBicm9hZGx5IHVzZWZ1bC4NCg0KICAgICpBbGlhc2VzKg0K DQogICAgVGhpcyB1c2UgY2FzZSB3YXMgYnJvdWdodCB1cCBpbiB0aGUgY29udGV4dCBvZiBtaWdy YXRpbmcgY2xpZW50cw0KICAgIGZyb20gZHJhZnQgZXZlbnQgbmFtZXMgdG8gc3RhbmRhcmRpemVk IGV2ZW50IG5hbWVzLiBJbiB0aGlzIGNhc2UsDQogICAgdGhlIGV2ZW50IHRyYW5zbWl0dGVyIGNh biB0cmFuc21pdCB0d28gdG9rZW5zIGZvciB0aGUgbG9naWNhbCBldmVudCwNCiAgICBvbmUgdXNp bmcgdGhlIG9sZCBuYW1lIGFuZCBhbm90aGVyIHVzaW5nIHRoZSBuZXcgbmFtZS4NCg0KICAgICpS ZWxhdGVkIEV2ZW50cyoNCg0KICAgIFRoZSBTRVQgc3BlYyBkZWZpbmVzIHRoZSB0eG4gY2xhaW0g YXMgYSBtZWFucyBvZiBjb3JyZWxhdGluZw0KICAgIGluZGVwZW5kZW50IHRva2VucyB0aGF0IHJl bGF0ZSB0byB0aGUgc2FtZSBsb2dpY2FsIGV2ZW50Lg0KDQogICAgLS0NCiAgICBBbm5hYmVsbGUg UmljaGFyZCBCYWNrbWFuDQoNCiAgICBBbWF6b24g4oCTIElkZW50aXR5IFNlcnZpY2VzDQoNCiAg ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIElk LWV2ZW50IG1haWxpbmcgbGlzdA0KICAgIElkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVu dEBpZXRmLm9yZz4gPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmc+Pg0KICAgIGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNB ZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09czVieUJlNUtBTm5HVnVBYjFt QXVwRUdvSm44WEc1SklVVXdXR0ZTaWJFYyZzPVg4b1JTcTNJemxGN2ppUkFlWmhYcFIzZVZJMEk1 OFpGZDRlRVpmZ3lvSVkmZT0NCg0KDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3Jn PG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vaWQtZXZlbnQ8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9 RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5h NUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNG c2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JnM9V3JNdVFSd0xWODAyaU1RNHdZQjFmMnJG VUd1NHpiaGNXMDAxZkswMkVYcyZlPT4NCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5v cmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9pZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQm ZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9 bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0dsSzltampo Y0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYy ckZVR3U0emJoY1cwMDFmSzAyRVhzJmU9Pg0KDQoNCg0KLS0NClN1YnNjcmliZSB0byB0aGUgSEFS RFRXQVJFPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNB X19oYXJkdHdhcmUuY29tXyZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJ ck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRL Wk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPUxZTjcy R2dLVmhIc1Q2dEFxQmUtZU1vV012eV83ZGZGbjF1WjBISzZZdVEmZT0+IG1haWwgbGlzdCB0byBs ZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1l dmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhC djdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxj TE40S1pOQSZtPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz1X ck11UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmU9DQoNCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5n IGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBw dVlxUGtBSTFhTGNMTjRLWk5BJm09VS1hNUhCTkQwSGFUWDRhbk5aZnpYN3BEc2ZLNWYwaDltWjlD WmtrR2llYyZzPXJ2ZHJ0STdyWU5SQW5xWkRsdEN3QkFaVkhLcC1NSjIwdWkybm00NlFTejAmZT0N Cg0KDQoNCg0KLS0NClN1YnNjcmliZSB0byB0aGUgSEFSRFRXQVJFPGh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19oYXJkdHdhcmUuY29tXyZkPUR3TUZh USZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpC VFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09aXlWbnJabXI5X3VHQ1E2TUQw ekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPXd0Z0QzTnAwdnloTGRwRXdVaXFzZjRJdGl3QTNP bTdHcm9iNzBMeDByM2smZT0+IG1haWwgbGlzdCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFt IHdvcmtpbmcgb24hDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQt ZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJs P3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1E d0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1 RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPWl5Vm5yWm1yOV91R0NR Nk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmcz1PZTBxZkxFWDgzdnRYTTdXbDJjWUJlLUdn MURWUGpoWGpWSmtmaFZSendjJmU9DQo= --_000_CY4PR21MB0504620D605B64EF1ACF1496F55E0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhU TUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAw MXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRN TCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4ubTQwMjYyMzY0 NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6bV80MDI2 MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTIx DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEu MGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBE ZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NTU2MDg3NDUyOw0KCW1zby1s aXN0LXRlbXBsYXRlLWlkczotMTQ0MTc5MTEwO30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2 ZWwtc3RhcnQtYXQ6MjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVs Mg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjEuNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGww OmxldmVsNQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7 bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC10 YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6NC4w aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDENCgl7bXNvLWxpc3QtaWQ6MTY0MDc2Mzc1NzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTIw NzY1NTgyMzY7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC10YWItc3RvcDouNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0K QGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxl dmVsMw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNv LWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC10YWIt c3RvcDoyLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6My4waW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6 bGV2ZWw4DQoJe21zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOQ0KCXtt c28tbGV2ZWwtdGFiLXN0b3A6NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMg0KCXttc28tbGlzdC1pZDoxNzg1MDc1 OTMxOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxOTMzNjMxMTE4O30NCkBsaXN0IGwyOmxldmVs MQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBs aXN0IGwyOmxldmVsMg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZl bDMNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6bGV2ZWw0DQoJe21zby1s ZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxldmVsNQ0KCXttc28tbGV2ZWwtdGFiLXN0 b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZlbDYNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0K QGxpc3QgbDI6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxl dmVsOA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZlbDkNCgl7bXNv LWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7 bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9 ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JdOKAmXMgaGFyZCBm b3IgbWUgdG8gZXZlbiBleHByZXNzIG15IGxldmVsIG9mIGZydXN0cmF0aW9uIHdpdGggdGhlIHJl Y2VudCBhdHRlbXB0cyB0byBvbmNlIGFnYWluIHJlZGVzaWduIHRoZSBTZWNFdmVudCBUb2tlbiBz cGVjLiZuYnNwOyBXZeKAmXZlIGJlZW4gYXQgdGhpcyBmb3IgbXVsdGlwbGUgeWVhcnMgYmVjYXVz ZSBwZW9wbGUga2VlcCB0cnlpbmcgdG8gcmV2aXNpdCBkZWNpc2lvbnMNCiB0aGF0IHdlcmUgbG9u ZyBhZ28gbWFkZSBieSBjb25zZW5zdXMuJm5ic3A7IEl04oCZcyBiZWVuIHN0YWJsZSBmb3Igb3Zl ciBhIHllYXIgYW5kIHRoZSBtYWpvcml0eSBvZiBXR0xDIHJlc3BvbmRlbnRzIHNhaWQgc29tZSB2 YXJpYW50IG9mIOKAnFdvcmtzIGZvciBtZSDigJMgc2hpcCBpdCHigJ08bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPlRoZXJl4oCZcyBub3Qgc3VmZmljaWVudCBqdXN0aWZpY2F0 aW9uIHRvIHRyeSB0byB1bmRvIGNvbnNlbnN1cyBwb3NpdGlvbnMgdGhhdCBoYXZlIGJlZW4gZGVi YXRlZCBhbmQgYWZmaXJtZWQgb3ZlciBhbmQgb3Zlci4mbmJzcDsgQ291bnRlbmFuY2luZyB3aG9s ZXNhbGUgY2hhbmdlcyBhdCB0aGlzIGxhdGUgZGF0ZSBpcyBjb3VudGVycHJvZHVjdGl2ZSBpbiB0 aGUgZXh0cmVtZSE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkl04oCZcyBm YXIgYmV0dGVyIHRoYW4gZ29vZCBlbm91Z2ggYXMtaXMuJm5ic3A7IEluIG15IGV4cGVyaWVuY2Us IGlmIHdlIHN0YXJ0IHJlZGVzaWduaW5nIGl0LCBpdCB3aWxsIHJlc3VsdCBpbiBhbm90aGVyIHll YXLigJlzIGRlbGF5LiZuYnNwOyBJdCBkb2VzIHNvbWV0aGluZyBzaW1wbGUgYW5kIHVzZWZ1bC4m bmJzcDsgUGxlYXNlLCBsZXTigJlzIGp1c3Qgc2hpcCBpdCwgc28gcGVvcGxlIGNhbg0KIHJlbHkg b24gaXQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3Bh biBzdHlsZT0ibXNvLWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPGRpdj4NCjxk aXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRk aW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9i PiBQaGlsIEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbV0gPGJyPg0KPGI+ U2VudDo8L2I+IE1vbmRheSwgT2N0b2JlciAzMCwgMjAxNyAyOjQyIFBNPGJyPg0KPGI+VG86PC9i PiBEaWNrIEhhcmR0ICZsdDtkaWNrLmhhcmR0QGdtYWlsLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+ IFlhcm9uIFNoZWZmZXIgJmx0O3lhcm9uZi5pZXRmQGdtYWlsLmNvbSZndDs7IFJpY2hhcmQgQmFj a21hbiwgQW5uYWJlbGxlICZsdDtyaWNoYW5uYUBhbWF6b24uY29tJmd0OzsgTWlrZSBKb25lcyAm bHQ7TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0OzsgSUQgRXZlbnRzIE1haWxpbmcgTGlz dCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQt ZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW5saW5lLi4uPGJyPg0KPGJyPg0K UGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBPY3QgMzAsIDIwMTcsIGF0IDI6 MjIgUE0sIERpY2sgSGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNv bSI+ZGljay5oYXJkdEBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIFBoaWw8bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNvcnJlY3QgbWUgaWYgSSBh bSBtaXN1bmRlcnN0YW5kaW5nLCBidXQgdGhlcmUgaXMgYSBSSVNDIHByb2ZpbGUgZXZlbnQmbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9IndoaXRlLXNwYWNl OnByZS13cmFwIj48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0id2hpdGUtc3Bh Y2U6cHJlLXdyYXAiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij4mcXVvdDs8YSBocmVm PSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2No ZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVDJmFtcDtkPUR3 TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFt cDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209aXlW bnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZhbXA7cz0yNWwwOXNIOFlW NDJ4emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsi Pmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBlLzwvYT48 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtBcmlh bCZxdW90OyxzYW5zLXNlcmlmIj5hY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdlLXJlcXVpcmVkPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFs JnF1b3Q7LHNhbnMtc2VyaWYiPuKAnTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHls ZT0id2hpdGUtc3BhY2U6cHJlLXdyYXAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5hbmQgYW4gU0NJTSBwcm9maWxlIGV2ZW50PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4mcXVvdDs8YSBocmVmPSJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFz c3dvcmRSZXNldEV4dCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9l dmVudC9wYXNzd29yZFJlc2V0RXh0PC9hPuKAnTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkknbSBzdWdnZXN0aW5nIHRoYXQgdHdvIGRpZmZl cmVudCBldmVudHMgd291bGQgYmUgc2VudC4gRW1iZWRkaW5nIG9uZSBpbiB0aGUgb3RoZXIgZG9l cyBub3QgbWFrZSBzZW5zZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZsdDtwaCZndDtJdCBpcyBhIGh5 cG90aGV0aWNhbCBleGFtcGxlLiBKdXN0IGJlY2F1c2UgeW91IGRpc2FncmVlIG9uIHRoaXMgZG9l cyBub3QgbWVhbiBvdGhlcnMgYXJlIG5vdCB2YWxpZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkganVzdCBwaWNrZWQgb3ZlcmxhcHBpbmcgcHJv cG9zYWxzIHRoYXQgaGF2ZSBkaWZmZXJlbnQgbWVhbmluZyAoYnV0IG5vdCB0aGUgc2FtZSkgdG8g aWxsdXN0cmF0ZSB0aGUgZGlmZmVyZW5jZSBmcm9tIGlzc3VpbmcgYSBzaW5nbGUgc2V0IHdpdGgg ZGlmZmVyZW50IGV2ZW50cy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+QXMgSSBoYXZlIHN0YXRlZCB0aGlzIGlzIHZlcnkgZGlmZmVy ZW50IGZyb20gYXNzZXJ0aW5nIG11bHRpcGxlIGRpc3RpbmN0IGV2ZW50cyBpbiBvbmUgU0VULiZu YnNwOzxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsc28sIEkgdGhpbmsgaXQgaXMgc2ltcGxlciB0byBoYXZl IGV2ZW50X3R5cGUgYmUgYXQgdGhlIHNhbWUgbGV2ZWwgYXMgZXZlbnQ8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jmx0O3BoJmd0O21heSBiZS4gSSB3YXMgd29ya2luZyBmcm9tIEFubmFiZWxsZSdzIHBy b3Bvc2VkIGZvcm1hdC4mbmJzcDs8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1 b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7 OiAmcXVvdDszZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCZxdW90Oyw8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmcXVvdDtp YXQmcXVvdDs6IDE0NTg0OTYwMjUsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJo dHRwczovL3NjaW0uZXhhbXBsZS5jb20iPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbTwvYT4mcXVv dDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v amh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0Ij5odHRwczov L2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvYT4mcXVv dDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsgJm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVk cy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ij5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVl ZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4mcXVvdDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDtdLDwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNw OyZxdW90O2V2ZW50X3R5cGUmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5j b20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0Ij5odHRwczovL2V4YW1wbGUuY29tL3NjaW0v ZXZlbnQvcGFzc3dvcmRSZXNldEV4dDwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7JnF1b3Q7ZXZlbnQmcXVv dDs6IHsmbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtpZCZx dW90OzomcXVvdDs0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5JnF1b3Q7LDwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyZxdW90O3Jlc2V0QXR0ZW1wdHMmcXVvdDs6NTwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDszZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFi ZDRlN2QzMCZxdW90Oyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7aXNz JnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iPmh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbTwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7 ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZh NWJiYzg3OTU5M2I3NzU0Ij5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFm YTViYmM4Nzk1OTNiNzc1NDwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBz Oi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ij5odHRw czovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4m cXVvdDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDtdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyZxdW90O2V2ZW50X3R5cGUmcXVvdDs6ICZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNB X19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRfcmlzY19ldmVudC0yRHR5cGVfYWNjb3VudC0y RGNyZWRlbnRpYWwtMkRjaGFuZ2UtMkRyZXF1aXJlZCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5x V055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpG MnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9blF5OWV6UFJqREdkdlJUQ2FpRHRpNE9IZWxI M0RLZ1VDVEtqRjJHUS1zbyZhbXA7ZT0iPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZl bnQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQ8L2E+ JnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Jm5ic3A7ICZuYnNwOyZxdW90O2V2ZW50JnF1b3Q7OiB7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDvigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDvi gJxpc3PigJ06JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIj5odHRwczov L2lkcC5leGFtcGxlLmNvbS88L2E+JnF1b3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDt9PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBPY3QgMzAsIDIw MTcgYXQgMTI6MDkgUE0sIFBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFy Z2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkFubmFiZWxsZS9EaWNrLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MgZm9yIHRoZSBjb21tZW50cy4gSSB0aGlu ayB3ZSBuZWVkIHRvIGV4YW1pbmUgdGhlIGNvbnNlcXVlbmNlcyBvZiB0aGUgcHJvcG9zYWwgaW4g SlNPTi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcyBJ IHN0YXRlZCwgd2hhdCBjYXVzZXMgbW9zdCBvZiB0aGUgaXNzdWUgaXMgdGhlIHByb3Bvc2VkIGV4 dGVuc2lvbiBtZWNoYW5pc20gaW4gdGhlIHBheWxvYWQgKHBvc3NpYmx5IHVzaW5nIGV2ZW50cyBp biBhIHJlY3Vyc2l2ZSB3YXkpLiBEb2VzIGl0IGZvbGxvdyB0aGUgb2xkIGZvcm1hdCBvciB0aGUg bmV3PzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TGV04oCZ cyAmbmJzcDtjb25zaWRlciBhIHVzZSBjYXNlIHdoZXJlIHdlIGhhdmUgYW4gaWRlbnRpdHkgbWFu YWdlbWVudCBzeXN0ZW0gdGhhdCB1c2VzIFNDSU0sIGJ1dCB0aGUgU0NJTSBzeXN0ZW0gaXMgYWxz byB0aGUgdW5kZXJseWluZyBkYXRhIHN0b3JlIGZvciBDb25uZWN0LiZuYnNwOyBBIFBhc3N3b3Jk IHJlc2V0IG1pZ2h0IGdlbmVyYXRlIHRoZSBmb2xsb3dpbmcgZXZlbnQgd2hpY2ggaGFzIGFuIGV4 dGVuc2lvbiAoY29udmV5aW5nDQogcmVzZXQgY291bnQpIEFORCBvdmVybGFwcGluZyBzdGF0ZW1l bnQgZnJvbSBSSVNDLiZuYnNwOyBCT1RIIG9mIHdoaWNoIG1pZ2h0IGJlIGltcG9ydGFudCB0byBh IHNpbWlsYXIgcmVjZWl2ZXIgdXNpbmcgU0NJTSBhbmQgT0lEQy4gJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPlRoZSAwMyBzcGVj IGN1cnJlbnRseSB3b3VsZCBhbGxvdzo8L2I+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwcmU+ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6 ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7LDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9zY2ltLmV4YW1w bGUuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7YXVk JnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3 OTU5M2I3NzU0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRz Lzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQ8L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL2podWIuZXhhbXBs ZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3PC9h PiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBdLDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7dXJuOmlldGY6cGFy YW1zOnNjaW06ZXZlbnQ6cGFzc3dvcmRSZXNldCZxdW90Ozo8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgeyAmcXVvdDtpZCZxdW90Ozom cXVvdDs0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5JnF1b3Q7fSw8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9leGFt cGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiIHRhcmdldD0iX2JsYW5rIj5odHRw czovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dDwvYT4mcXVvdDs6PG86 cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHsgJnF1b3Q7cmVzZXRBdHRlbXB0cyZxdW90Ozo1fSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZx dW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRfcmlzY19ldmVudC0yRHR5cGVfLTI1 NUMmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1 ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pO QSZhbXA7bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JmFtcDtz PTI1bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlESno0MHRDUmpGYWxoa3cmYW1wO2U9IiB0YXJn ZXQ9Il9ibGFuayI+aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50 LXR5cGUvXDwvYT48YnI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7YWNjb3VudC1jcmVkZW50 aWFsLWNoYW5nZS1yZXF1aXJlZCZxdW90Ozogezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnHN1YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSw8 L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxp c3PigJ06JnF1b3Q7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij48YSBocmVm PSJodHRwczovL2lkcC5leGFtcGxlLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2lkcC5l eGFtcGxlLmNvbS88L2E+JnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgfTxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+Jm5ic3A7IH08bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+ PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiB0aGUgYWJvdmUgLSBlYWNoIHBheWxv YWQgaXMgYSDigJhwZWVyJyBhbmQgaXNzdWVkIHdpdGhvdXQgcHJlZmVyZW5jZSBieSB0aGUgdHJh bnNtaXR0ZXIuIFRoZSByZWNlaXZlciBjYW4gYXNzaWduIHByaW9yaXR5IGluIGl0cyBvd24gY29u dGV4dCBpZiB0aGF0IG1hdHRlcnMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHBy ZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZT48Yj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoZSBu ZXcgcHJvcG9zYWw6PC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8ZGl2Pg0K PHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZT57PG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7M2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIx YmQ0ZTdkMzAmcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lhdCZx dW90OzogMTQ1ODQ5NjAyNSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7aXNz JnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iIHRhcmdldD0i X2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb208L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyAmcXVvdDthdWQmcXVvdDs6IFs8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUu Y29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdldD0iX2JsYW5rIj5odHRw czovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvYT4m cXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3 Njc2ZWU3IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVk NzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7ICZxdW90 O2V2ZW50JnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IOKAnGV2ZW50X3R5cGXigJ06JnF1b3Q7dXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6 cGFzc3dvcmRSZXNldOKAnSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7aWQmcXVvdDs64oCdNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOeKAnSw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZlbnRz 4oCdOns8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLSZn dDtub3RlIOKApmlzIHRoaXMgdGhlIG9sZCBvciBuZXcgc3RydWN0dXJlPyAmbHQ7LTxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDs8YSBocmVmPSJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4 dCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29y ZFJlc2V0RXh0PC9hPiZxdW90Ozo8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgeyAmcXVvdDtyZXNldEF0dGVtcHRz JnF1b3Q7OjV9LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3Nj aGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1QyZhbXA7ZD1E d01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZh bXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5 Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9MjVsMDlzSDhZ VjQyeHpnVS1DWFNnOHhIOXR2eURKejQwdENSakZhbGhrdyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5r Ij5odHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPC9h Pjxicj4mbmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDthY2NvdW50LWNyZWRl bnRpYWwtY2hhbmdlLXJlcXVpcmVkJnF1b3Q7OiB7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcc3Vi4oCdOuKAnTczNzU2MjZBNjU2Mzc04oCd LDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKA nGlzc+KAnTomcXVvdDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPjxhIGhy ZWY9Imh0dHBzOi8vaWRwLmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vaWRw LmV4YW1wbGUuY29tLzwvYT4mcXVvdDs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB9PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTwvc3Bhbj48bzpwPjwvbzpw PjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7 IH08L3NwYW4+Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PjxvOnA+Jm5ic3A7PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SW4gdGhlIGFib3ZlLCBzdWItZXZlbnRz IG9yIGV4dGVuc2lvbnMgaGF2ZSBhIGRpZmZlcmVudCBmb3JtYXQuIFRoZSBzYW1lIGNvbXBsYWlu dCBhYm91dCB0aGUgb3JpZ2luYWwgc3RhbmRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZT48Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPipPUiogKGlmIHRoZSByZWNlaXZl ciBjYXJlcyBhYm91dCBSSVNDIG1vcmUpLiZuYnNwOyBOb3RlIHRoYXQgdGhpcyBsZWFkcyB0byBh IHRyaXBsZSBuZXN0ZWQgc3RydWN0dXJlLjwvc3Bhbj48L2I+PG86cD48L286cD48L3ByZT4NCjxw cmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJk NGU3ZDMwJnF1b3Q7LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpYXQmcXVv dDs6IDE0NTg0OTYwMjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lzcyZx dW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNv bS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQ8L2E+JnF1 b3Q7LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBo cmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3 NmVlNyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2 MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3PC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZu YnNwOyZuYnNwOyBdLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyAmcXVvdDtl dmVudCZxdW90OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyDigJxldmVudF90eXBl4oCdOjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij4mcXVv dDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0 cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVD JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVh cElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEm YW1wO209aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZhbXA7cz0y NWwwOXNIOFlWNDJ4emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmFtcDtlPSIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10 eXBlL1w8L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQiPiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZuYnNwO2FjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQ8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPuKAnSw8L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyDigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg Jm5ic3A74oCcaXNz4oCdOiZxdW90Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+PGEgaHJlZj0iaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v4oCcIiB0YXJnZXQ9Il9ibGFuayI+ aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v4oCcPC9hPiw8L3NwYW4+PG86cD48L286cD48L3ByZT4N CjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyDigJxldmVudHPigJ06ezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3VybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3Jk UmVzZXQmcXVvdDs6PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgeyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWQmcXVvdDs64oCd NDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOeKAnSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZl bnRz4oCdOns8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEg aHJlZj0iaHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNl dEV4dDwvYT4mcXVvdDs6PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IHsgJnF1b3Q7cmVzZXRBdHRlbXB0cyZxdW90Ozo1fSw8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEzLjVwdCI+Jm5ic3A7IDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7fTwvc3Bhbj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO308bzpwPjwvbzpwPjwvcHJlPg0KPC9k aXY+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB9Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IDxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNw OyZuYnNwO308bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPn08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cHJlPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SW4gdGhlIGFib3ZlLCB0 aGUgZXh0ZW5zaW9uIGlzIHBsYWNlZCBpbnNpZGUgdGhlIGV2ZW50IGl0IGV4dGVuZHMuIEl0IGZv bGxvd3MgdGhlIG9sZCBmb3JtYXQgKG9yIHNob3VsZCBpdCBmb2xsb3cgdGhlIG5ldz8pPC9zcGFu PjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPjxiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Kk9SKiBGb2xsb3dp bmcgdGhlIHRvcCBsYXllciBwYXR0ZXJuIG9mIHNpbmd1bGFyIGV2ZW50Jm5ic3A7IE5vdGUgdGhh dCB0aGlzIGxlYWRzIHRvIGEgdHJpcGxlIG5lc3RlZCBzdHJ1Y3R1cmUuPC9zcGFuPjwvYj48bzpw PjwvbzpwPjwvcHJlPg0KPHByZT48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0KPHByZT57PG86cD48 L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7M2QwYzNjZjc5 NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAmcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7ICZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjAyNSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBs ZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb208L2E+JnF1b3Q7 LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDthdWQmcXVvdDs6IFs8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6 Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4 Nzk1OTNiNzc1NDwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2 MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1w bGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L2E+JnF1b3Q7PG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7ICZxdW90O2V2ZW50JnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW50X3R5cGXigJ06PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMy41cHQiPiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRfcmlzY19l dmVudC0yRHR5cGVfLTI1NUMmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4 UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZ cVBrQUkxYUxjTE40S1pOQSZhbXA7bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZf OHU4X3FTQ193JmFtcDtzPTI1bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlESno0MHRDUmpGYWxo a3cmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9zZWNl dmVudC9yaXNjL2V2ZW50LXR5cGUvXDwvYT48L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg Jm5ic3A7YWNjb3VudC1jcmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZDxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij7igJ0sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTMuNXB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCc c3Vi4oCdOuKAnTczNzU2MjZBNjU2Mzc04oCdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcaXNz4oCdOiZxdW90OzxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48YSBocmVmPSJodHRwczovL2lkcC5leGFtcGxlLmNvbS/i gJwiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2lkcC5leGFtcGxlLmNvbS/igJw8L2E+LDwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW504oCdOns8L3NwYW4+PG86cD48 L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxldmVudF90eXBl4oCdOiZxdW90 O3VybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXTigJ0sPC9zcGFuPjxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPiZxdW90O2lkJnF1b3Q7 OuKAnTQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDnigJ0sPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW504oCdOns8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZlbnRfdHlwZeKAnTomcXVvdDs8YSBocmVmPSJodHRw czovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dCIgdGFyZ2V0PSJfYmxh bmsiPmh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0PC9hPuKA nSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7cmVzZXRBdHRlbXB0cyZxdW90Ozo1PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPiA8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxkaXY+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO308 bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyB9Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwO308bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08L3NwYW4+PG86cD48L286cD48L3By ZT4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGlzIGZvcm1hdCBmb2xs b3dzIHRoZSBwcm9wb3NlZCBzaW5ndWxhciBldmVudCBmb3JtYXQgcmVjdXJzaXZlbHkgYW5kIGlz IDMgbGF5ZXJzIGRlZXAuIE5vdGUgdGhhdCB0aGUgcGFyc2VyIGhhcyB0byBjb250aW51ZSB0byBz ZWFyY2ggdGhlIGRvY3VtZW50IGZvciB0aGluZ3MgdGhhdCBhcmVu4oCZdCB0aGVyZSBhcyBpdCBo YXMgdG8gc3RvcCB3aGVuIG5vIOKAnGV2ZW504oCdIGF0dHJpYnV0ZSBpcyBmb3VuZCByYXRoZXIg dGhhbiBpdGVyYXRlIG92ZXIgYW4gYXJyYXkuPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Rp dj4NCjxwcmU+PG86cD4mbmJzcDs8L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlBoaWw8YnI+DQo8YnI+DQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5 IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxicj4NCkBpbmRlcGVuZGVudGlkPGJyPg0KPGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3 dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBw dVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5 Rl84dThfcVNDX3cmYW1wO3M9OXNZaGdwRXpiN3hQbFFGbUNDWE5tSG82ZlFOOUlCdS1TSEphbWdf QjRIcyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PGJy Pg0KPGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+ cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gT2N0IDMwLCAyMDE3LCBhdCA4OjU3IEFN LCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5h QGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj5yaWNoYW5uYUBhbWF6b24uY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5SZXBsaWVzIGlubGluZS48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyxzZXJpZiI+LS0mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7LHNlcmlmIj5Bbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+SWRlbnRpdHkgU2VydmljZXM8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48Yj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+RnJvbTo8c3BhbiBjbGFzcz0ibTQwMjYyMzY0NTYwODAz NDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PC9iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5QaGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpw aGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+RGF0ZTo8 c3BhbiBjbGFzcz0ibTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj48L2I+U3VuZGF5LCBPY3RvYmVyIDI5LCAyMDE3IGF0IDU6MjUgUE08YnI+DQo8 Yj5Ubzo8c3BhbiBjbGFzcz0ibTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48L2I+RGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2su aGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+ZGljay5oYXJkdEBnbWFpbC5jb208L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5DYzo8c3BhbiBj bGFzcz0ibTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj48L2I+WWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnlhcm9uZi5pZXRmQGdt YWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnlhcm9u Zi5pZXRmQGdtYWlsLmNvbTwvc3Bhbj48L2E+Jmd0OywgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0i bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvc3Bhbj48 L2E+Jmd0OywNCiAmcXVvdDtSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSZxdW90OyAmbHQ7PGEg aHJlZj0ibWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5yaWNoYW5uYUBhbWF6b24uY29tPC9zcGFuPjwvYT4mZ3Q7LCBJ RCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZC1ldmVudEBp ZXRmLm9yZzwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PHNwYW4gY2xhc3M9Im00MDI2 MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlJl OiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImJhY2tncm91bmQ6d2hpdGUiPkkgaG9wZSB0aGlzIGFuc3dlcnMgeW91ciBxdWVzdGlvbi48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJiYWNrZ3JvdW5kOndoaXRlIj5NeSDigJxtYXnigJ0gd2FzIGJlY2F1c2UgSSBjYW7igJl0IHNl ZSBhIHJlYXNvbiB3aHkgbm90LiBUaGUgcXVlc3Rpb24gc2hvdWxkIGJlLCB3aGF0IGlzIHRoZSBq dXN0aWZpY2F0aW9uIHRvIG1ha2Ug4oCcZXZlbnRz4oCdIHNpbmd1bGFyPzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdVGhlIHNpbmd1bGFy IOKAnGV2ZW504oCdIGNsYWltIGhhcyBjbGVhcmVyIHNlbWFudGljcyBhbmQgaXMgZWFzaWVyIHRv IHByb2Nlc3MuIFdlIHNob3VsZCBvcHQgZm9yIGVhc2llciBzb2x1dGlvbnMgdW5sZXNzIHRoZXJl IGFyZSB1c2UgY2FzZXMgdGhhdCByZXF1aXJlIG1vcmUgY29tcGxleGl0eS5bL3JpY2hhbm5hXTwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5UaGVyZSBhcmUgbWFueSByZWFzb25zIGZvciBtdWx0 aXBsZSBldmVudHMgaW4gYSBTRVQuJm5ic3A7IFNvbWUgYXJlIGdvb2QsIHNvbWUgbm90IHNvIGdv b2QuIFNvbWUgb2YgdGhlIHJlYXNvbnMuLi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4xLiZuYnNwOyBN dWx0aXBsZSBldmVudCBwYXlsb2FkcyBleHByZXNzaW5nIHN0YXRlbWVudHMgYWJvdXQgbGFyZ2Vs eSB0aGUgKnNhbWUqdGhpbmcuIEZvciBleGFtcGxlLCBTQ0lNIHBhc3N3b3JkIHJlc2V0IEFORCBS SVNDIHBhc3N3b3JkIHJlc2V0LiZuYnNwOyBBIFJJU0MgRXZlbnQgYW5kIGFuIE9wZW5CYW5raW5n IEV2ZW50LiBJcyBvbmUgYSBjb21wbGVtZW50IHRvIHRoZSBvdGhlcj8mbmJzcDsNCiBEbyB0aGV5 IG92ZXJsYXAgb3IgYXJlIHRoZXkgZGlzdGluY3Q/ICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdQ29weS9wYXN0ZWQgZnJvbSBt eSBlYXJsaWVyIGVtYWlsOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0i Y29sb3I6I0MzNDZFMCI+V2h5IGlzIGl0IG5lY2Vzc2FyeSBvciBhcHByb3ByaWF0ZSB0byBpbmNs dWRlIHRoZXNlIGV2ZW50cyBpbiB0aGUgc2FtZSBTRVQ/IFRoZXkgYXJlIGxpa2VseSBiZWluZyBn ZW5lcmF0ZWQgYnkgZGlmZmVyZW50IHN5c3RlbXMgYXQgZGlmZmVyZW50IHRpbWVzIG9uIHRoZSB0 cmFuc21pdHRlcuKAmXMgc2lkZSwgY29uc3VtZWQNCiBieSBkaWZmZXJlbnQgc3lzdGVtcyBvbiB0 aGUgcmVjZWl2ZXLigJlzIHNpZGUsIGFuZCBwb3NzaWJseSBiZWluZyB0cmFuc21pdHRlZCBvdmVy IGRpZmZlcmVudCBldmVudCBzdHJlYW1zLiBJIGtub3cgdGhlIGxhdHRlciB3b3VsZCBiZSB0aGUg Y2FzZSBmb3IgdXMsIGFzIGEgcmVjZWl2ZXIuIEV2ZW4gaWYgaXTigJlzIG5vdCwgaXMgaXQgYnVy ZGVuc29tZSB0byBzZW5kIHRoZXNlIGV2ZW50cyBzZXBhcmF0ZWx5PyBXaGF0IHZhbHVlIGlzIGdh aW5lZCBpbg0KIGNvbWJpbmluZyB0aGVtPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iY29sb3I6I0MzNDZFMCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5BZGRpdGlvbmFsbHksIHNpbmNlIHRoZSBzaWdu YXR1cmUgaXMgb3ZlciB0aGUgU0VUIGFuZCBub3QgdGhlIGV2ZW50IG9iamVjdHMsIFJlY2VpdmVy cyBpbmRlcGVuZGVudGx5IHJvdXRlIHNlcGFyYXRlIGV2ZW50cyBmcm9tIGEgc2luZ2xlIHRva2Vu IHdpdGhvdXQgZWl0aGVyIGxvc2luZyB0aGUgYWJpbGl0eSB0byB2ZXJpZnkNCiB0aGUgYXV0aGVu dGljaXR5IG9mIHRoZSBldmVudCBvciBzaGFyaW5nIGFsbCBpbmZvcm1hdGlvbiBpbiB0aGUgU0VU IHdpdGggZXZlcnkgc3lzdGVtIGhhbmRsaW5nIGFueSBldmVudCBpbiB0aGUgdG9rZW4uWy9yaWNo YW5uYV08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2 RTAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdDti YWNrZ3JvdW5kOndoaXRlIj4yLiZuYnNwOyBNdWx0aXBsZSBldmVudHMgcGF5bG9hZHMgZXhwcmVz c2luZyBkaWZmZXJlbnQgc3RhdGVtZW50cyBhYm91dCB0aGUgc2FtZSB0cmFuc2FjdGlvbiAtIFJJ U0MgUGFzc3dvcmQgUmVzZXQgYW5kIFJJU0MgU2Vzc2lvbiBDYW5jZWw8YnI+DQo8c3BhbiBzdHls ZT0iY29sb3I6I0MzNDZFMCI+W3JpY2hhbm5hXVNhbWUgYXMgYWJvdmVbL3JpY2hhbm5hXTwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4zLiZuYnNwOyBBIG5ldyBwcm9m aWxlIGRlZmluZXMgbmV3IGV2ZW50IGF0dHJpYnV0ZXMgdG8gYmUgYWRkZWQgb24gdG8gYW4gZXhp c3RpbmcgZXZlbnQgdHlwZSAoYSBwdXJlIGV4dGVuc2lvbikmbmJzcDs8YnI+DQo8c3BhbiBzdHls ZT0iY29sb3I6I0MzNDZFMCI+W3JpY2hhbm5hXUkgaGF2ZSBzdWdnZXN0ZWQgYSB3YXkgdG8gc3Vw cG9ydCBleHRlbnNpb25zIHdpdGhpbiBhbiBldmVudCBib2R5LCBtdWx0aXBsZSB0aW1lcyBub3cu IElmIHlvdSBzZWUgcHJvYmxlbXMgd2l0aCBpdCwgcGxlYXNlIHBvaW50IHRoZW0gb3V0Llsvcmlj aGFubmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPkkgdGhpbmsgaXQgaXMgcXVpdGUgdmFs aWQgdG8gYWxsb3cgMSBhbmQgMy4gJm5ic3A7MiBjb3VsZCBiZSBsaW1pdGVkIGJ5IHNwZWNpZmlj IHByb2ZpbGVzIGxpa2UgUklTQyBpZiB0aGV5IHdhbnQuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+SSBh bSBub3QgaW4gYWdyZWVtZW50IHRoYXQgbWFraW5nIGV2ZW50IHNpbmd1bGFyIHNpbXBsaWZpZXMg YW55dGhpbmcuIEZvciBvbmUgaXMgbWFrZXMgZXh0ZW5zaW9ucyBjb21wbGV4IChhbm90aGVyIG5l c3RlZCBKU09OIHN0cnVjdHVyZSkgYW5kIHBvdGVudGlhbGx5IGNvbmZsaWN0aW5nLiZuYnNwOzxi cj4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tn cm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5XYXlzIHRoYXQgbXVsdGlw bGUtZXZlbnQgU0VUcyBhcmUgbW9yZSBjb21wbGljYXRlZDo8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSIxIj4N CjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttc28tbGlzdDpsMSBs ZXZlbDEgbGZvMTtiYWNrZ3JvdW5kOndoaXRlIj4NCkl0IHJlc3VsdHMgaW4gYSBtb3JlIGNvbXBs ZXggc3RydWN0dXJlIGZvciB0aGUgc2luZ2xlIGV2ZW50IHVzZSBjYXNlLCB3aGljaCBJIHRoaW5r IHdlIGFsbCBhZ3JlZSBpcyB0aGUgbWFqb3JpdHkgdXNlIGNhc2UuPG86cD48L286cD48L2xpPjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttc28tbGlzdDpsMSBsZXZl bDEgbGZvMTtiYWNrZ3JvdW5kOndoaXRlIj4NCk11bHRpcGxlLWV2ZW50IFNFVHMgaGF2ZSBhbWJp Z3VvdXMgc2VtYW50aWNzLiBUaGUgcHJlc2VuY2Ugb2YgdHdvIGV2ZW50cyBBIGFuZCBCIGluIHRo ZSBzYW1lIFNFVCBjb3VsZCBtZWFuIGFueSBvZjo8bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxvbCBz dHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIyIiB0eXBlPSIxIj4NCjxvbCBzdHlsZT0ibWFy Z2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0eXBlPSJhIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iY29sb3I6I0MzNDZFMDttc28tbGlzdDpsMCBsZXZlbDIgbGZvMjtiYWNrZ3JvdW5kOndo aXRlIj4NClRoZXkgYXJlIHJlbGF0ZWQgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudCAoaS5lLiB0 aGUgc2FtZSB0aGluZyBhcyBpZiB0aGV5IHdlcmUgZnJvbSBkaWZmZXJlbnQgU0VUcyB0aGF0IGhh dmUgYSBjb21tb24gdHhuKS48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJjb2xvcjojQzM0NkUwO21zby1saXN0OmwwIGxldmVsMiBsZm8yO2JhY2tncm91bmQ6d2hp dGUiPg0KQSBpcyBhbiBleHRlbnNpb24gb2YgQi48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21zby1saXN0OmwwIGxldmVsMiBsZm8yO2Jh Y2tncm91bmQ6d2hpdGUiPg0KQiBpcyBhbiBleHRlbnNpb24gb2YgQS48bzpwPjwvbzpwPjwvbGk+ PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21zby1saXN0OmwwIGxl dmVsMiBsZm8yO2JhY2tncm91bmQ6d2hpdGUiPg0KVGhleSBhcmUgYWxpYXNlcyBmb3Igb25lIGFu b3RoZXIuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6 I0MzNDZFMDttc28tbGlzdDpsMCBsZXZlbDIgbGZvMjtiYWNrZ3JvdW5kOndoaXRlIj4NClRoZXkg YXJlIG5vdCBhY3R1YWxseSByZWxhdGVkIHRvIG9uZSBhbm90aGVyIGluIGFueSB3YXkuPG86cD48 L286cD48L2xpPjwvb2w+DQo8L29sPg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3RhcnQ9 IjMiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUw O21zby1saXN0OmwyIGxldmVsMSBsZm8zO2JhY2tncm91bmQ6d2hpdGUiPg0KQ2xhaW0gc2VtYW50 aWNzIGJlY29tZSBoYXJkZXIgdG8gZGVmaW5lLCBhcyBkaWZmZXJlbnQgcHJvZmlsZXMgbWF5IHdh bnQgdG8gdXNlIHRoZSBzYW1lIGNsYWltcyBpbiBkaWZmZXJlbnQgd2F5cy48bzpwPjwvbzpwPjwv bGk+PC9vbD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iYmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3 aGl0ZSI+SWYgdGhlIFdHIHdhbnRzIHRvIGJsb2NrIDEgYW5kIDIgYWJvdmUsIHRoZW4gSSBiZWxp ZXZlIHdlIGhhdmUgdG8gZXN0YWJsaXNoIGFuIGV2ZW50IHJlZ2lzdHJ5IHRvIGVuc3VyZSBuZXcg RXZlbnQgcHJvZmlsZXMgZG8gbm90IG92ZXJsYXAgdG8gZWxpbWluYXRlIHRoZSBuZWVkIHRvIGV4 cHJlc3MgbXVsdGlwbGUgZXZlbnRzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdSeKAmW0gbm90IHN1cmUgd2hh dCB5b3UgbWVhbiBieSB0aGlzLiBBcmUgeW91IHJlZmVycmluZyB0byBldmVudCBuYW1lcz8gVGhv c2UgYXJlIGFscmVhZHkgZGVmaW5lZCBieSB0aGUgc3BlYyB0byBiZSBVUklzLlsvcmljaGFubmFd PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPlBo aWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3Vk IFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPkBp bmRlcGVuZGVudGlkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5p bmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQ Wmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlx UGtBSTFhTGNMTjRLWk5BJmFtcDttPVUtYTVIQk5EMEhhVFg0YW5OWmZ6WDdwRHNmSzVmMGg5bVo5 Q1pra0dpZWMmYW1wO3M9S0J3S1BGbnFZX1E5NUNUQV9fV0dDWUdUeHJEN0FHQ3h1ZW9QWG5LRVVU MCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj53d3cu aW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50 QG9yYWNsZS5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+T24gT2N0IDI5LCAyMDE3LCBhdCA0OjEyIFBNLCBE aWNrIEhhcmR0ICZsdDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrLmhhcmR0QGdtYWlsLmNv bTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+UGhp bDo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5JbiB5b3VyIGV4YW1wbGVzIGZvciBoYXZpbmcgYSBwbHVyYWxpdHkgb2YgZXZlbnRz LCB5b3UgdXNlIHRoZSB3b3JkICZxdW90O21heSZxdW90Oywgd2hpY2ggbGVhZHMgbWUgdG8gcXVl c3Rpb24gaWYgYSBwbHVyYWxpdHkgb2YgZXZlbnRzIGlzIHJlYWxseSByZXF1aXJlZA0KIGluIFNF VC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWYiPllvdSBwb3NpdCB0aGF0IGl0IHdpbGwgYmUgZGlmZmljdWx0IGZvciBh IGRpc3RyaWJ1dGVkIHN5c3RlbSB0byBjb3JyZWxhdGUgbXVsdGlwbGUgU0VUcyB3aXRoIHRoZSBz YW1lICZxdW90O3R4biZxdW90OywgYnV0IHRoZSBkaXN0cmlidXRlZCBzeXN0ZW0gd2lsbCBjZXJ0 YWlubHkNCiBuZWVkIHRvIGNvcnJlbGF0ZSBldmVudHMgb24gdGhlIHNhbWUgc3ViamVjdCAtLSBj b3JyZWxhdGluZyBldmVudHMgb24gdGhlIHNhbWUgJnF1b3Q7dHhuJnF1b3Q7IG9uIHRoZSBzYW1l IHN1YmplY3Qgc2VlbXMgZmFpcmx5IHNpbXBsZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFj a2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgdGhpbmsgdGhhdCBh IHJlY2VpdmVyIHdpbGwgbmVlZCB0byBjb3JyZWxhdGUgbXVsdGlwbGUgU0V0cyBvbiB0aGUgc2Ft ZSBzdWJqZWN0LCBzbyBoYXZpbmcgbXVsdGlwbGUgZXZlbnRzIGluIGEgU0VUIGlzIHJlZHVuZGFu dCwgYW5kIGFkZHMgY29tcGxleGl0eQ0KIHdpdGggbm8gY2xlYXIgYmVuZWZpdCB0aGF0IEkgY2Fu IHNlZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPkFuIGltcGxlbWVudG9yIG1heSBjaG9vc2UgdG8gc2VuZCBtdWx0 aXBsZSBTRVRzLCBvciBzZW5kIGEgc2luZ2xlIFNFVCB3aXRoIG11bHRpcGxlIGV2ZW50cywgc28g YSByZWNlaXZlciB3aWxsIG5lZWQgdG8gc3VwcG9ydCBib3RoLiBJIHByZWZlciB3ZSBwaWNrDQog b25lIHdheSBhbmQgbWluaW1pemUgdGhlIGNvZGUgcGF0aHMsIGFuZCB3ZSB3aWxsIG5lZWQgdG8g c3VwcG9ydCBjb3JyZWxhdGluZyBhY3Jvc3MgbXVsdGlwbGUgU0VUcywgc28gdGhhdCBzZWVtcyB0 aGUgYmVzdCBtZWNoYW5pc20uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hp dGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5MZXQgbWUga25vdyBpZiB0aGVyZSBpcyBz b21ldGhpbmcgSSBtaXNzZWQgaW4gbXkgbG9naWMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJh Y2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4vRGljazwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWYiPk9uIFN1biwgT2N0IDI5LCAyMDE3IGF0IDExOjI4IEFNLCBZYXJvbiBT aGVmZmVyPHNwYW4gY2xhc3M9Im00MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5j b20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj55YXJvbmYuaWV0 ZkBnbWFpbC5jb208L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0ibTQwMjYyMzY0NTYwODAzNDk2 NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj53cm90ZTo8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiB0aGF0IGNhc2UsIGxldCdzIGFkZCB0ZXh0IHRv IHRoYXQgZWZmZWN0LCBlLmcuIHdlIGNvdWxkIGFkZCB0byB0aGUgZGVmaW5pdGlvbiBvZiB0aGUg JnF1b3Q7ZXZlbnRzJnF1b3Q7IGNsYWltOjxicj4NCjxicj4NClByb2ZpbGluZyBzcGVjaWZpY2F0 aW9ucyBTSE9VTEQgZGVmaW5lIHRoZSBhbGxvd2VkIGV2ZW50IHN0YXRlbWVudHMsIGFuZCBNQVkg cmVzdHJpY3QgdGhlaXIgbnVtYmVyLiBGb3IgZXhhbXBsZSwgc29tZSBwcm9maWxlcyBtYXkgcmVx dWlyZSB0aGlzIGNsYWltIHRvIGNvbnRhaW4gb25seSBhIHNpbmdsZSBldmVudCBzdGF0ZW1lbnQu PGJyPg0KPGJyPg0KVGhhbmtzLDxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzxzcGFu IGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPllhcm9uPGJyPg0KPGJyPg0KT24gMjQvMTAvMTcgMjI6MTAsIE1pa2UgSm9uZXMgd3Jv dGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0 OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5J IGFncmVlIHdpdGggbXVjaCBvZiBQaGls4oCZcyByYXRpb25hbGUgaGVyZS48YnI+DQo8YnI+DQpJ dOKAmXMgZmluZSBmb3Igc29tZSBwcm9maWxlcyB0byBzYXkgdGhhdCB0aGUg4oCcZXZlbnRz4oCd IHNldCBtdXN0IGJlIGEgc2luZ2xldG9uLiZuYnNwOyBUaGF0IGRvZXNu4oCZdCBoYXZlIHRvIGJl IHRydWUgZm9yIGFsbCBldmVudHMuJm5ic3A7IEkgdGhpbmsgdGhpbmdzIGFyZSBmaW5lIGFzLWlz Ljxicj4NCjxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxz cGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPi0tIE1pa2U8YnI+DQo8YnI+DQoqRnJvbToqIElkLWV2ZW50IFttYWlsdG86PGEg aHJlZj0ibWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5pZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPC9zcGFu PjwvYT5dICpPbiBCZWhhbGYgT2YgKlBoaWwgSHVudDxicj4NCipTZW50OiogTW9uZGF5LCBPY3Rv YmVyIDIzLCAyMDE3IDg6NDcgUE08YnI+DQoqVG86KiBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxs ZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5yaWNoYW5uYUBhbWF6b24uY29tPC9zcGFuPjwv YT4mZ3Q7PGJyPg0KKkNjOiogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFp bHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+aWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8YnI+DQoqU3ViamVjdDoq IFJlOiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/PGJy Pg0KPGJyPg0KQW5uYWJlbGxlLDxicj4NCjxicj4NCkkgaGF2ZSBhIG51bWJlciBvZiBjb25jZXJu cyB3aXRoIHRoaXMgcHJvcG9zYWwuPGJyPg0KPGJyPg0KUHJvZmlsaW5nIEluZGVwZW5kZW5jZSAv IEtlZXBpbmcgRXZlbnQgUGF5bG9hZHMgSW5kZXBlbmRlbnQ8YnI+DQo8YnI+DQpJbmRpY2F0aW5n IHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFuZGxlZCBieSBwcm9maWxlcyBsZWFkcyB0byBt b3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBhbmQgbW9yZSBpbXBvcnRhbnRseSBpbnRydWRl cyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBieSBzdWdnZXN0aW5nIGEgc3ViLXNjaGVtYSBj cmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBhbmQgY29uZmxpY3RzIHRoYXQgbWF5IGFkZCB0 byBjb21wbGV4aXR5IGxhdGVyDQogb24uIFRoZSBjdXJyZW50IGZvcm1hdCBhbGxvd3MgYSBwYXJz ZXIgdG8gZGlzY292ZXIgYW5kIHVubG9hZCBvbmUgb3IgbW9yZSBKU09OIHBheWxvYWRzIHdoaWNo IGNhbiBlYWNoIGhhdmUgaW5kZXBlbmRlbnQgc3RydWN0dXJlLjxicj4NCjxicj4NCkdlbmVyYWwg ZXh0ZW5zaW9uczxicj4NCjxicj4NClRoZSBwcm9wb3NhbCBhbHNvIHJ1bGVzIG91dCBnZW5lcmFs IHB1cnBvc2UgZXh0ZW5zaW9ucyBub3QgcmVsYXRlZCB0byBhbnkgc3BlY2lmaWMgZXZlbnQuIEdp dmVuIHRoZSBlbWVyZ2VuY2Ugb2YgaXRlbXMgbGlrZSBHUFJELCBJIHdvdWxkIG5vdCB3YW50IHRv IGJsb2NrIHRoZSBhYmlsaXR5IHRvIGFkZCBtZXRhLWRhdGEgb3Igb3RoZXIgZ2VuZXJhbCBwdXJw b3NlIGl0ZW1zLiBXZSBjYW4gYWxzbyBhbnRpY2lwYXRlIHNvbWUgZGVsaXZlcnkgc2NlbmFyaW9z DQogd2hlcmUgYWRkaXRpb25hbCBkYXRhIG1pZ2h0IGJlIHJlcXVpcmVkLiBFdmVuIHRob3VnaCB0 aGVyZSBpcyBubyBjdXJyZW50IHBsYW5uZWQgdXNlLCBJIHNlZSBubyBnb29kIHJlYXNvbiB0byBy dWxlIHRoaXMgb3V0Ljxicj4NCjxicj4NCk11bHRpcGxlIEV2ZW50cyBGcm9tIERpZmZlcmVudCBG YW1pbGllcyAodnMuIE11bHRpcGxlIEV2ZW50cyBmcm9tIGEgc2luZ2xlIGZhbWlseSBsaWtlIFJJ U0MpPGJyPg0KPGJyPg0KSW4gb3VyIFJJU0Mgc2Vzc2lvbiB3ZSBkaXNjdXNzZWQgZXhwcmVzc2lu ZyBtdWx0aXBsZSBkaXN0aW5jdCBSSVNDIGV2ZW50cyBpbiBvbmUgU0VULiBUaGUgZGlzY3Vzc2lv biB3YXMgdGhhdCBvbmx5IG9uZSBSSVNDIGV2ZW50IGF0IGEgdGltZS4gV2UgZGlkIG5vdCBkaXNj dXNzIG90aGVyIGV2ZW50IHByb2ZpbGVzLiBJIGRvbuKAmXQgc2VlIGEgcmVhc29uIHRvIHJ1bGUg b3V0IG11bHRpLWV2ZW50cyBmcm9tIGRpZmZlcmVudCBmYW1pbGllcyBhdCB0aGUNCiBTRVQgbGV2 ZWwuIEVhY2ggcHJvZmlsZSBpcyBleHByZXNzaW5nIHNsaWdodGx5IGRpZmZlcmVudCB0aGluZ3Mg YWJvdXQgdGhlIHNhbWUgZXZlbnQuPGJyPg0KPGJyPg0KSSBjYW4gZm9yc2VlIHNvbWUgY2FzZXMg d2hlcmUgaXQgaXMgbm90IGNsZWFyIHdoaWNoIGlzIHRoZSBwcmltYXJ5IGFuZCB3aGljaCBpcyB0 aGUgZXh0ZW5zaW9uLiZuYnNwOyBUaGVyZSBtYXkgbm90IGJlIGEgY2xlYXIgd2lubmVyLjxicj4N Cjxicj4NCkEgY291cGxlIG9mIGV4YW1wbGVzICh0aGVzZSBhcmUgbmVjZXNzYXJpbHkgcmVhbOKA pmp1c3QgcG9zc2liaWxpdGllcyk6PGJyPg0KPGJyPg0KKiBJdCBpcyBwcm9iYWJseSB1c2VmdWwg dG8gYmUgYWJsZSB0byBleHByZXNzIHNpbWxhci9vdmVybGFwcGluZyBldmVudHMgZnJvbSBkaWZm ZXJlbnQgU0VUIHByb2ZpbGVzIGluIG9uZSBTRVQuJm5ic3A7IEZvciBleGFtcGxlIGEgQmFja2No YW5uZWwgTG9nb3V0ICZhbXA7IGEgUklTQyBzZXNzaW9uIGNhbmNlbCBldmVudC48YnI+DQo8YnI+ DQoqIFNDSU0gbWF5IHdhbnQgdG8gcmVwcmVzZW50IGEgc2luZ2xlIHRyYW5zYWN0aW9uIGFzIGNh dXNpbmcgbXVsdGlwbGUgc3RhdGUgY2hhbmdlcyBpbiBhbiBldmVudCAoZS5nLiBhIHBhc3N3b3Jk IGNoYW5nZSBjYXVzZXMgbXVsdGlwbGUgZWZmZWN0cykuIEhhdmluZyB0byBjaGFzZSBkb3duIG11 bHRpcGxlIGV2ZW50cyBhbmQgY29ycmVsYXRlIGJ5IOKAnHR4buKAnSB3b3VsZCBiZSBjaGFsbGVu Z2luZyBpbiBhIG11bHRpLXRocmVhZGVkL211bHRpLW5vZGUNCiBkZWxpdmVyeSBzeXN0ZW0uJm5i c3A7ICZuYnNwO1RoZSBTQ0lNIGxpc3QgaGFzIG5vdCBkaXNjdXNzZWQgdGhpcywgYnV0IEkgd291 bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhpcyBjYXBhYmlsaXR5LiZuYnNwOyBJT1cgLSBKdXN0IGJl Y2F1c2UgUklTQyBkb2VzIG5vdCB3YW50IHRvIGV4cHJlc3MgbXVsdGlwbGUgZXZlbnRzIGRvZXMg bm90IG1ha2UgdGhpcyB0cnVlIGZvciBvdGhlciBwcm9maWxlcy48YnI+DQo8YnI+DQoqIFdlIG1h eSB3aXNoIHRvIGluZGljYXRlIGEgU0NJTSBQYXNzd29yZCBSZXNldCB3YXMgcGVyZm9ybWVkIGFu ZCBhIExvZ291dC9zZXNzaW9uIGNhbmNlbGxhdGlvbiBpcyBleHByZXNzZWQgYXQgdGhlIHNhbWUg dGltZS4mbmJzcDsgVGhlIGV2ZW50cyBhcmUgcmVsYXRlZCBidXQgZXhwcmVzcyBkaWZmZXJlbnQg ZGF0YS48YnI+DQo8YnI+DQpBdm9pZGluZyBDb25mdXNpb24gRnJvbSBTaW1pbGFyIEV2ZW50cyBP cmlnaW5hdGluZyBmcm9tIHRoZSBTYW1lIFRyYW5zYWN0aW9uPGJyPg0KPGJyPg0KSWYgZXZlbnRz IGFyZSBzZW50IHNlcGFyYXRlbHksIHRoZW4gbW9yZSB0cmFja2luZyBvZiBzdGF0ZSAoZS5nLiBi eSB0eG4pIHdvdWxkIGJlIHJlcXVpcmVkIHRvIGVuc3VyZSBzaW1pbGFyIGV2ZW50cyBhcmUgbm90 IG1pc3Rha2VuIG9yIGhhbmRsZWQgYXMgcmVwZWF0cy4gV2hpbGUgdHhuIHByb3ZpZGVzIHVzZWZ1 bCBhdWRpdCBhbmFseXNpcyBjYXBhYmlsaXR5LCBJ4oCZbSBub3Qgc3VyZSBpdCBjYW4gYmUgdXNl ZCBpbiBsaXZlIG9yIG5lYXItcmVhbA0KIHRpbWUgc3lzdGVtcyBnaXZlbiBkaXN0cmlidXRlZCBt dWx0aS1ub2RlLCBtdWx0aS10aHJlYWRpbmcgYXJjaGl0ZWN0dXJlcy48YnI+DQo8YnI+DQpQcmV2 aW91cyBEaXNjdXNzaW9uPGJyPg0KPGJyPg0KSSBub3RlIHRoYXQgSSBvcmlnaW5hbGx5IHJhaXNl ZCBoYXZpbmcgYW4gYXR0cmlidXRlIHRvIGRlc2lnbmF0ZSBwcmltYXJ5IGV2ZW50IGF0dHJpYnV0 ZSB0byBhbGxldmlhdGUgeW91ciBjb25jZXJuLCBidXQgdGhpcyB3YXMgbm90IGFjY2VwdGVkLiBT ZWU6PGJyPg0KPGJyPg0KKjxzcGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWwtMkRhcmNo aXZlX3dlYl9pZC0yRGV2ZW50X2N1cnJlbnRfbXNnMDA0MDYuaHRtbCZhbXA7ZD1Ed01GYVEmYW1w O2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVG VnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampo Y0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9UzNzTVZpcU12RWdud0diSndP UU55Y3JPeXI3U2VmcHFfTW9GT0tjRWVDRSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2Vi L2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYuaHRtbDwvc3Bhbj48L2E+PGJyPg0KPGJyPg0KKjxz cGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2ZW50 X2N1cnJlbnRfbXNnMDAxNDAuaHRtbCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5 WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1 aWI5S0FUa1JsUUcxaXcmYW1wO3M9R3k5Z3lSb0lJdGEtY1NoVjdiTjE2MWF5NHlFNnI5RzFfQWFf TmVCbnlsZyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQv bXNnMDAxNDAuaHRtbDwvc3Bhbj48L2E+PGJyPg0KPGJyPg0KVGhlIGNvbnNlbnN1cywgYXQgbGVh c3QgYXMgSSBpbnRlcnByZXRlZCBpdCBpcyB1cCB0byB0aGUgcmVjZWl2ZXIgdG8gZmlndXJlIHRo aXMgb3V0IGJhc2VkIG9uIHRoZSBkZWZpbml0aW9ucyBpdCBoYXMgZm9yIGVhY2ggZXZlbnQgVVJJ IGFuZCB0aGUgcHJvZmlsZXMgdGhleSByZXByZXNlbnQuIElPVyAtIFJJU0MgaXMgZnJlZSB0byBs aW1pdCB0aGF0IG9ubHkgb25lIFJJU0MgZXZlbnQgYmUgZXhwcmVzc2VkIGF0IGEgdGltZS48YnI+ DQo8YnI+DQpQaGlsPGJyPg0KPGJyPg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91 ZCBTZXJ2aWNlcyBBcmNoaXRlY3Q8YnI+DQo8YnI+DQpAaW5kZXBlbmRlbnRpZDxicj4NCjxicj4N CjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw LTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENn YVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTRE cGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1 eHVydWliOUtBVGtSbFFHMWl3JmFtcDtzPTlOUDVuYW1nNnJJVnp3dW45Yy0xcTB3aHN5WHdTdnRI QjBmMmRLa2ZDWDgmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0ibTQwMjYy MzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEg aHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0Ff X3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5 WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1 aWI5S0FUa1JsUUcxaXcmYW1wO3M9OU5QNW5hbWc2cklWend1bjljLTFxMHdoc3lYd1N2dEhCMGYy ZEtrZkNYOCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij5odHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGJyPg0K PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNw YW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPjxz cGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPiZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9y YWNsZS5jb208L3NwYW4+PC9hPiZndDs8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7IE9uIE9jdCAy MywgMjAxNywgYXQgNzowMiBQTSwgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGU8YnI+DQombmJz cDsgJm5ic3A7ICZsdDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJpY2hhbm5hQGFtYXpvbi5jb208 L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRl ZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5h QGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5y aWNoYW5uYUBhbWF6b24uY29tPC9zcGFuPjwvYT4mZ3Q7Jmd0Ow0KIHdyb3RlOjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDsgVGhlIGN1cnJlbnQgZHJhZnQgb2YgdGhlIFNFVCBzcGVjIGFsbG93cyBm b3IgZXhwcmVzc2luZyBtdWx0aXBsZTxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnRzIHdpdGhpbiB0 aGUgc2FtZSB0b2tlbiwgd2hpY2ggaW50cm9kdWNlcyBhZGRpdGlvbmFsIGNvbXBsZXhpdHk8YnI+ DQombmJzcDsgJm5ic3A7IGFuZCByb29tIGZvciBhbWJpZ3VvdXMgc2VtYW50aWNzLiBXZeKAmXZl IGRpc2N1c3NlZCB0aGlzIGluIHRoZSBPSURGPGJyPg0KJm5ic3A7ICZuYnNwOyBSSVNDIHdvcmtp bmcgZ3JvdXAgYW5kIHRoZSBjdXJyZW50IGNvbnNlbnN1cyB0aGVyZSBpcyB0aGF0IFJJU0Mgd2ls bDxicj4NCiZuYnNwOyAmbmJzcDsgcmVxdWlyZSB0aGF0IFJJU0MgZXZlbnRzIG11c3QgYmUgdGhl IG9ubHkgZXZlbnQgaW4gdGhlIFNFVCwgaGF2aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyBpZGVudGlm aWVkIHdheXMgdG8gY2xlYXJseSBhbmQgZWFzaWx5IHN1cHBvcnQgdGhlIGhhbmRmdWwgb2YgdXNl PGJyPg0KJm5ic3A7ICZuYnNwOyBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciB0b2tlbiB0 aGF0IHBlb3BsZSBoYXZlIHJhaXNlZC4gV2l0aDxicj4NCiZuYnNwOyAmbmJzcDsgdGhhdCBjb250 ZXh0IGluIG1pbmQsIEkgcHJvcG9zZSBzdHJpa2luZyB0aGUgZGVmaW5pdGlvbiBvZiB0aGU8YnI+ DQombmJzcDsgJm5ic3A7IOKAnGV2ZW50c+KAnSBjbGFpbSBmcm9tIHRoZSBTZWN1cml0eSBFdmVu dCBUb2tlbiBzcGVjLCBhbmQgcmVwbGFjaW5nIGl0PGJyPg0KJm5ic3A7ICZuYnNwOyB3aXRoIHRo ZSBmb2xsb3dpbmcgZGVmaW5pdGlvbiBmb3IgYW4g4oCcZXZlbnTigJ0gY2xhaW0gKHNpbmd1bGFy KTo8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7IGV2ZW50PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw OyBBIEpTT04gb2JqZWN0IGNvbnRhaW5pbmcgYW4gJnF1b3Q7ZXZlbnRfdHlwZSZxdW90OyBtZW1i ZXIgd2hvc2UgdmFsdWUgaXMgYSBVUkk8YnI+DQombmJzcDsgJm5ic3A7IHJlcHJlc2VudGluZyBh IHR5cGUgb2YgZXZlbnQgZGVmaW5lZCBpbiBhIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLjxicj4N CiZuYnNwOyAmbmJzcDsgVGhlIG9iamVjdCBNQVkgb3RoZXJ3aXNlIGJlIGVtcHR5LCBvciBNQVkg Y29udGFpbiBhZGRpdGlvbmFsIG1lbWJlcnM8YnI+DQombmJzcDsgJm5ic3A7IGFzIGRlc2NyaWJl ZCBieSB0aGUgUHJvZmlsaW5nIFNwZWNpZmljYXRpb24uPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw OyBIZXJlIGlzIHRoZSBleGFtcGxlIFNFVCBmcm9tIHNlY3Rpb24gMi4zLCByZXdyaXR0ZW4gd2l0 aCB0aGlzIGNoYW5nZTxicj4NCiZuYnNwOyAmbmJzcDsgbWluZDo8YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7PHNwYW4gY2xhc3M9Im00MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+ezxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7 ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7NGQzNTU5ZWM2NzUwNGFhYmE2NWQ0MGIwMzYzZmFhZDgm cXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1 b3Q7OiAxNDU4NDk2NDA0LDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7JnF1 b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vIiB0 YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9zY2ltLmV4 YW1wbGUuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0ibTQwMjYyMzY0NTYwODAzNDk2NDRhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0iaHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS88L3NwYW4+PC9hPiZndDsmcXVvdDssPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7JnF1b3Q7PGEgaHJlZj0i aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQi IHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3NjaW0u ZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvc3Bhbj48L2E+JnF1 b3Q7LDxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZx dW90OzxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQw ODY0MWQ3Njc2ZWU3IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8 L3NwYW4+PC9hPiZxdW90Ozxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7IF0s PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6 IHs8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDtldmVudF90eXBlJnF1b3Q7OiAmcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpjcmVh dGUmcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJnF1b3Q7cmVmJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5j b20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2 MTQyZGY5NmJkNmFiNjFlNzUyMWQ5PC9zcGFuPjwvYT4mcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXR0cmlidXRlcyZxdW90Ozog WyZxdW90O2lkJnF1b3Q7LCAmcXVvdDtuYW1lJnF1b3Q7LCAmcXVvdDt1c2VyTmFtZSZxdW90Oywg JnF1b3Q7cGFzc3dvcmQmcXVvdDssICZxdW90O2VtYWlscyZxdW90O108YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7ICZuYnNwOyZuYnNwOyB9PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyB9PGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwOyBEb2VzIGFueW9uZSBpbiB0aGUgd29ya2luZyBncm91cCBoYXZl IHVzZSBjYXNlcyBmb3IgU0VUcyB0aGF0IGNhbm5vdDxicj4NCiZuYnNwOyAmbmJzcDsgYmUgbWV0 IGJ5IHRoaXMgcHJvcG9zZWQgdGV4dD8gV2l0aGluIFJJU0MsIHdlIGlkZW50aWZpZWQgdGhyZWUg dXNlPGJyPg0KJm5ic3A7ICZuYnNwOyBjYXNlcywgd2l0aCBzb2x1dGlvbnMgb3V0bGluZWQgYmVs b3c6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAqKjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsg KkV4dGVuc2lvbnMqPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBFdmVudCBleHRlbnNpb24gbWVj aGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0aGUgZXZlbnQ8YnI+DQombmJzcDsg Jm5ic3A7IG9iamVjdC4gQSBzaW1wbGUgYXBwcm9hY2ggd291bGQgYmUgdG8gJm5ic3A7ZGVmaW5l IGFuIOKAnGV4dGVuc2lvbnPigJ0gbWVtYmVyPGJyPg0KJm5ic3A7ICZuYnNwOyB0aGF0IGlzIGEg bGlzdCBvZiBldmVudCBvYmplY3RzIChvciBzZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCd PGJyPg0KJm5ic3A7ICZuYnNwOyBjbGFpbSBhcyBkZWZpbmVkIGluIHRoZSBjdXJyZW50IHNwZWMp LiBUaGlzIGhhcyB0aGUgYWR2YW50YWdlIG9mPGJyPg0KJm5ic3A7ICZuYnNwOyBtYWtpbmcgaXQg Y2xlYXIgaW4gdGhlIGRhdGEgc3RydWN0dXJlIHRoYXQgdGhlcmUgaXMgYSBzaW5nbGUgcHJpbWFy eTxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lvbnMu IFRoZXJlIGlzIG5vIHJvb20gZm9yIGNvbmZ1c2lvbjxicj4NCiZuYnNwOyAmbmJzcDsgb3ZlciB3 aGljaCBldmVudCBpcyBwcmltYXJ5LCBvciBpZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQgYXQg YWxsLjxicj4NCiZuYnNwOyAmbmJzcDsgSSB3b3VsZCBiZSBmaW5lIHdpdGggYWRkaW5nIHNvbWV0 aGluZyBsaWtlIHRoaXMgdG8gbXkgcHJvcG9zZWQgdGV4dCw8YnI+DQombmJzcDsgJm5ic3A7IGlm IHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkgdXNlZnVsLjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDsgKkFsaWFzZXMqPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBUaGlzIHVz ZSBjYXNlIHdhcyBicm91Z2h0IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRz PGJyPg0KJm5ic3A7ICZuYnNwOyBmcm9tIGRyYWZ0IGV2ZW50IG5hbWVzIHRvIHN0YW5kYXJkaXpl ZCBldmVudCBuYW1lcy4gSW4gdGhpcyBjYXNlLDxicj4NCiZuYnNwOyAmbmJzcDsgdGhlIGV2ZW50 IHRyYW5zbWl0dGVyIGNhbiB0cmFuc21pdCB0d28gdG9rZW5zIGZvciB0aGUgbG9naWNhbCBldmVu dCw8YnI+DQombmJzcDsgJm5ic3A7IG9uZSB1c2luZyB0aGUgb2xkIG5hbWUgYW5kIGFub3RoZXIg dXNpbmcgdGhlIG5ldyBuYW1lLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgKlJlbGF0ZWQgRXZl bnRzKjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgVGhlIFNFVCBzcGVjIGRlZmluZXMgdGhlIHR4 biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJlbGF0aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyBpbmRl cGVuZGVudCB0b2tlbnMgdGhhdCByZWxhdGUgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC48YnI+ DQo8YnI+DQombmJzcDsgJm5ic3A7IC0tPHNwYW4gY2xhc3M9Im00MDI2MjM2NDU2MDgwMzQ5NjQ0 YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KJm5ic3A7ICZuYnNwOyBB bm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBBbWF6b24g 4oCTIElkZW50aXR5IFNlcnZpY2VzPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBfX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCiZuYnNwOyAmbmJzcDsg SWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KJm5ic3A7ICZuYnNwOzxzcGFuIGNsYXNzPSJtNDAy NjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhy ZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0i bTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4m bHQ7bWFpbHRvOjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwv YT4mZ3Q7PGJyPg0KJm5ic3A7ICZuYnNwOzxzcGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0OTY0 NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21h aWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRT ZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXM1YnlCZTVLQU5uR1Z1QWIxbUF1cEVHb0pu OFhHNUpJVVV3V0dGU2liRWMmYW1wO3M9WDhvUlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZk NGVFWmZneW9JWSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVy cGxlIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFt cDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJt NWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1zNWJ5QmU1S0FO bkdWdUFiMW1BdXBFR29KbjhYRzVKSVVVd1dHRlNpYkVjJmFtcDtzPVg4b1JTcTNJemxGN2ppUkFl WmhYcFIzZVZJMEk1OFpGZDRlRVpmZ3lvSVkmYW1wO2U9PC9zcGFuPjwvYT48YnI+DQo8YnI+DQo8 YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVu dEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklk LWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQ cHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWli OUtBVGtSbFFHMWl3JmFtcDtzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZL MDJFWHMmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvc3Bhbj48L2E+ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+ DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklk LWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9y ZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGll dGYub3JnPC9zcGFuPjwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZv X2lkLTJEZXZlbnQmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2 N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkx YUxjTE40S1pOQSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFH MWl3JmFtcDtzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZLMDJFWHMmYW1w O2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDwvc3Bhbj48L2E+PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndo aXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5k OndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4tLTxzcGFuIGNsYXNzPSJtNDAyNjIzNjQ1NjA4MDM0 OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5TdWJzY3JpYmUgdG8gdGhlPHNwYW4gY2xhc3M9Im00MDI2MjM2NDU2MDgw MzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0iaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2hhcmR0d2FyZS5j b21fJmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2 NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEta TkEmYW1wO209WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7 cz1MWU43MkdnS1ZoSHNUNnRBcUJlLWVNb1dNdnlfN2RmRm4xdVowSEs2WXVRJmFtcDtlPSIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPkhBUkRUV0FSRTwvc3Bhbj48 L2E+PHNwYW4gY2xhc3M9Im00MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+bWFpbA0KIGxpc3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBhbSB3 b3JraW5nIG9uITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZl bnQgbWFpbGluZyBsaXN0PGJyPg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5JZC1l dmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPC9zcGFuPjxh IGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcm YW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1u YTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzlt ampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9V3JNdVFSd0xWODAyaU1R NHdZQjFmMnJGVUd1NHpiaGNXMDAxZkswMkVYcyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0y RGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJN VUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xO NEtaTkEmYW1wO209WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZh bXA7cz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmFtcDtlPTwv c3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImJhY2tncm91bmQ6d2hp dGUiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtiYWNrZ3JvdW5kOndoaXRlIj5fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj48YnI+DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+SWQtZXZlbnQgbWFp bGluZyBsaXN0PC9zcGFuPjxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZTtiYWNr Z3JvdW5kOndoaXRlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdf bWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0 RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209VS1hNUhCTkQwSGFUWDRhbk5aZnpYN3BE c2ZLNWYwaDltWjlDWmtrR2llYyZhbXA7cz1ydmRydEk3cllOUkFucVpEbHRDd0JBWlZIS3AtTUoy MHVpMm5tNDZRU3owJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6cHVycGxlO2JhY2tncm91bmQ6d2hpdGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUly TVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNM TjRLWk5BJmFtcDttPVUtYTVIQk5EMEhhVFg0YW5OWmZ6WDdwRHNmSzVmMGg5bVo5Q1pra0dpZWMm YW1wO3M9cnZkcnRJN3JZTlJBbnFaRGx0Q3dCQVpWSEtwLU1KMjB1aTJubTQ2UVN6MCZhbXA7ZT08 L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJy IGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0t IDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U3Vic2NyaWJlIHRvIHRoZSA8YSBocmVmPSJodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9faGFyZHR3YXJlLmNv bV8mYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1 ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pO QSZhbXA7bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JmFtcDtz PXd0Z0QzTnAwdnloTGRwRXdVaXFzZjRJdGl3QTNPbTdHcm9iNzBMeDByM2smYW1wO2U9IiB0YXJn ZXQ9Il9ibGFuayI+DQpIQVJEVFdBUkU8L2E+IG1haWwgbGlzdCB0byBsZWFybiBhYm91dCBwcm9q ZWN0cyBJIGFtIHdvcmtpbmcgb24hPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8 YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3JnPC9hPjxi cj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1E d0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZh bXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5 Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9T2UwcWZMRVg4 M3Z0WE03V2wyY1lCZS1HZzFEVlBqaFhqVkprZmhWUnp3YyZhbXA7ZT0iPmh0dHBzOi8vdXJsZGVm ZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxt YW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5 WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxL Njd5Rl84dThfcVNDX3cmYW1wO3M9T2UwcWZMRVg4M3Z0WE03V2wyY1lCZS1HZzFEVlBqaFhqVkpr ZmhWUnp3YyZhbXA7ZT08L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504620D605B64EF1ACF1496F55E0CY4PR21MB0504namp_-- From nobody Tue Oct 31 21:22:29 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC12913F966 for ; Tue, 31 Oct 2017 21:22:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H4Oysb0PBBMY for ; Tue, 31 Oct 2017 21:22:24 -0700 (PDT) Received: from mail-pf0-x22a.google.com (mail-pf0-x22a.google.com [IPv6:2607:f8b0:400e:c00::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1806613F954 for ; Tue, 31 Oct 2017 21:22:24 -0700 (PDT) Received: by mail-pf0-x22a.google.com with SMTP id p87so989393pfj.3 for ; Tue, 31 Oct 2017 21:22:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=8bL5Y/XFornyhqJfvU5hIBEv44W6XOa4bObjViFtqUI=; b=ckoDFlO89wmPdhZlBMj0uxJqTEKbmWc/pxbkgpXL+a+ACxzfR36Jqn92cH7t8kriJA FCwbGT821Cbn1uyhCzTMF+4JAfYU4PNZdHMB/EzHpJ4DOGltzhRUJh9HwzYt1uzQQUL0 JMOIj4jBffDSZKUdhBFG1Yf6aWLdDJQfT5eElykaS2d+Njkr/YDoXV2Q2WQcRHZJQJOi ysNFqHc8LsSftHoJ8vo71eeNdOlZkeWdPXtFkOTBHsPL5l9IW5U+m/vefT+49NAx4MF9 PybwTnGI4cIrK0pERoWx/p9uuhr6UHSLUhLd8kRFbWLYIJorfthfs6QmQIi09SS6Ew5C cr8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=8bL5Y/XFornyhqJfvU5hIBEv44W6XOa4bObjViFtqUI=; b=I3E2Pz6t6j0WcZOiMyp9R46jH96U0MTvV2aFxUFk+eHizKJ+Ll0iwERVPJhzr5hV+y txJkwelnhy42PSYtMQNQFLrSW7FlgO/XIQXnArsEVGuDt/S0kbLgNdcoH+Bd1CFCghE0 e1/G20bn+WWIr8233Z5Q4sw5H/6EXyCg4vZsJUndFWT2yQPNprDQANK+f6d/n75kBaw5 iKq2c4BzOmp4zAAJbm8EY4i6WxpGkjKGzKweHKeUkO1012UM2fehOWuW6kD21jdv+yjW jVmPfy5e+G0yP4dLEnbP4qZCGfy5Tmo1q5d7COAEBCYomJC2Fco3RjiJJ1WHOIwX0a2F vUDQ== X-Gm-Message-State: AMCzsaVOMcrBZCsfo/3zfef+ttOS5Vq3QYg293eJ/zWiFmKOOYjQ0A54 hLo37VG19O/gzQoMAZJBBBtDgOQtZO9qDk6MEyQ= X-Google-Smtp-Source: ABhQp+TOOGNqpeO/9e9WdS44yi64wpUK0JVw+L06zPnvt/wdoHSTi/UaykQUljEwgYXL3kNN4e+hco0EvcWbmGc1m8Q= X-Received: by 10.98.163.193 with SMTP id q62mr4909337pfl.276.1509510143375; Tue, 31 Oct 2017 21:22:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Tue, 31 Oct 2017 21:22:02 -0700 (PDT) In-Reply-To: References: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> From: Dick Hardt Date: Tue, 31 Oct 2017 21:22:02 -0700 Message-ID: To: Adam Dawes Cc: "Phil Hunt (IDM)" , Mike Jones , Annabelle Richard , SecEvent , Marius Scurtescu Content-Type: multipart/alternative; boundary="001a11405920e17ed6055ce4374d" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 04:22:27 -0000 --001a11405920e17ed6055ce4374d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Adam Thanks for raising these points. I think all of them will be covered in the agenda, but I will clarify where they will be covered. The agenda is set up for both management APIs to be presented, and then I have a slot for the WG to discuss how to proceed. I expect the issues wrt. the SET document will be addressed in the time allotted for SET, similarly for the "toe" attribute. The authorization header I would expect to be covered in the SET Delivery time slot. wrt. composite object, that also should be discussed in the SET time slot -- I think the proposal is that subjects NOT be in SET, and that each profile defines how subjects are represented. Phil: would you confirm you will be covering these topics in your slot on SET? Marius: same for the authorization header in the Delivery discussion? /Dick On Tue, Oct 31, 2017 at 12:20 AM, Adam Dawes wrote: > Thanks for sending out the agenda. > > From our perspective, there are two important issues that are blocking > implementation and I think it would be very helpful to shift the agenda a > bit so we have more time to discuss these. It would be very beneficial to > implementors if we could resolve these issues so we can finish our servic= es > and start to receive operational feedback on the specs. > > - Management API resolution. We have two approaches (Phil's > and > Marius/Annabelle's > ). > The management API is the key to being able to scale our implementatio= n and > start interop with multiple providers. Perhaps Phil and Marius/Annabel= le > can each provide a summary of their drafts and we can have try to reac= h > consensus. > - Single/multiple event per SET > This is currently being discussed on list and within RISC working > group. It would be helpful to also nail this down to free up our engin= eers > to build this right the first time instead of making a guessing and ha= ving > the community later choose differently. > > In addition, but less critically, we'd like to propose the following > topics too: > > - "toe" SET attribute > - authorization header for push delivery > - receiver configures full authorization header as static/bearer > header > - composite subject claim defined in SET > - present RISC approach as example > > > On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt wrote: > >> Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if one of >> the other authors will do the Delivery. >> >> On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) >> wrote: >> >>> Dick, >>> >>> I believe Mike won't be able to make the monday meeting. so Mike and I >>> are working on a presentation for the current state of set that I will = do. >>> >>> Not much has happened with delivery other than removing verify event >>> (because that was going in control plane). I can do that very quickly. >>> >>> I do have concerns about config on control planes and delivery streams >>> when firewalls are involved. I will include a couple of slides on this = that >>> may be important to control plane discussion. >>> >>> I can do my control plane ID draft proposal after marius/annabelle's. I= t >>> will be similar to the deck we discussed at the amazon hq f2f. >>> >>> Phil >>> >>> On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: >>> >>> Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me >>> know who is presenting what where it is xxx >>> >>> Thanks! >>> >>> Here are the documents we will be discussing: >>> >>> https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ >>> >>> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >>> >>> https://datatracker.ietf.org/doc/draft-scurtescu-secevent-ev >>> ent-stream-mgmt-api/ >>> >>> https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ >>> >>> >>> /Dick >>> >>> ----- >>> IETF 100 Singapore >>> Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 >>> >>> Agenda Setting Dick Hardt (chair) 13:30 >>> - 13:40 >>> Security Event Token (SET) xxx 13:40 >>> - 14:00 >>> SET Delivery using HTTP xxx 14:00 >>> - 14:20 >>> Chair Slides on Managment APIs Dick Hardt (chair) 14:20 >>> - 14:30 >>> Management API for SET Event Streams xxx 14:30 >>> - 14:50 >>> SET Stream Managment and Provisioning Phil Hunt 14:50 >>> - 15:10 >>> Management API Discussion Dick Hardt (chair) 15:10 >>> - 15:20 >>> AOB Dick Hardt (chair) 15:20 >>> - 15:30 >>> >>> >>> >>> >> >> >> -- >> Subscribe to the HARDTWARE mail list to learn >> about projects I am working on! >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> > > > -- > Adam Dawes | Sr. Product Manager | adawes@google.com | +1 650-214-2410 > <(650)%20214-2410> > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a11405920e17ed6055ce4374d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable     _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


    <= br clear=3D"all">

    --



    --
    Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
    --001a11405920e17ed6055ce4374d-- From nobody Tue Oct 31 21:23:33 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84E3913F980 for ; Tue, 31 Oct 2017 21:23:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.009 X-Spam-Level: X-Spam-Status: No, score=-0.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vNhHqesHTE8M for ; Tue, 31 Oct 2017 21:23:29 -0700 (PDT) Received: from mail-pf0-x22a.google.com (mail-pf0-x22a.google.com [IPv6:2607:f8b0:400e:c00::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BBBF1375C9 for ; Tue, 31 Oct 2017 21:23:23 -0700 (PDT) Received: by mail-pf0-x22a.google.com with SMTP id d28so994757pfe.2 for ; Tue, 31 Oct 2017 21:23:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=oV1p3aKtCgmzbrFC64I+b52dLD5E/r4uIkkl1gtNHb4=; b=ODO5CClnSA8Rof9iX/ovock/IX3MO3i9PPo9HrTLSI38k5KYycS5TgqlFSLwmbDS1P 6N18Pj1AFqXkLS4P0xjiLOUyGteT6tkzAJpwzasGTBMGYlG8i9UDOe+QhuXCvksJrQ9K 5qR1NxWFYeKgIZz0yryVPUaFu8m3U9UdBADpQyBFX1mXJ3wHVSKtJLCE90AIGeIENK/G ci61BoNFX5Ey16hQo6/TZjwH85vcJnoyNFGvqF0tgstU0kWutyekGSCrYDfp1lRHjPJA c0XbvgLGvgt4x2KOqJjMSvH5un6aKIwqZsNmLVbNAYnox+bmsO0ewvuScDFjsEPQV1Hl jCjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=oV1p3aKtCgmzbrFC64I+b52dLD5E/r4uIkkl1gtNHb4=; b=RKAjO0xV9G74hG5Y3K1SHOERG8hD1mVyzGGqenNzsvkLzI+xMvfMcTABrNSTgCVVRo 5ZIwt7+JAFhVkwCZ1jRluCqZ/xIjwUfmKVU77dbZQECl9M+B1T72WI/7XfzJWIVFVP8H mkK4uWcqxMWhqD5rATOxEDatc8tpyLhmnZxQNj2+IGSN4MdFiMdgGAHIkjnGzqXkdXKO KGdYgqm7Y5WHQ4JvkkXW2lOr0O+1awA3ncnMAm4swbbVfLD8YGU67pF4dWB7TgEFlUTd FbRUS2olncE12ZaOg8v/rqxfmVhXsjFTikO5OOMrwJ0iz6S20nfZu6LdrEszf/FZ0q05 mPAA== X-Gm-Message-State: AMCzsaW+VGNNReJ3fC1UESneB0zT5dh/63eVNGcR/UDHWgSi+IFwlWog RZy8ZSd354ySndo8nE28swnbZKIAWxKn2vuTxHk= X-Google-Smtp-Source: ABhQp+RTOq/3gsy7s5H5Vp3NJXBBlfMaER81t6LzZ7M9VcV2/Nf+BtMzP6sDueop13UEToKtarxRCgdn792UZKfcOgU= X-Received: by 10.98.130.65 with SMTP id w62mr4912523pfd.203.1509510202978; Tue, 31 Oct 2017 21:23:22 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Tue, 31 Oct 2017 21:23:02 -0700 (PDT) In-Reply-To: References: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> From: Dick Hardt Date: Tue, 31 Oct 2017 21:23:02 -0700 Message-ID: To: Marius Scurtescu Cc: "Phil Hunt (IDM)" , SecEvent , Mike Jones , Annabelle Richard Content-Type: multipart/alternative; boundary="94eb2c119bb86ef7cc055ce43b6f" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 04:23:31 -0000 --94eb2c119bb86ef7cc055ce43b6f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Marius. I've updated the agenda to reflect above. Also please note the authorization header discussion brought up by Adam in my previous email= . On Tue, Oct 31, 2017 at 9:21 AM, Marius Scurtescu wrote: > For https://datatracker.ietf.org/doc/draft-scurtescu- > secevent-event-stream-mgmt-api/ Annabelle and I are proposing a two part > presentation: I will present the current draft and changes since Prague, > Annabelle will then present a concrete example of profiling this manageme= nt > API spec in RISC. > > The delta on the delivery spec is relatively small, I am happy to present > that as well. > > Marius > > On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt wrote: > >> Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if one of >> the other authors will do the Delivery. >> >> On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) >> wrote: >> >>> Dick, >>> >>> I believe Mike won't be able to make the monday meeting. so Mike and I >>> are working on a presentation for the current state of set that I will = do. >>> >>> Not much has happened with delivery other than removing verify event >>> (because that was going in control plane). I can do that very quickly. >>> >>> I do have concerns about config on control planes and delivery streams >>> when firewalls are involved. I will include a couple of slides on this = that >>> may be important to control plane discussion. >>> >>> I can do my control plane ID draft proposal after marius/annabelle's. I= t >>> will be similar to the deck we discussed at the amazon hq f2f. >>> >>> Phil >>> >>> On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: >>> >>> Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let me >>> know who is presenting what where it is xxx >>> >>> Thanks! >>> >>> Here are the documents we will be discussing: >>> >>> https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ >>> >>> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >>> >>> https://datatracker.ietf.org/doc/draft-scurtescu-secevent-ev >>> ent-stream-mgmt-api/ >>> >>> https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ >>> >>> >>> /Dick >>> >>> ----- >>> IETF 100 Singapore >>> Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 >>> >>> Agenda Setting Dick Hardt (chair) 13:30 >>> - 13:40 >>> Security Event Token (SET) xxx 13:40 >>> - 14:00 >>> SET Delivery using HTTP xxx 14:00 >>> - 14:20 >>> Chair Slides on Managment APIs Dick Hardt (chair) 14:20 >>> - 14:30 >>> Management API for SET Event Streams xxx 14:30 >>> - 14:50 >>> SET Stream Managment and Provisioning Phil Hunt 14:50 >>> - 15:10 >>> Management API Discussion Dick Hardt (chair) 15:10 >>> - 15:20 >>> AOB Dick Hardt (chair) 15:20 >>> - 15:30 >>> >>> >>> >>> >> >> >> -- >> Subscribe to the HARDTWARE mail list to learn >> about projects I am working on! >> > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c119bb86ef7cc055ce43b6f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Thanks Marius. I've updated the agenda to reflect abov= e. Also please note the authorization header discussion brought up by Adam = in my previous email.

    On Tue, Oct 31, 2017 at 9:21 AM, Marius Scurtescu <mscurtesc= u@google.com> wrote:
    For=C2=A0https://datatracker= .ietf.org/doc/draft-scurtescu-secevent-event-stream-mgmt-api= / Annabelle and I are proposing a two part presentation: I will present= the current draft and changes since Prague, Annabelle will then present a = concrete example of profiling this management API spec in RISC.

    The delta on the delivery spec is relatively small, I am happy to p= resent that as well.

    Marius

    On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:
    Hey Phil, Thanks! I'll slot you= in for the SET slot. Let's see if one of the other authors will do the= Delivery.

    On Mon, Oct 30, 2017 at 2:= 32 PM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
    Dick,<= /div>

    I believe = Mike won't be able to make the monday meeting. so Mike and I are workin= g on a presentation for the current state of set that I will do.=C2=A0

    Not much has h= appened with delivery other than removing verify event (because that was go= ing in control plane). I can do that very quickly.=C2=A0

    I do have concerns about con= fig on control planes and delivery streams when firewalls are involved. I w= ill include a couple of slides on this that may be important to control pla= ne discussion.=C2=A0

    I can do my control plane ID draft proposal after marius/annabel= le's. It will be similar to the deck we discussed at the amazon hq f2f.= =C2=A0

    Phil
    =

    On Oct 30, 2017, at 2:09 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
    Here is the dra= ft agenda. Mike, Phil, Marius, Annabelle - please let me know who is presen= ting what where it is xxx

    Thanks!

    Here are the documents we will be discussing:

    =

    /Dick

    <= /div>
    -----
    IETF 100 Singapore
    Bras Basah Monday No= v 13, 2017, 13:30 - 15:30

    Agenda Setting=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:40
    Security Event Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A013:40 - 14:00=C2=A0 =C2=A0
    SET Delivery using HT= TP=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0xxx=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A014:00 - 14:20=C2=A0
    Chair Slides on Managment APIs=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 14:2= 0 - 14:30
    Management API for SET Event Streams=C2=A0 =C2=A0 xxx= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A014:30 - 14:50=C2=A0
    SET Stream Managment and Provisioni= ng=C2=A0 =C2=A0Phil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A014:50 - 15:10=C2=A0 =C2=A0=C2=A0
    Management API Disc= ussion=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (ch= air)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:10 - 15:20
    AOB=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2= =A0 =C2=A0 =C2=A0 15:20 - 15:30





    -= -
    Subs= cribe to the HARDTWARE= mail list to learn about projects I am working on!
    =




    --
    Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
    --94eb2c119bb86ef7cc055ce43b6f-- From nobody Tue Oct 31 21:24:42 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2CBF13F99D for ; Tue, 31 Oct 2017 21:24:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rWNFXBWqamgK for ; Tue, 31 Oct 2017 21:24:39 -0700 (PDT) Received: from mail-pg0-x231.google.com (mail-pg0-x231.google.com [IPv6:2607:f8b0:400e:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDE1213F97F for ; Tue, 31 Oct 2017 21:24:36 -0700 (PDT) Received: by mail-pg0-x231.google.com with SMTP id m18so1061782pgd.13 for ; Tue, 31 Oct 2017 21:24:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=cv6d7UPYBC9X7d3TrFCUkJwvE3OQbHNDzZdx0Rmep7I=; b=NZ4Ky8t8bD3enis3aWEIF1gwqeAJAjeW/AWvawTyj/wFviKYs8bGSZBVPCs9HYDCue 5Ci3JtKQSv8tSK75cgb9wh1zAtaZ0kOAWESbOFyixHbQBIiGk68EMVOfXnkxy8bXpwaT bnqC6q4zLb1jNw/XFx39r3POhiqShSYpC509+tlNxKD2VDN9Ti+PzGMoKVPZUvENy1WU zgxIp5b8Xh0nZVcPkpgRRJrYpqYY+t4lsVGrzLSccVRPfRJpP9qrhLGIDqLovtg03ZiL TZghBCZBQvPvrlo0cuR+bIsheiwrESjeWknYGNSDj+CAovhVZmChLliKVvUWY0Gm9JE4 CVrQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=cv6d7UPYBC9X7d3TrFCUkJwvE3OQbHNDzZdx0Rmep7I=; b=LIDSajmc/zds/iQ39MOlWmqtSmiRaXx/23Tzb1lV/LN0FLkux6jIh/XPOZ4kU9A2rN +YqhRcdgqLywiNTAdAyB0YZQEKMKxNpHViQRwQM8QktoJeGwWMg2XuI+NvQOqfP29yNO mODrIveWSW9ZwXczJRSBU+7kmOdKfz7mtnL9naPYXNXS0TYvmpV6jxfJ2+ELapg4xV5j mPpNNIXC9EZq7t7c7QTIBs/GLCKXKZE8lPLif66a/Qx/Tvd9JHq0hlXl+ohgtA0RNRfy POCPoi/xtXcUuMcmSmcXGNOqVpigWY+vRdT6DNj92+GfWPfznkwHdTUPfRepnpMGO/sG Jdpw== X-Gm-Message-State: AMCzsaXI07K5RQt9ZQt0ROcdACaIK+L1N0AxflHviVVk6aAR1+sXsLYn +w38FYFkFFrUj6o4BTCHv8lLIa8xYbGIBCYSWK9NQg== X-Google-Smtp-Source: ABhQp+Q8TZH2QiYTpgBhBEthcHd6I32qwzGWadE/zKq+jNdkj0zWumZOeyPrI1uY3Xl8mrUmeL6d3nEFHAucKjFzdIQ= X-Received: by 10.101.93.9 with SMTP id e9mr4319491pgr.302.1509510275917; Tue, 31 Oct 2017 21:24:35 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Tue, 31 Oct 2017 21:24:15 -0700 (PDT) From: Dick Hardt Date: Tue, 31 Oct 2017 21:24:15 -0700 Message-ID: To: SecEvent Content-Type: multipart/alternative; boundary="089e0824731cc7eea9055ce43f71" Archived-At: Subject: [Id-event] Draft agenda uploaded to IETF site X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 04:24:41 -0000 --089e0824731cc7eea9055ce43f71 Content-Type: text/plain; charset="UTF-8" https://datatracker.ietf.org/meeting/100/materials/agenda-100-secevent/ IETF 100 Singapore Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 Agenda Setting Dick Hardt (chair) 13:30 - 13:40 Security Event Token (SET) Phil Hunt 13:40 - 14:00 SET Delivery using HTTP Marius Scurtescu 14:00 - 14:20 Management API for SET Event Streams Marius Scurtescu 14:20 - 14:30 Management API example Annabelle Richard 14:30 - 14:40 SET Stream Managment and Provisioning Phil Hunt 14:40 - 15:00 Management API Discussion Dick Hardt (chair) 15:00 - 15:20 AOB Dick Hardt (chair) 15:20 - 15:30 --089e0824731cc7eea9055ce43f71 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    https://datatracker.ietf.org/meeting/100/material= s/agenda-100-secevent/

    IETF 100 Singapore
    Bras Basah Monday Nov 13, 2017, 13:30 - 15:30

    Agenda Setting=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2= =A0 =C2=A0 =C2=A0 13:30 - 13:40
    Security Event Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 Phil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A013:40 - 14:00=C2=A0 =C2=A0
    SET Delivery using HTTP=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0Marius Scurtescu=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = 14:00 - 14:20=C2=A0
    Ma= nagement API for SET Event Streams=C2=A0 =C2=A0 Marius Scurtescu=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 14:20 - 14:30
    Management API example=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 Annabelle Richard=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A014:30 - 14:40
    SE= T Stream Managment and Provisioning=C2=A0 =C2=A0Phil Hunt=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:40 - 15:00=C2=A0 =C2=A0=C2= =A0
    Management API Dis= cussion=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (c= hair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:00 - 15:20
    AOB=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:20 - 15:30

    --089e0824731cc7eea9055ce43f71-- From nobody Tue Oct 31 21:37:35 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD04B13FAD8 for ; Tue, 31 Oct 2017 21:37:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-d8kZptd1ZY for ; Tue, 31 Oct 2017 21:37:27 -0700 (PDT) Received: from mail-pg0-x231.google.com (mail-pg0-x231.google.com [IPv6:2607:f8b0:400e:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD1F913FACB for ; Tue, 31 Oct 2017 21:37:26 -0700 (PDT) Received: by mail-pg0-x231.google.com with SMTP id a192so1094513pge.9 for ; Tue, 31 Oct 2017 21:37:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=VeehpZ0Jy+yr/tbCwUQqaCQnVPM7fZY/yxxEiD/CXKo=; b=Ywr5WyL1cwuJRWb0mcqbD8Lwc3F9xfasMaUTfTmxRMixewKG2xfaLSM3KFSTnCgYZQ fbIkXFyZQvBI5jA9KYhS0fDZh+PwlhRw4n4jtXRs2+R5l1x6lmg+HmLo8YmGGvI3Imqg olPRRYyIK6/ev/RaXe0Z4A7ogV1xmT0YU7O2z1REJAANf4f/FVDYgbmoiWuc35knDH2S BDieQUfbEiFRwMLjx8xvDvcNqjs3xJefOSBPX0HcxKEF659fTmNeWygALgDjjjaopOVl 7F5V0zKo4kN1zk6gylRwU5CkXEvPwoND+rQPlyI1gXwIQuOOiO268yF63/RCjf1uAm1i EiwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=VeehpZ0Jy+yr/tbCwUQqaCQnVPM7fZY/yxxEiD/CXKo=; b=sL2OFtcFIDWe4Tv3vogV/KMzX1F1Olw79BcsgfgTZHhx54/Je9zZVkd9Ob+mMOrL0i R8kxiopW3PUCj4nFg+goUECXuSlAMf5OWUvazcjyDsWGB3PImKsiWQIe3Z/zp64lfNcj pLoY2siSZcE6jzRG8tOkZVOjgGz4EciDcICxgJDxnZURsSrDUbH6lPZyU5yN6WlbEsBI Z+Rrv8MsdRgw+B1lqPQSvZr17Dkxe1BsmxWRe4zwZkrURGBzLihvXPZ2tj67E0Rn0EF6 4SAIOLujzWQFCPRtIZdPOEmT0d+lBkplakLVMZLvP6sU1pedMFt7r2OyLFDDhH5N4nAc miwA== X-Gm-Message-State: AMCzsaXepRDOkdJwOqrWEFCn8ZvI+/9yFAiKOMOaAhSRLgln9KpxuDyL afZ5Fa1G0UuhjSph+8UOBXJgS6EoVCDeyfi8pyg= X-Google-Smtp-Source: ABhQp+TwFbhUSpyUR1H3rThjEDKA8C0eotvO5XS9gmZyemM2kakFc8YbA0PW8xLxbZtx1hPFMFVQOnrMBn/GpbRQG20= X-Received: by 10.98.218.83 with SMTP id w19mr4904087pfl.287.1509511046027; Tue, 31 Oct 2017 21:37:26 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Tue, 31 Oct 2017 21:37:05 -0700 (PDT) In-Reply-To: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> From: Dick Hardt Date: Tue, 31 Oct 2017 21:37:05 -0700 Message-ID: To: Mike Jones Cc: "Phil Hunt (IDM)" , Yaron Sheffer , "Richard Backman, Annabelle" , ID Events Mailing List Content-Type: multipart/alternative; boundary="f403045ebaf0aedfaf055ce46deb" Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 04:37:34 -0000 --f403045ebaf0aedfaf055ce46deb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Mike As you well know, many people in a WG don't look closely at a specification until last call is made. Additionally, we are coming up on only the 3rd WG meeting. The WG has not existed for very long. While some of the participants have been working on this for a while, many have not, and we are looking for consensus across the WG. Since SecEvent is a framework that we expect to be profiled, I feel it is important to ensure that SecEvent specifications are easy for a variety of profiles to adopt, and that the semantics make sense. I also think that properties that are specific to a profile should be left to that profile and not be included in SecEvent. Since this is a framework, it is expected that as different groups profile it, there will be additional feedback. Specifically, as a participant in the RISC profile of SET, a number of issues in SET have surfaced as the RISC WG has looked at how to use the SET= . As for SET being stable for over a year, there have been a number of changes to SET since then. I also don't think there was consensus. Before the WG was formed, I and several others had expressed concern on the design of SET when Phil presented it at an IIW session. As to taking another year, I am hopeful we can resolve the remaining issues in SET and publish a new draft for last call. I do not think we will need to wait for another WG meeting to ask for last call. We also have a number of other documents that are not in last call, and we don't have a WG adopted draft yet for management. So there are still a number of documents to work through before we have all the bits for someone to work with. I do think we have been making good progress since the last IETF meeting, and I am hopeful we can keep up this momentum and finalize all the documents in a timely manner. /Dick On Tue, Oct 31, 2017 at 12:48 PM, Mike Jones wrote: > It=E2=80=99s hard for me to even express my level of frustration with the= recent > attempts to once again redesign the SecEvent Token spec. We=E2=80=99ve b= een at > this for multiple years because people keep trying to revisit decisions > that were long ago made by consensus. It=E2=80=99s been stable for over = a year and > the majority of WGLC respondents said some variant of =E2=80=9CWorks for = me =E2=80=93 ship > it!=E2=80=9D > > > > There=E2=80=99s not sufficient justification to try to undo consensus pos= itions > that have been debated and affirmed over and over. Countenancing wholesa= le > changes at this late date is counterproductive in the extreme! > > > > It=E2=80=99s far better than good enough as-is. In my experience, if we = start > redesigning it, it will result in another year=E2=80=99s delay. It does = something > simple and useful. Please, let=E2=80=99s just ship it, so people can rel= y on it. > > > > -- Mike > > > > *From:* Phil Hunt (IDM) [mailto:phil.hunt@oracle.com] > *Sent:* Monday, October 30, 2017 2:42 PM > *To:* Dick Hardt > *Cc:* Yaron Sheffer ; Richard Backman, Annabelle < > richanna@amazon.com>; Mike Jones ; ID Events > Mailing List > > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > > > Inline... > > Phil > > > On Oct 30, 2017, at 2:22 PM, Dick Hardt wrote: > > Hi Phil > > > > Correct me if I am misunderstanding, but there is a RISC profile event > > > > "http://schemas.openid.net/secevent/risc/event-type/ accou= nt-credential-change-required=E2=80=9D > > > > and an SCIM profile event > > > > "https://example.com/scim/event/passwordResetExt=E2=80=9D > > > > I'm suggesting that two different events would be sent. Embedding one in > the other does not make sense. > > It is a hypothetical example. Just because you disagree on this does > not mean others are not valid. > > > > I just picked overlapping proposals that have different meaning (but not > the same) to illustrate the difference from issuing a single set with > different events. > > > > As I have stated this is very different from asserting multiple distinct > events in one SET. > > > > Also, I think it is simpler to have event_type be at the same level as > event > > > > may be. I was working from Annabelle's proposed format. > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event_type": "https://example.com/scim/event/passwordResetExt", > > "event": { > > "id":"44f6142df96bd6ab61e7521d9", > > "resetAttempts":5 > > } > > } > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event_type": "http://schemas.openid.net/secevent/risc/event-type/ > account-credential-change-required > > ", > > "event": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > > > > > > > > > > > On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt wrote: > > Annabelle/Dick, > > > > Thanks for the comments. I think we need to examine the consequences of > the proposal in JSON. > > > > As I stated, what causes most of the issue is the proposed extension > mechanism in the payload (possibly using events in a recursive way). Does > it follow the old format or the new? > > > > Let=E2=80=99s consider a use case where we have an identity management s= ystem > that uses SCIM, but the SCIM system is also the underlying data store for > Connect. A Password reset might generate the following event which has a= n > extension (conveying reset count) AND overlapping statement from RISC. > BOTH of which might be important to a similar receiver using SCIM and OID= C. > > > > > *The 03 spec currently would allow:* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "events": { > > "urn:ietf:params:scim:event:passwordReset": > > { "id":"44f6142df96bd6ab61e7521d9"}, > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > "http://schemas.openid.net/secevent/risc/event-type/\ > account-credential-change-required": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > } > > > > In the above - each payload is a =E2=80=98peer' and issued without prefer= ence by the transmitter. The receiver can assign priority in its own contex= t if that matters. > > > > *The new proposal:* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRes= et=E2=80=9D, > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevents=E2=80=9D:{ > > ->note =E2=80=A6is this the old or new structure? <- > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > "http://schemas.openid.net/secevent/risc/event-type/\ > account-credential-change-required": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > } > > } > > > > In the above, sub-events or extensions have a different format. The same = complaint about the original stands. > > > > **OR* (if the receiver cares about RISC more). Note that this leads to a= triple nested structure.* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ > > account-credential-change-required=E2=80=9D, > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, > > =E2=80=9Cevents=E2=80=9D:{ > > "urn:ietf:params:scim:event:passwordReset": > > { > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevents=E2=80=9D:{ > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > } > > } > > } > > } > > } > > > > In the above, the extension is placed inside the event it extends. It fol= lows the old format (or should it follow the new?) > > **OR* Following the top layer pattern of singular event Note that this l= eads to a triple nested structure.* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ > > account-credential-change-required=E2=80=9D, > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, > > =E2=80=9Cevent=E2=80=9D:{ > > =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:password= Reset=E2=80=9D, > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevent=E2=80=9D:{ > > =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/pa= sswordResetExt=E2=80=9D, > > "resetAttempts":5 > > } > > } > > } > > } > > > > This format follows the proposed singular event format recursively and is= 3 layers deep. Note that the parser has to continue to search the document= for things that aren=E2=80=99t there as it has to stop when no =E2=80=9Cev= ent=E2=80=9D attribute is found rather than iterate over an array. > > > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > > phil.hunt@oracle.com > > > > On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle < > richanna@amazon.com> wrote: > > > > Replies inline. > > > > -- > > Annabelle Richard Backman > > Identity Services > > > > > > *From: *Phil Hunt > *Date: *Sunday, October 29, 2017 at 5:25 PM > *To: *Dick Hardt > *Cc: *Yaron Sheffer , Mike Jones < > Michael.Jones@microsoft.com>, "Richard Backman, Annabelle" < > richanna@amazon.com>, ID Events Mailing List > *Subject: *Re: [Id-event] Use cases for multiple events per SET? > > > > I hope this answers your question. > > > > My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why not= . The question should be, > what is the justification to make =E2=80=9Cevents=E2=80=9D singular? > > [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer semantic= s and is easier > to process. We should opt for easier solutions unless there are use cases > that require more complexity.[/richanna] > > > > There are many reasons for multiple events in a SET. Some are good, some > not so good. Some of the reasons... > > > > 1. Multiple event payloads expressing statements about largely the > *same*thing. For example, SCIM password reset AND RISC password reset. A > RISC Event and an OpenBanking Event. Is one a complement to the other? D= o > they overlap or are they distinct? > > [richanna]Copy/pasted from my earlier email: > > Why is it necessary or appropriate to include these events in the same > SET? They are likely being generated by different systems at different > times on the transmitter=E2=80=99s side, consumed by different systems on= the > receiver=E2=80=99s side, and possibly being transmitted over different ev= ent > streams. I know the latter would be the case for us, as a receiver. Even = if > it=E2=80=99s not, is it burdensome to send these events separately? What = value is > gained in combining them? > > > > Additionally, since the signature is over the SET and not the event > objects, Receivers independently route separate events from a single toke= n > without either losing the ability to verify the authenticity of the event > or sharing all information in the SET with every system handling any even= t > in the token.[/richanna] > > > > 2. Multiple events payloads expressing different statements about the > same transaction - RISC Password Reset and RISC Session Cancel > [richanna]Same as above[/richanna] > > 3. A new profile defines new event attributes to be added on to an > existing event type (a pure extension) > [richanna]I have suggested a way to support extensions within an event > body, multiple times now. If you see problems with it, please point them > out.[/richanna] > > > > I think it is quite valid to allow 1 and 3. 2 could be limited by > specific profiles like RISC if they want. > > > > I am not in agreement that making event singular simplifies anything. For > one is makes extensions complex (another nested JSON structure) and > potentially conflicting. > [richanna] > > Ways that multiple-event SETs are more complicated: > > 1. It results in a more complex structure for the single event use > case, which I think we all agree is the majority use case. > 2. Multiple-event SETs have ambiguous semantics. The presence of two > events A and B in the same SET could mean any of: > > > 1. They are related to the same logical event (i.e. the same thing as > if they were from different SETs that have a common txn). > 2. A is an extension of B. > 3. B is an extension of A. > 4. They are aliases for one another. > 5. They are not actually related to one another in any way. > > > 1. Claim semantics become harder to define, as different profiles may > want to use the same claims in different ways. > > > > If the WG wants to block 1 and 2 above, then I believe we have to > establish an event registry to ensure new Event profiles do not overlap t= o > eliminate the need to express multiple events. > > [richanna]I=E2=80=99m not sure what you mean by this. Are you referring t= o event > names? Those are already defined by the spec to be URIs.[/richanna] > > Phil > > > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > > phil.hunt@oracle.com > > > > On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: > > > > Phil: > > > > In your examples for having a plurality of events, you use the word "may"= , > which leads me to question if a plurality of events is really required in > SET. > > > > You posit that it will be difficult for a distributed system to correlate > multiple SETs with the same "txn", but the distributed system will > certainly need to correlate events on the same subject -- correlating > events on the same "txn" on the same subject seems fairly simple. > > > > I think that a receiver will need to correlate multiple SEts on the same > subject, so having multiple events in a SET is redundant, and adds > complexity with no clear benefit that I can see. > > > > An implementor may choose to send multiple SETs, or send a single SET wit= h > multiple events, so a receiver will need to support both. I prefer we pic= k > one way and minimize the code paths, and we will need to support > correlating across multiple SETs, so that seems the best mechanism. > > > > Let me know if there is something I missed in my logic. > > > > /Dick > > > > > > On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer > wrote: > > In that case, let's add text to that effect, e.g. we could add to the > definition of the "events" claim: > > Profiling specifications SHOULD define the allowed event statements, and > MAY restrict their number. For example, some profiles may require this > claim to contain only a single event statement. > > Thanks, > Yaron > > On 24/10/17 22:10, Mike Jones wrote: > > I agree with much of Phil=E2=80=99s rationale here. > > It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a > singleton. That doesn=E2=80=99t have to be true for all events. I think= things > are fine as-is. > > -- Mike > > *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil > Hunt > *Sent:* Monday, October 23, 2017 8:47 PM > *To:* Richard Backman, Annabelle > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > Annabelle, > > I have a number of concerns with this proposal. > > Profiling Independence / Keeping Event Payloads Independent > > Indicating that extensions should be handled by profiles leads to more > inter-operability issues and more importantly intrudes on the Event paylo= ad > space by suggesting a sub-schema creates potential limitations and > conflicts that may add to complexity later on. The current format allows = a > parser to discover and unload one or more JSON payloads which can each ha= ve > independent structure. > > General extensions > > The proposal also rules out general purpose extensions not related to any > specific event. Given the emergence of items like GPRD, I would not want = to > block the ability to add meta-data or other general purpose items. We can > also anticipate some delivery scenarios where additional data might be > required. Even though there is no current planned use, I see no good reas= on > to rule this out. > > Multiple Events From Different Families (vs. Multiple Events from a singl= e > family like RISC) > > In our RISC session we discussed expressing multiple distinct RISC events > in one SET. The discussion was that only one RISC event at a time. We did > not discuss other event profiles. I don=E2=80=99t see a reason to rule ou= t > multi-events from different families at the SET level. Each profile is > expressing slightly different things about the same event. > > I can forsee some cases where it is not clear which is the primary and > which is the extension. There may not be a clear winner. > > A couple of examples (these are necessarily real=E2=80=A6just possibiliti= es): > > * It is probably useful to be able to express simlar/overlapping events > from different SET profiles in one SET. For example a Backchannel Logout= & > a RISC session cancel event. > > * SCIM may want to represent a single transaction as causing multiple > state changes in an event (e.g. a password change causes multiple effects= ). > Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80= =9D would be > challenging in a multi-threaded/multi-node delivery system. The SCIM li= st > has not discussed this, but I would not want to block this capability. I= OW > - Just because RISC does not want to express multiple events does not mak= e > this true for other profiles. > > * We may wish to indicate a SCIM Password Reset was performed and a > Logout/session cancellation is expressed at the same time. The events ar= e > related but express different data. > > Avoiding Confusion From Similar Events Originating from the Same > Transaction > > If events are sent separately, then more tracking of state (e.g. by txn) > would be required to ensure similar events are not mistaken or handled as > repeats. While txn provides useful audit analysis capability, I=E2=80=99m= not sure > it can be used in live or near-real time systems given distributed > multi-node, multi-threading architectures. > > Previous Discussion > > I note that I originally raised having an attribute to designate primary > event attribute to alleviate your concern, but this was not accepted. See= : > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html > > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html > > > The consensus, at least as I interpreted it is up to the receiver to > figure this out based on the definitions it has for each event URI and th= e > profiles they represent. IOW - RISC is free to limit that only one RISC > event be expressed at a time. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > > > > > phil.hunt@oracle.com > > On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle > > wrote: > > The current draft of the SET spec allows for expressing multiple > events within the same token, which introduces additional complexity > and room for ambiguous semantics. We=E2=80=99ve discussed this in the= OIDF > RISC working group and the current consensus there is that RISC will > require that RISC events must be the only event in the SET, having > identified ways to clearly and easily support the handful of use > cases for multiple events per token that people have raised. With > that context in mind, I propose striking the definition of the > =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, an= d replacing it > with the following definition for an =E2=80=9Cevent=E2=80=9D claim (s= ingular): > > event > > A JSON object containing an "event_type" member whose value is a URI > representing a type of event defined in a Profiling Specification. > The object MAY otherwise be empty, or MAY contain additional members > as described by the Profiling Specification. > > Here is the example SET from section 2.3, rewritten with this change > mind: > > { > > "jti": "4d3559ec67504aaba65d40b0363faad8", > > "iat": 1458496404, > > "iss": "https://scim.example.com ", > > "aud": [ > > "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > "event_type": "urn:ietf:params:scim:event:create", > > "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 > ", > > "attributes": ["id", "name", "userName", "password", "emails"] > > } > > } > > Does anyone in the working group have use cases for SETs that cannot > be met by this proposed text? Within RISC, we identified three use > cases, with solutions outlined below: > > ** > > *Extensions* > > Event extension mechanisms can be defined internal to the event > object. A simple approach would be to define an =E2=80=9Cextensions= =E2=80=9D member > that is a list of event objects (or set resembling the =E2=80=9Cevent= s=E2=80=9D > claim as defined in the current spec). This has the advantage of > making it clear in the data structure that there is a single primary > event, with zero or more extensions. There is no room for confusion > over which event is primary, or if there is a primary event at all. > I would be fine with adding something like this to my proposed text, > if there is consensus that it is broadly useful. > > *Aliases* > > This use case was brought up in the context of migrating clients > from draft event names to standardized event names. In this case, > the event transmitter can transmit two tokens for the logical event, > one using the old name and another using the new name. > > *Related Events* > > The SET spec defines the txn claim as a means of correlating > independent tokens that relate to the same logical event. > > -- > Annabelle Richard Backman > > Amazon =E2=80=93 Identity Services > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps- > 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > s5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3D > X8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > -- > > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj- > 2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zb > hcW001fK02EXs&e=3D > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU- > a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp= - > MJ20ui2nm46QSz0&e=3D > > > > > > > > -- > > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DiyVnrZmr9_ > uGCQ6MD0zF2ymRQS6lK67yF_8u8_qSC_w&s=3DOe0qfLEX83vtXM7Wl2cYBe- > Gg1DVPjhXjVJkfhVRzwc&e=3D > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --f403045ebaf0aedfaf055ce46deb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Mike

    As you well know, many people in a= WG don't look closely at a specification until last call is made. Addi= tionally, we are coming up on only the 3rd WG meeting. The WG has not exist= ed for very long. While some of the participants have been working on this = for a while, many have not, and we are looking for consensus across the WG.=

    Since SecEvent is a framework that we expect to b= e profiled, I feel it is important to ensure that SecEvent specifications a= re easy for a variety of profiles to adopt, and that the semantics make sen= se. I also think that properties that are specific to a profile should be l= eft to that profile and not be included in SecEvent.

    Since this is a framework, it is expected that as different groups profi= le it, there will be additional feedback.

    Specific= ally, as a participant in the RISC profile of SET, a number of issues in SE= T have surfaced as the RISC WG has looked at how to use the SET.
    =
    As for SET being stable for over a year, there have been a n= umber of changes to SET since then. I also don't think there was consen= sus. Before the WG was formed, I and several others had expressed concern o= n the design of SET when Phil presented it at an IIW session.
    As to taking another year, I am hopeful we can resolve the rema= ining issues in SET and publish a new draft for last call. I do not think w= e will need to wait for another WG meeting to ask for last call.=C2=A0

    We also have a number of other documents that are not = in last call, and we don't have a WG adopted draft yet for management. = So there are still a number of documents to work through before we have all= the bits for someone to work with.

    I do think we = have been making good progress since the last IETF meeting, and I am hopefu= l we can keep up this momentum and finalize all the documents in a timely m= anner.

    /Dick


    On Tue, Oct 31, 2017 at 12:= 48 PM, Mike Jones <Michael.Jones@microsoft.com> wr= ote:

    It=E2=80=99s hard for = me to even express my level of frustration with the recent attempts to once= again redesign the SecEvent Token spec.=C2=A0 We=E2=80=99ve been at this f= or multiple years because people keep trying to revisit decisions that were long ago made by consensus.=C2=A0 It=E2=80=99s been stable for o= ver a year and the majority of WGLC respondents said some variant of =E2=80= =9CWorks for me =E2=80=93 ship it!=E2=80=9D

    =C2=A0

    There=E2=80=99s not su= fficient justification to try to undo consensus positions that have been de= bated and affirmed over and over.=C2=A0 Countenancing wholesale changes at = this late date is counterproductive in the extreme!

    =C2=A0

    It=E2=80=99s far bette= r than good enough as-is.=C2=A0 In my experience, if we start redesigning i= t, it will result in another year=E2=80=99s delay.=C2=A0 It does something = simple and useful.=C2=A0 Please, let=E2=80=99s just ship it, so people can rely on it.

    =C2=A0

    =C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0

    From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
    Sent: Monday, October 30, 2017 2:42 PM
    To: Dick Hardt <dick.hardt@gmail.com>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>; Richard Backman, Annabelle <= richanna@amazon.co= m>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List= <id-event@ietf.o= rg>


    Subject: Re: [Id-event] Use cases for multiple events per SET?

    =C2=A0

    Inline...

    Phil


    On Oct 30, 2017, at 2:22 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

    Hi Phil

    =C2=A0

    Correct me if I am misunderstanding, but there is a = RISC profile event=C2=A0

    =C2=A0
    "=
http://=
schemas.openid.net/secevent/risc/event-type/account-cred=
ential-change-required=E2=80=9D
    =C2=A0

    and an SCIM profile event

    =C2=A0

    I'm suggesting that two different events would b= e sent. Embedding one in the other does not make sense.

    <ph>It is a hypothetical example. Just because= you disagree on this does not mean others are not valid.=C2=A0

    =C2=A0

    I just picked overlapping proposals that have differ= ent meaning (but not the same) to illustrate the difference from issuing a = single set with different events.=C2=A0

    =C2=A0

    As I have stated this is very different from asserti= ng multiple distinct events in one SET.=C2=A0

    =C2=A0

    Also, I think it is simpler to have event_type be at= the same level as event

    =C2=A0

    <ph>may be. I was working from Annabelle's= proposed format.=C2=A0

    =C2=A0

    = {

    = =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30&qu= ot;,

    = =C2=A0 "iat": 1458496025,

    = =C2=A0 "iss": "https://scim.example.com",

    = =C2=A0 "aud": [

    = =C2=A0 =C2=A0],

    = =C2=A0 =C2=A0"event_type": "https://example.com/scim/event/passwordResetExt",

    = =C2=A0 =C2=A0"event": {=C2=A0=C2=A0

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"id":"44f6142df96bd6a= b61e7521d9",

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"resetAttempts":5=

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0}

    = }

    =C2=A0

    = {

    = =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30&qu= ot;,

    = =C2=A0 "iat": 1458496025,

    = =C2=A0 "iss": "https://scim.example.com",

    = =C2=A0 "aud": [

    = =C2=A0 =C2=A0],

    = =C2=A0 =C2=A0"event": {

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2= =80=9D,

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9Ciss=E2=80=9D:"https://idp.example.com/"= =C2=A0 =C2=A0 =C2=A0 =C2=A0

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0}

    = }

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt <phil.hunt@oracle.com<= /a>> wrote:

    Annabelle/Dick,

    =C2=A0

    Thanks for the comments. I think we need to examine = the consequences of the proposal in JSON.

    =C2=A0

    As I stated, what causes most of the issue is the pr= oposed extension mechanism in the payload (possibly using events in a recur= sive way). Does it follow the old format or the new?

    =C2=A0

    Let=E2=80=99s =C2=A0consider a use case where we hav= e an identity management system that uses SCIM, but the SCIM system is also= the underlying data store for Connect.=C2=A0 A Password reset might genera= te the following event which has an extension (conveying reset count) AND overlapping statement from RISC.=C2=A0 BOTH of which migh= t be important to a similar receiver using SCIM and OIDC. =C2=A0<= /u>

    =C2=A0

    The 03 spec currently would allow:<= /u>

    =C2=A0

    {
    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    =C2=A0 "iat": 1458496025,
    =C2=A0 "iss": "https://scim.example.com",
    =C2=A0 "aud": [
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    =C2=A0=C2=A0 ],
    =C2=A0=C2=A0 "events": {
    =C2=A0=C2=A0=C2=A0=C2=A0 "urn:ietf:params:scim:event:passwor=
dReset":
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { "id":"44f61=
42df96bd6ab61e7521d9"},
    =C2=A0=C2=A0=C2=A0=C2=A0 "https://example.com/scim/event/=
passwordResetExt":
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { "resetAttempts":5},
    =C2=A0=C2=A0=C2=A0=C2=A0 "http://schema=
s.openid.net/secevent/risc/event-type/\
    =C2=A0 =C2=A0 =C2=A0 =
=C2=A0account-credential-change-required": {    =

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,=

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Ciss=E2=80=9D:"https://idp.ex=
ample.com/"
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
}
    =C2=A0 }
    }
    =C2=A0
    In the ab=
ove - each payload is a =E2=80=98peer' and issued without preference by=
 the transmitter. The receiver can assign priority in its own context if th=
at matters.
    =C2=A0
    The ne=
w proposal:
    =C2=A0
    {
    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    =C2=A0 "iat": 1458496025,
    =C2=A0 "iss": "https://scim.example.com",
    =C2=A0 "aud": [
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    =C2=A0=C2=A0 ],
    =C2=A0=C2=A0 "event": {
    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:p=
arams:scim:event:passwordReset=E2=80=9D,
    =C2=A0=C2=A0=C2=A0=C2=A0 "id":=E2=80=9D44f6142df96bd6ab=
61e7521d9=E2=80=9D,
    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevents=E2=80=9D:{

    =C2=A0=C2=A0=C2=A0=C2=A0 ->note =E2=80=A6is this the old or new str=
ucture? <-
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://example.com/scim=
/event/passwordResetExt":
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { "resetAttempts=
":5},
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
"=
http://schemas.openid.net/secevent/risc/event-type/\
    =C2=A0 =C2=
=A0 =C2=A0=C2=A0=C2=A0 =C2=A0account-credential-change-required":=
 {
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,=

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Ciss=E2=80=9D:"https://idp.ex=
ample.com/"
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
}
    

    =C2=A0=C2=A0=C2=A0=C2=A0 }<=
/u>
    

    =C2=A0=C2=A0 }=C2=A0=C2=A0=C2=
=A0 
    

    }
    

    =C2=A0
    

    In the ab=
ove, sub-events or extensions have a different format. The same complaint a=
bout the original stands.
    

    =C2=A0
    

    *OR* (=
if the receiver cares about RISC more).=C2=A0 Note that this leads to a tri=
ple nested structure.
    

    =C2=A0
    

    {
    

    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    

    =C2=A0 "iat": 1458496025,
    

    =C2=A0 "iss": "https://scim.example.com",
    

    =C2=A0 "aud": [
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    

    =C2=A0=C2=A0 ],
    

    =C2=A0=C2=A0 "event": {
    

    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-typ=
e/\
    

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0account-credential-change-required=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=E2=80=
=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Cevents=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 "urn:ietf:params:scim:event:passwordReset":=

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 {=C2=A0
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "id":=
=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevents=
=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "https://example.com/scim/event/passwordResetExt"=
:
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 { "resetAttempts":5},=C2=A0 
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0}=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }=C2=A0=C2=A0=C2=A0=C2=A0 
    

    =C2=A0=C2=A0=C2=A0}
    

    }
    

    

    =C2=A0
    

    

    

    In the ab=
ove, the extension is placed inside the event it extends. It follows the ol=
d format (or should it follow the new?)
    

    

    

    *OR* F=
ollowing the top layer pattern of singular event=C2=A0 Note that this leads=
 to a triple nested structure.
    

    =C2=A0
    

    {
    

    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    

    =C2=A0 "iat": 1458496025,
    

    =C2=A0 "iss": "https://scim.example.com",
    

    =C2=A0 "aud": [
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    

    =C2=A0=C2=A0 ],
    

    =C2=A0=C2=A0 "event": {
    

    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-typ=
e/\
    

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0account=
-credential-change-required=E2=80=9D,=

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Cevent=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:p=
asswordReset=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=
=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_=
type=E2=80=9D:"https://example.com/scim/event/passwordRes=
etExt=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "resetAtte=
mpts":5 
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }=C2=A0=C2=A0=C2=A0=C2=A0 
    

    =C2=A0=C2=A0=C2=A0}
    

    }
    

    =C2=A0
    

    This form=
at follows the proposed singular event format recursively and is 3 layers d=
eep. Note that the parser has to continue to search the document for things=
 that aren=E2=80=99t there as it has to stop when no =E2=80=9Cevent=E2=80=
=9D attribute is found rather than iterate over an array.<=
/u>
    

    

    =C2=A0

    Phil

    Oracle Corporation, Identity Cloud Services Architect
    @independentid
    www.independentid.com
    phil.hunt@oracle.= com

    =C2=A0

    On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabe= lle <richanna@a= mazon.com> wrote:

    =C2=A0

    Replies inline.

    =C2=A0

    --=C2=A0

    Annabelle Richard Bac= kman

    Identity Services

    =C2=A0

    =C2=A0

    From:=C2=A0Phil Hunt <<= span style=3D"color:purple">phil.hunt@oracle.com>
    Date:=C2=A0Sunday, October 29, 2017 at 5:25 PM
    To:=C2=A0Dick Hardt <dick.hardt@gmail.com<= /span>>
    Cc:=C2=A0Yaron Sheffer <yaronf.ietf@gmail= .com>, Mike Jones <Michael.Jones@micros= oft.com>, "Richard Backman, Annabelle" <richanna@amazon.com<= /span>>, ID Events Mailing List <id-event@ietf.org>
    Subject:=C2=A0Re: [Id-event] Use cases for multiple event= s per SET?

    =C2=A0

    I hope this answers your = question.

    =C2=A0

    My =E2=80=9Cmay=E2=80=9D = was because I can=E2=80=99t see a reason why not. The question should be, w= hat is the justification to make =E2=80=9Cevents=E2=80=9D singular?<= u>

    [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer seman= tics and is easier to process. We should opt for easier solutions unless th= ere are use cases that require more complexity.[/richanna]=

    =C2=A0

    There are many reasons fo= r multiple events in a SET.=C2=A0 Some are good, some not so good. Some of = the reasons...

    =C2=A0

    1.=C2=A0 Multiple event p= ayloads expressing statements about largely the *same*thing. For example, S= CIM password reset AND RISC password reset.=C2=A0 A RISC Event and an OpenB= anking Event. Is one a complement to the other?=C2=A0 Do they overlap or are they distinct? =C2=A0

    [richanna]Copy/pasted from my earlier email:

    Why is it necessary or appropriate to include these events in the same= SET? They are likely being generated by different systems at different tim= es on the transmitter=E2=80=99s side, consumed by different systems on the receiver=E2=80=99s side, and possibly being tr= ansmitted over different event streams. I know the latter would be the case= for us, as a receiver. Even if it=E2=80=99s not, is it burdensome to send = these events separately? What value is gained in combining them?

    =C2=A0

    Additionally, since the signature is over the SET and not the event ob= jects, Receivers independently route separate events from a single token wi= thout either losing the ability to verify the authenticity of the event or sharing all information in the SET with e= very system handling any event in the token.[/richanna]

    =C2=A0

    2.= =C2=A0 Multiple events payloads expressing different statements about the s= ame transaction - RISC Password Reset and RISC Session Cancel
    [richanna]Same as above[/richanna]<= /u>

    3.=C2=A0 A new profile de= fines new event attributes to be added on to an existing event type (a pure= extension)=C2=A0
    [richanna]I have suggested a way to support e= xtensions within an event body, multiple times now. If you see problems wit= h it, please point them out.[/richanna]

    =C2=A0

    I think it is quite valid= to allow 1 and 3. =C2=A02 could be limited by specific profiles like RISC = if they want.

    =C2=A0

    I am not in agreement tha= t making event singular simplifies anything. For one is makes extensions co= mplex (another nested JSON structure) and potentially conflicting.=C2=A0 [richanna]

    Ways that multiple-event SETs are more complicated:

    1. It results in a more complex structure for the single event use case, which= I think we all agree is the majority use case.
    2. Multiple-event SETs have ambiguous semantics. The presence of two events A = and B in the same SET could mean any of:
      1. They are related to the same logical event (i.e. the same thing as if they = were from different SETs that have a common txn).
      2. A is an extension of B.
      3. B is an extension of A.
      4. They are aliases for one another.
      5. They are not actually related to one another in any way.
        6. =
    1. Claim semantics become harder to define, as different profiles may want to = use the same claims in different ways.

    =C2=A0

    If the WG wants to block = 1 and 2 above, then I believe we have to establish an event registry to ens= ure new Event profiles do not overlap to eliminate the need to express mult= iple events.

    [richanna]I=E2=80=99m not sure what you mean by this. Are you referrin= g to event names? Those are already defined by the spec to be URIs.[/richan= na]

    Phil

    =C2=A0

    Oracle Corporation, Ident= ity Cloud Services Architect

    @independentid<= /u>

    =C2=A0

    On Oct 29, 2017, at 4:12 = PM, Dick Hardt <dick.hardt@gmail.com> wrote:

    =C2=A0

    Phil:<= /u>

    =C2=A0=

    In your examples for ha= ving a plurality of events, you use the word "may", which leads m= e to question if a plurality of events is really required in SET.

    =C2=A0=

    You posit that it will = be difficult for a distributed system to correlate multiple SETs with the s= ame "txn", but the distributed system will certainly need to correlate events on the same subject -- correlating events on the = same "txn" on the same subject seems fairly simple.=

    =C2=A0=

    I think that a receiver= will need to correlate multiple SEts on the same subject, so having multip= le events in a SET is redundant, and adds complexity with no clear benefit that I can see.

    =C2=A0=

    An implementor may choo= se to send multiple SETs, or send a single SET with multiple events, so a r= eceiver will need to support both. I prefer we pick one way and minimize the code paths, and we will need to support correlati= ng across multiple SETs, so that seems the best mechanism.=

    =C2=A0=

    Let me know if there is= something I missed in my logic.

    =C2=A0=

    /Dick<= /u>

    =C2=A0=

    =C2=A0=

    On Sun, Oct 29, 2017 at= 11:28 AM, Yaron Sheffer=C2=A0<yaronf.ietf@gmail= .com>=C2=A0wrote:

    In that case, let's= add text to that effect, e.g. we could add to the definition of the "= events" claim:

    Profiling specifications SHOULD define the allowed event statements, and MA= Y restrict their number. For example, some profiles may require this claim = to contain only a single event statement.

    Thanks,
    =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0Yaron

    On 24/10/17 22:10, Mike Jones wrote:

    I = agree with much of Phil=E2=80=99s rationale here.

    It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a singleton.=C2=A0 That doesn=E2=80=99t have to be true for= all events.=C2=A0 I think things are fine as-is.

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0-- Mike

    *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt
    *Sent:* Monday, October 23, 2017 8:47 PM
    *To:* Richard Backman, Annabelle <richanna@amazon.com<= /a>>
    *Cc:* ID Events Mailing List <    id-event@ietf.org><= br> *Subject:* Re: [Id-event] Use cases for multiple events per SET?

    Annabelle,

    I have a number of concerns with this proposal.

    Profiling Independence / Keeping Event Payloads Independent

    Indicating that extensions should be handled by profiles leads to more inte= r-operability issues and more importantly intrudes on the Event payload spa= ce by suggesting a sub-schema creates potential limitations and conflicts t= hat may add to complexity later on. The current format allows a parser to discover and unload one or more = JSON payloads which can each have independent structure.

    General extensions

    The proposal also rules out general purpose extensions not related to any s= pecific event. Given the emergence of items like GPRD, I would not want to = block the ability to add meta-data or other general purpose items. We can a= lso anticipate some delivery scenarios where additional data might be required. Even though there is no current p= lanned use, I see no good reason to rule this out.

    Multiple Events From Different Families (vs. Multiple Events from a single = family like RISC)

    In our RISC session we discussed expressing multiple distinct RISC events i= n one SET. The discussion was that only one RISC event at a time. We did no= t discuss other event profiles. I don=E2=80=99t see a reason to rule out mu= lti-events from different families at the SET level. Each profile is expressing slightly different things about the = same event.

    I can forsee some cases where it is not clear which is the primary and whic= h is the extension.=C2=A0 There may not be a clear winner.

    A couple of examples (these are necessarily real=E2=80=A6just possibilities= ):

    * It is probably useful to be able to express simlar/overlapping events fro= m different SET profiles in one SET.=C2=A0 For example a Backchannel Logout= & a RISC session cancel event.

    * SCIM may want to represent a single transaction as causing multiple state= changes in an event (e.g. a password change causes multiple effects). Havi= ng to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80=9D wou= ld be challenging in a multi-threaded/multi-node delivery system.=C2=A0 =C2=A0The SCIM list has not discussed this, but I w= ould not want to block this capability.=C2=A0 IOW - Just because RISC does = not want to express multiple events does not make this true for other profi= les.

    * We may wish to indicate a SCIM Password Reset was performed and a Logout/= session cancellation is expressed at the same time.=C2=A0 The events are re= lated but express different data.

    Avoiding Confusion From Similar Events Originating from the Same Transactio= n

    If events are sent separately, then more tracking of state (e.g. by txn) wo= uld be required to ensure similar events are not mistaken or handled as rep= eats. While txn provides useful audit analysis capability, I=E2=80=99m not = sure it can be used in live or near-real time systems given distributed multi-node, multi-threading architectures.<= br>
    Previous Discussion

    I note that I originally raised having an attribute to designate primary ev= ent attribute to alleviate your concern, but this was not accepted. See:
    *=C2=A0https://www.ietf.org/= mail-archive/web/id-event/current/msg00406.html

    *=C2=A0https://www.ietf.org/= mail-archive/web/id-event/current/msg00140.html

    The consensus, at least as I interpreted it is up to the receiver to figure= this out based on the definitions it has for each event URI and the profil= es they represent. IOW - RISC is free to limit that only one RISC event be = expressed at a time.

    Phil

    Oracle Corporation, Identity Cloud Services Architect

    @independentid

    www.inde= pendentid.com=C2=A0<http://www.independentid.com    >

    phil.hunt@oracle.com=C2=A0<mailto:phil.hunt@oracle.com>

    =C2=A0 =C2=A0 On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle
    =C2=A0 =C2=A0 <= richanna@amazon.com=C2=A0<mailto:richanna@amazon.com>> wrote:

    =C2=A0 =C2=A0 The current draft of the SET spec allows for expressing multi= ple
    =C2=A0 =C2=A0 events within the same token, which introduces additional com= plexity
    =C2=A0 =C2=A0 and room for ambiguous semantics. We=E2=80=99ve discussed thi= s in the OIDF
    =C2=A0 =C2=A0 RISC working group and the current consensus there is that RI= SC will
    =C2=A0 =C2=A0 require that RISC events must be the only event in the SET, h= aving
    =C2=A0 =C2=A0 identified ways to clearly and easily support the handful of = use
    =C2=A0 =C2=A0 cases for multiple events per token that people have raised. = With
    =C2=A0 =C2=A0 that context in mind, I propose striking the definition of th= e
    =C2=A0 =C2=A0 =E2=80=9Cevents=E2=80=9D claim from the Security Event Token = spec, and replacing it
    =C2=A0 =C2=A0 with the following definition for an =E2=80=9Cevent=E2=80=9D = claim (singular):

    =C2=A0 =C2=A0 event

    =C2=A0 =C2=A0 A JSON object containing an "event_type" member who= se value is a URI
    =C2=A0 =C2=A0 representing a type of event defined in a Profiling Specifica= tion.
    =C2=A0 =C2=A0 The object MAY otherwise be empty, or MAY contain additional = members
    =C2=A0 =C2=A0 as described by the Profiling Specification.

    =C2=A0 =C2=A0 Here is the example SET from section 2.3, rewritten with this= change
    =C2=A0 =C2=A0 mind:

    =C2=A0 =C2=A0=C2=A0{

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "jti": "4d3559ec67504aaba65d= 40b0363faad8",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "iat": 1458496404,

    =C2=A0 =C2=A0 =C2=A0=C2=A0"iss": "https://scim.exa= mple.com=C2=A0<https://scim.example= .com/>",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "aud": [

    =C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/98d52461fa5bbc879593b77= 54",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/5d7604516b1d08641d7676e= e7"

    =C2=A0 =C2=A0 =C2=A0=C2=A0 ],

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "event": {

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "event_type": "urn:ie= tf:params:scim:event:create",

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "ref": "<= span style=3D"color:purple">https://scim.example.com/Users/44f614= 2df96bd6ab61e7521d9    ",

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "attributes": ["id&qu= ot;, "name", "userName", "password", "em= ails"]

    =C2=A0 =C2=A0 =C2=A0=C2=A0 }

    =C2=A0 =C2=A0 }

    =C2=A0 =C2=A0 Does anyone in the working group have use cases for SETs that= cannot
    =C2=A0 =C2=A0 be met by this proposed text? Within RISC, we identified thre= e use
    =C2=A0 =C2=A0 cases, with solutions outlined below:

    =C2=A0 =C2=A0 **

    =C2=A0 =C2=A0 *Extensions*

    =C2=A0 =C2=A0 Event extension mechanisms can be defined internal to the eve= nt
    =C2=A0 =C2=A0 object. A simple approach would be to =C2=A0define an =E2=80= =9Cextensions=E2=80=9D member
    =C2=A0 =C2=A0 that is a list of event objects (or set resembling the =E2=80= =9Cevents=E2=80=9D
    =C2=A0 =C2=A0 claim as defined in the current spec). This has the advantage= of
    =C2=A0 =C2=A0 making it clear in the data structure that there is a single = primary
    =C2=A0 =C2=A0 event, with zero or more extensions. There is no room for con= fusion
    =C2=A0 =C2=A0 over which event is primary, or if there is a primary event a= t all.
    =C2=A0 =C2=A0 I would be fine with adding something like this to my propose= d text,
    =C2=A0 =C2=A0 if there is consensus that it is broadly useful.

    =C2=A0 =C2=A0 *Aliases*

    =C2=A0 =C2=A0 This use case was brought up in the context of migrating clie= nts
    =C2=A0 =C2=A0 from draft event names to standardized event names. In this c= ase,
    =C2=A0 =C2=A0 the event transmitter can transmit two tokens for the logical= event,
    =C2=A0 =C2=A0 one using the old name and another using the new name.

    =C2=A0 =C2=A0 *Related Events*

    =C2=A0 =C2=A0 The SET spec defines the txn claim as a means of correlating<= br> =C2=A0 =C2=A0 independent tokens that relate to the same logical event.

    =C2=A0 =C2=A0 --=C2=A0
    =C2=A0 =C2=A0 Annabelle Richard Backman

    =C2=A0 =C2=A0 Amazon =E2=80=93 Identity Services

    =C2=A0 =C2=A0 _______________________________________________
    =C2=A0 =C2=A0 Id-event mailing list
    =C2=A0 =C2=A0=C2=A0Id-event@ietf.org= =C2=A0<mailto:Id-event@ietf.org>
    =C2=A0 =C2=A0=C2=A0https://urldefense.proofpoin= t.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Deve= nt&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkK= Y057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&= ;m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3DX8o= RSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D



    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event<= /span>


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event<= /span>



    =C2=A0=

    --=C2=A0

    Subscribe to the=C2= =A0HARDT= WARE=C2=A0mail list to learn about projects I am working on!

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org

    https://urldefense.proofpoint.co= m/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&a= mp;d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE= &r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU-a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRA= nqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e=3D

    =C2=A0



    =C2=A0

    --

    Subscribe to the HARDTWARE mail list to learn about projects I am working on!<= /u>




    --
    Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
    --f403045ebaf0aedfaf055ce46deb-- From nobody Tue Oct 31 21:42:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7968D13FAFE for ; Tue, 31 Oct 2017 21:42:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.018 X-Spam-Level: X-Spam-Status: No, score=-2.018 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6020xzr46DuZ for ; Tue, 31 Oct 2017 21:42:19 -0700 (PDT) Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0124.outbound.protection.outlook.com [104.47.33.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3135013FAF8 for ; Tue, 31 Oct 2017 21:42:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=e5DyDjCAnRB4gRgyOvADrbJVZhJlJyWKo7Fan4ebwX4=; b=IO1U643w98olm68XWwfTyQtZWmVmZP1lJhhp0ApjHYSmswtk/iXa69OXVIjH97wyQEViixX4AVd1ScrG/8Xcpuq2P0SfRsSnRvl/AFJRHv1VIzAYgO5mUzQ3aSHDtYH5R1tXffz5Gopv/6mNtUOah6K/c1T5ZluQqbS1mDhv2bM= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0840.namprd21.prod.outlook.com (10.173.192.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.218.2; Wed, 1 Nov 2017 04:42:14 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0218.004; Wed, 1 Nov 2017 04:42:14 +0000 From: Mike Jones To: Dick Hardt CC: "Phil Hunt (IDM)" , Yaron Sheffer , "Richard Backman, Annabelle" , ID Events Mailing List Thread-Topic: [Id-event] Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9aLyXLkAgAEBjXCAB9BnAIAAT1IAgAAUagCAAQQ9AIAANauAgAAlNACAAAV2gIABcZJQgACUvYCAAADCcA== Date: Wed, 1 Nov 2017 04:42:14 +0000 Message-ID: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.85.199] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0840; 6:5lamve/1XsSqa8bgrXR3b2Zj8KheAwJGVQyGty/5gcrbKyrkQRRDTa+s4mbL2oT7qKVQ81wEuhY0xTF4hHl9CyWkuOa0YulfO6ECYGRmveq150xgiTODcgVpI93tCW7Lo9X4UE8VPxANQ76YY/80IX7BeMkUtFaGtaIBBUE1qN+UyS5PJNyRLY30/+mDwx0dOR/R6eJhxqHW60Bck5nAvJrAhlJRpks/0CtoOvycdTegipRLQtZwC6fAhm0wwe8XMLdp8Fj+EObMm3S+AyPQRSTXtms0KA0gO4X+DqKmNNZDAMrM2NTJQ7m+Cy4uLjMjb0gHy70lXJs81kyF7BluJATvZug6OC1+9qnXkJlVjLM=; 5:cSXbroXn18bek4yRlpGbGkNthd+fwAOqrvveTkB2UKvFfT6+YYpobUT2+zI+u6iUzGviD5S1vyOCIchPpLn6nmLdAXxzNR699CvNcMfT9k2VNh+4H9CexoIsg0RwlNciaduiGTjhOYPAhVhiyFlIE1+02hCHgHKq8G20zXybsAM=; 24:nKeOi939jEwUFfME18WoBupOo3Ny5NJgl8iPf2OeuQyjdAfMfJxkvETF5I53Ur31tCihevlrkCtLsyu4+kAgZD/suWCN4tCWYOxdUWLUYBM=; 7:eZycmN7mLUpRDBiU3IzFhAym6VeZjuz+B+achpUCC6V1jjZHAVa4YmzGYppDZQ64l+tZq05Zw+Rq+g1nQoz19qxyayUfPE4ytRX3iXouf72HM7QZwPpjl/tlOlhaaA1KPPonj0RDNSd21RVOIrvPKv0zK+2BQ932SXsvdJu99btgmyT9eTYFFkFJrDCpaZ9eql8Zil1xULjozuZaTtu+2y2UQXyZQ6J2cvT2ZijQY4lLCRZAenpLzXOWDDfe1Qls x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 1487683f-4268-4bec-020e-08d520e2ec8d x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(2017052603238); SRVR:CY4PR21MB0840; x-ms-traffictypediagnostic: CY4PR21MB0840: x-exchange-antispam-report-test: UriScan:(10436049006162)(89211679590171)(192374486261705)(33061846794335)(100405760836317)(21748063052155)(5213294742642)(146099531331640)(47284530071512)(17755550239193); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(8121501046)(5005006)(3231020)(100000703101)(100105400095)(3002001)(93006095)(93001095)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123558100)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0840; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0840; x-forefront-prvs: 0478C23FE0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(39860400002)(346002)(47760400005)(51914003)(51444003)(189002)(24454002)(199003)(236005)(53376002)(33656002)(76176999)(6246003)(3660700001)(54356999)(561944003)(551934003)(55016002)(53946003)(50986999)(6916009)(10090500001)(101416001)(9686003)(74316002)(39060400002)(14454004)(6306002)(53386004)(16200700003)(2950100002)(54896002)(99286003)(5660300001)(86362001)(8676002)(53936002)(106356001)(3846002)(8936002)(7066003)(81156014)(575784001)(86612001)(105586002)(7736002)(81166006)(790700001)(4326008)(2906002)(19609705001)(7696004)(72206003)(966005)(3280700002)(68736007)(316002)(53546010)(25786009)(229853002)(10290500003)(8990500004)(478600001)(606006)(2900100001)(22452003)(93886005)(102836003)(54906003)(66066001)(6506006)(189998001)(97736004)(551544002)(6436002)(77096006)(6116002)(559001)(579004)(569006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0840; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504E322952C6E74296341C0F55F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1487683f-4268-4bec-020e-08d520e2ec8d X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Nov 2017 04:42:14.4592 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0840 Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 04:42:26 -0000 --_000_CY4PR21MB0504E322952C6E74296341C0F55F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBoZWFyIHlvdSBvbiB0aGUgZmFjdCB0aGF0IGRpZmZlcmVudCBwZW9wbGUgaGF2ZSBqb2luZWQg dGhlIGVmZm9ydCBhdCBkaWZmZXJlbnQgdGltZXMuICBUaGF04oCZcyBhIG5vcm1hbCBwcm9jZXNz IGFzIGFuIGVmZm9ydCBidWlsZHMgbW9tZW50dW0uICBJIGdldCB0aGF0IG5vdCBldmVyeW9uZSB3 YXMgdGhlcmUgd2hlbiBwcmV2aW91cyBjb25zZW5zdXMgY2FsbHMgd2VyZSB0YWtlbi4NCg0KSSBz aG91bGQgbm90ZSB0aGF0IEkgaGF2ZSBzcGVjaWZpYyB0ZWNobmljYWwgb2JqZWN0aW9ucyB0byB0 aGUgc3BlY2lmaWMgcHJvcG9zZWQgY2hhbmdlcyBiZWluZyBkaXNjdXNzZWQgYXMgd2VsbC4gIEN1 cnJlbnRseSBhbGwgZXZlbnRzIGluIHRoZSBzZXQgaGF2ZSB0aGUgc2FtZSBzeW50YXguICBUaGUg cHJvcG9zYWxzLCBhcyBJIHVuZGVyc3RhbmQgdGhlbSwgcmV2ZXJ0IHVzIHRvIGEgc3RhdGUgd2hl cmUgdGhlcmXigJlzIGEg4oCccHJpbWFyeeKAnSBhbmQg4oCcc2Vjb25kYXJ54oCdIGV2ZW50cywg d2l0aCBkaWZmZXJlbnQgc3ludGF4IGZvciB0aGUgdHdvIGNsYXNzZXMuICBUaGF04oCZcyBuZWVk bGVzc2x5IG1vcmUgY29tcGxpY2F0ZWQsIGFkZGluZyBubyBhY3R1YWwgdmFsdWUuDQoNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAtLSBNaWtlDQoNCkZyb206IERpY2sgSGFyZHQgW21haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNv bV0NClNlbnQ6IFR1ZXNkYXksIE9jdG9iZXIgMzEsIDIwMTcgOTozNyBQTQ0KVG86IE1pa2UgSm9u ZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4NCkNjOiBQaGlsIEh1bnQgKElETSkgPHBo aWwuaHVudEBvcmFjbGUuY29tPjsgWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29t PjsgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb20+OyBJRCBF dmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbSWQt ZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/DQoNCk1pa2UNCg0K QXMgeW91IHdlbGwga25vdywgbWFueSBwZW9wbGUgaW4gYSBXRyBkb24ndCBsb29rIGNsb3NlbHkg YXQgYSBzcGVjaWZpY2F0aW9uIHVudGlsIGxhc3QgY2FsbCBpcyBtYWRlLiBBZGRpdGlvbmFsbHks IHdlIGFyZSBjb21pbmcgdXAgb24gb25seSB0aGUgM3JkIFdHIG1lZXRpbmcuIFRoZSBXRyBoYXMg bm90IGV4aXN0ZWQgZm9yIHZlcnkgbG9uZy4gV2hpbGUgc29tZSBvZiB0aGUgcGFydGljaXBhbnRz IGhhdmUgYmVlbiB3b3JraW5nIG9uIHRoaXMgZm9yIGEgd2hpbGUsIG1hbnkgaGF2ZSBub3QsIGFu ZCB3ZSBhcmUgbG9va2luZyBmb3IgY29uc2Vuc3VzIGFjcm9zcyB0aGUgV0cuDQoNClNpbmNlIFNl Y0V2ZW50IGlzIGEgZnJhbWV3b3JrIHRoYXQgd2UgZXhwZWN0IHRvIGJlIHByb2ZpbGVkLCBJIGZl ZWwgaXQgaXMgaW1wb3J0YW50IHRvIGVuc3VyZSB0aGF0IFNlY0V2ZW50IHNwZWNpZmljYXRpb25z IGFyZSBlYXN5IGZvciBhIHZhcmlldHkgb2YgcHJvZmlsZXMgdG8gYWRvcHQsIGFuZCB0aGF0IHRo ZSBzZW1hbnRpY3MgbWFrZSBzZW5zZS4gSSBhbHNvIHRoaW5rIHRoYXQgcHJvcGVydGllcyB0aGF0 IGFyZSBzcGVjaWZpYyB0byBhIHByb2ZpbGUgc2hvdWxkIGJlIGxlZnQgdG8gdGhhdCBwcm9maWxl IGFuZCBub3QgYmUgaW5jbHVkZWQgaW4gU2VjRXZlbnQuDQoNClNpbmNlIHRoaXMgaXMgYSBmcmFt ZXdvcmssIGl0IGlzIGV4cGVjdGVkIHRoYXQgYXMgZGlmZmVyZW50IGdyb3VwcyBwcm9maWxlIGl0 LCB0aGVyZSB3aWxsIGJlIGFkZGl0aW9uYWwgZmVlZGJhY2suDQoNClNwZWNpZmljYWxseSwgYXMg YSBwYXJ0aWNpcGFudCBpbiB0aGUgUklTQyBwcm9maWxlIG9mIFNFVCwgYSBudW1iZXIgb2YgaXNz dWVzIGluIFNFVCBoYXZlIHN1cmZhY2VkIGFzIHRoZSBSSVNDIFdHIGhhcyBsb29rZWQgYXQgaG93 IHRvIHVzZSB0aGUgU0VULg0KDQpBcyBmb3IgU0VUIGJlaW5nIHN0YWJsZSBmb3Igb3ZlciBhIHll YXIsIHRoZXJlIGhhdmUgYmVlbiBhIG51bWJlciBvZiBjaGFuZ2VzIHRvIFNFVCBzaW5jZSB0aGVu LiBJIGFsc28gZG9uJ3QgdGhpbmsgdGhlcmUgd2FzIGNvbnNlbnN1cy4gQmVmb3JlIHRoZSBXRyB3 YXMgZm9ybWVkLCBJIGFuZCBzZXZlcmFsIG90aGVycyBoYWQgZXhwcmVzc2VkIGNvbmNlcm4gb24g dGhlIGRlc2lnbiBvZiBTRVQgd2hlbiBQaGlsIHByZXNlbnRlZCBpdCBhdCBhbiBJSVcgc2Vzc2lv bi4NCg0KQXMgdG8gdGFraW5nIGFub3RoZXIgeWVhciwgSSBhbSBob3BlZnVsIHdlIGNhbiByZXNv bHZlIHRoZSByZW1haW5pbmcgaXNzdWVzIGluIFNFVCBhbmQgcHVibGlzaCBhIG5ldyBkcmFmdCBm b3IgbGFzdCBjYWxsLiBJIGRvIG5vdCB0aGluayB3ZSB3aWxsIG5lZWQgdG8gd2FpdCBmb3IgYW5v dGhlciBXRyBtZWV0aW5nIHRvIGFzayBmb3IgbGFzdCBjYWxsLg0KDQpXZSBhbHNvIGhhdmUgYSBu dW1iZXIgb2Ygb3RoZXIgZG9jdW1lbnRzIHRoYXQgYXJlIG5vdCBpbiBsYXN0IGNhbGwsIGFuZCB3 ZSBkb24ndCBoYXZlIGEgV0cgYWRvcHRlZCBkcmFmdCB5ZXQgZm9yIG1hbmFnZW1lbnQuIFNvIHRo ZXJlIGFyZSBzdGlsbCBhIG51bWJlciBvZiBkb2N1bWVudHMgdG8gd29yayB0aHJvdWdoIGJlZm9y ZSB3ZSBoYXZlIGFsbCB0aGUgYml0cyBmb3Igc29tZW9uZSB0byB3b3JrIHdpdGguDQoNCkkgZG8g dGhpbmsgd2UgaGF2ZSBiZWVuIG1ha2luZyBnb29kIHByb2dyZXNzIHNpbmNlIHRoZSBsYXN0IElF VEYgbWVldGluZywgYW5kIEkgYW0gaG9wZWZ1bCB3ZSBjYW4ga2VlcCB1cCB0aGlzIG1vbWVudHVt IGFuZCBmaW5hbGl6ZSBhbGwgdGhlIGRvY3VtZW50cyBpbiBhIHRpbWVseSBtYW5uZXIuDQoNCi9E aWNrDQoNCg0KT24gVHVlLCBPY3QgMzEsIDIwMTcgYXQgMTI6NDggUE0sIE1pa2UgSm9uZXMgPE1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPj4gd3JvdGU6DQpJdOKAmXMgaGFyZCBmb3IgbWUgdG8gZXZlbiBleHByZXNzIG15IGxldmVs IG9mIGZydXN0cmF0aW9uIHdpdGggdGhlIHJlY2VudCBhdHRlbXB0cyB0byBvbmNlIGFnYWluIHJl ZGVzaWduIHRoZSBTZWNFdmVudCBUb2tlbiBzcGVjLiAgV2XigJl2ZSBiZWVuIGF0IHRoaXMgZm9y IG11bHRpcGxlIHllYXJzIGJlY2F1c2UgcGVvcGxlIGtlZXAgdHJ5aW5nIHRvIHJldmlzaXQgZGVj aXNpb25zIHRoYXQgd2VyZSBsb25nIGFnbyBtYWRlIGJ5IGNvbnNlbnN1cy4gIEl04oCZcyBiZWVu IHN0YWJsZSBmb3Igb3ZlciBhIHllYXIgYW5kIHRoZSBtYWpvcml0eSBvZiBXR0xDIHJlc3BvbmRl bnRzIHNhaWQgc29tZSB2YXJpYW50IG9mIOKAnFdvcmtzIGZvciBtZSDigJMgc2hpcCBpdCHigJ0N Cg0KVGhlcmXigJlzIG5vdCBzdWZmaWNpZW50IGp1c3RpZmljYXRpb24gdG8gdHJ5IHRvIHVuZG8g Y29uc2Vuc3VzIHBvc2l0aW9ucyB0aGF0IGhhdmUgYmVlbiBkZWJhdGVkIGFuZCBhZmZpcm1lZCBv dmVyIGFuZCBvdmVyLiAgQ291bnRlbmFuY2luZyB3aG9sZXNhbGUgY2hhbmdlcyBhdCB0aGlzIGxh dGUgZGF0ZSBpcyBjb3VudGVycHJvZHVjdGl2ZSBpbiB0aGUgZXh0cmVtZSENCg0KSXTigJlzIGZh ciBiZXR0ZXIgdGhhbiBnb29kIGVub3VnaCBhcy1pcy4gIEluIG15IGV4cGVyaWVuY2UsIGlmIHdl IHN0YXJ0IHJlZGVzaWduaW5nIGl0LCBpdCB3aWxsIHJlc3VsdCBpbiBhbm90aGVyIHllYXLigJlz IGRlbGF5LiAgSXQgZG9lcyBzb21ldGhpbmcgc2ltcGxlIGFuZCB1c2VmdWwuICBQbGVhc2UsIGxl dOKAmXMganVzdCBzaGlwIGl0LCBzbyBwZW9wbGUgY2FuIHJlbHkgb24gaXQuDQoNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoN CkZyb206IFBoaWwgSHVudCAoSURNKSBbbWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0 bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT5dDQpTZW50OiBNb25kYXksIE9jdG9iZXIgMzAsIDIwMTcg Mjo0MiBQTQ0KVG86IERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPG1haWx0bzpkaWNr LmhhcmR0QGdtYWlsLmNvbT4+DQpDYzogWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwu Y29tPG1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+PjsgUmljaGFyZCBCYWNrbWFuLCBBbm5h YmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+Pjsg TWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb20+PjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0 Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NCg0KU3ViamVjdDogUmU6IFtJZC1ldmVu dF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD8NCg0KSW5saW5lLi4uDQoN ClBoaWwNCg0KT24gT2N0IDMwLCAyMDE3LCBhdCAyOjIyIFBNLCBEaWNrIEhhcmR0IDxkaWNrLmhh cmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3cm90ZToNCkhpIFBo aWwNCg0KQ29ycmVjdCBtZSBpZiBJIGFtIG1pc3VuZGVyc3RhbmRpbmcsIGJ1dCB0aGVyZSBpcyBh IFJJU0MgcHJvZmlsZSBldmVudA0KDQoNCg0KImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2Vj ZXZlbnQvcmlzYy9ldmVudC10eXBlLzxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQt MkR0eXBlXy0yNTVDJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVC NjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEm bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9MjVsMDlzSDhZ VjQyeHpnVS1DWFNnOHhIOXR2eURKejQwdENSakZhbGhrdyZlPT5hY2NvdW50LWNyZWRlbnRpYWwt Y2hhbmdlLXJlcXVpcmVk4oCdDQoNCg0KYW5kIGFuIFNDSU0gcHJvZmlsZSBldmVudA0KDQoNCiJo dHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dOKAnQ0KDQoNCkkn bSBzdWdnZXN0aW5nIHRoYXQgdHdvIGRpZmZlcmVudCBldmVudHMgd291bGQgYmUgc2VudC4gRW1i ZWRkaW5nIG9uZSBpbiB0aGUgb3RoZXIgZG9lcyBub3QgbWFrZSBzZW5zZS4NCjxwaD5JdCBpcyBh IGh5cG90aGV0aWNhbCBleGFtcGxlLiBKdXN0IGJlY2F1c2UgeW91IGRpc2FncmVlIG9uIHRoaXMg ZG9lcyBub3QgbWVhbiBvdGhlcnMgYXJlIG5vdCB2YWxpZC4NCg0KSSBqdXN0IHBpY2tlZCBvdmVy bGFwcGluZyBwcm9wb3NhbHMgdGhhdCBoYXZlIGRpZmZlcmVudCBtZWFuaW5nIChidXQgbm90IHRo ZSBzYW1lKSB0byBpbGx1c3RyYXRlIHRoZSBkaWZmZXJlbmNlIGZyb20gaXNzdWluZyBhIHNpbmds ZSBzZXQgd2l0aCBkaWZmZXJlbnQgZXZlbnRzLg0KDQpBcyBJIGhhdmUgc3RhdGVkIHRoaXMgaXMg dmVyeSBkaWZmZXJlbnQgZnJvbSBhc3NlcnRpbmcgbXVsdGlwbGUgZGlzdGluY3QgZXZlbnRzIGlu IG9uZSBTRVQuDQoNCkFsc28sIEkgdGhpbmsgaXQgaXMgc2ltcGxlciB0byBoYXZlIGV2ZW50X3R5 cGUgYmUgYXQgdGhlIHNhbWUgbGV2ZWwgYXMgZXZlbnQNCg0KPHBoPm1heSBiZS4gSSB3YXMgd29y a2luZyBmcm9tIEFubmFiZWxsZSdzIHByb3Bvc2VkIGZvcm1hdC4NCg0Kew0KICAianRpIjogIjNk MGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwIiwNCiAgImlhdCI6IDE0NTg0OTYwMjUsDQog ICJpc3MiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiwNCiAgImF1ZCI6IFsNCiAgICAiaHR0 cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0K ICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3 NmVlNyINCiAgIF0sDQogICAiZXZlbnRfdHlwZSI6ICJodHRwczovL2V4YW1wbGUuY29tL3NjaW0v ZXZlbnQvcGFzc3dvcmRSZXNldEV4dCIsDQogICAiZXZlbnQiOiB7DQogICAgICAgICAiaWQiOiI0 NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5IiwNCiAgICAgICAgICJyZXNldEF0dGVtcHRzIjo1DQog ICAgICAgfQ0KfQ0KDQp7DQogICJqdGkiOiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdk MzAiLA0KICAiaWF0IjogMTQ1ODQ5NjAyNSwNCiAgImlzcyI6ICJodHRwczovL3NjaW0uZXhhbXBs ZS5jb20iLA0KICAiYXVkIjogWw0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMv OThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIsDQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNv bS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ig0KICAgXSwNCiAgICJldmVudF90eXBl IjogImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL2Fj Y291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQ8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9y aXNjX2V2ZW50LTJEdHlwZV9hY2NvdW50LTJEY3JlZGVudGlhbC0yRGNoYW5nZS0yRHJlcXVpcmVk JmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZy PW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1peVZuclptcjlf dUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9blF5OWV6UFJqREdkdlJUQ2FpRHRp NE9IZWxIM0RLZ1VDVEtqRjJHUS1zbyZlPT4iLA0KICAgImV2ZW50Ijogew0KICAgICAgIOKAnHN1 YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSwNCiAgICAgICDigJxpc3PigJ06Imh0dHBzOi8vaWRw LmV4YW1wbGUuY29tLyINCiAgICAgICB9DQp9DQoNCg0KDQoNCg0KT24gTW9uLCBPY3QgMzAsIDIw MTcgYXQgMTI6MDkgUE0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpBbm5hYmVsbGUvRGljaywNCg0KVGhhbmtzIGZv ciB0aGUgY29tbWVudHMuIEkgdGhpbmsgd2UgbmVlZCB0byBleGFtaW5lIHRoZSBjb25zZXF1ZW5j ZXMgb2YgdGhlIHByb3Bvc2FsIGluIEpTT04uDQoNCkFzIEkgc3RhdGVkLCB3aGF0IGNhdXNlcyBt b3N0IG9mIHRoZSBpc3N1ZSBpcyB0aGUgcHJvcG9zZWQgZXh0ZW5zaW9uIG1lY2hhbmlzbSBpbiB0 aGUgcGF5bG9hZCAocG9zc2libHkgdXNpbmcgZXZlbnRzIGluIGEgcmVjdXJzaXZlIHdheSkuIERv ZXMgaXQgZm9sbG93IHRoZSBvbGQgZm9ybWF0IG9yIHRoZSBuZXc/DQoNCkxldOKAmXMgIGNvbnNp ZGVyIGEgdXNlIGNhc2Ugd2hlcmUgd2UgaGF2ZSBhbiBpZGVudGl0eSBtYW5hZ2VtZW50IHN5c3Rl bSB0aGF0IHVzZXMgU0NJTSwgYnV0IHRoZSBTQ0lNIHN5c3RlbSBpcyBhbHNvIHRoZSB1bmRlcmx5 aW5nIGRhdGEgc3RvcmUgZm9yIENvbm5lY3QuICBBIFBhc3N3b3JkIHJlc2V0IG1pZ2h0IGdlbmVy YXRlIHRoZSBmb2xsb3dpbmcgZXZlbnQgd2hpY2ggaGFzIGFuIGV4dGVuc2lvbiAoY29udmV5aW5n IHJlc2V0IGNvdW50KSBBTkQgb3ZlcmxhcHBpbmcgc3RhdGVtZW50IGZyb20gUklTQy4gIEJPVEgg b2Ygd2hpY2ggbWlnaHQgYmUgaW1wb3J0YW50IHRvIGEgc2ltaWxhciByZWNlaXZlciB1c2luZyBT Q0lNIGFuZCBPSURDLg0KDQpUaGUgMDMgc3BlYyBjdXJyZW50bHkgd291bGQgYWxsb3c6DQoNCg0K ew0KDQogICJqdGkiOiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAiLA0KDQogICJp YXQiOiAxNDU4NDk2MDI1LA0KDQogICJpc3MiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiwN Cg0KICAiYXVkIjogWw0KDQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1 MjQ2MWZhNWJiYzg3OTU5M2I3NzU0IiwNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20v RmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyINCg0KICAgXSwNCg0KICAgImV2ZW50cyI6 IHsNCg0KICAgICAidXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6cGFzc3dvcmRSZXNldCI6DQoN CiAgICAgICB7ICJpZCI6IjQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDkifSwNCg0KICAgICAiaHR0 cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiOg0KDQogICAgICAg eyAicmVzZXRBdHRlbXB0cyI6NX0sDQoNCiAgICAgImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQv c2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL1w8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2 ZW50LTJEdHlwZV8tMjU1QyZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJ ck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRL Wk5BJm09aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTI1bDA5 c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlESno0MHRDUmpGYWxoa3cmZT0+DQogICAgICAgYWNjb3Vu dC1jcmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZCI6IHsNCg0KICAgICAgICAg4oCcc3Vi4oCdOuKA nTczNzU2MjZBNjU2Mzc04oCdLA0KDQogICAgICAgICDigJxpc3PigJ06Imh0dHBzOi8vaWRwLmV4 YW1wbGUuY29tLyINCg0KICAgICAgIH0NCg0KICB9DQoNCn0NCg0KDQoNCkluIHRoZSBhYm92ZSAt IGVhY2ggcGF5bG9hZCBpcyBhIOKAmHBlZXInIGFuZCBpc3N1ZWQgd2l0aG91dCBwcmVmZXJlbmNl IGJ5IHRoZSB0cmFuc21pdHRlci4gVGhlIHJlY2VpdmVyIGNhbiBhc3NpZ24gcHJpb3JpdHkgaW4g aXRzIG93biBjb250ZXh0IGlmIHRoYXQgbWF0dGVycy4NCg0KDQoNClRoZSBuZXcgcHJvcG9zYWw6 DQoNCg0KDQp7DQoNCiAgImp0aSI6ICIzZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCIs DQoNCiAgImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAgImlzcyI6ICJodHRwczovL3NjaW0uZXhhbXBs ZS5jb20iLA0KDQogICJhdWQiOiBbDQoNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0Zl ZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0KDQogICAgImh0dHBzOi8vamh1Yi5leGFt cGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ig0KDQogICBdLA0KDQogICAi ZXZlbnQiOiB7DQoNCiAgICAg4oCcZXZlbnRfdHlwZeKAnToidXJuOmlldGY6cGFyYW1zOnNjaW06 ZXZlbnQ6cGFzc3dvcmRSZXNldOKAnSwNCg0KICAgICAiaWQiOuKAnTQ0ZjYxNDJkZjk2YmQ2YWI2 MWU3NTIxZDnigJ0sDQoNCiAgICAg4oCcZXZlbnRz4oCdOnsNCg0KICAgICAtPm5vdGUg4oCmaXMg dGhpcyB0aGUgb2xkIG9yIG5ldyBzdHJ1Y3R1cmU/IDwtDQoNCiAgICAgICAiaHR0cHM6Ly9leGFt cGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiOg0KDQogICAgICAgICB7ICJyZXNl dEF0dGVtcHRzIjo1fSwNCg0KICAgICAgICJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2 ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRfcmlzY19ldmVudC0y RHR5cGVfLTI1NUMmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2 NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZt PWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmcz0yNWwwOXNIOFlW NDJ4emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmU9Pg0KICAgICAgICAgYWNjb3VudC1j cmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZCI6IHsNCg0KICAgICAgICAg4oCcc3Vi4oCdOuKAnTcz NzU2MjZBNjU2Mzc04oCdLA0KDQogICAgICAgICDigJxpc3PigJ06Imh0dHBzOi8vaWRwLmV4YW1w bGUuY29tLyINCg0KICAgICAgIH0NCg0KICAgICB9DQoNCiAgIH0NCg0KfQ0KDQoNCg0KSW4gdGhl IGFib3ZlLCBzdWItZXZlbnRzIG9yIGV4dGVuc2lvbnMgaGF2ZSBhIGRpZmZlcmVudCBmb3JtYXQu IFRoZSBzYW1lIGNvbXBsYWludCBhYm91dCB0aGUgb3JpZ2luYWwgc3RhbmRzLg0KDQoNCg0KKk9S KiAoaWYgdGhlIHJlY2VpdmVyIGNhcmVzIGFib3V0IFJJU0MgbW9yZSkuICBOb3RlIHRoYXQgdGhp cyBsZWFkcyB0byBhIHRyaXBsZSBuZXN0ZWQgc3RydWN0dXJlLg0KDQoNCg0Kew0KDQogICJqdGki OiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAiLA0KDQogICJpYXQiOiAxNDU4NDk2 MDI1LA0KDQogICJpc3MiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiwNCg0KICAiYXVkIjog Ww0KDQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3 OTU5M2I3NzU0IiwNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0 NTE2YjFkMDg2NDFkNzY3NmVlNyINCg0KICAgXSwNCg0KICAgImV2ZW50Ijogew0KDQogICAgIOKA nGV2ZW50X3R5cGXigJ06Imh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9l dmVudC10eXBlL1w8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1 QyZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUm cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09aXlWbnJabXI5 X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTI1bDA5c0g4WVY0Mnh6Z1UtQ1hT Zzh4SDl0dnlESno0MHRDUmpGYWxoa3cmZT0+DQoNCiAgICAgICAgICAgICBhY2NvdW50LWNyZWRl bnRpYWwtY2hhbmdlLXJlcXVpcmVk4oCdLA0KDQogICAgICDigJxzdWLigJ064oCdNzM3NTYyNkE2 NTYzNzTigJ0sDQoNCiAgICAgIOKAnGlzc+KAnToiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v4oCc LA0KDQogICAgICDigJxldmVudHPigJ06ew0KDQogICAgICAgICJ1cm46aWV0ZjpwYXJhbXM6c2Np bTpldmVudDpwYXNzd29yZFJlc2V0IjoNCg0KICAgICAgICB7DQoNCiAgICAgICAgICAiaWQiOuKA nTQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDnigJ0sDQoNCiAgICAgICAgICDigJxldmVudHPigJ06 ew0KDQogICAgICAgICAgICAgImh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29y ZFJlc2V0RXh0IjoNCg0KICAgICAgICAgICAgICAgeyAicmVzZXRBdHRlbXB0cyI6NX0sDQoNCiAg ICAgICAgICB9DQoNCiAgICAgICAgfQ0KDQogICAgICB9DQoNCiAgIH0NCg0KfQ0KDQoNCg0KSW4g dGhlIGFib3ZlLCB0aGUgZXh0ZW5zaW9uIGlzIHBsYWNlZCBpbnNpZGUgdGhlIGV2ZW50IGl0IGV4 dGVuZHMuIEl0IGZvbGxvd3MgdGhlIG9sZCBmb3JtYXQgKG9yIHNob3VsZCBpdCBmb2xsb3cgdGhl IG5ldz8pDQoNCipPUiogRm9sbG93aW5nIHRoZSB0b3AgbGF5ZXIgcGF0dGVybiBvZiBzaW5ndWxh ciBldmVudCAgTm90ZSB0aGF0IHRoaXMgbGVhZHMgdG8gYSB0cmlwbGUgbmVzdGVkIHN0cnVjdHVy ZS4NCg0KDQoNCnsNCg0KICAianRpIjogIjNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMw IiwNCg0KICAiaWF0IjogMTQ1ODQ5NjAyNSwNCg0KICAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFt cGxlLmNvbSIsDQoNCiAgImF1ZCI6IFsNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20v RmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIsDQoNCiAgICAiaHR0cHM6Ly9qaHViLmV4 YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciDQoNCiAgIF0sDQoNCiAg ICJldmVudCI6IHsNCg0KICAgICDigJxldmVudF90eXBl4oCdOiJodHRwOi8vc2NoZW1hcy5vcGVu aWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRf cmlzY19ldmVudC0yRHR5cGVfLTI1NUMmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBa aDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkx YUxjTE40S1pOQSZtPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cm cz0yNWwwOXNIOFlWNDJ4emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmU9Pg0KDQogICAg ICAgICAgICAgYWNjb3VudC1jcmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZOKAnSwNCg0KICAgICAg 4oCcc3Vi4oCdOuKAnTczNzU2MjZBNjU2Mzc04oCdLA0KDQogICAgICDigJxpc3PigJ06Imh0dHBz Oi8vaWRwLmV4YW1wbGUuY29tL+KAnCwNCg0KICAgICAg4oCcZXZlbnTigJ06ew0KDQogICAgICAg IOKAnGV2ZW50X3R5cGXigJ06InVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVz ZXTigJ0sDQoNCiAgICAgICAgImlkIjrigJ00NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ54oCdLA0K DQogICAgICAgIOKAnGV2ZW504oCdOnsNCg0KICAgICAgICAgIOKAnGV2ZW50X3R5cGXigJ06Imh0 dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh04oCdLA0KDQogICAg ICAgICAgInJlc2V0QXR0ZW1wdHMiOjUNCg0KICAgICAgICB9DQoNCiAgICAgIH0NCg0KICAgfQ0K DQp9DQoNCg0KDQpUaGlzIGZvcm1hdCBmb2xsb3dzIHRoZSBwcm9wb3NlZCBzaW5ndWxhciBldmVu dCBmb3JtYXQgcmVjdXJzaXZlbHkgYW5kIGlzIDMgbGF5ZXJzIGRlZXAuIE5vdGUgdGhhdCB0aGUg cGFyc2VyIGhhcyB0byBjb250aW51ZSB0byBzZWFyY2ggdGhlIGRvY3VtZW50IGZvciB0aGluZ3Mg dGhhdCBhcmVu4oCZdCB0aGVyZSBhcyBpdCBoYXMgdG8gc3RvcCB3aGVuIG5vIOKAnGV2ZW504oCd IGF0dHJpYnV0ZSBpcyBmb3VuZCByYXRoZXIgdGhhbiBpdGVyYXRlIG92ZXIgYW4gYXJyYXkuDQoN Cg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFy Y2hpdGVjdA0KQGluZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50 aWQuY29tJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJ X0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1peVZu clptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9OXNZaGdwRXpiN3hQbFFG bUNDWE5tSG82ZlFOOUlCdS1TSEphbWdfQjRIcyZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4NCg0KT24gT2N0IDMwLCAyMDE3LCBhdCA4OjU3IEFN LCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmFAYW1hem9uLmNvbTxtYWlsdG86 cmljaGFubmFAYW1hem9uLmNvbT4+IHdyb3RlOg0KDQpSZXBsaWVzIGlubGluZS4NCg0KLS0NCkFu bmFiZWxsZSBSaWNoYXJkIEJhY2ttYW4NCklkZW50aXR5IFNlcnZpY2VzDQoNCg0KRnJvbTogUGhp bCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+ Pg0KRGF0ZTogU3VuZGF5LCBPY3RvYmVyIDI5LCAyMDE3IGF0IDU6MjUgUE0NClRvOiBEaWNrIEhh cmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+Pg0K Q2M6IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbTxtYWlsdG86eWFyb25mLmll dGZAZ21haWwuY29tPj4sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxt YWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4sICJSaWNoYXJkIEJhY2ttYW4sIEFu bmFiZWxsZSIgPHJpY2hhbm5hQGFtYXpvbi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+ PiwgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2 ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVs dGlwbGUgZXZlbnRzIHBlciBTRVQ/DQoNCkkgaG9wZSB0aGlzIGFuc3dlcnMgeW91ciBxdWVzdGlv bi4NCg0KTXkg4oCcbWF54oCdIHdhcyBiZWNhdXNlIEkgY2Fu4oCZdCBzZWUgYSByZWFzb24gd2h5 IG5vdC4gVGhlIHF1ZXN0aW9uIHNob3VsZCBiZSwgd2hhdCBpcyB0aGUganVzdGlmaWNhdGlvbiB0 byBtYWtlIOKAnGV2ZW50c+KAnSBzaW5ndWxhcj8NCltyaWNoYW5uYV1UaGUgc2luZ3VsYXIg4oCc ZXZlbnTigJ0gY2xhaW0gaGFzIGNsZWFyZXIgc2VtYW50aWNzIGFuZCBpcyBlYXNpZXIgdG8gcHJv Y2Vzcy4gV2Ugc2hvdWxkIG9wdCBmb3IgZWFzaWVyIHNvbHV0aW9ucyB1bmxlc3MgdGhlcmUgYXJl IHVzZSBjYXNlcyB0aGF0IHJlcXVpcmUgbW9yZSBjb21wbGV4aXR5LlsvcmljaGFubmFdDQoNClRo ZXJlIGFyZSBtYW55IHJlYXNvbnMgZm9yIG11bHRpcGxlIGV2ZW50cyBpbiBhIFNFVC4gIFNvbWUg YXJlIGdvb2QsIHNvbWUgbm90IHNvIGdvb2QuIFNvbWUgb2YgdGhlIHJlYXNvbnMuLi4NCg0KMS4g IE11bHRpcGxlIGV2ZW50IHBheWxvYWRzIGV4cHJlc3Npbmcgc3RhdGVtZW50cyBhYm91dCBsYXJn ZWx5IHRoZSAqc2FtZSp0aGluZy4gRm9yIGV4YW1wbGUsIFNDSU0gcGFzc3dvcmQgcmVzZXQgQU5E IFJJU0MgcGFzc3dvcmQgcmVzZXQuICBBIFJJU0MgRXZlbnQgYW5kIGFuIE9wZW5CYW5raW5nIEV2 ZW50LiBJcyBvbmUgYSBjb21wbGVtZW50IHRvIHRoZSBvdGhlcj8gIERvIHRoZXkgb3ZlcmxhcCBv ciBhcmUgdGhleSBkaXN0aW5jdD8NCltyaWNoYW5uYV1Db3B5L3Bhc3RlZCBmcm9tIG15IGVhcmxp ZXIgZW1haWw6DQpXaHkgaXMgaXQgbmVjZXNzYXJ5IG9yIGFwcHJvcHJpYXRlIHRvIGluY2x1ZGUg dGhlc2UgZXZlbnRzIGluIHRoZSBzYW1lIFNFVD8gVGhleSBhcmUgbGlrZWx5IGJlaW5nIGdlbmVy YXRlZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBhdCBkaWZmZXJlbnQgdGltZXMgb24gdGhlIHRyYW5z bWl0dGVy4oCZcyBzaWRlLCBjb25zdW1lZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBvbiB0aGUgcmVj ZWl2ZXLigJlzIHNpZGUsIGFuZCBwb3NzaWJseSBiZWluZyB0cmFuc21pdHRlZCBvdmVyIGRpZmZl cmVudCBldmVudCBzdHJlYW1zLiBJIGtub3cgdGhlIGxhdHRlciB3b3VsZCBiZSB0aGUgY2FzZSBm b3IgdXMsIGFzIGEgcmVjZWl2ZXIuIEV2ZW4gaWYgaXTigJlzIG5vdCwgaXMgaXQgYnVyZGVuc29t ZSB0byBzZW5kIHRoZXNlIGV2ZW50cyBzZXBhcmF0ZWx5PyBXaGF0IHZhbHVlIGlzIGdhaW5lZCBp biBjb21iaW5pbmcgdGhlbT8NCg0KQWRkaXRpb25hbGx5LCBzaW5jZSB0aGUgc2lnbmF0dXJlIGlz IG92ZXIgdGhlIFNFVCBhbmQgbm90IHRoZSBldmVudCBvYmplY3RzLCBSZWNlaXZlcnMgaW5kZXBl bmRlbnRseSByb3V0ZSBzZXBhcmF0ZSBldmVudHMgZnJvbSBhIHNpbmdsZSB0b2tlbiB3aXRob3V0 IGVpdGhlciBsb3NpbmcgdGhlIGFiaWxpdHkgdG8gdmVyaWZ5IHRoZSBhdXRoZW50aWNpdHkgb2Yg dGhlIGV2ZW50IG9yIHNoYXJpbmcgYWxsIGluZm9ybWF0aW9uIGluIHRoZSBTRVQgd2l0aCBldmVy eSBzeXN0ZW0gaGFuZGxpbmcgYW55IGV2ZW50IGluIHRoZSB0b2tlbi5bL3JpY2hhbm5hXQ0KDQoy LiAgTXVsdGlwbGUgZXZlbnRzIHBheWxvYWRzIGV4cHJlc3NpbmcgZGlmZmVyZW50IHN0YXRlbWVu dHMgYWJvdXQgdGhlIHNhbWUgdHJhbnNhY3Rpb24gLSBSSVNDIFBhc3N3b3JkIFJlc2V0IGFuZCBS SVNDIFNlc3Npb24gQ2FuY2VsDQpbcmljaGFubmFdU2FtZSBhcyBhYm92ZVsvcmljaGFubmFdDQoz LiAgQSBuZXcgcHJvZmlsZSBkZWZpbmVzIG5ldyBldmVudCBhdHRyaWJ1dGVzIHRvIGJlIGFkZGVk IG9uIHRvIGFuIGV4aXN0aW5nIGV2ZW50IHR5cGUgKGEgcHVyZSBleHRlbnNpb24pDQpbcmljaGFu bmFdSSBoYXZlIHN1Z2dlc3RlZCBhIHdheSB0byBzdXBwb3J0IGV4dGVuc2lvbnMgd2l0aGluIGFu IGV2ZW50IGJvZHksIG11bHRpcGxlIHRpbWVzIG5vdy4gSWYgeW91IHNlZSBwcm9ibGVtcyB3aXRo IGl0LCBwbGVhc2UgcG9pbnQgdGhlbSBvdXQuWy9yaWNoYW5uYV0NCg0KSSB0aGluayBpdCBpcyBx dWl0ZSB2YWxpZCB0byBhbGxvdyAxIGFuZCAzLiAgMiBjb3VsZCBiZSBsaW1pdGVkIGJ5IHNwZWNp ZmljIHByb2ZpbGVzIGxpa2UgUklTQyBpZiB0aGV5IHdhbnQuDQoNCkkgYW0gbm90IGluIGFncmVl bWVudCB0aGF0IG1ha2luZyBldmVudCBzaW5ndWxhciBzaW1wbGlmaWVzIGFueXRoaW5nLiBGb3Ig b25lIGlzIG1ha2VzIGV4dGVuc2lvbnMgY29tcGxleCAoYW5vdGhlciBuZXN0ZWQgSlNPTiBzdHJ1 Y3R1cmUpIGFuZCBwb3RlbnRpYWxseSBjb25mbGljdGluZy4NCltyaWNoYW5uYV0NCldheXMgdGhh dCBtdWx0aXBsZS1ldmVudCBTRVRzIGFyZSBtb3JlIGNvbXBsaWNhdGVkOg0KDQogIDEuICBJdCBy ZXN1bHRzIGluIGEgbW9yZSBjb21wbGV4IHN0cnVjdHVyZSBmb3IgdGhlIHNpbmdsZSBldmVudCB1 c2UgY2FzZSwgd2hpY2ggSSB0aGluayB3ZSBhbGwgYWdyZWUgaXMgdGhlIG1ham9yaXR5IHVzZSBj YXNlLg0KICAyLiAgTXVsdGlwbGUtZXZlbnQgU0VUcyBoYXZlIGFtYmlndW91cyBzZW1hbnRpY3Mu IFRoZSBwcmVzZW5jZSBvZiB0d28gZXZlbnRzIEEgYW5kIEIgaW4gdGhlIHNhbWUgU0VUIGNvdWxk IG1lYW4gYW55IG9mOg0KDQogICAgICogICBUaGV5IGFyZSByZWxhdGVkIHRvIHRoZSBzYW1lIGxv Z2ljYWwgZXZlbnQgKGkuZS4gdGhlIHNhbWUgdGhpbmcgYXMgaWYgdGhleSB3ZXJlIGZyb20gZGlm ZmVyZW50IFNFVHMgdGhhdCBoYXZlIGEgY29tbW9uIHR4bikuDQogICAgICogICBBIGlzIGFuIGV4 dGVuc2lvbiBvZiBCLg0KICAgICAqICAgQiBpcyBhbiBleHRlbnNpb24gb2YgQS4NCiAgICAgKiAg IFRoZXkgYXJlIGFsaWFzZXMgZm9yIG9uZSBhbm90aGVyLg0KICAgICAqICAgVGhleSBhcmUgbm90 IGFjdHVhbGx5IHJlbGF0ZWQgdG8gb25lIGFub3RoZXIgaW4gYW55IHdheS4NCg0KICAxLiAgQ2xh aW0gc2VtYW50aWNzIGJlY29tZSBoYXJkZXIgdG8gZGVmaW5lLCBhcyBkaWZmZXJlbnQgcHJvZmls ZXMgbWF5IHdhbnQgdG8gdXNlIHRoZSBzYW1lIGNsYWltcyBpbiBkaWZmZXJlbnQgd2F5cy4NCg0K SWYgdGhlIFdHIHdhbnRzIHRvIGJsb2NrIDEgYW5kIDIgYWJvdmUsIHRoZW4gSSBiZWxpZXZlIHdl IGhhdmUgdG8gZXN0YWJsaXNoIGFuIGV2ZW50IHJlZ2lzdHJ5IHRvIGVuc3VyZSBuZXcgRXZlbnQg cHJvZmlsZXMgZG8gbm90IG92ZXJsYXAgdG8gZWxpbWluYXRlIHRoZSBuZWVkIHRvIGV4cHJlc3Mg bXVsdGlwbGUgZXZlbnRzLg0KW3JpY2hhbm5hXUnigJltIG5vdCBzdXJlIHdoYXQgeW91IG1lYW4g YnkgdGhpcy4gQXJlIHlvdSByZWZlcnJpbmcgdG8gZXZlbnQgbmFtZXM/IFRob3NlIGFyZSBhbHJl YWR5IGRlZmluZWQgYnkgdGhlIHNwZWMgdG8gYmUgVVJJcy5bL3JpY2hhbm5hXQ0KUGhpbA0KDQpP cmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KQGlu ZGVwZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdN R2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZW ekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1VLWE1SEJORDBIYVRYNGFu Tlpmelg3cERzZks1ZjBoOW1aOUNaa2tHaWVjJnM9S0J3S1BGbnFZX1E5NUNUQV9fV0dDWUdUeHJE N0FHQ3h1ZW9QWG5LRVVUMCZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1 bnRAb3JhY2xlLmNvbT4NCg0KT24gT2N0IDI5LCAyMDE3LCBhdCA0OjEyIFBNLCBEaWNrIEhhcmR0 IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3cm90 ZToNCg0KUGhpbDoNCg0KSW4geW91ciBleGFtcGxlcyBmb3IgaGF2aW5nIGEgcGx1cmFsaXR5IG9m IGV2ZW50cywgeW91IHVzZSB0aGUgd29yZCAibWF5Iiwgd2hpY2ggbGVhZHMgbWUgdG8gcXVlc3Rp b24gaWYgYSBwbHVyYWxpdHkgb2YgZXZlbnRzIGlzIHJlYWxseSByZXF1aXJlZCBpbiBTRVQuDQoN CllvdSBwb3NpdCB0aGF0IGl0IHdpbGwgYmUgZGlmZmljdWx0IGZvciBhIGRpc3RyaWJ1dGVkIHN5 c3RlbSB0byBjb3JyZWxhdGUgbXVsdGlwbGUgU0VUcyB3aXRoIHRoZSBzYW1lICJ0eG4iLCBidXQg dGhlIGRpc3RyaWJ1dGVkIHN5c3RlbSB3aWxsIGNlcnRhaW5seSBuZWVkIHRvIGNvcnJlbGF0ZSBl dmVudHMgb24gdGhlIHNhbWUgc3ViamVjdCAtLSBjb3JyZWxhdGluZyBldmVudHMgb24gdGhlIHNh bWUgInR4biIgb24gdGhlIHNhbWUgc3ViamVjdCBzZWVtcyBmYWlybHkgc2ltcGxlLg0KDQpJIHRo aW5rIHRoYXQgYSByZWNlaXZlciB3aWxsIG5lZWQgdG8gY29ycmVsYXRlIG11bHRpcGxlIFNFdHMg b24gdGhlIHNhbWUgc3ViamVjdCwgc28gaGF2aW5nIG11bHRpcGxlIGV2ZW50cyBpbiBhIFNFVCBp cyByZWR1bmRhbnQsIGFuZCBhZGRzIGNvbXBsZXhpdHkgd2l0aCBubyBjbGVhciBiZW5lZml0IHRo YXQgSSBjYW4gc2VlLg0KDQpBbiBpbXBsZW1lbnRvciBtYXkgY2hvb3NlIHRvIHNlbmQgbXVsdGlw bGUgU0VUcywgb3Igc2VuZCBhIHNpbmdsZSBTRVQgd2l0aCBtdWx0aXBsZSBldmVudHMsIHNvIGEg cmVjZWl2ZXIgd2lsbCBuZWVkIHRvIHN1cHBvcnQgYm90aC4gSSBwcmVmZXIgd2UgcGljayBvbmUg d2F5IGFuZCBtaW5pbWl6ZSB0aGUgY29kZSBwYXRocywgYW5kIHdlIHdpbGwgbmVlZCB0byBzdXBw b3J0IGNvcnJlbGF0aW5nIGFjcm9zcyBtdWx0aXBsZSBTRVRzLCBzbyB0aGF0IHNlZW1zIHRoZSBi ZXN0IG1lY2hhbmlzbS4NCg0KTGV0IG1lIGtub3cgaWYgdGhlcmUgaXMgc29tZXRoaW5nIEkgbWlz c2VkIGluIG15IGxvZ2ljLg0KDQovRGljaw0KDQoNCk9uIFN1biwgT2N0IDI5LCAyMDE3IGF0IDEx OjI4IEFNLCBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9u Zi5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KSW4gdGhhdCBjYXNlLCBsZXQncyBhZGQgdGV4dCB0 byB0aGF0IGVmZmVjdCwgZS5nLiB3ZSBjb3VsZCBhZGQgdG8gdGhlIGRlZmluaXRpb24gb2YgdGhl ICJldmVudHMiIGNsYWltOg0KDQpQcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMgU0hPVUxEIGRlZmlu ZSB0aGUgYWxsb3dlZCBldmVudCBzdGF0ZW1lbnRzLCBhbmQgTUFZIHJlc3RyaWN0IHRoZWlyIG51 bWJlci4gRm9yIGV4YW1wbGUsIHNvbWUgcHJvZmlsZXMgbWF5IHJlcXVpcmUgdGhpcyBjbGFpbSB0 byBjb250YWluIG9ubHkgYSBzaW5nbGUgZXZlbnQgc3RhdGVtZW50Lg0KDQpUaGFua3MsDQogICAg ICAgIFlhcm9uDQoNCk9uIDI0LzEwLzE3IDIyOjEwLCBNaWtlIEpvbmVzIHdyb3RlOg0KSSBhZ3Jl ZSB3aXRoIG11Y2ggb2YgUGhpbOKAmXMgcmF0aW9uYWxlIGhlcmUuDQoNCkl04oCZcyBmaW5lIGZv ciBzb21lIHByb2ZpbGVzIHRvIHNheSB0aGF0IHRoZSDigJxldmVudHPigJ0gc2V0IG11c3QgYmUg YSBzaW5nbGV0b24uICBUaGF0IGRvZXNu4oCZdCBoYXZlIHRvIGJlIHRydWUgZm9yIGFsbCBldmVu dHMuICBJIHRoaW5rIHRoaW5ncyBhcmUgZmluZSBhcy1pcy4NCg0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoN CipGcm9tOiogSWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPG1haWx0 bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPl0gKk9uIEJlaGFsZiBPZiAqUGhpbCBIdW50DQoq U2VudDoqIE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyA4OjQ3IFBNDQoqVG86KiBSaWNoYXJkIEJh Y2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmFAYW1hem9uLmNvbTxtYWlsdG86cmljaGFubmFAYW1h em9uLmNvbT4+DQoqQ2M6KiBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9y ZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KKlN1YmplY3Q6KiBSZTogW0lkLWV2ZW50XSBV c2UgY2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgU0VUPw0KDQpBbm5hYmVsbGUsDQoNCkkg aGF2ZSBhIG51bWJlciBvZiBjb25jZXJucyB3aXRoIHRoaXMgcHJvcG9zYWwuDQoNClByb2ZpbGlu ZyBJbmRlcGVuZGVuY2UgLyBLZWVwaW5nIEV2ZW50IFBheWxvYWRzIEluZGVwZW5kZW50DQoNCklu ZGljYXRpbmcgdGhhdCBleHRlbnNpb25zIHNob3VsZCBiZSBoYW5kbGVkIGJ5IHByb2ZpbGVzIGxl YWRzIHRvIG1vcmUgaW50ZXItb3BlcmFiaWxpdHkgaXNzdWVzIGFuZCBtb3JlIGltcG9ydGFudGx5 IGludHJ1ZGVzIG9uIHRoZSBFdmVudCBwYXlsb2FkIHNwYWNlIGJ5IHN1Z2dlc3RpbmcgYSBzdWIt c2NoZW1hIGNyZWF0ZXMgcG90ZW50aWFsIGxpbWl0YXRpb25zIGFuZCBjb25mbGljdHMgdGhhdCBt YXkgYWRkIHRvIGNvbXBsZXhpdHkgbGF0ZXIgb24uIFRoZSBjdXJyZW50IGZvcm1hdCBhbGxvd3Mg YSBwYXJzZXIgdG8gZGlzY292ZXIgYW5kIHVubG9hZCBvbmUgb3IgbW9yZSBKU09OIHBheWxvYWRz IHdoaWNoIGNhbiBlYWNoIGhhdmUgaW5kZXBlbmRlbnQgc3RydWN0dXJlLg0KDQpHZW5lcmFsIGV4 dGVuc2lvbnMNCg0KVGhlIHByb3Bvc2FsIGFsc28gcnVsZXMgb3V0IGdlbmVyYWwgcHVycG9zZSBl eHRlbnNpb25zIG5vdCByZWxhdGVkIHRvIGFueSBzcGVjaWZpYyBldmVudC4gR2l2ZW4gdGhlIGVt ZXJnZW5jZSBvZiBpdGVtcyBsaWtlIEdQUkQsIEkgd291bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhl IGFiaWxpdHkgdG8gYWRkIG1ldGEtZGF0YSBvciBvdGhlciBnZW5lcmFsIHB1cnBvc2UgaXRlbXMu IFdlIGNhbiBhbHNvIGFudGljaXBhdGUgc29tZSBkZWxpdmVyeSBzY2VuYXJpb3Mgd2hlcmUgYWRk aXRpb25hbCBkYXRhIG1pZ2h0IGJlIHJlcXVpcmVkLiBFdmVuIHRob3VnaCB0aGVyZSBpcyBubyBj dXJyZW50IHBsYW5uZWQgdXNlLCBJIHNlZSBubyBnb29kIHJlYXNvbiB0byBydWxlIHRoaXMgb3V0 Lg0KDQpNdWx0aXBsZSBFdmVudHMgRnJvbSBEaWZmZXJlbnQgRmFtaWxpZXMgKHZzLiBNdWx0aXBs ZSBFdmVudHMgZnJvbSBhIHNpbmdsZSBmYW1pbHkgbGlrZSBSSVNDKQ0KDQpJbiBvdXIgUklTQyBz ZXNzaW9uIHdlIGRpc2N1c3NlZCBleHByZXNzaW5nIG11bHRpcGxlIGRpc3RpbmN0IFJJU0MgZXZl bnRzIGluIG9uZSBTRVQuIFRoZSBkaXNjdXNzaW9uIHdhcyB0aGF0IG9ubHkgb25lIFJJU0MgZXZl bnQgYXQgYSB0aW1lLiBXZSBkaWQgbm90IGRpc2N1c3Mgb3RoZXIgZXZlbnQgcHJvZmlsZXMuIEkg ZG9u4oCZdCBzZWUgYSByZWFzb24gdG8gcnVsZSBvdXQgbXVsdGktZXZlbnRzIGZyb20gZGlmZmVy ZW50IGZhbWlsaWVzIGF0IHRoZSBTRVQgbGV2ZWwuIEVhY2ggcHJvZmlsZSBpcyBleHByZXNzaW5n IHNsaWdodGx5IGRpZmZlcmVudCB0aGluZ3MgYWJvdXQgdGhlIHNhbWUgZXZlbnQuDQoNCkkgY2Fu IGZvcnNlZSBzb21lIGNhc2VzIHdoZXJlIGl0IGlzIG5vdCBjbGVhciB3aGljaCBpcyB0aGUgcHJp bWFyeSBhbmQgd2hpY2ggaXMgdGhlIGV4dGVuc2lvbi4gIFRoZXJlIG1heSBub3QgYmUgYSBjbGVh ciB3aW5uZXIuDQoNCkEgY291cGxlIG9mIGV4YW1wbGVzICh0aGVzZSBhcmUgbmVjZXNzYXJpbHkg cmVhbOKApmp1c3QgcG9zc2liaWxpdGllcyk6DQoNCiogSXQgaXMgcHJvYmFibHkgdXNlZnVsIHRv IGJlIGFibGUgdG8gZXhwcmVzcyBzaW1sYXIvb3ZlcmxhcHBpbmcgZXZlbnRzIGZyb20gZGlmZmVy ZW50IFNFVCBwcm9maWxlcyBpbiBvbmUgU0VULiAgRm9yIGV4YW1wbGUgYSBCYWNrY2hhbm5lbCBM b2dvdXQgJiBhIFJJU0Mgc2Vzc2lvbiBjYW5jZWwgZXZlbnQuDQoNCiogU0NJTSBtYXkgd2FudCB0 byByZXByZXNlbnQgYSBzaW5nbGUgdHJhbnNhY3Rpb24gYXMgY2F1c2luZyBtdWx0aXBsZSBzdGF0 ZSBjaGFuZ2VzIGluIGFuIGV2ZW50IChlLmcuIGEgcGFzc3dvcmQgY2hhbmdlIGNhdXNlcyBtdWx0 aXBsZSBlZmZlY3RzKS4gSGF2aW5nIHRvIGNoYXNlIGRvd24gbXVsdGlwbGUgZXZlbnRzIGFuZCBj b3JyZWxhdGUgYnkg4oCcdHhu4oCdIHdvdWxkIGJlIGNoYWxsZW5naW5nIGluIGEgbXVsdGktdGhy ZWFkZWQvbXVsdGktbm9kZSBkZWxpdmVyeSBzeXN0ZW0uICAgVGhlIFNDSU0gbGlzdCBoYXMgbm90 IGRpc2N1c3NlZCB0aGlzLCBidXQgSSB3b3VsZCBub3Qgd2FudCB0byBibG9jayB0aGlzIGNhcGFi aWxpdHkuICBJT1cgLSBKdXN0IGJlY2F1c2UgUklTQyBkb2VzIG5vdCB3YW50IHRvIGV4cHJlc3Mg bXVsdGlwbGUgZXZlbnRzIGRvZXMgbm90IG1ha2UgdGhpcyB0cnVlIGZvciBvdGhlciBwcm9maWxl cy4NCg0KKiBXZSBtYXkgd2lzaCB0byBpbmRpY2F0ZSBhIFNDSU0gUGFzc3dvcmQgUmVzZXQgd2Fz IHBlcmZvcm1lZCBhbmQgYSBMb2dvdXQvc2Vzc2lvbiBjYW5jZWxsYXRpb24gaXMgZXhwcmVzc2Vk IGF0IHRoZSBzYW1lIHRpbWUuICBUaGUgZXZlbnRzIGFyZSByZWxhdGVkIGJ1dCBleHByZXNzIGRp ZmZlcmVudCBkYXRhLg0KDQpBdm9pZGluZyBDb25mdXNpb24gRnJvbSBTaW1pbGFyIEV2ZW50cyBP cmlnaW5hdGluZyBmcm9tIHRoZSBTYW1lIFRyYW5zYWN0aW9uDQoNCklmIGV2ZW50cyBhcmUgc2Vu dCBzZXBhcmF0ZWx5LCB0aGVuIG1vcmUgdHJhY2tpbmcgb2Ygc3RhdGUgKGUuZy4gYnkgdHhuKSB3 b3VsZCBiZSByZXF1aXJlZCB0byBlbnN1cmUgc2ltaWxhciBldmVudHMgYXJlIG5vdCBtaXN0YWtl biBvciBoYW5kbGVkIGFzIHJlcGVhdHMuIFdoaWxlIHR4biBwcm92aWRlcyB1c2VmdWwgYXVkaXQg YW5hbHlzaXMgY2FwYWJpbGl0eSwgSeKAmW0gbm90IHN1cmUgaXQgY2FuIGJlIHVzZWQgaW4gbGl2 ZSBvciBuZWFyLXJlYWwgdGltZSBzeXN0ZW1zIGdpdmVuIGRpc3RyaWJ1dGVkIG11bHRpLW5vZGUs IG11bHRpLXRocmVhZGluZyBhcmNoaXRlY3R1cmVzLg0KDQpQcmV2aW91cyBEaXNjdXNzaW9uDQoN Ckkgbm90ZSB0aGF0IEkgb3JpZ2luYWxseSByYWlzZWQgaGF2aW5nIGFuIGF0dHJpYnV0ZSB0byBk ZXNpZ25hdGUgcHJpbWFyeSBldmVudCBhdHRyaWJ1dGUgdG8gYWxsZXZpYXRlIHlvdXIgY29uY2Vy biwgYnV0IHRoaXMgd2FzIG5vdCBhY2NlcHRlZC4gU2VlOg0KDQoqIGh0dHBzOi8vd3d3LmlldGYu b3JnL21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQvY3VycmVudC9tc2cwMDQwNi5odG1sPGh0dHBz Oi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYu b3JnX21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2ZW50X2N1cnJlbnRfbXNnMDA0MDYuaHRtbCZk PUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1u YTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhj RnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPVMzc01WaXFNdkVnbndHYkp3T1FOeWNy T3lyN1NlZnBxX01vRk9LY0VlQ0UmZT0+DQoNCiogaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbC1h cmNoaXZlL3dlYi9pZC1ldmVudC9jdXJyZW50L21zZzAwMTQwLmh0bWw8aHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbC0y RGFyY2hpdmVfd2ViX2lkLTJEZXZlbnRfY3VycmVudF9tc2cwMDE0MC5odG1sJmQ9RHdNRmFRJmM9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21h bnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24z MUF1eHVydWliOUtBVGtSbFFHMWl3JnM9R3k5Z3lSb0lJdGEtY1NoVjdiTjE2MWF5NHlFNnI5RzFf QWFfTmVCbnlsZyZlPT4NCg0KVGhlIGNvbnNlbnN1cywgYXQgbGVhc3QgYXMgSSBpbnRlcnByZXRl ZCBpdCBpcyB1cCB0byB0aGUgcmVjZWl2ZXIgdG8gZmlndXJlIHRoaXMgb3V0IGJhc2VkIG9uIHRo ZSBkZWZpbml0aW9ucyBpdCBoYXMgZm9yIGVhY2ggZXZlbnQgVVJJIGFuZCB0aGUgcHJvZmlsZXMg dGhleSByZXByZXNlbnQuIElPVyAtIFJJU0MgaXMgZnJlZSB0byBsaW1pdCB0aGF0IG9ubHkgb25l IFJJU0MgZXZlbnQgYmUgZXhwcmVzc2VkIGF0IGEgdGltZS4NCg0KUGhpbA0KDQpPcmFjbGUgQ29y cG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdA0KDQpAaW5kZXBlbmRl bnRpZA0KDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZkPUR3TUZhUSZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdt YW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtu MzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPTlOUDVuYW1nNnJJVnp3dW45Yy0xcTB3aHN5WHdTdnRI QjBmMmRLa2ZDWDgmZT0+IDxodHRwOi8vd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRp ZC5jb20mZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElf Sm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0ds SzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz05TlA1bmFtZzZySVZ6d3Vu OWMtMXEwd2hzeVh3U3Z0SEIwZjJkS2tmQ1g4JmU9Pj4NCg0KcGhpbC5odW50QG9yYWNsZS5jb208 bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPiA8bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t PG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+DQoNCiAgICBPbiBPY3QgMjMsIDIwMTcsIGF0 IDc6MDIgUE0sIFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlDQogICAgPHJpY2hhbm5hQGFtYXpv bi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+IDxtYWlsdG86cmljaGFubmFAYW1hem9u LmNvbTxtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbT4+PiB3cm90ZToNCg0KICAgIFRoZSBjdXJy ZW50IGRyYWZ0IG9mIHRoZSBTRVQgc3BlYyBhbGxvd3MgZm9yIGV4cHJlc3NpbmcgbXVsdGlwbGUN CiAgICBldmVudHMgd2l0aGluIHRoZSBzYW1lIHRva2VuLCB3aGljaCBpbnRyb2R1Y2VzIGFkZGl0 aW9uYWwgY29tcGxleGl0eQ0KICAgIGFuZCByb29tIGZvciBhbWJpZ3VvdXMgc2VtYW50aWNzLiBX ZeKAmXZlIGRpc2N1c3NlZCB0aGlzIGluIHRoZSBPSURGDQogICAgUklTQyB3b3JraW5nIGdyb3Vw IGFuZCB0aGUgY3VycmVudCBjb25zZW5zdXMgdGhlcmUgaXMgdGhhdCBSSVNDIHdpbGwNCiAgICBy ZXF1aXJlIHRoYXQgUklTQyBldmVudHMgbXVzdCBiZSB0aGUgb25seSBldmVudCBpbiB0aGUgU0VU LCBoYXZpbmcNCiAgICBpZGVudGlmaWVkIHdheXMgdG8gY2xlYXJseSBhbmQgZWFzaWx5IHN1cHBv cnQgdGhlIGhhbmRmdWwgb2YgdXNlDQogICAgY2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIg dG9rZW4gdGhhdCBwZW9wbGUgaGF2ZSByYWlzZWQuIFdpdGgNCiAgICB0aGF0IGNvbnRleHQgaW4g bWluZCwgSSBwcm9wb3NlIHN0cmlraW5nIHRoZSBkZWZpbml0aW9uIG9mIHRoZQ0KICAgIOKAnGV2 ZW50c+KAnSBjbGFpbSBmcm9tIHRoZSBTZWN1cml0eSBFdmVudCBUb2tlbiBzcGVjLCBhbmQgcmVw bGFjaW5nIGl0DQogICAgd2l0aCB0aGUgZm9sbG93aW5nIGRlZmluaXRpb24gZm9yIGFuIOKAnGV2 ZW504oCdIGNsYWltIChzaW5ndWxhcik6DQoNCiAgICBldmVudA0KDQogICAgQSBKU09OIG9iamVj dCBjb250YWluaW5nIGFuICJldmVudF90eXBlIiBtZW1iZXIgd2hvc2UgdmFsdWUgaXMgYSBVUkkN CiAgICByZXByZXNlbnRpbmcgYSB0eXBlIG9mIGV2ZW50IGRlZmluZWQgaW4gYSBQcm9maWxpbmcg U3BlY2lmaWNhdGlvbi4NCiAgICBUaGUgb2JqZWN0IE1BWSBvdGhlcndpc2UgYmUgZW1wdHksIG9y IE1BWSBjb250YWluIGFkZGl0aW9uYWwgbWVtYmVycw0KICAgIGFzIGRlc2NyaWJlZCBieSB0aGUg UHJvZmlsaW5nIFNwZWNpZmljYXRpb24uDQoNCiAgICBIZXJlIGlzIHRoZSBleGFtcGxlIFNFVCBm cm9tIHNlY3Rpb24gMi4zLCByZXdyaXR0ZW4gd2l0aCB0aGlzIGNoYW5nZQ0KICAgIG1pbmQ6DQoN CiAgICB7DQoNCiAgICAgICAianRpIjogIjRkMzU1OWVjNjc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4 IiwNCg0KICAgICAgICJpYXQiOiAxNDU4NDk2NDA0LA0KDQogICAgICAiaXNzIjogImh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbTxodHRwczovL3NjaW0uZXhhbXBsZS5jb20vPiA8aHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tLz4iLA0KDQogICAgICAgImF1ZCI6IFsNCg0KICAgICAgICAgImh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0IiwNCg0KICAg ICAgICAgImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3 Njc2ZWU3Ig0KDQogICAgICAgXSwNCg0KICAgICAgICJldmVudCI6IHsNCg0KICAgICAgICAgImV2 ZW50X3R5cGUiOiAidXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6Y3JlYXRlIiwNCg0KICAgICAg ICAgInJlZiI6ICJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZh YjYxZTc1MjFkOSIsDQoNCiAgICAgICAgICJhdHRyaWJ1dGVzIjogWyJpZCIsICJuYW1lIiwgInVz ZXJOYW1lIiwgInBhc3N3b3JkIiwgImVtYWlscyJdDQoNCiAgICAgICB9DQoNCiAgICB9DQoNCiAg ICBEb2VzIGFueW9uZSBpbiB0aGUgd29ya2luZyBncm91cCBoYXZlIHVzZSBjYXNlcyBmb3IgU0VU cyB0aGF0IGNhbm5vdA0KICAgIGJlIG1ldCBieSB0aGlzIHByb3Bvc2VkIHRleHQ/IFdpdGhpbiBS SVNDLCB3ZSBpZGVudGlmaWVkIHRocmVlIHVzZQ0KICAgIGNhc2VzLCB3aXRoIHNvbHV0aW9ucyBv dXRsaW5lZCBiZWxvdzoNCg0KICAgICoqDQoNCiAgICAqRXh0ZW5zaW9ucyoNCg0KICAgIEV2ZW50 IGV4dGVuc2lvbiBtZWNoYW5pc21zIGNhbiBiZSBkZWZpbmVkIGludGVybmFsIHRvIHRoZSBldmVu dA0KICAgIG9iamVjdC4gQSBzaW1wbGUgYXBwcm9hY2ggd291bGQgYmUgdG8gIGRlZmluZSBhbiDi gJxleHRlbnNpb25z4oCdIG1lbWJlcg0KICAgIHRoYXQgaXMgYSBsaXN0IG9mIGV2ZW50IG9iamVj dHMgKG9yIHNldCByZXNlbWJsaW5nIHRoZSDigJxldmVudHPigJ0NCiAgICBjbGFpbSBhcyBkZWZp bmVkIGluIHRoZSBjdXJyZW50IHNwZWMpLiBUaGlzIGhhcyB0aGUgYWR2YW50YWdlIG9mDQogICAg bWFraW5nIGl0IGNsZWFyIGluIHRoZSBkYXRhIHN0cnVjdHVyZSB0aGF0IHRoZXJlIGlzIGEgc2lu Z2xlIHByaW1hcnkNCiAgICBldmVudCwgd2l0aCB6ZXJvIG9yIG1vcmUgZXh0ZW5zaW9ucy4gVGhl cmUgaXMgbm8gcm9vbSBmb3IgY29uZnVzaW9uDQogICAgb3ZlciB3aGljaCBldmVudCBpcyBwcmlt YXJ5LCBvciBpZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQgYXQgYWxsLg0KICAgIEkgd291bGQg YmUgZmluZSB3aXRoIGFkZGluZyBzb21ldGhpbmcgbGlrZSB0aGlzIHRvIG15IHByb3Bvc2VkIHRl eHQsDQogICAgaWYgdGhlcmUgaXMgY29uc2Vuc3VzIHRoYXQgaXQgaXMgYnJvYWRseSB1c2VmdWwu DQoNCiAgICAqQWxpYXNlcyoNCg0KICAgIFRoaXMgdXNlIGNhc2Ugd2FzIGJyb3VnaHQgdXAgaW4g dGhlIGNvbnRleHQgb2YgbWlncmF0aW5nIGNsaWVudHMNCiAgICBmcm9tIGRyYWZ0IGV2ZW50IG5h bWVzIHRvIHN0YW5kYXJkaXplZCBldmVudCBuYW1lcy4gSW4gdGhpcyBjYXNlLA0KICAgIHRoZSBl dmVudCB0cmFuc21pdHRlciBjYW4gdHJhbnNtaXQgdHdvIHRva2VucyBmb3IgdGhlIGxvZ2ljYWwg ZXZlbnQsDQogICAgb25lIHVzaW5nIHRoZSBvbGQgbmFtZSBhbmQgYW5vdGhlciB1c2luZyB0aGUg bmV3IG5hbWUuDQoNCiAgICAqUmVsYXRlZCBFdmVudHMqDQoNCiAgICBUaGUgU0VUIHNwZWMgZGVm aW5lcyB0aGUgdHhuIGNsYWltIGFzIGEgbWVhbnMgb2YgY29ycmVsYXRpbmcNCiAgICBpbmRlcGVu ZGVudCB0b2tlbnMgdGhhdCByZWxhdGUgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC4NCg0KICAg IC0tDQogICAgQW5uYWJlbGxlIFJpY2hhcmQgQmFja21hbg0KDQogICAgQW1hem9uIOKAkyBJZGVu dGl0eSBTZXJ2aWNlcw0KDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCiAgICBJZC1ldmVudCBtYWlsaW5nIGxpc3QNCiAgICBJZC1ldmVudEBpZXRm Lm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+IDxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc8 bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPj4NCiAgICBodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZv X2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZt PXM1YnlCZTVLQU5uR1Z1QWIxbUF1cEVHb0puOFhHNUpJVVV3V0dGU2liRWMmcz1YOG9SU3EzSXps RjdqaVJBZVpoWHBSM2VWSTBJNThaRmQ0ZUVaZmd5b0lZJmU9DQoNCg0KDQpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlz dGluZm9faWQtMkRldmVudCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJ ck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRL Wk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPVdyTXVR UndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZLMDJFWHMmZT0+DQoNCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxp c3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8aHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9s aXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3 cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xO NEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JnM9V3JN dVFSd0xWODAyaU1RNHdZQjFmMnJGVUd1NHpiaGNXMDAxZkswMkVYcyZlPT4NCg0KDQoNCi0tDQpT dWJzY3JpYmUgdG8gdGhlIEhBUkRUV0FSRTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5j b20vdjIvdXJsP3U9aHR0cC0zQV9faGFyZHR3YXJlLmNvbV8mZD1Ed01GYVEmYz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0 eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5 S0FUa1JsUUcxaXcmcz1MWU43MkdnS1ZoSHNUNnRBcUJlLWVNb1dNdnlfN2RmRm4xdVowSEs2WXVR JmU9PiBtYWlsIGxpc3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBhbSB3b3JraW5nIG9uIQ0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50 IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3Jn Pg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193 d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0 RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVy dWliOUtBVGtSbFFHMWl3JnM9V3JNdVFSd0xWODAyaU1RNHdZQjFmMnJGVUd1NHpiaGNXMDAxZksw MkVYcyZlPQ0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed0lD QWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6 QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVUtYTVIQk5EMEhhVFg0YW5O WmZ6WDdwRHNmSzVmMGg5bVo5Q1pra0dpZWMmcz1ydmRydEk3cllOUkFucVpEbHRDd0JBWlZIS3At TUoyMHVpMm5tNDZRU3owJmU9DQoNCg0KDQoNCi0tDQpTdWJzY3JpYmUgdG8gdGhlIEhBUkRUV0FS RTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9faGFy ZHR3YXJlLmNvbV8mZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2 NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZt PWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmcz13dGdEM05wMHZ5 aExkcEV3VWlxc2Y0SXRpd0EzT203R3JvYjcwTHgwcjNrJmU9PiBtYWlsIGxpc3QgdG8gbGVhcm4g YWJvdXQgcHJvamVjdHMgSSBhbSB3b3JraW5nIG9uIQ0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRA aWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUly TVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEta TkEmbT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9T2UwcWZM RVg4M3Z0WE03V2wyY1lCZS1HZzFEVlBqaFhqVkprZmhWUnp3YyZlPQ0KDQoNCg0KLS0NClN1YnNj cmliZSB0byB0aGUgSEFSRFRXQVJFPGh0dHA6Ly9oYXJkdHdhcmUuY29tLz4gbWFpbCBsaXN0IHRv IGxlYXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiENCg== --_000_CY4PR21MB0504E322952C6E74296341C0F55F0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhU TUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAw MXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRN TCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4ubTY5NTg3NzY5 ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXtt c28tc3R5bGUtbmFtZTptXzY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFw cGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERl ZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoyMTg5ODIyMDE7DQoJbXNvLWxp c3QtdGVtcGxhdGUtaWRzOjIwODc4OTcyNDI7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZl bC1zdGFydC1hdDoyOw0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWwy DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWIt c3RvcDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjkwMjU2MzA4MTsNCgltc28tbGlz dC10ZW1wbGF0ZS1pZHM6LTExMDIxNjQ0NzY7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZl bC1zdGFydC1hdDozOw0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDINCgl7bXNv LWxpc3QtaWQ6MTc4NzExNzMzNzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTExOTcwNjM0MDg7 fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JIGhlYXIgeW91IG9uIHRoZSBmYWN0IHRoYXQgZGlmZmVy ZW50IHBlb3BsZSBoYXZlIGpvaW5lZCB0aGUgZWZmb3J0IGF0IGRpZmZlcmVudCB0aW1lcy4mbmJz cDsgVGhhdOKAmXMgYSBub3JtYWwgcHJvY2VzcyBhcyBhbiBlZmZvcnQgYnVpbGRzIG1vbWVudHVt LiZuYnNwOyBJIGdldCB0aGF0IG5vdCBldmVyeW9uZSB3YXMgdGhlcmUgd2hlbiBwcmV2aW91cyBj b25zZW5zdXMgY2FsbHMNCiB3ZXJlIHRha2VuLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+SSBzaG91bGQgbm90ZSB0aGF0IEkgaGF2ZSBzcGVjaWZpYyB0ZWNobmljYWwgb2Jq ZWN0aW9ucyB0byB0aGUgc3BlY2lmaWMgcHJvcG9zZWQgY2hhbmdlcyBiZWluZyBkaXNjdXNzZWQg YXMgd2VsbC4mbmJzcDsgQ3VycmVudGx5IGFsbCBldmVudHMgaW4gdGhlIHNldCBoYXZlIHRoZSBz YW1lIHN5bnRheC4mbmJzcDsgVGhlIHByb3Bvc2FscywgYXMgSSB1bmRlcnN0YW5kIHRoZW0sIHJl dmVydA0KIHVzIHRvIGEgc3RhdGUgd2hlcmUgdGhlcmXigJlzIGEg4oCccHJpbWFyeeKAnSBhbmQg 4oCcc2Vjb25kYXJ54oCdIGV2ZW50cywgd2l0aCBkaWZmZXJlbnQgc3ludGF4IGZvciB0aGUgdHdv IGNsYXNzZXMuJm5ic3A7IFRoYXTigJlzIG5lZWRsZXNzbHkgbW9yZSBjb21wbGljYXRlZCwgYWRk aW5nIG5vIGFjdHVhbCB2YWx1ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGEgbmFtZT0iX01haWxFbmRDb21wb3Nl Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9h PjwvcD4NCjxzcGFuIHN0eWxlPSJtc28tYm9va21hcms6X01haWxFbmRDb21wb3NlIj48L3NwYW4+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gRGljayBIYXJkdCBbbWFpbHRvOmRp Y2suaGFyZHRAZ21haWwuY29tXSA8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2RheSwgT2N0b2JlciAz MSwgMjAxNyA5OjM3IFBNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDtNaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBQaGlsIEh1bnQgKElETSkgJmx0 O3BoaWwuaHVudEBvcmFjbGUuY29tJmd0OzsgWWFyb24gU2hlZmZlciAmbHQ7eWFyb25mLmlldGZA Z21haWwuY29tJmd0OzsgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0O3JpY2hhbm5hQGFt YXpvbi5jb20mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9y ZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gVXNlIGNhc2VzIGZvciBt dWx0aXBsZSBldmVudHMgcGVyIFNFVD88bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1p a2U8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIHlvdSB3 ZWxsIGtub3csIG1hbnkgcGVvcGxlIGluIGEgV0cgZG9uJ3QgbG9vayBjbG9zZWx5IGF0IGEgc3Bl Y2lmaWNhdGlvbiB1bnRpbCBsYXN0IGNhbGwgaXMgbWFkZS4gQWRkaXRpb25hbGx5LCB3ZSBhcmUg Y29taW5nIHVwIG9uIG9ubHkgdGhlIDNyZCBXRyBtZWV0aW5nLiBUaGUgV0cgaGFzIG5vdCBleGlz dGVkIGZvciB2ZXJ5IGxvbmcuIFdoaWxlIHNvbWUgb2YgdGhlIHBhcnRpY2lwYW50cyBoYXZlIGJl ZW4NCiB3b3JraW5nIG9uIHRoaXMgZm9yIGEgd2hpbGUsIG1hbnkgaGF2ZSBub3QsIGFuZCB3ZSBh cmUgbG9va2luZyBmb3IgY29uc2Vuc3VzIGFjcm9zcyB0aGUgV0cuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNpbmNlIFNlY0V2ZW50IGlzIGEg ZnJhbWV3b3JrIHRoYXQgd2UgZXhwZWN0IHRvIGJlIHByb2ZpbGVkLCBJIGZlZWwgaXQgaXMgaW1w b3J0YW50IHRvIGVuc3VyZSB0aGF0IFNlY0V2ZW50IHNwZWNpZmljYXRpb25zIGFyZSBlYXN5IGZv ciBhIHZhcmlldHkgb2YgcHJvZmlsZXMgdG8gYWRvcHQsIGFuZCB0aGF0IHRoZSBzZW1hbnRpY3Mg bWFrZSBzZW5zZS4gSSBhbHNvIHRoaW5rIHRoYXQgcHJvcGVydGllcyB0aGF0DQogYXJlIHNwZWNp ZmljIHRvIGEgcHJvZmlsZSBzaG91bGQgYmUgbGVmdCB0byB0aGF0IHByb2ZpbGUgYW5kIG5vdCBi ZSBpbmNsdWRlZCBpbiBTZWNFdmVudC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+U2luY2UgdGhpcyBpcyBhIGZyYW1ld29yaywgaXQgaXMgZXhw ZWN0ZWQgdGhhdCBhcyBkaWZmZXJlbnQgZ3JvdXBzIHByb2ZpbGUgaXQsIHRoZXJlIHdpbGwgYmUg YWRkaXRpb25hbCBmZWVkYmFjay48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+U3BlY2lmaWNhbGx5LCBhcyBhIHBhcnRpY2lwYW50IGluIHRoZSBS SVNDIHByb2ZpbGUgb2YgU0VULCBhIG51bWJlciBvZiBpc3N1ZXMgaW4gU0VUIGhhdmUgc3VyZmFj ZWQgYXMgdGhlIFJJU0MgV0cgaGFzIGxvb2tlZCBhdCBob3cgdG8gdXNlIHRoZSBTRVQuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIGZvciBT RVQgYmVpbmcgc3RhYmxlIGZvciBvdmVyIGEgeWVhciwgdGhlcmUgaGF2ZSBiZWVuIGEgbnVtYmVy IG9mIGNoYW5nZXMgdG8gU0VUIHNpbmNlIHRoZW4uIEkgYWxzbyBkb24ndCB0aGluayB0aGVyZSB3 YXMgY29uc2Vuc3VzLiBCZWZvcmUgdGhlIFdHIHdhcyBmb3JtZWQsIEkgYW5kIHNldmVyYWwgb3Ro ZXJzIGhhZCBleHByZXNzZWQgY29uY2VybiBvbiB0aGUgZGVzaWduIG9mIFNFVCB3aGVuIFBoaWwN CiBwcmVzZW50ZWQgaXQgYXQgYW4gSUlXIHNlc3Npb24uPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFzIHRvIHRha2luZyBhbm90aGVyIHllYXIs IEkgYW0gaG9wZWZ1bCB3ZSBjYW4gcmVzb2x2ZSB0aGUgcmVtYWluaW5nIGlzc3VlcyBpbiBTRVQg YW5kIHB1Ymxpc2ggYSBuZXcgZHJhZnQgZm9yIGxhc3QgY2FsbC4gSSBkbyBub3QgdGhpbmsgd2Ug d2lsbCBuZWVkIHRvIHdhaXQgZm9yIGFub3RoZXIgV0cgbWVldGluZyB0byBhc2sgZm9yIGxhc3Qg Y2FsbC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+V2UgYWxzbyBoYXZlIGEgbnVtYmVyIG9mIG90aGVyIGRvY3VtZW50cyB0aGF0IGFy ZSBub3QgaW4gbGFzdCBjYWxsLCBhbmQgd2UgZG9uJ3QgaGF2ZSBhIFdHIGFkb3B0ZWQgZHJhZnQg eWV0IGZvciBtYW5hZ2VtZW50LiBTbyB0aGVyZSBhcmUgc3RpbGwgYSBudW1iZXIgb2YgZG9jdW1l bnRzIHRvIHdvcmsgdGhyb3VnaCBiZWZvcmUgd2UgaGF2ZSBhbGwgdGhlIGJpdHMgZm9yIHNvbWVv bmUgdG8gd29yayB3aXRoLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JIGRvIHRoaW5rIHdlIGhhdmUgYmVlbiBtYWtpbmcgZ29vZCBwcm9ncmVz cyBzaW5jZSB0aGUgbGFzdCBJRVRGIG1lZXRpbmcsIGFuZCBJIGFtIGhvcGVmdWwgd2UgY2FuIGtl ZXAgdXAgdGhpcyBtb21lbnR1bSBhbmQgZmluYWxpemUgYWxsIHRoZSBkb2N1bWVudHMgaW4gYSB0 aW1lbHkgbWFubmVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4vRGljazxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwgT2N0IDMxLCAyMDE3IGF0IDEyOjQ4IFBNLCBNaWtlIEpv bmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIiB0YXJn ZXQ9Il9ibGFuayI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86 cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6 c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0 OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JdOKAmXMgaGFyZCBmb3IgbWUgdG8g ZXZlbiBleHByZXNzIG15IGxldmVsIG9mIGZydXN0cmF0aW9uIHdpdGggdGhlIHJlY2VudCBhdHRl bXB0cyB0byBvbmNlIGFnYWluIHJlZGVzaWduIHRoZSBTZWNFdmVudCBUb2tlbiBzcGVjLiZuYnNw OyBXZeKAmXZlIGJlZW4gYXQgdGhpcw0KIGZvciBtdWx0aXBsZSB5ZWFycyBiZWNhdXNlIHBlb3Bs ZSBrZWVwIHRyeWluZyB0byByZXZpc2l0IGRlY2lzaW9ucyB0aGF0IHdlcmUgbG9uZyBhZ28gbWFk ZSBieSBjb25zZW5zdXMuJm5ic3A7IEl04oCZcyBiZWVuIHN0YWJsZSBmb3Igb3ZlciBhIHllYXIg YW5kIHRoZSBtYWpvcml0eSBvZiBXR0xDIHJlc3BvbmRlbnRzIHNhaWQgc29tZSB2YXJpYW50IG9m IOKAnFdvcmtzIGZvciBtZSDigJMgc2hpcCBpdCHigJ08L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJjb2xvcjojMDAyMDYwIj5UaGVyZeKAmXMgbm90IHN1ZmZpY2llbnQganVzdGlmaWNhdGlvbiB0 byB0cnkgdG8gdW5kbyBjb25zZW5zdXMgcG9zaXRpb25zIHRoYXQgaGF2ZSBiZWVuIGRlYmF0ZWQg YW5kIGFmZmlybWVkIG92ZXIgYW5kIG92ZXIuJm5ic3A7IENvdW50ZW5hbmNpbmcgd2hvbGVzYWxl IGNoYW5nZXMNCiBhdCB0aGlzIGxhdGUgZGF0ZSBpcyBjb3VudGVycHJvZHVjdGl2ZSBpbiB0aGUg ZXh0cmVtZSE8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5JdOKAmXMg ZmFyIGJldHRlciB0aGFuIGdvb2QgZW5vdWdoIGFzLWlzLiZuYnNwOyBJbiBteSBleHBlcmllbmNl LCBpZiB3ZSBzdGFydCByZWRlc2lnbmluZyBpdCwgaXQgd2lsbCByZXN1bHQgaW4gYW5vdGhlciB5 ZWFy4oCZcyBkZWxheS4mbmJzcDsgSXQgZG9lcyBzb21ldGhpbmcgc2ltcGxlDQogYW5kIHVzZWZ1 bC4mbmJzcDsgUGxlYXNlLCBsZXTigJlzIGp1c3Qgc2hpcCBpdCwgc28gcGVvcGxlIGNhbiByZWx5 IG9uIGl0Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48YSBuYW1lPSJtXzY5NTg3NzY5ODAyNDY2NjA3 MDNfX01haWxFbmRDb21wb3NlIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9z cGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTti b3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPkZyb206PC9iPiBQaGlsIEh1bnQgKElETSkgW21h aWx0bzo8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5r Ij5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT5dDQo8YnI+DQo8Yj5TZW50OjwvYj4gTW9uZGF5LCBP Y3RvYmVyIDMwLCAyMDE3IDI6NDIgUE08YnI+DQo8Yj5Ubzo8L2I+IERpY2sgSGFyZHQgJmx0Ozxh IGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2su aGFyZHRAZ21haWwuY29tPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IFlhcm9uIFNoZWZmZXIgJmx0 OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj55 YXJvbmYuaWV0ZkBnbWFpbC5jb208L2E+Jmd0OzsgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUg Jmx0OzxhIGhyZWY9Im1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+ cmljaGFubmFAYW1hem9uLmNvbTwvYT4mZ3Q7OyBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWls dG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDs7DQogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+aWQtZXZl bnRAaWV0Zi5vcmc8L2E+Jmd0OzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gVXNlIGNh c2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ SW5saW5lLi4uPGJyPg0KPGJyPg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdp bi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBPY3QgMzAsIDIwMTcsIGF0IDI6MjIgUE0sIERpY2sg SGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbSIgdGFyZ2V0PSJf YmxhbmsiPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0 b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkhpIFBoaWw8 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5Db3JyZWN0 IG1lIGlmIEkgYW0gbWlzdW5kZXJzdGFuZGluZywgYnV0IHRoZXJlIGlzIGEgUklTQyBwcm9maWxl IGV2ZW50Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUtd3JhcCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9 IndoaXRlLXNwYWNlOnByZS13cmFwIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+JnF1 b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1 QyZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVl YXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5B JmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9 MjVsMDlzSDhZVjQyeHpnVS1DWFNnOHhIOXR2eURKejQwdENSakZhbGhrdyZhbXA7ZT0iIHRhcmdl dD0iX2JsYW5rIj5odHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQt dHlwZS88L2E+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+YWNjb3VudC1jcmVkZW50aWFsLWNoYW5nZS1y ZXF1aXJlZDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250LWZhbWlseTom cXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmIj7igJ08L3NwYW4+PG86cD48L286cD48L3ByZT4N CjxwcmUgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4mbmJzcDs8bzpwPjwvbzpwPjwvcHJl Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5hbmQgYW4gU0NJTSBwcm9m aWxlIGV2ZW50PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZSBzdHlsZT0i d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5jb20v c2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9leGFt cGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQ8L2E+4oCdPG86cD48L286cD48L3By ZT4NCjxwcmUgc3R5bGU9IndoaXRlLXNwYWNlOnByZS13cmFwIj4mbmJzcDs8bzpwPjwvbzpwPjwv cHJlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JJ20gc3VnZ2VzdGlu ZyB0aGF0IHR3byBkaWZmZXJlbnQgZXZlbnRzIHdvdWxkIGJlIHNlbnQuIEVtYmVkZGluZyBvbmUg aW4gdGhlIG90aGVyIGRvZXMgbm90IG1ha2Ugc2Vuc2UuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZs dDtwaCZndDtJdCBpcyBhIGh5cG90aGV0aWNhbCBleGFtcGxlLiBKdXN0IGJlY2F1c2UgeW91IGRp c2FncmVlIG9uIHRoaXMgZG9lcyBub3QgbWVhbiBvdGhlcnMgYXJlIG5vdCB2YWxpZC4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JIGp1c3Qg cGlja2VkIG92ZXJsYXBwaW5nIHByb3Bvc2FscyB0aGF0IGhhdmUgZGlmZmVyZW50IG1lYW5pbmcg KGJ1dCBub3QgdGhlIHNhbWUpIHRvIGlsbHVzdHJhdGUgdGhlIGRpZmZlcmVuY2UgZnJvbSBpc3N1 aW5nIGEgc2luZ2xlIHNldCB3aXRoIGRpZmZlcmVudCBldmVudHMuJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0Ij5BcyBJIGhhdmUgc3RhdGVk IHRoaXMgaXMgdmVyeSBkaWZmZXJlbnQgZnJvbSBhc3NlcnRpbmcgbXVsdGlwbGUgZGlzdGluY3Qg ZXZlbnRzIGluIG9uZSBTRVQuJm5ic3A7PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHls ZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkFsc28sIEkgdGhpbmsgaXQgaXMgc2lt cGxlciB0byBoYXZlIGV2ZW50X3R5cGUgYmUgYXQgdGhlIHNhbWUgbGV2ZWwgYXMgZXZlbnQ8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bWFyZ2lu LWJvdHRvbToxMi4wcHQiPiZsdDtwaCZndDttYXkgYmUuIEkgd2FzIHdvcmtpbmcgZnJvbSBBbm5h YmVsbGUncyBwcm9wb3NlZCBmb3JtYXQuJm5ic3A7PG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZxdW90O2p0aSZx dW90OzogJnF1b3Q7M2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAmcXVvdDssPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAm cXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbTwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmcXVvdDthdWQmcXVvdDs6IFs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZu YnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0 NjFmYTViYmM4Nzk1OTNiNzc1NCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxl LmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0PC9hPiZxdW90Oyw8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNw OyAmcXVvdDs8YSBocmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2 YjFkMDg2NDFkNzY3NmVlNyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNv bS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3PC9hPiZxdW90Ozwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7XSw8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5i c3A7ICZuYnNwOyZxdW90O2V2ZW50X3R5cGUmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v ZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IiB0YXJnZXQ9Il9ibGFuayI+ aHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQ8L2E+JnF1b3Q7 LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsgJm5ic3A7JnF1b3Q7ZXZlbnQmcXVvdDs6IHsmbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyZxdW90O2lkJnF1b3Q7OiZxdW90OzQ0ZjYxNDJkZjk2YmQ2YWI2 MWU3NTIxZDkmcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtyZXNl dEF0dGVtcHRzJnF1b3Q7OjU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7fTwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij59PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmcXVvdDtq dGkmcXVvdDs6ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7LDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVv dDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRw czovL3NjaW0uZXhhbXBsZS5jb208L2E+JnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNw OyAmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4 ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhh bXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvYT4mcXVvdDssPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAm bmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYw NDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhhbXBs ZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4mcXVvdDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNw O10sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsmcXVvdDtldmVudF90eXBlJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5v cGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlX2FjY291bnQtMkRjcmVkZW50aWFs LTJEY2hhbmdlLTJEcmVxdWlyZWQmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQ cHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3 eUZfOHU4X3FTQ193JmFtcDtzPW5ReTllelBSakRHZHZSVENhaUR0aTRPSGVsSDNES2dVQ1RLakYy R1Etc28mYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9z ZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvYWNjb3VudC1jcmVkZW50aWFsLWNoYW5nZS1yZXF1aXJl ZDwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsmcXVvdDtldmVudCZxdW90Ozogezwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDvigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwO+KAnGlzc+KAnTomcXVvdDs8YSBocmVmPSJodHRwczovL2lkcC5leGFtcGxlLmNv bS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2lkcC5leGFtcGxlLmNvbS88L2E+JnF1b3Q7Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO308L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgT2N0IDMwLCAyMDE3IGF0IDEyOjA5IFBN LCBQaGlsIEh1bnQgJmx0OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5Bbm5hYmVsbGUvRGljayw8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlRo YW5rcyBmb3IgdGhlIGNvbW1lbnRzLiBJIHRoaW5rIHdlIG5lZWQgdG8gZXhhbWluZSB0aGUgY29u c2VxdWVuY2VzIG9mIHRoZSBwcm9wb3NhbCBpbiBKU09OLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5BcyBJIHN0YXRlZCwgd2hhdCBjYXVzZXMgbW9z dCBvZiB0aGUgaXNzdWUgaXMgdGhlIHByb3Bvc2VkIGV4dGVuc2lvbiBtZWNoYW5pc20gaW4gdGhl IHBheWxvYWQgKHBvc3NpYmx5IHVzaW5nIGV2ZW50cyBpbiBhIHJlY3Vyc2l2ZSB3YXkpLiBEb2Vz IGl0IGZvbGxvdyB0aGUgb2xkIGZvcm1hdCBvciB0aGUgbmV3PzxvOnA+PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkxldOKAmXMgJm5ic3A7Y29uc2lkZXIgYSB1 c2UgY2FzZSB3aGVyZSB3ZSBoYXZlIGFuIGlkZW50aXR5IG1hbmFnZW1lbnQgc3lzdGVtIHRoYXQg dXNlcyBTQ0lNLCBidXQgdGhlIFNDSU0gc3lzdGVtIGlzIGFsc28gdGhlIHVuZGVybHlpbmcgZGF0 YSBzdG9yZSBmb3IgQ29ubmVjdC4mbmJzcDsgQSBQYXNzd29yZCByZXNldCBtaWdodA0KIGdlbmVy YXRlIHRoZSBmb2xsb3dpbmcgZXZlbnQgd2hpY2ggaGFzIGFuIGV4dGVuc2lvbiAoY29udmV5aW5n IHJlc2V0IGNvdW50KSBBTkQgb3ZlcmxhcHBpbmcgc3RhdGVtZW50IGZyb20gUklTQy4mbmJzcDsg Qk9USCBvZiB3aGljaCBtaWdodCBiZSBpbXBvcnRhbnQgdG8gYSBzaW1pbGFyIHJlY2VpdmVyIHVz aW5nIFNDSU0gYW5kIE9JREMuICZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+VGhlIDAzIHNwZWMgY3VycmVudGx5IHdvdWxk IGFsbG93OjwvYj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPns8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDszZDBjM2Nm Nzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vc2NpbS5leGFt cGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbTwvYT4mcXVv dDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWzxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRw czovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIgdGFy Z2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJi Yzg3OTU5M2I3NzU0PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVk NzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhh bXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4mcXVvdDs8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgXSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnRzJnF1b3Q7OiB7PG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3VybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50 OnBhc3N3b3JkUmVzZXQmcXVvdDs6PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHsgJnF1b3Q7aWQmcXVvdDs6JnF1b3Q7NDRmNjE0MmRm OTZiZDZhYjYxZTc1MjFkOSZxdW90O30sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9l dmVudC9wYXNzd29yZFJlc2V0RXh0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9leGFtcGxlLmNv bS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQ8L2E+JnF1b3Q7OjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB7ICZxdW90O3Jlc2V0 QXR0ZW1wdHMmcXVvdDs6NX0sPG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1h cy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVDJmFtcDtkPUR3TUZh USZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDty PW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209aXlWbnJa bXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZhbXA7cz0yNWwwOXNIOFlWNDJ4 emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL1w8L2E+PGJy PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO2FjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVx dWlyZWQmcXVvdDs6IHs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyDigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sPC9zcGFuPjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcaXNz4oCdOiZxdW90Ozwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+PGEgaHJlZj0iaHR0cHM6Ly9pZHAu ZXhhbXBsZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vPC9h PiZxdW90Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08L3NwYW4+ PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZu YnNwOyB9PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+SW4gdGhlIGFib3ZlIC0gZWFjaCBwYXlsb2FkIGlzIGEg4oCYcGVl cicgYW5kIGlzc3VlZCB3aXRob3V0IHByZWZlcmVuY2UgYnkgdGhlIHRyYW5zbWl0dGVyLiBUaGUg cmVjZWl2ZXIgY2FuIGFzc2lnbiBwcmlvcml0eSBpbiBpdHMgb3duIGNvbnRleHQgaWYgdGhhdCBt YXR0ZXJzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwcmU+Jm5ic3A7PG86cD48 L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+PGI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5UaGUgbmV3IHByb3Bvc2FsOjwv c3Bhbj48L2I+PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+Jm5ic3A7PG86 cD48L286cD48L3ByZT4NCjxwcmU+ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVv dDtqdGkmcXVvdDs6ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7 LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYw MjUsPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7 PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly9zY2ltLmV4YW1wbGUuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1 MjQ2MWZhNWJiYzg3OTU5M2I3NzU0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1w bGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQ8L2E+JnF1b3Q7LDxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczov L2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0 MWQ3Njc2ZWU3PC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBd LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyAmcXVvdDtldmVudCZxdW90Ozog ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxldmVu dF90eXBl4oCdOiZxdW90O3VybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXTi gJ0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 O2lkJnF1b3Q7OuKAnTQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIxZDnigJ0sPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW50c+KAnTp7PG86cD48L286 cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0mZ3Q7bm90ZSDigKZpcyB0 aGlzIHRoZSBvbGQgb3IgbmV3IHN0cnVjdHVyZT8gJmx0Oy08bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dDwvYT4m cXVvdDs6PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHsgJnF1b3Q7cmVzZXRBdHRlbXB0cyZxdW90Ozo1fSw8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5u ZXRfc2VjZXZlbnRfcmlzY19ldmVudC0yRHR5cGVfLTI1NUMmYW1wO2Q9RHdNRmFRJmFtcDtjPVJv UDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRX bWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1peVZuclptcjlfdUdDUTZN RDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JmFtcDtzPTI1bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4 SDl0dnlESno0MHRDUmpGYWxoa3cmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3NjaGVt YXMub3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvXDwvYT48YnI+Jm5ic3A7ICZu YnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7YWNjb3VudC1jcmVkZW50aWFsLWNoYW5nZS1y ZXF1aXJlZCZxdW90Ozogezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IOKAnHN1YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSw8L3NwYW4+PG86cD48 L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxpc3PigJ06JnF1b3Q7 PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij48YSBocmVmPSJodHRwczovL2lk cC5leGFtcGxlLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2lkcC5leGFtcGxlLmNvbS88 L2E+JnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfTwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyB9PC9zcGFuPiZuYnNw OyZuYnNwOyZuYnNwOyA8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDs8bzpwPjwv bzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNh JnF1b3Q7LHNhbnMtc2VyaWYiPkluIHRoZSBhYm92ZSwgc3ViLWV2ZW50cyBvciBleHRlbnNpb25z IGhhdmUgYSBkaWZmZXJlbnQgZm9ybWF0LiBUaGUgc2FtZSBjb21wbGFpbnQgYWJvdXQgdGhlIG9y aWdpbmFsIHN0YW5kcy48L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48 L286cD48L3ByZT4NCjxwcmU+PGI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj4qT1IqIChpZiB0aGUgcmVjZWl2ZXIgY2FyZXMgYWJvdXQg UklTQyBtb3JlKS4mbmJzcDsgTm90ZSB0aGF0IHRoaXMgbGVhZHMgdG8gYSB0cmlwbGUgbmVzdGVk IHN0cnVjdHVyZS48L3NwYW4+PC9iPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPns8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7 anRpJnF1b3Q7OiAmcXVvdDszZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCZxdW90Oyw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1 LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 ICZxdW90O2F1ZCZxdW90OzogWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0 NjFmYTViYmM4Nzk1OTNiNzc1NCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxl LmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0PC9hPiZxdW90Oyw8bzpwPjwvbzpw PjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9q aHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0i X2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFk NzY3NmVlNzwvYT4mcXVvdDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgXSw8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6IHs8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZlbnRf dHlwZeKAnTo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+JnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMu b3BlbmlkLm5ldF9zZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1QyZhbXA7ZD1Ed01GYVEm YW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1u YTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1y OV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9MjVsMDlzSDhZVjQyeHpn VS1DWFNnOHhIOXR2eURKejQwdENSakZhbGhrdyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRw Oi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPC9hPjwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0Ij4m bmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAm bmJzcDthY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdlLXJlcXVpcmVkPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTIuMHB0Ij7igJ0sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsg4oCcc3Vi4oCdOuKAnTczNzU2MjZBNjU2Mzc04oCdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgJm5ic3A74oCcaXNz4oCdOiZxdW90Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+PGEgaHJlZj0iaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v4oCcIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v4oCcPC9hPiw8L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyDigJxldmVudHPigJ06ezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0K PHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3VybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBh c3N3b3JkUmVzZXQmcXVvdDs6PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgeyZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aWQmcXVv dDs64oCdNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOeKAnSw8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg 4oCcZXZlbnRz4oCdOns8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1 b3Q7PGEgaHJlZj0iaHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRF eHQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dv cmRSZXNldEV4dDwvYT4mcXVvdDs6PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHsgJnF1b3Q7cmVzZXRBdHRlbXB0cyZxdW90Ozo1fSw8c3BhbiBzdHls ZT0iZm9udC1zaXplOjEzLjVwdCI+Jm5ic3A7IDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7fTwvc3Bhbj4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgPG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cHJlPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwO308bzpwPjwvbzpwPjwvcHJl Pg0KPC9kaXY+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB9Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDt9PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij59PC9zcGFuPjxvOnA+PC9vOnA+ PC9wcmU+DQo8ZGl2Pg0KPHByZT4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8ZGl2 Pg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPkluIHRoZSBhYm92ZSwgdGhlIGV4dGVuc2lvbiBpcyBwbGFjZWQgaW5zaWRlIHRo ZSBldmVudCBpdCBleHRlbmRzLiBJdCBmb2xsb3dzIHRoZSBvbGQgZm9ybWF0IChvciBzaG91bGQg aXQgZm9sbG93IHRoZSBuZXc/KTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8ZGl2 Pg0KPHByZT48Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPipPUiogRm9sbG93aW5nIHRoZSB0b3AgbGF5ZXIgcGF0dGVybiBvZiBzaW5n dWxhciBldmVudCZuYnNwOyBOb3RlIHRoYXQgdGhpcyBsZWFkcyB0byBhIHRyaXBsZSBuZXN0ZWQg c3RydWN0dXJlLjwvc3Bhbj48L2I+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48 L286cD48L3ByZT4NCjxwcmU+ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtq dGkmcXVvdDs6ICZxdW90OzNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7LDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUs PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEg aHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9z Y2ltLmV4YW1wbGUuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsg JnF1b3Q7YXVkJnF1b3Q7OiBbPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2 MWZhNWJiYzg3OTU5M2I3NzU0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1wbGUu Y29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQ8L2E+JnF1b3Q7LDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL2po dWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyIgdGFyZ2V0PSJf YmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3 Njc2ZWU3PC9hPiZxdW90OzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyBdLDxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyAmcXVvdDtldmVudCZxdW90Ozogezxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxldmVudF90 eXBl4oCdOjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij4mcXVvdDs8YSBocmVmPSJodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5v cGVuaWQubmV0X3NlY2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVDJmFtcDtkPUR3TUZhUSZh bXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5h NUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209aXlWbnJabXI5 X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZhbXA7cz0yNWwwOXNIOFlWNDJ4emdV LUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6 Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL1w8L2E+PC9zcGFu PjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwO2FjY291bnQtY3JlZGVudGlhbC1jaGFuZ2Ut cmVxdWlyZWQ8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+4oCdLDwvc3Bhbj48bzpwPjwv bzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnHN1YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSw8L3Nw YW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IOKAnGlzc+KAnTomcXVvdDs8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+PGEgaHJlZj0i aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v4oCcIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9pZHAu ZXhhbXBsZS5jb20v4oCcPC9hPiw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDi gJxldmVudOKAnTp7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsg4oCcZXZlbnRfdHlwZeKAnTomcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNz d29yZFJlc2V04oCdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IDwvc3Bhbj4mcXVvdDtpZCZxdW90OzrigJ00NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ54oCd LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyDigJxldmVudOKAnTp7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW50X3R5 cGXigJ06JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3 b3JkUmVzZXRFeHQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZl bnQvcGFzc3dvcmRSZXNldEV4dDwvYT7igJ0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O3Jl c2V0QXR0ZW1wdHMmcXVvdDs6NTxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij4gPC9zcGFu PjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt9PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPHByZT4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5i c3A7Jm5ic3A7Jm5ic3A7fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJz cDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlRoaXMgZm9ybWF0IGZvbGxvd3MgdGhlIHByb3Bv c2VkIHNpbmd1bGFyIGV2ZW50IGZvcm1hdCByZWN1cnNpdmVseSBhbmQgaXMgMyBsYXllcnMgZGVl cC4gTm90ZSB0aGF0IHRoZSBwYXJzZXIgaGFzIHRvIGNvbnRpbnVlIHRvIHNlYXJjaCB0aGUgZG9j dW1lbnQgZm9yIHRoaW5ncyB0aGF0IGFyZW7igJl0IHRoZXJlIGFzIGl0IGhhcyB0byBzdG9wIHdo ZW4gbm8g4oCcZXZlbnTigJ0gYXR0cmlidXRlIGlzIGZvdW5kIHJhdGhlciB0aGFuIGl0ZXJhdGUg b3ZlciBhbiBhcnJheS48L3NwYW4+PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPHByZT4mbmJz cDs8bzpwPjwvbzpwPjwvcHJlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij5QaGlsPGJyPg0KPGJyPg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2 aWNlcyBBcmNoaXRlY3Q8YnI+DQpAaW5kZXBlbmRlbnRpZDxicj4NCjxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRl bnRpZC5jb20mYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJ ck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxj TE40S1pOQSZhbXA7bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193 JmFtcDtzPTlzWWhncEV6Yjd4UGxRRm1DQ1hObUhvNmZRTjlJQnUtU0hKYW1nX0I0SHMmYW1wO2U9 IiB0YXJnZXQ9Il9ibGFuayI+d3d3LmluZGVwZW5kZW50aWQuY29tPC9hPjxicj4NCjxhIGhyZWY9 Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBv cmFjbGUuY29tPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj5PbiBPY3QgMzAsIDIwMTcsIGF0IDg6NTcgQU0sIFJpY2hh cmQgQmFja21hbiwgQW5uYWJlbGxlICZsdDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1hem9u LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJpY2hhbm5hQGFtYXpvbi5jb208L2E+Jmd0OyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0 eWxlPSJjb2xvcjojQzM0NkUwIj5SZXBsaWVzIGlubGluZS48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+ DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPi0tJm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj5Bbm5hYmVsbGUg UmljaGFyZCBCYWNrbWFuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlm Ij5JZGVudGl0eSBTZXJ2aWNlczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFj a2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4w cHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5k OndoaXRlIj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5Gcm9tOjxzcGFuIGNs YXNzPSJtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+UGhpbCBIdW50ICZsdDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5j b20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5waGlsLmh1bnRA b3JhY2xlLmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPkRhdGU6PHNwYW4gY2xhc3M9Im02OTU4 Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj48L2I+U3VuZGF5LCBPY3RvYmVyIDI5LCAyMDE3IGF0IDU6MjUgUE08YnI+ DQo8Yj5Ubzo8c3BhbiBjbGFzcz0ibTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0 OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5EaWNrIEhhcmR0ICZs dDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrLmhhcmR0QGdtYWlsLmNvbTwvc3Bhbj48L2E+ Jmd0Ozxicj4NCjxiPkNjOjxzcGFuIGNsYXNzPSJtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2 NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPllhcm9u IFNoZWZmZXIgJmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20iIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj55YXJvbmYuaWV0ZkBnbWFpbC5j b208L3NwYW4+PC9hPiZndDssIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L3NwYW4+PC9hPiZndDssDQogJnF1 b3Q7UmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpy aWNoYW5uYUBhbWF6b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+cmljaGFubmFAYW1hem9uLmNvbTwvc3Bhbj48L2E+Jmd0OywgSUQgRXZlbnRzIE1haWxp bmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+ PC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjxzcGFuIGNsYXNzPSJtNjk1ODc3Njk4MDI0NjY2MDcw M200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PC9iPlJlOiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 YmFja2dyb3VuZDp3aGl0ZSI+DQpJIGhvcGUgdGhpcyBhbnN3ZXJzIHlvdXIgcXVlc3Rpb24uPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5k OndoaXRlIj4NCk15IOKAnG1heeKAnSB3YXMgYmVjYXVzZSBJIGNhbuKAmXQgc2VlIGEgcmVhc29u IHdoeSBub3QuIFRoZSBxdWVzdGlvbiBzaG91bGQgYmUsIHdoYXQgaXMgdGhlIGp1c3RpZmljYXRp b24gdG8gbWFrZSDigJxldmVudHPigJ0gc2luZ3VsYXI/PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBz dHlsZT0iY29sb3I6I0MzNDZFMCI+W3JpY2hhbm5hXVRoZSBzaW5ndWxhciDigJxldmVudOKAnSBj bGFpbSBoYXMgY2xlYXJlciBzZW1hbnRpY3MgYW5kIGlzIGVhc2llciB0byBwcm9jZXNzLiBXZSBz aG91bGQgb3B0IGZvciBlYXNpZXIgc29sdXRpb25zIHVubGVzcyB0aGVyZSBhcmUgdXNlIGNhc2Vz IHRoYXQgcmVxdWlyZSBtb3JlIGNvbXBsZXhpdHkuWy9yaWNoYW5uYV08L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRl Ij4NClRoZXJlIGFyZSBtYW55IHJlYXNvbnMgZm9yIG11bHRpcGxlIGV2ZW50cyBpbiBhIFNFVC4m bmJzcDsgU29tZSBhcmUgZ29vZCwgc29tZSBub3Qgc28gZ29vZC4gU29tZSBvZiB0aGUgcmVhc29u cy4uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFj a2dyb3VuZDp3aGl0ZSI+DQoxLiZuYnNwOyBNdWx0aXBsZSBldmVudCBwYXlsb2FkcyBleHByZXNz aW5nIHN0YXRlbWVudHMgYWJvdXQgbGFyZ2VseSB0aGUgKnNhbWUqdGhpbmcuIEZvciBleGFtcGxl LCBTQ0lNIHBhc3N3b3JkIHJlc2V0IEFORCBSSVNDIHBhc3N3b3JkIHJlc2V0LiZuYnNwOyBBIFJJ U0MgRXZlbnQgYW5kIGFuIE9wZW5CYW5raW5nIEV2ZW50LiBJcyBvbmUgYSBjb21wbGVtZW50IHRv IHRoZSBvdGhlcj8mbmJzcDsgRG8gdGhleSBvdmVybGFwIG9yIGFyZSB0aGV5IGRpc3RpbmN0PyAm bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFu bmFdQ29weS9wYXN0ZWQgZnJvbSBteSBlYXJsaWVyIGVtYWlsOjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRl Ij4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5XaHkgaXMgaXQgbmVjZXNzYXJ5IG9yIGFw cHJvcHJpYXRlIHRvIGluY2x1ZGUgdGhlc2UgZXZlbnRzIGluIHRoZSBzYW1lIFNFVD8gVGhleSBh cmUgbGlrZWx5IGJlaW5nIGdlbmVyYXRlZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBhdCBkaWZmZXJl bnQgdGltZXMgb24gdGhlIHRyYW5zbWl0dGVy4oCZcyBzaWRlLCBjb25zdW1lZCBieSBkaWZmZXJl bnQgc3lzdGVtcyBvbiB0aGUgcmVjZWl2ZXLigJlzIHNpZGUsDQogYW5kIHBvc3NpYmx5IGJlaW5n IHRyYW5zbWl0dGVkIG92ZXIgZGlmZmVyZW50IGV2ZW50IHN0cmVhbXMuIEkga25vdyB0aGUgbGF0 dGVyIHdvdWxkIGJlIHRoZSBjYXNlIGZvciB1cywgYXMgYSByZWNlaXZlci4gRXZlbiBpZiBpdOKA mXMgbm90LCBpcyBpdCBidXJkZW5zb21lIHRvIHNlbmQgdGhlc2UgZXZlbnRzIHNlcGFyYXRlbHk/ IFdoYXQgdmFsdWUgaXMgZ2FpbmVkIGluIGNvbWJpbmluZyB0aGVtPzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndo aXRlIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3 aGl0ZSI+DQo8c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+QWRkaXRpb25hbGx5LCBzaW5jZSB0 aGUgc2lnbmF0dXJlIGlzIG92ZXIgdGhlIFNFVCBhbmQgbm90IHRoZSBldmVudCBvYmplY3RzLCBS ZWNlaXZlcnMgaW5kZXBlbmRlbnRseSByb3V0ZSBzZXBhcmF0ZSBldmVudHMgZnJvbSBhIHNpbmds ZSB0b2tlbiB3aXRob3V0IGVpdGhlciBsb3NpbmcgdGhlIGFiaWxpdHkgdG8gdmVyaWZ5IHRoZSBh dXRoZW50aWNpdHkgb2YgdGhlIGV2ZW50IG9yIHNoYXJpbmcgYWxsDQogaW5mb3JtYXRpb24gaW4g dGhlIFNFVCB3aXRoIGV2ZXJ5IHN5c3RlbSBoYW5kbGluZyBhbnkgZXZlbnQgaW4gdGhlIHRva2Vu LlsvcmljaGFubmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiND MzQ2RTAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRlIj4NCjIuJm5ic3A7IE11 bHRpcGxlIGV2ZW50cyBwYXlsb2FkcyBleHByZXNzaW5nIGRpZmZlcmVudCBzdGF0ZW1lbnRzIGFi b3V0IHRoZSBzYW1lIHRyYW5zYWN0aW9uIC0gUklTQyBQYXNzd29yZCBSZXNldCBhbmQgUklTQyBT ZXNzaW9uIENhbmNlbDxicj4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFd U2FtZSBhcyBhYm92ZVsvcmljaGFubmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hp dGUiPg0KMy4mbmJzcDsgQSBuZXcgcHJvZmlsZSBkZWZpbmVzIG5ldyBldmVudCBhdHRyaWJ1dGVz IHRvIGJlIGFkZGVkIG9uIHRvIGFuIGV4aXN0aW5nIGV2ZW50IHR5cGUgKGEgcHVyZSBleHRlbnNp b24pJm5ic3A7PGJyPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPltyaWNoYW5uYV1JIGhh dmUgc3VnZ2VzdGVkIGEgd2F5IHRvIHN1cHBvcnQgZXh0ZW5zaW9ucyB3aXRoaW4gYW4gZXZlbnQg Ym9keSwgbXVsdGlwbGUgdGltZXMgbm93LiBJZiB5b3Ugc2VlIHByb2JsZW1zIHdpdGggaXQsIHBs ZWFzZSBwb2ludCB0aGVtIG91dC5bL3JpY2hhbm5hXTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3Jv dW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KSSB0aGlu ayBpdCBpcyBxdWl0ZSB2YWxpZCB0byBhbGxvdyAxIGFuZCAzLiAmbmJzcDsyIGNvdWxkIGJlIGxp bWl0ZWQgYnkgc3BlY2lmaWMgcHJvZmlsZXMgbGlrZSBSSVNDIGlmIHRoZXkgd2FudC48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hp dGUiPg0KSSBhbSBub3QgaW4gYWdyZWVtZW50IHRoYXQgbWFraW5nIGV2ZW50IHNpbmd1bGFyIHNp bXBsaWZpZXMgYW55dGhpbmcuIEZvciBvbmUgaXMgbWFrZXMgZXh0ZW5zaW9ucyBjb21wbGV4IChh bm90aGVyIG5lc3RlZCBKU09OIHN0cnVjdHVyZSkgYW5kIHBvdGVudGlhbGx5IGNvbmZsaWN0aW5n LiZuYnNwOzxicj4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2Jh Y2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPldheXMgdGhhdCBt dWx0aXBsZS1ldmVudCBTRVRzIGFyZSBtb3JlIGNvbXBsaWNhdGVkOjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPG9sIHN0YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMiBsZXZlbDEgbGZvMTtiYWNrZ3JvdW5kOndo aXRlIj4NCkl0IHJlc3VsdHMgaW4gYSBtb3JlIGNvbXBsZXggc3RydWN0dXJlIGZvciB0aGUgc2lu Z2xlIGV2ZW50IHVzZSBjYXNlLCB3aGljaCBJIHRoaW5rIHdlIGFsbCBhZ3JlZSBpcyB0aGUgbWFq b3JpdHkgdXNlIGNhc2UuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0iY29sb3I6I0MzNDZFMDttc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttc28tbGlzdDpsMiBsZXZlbDEgbGZvMTtiYWNrZ3JvdW5kOndoaXRlIj4NCk11 bHRpcGxlLWV2ZW50IFNFVHMgaGF2ZSBhbWJpZ3VvdXMgc2VtYW50aWNzLiBUaGUgcHJlc2VuY2Ug b2YgdHdvIGV2ZW50cyBBIGFuZCBCIGluIHRoZSBzYW1lIFNFVCBjb3VsZCBtZWFuIGFueSBvZjo8 bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxvbCBzdGFydD0iMiIgdHlwZT0iMSI+DQo8b2wgc3RhcnQ9 IjEiIHR5cGU9ImEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUw O21zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwwIGxldmVsMiBsZm8yO2JhY2tncm91bmQ6d2hpdGUiPg0KVGhleSBhcmUgcmVsYXRlZCB0 byB0aGUgc2FtZSBsb2dpY2FsIGV2ZW50IChpLmUuIHRoZSBzYW1lIHRoaW5nIGFzIGlmIHRoZXkg d2VyZSBmcm9tIGRpZmZlcmVudCBTRVRzIHRoYXQgaGF2ZSBhIGNvbW1vbiB0eG4pLjxvOnA+PC9v OnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNvbG9yOiNDMzQ2RTA7bXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAg bGV2ZWwyIGxmbzI7YmFja2dyb3VuZDp3aGl0ZSI+DQpBIGlzIGFuIGV4dGVuc2lvbiBvZiBCLjxv OnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNvbG9yOiNDMzQ2RTA7 bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxp c3Q6bDAgbGV2ZWwyIGxmbzI7YmFja2dyb3VuZDp3aGl0ZSI+DQpCIGlzIGFuIGV4dGVuc2lvbiBv ZiBBLjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNvbG9yOiND MzQ2RTA7bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bXNvLWxpc3Q6bDAgbGV2ZWwyIGxmbzI7YmFja2dyb3VuZDp3aGl0ZSI+DQpUaGV5IGFyZSBhbGlh c2VzIGZvciBvbmUgYW5vdGhlci48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJjb2xvcjojQzM0NkUwO21zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMiBsZm8yO2JhY2tncm91bmQ6d2hpdGUi Pg0KVGhleSBhcmUgbm90IGFjdHVhbGx5IHJlbGF0ZWQgdG8gb25lIGFub3RoZXIgaW4gYW55IHdh eS48bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjwvb2w+DQo8b2wgc3RhcnQ9IjMiIHR5cGU9IjEiPg0K PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxldmVsMSBs Zm8zO2JhY2tncm91bmQ6d2hpdGUiPg0KQ2xhaW0gc2VtYW50aWNzIGJlY29tZSBoYXJkZXIgdG8g ZGVmaW5lLCBhcyBkaWZmZXJlbnQgcHJvZmlsZXMgbWF5IHdhbnQgdG8gdXNlIHRoZSBzYW1lIGNs YWltcyBpbiBkaWZmZXJlbnQgd2F5cy48bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCklmIHRoZSBXRyB3YW50cyB0byBibG9j ayAxIGFuZCAyIGFib3ZlLCB0aGVuIEkgYmVsaWV2ZSB3ZSBoYXZlIHRvIGVzdGFibGlzaCBhbiBl dmVudCByZWdpc3RyeSB0byBlbnN1cmUgbmV3IEV2ZW50IHByb2ZpbGVzIGRvIG5vdCBvdmVybGFw IHRvIGVsaW1pbmF0ZSB0aGUgbmVlZCB0byBleHByZXNzIG11bHRpcGxlIGV2ZW50cy48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmlj aGFubmFdSeKAmW0gbm90IHN1cmUgd2hhdCB5b3UgbWVhbiBieSB0aGlzLiBBcmUgeW91IHJlZmVy cmluZyB0byBldmVudCBuYW1lcz8gVGhvc2UgYXJlIGFscmVhZHkgZGVmaW5lZCBieSB0aGUgc3Bl YyB0byBiZSBVUklzLlsvcmljaGFubmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2Jh Y2tncm91bmQ6d2hpdGUiPg0KUGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQpPcmFjbGUgQ29ycG9yYXRpb24sIElk ZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hp dGUiPg0KQGluZGVwZW5kZW50aWQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxhIGhy ZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193 d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQ cHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1VLWE1SEJORDBIYVRYNGFuTlpmelg3cERzZks1ZjBo OW1aOUNaa2tHaWVjJmFtcDtzPUtCd0tQRm5xWV9ROTVDVEFfX1dHQ1lHVHhyRDdBR0N4dWVvUFhu S0VVVDAmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ d3d3LmluZGVwZW5kZW50aWQuY29tPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUu Y29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50 QG9yYWNsZS5jb208L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzti YWNrZ3JvdW5kOndoaXRlIj4NCk9uIE9jdCAyOSwgMjAxNywgYXQgNDoxMiBQTSwgRGljayBIYXJk dCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ZGljay5oYXJkdEBnbWFpbC5jb208L3NwYW4+ PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5QaGlsOjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFj a2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiB5b3VyIGV4YW1wbGVz IGZvciBoYXZpbmcgYSBwbHVyYWxpdHkgb2YgZXZlbnRzLCB5b3UgdXNlIHRoZSB3b3JkICZxdW90 O21heSZxdW90Oywgd2hpY2ggbGVhZHMgbWUgdG8gcXVlc3Rpb24gaWYgYSBwbHVyYWxpdHkgb2Yg ZXZlbnRzIGlzIHJlYWxseSByZXF1aXJlZCBpbiBTRVQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tn cm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+WW91IHBvc2l0IHRoYXQgaXQg d2lsbCBiZSBkaWZmaWN1bHQgZm9yIGEgZGlzdHJpYnV0ZWQgc3lzdGVtIHRvIGNvcnJlbGF0ZSBt dWx0aXBsZSBTRVRzIHdpdGggdGhlIHNhbWUgJnF1b3Q7dHhuJnF1b3Q7LCBidXQgdGhlIGRpc3Ry aWJ1dGVkIHN5c3RlbSB3aWxsIGNlcnRhaW5seSBuZWVkIHRvIGNvcnJlbGF0ZSBldmVudHMgb24g dGhlIHNhbWUgc3ViamVjdA0KIC0tIGNvcnJlbGF0aW5nIGV2ZW50cyBvbiB0aGUgc2FtZSAmcXVv dDt0eG4mcXVvdDsgb24gdGhlIHNhbWUgc3ViamVjdCBzZWVtcyBmYWlybHkgc2ltcGxlLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PkkgdGhpbmsgdGhhdCBhIHJlY2VpdmVyIHdpbGwgbmVlZCB0byBjb3JyZWxhdGUgbXVsdGlwbGUg U0V0cyBvbiB0aGUgc2FtZSBzdWJqZWN0LCBzbyBoYXZpbmcgbXVsdGlwbGUgZXZlbnRzIGluIGEg U0VUIGlzIHJlZHVuZGFudCwgYW5kIGFkZHMgY29tcGxleGl0eSB3aXRoIG5vIGNsZWFyIGJlbmVm aXQgdGhhdCBJIGNhbiBzZWUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hp dGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+QW4gaW1wbGVtZW50b3IgbWF5IGNob29zZSB0byBzZW5k IG11bHRpcGxlIFNFVHMsIG9yIHNlbmQgYSBzaW5nbGUgU0VUIHdpdGggbXVsdGlwbGUgZXZlbnRz LCBzbyBhIHJlY2VpdmVyIHdpbGwgbmVlZCB0byBzdXBwb3J0IGJvdGguIEkgcHJlZmVyIHdlIHBp Y2sgb25lIHdheSBhbmQgbWluaW1pemUgdGhlIGNvZGUgcGF0aHMsIGFuZCB3ZQ0KIHdpbGwgbmVl ZCB0byBzdXBwb3J0IGNvcnJlbGF0aW5nIGFjcm9zcyBtdWx0aXBsZSBTRVRzLCBzbyB0aGF0IHNl ZW1zIHRoZSBiZXN0IG1lY2hhbmlzbS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0 ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZl dGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3Vu ZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5MZXQgbWUga25vdyBpZiB0aGVyZSBpcyBzb21l dGhpbmcgSSBtaXNzZWQgaW4gbXkgbG9naWMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6 d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tn cm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+L0RpY2s8L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBTdW4s IE9jdCAyOSwgMjAxNyBhdCAxMToyOCBBTSwgWWFyb24gU2hlZmZlcjxzcGFuIGNsYXNzPSJtNjk1 ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20i IHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj55YXJvbmYuaWV0ZkBn bWFpbC5jb208L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0ibTY5NTg3NzY5ODAyNDY2NjA3MDNt NDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPndy b3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdo dDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+SW4gdGhhdCBjYXNlLCBsZXQn cyBhZGQgdGV4dCB0byB0aGF0IGVmZmVjdCwgZS5nLiB3ZSBjb3VsZCBhZGQgdG8gdGhlIGRlZmlu aXRpb24gb2YgdGhlICZxdW90O2V2ZW50cyZxdW90OyBjbGFpbTo8YnI+DQo8YnI+DQpQcm9maWxp bmcgc3BlY2lmaWNhdGlvbnMgU0hPVUxEIGRlZmluZSB0aGUgYWxsb3dlZCBldmVudCBzdGF0ZW1l bnRzLCBhbmQgTUFZIHJlc3RyaWN0IHRoZWlyIG51bWJlci4gRm9yIGV4YW1wbGUsIHNvbWUgcHJv ZmlsZXMgbWF5IHJlcXVpcmUgdGhpcyBjbGFpbSB0byBjb250YWluIG9ubHkgYSBzaW5nbGUgZXZl bnQgc3RhdGVtZW50Ljxicj4NCjxicj4NClRoYW5rcyw8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDs8c3BhbiBjbGFzcz0ibTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0 OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPllhcm9uPGJyPg0KPGJyPg0K T24gMjQvMTAvMTcgMjI6MTAsIE1pa2UgSm9uZXMgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt YXJnaW4tYm90dG9tOjEyLjBwdDtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PkkgYWdyZWUgd2l0aCBtdWNoIG9mIFBoaWzigJlzIHJhdGlvbmFsZSBoZXJlLjxicj4NCjxicj4N Ckl04oCZcyBmaW5lIGZvciBzb21lIHByb2ZpbGVzIHRvIHNheSB0aGF0IHRoZSDigJxldmVudHPi gJ0gc2V0IG11c3QgYmUgYSBzaW5nbGV0b24uJm5ic3A7IFRoYXQgZG9lc27igJl0IGhhdmUgdG8g YmUgdHJ1ZSBmb3IgYWxsIGV2ZW50cy4mbmJzcDsgSSB0aGluayB0aGluZ3MgYXJlIGZpbmUgYXMt aXMuPGJyPg0KPGJyPg0KJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 PHNwYW4gY2xhc3M9Im02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2NDRhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4tLSBNaWtlPGJyPg0KPGJyPg0KKkZyb206 KiBJZC1ldmVudCBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQtZXZlbnQt Ym91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XSAqT24gQmVoYWxmIE9mICpQaGlsIEh1bnQ8YnI+ DQoqU2VudDoqIE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyA4OjQ3IFBNPGJyPg0KKlRvOiogUmlj aGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0OzxhIGhyZWY9Im1haWx0bzpyaWNoYW5uYUBhbWF6 b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cmljaGFu bmFAYW1hem9uLmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCipDYzoqIElEIEV2ZW50cyBNYWlsaW5n IExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmlkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwv YT4mZ3Q7PGJyPg0KKlN1YmplY3Q6KiBSZTogW0lkLWV2ZW50XSBVc2UgY2FzZXMgZm9yIG11bHRp cGxlIGV2ZW50cyBwZXIgU0VUPzxicj4NCjxicj4NCkFubmFiZWxsZSw8YnI+DQo8YnI+DQpJIGhh dmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHByb3Bvc2FsLjxicj4NCjxicj4NClBy b2ZpbGluZyBJbmRlcGVuZGVuY2UgLyBLZWVwaW5nIEV2ZW50IFBheWxvYWRzIEluZGVwZW5kZW50 PGJyPg0KPGJyPg0KSW5kaWNhdGluZyB0aGF0IGV4dGVuc2lvbnMgc2hvdWxkIGJlIGhhbmRsZWQg YnkgcHJvZmlsZXMgbGVhZHMgdG8gbW9yZSBpbnRlci1vcGVyYWJpbGl0eSBpc3N1ZXMgYW5kIG1v cmUgaW1wb3J0YW50bHkgaW50cnVkZXMgb24gdGhlIEV2ZW50IHBheWxvYWQgc3BhY2UgYnkgc3Vn Z2VzdGluZyBhIHN1Yi1zY2hlbWEgY3JlYXRlcyBwb3RlbnRpYWwgbGltaXRhdGlvbnMgYW5kIGNv bmZsaWN0cyB0aGF0IG1heSBhZGQgdG8gY29tcGxleGl0eSBsYXRlcg0KIG9uLiBUaGUgY3VycmVu dCBmb3JtYXQgYWxsb3dzIGEgcGFyc2VyIHRvIGRpc2NvdmVyIGFuZCB1bmxvYWQgb25lIG9yIG1v cmUgSlNPTiBwYXlsb2FkcyB3aGljaCBjYW4gZWFjaCBoYXZlIGluZGVwZW5kZW50IHN0cnVjdHVy ZS48YnI+DQo8YnI+DQpHZW5lcmFsIGV4dGVuc2lvbnM8YnI+DQo8YnI+DQpUaGUgcHJvcG9zYWwg YWxzbyBydWxlcyBvdXQgZ2VuZXJhbCBwdXJwb3NlIGV4dGVuc2lvbnMgbm90IHJlbGF0ZWQgdG8g YW55IHNwZWNpZmljIGV2ZW50LiBHaXZlbiB0aGUgZW1lcmdlbmNlIG9mIGl0ZW1zIGxpa2UgR1BS RCwgSSB3b3VsZCBub3Qgd2FudCB0byBibG9jayB0aGUgYWJpbGl0eSB0byBhZGQgbWV0YS1kYXRh IG9yIG90aGVyIGdlbmVyYWwgcHVycG9zZSBpdGVtcy4gV2UgY2FuIGFsc28gYW50aWNpcGF0ZSBz b21lIGRlbGl2ZXJ5IHNjZW5hcmlvcw0KIHdoZXJlIGFkZGl0aW9uYWwgZGF0YSBtaWdodCBiZSBy ZXF1aXJlZC4gRXZlbiB0aG91Z2ggdGhlcmUgaXMgbm8gY3VycmVudCBwbGFubmVkIHVzZSwgSSBz ZWUgbm8gZ29vZCByZWFzb24gdG8gcnVsZSB0aGlzIG91dC48YnI+DQo8YnI+DQpNdWx0aXBsZSBF dmVudHMgRnJvbSBEaWZmZXJlbnQgRmFtaWxpZXMgKHZzLiBNdWx0aXBsZSBFdmVudHMgZnJvbSBh IHNpbmdsZSBmYW1pbHkgbGlrZSBSSVNDKTxicj4NCjxicj4NCkluIG91ciBSSVNDIHNlc3Npb24g d2UgZGlzY3Vzc2VkIGV4cHJlc3NpbmcgbXVsdGlwbGUgZGlzdGluY3QgUklTQyBldmVudHMgaW4g b25lIFNFVC4gVGhlIGRpc2N1c3Npb24gd2FzIHRoYXQgb25seSBvbmUgUklTQyBldmVudCBhdCBh IHRpbWUuIFdlIGRpZCBub3QgZGlzY3VzcyBvdGhlciBldmVudCBwcm9maWxlcy4gSSBkb27igJl0 IHNlZSBhIHJlYXNvbiB0byBydWxlIG91dCBtdWx0aS1ldmVudHMgZnJvbSBkaWZmZXJlbnQgZmFt aWxpZXMgYXQgdGhlDQogU0VUIGxldmVsLiBFYWNoIHByb2ZpbGUgaXMgZXhwcmVzc2luZyBzbGln aHRseSBkaWZmZXJlbnQgdGhpbmdzIGFib3V0IHRoZSBzYW1lIGV2ZW50Ljxicj4NCjxicj4NCkkg Y2FuIGZvcnNlZSBzb21lIGNhc2VzIHdoZXJlIGl0IGlzIG5vdCBjbGVhciB3aGljaCBpcyB0aGUg cHJpbWFyeSBhbmQgd2hpY2ggaXMgdGhlIGV4dGVuc2lvbi4mbmJzcDsgVGhlcmUgbWF5IG5vdCBi ZSBhIGNsZWFyIHdpbm5lci48YnI+DQo8YnI+DQpBIGNvdXBsZSBvZiBleGFtcGxlcyAodGhlc2Ug YXJlIG5lY2Vzc2FyaWx5IHJlYWzigKZqdXN0IHBvc3NpYmlsaXRpZXMpOjxicj4NCjxicj4NCiog SXQgaXMgcHJvYmFibHkgdXNlZnVsIHRvIGJlIGFibGUgdG8gZXhwcmVzcyBzaW1sYXIvb3Zlcmxh cHBpbmcgZXZlbnRzIGZyb20gZGlmZmVyZW50IFNFVCBwcm9maWxlcyBpbiBvbmUgU0VULiZuYnNw OyBGb3IgZXhhbXBsZSBhIEJhY2tjaGFubmVsIExvZ291dCAmYW1wOyBhIFJJU0Mgc2Vzc2lvbiBj YW5jZWwgZXZlbnQuPGJyPg0KPGJyPg0KKiBTQ0lNIG1heSB3YW50IHRvIHJlcHJlc2VudCBhIHNp bmdsZSB0cmFuc2FjdGlvbiBhcyBjYXVzaW5nIG11bHRpcGxlIHN0YXRlIGNoYW5nZXMgaW4gYW4g ZXZlbnQgKGUuZy4gYSBwYXNzd29yZCBjaGFuZ2UgY2F1c2VzIG11bHRpcGxlIGVmZmVjdHMpLiBI YXZpbmcgdG8gY2hhc2UgZG93biBtdWx0aXBsZSBldmVudHMgYW5kIGNvcnJlbGF0ZSBieSDigJx0 eG7igJ0gd291bGQgYmUgY2hhbGxlbmdpbmcgaW4gYSBtdWx0aS10aHJlYWRlZC9tdWx0aS1ub2Rl DQogZGVsaXZlcnkgc3lzdGVtLiZuYnNwOyAmbmJzcDtUaGUgU0NJTSBsaXN0IGhhcyBub3QgZGlz Y3Vzc2VkIHRoaXMsIGJ1dCBJIHdvdWxkIG5vdCB3YW50IHRvIGJsb2NrIHRoaXMgY2FwYWJpbGl0 eS4mbmJzcDsgSU9XIC0gSnVzdCBiZWNhdXNlIFJJU0MgZG9lcyBub3Qgd2FudCB0byBleHByZXNz IG11bHRpcGxlIGV2ZW50cyBkb2VzIG5vdCBtYWtlIHRoaXMgdHJ1ZSBmb3Igb3RoZXIgcHJvZmls ZXMuPGJyPg0KPGJyPg0KKiBXZSBtYXkgd2lzaCB0byBpbmRpY2F0ZSBhIFNDSU0gUGFzc3dvcmQg UmVzZXQgd2FzIHBlcmZvcm1lZCBhbmQgYSBMb2dvdXQvc2Vzc2lvbiBjYW5jZWxsYXRpb24gaXMg ZXhwcmVzc2VkIGF0IHRoZSBzYW1lIHRpbWUuJm5ic3A7IFRoZSBldmVudHMgYXJlIHJlbGF0ZWQg YnV0IGV4cHJlc3MgZGlmZmVyZW50IGRhdGEuPGJyPg0KPGJyPg0KQXZvaWRpbmcgQ29uZnVzaW9u IEZyb20gU2ltaWxhciBFdmVudHMgT3JpZ2luYXRpbmcgZnJvbSB0aGUgU2FtZSBUcmFuc2FjdGlv bjxicj4NCjxicj4NCklmIGV2ZW50cyBhcmUgc2VudCBzZXBhcmF0ZWx5LCB0aGVuIG1vcmUgdHJh Y2tpbmcgb2Ygc3RhdGUgKGUuZy4gYnkgdHhuKSB3b3VsZCBiZSByZXF1aXJlZCB0byBlbnN1cmUg c2ltaWxhciBldmVudHMgYXJlIG5vdCBtaXN0YWtlbiBvciBoYW5kbGVkIGFzIHJlcGVhdHMuIFdo aWxlIHR4biBwcm92aWRlcyB1c2VmdWwgYXVkaXQgYW5hbHlzaXMgY2FwYWJpbGl0eSwgSeKAmW0g bm90IHN1cmUgaXQgY2FuIGJlIHVzZWQgaW4gbGl2ZSBvciBuZWFyLXJlYWwNCiB0aW1lIHN5c3Rl bXMgZ2l2ZW4gZGlzdHJpYnV0ZWQgbXVsdGktbm9kZSwgbXVsdGktdGhyZWFkaW5nIGFyY2hpdGVj dHVyZXMuPGJyPg0KPGJyPg0KUHJldmlvdXMgRGlzY3Vzc2lvbjxicj4NCjxicj4NCkkgbm90ZSB0 aGF0IEkgb3JpZ2luYWxseSByYWlzZWQgaGF2aW5nIGFuIGF0dHJpYnV0ZSB0byBkZXNpZ25hdGUg cHJpbWFyeSBldmVudCBhdHRyaWJ1dGUgdG8gYWxsZXZpYXRlIHlvdXIgY29uY2VybiwgYnV0IHRo aXMgd2FzIG5vdCBhY2NlcHRlZC4gU2VlOjxicj4NCjxicj4NCio8c3BhbiBjbGFzcz0ibTY5NTg3 NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2 ZW50X2N1cnJlbnRfbXNnMDA0MDYuaHRtbCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERw Y3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4 dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9UzNzTVZpcU12RWdud0diSndPUU55Y3JPeXI3U2VmcHFf TW9GT0tjRWVDRSZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVy cGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJl bnQvbXNnMDA0MDYuaHRtbDwvc3Bhbj48L2E+PGJyPg0KPGJyPg0KKjxzcGFuIGNsYXNzPSJtNjk1 ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbC0yRGFyY2hpdmVfd2ViX2lkLTJE ZXZlbnRfY3VycmVudF9tc2cwMDE0MC5odG1sJmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0 RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFB dXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz1HeTlneVJvSUl0YS1jU2hWN2JOMTYxYXk0eUU2cjlH MV9BYV9OZUJueWxnJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQvY3Vy cmVudC9tc2cwMDE0MC5odG1sPC9zcGFuPjwvYT48YnI+DQo8YnI+DQpUaGUgY29uc2Vuc3VzLCBh dCBsZWFzdCBhcyBJIGludGVycHJldGVkIGl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBmaWd1 cmUgdGhpcyBvdXQgYmFzZWQgb24gdGhlIGRlZmluaXRpb25zIGl0IGhhcyBmb3IgZWFjaCBldmVu dCBVUkkgYW5kIHRoZSBwcm9maWxlcyB0aGV5IHJlcHJlc2VudC4gSU9XIC0gUklTQyBpcyBmcmVl IHRvIGxpbWl0IHRoYXQgb25seSBvbmUgUklTQyBldmVudCBiZSBleHByZXNzZWQgYXQgYSB0aW1l Ljxicj4NCjxicj4NClBoaWw8YnI+DQo8YnI+DQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5 IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdDxicj4NCjxicj4NCkBpbmRlcGVuZGVudGlkPGJyPg0K PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5x V055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERr bjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9OU5QNW5hbWc2cklWend1bjljLTFxMHdoc3lY d1N2dEhCMGYyZEtrZkNYOCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJt Njk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mYW1wO2Q9RHdN RmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1w O3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1ZQkNH bEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JmFtcDtzPTlOUDVuYW1nNnJJ Vnp3dW45Yy0xcTB3aHN5WHdTdnRIQjBmMmRLa2ZDWDgmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbTwv c3Bhbj48L2E+Jmd0Ozxicj4NCjxicj4NCjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xl LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnBoaWwuaHVu dEBvcmFjbGUuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0ibTY5NTg3NzY5ODAyNDY2NjA3MDNt NDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZs dDttYWlsdG86PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9i bGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3Nw YW4+PC9hPiZndDs8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7IE9uIE9jdCAyMywgMjAxNywgYXQg NzowMiBQTSwgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGU8YnI+DQombmJzcDsgJm5ic3A7ICZs dDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJpY2hhbm5hQGFtYXpvbi5jb208L3NwYW4+PC9hPjxz cGFuIGNsYXNzPSJtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86 cmljaGFubmFAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpw dXJwbGUiPnJpY2hhbm5hQGFtYXpvbi5jb208L3NwYW4+PC9hPiZndDsmZ3Q7DQogd3JvdGU6PGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBUaGUgY3VycmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMg YWxsb3dzIGZvciBleHByZXNzaW5nIG11bHRpcGxlPGJyPg0KJm5ic3A7ICZuYnNwOyBldmVudHMg d2l0aGluIHRoZSBzYW1lIHRva2VuLCB3aGljaCBpbnRyb2R1Y2VzIGFkZGl0aW9uYWwgY29tcGxl eGl0eTxicj4NCiZuYnNwOyAmbmJzcDsgYW5kIHJvb20gZm9yIGFtYmlndW91cyBzZW1hbnRpY3Mu IFdl4oCZdmUgZGlzY3Vzc2VkIHRoaXMgaW4gdGhlIE9JREY8YnI+DQombmJzcDsgJm5ic3A7IFJJ U0Mgd29ya2luZyBncm91cCBhbmQgdGhlIGN1cnJlbnQgY29uc2Vuc3VzIHRoZXJlIGlzIHRoYXQg UklTQyB3aWxsPGJyPg0KJm5ic3A7ICZuYnNwOyByZXF1aXJlIHRoYXQgUklTQyBldmVudHMgbXVz dCBiZSB0aGUgb25seSBldmVudCBpbiB0aGUgU0VULCBoYXZpbmc8YnI+DQombmJzcDsgJm5ic3A7 IGlkZW50aWZpZWQgd2F5cyB0byBjbGVhcmx5IGFuZCBlYXNpbHkgc3VwcG9ydCB0aGUgaGFuZGZ1 bCBvZiB1c2U8YnI+DQombmJzcDsgJm5ic3A7IGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVy IHRva2VuIHRoYXQgcGVvcGxlIGhhdmUgcmFpc2VkLiBXaXRoPGJyPg0KJm5ic3A7ICZuYnNwOyB0 aGF0IGNvbnRleHQgaW4gbWluZCwgSSBwcm9wb3NlIHN0cmlraW5nIHRoZSBkZWZpbml0aW9uIG9m IHRoZTxicj4NCiZuYnNwOyAmbmJzcDsg4oCcZXZlbnRz4oCdIGNsYWltIGZyb20gdGhlIFNlY3Vy aXR5IEV2ZW50IFRva2VuIHNwZWMsIGFuZCByZXBsYWNpbmcgaXQ8YnI+DQombmJzcDsgJm5ic3A7 IHdpdGggdGhlIGZvbGxvd2luZyBkZWZpbml0aW9uIGZvciBhbiDigJxldmVudOKAnSBjbGFpbSAo c2luZ3VsYXIpOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnQ8YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7IEEgSlNPTiBvYmplY3QgY29udGFpbmluZyBhbiAmcXVvdDtldmVudF90eXBlJnF1 b3Q7IG1lbWJlciB3aG9zZSB2YWx1ZSBpcyBhIFVSSTxicj4NCiZuYnNwOyAmbmJzcDsgcmVwcmVz ZW50aW5nIGEgdHlwZSBvZiBldmVudCBkZWZpbmVkIGluIGEgUHJvZmlsaW5nIFNwZWNpZmljYXRp b24uPGJyPg0KJm5ic3A7ICZuYnNwOyBUaGUgb2JqZWN0IE1BWSBvdGhlcndpc2UgYmUgZW1wdHks IG9yIE1BWSBjb250YWluIGFkZGl0aW9uYWwgbWVtYmVyczxicj4NCiZuYnNwOyAmbmJzcDsgYXMg ZGVzY3JpYmVkIGJ5IHRoZSBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbi48YnI+DQo8YnI+DQombmJz cDsgJm5ic3A7IEhlcmUgaXMgdGhlIGV4YW1wbGUgU0VUIGZyb20gc2VjdGlvbiAyLjMsIHJld3Jp dHRlbiB3aXRoIHRoaXMgY2hhbmdlPGJyPg0KJm5ic3A7ICZuYnNwOyBtaW5kOjxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0ibTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1 NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPns8YnI+DQo8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90OzRkMzU1 OWVjNjc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4JnF1b3Q7LDxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7Jm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjQwNCw8YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0i aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbTwvc3Bhbj48L2E+PHNwYW4gY2xh c3M9Im02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUu Y29tLyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbS88L3NwYW4+PC9hPiZndDsmcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsmbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9z Y2ltLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdldD0i X2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3NjaW0uZXhhbXBsZS5j b20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvc3Bhbj48L2E+JnF1b3Q7LDxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90OzxhIGhy ZWY9Imh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2 ZWU3IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9z Y2ltLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L3NwYW4+PC9h PiZxdW90Ozxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7IF0sPGJyPg0KPGJy Pg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6IHs8YnI+DQo8 YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtldmVudF90 eXBlJnF1b3Q7OiAmcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpjcmVhdGUmcXVvdDss PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7 cmVmJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMv NDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJk NmFiNjFlNzUyMWQ5PC9zcGFuPjwvYT4mcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YXR0cmlidXRlcyZxdW90OzogWyZxdW90O2lk JnF1b3Q7LCAmcXVvdDtuYW1lJnF1b3Q7LCAmcXVvdDt1c2VyTmFtZSZxdW90OywgJnF1b3Q7cGFz c3dvcmQmcXVvdDssICZxdW90O2VtYWlscyZxdW90O108YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyZuYnNwOyB9PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyB9PGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwOyBEb2VzIGFueW9uZSBpbiB0aGUgd29ya2luZyBncm91cCBoYXZlIHVzZSBjYXNl cyBmb3IgU0VUcyB0aGF0IGNhbm5vdDxicj4NCiZuYnNwOyAmbmJzcDsgYmUgbWV0IGJ5IHRoaXMg cHJvcG9zZWQgdGV4dD8gV2l0aGluIFJJU0MsIHdlIGlkZW50aWZpZWQgdGhyZWUgdXNlPGJyPg0K Jm5ic3A7ICZuYnNwOyBjYXNlcywgd2l0aCBzb2x1dGlvbnMgb3V0bGluZWQgYmVsb3c6PGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwOyAqKjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgKkV4dGVuc2lv bnMqPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBFdmVudCBleHRlbnNpb24gbWVjaGFuaXNtcyBj YW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0aGUgZXZlbnQ8YnI+DQombmJzcDsgJm5ic3A7IG9i amVjdC4gQSBzaW1wbGUgYXBwcm9hY2ggd291bGQgYmUgdG8gJm5ic3A7ZGVmaW5lIGFuIOKAnGV4 dGVuc2lvbnPigJ0gbWVtYmVyPGJyPg0KJm5ic3A7ICZuYnNwOyB0aGF0IGlzIGEgbGlzdCBvZiBl dmVudCBvYmplY3RzIChvciBzZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCdPGJyPg0KJm5i c3A7ICZuYnNwOyBjbGFpbSBhcyBkZWZpbmVkIGluIHRoZSBjdXJyZW50IHNwZWMpLiBUaGlzIGhh cyB0aGUgYWR2YW50YWdlIG9mPGJyPg0KJm5ic3A7ICZuYnNwOyBtYWtpbmcgaXQgY2xlYXIgaW4g dGhlIGRhdGEgc3RydWN0dXJlIHRoYXQgdGhlcmUgaXMgYSBzaW5nbGUgcHJpbWFyeTxicj4NCiZu YnNwOyAmbmJzcDsgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lvbnMuIFRoZXJlIGlz IG5vIHJvb20gZm9yIGNvbmZ1c2lvbjxicj4NCiZuYnNwOyAmbmJzcDsgb3ZlciB3aGljaCBldmVu dCBpcyBwcmltYXJ5LCBvciBpZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQgYXQgYWxsLjxicj4N CiZuYnNwOyAmbmJzcDsgSSB3b3VsZCBiZSBmaW5lIHdpdGggYWRkaW5nIHNvbWV0aGluZyBsaWtl IHRoaXMgdG8gbXkgcHJvcG9zZWQgdGV4dCw8YnI+DQombmJzcDsgJm5ic3A7IGlmIHRoZXJlIGlz IGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkgdXNlZnVsLjxicj4NCjxicj4NCiZuYnNwOyAm bmJzcDsgKkFsaWFzZXMqPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBUaGlzIHVzZSBjYXNlIHdh cyBicm91Z2h0IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRzPGJyPg0KJm5i c3A7ICZuYnNwOyBmcm9tIGRyYWZ0IGV2ZW50IG5hbWVzIHRvIHN0YW5kYXJkaXplZCBldmVudCBu YW1lcy4gSW4gdGhpcyBjYXNlLDxicj4NCiZuYnNwOyAmbmJzcDsgdGhlIGV2ZW50IHRyYW5zbWl0 dGVyIGNhbiB0cmFuc21pdCB0d28gdG9rZW5zIGZvciB0aGUgbG9naWNhbCBldmVudCw8YnI+DQom bmJzcDsgJm5ic3A7IG9uZSB1c2luZyB0aGUgb2xkIG5hbWUgYW5kIGFub3RoZXIgdXNpbmcgdGhl IG5ldyBuYW1lLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgKlJlbGF0ZWQgRXZlbnRzKjxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDsgVGhlIFNFVCBzcGVjIGRlZmluZXMgdGhlIHR4biBjbGFpbSBh cyBhIG1lYW5zIG9mIGNvcnJlbGF0aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyBpbmRlcGVuZGVudCB0 b2tlbnMgdGhhdCByZWxhdGUgdG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC48YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7IC0tPHNwYW4gY2xhc3M9Im02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0 NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQombmJz cDsgJm5ic3A7IEFubmFiZWxsZSBSaWNoYXJkIEJhY2ttYW48YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7IEFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXM8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KJm5i c3A7ICZuYnNwOyBJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQombmJzcDsgJm5ic3A7PHNwYW4g Y2xhc3M9Im02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5JZC1ldmVudEBp ZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9Im02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYy MzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7bWFp bHRvOjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7 PGJyPg0KJm5ic3A7ICZuYnNwOzxzcGFuIGNsYXNzPSJtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2 MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193 d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7 Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209czVieUJlNUtBTm5H VnVBYjFtQXVwRUdvSm44WEc1SklVVXdXR0ZTaWJFYyZhbXA7cz1YOG9SU3EzSXpsRjdqaVJBZVpo WHBSM2VWSTBJNThaRmQ0ZUVaZmd5b0lZJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZh bXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPXM1YnlCZTVLQU5uR1Z1QWIxbUF1cEVHb0puOFhHNUpJVVV3V0dGU2liRWMmYW1wO3M9WDhv UlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZkNGVFWmZneW9JWSZhbXA7ZT08L3NwYW4+PC9h Pjxicj4NCjxicj4NCjxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0i bWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxhIGhyZWY9Imh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3Lmll dGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdt YW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0y dERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9V3JNdVFSd0xWODAyaU1RNHdZQjFmMnJG VUd1NHpiaGNXMDAxZkswMkVYcyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2 ZW50PC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5J ZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZs WllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlY UHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVp YjlLQVRrUmxRRzFpdyZhbXA7cz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFm SzAyRVhzJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L3NwYW4+PC9h Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndo aXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVs dmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hp dGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+LS08c3BhbiBjbGFzcz0ibTY5NTg3NzY5ODAyNDY2NjA3 MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5k OndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPlN1YnNjcmliZSB0byB0aGU8c3BhbiBjbGFzcz0i bTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwLTNBX19oYXJkdHdhcmUuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpC VFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zz ai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9TFlONzJHZ0tWaEhzVDZ0QXFCZS1l TW9XTXZ5XzdkZkZuMXVaMEhLNll1USZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5IQVJEVFdBUkU8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtNjk1ODc3 Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+bWFpbA0KIGxpc3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBhbSB3b3Jr aW5nIG9uITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+X19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWls aW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGll dGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cu aWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJU V21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xLOW1qamhjRnNq LTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYy ckZVR3U0emJoY1cwMDFmSzAyRVhzJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6cHVycGxlIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQm YW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFw SV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZh bXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JmFtcDtzPVdy TXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZLMDJFWHMmYW1wO2U9PC9zcGFuPjwv YT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtiYWNrZ3JvdW5kOndoaXRlIj5fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48 YnI+DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+SWQtZXZlbnQgbWFpbGluZyBsaXN0 PC9zcGFuPjxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRh cmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZTtiYWNrZ3JvdW5kOndo aXRlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48YSBocmVmPSJodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFu X2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQ cHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1VLWE1SEJORDBIYVRYNGFuTlpmelg3cERzZks1ZjBo OW1aOUNaa2tHaWVjJmFtcDtzPXJ2ZHJ0STdyWU5SQW5xWkRsdEN3QkFaVkhLcC1NSjIwdWkybm00 NlFTejAmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJw bGU7YmFja2dyb3VuZDp3aGl0ZSI+aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50 JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVh cElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEm YW1wO209VS1hNUhCTkQwSGFUWDRhbk5aZnpYN3BEc2ZLNWYwaDltWjlDWmtrR2llYyZhbXA7cz1y dmRydEk3cllOUkFucVpEbHRDd0JBWlZIS3AtTUoyMHVpMm5tNDZRU3owJmFtcDtlPTwvc3Bhbj48 L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJyPg0KPGJyIGNs ZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4t LQ0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlN1YnNjcmliZSB0byB0aGUNCjxhIGhyZWY9Imh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19oYXJkdHdh cmUuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUly TVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNM TjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cm YW1wO3M9d3RnRDNOcDB2eWhMZHBFd1VpcXNmNEl0aXdBM09tN0dyb2I3MEx4MHIzayZhbXA7ZT0i IHRhcmdldD0iX2JsYW5rIj4NCkhBUkRUV0FSRTwvYT4gbWFpbCBsaXN0IHRvIGxlYXJuIGFib3V0 IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiE8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+ SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBa aDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQ a0FJMWFMY0xONEtaTkEmYW1wO209aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1 OF9xU0NfdyZhbXA7cz1PZTBxZkxFWDgzdnRYTTdXbDJjWUJlLUdnMURWUGpoWGpWSmtmaFZSendj JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRl dmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVC NjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRL Wk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1w O3M9T2UwcWZMRVg4M3Z0WE03V2wyY1lCZS1HZzFEVlBqaFhqVkprZmhWUnp3YyZhbXA7ZT08L2E+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1YnNjcmliZSB0byB0 aGUgPGEgaHJlZj0iaHR0cDovL2hhcmR0d2FyZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+DQpIQVJE VFdBUkU8L2E+IG1haWwgbGlzdCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcg b24hPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB0504E322952C6E74296341C0F55F0CY4PR21MB0504namp_-- From nobody Tue Oct 31 21:52:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99ED413FB42 for ; Tue, 31 Oct 2017 21:52:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vDxIYFJOotsZ for ; Tue, 31 Oct 2017 21:52:08 -0700 (PDT) Received: from mail-pf0-x236.google.com (mail-pf0-x236.google.com [IPv6:2607:f8b0:400e:c00::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E3E713FB39 for ; Tue, 31 Oct 2017 21:52:08 -0700 (PDT) Received: by mail-pf0-x236.google.com with SMTP id x7so1045367pfa.1 for ; Tue, 31 Oct 2017 21:52:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Sdag1JLOUefRVWrUBgBBaYpCbB9kYKeKxVj4sGKI0Xk=; b=Z5Rx1JDtEU+7Tx616ycUFGJjf/rcBkC7Q/EhnHO0Jl/fQ12hlDYLzIq80RmxYFNp6n byxd2EiKgtRWlsQ5AZxEdBkfP+0pSz5Se58bw04msiaqKSj4iKWIzOKeBXxO/dYbH8n6 MDSv6XWKQIrLFW7K0Y8TKsKnxiECa6oebFHU+doksnljVlY4XYGsfdarKpOX0gXz/if3 PNpNpc7EWIhaZx0B0YfTlnIyCe3/UHR3dsmTO9rQCHjRiyk527muFYerV7DBnN1coh/x 7E3jfXROejDBfre4HIDrEb2gp3wh1UaDzdkWtr6cv+/bOuddnHUcmfuNfHA7TkMM8pcY /Q2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Sdag1JLOUefRVWrUBgBBaYpCbB9kYKeKxVj4sGKI0Xk=; b=mwP5MJbwr/rcwUZGl8HNMhlLi7wzm4/KoFEYxhKsl8/fOqEOYtXVZmylPKRycmnKUf B/fOCPwDmazAvIWs3t712Ly+yNwaQUZ4G4OGzJ17+JO1ItEQUOO2leEBtUI5+usBNXhK Hj8o0nFXjoQIuMV9VMzvfSXCI26n0BZGb02OLArCkaM1gQb9q8dDe/d6FZat52yRkCck 6WZF5E1LkUGf7RH1cHd8jOC3nXsdl4RiOd3UgomT/LkiYRKWbmEeU/d0BBQ2nEMwljZz zj2rrTPQ1LyY5zEIWsu9Fw/QYMZPttR8IuAw59a5BJBmlfS59PRFYLBDmMDDJUMOaAZ3 l6cg== X-Gm-Message-State: AMCzsaXiCDyJMaJ7JHnRH+TbEHX1inB3V4aOBBZu80nAtsTQS/lcziCf cRmgbJhiD0bGm0FKAuNoS91it58TpN4Dql34NhM= X-Google-Smtp-Source: ABhQp+SakKRHOfyro4oUKuW/9v1l2eFty8A23HAzctUtQeSmVi3Hp+VqtYnUvqHsA6KV/T2P3clRa93YSGF89CHQYEI= X-Received: by 10.98.130.65 with SMTP id w62mr5008081pfd.203.1509511927360; Tue, 31 Oct 2017 21:52:07 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.128.78 with HTTP; Tue, 31 Oct 2017 21:51:46 -0700 (PDT) In-Reply-To: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> From: Dick Hardt Date: Tue, 31 Oct 2017 21:51:46 -0700 Message-ID: To: Mike Jones Cc: "Phil Hunt (IDM)" , Yaron Sheffer , "Richard Backman, Annabelle" , ID Events Mailing List Content-Type: multipart/alternative; boundary="94eb2c119bb836f972055ce4a2cf" Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 04:52:17 -0000 --94eb2c119bb836f972055ce4a2cf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Please direct me to a proposal that has a "primary" and "secondary" events. I agree that is undesirable. I would also encourage to engage in the discussions so that we can drive clarity and simplicity. I think the proposal is that there is one event per SET. I think having more than one event per SET adds complexity as a receiver must deal with receiving correlated events in one SET as well as correlated events in the same SET. /Dick On Tue, Oct 31, 2017 at 9:42 PM, Mike Jones wrote: > I hear you on the fact that different people have joined the effort at > different times. That=E2=80=99s a normal process as an effort builds mom= entum. I > get that not everyone was there when previous consensus calls were taken. > > > > I should note that I have specific technical objections to the specific > proposed changes being discussed as well. Currently all events in the se= t > have the same syntax. The proposals, as I understand them, revert us to = a > state where there=E2=80=99s a =E2=80=9Cprimary=E2=80=9D and =E2=80=9Cseco= ndary=E2=80=9D events, with different > syntax for the two classes. That=E2=80=99s needlessly more complicated, = adding no > actual value. > > > > -- Mike > > > > *From:* Dick Hardt [mailto:dick.hardt@gmail.com] > *Sent:* Tuesday, October 31, 2017 9:37 PM > *To:* Mike Jones > *Cc:* Phil Hunt (IDM) ; Yaron Sheffer < > yaronf.ietf@gmail.com>; Richard Backman, Annabelle ; > ID Events Mailing List > > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > > > Mike > > > > As you well know, many people in a WG don't look closely at a > specification until last call is made. Additionally, we are coming up on > only the 3rd WG meeting. The WG has not existed for very long. While some > of the participants have been working on this for a while, many have not, > and we are looking for consensus across the WG. > > > > Since SecEvent is a framework that we expect to be profiled, I feel it is > important to ensure that SecEvent specifications are easy for a variety o= f > profiles to adopt, and that the semantics make sense. I also think that > properties that are specific to a profile should be left to that profile > and not be included in SecEvent. > > > > Since this is a framework, it is expected that as different groups profil= e > it, there will be additional feedback. > > > > Specifically, as a participant in the RISC profile of SET, a number of > issues in SET have surfaced as the RISC WG has looked at how to use the S= ET. > > > > As for SET being stable for over a year, there have been a number of > changes to SET since then. I also don't think there was consensus. Before > the WG was formed, I and several others had expressed concern on the desi= gn > of SET when Phil presented it at an IIW session. > > > > As to taking another year, I am hopeful we can resolve the remaining > issues in SET and publish a new draft for last call. I do not think we wi= ll > need to wait for another WG meeting to ask for last call. > > > > We also have a number of other documents that are not in last call, and w= e > don't have a WG adopted draft yet for management. So there are still a > number of documents to work through before we have all the bits for someo= ne > to work with. > > > > I do think we have been making good progress since the last IETF meeting, > and I am hopeful we can keep up this momentum and finalize all the > documents in a timely manner. > > > > /Dick > > > > > > On Tue, Oct 31, 2017 at 12:48 PM, Mike Jones > wrote: > > It=E2=80=99s hard for me to even express my level of frustration with the= recent > attempts to once again redesign the SecEvent Token spec. We=E2=80=99ve b= een at > this for multiple years because people keep trying to revisit decisions > that were long ago made by consensus. It=E2=80=99s been stable for over = a year and > the majority of WGLC respondents said some variant of =E2=80=9CWorks for = me =E2=80=93 ship > it!=E2=80=9D > > > > There=E2=80=99s not sufficient justification to try to undo consensus pos= itions > that have been debated and affirmed over and over. Countenancing wholesa= le > changes at this late date is counterproductive in the extreme! > > > > It=E2=80=99s far better than good enough as-is. In my experience, if we = start > redesigning it, it will result in another year=E2=80=99s delay. It does = something > simple and useful. Please, let=E2=80=99s just ship it, so people can rel= y on it. > > > > -- Mike > > > > *From:* Phil Hunt (IDM) [mailto:phil.hunt@oracle.com] > *Sent:* Monday, October 30, 2017 2:42 PM > *To:* Dick Hardt > *Cc:* Yaron Sheffer ; Richard Backman, Annabelle < > richanna@amazon.com>; Mike Jones ; ID Events > Mailing List > > > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > > > Inline... > > Phil > > > On Oct 30, 2017, at 2:22 PM, Dick Hardt wrote: > > Hi Phil > > > > Correct me if I am misunderstanding, but there is a RISC profile event > > > > "http://schemas.openid.net/secevent/risc/event-type/ accou= nt-credential-change-required=E2=80=9D > > > > and an SCIM profile event > > > > "https://example.com/scim/event/passwordResetExt=E2=80=9D > > > > I'm suggesting that two different events would be sent. Embedding one in > the other does not make sense. > > It is a hypothetical example. Just because you disagree on this does > not mean others are not valid. > > > > I just picked overlapping proposals that have different meaning (but not > the same) to illustrate the difference from issuing a single set with > different events. > > > > As I have stated this is very different from asserting multiple distinct > events in one SET. > > > > Also, I think it is simpler to have event_type be at the same level as > event > > > > may be. I was working from Annabelle's proposed format. > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event_type": "https://example.com/scim/event/passwordResetExt", > > "event": { > > "id":"44f6142df96bd6ab61e7521d9", > > "resetAttempts":5 > > } > > } > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event_type": "http://schemas.openid.net/secevent/risc/event-type/ > account-credential-change-required > > ", > > "event": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > > > > > > > > > > > On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt wrote: > > Annabelle/Dick, > > > > Thanks for the comments. I think we need to examine the consequences of > the proposal in JSON. > > > > As I stated, what causes most of the issue is the proposed extension > mechanism in the payload (possibly using events in a recursive way). Does > it follow the old format or the new? > > > > Let=E2=80=99s consider a use case where we have an identity management s= ystem > that uses SCIM, but the SCIM system is also the underlying data store for > Connect. A Password reset might generate the following event which has a= n > extension (conveying reset count) AND overlapping statement from RISC. > BOTH of which might be important to a similar receiver using SCIM and OID= C. > > > > > *The 03 spec currently would allow:* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "events": { > > "urn:ietf:params:scim:event:passwordReset": > > { "id":"44f6142df96bd6ab61e7521d9"}, > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > "http://schemas.openid.net/secevent/risc/event-type/\ > account-credential-change-required": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > } > > > > In the above - each payload is a =E2=80=98peer' and issued without prefer= ence by the transmitter. The receiver can assign priority in its own contex= t if that matters. > > > > *The new proposal:* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordRes= et=E2=80=9D, > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevents=E2=80=9D:{ > > ->note =E2=80=A6is this the old or new structure? <- > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > "http://schemas.openid.net/secevent/risc/event-type/\ > account-credential-change-required": { > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/" > > } > > } > > } > > } > > > > In the above, sub-events or extensions have a different format. The same = complaint about the original stands. > > > > **OR* (if the receiver cares about RISC more). Note that this leads to a= triple nested structure.* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ > > account-credential-change-required=E2=80=9D, > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, > > =E2=80=9Cevents=E2=80=9D:{ > > "urn:ietf:params:scim:event:passwordReset": > > { > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevents=E2=80=9D:{ > > "https://example.com/scim/event/passwordResetExt": > > { "resetAttempts":5}, > > } > > } > > } > > } > > } > > > > In the above, the extension is placed inside the event it extends. It fol= lows the old format (or should it follow the new?) > > **OR* Following the top layer pattern of singular event Note that this l= eads to a triple nested structure.* > > > > { > > "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30", > > "iat": 1458496025, > > "iss": "https://scim.example.com", > > "aud": [ > > "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/ris= c/event-type/\ > > account-credential-change-required=E2=80=9D, > > =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D, > > =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C, > > =E2=80=9Cevent=E2=80=9D:{ > > =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:password= Reset=E2=80=9D, > > "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D, > > =E2=80=9Cevent=E2=80=9D:{ > > =E2=80=9Cevent_type=E2=80=9D:"https://example.com/scim/event/pa= sswordResetExt=E2=80=9D, > > "resetAttempts":5 > > } > > } > > } > > } > > > > This format follows the proposed singular event format recursively and is= 3 layers deep. Note that the parser has to continue to search the document= for things that aren=E2=80=99t there as it has to stop when no =E2=80=9Cev= ent=E2=80=9D attribute is found rather than iterate over an array. > > > > Phil > > Oracle Corporation, Identity Cloud Services Architect > @independentid > www.independentid.com > > phil.hunt@oracle.com > > > > On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle < > richanna@amazon.com> wrote: > > > > Replies inline. > > > > -- > > Annabelle Richard Backman > > Identity Services > > > > > > *From: *Phil Hunt > *Date: *Sunday, October 29, 2017 at 5:25 PM > *To: *Dick Hardt > *Cc: *Yaron Sheffer , Mike Jones < > Michael.Jones@microsoft.com>, "Richard Backman, Annabelle" < > richanna@amazon.com>, ID Events Mailing List > *Subject: *Re: [Id-event] Use cases for multiple events per SET? > > > > I hope this answers your question. > > > > My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why not= . The question should be, > what is the justification to make =E2=80=9Cevents=E2=80=9D singular? > > [richanna]The singular =E2=80=9Cevent=E2=80=9D claim has clearer semantic= s and is easier > to process. We should opt for easier solutions unless there are use cases > that require more complexity.[/richanna] > > > > There are many reasons for multiple events in a SET. Some are good, some > not so good. Some of the reasons... > > > > 1. Multiple event payloads expressing statements about largely the > *same*thing. For example, SCIM password reset AND RISC password reset. A > RISC Event and an OpenBanking Event. Is one a complement to the other? D= o > they overlap or are they distinct? > > [richanna]Copy/pasted from my earlier email: > > Why is it necessary or appropriate to include these events in the same > SET? They are likely being generated by different systems at different > times on the transmitter=E2=80=99s side, consumed by different systems on= the > receiver=E2=80=99s side, and possibly being transmitted over different ev= ent > streams. I know the latter would be the case for us, as a receiver. Even = if > it=E2=80=99s not, is it burdensome to send these events separately? What = value is > gained in combining them? > > > > Additionally, since the signature is over the SET and not the event > objects, Receivers independently route separate events from a single toke= n > without either losing the ability to verify the authenticity of the event > or sharing all information in the SET with every system handling any even= t > in the token.[/richanna] > > > > 2. Multiple events payloads expressing different statements about the > same transaction - RISC Password Reset and RISC Session Cancel > [richanna]Same as above[/richanna] > > 3. A new profile defines new event attributes to be added on to an > existing event type (a pure extension) > [richanna]I have suggested a way to support extensions within an event > body, multiple times now. If you see problems with it, please point them > out.[/richanna] > > > > I think it is quite valid to allow 1 and 3. 2 could be limited by > specific profiles like RISC if they want. > > > > I am not in agreement that making event singular simplifies anything. For > one is makes extensions complex (another nested JSON structure) and > potentially conflicting. > [richanna] > > Ways that multiple-event SETs are more complicated: > > 1. It results in a more complex structure for the single event use > case, which I think we all agree is the majority use case. > 2. Multiple-event SETs have ambiguous semantics. The presence of two > events A and B in the same SET could mean any of: > > > 1. They are related to the same logical event (i.e. the same thing as > if they were from different SETs that have a common txn). > 2. A is an extension of B. > 3. B is an extension of A. > 4. They are aliases for one another. > 5. They are not actually related to one another in any way. > > > 1. Claim semantics become harder to define, as different profiles may > want to use the same claims in different ways. > > > > If the WG wants to block 1 and 2 above, then I believe we have to > establish an event registry to ensure new Event profiles do not overlap t= o > eliminate the need to express multiple events. > > [richanna]I=E2=80=99m not sure what you mean by this. Are you referring t= o event > names? Those are already defined by the spec to be URIs.[/richanna] > > Phil > > > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > > phil.hunt@oracle.com > > > > On Oct 29, 2017, at 4:12 PM, Dick Hardt wrote: > > > > Phil: > > > > In your examples for having a plurality of events, you use the word "may"= , > which leads me to question if a plurality of events is really required in > SET. > > > > You posit that it will be difficult for a distributed system to correlate > multiple SETs with the same "txn", but the distributed system will > certainly need to correlate events on the same subject -- correlating > events on the same "txn" on the same subject seems fairly simple. > > > > I think that a receiver will need to correlate multiple SEts on the same > subject, so having multiple events in a SET is redundant, and adds > complexity with no clear benefit that I can see. > > > > An implementor may choose to send multiple SETs, or send a single SET wit= h > multiple events, so a receiver will need to support both. I prefer we pic= k > one way and minimize the code paths, and we will need to support > correlating across multiple SETs, so that seems the best mechanism. > > > > Let me know if there is something I missed in my logic. > > > > /Dick > > > > > > On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer > wrote: > > In that case, let's add text to that effect, e.g. we could add to the > definition of the "events" claim: > > Profiling specifications SHOULD define the allowed event statements, and > MAY restrict their number. For example, some profiles may require this > claim to contain only a single event statement. > > Thanks, > Yaron > > On 24/10/17 22:10, Mike Jones wrote: > > I agree with much of Phil=E2=80=99s rationale here. > > It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a > singleton. That doesn=E2=80=99t have to be true for all events. I think= things > are fine as-is. > > -- Mike > > *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil > Hunt > *Sent:* Monday, October 23, 2017 8:47 PM > *To:* Richard Backman, Annabelle > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Use cases for multiple events per SET? > > Annabelle, > > I have a number of concerns with this proposal. > > Profiling Independence / Keeping Event Payloads Independent > > Indicating that extensions should be handled by profiles leads to more > inter-operability issues and more importantly intrudes on the Event paylo= ad > space by suggesting a sub-schema creates potential limitations and > conflicts that may add to complexity later on. The current format allows = a > parser to discover and unload one or more JSON payloads which can each ha= ve > independent structure. > > General extensions > > The proposal also rules out general purpose extensions not related to any > specific event. Given the emergence of items like GPRD, I would not want = to > block the ability to add meta-data or other general purpose items. We can > also anticipate some delivery scenarios where additional data might be > required. Even though there is no current planned use, I see no good reas= on > to rule this out. > > Multiple Events From Different Families (vs. Multiple Events from a singl= e > family like RISC) > > In our RISC session we discussed expressing multiple distinct RISC events > in one SET. The discussion was that only one RISC event at a time. We did > not discuss other event profiles. I don=E2=80=99t see a reason to rule ou= t > multi-events from different families at the SET level. Each profile is > expressing slightly different things about the same event. > > I can forsee some cases where it is not clear which is the primary and > which is the extension. There may not be a clear winner. > > A couple of examples (these are necessarily real=E2=80=A6just possibiliti= es): > > * It is probably useful to be able to express simlar/overlapping events > from different SET profiles in one SET. For example a Backchannel Logout= & > a RISC session cancel event. > > * SCIM may want to represent a single transaction as causing multiple > state changes in an event (e.g. a password change causes multiple effects= ). > Having to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80= =9D would be > challenging in a multi-threaded/multi-node delivery system. The SCIM li= st > has not discussed this, but I would not want to block this capability. I= OW > - Just because RISC does not want to express multiple events does not mak= e > this true for other profiles. > > * We may wish to indicate a SCIM Password Reset was performed and a > Logout/session cancellation is expressed at the same time. The events ar= e > related but express different data. > > Avoiding Confusion From Similar Events Originating from the Same > Transaction > > If events are sent separately, then more tracking of state (e.g. by txn) > would be required to ensure similar events are not mistaken or handled as > repeats. While txn provides useful audit analysis capability, I=E2=80=99m= not sure > it can be used in live or near-real time systems given distributed > multi-node, multi-threading architectures. > > Previous Discussion > > I note that I originally raised having an attribute to designate primary > event attribute to alleviate your concern, but this was not accepted. See= : > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00406.html > > > * https://www.ietf.org/mail-archive/web/id-event/current/msg00140.html > > > The consensus, at least as I interpreted it is up to the receiver to > figure this out based on the definitions it has for each event URI and th= e > profiles they represent. IOW - RISC is free to limit that only one RISC > event be expressed at a time. > > Phil > > Oracle Corporation, Identity Cloud Services Architect > > @independentid > > www.independentid.com > > > > > > phil.hunt@oracle.com > > On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle > > wrote: > > The current draft of the SET spec allows for expressing multiple > events within the same token, which introduces additional complexity > and room for ambiguous semantics. We=E2=80=99ve discussed this in the= OIDF > RISC working group and the current consensus there is that RISC will > require that RISC events must be the only event in the SET, having > identified ways to clearly and easily support the handful of use > cases for multiple events per token that people have raised. With > that context in mind, I propose striking the definition of the > =E2=80=9Cevents=E2=80=9D claim from the Security Event Token spec, an= d replacing it > with the following definition for an =E2=80=9Cevent=E2=80=9D claim (s= ingular): > > event > > A JSON object containing an "event_type" member whose value is a URI > representing a type of event defined in a Profiling Specification. > The object MAY otherwise be empty, or MAY contain additional members > as described by the Profiling Specification. > > Here is the example SET from section 2.3, rewritten with this change > mind: > > { > > "jti": "4d3559ec67504aaba65d40b0363faad8", > > "iat": 1458496404, > > "iss": "https://scim.example.com ", > > "aud": [ > > "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754", > > "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7" > > ], > > "event": { > > "event_type": "urn:ietf:params:scim:event:create", > > "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9 > ", > > "attributes": ["id", "name", "userName", "password", "emails"] > > } > > } > > Does anyone in the working group have use cases for SETs that cannot > be met by this proposed text? Within RISC, we identified three use > cases, with solutions outlined below: > > ** > > *Extensions* > > Event extension mechanisms can be defined internal to the event > object. A simple approach would be to define an =E2=80=9Cextensions= =E2=80=9D member > that is a list of event objects (or set resembling the =E2=80=9Cevent= s=E2=80=9D > claim as defined in the current spec). This has the advantage of > making it clear in the data structure that there is a single primary > event, with zero or more extensions. There is no room for confusion > over which event is primary, or if there is a primary event at all. > I would be fine with adding something like this to my proposed text, > if there is consensus that it is broadly useful. > > *Aliases* > > This use case was brought up in the context of migrating clients > from draft event names to standardized event names. In this case, > the event transmitter can transmit two tokens for the logical event, > one using the old name and another using the new name. > > *Related Events* > > The SET spec defines the txn claim as a means of correlating > independent tokens that relate to the same logical event. > > -- > Annabelle Richard Backman > > Amazon =E2=80=93 Identity Services > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps- > 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > s5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFSibEc&s=3D > X8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > > > > -- > > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj- > 2tDkn31Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zb > hcW001fK02EXs&e=3D > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU- > a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRAnqZDltCwBAZVHKp= - > MJ20ui2nm46QSz0&e=3D > > > > > > > > -- > > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3D > na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DiyVnrZmr9_ > uGCQ6MD0zF2ymRQS6lK67yF_8u8_qSC_w&s=3DOe0qfLEX83vtXM7Wl2cYBe- > Gg1DVPjhXjVJkfhVRzwc&e=3D > > > > > > -- > > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c119bb836f972055ce4a2cf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    Please direct me to a proposal that has a "primary&qu= ot; and "secondary" events. I agree that is undesirable. I would = also encourage to engage in the discussions so that we can drive clarity an= d simplicity.

    I think the proposal is that there is one = event per SET.

    I think having more than one event = per SET adds complexity as a receiver must deal with receiving correlated e= vents in one SET as well as correlated events in the same SET.
    /Dick

    On Tue, Oct 31, 2017 at 9:42 PM, Mike Jones = <Michae= l.Jones@microsoft.com> wrote:

    I hear you on the fact= that different people have joined the effort at different times.=C2=A0 Tha= t=E2=80=99s a normal process as an effort builds momentum.=C2=A0 I get that= not everyone was there when previous consensus calls were taken.

    =C2=A0

    I should note that I h= ave specific technical objections to the specific proposed changes being di= scussed as well.=C2=A0 Currently all events in the set have the same syntax= .=C2=A0 The proposals, as I understand them, revert us to a state where there=E2=80=99s a =E2=80=9Cprimary=E2=80=9D and =E2=80= =9Csecondary=E2=80=9D events, with different syntax for the two classes.=C2= =A0 That=E2=80=99s needlessly more complicated, adding no actual value.<= /u>

    =C2=A0

    =C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mik= e

    <= span style=3D"color:#002060">=C2=A0

    From: Dick Hardt [mailto:dick.hardt@gmail.com]
    Sent: Tuesday, October 31, 2017 9:37 PM
    To: Mike Jones <Michael.Jones@microsoft.com>
    Cc: Phil Hunt (IDM) <phil.hunt@oracle.com>; Yaron Sheffer <yaronf.ietf@gmail.com>= ; Richard Backman, Annabelle <richanna@amazon.com>; ID Events Mailing List <id-event@ietf.org>= ;


    Subject: Re: [Id-event] Use cases for multiple events per SET?

    =C2=A0

    Mike

    =C2=A0

    As you well know, many people in a WG don't look= closely at a specification until last call is made. Additionally, we are c= oming up on only the 3rd WG meeting. The WG has not existed for very long. = While some of the participants have been working on this for a while, many have not, and we are looking for consens= us across the WG.

    =C2=A0

    Since SecEvent is a framework that we expect to be p= rofiled, I feel it is important to ensure that SecEvent specifications are = easy for a variety of profiles to adopt, and that the semantics make sense.= I also think that properties that are specific to a profile should be left to that profile and not be includ= ed in SecEvent.

    =C2=A0

    Since this is a framework, it is expected that as di= fferent groups profile it, there will be additional feedback.=

    =C2=A0

    Specifically, as a participant in the RISC profile o= f SET, a number of issues in SET have surfaced as the RISC WG has looked at= how to use the SET.

    =C2=A0

    As for SET being stable for over a year, there have = been a number of changes to SET since then. I also don't think there wa= s consensus. Before the WG was formed, I and several others had expressed c= oncern on the design of SET when Phil presented it at an IIW session.

    =C2=A0

    As to taking another year, I am hopeful we can resol= ve the remaining issues in SET and publish a new draft for last call. I do = not think we will need to wait for another WG meeting to ask for last call.= =C2=A0

    =C2=A0

    We also have a number of other documents that are no= t in last call, and we don't have a WG adopted draft yet for management= . So there are still a number of documents to work through before we have a= ll the bits for someone to work with.

    =C2=A0

    I do think we have been making good progress since t= he last IETF meeting, and I am hopeful we can keep up this momentum and fin= alize all the documents in a timely manner.

    =C2=A0

    /Dick

    =C2=A0

    =C2=A0

    On Tue, Oct 31, 2017 at 12:48 PM, Mike Jones <Michael.Jones= @microsoft.com> wrote:

    It=E2=80=99s hard for = me to even express my level of frustration with the recent attempts to once= again redesign the SecEvent Token spec.=C2=A0 We=E2=80=99ve been at this for multiple years because people keep trying to revisit decisions that we= re long ago made by consensus.=C2=A0 It=E2=80=99s been stable for over a ye= ar and the majority of WGLC respondents said some variant of =E2=80=9CWorks= for me =E2=80=93 ship it!=E2=80=9D

    =C2=A0

    There=E2=80=99s not su= fficient justification to try to undo consensus positions that have been de= bated and affirmed over and over.=C2=A0 Countenancing wholesale changes at this late date is counterproductive in the extreme!

    =C2=A0

    It=E2=80=99s far bette= r than good enough as-is.=C2=A0 In my experience, if we start redesigning i= t, it will result in another year=E2=80=99s delay.=C2=A0 It does something = simple and useful.=C2=A0 Please, let=E2=80=99s just ship it, so people can rely o= n it.

    =C2=A0

    =C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 -- Mike

    =C2=A0=

    From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
    Sent: Monday, October 30, 2017 2:42 PM
    To: Dick Hardt <dick.hardt@gmail.com>
    Cc: Yaron Sheffer <yaronf.ietf@gmail.com>; Richard Backman, Annabelle <= richanna@amazon.co= m>; Mike Jones <Michael.Jones@microsoft.com>; ID Events Mailing List <id-event@ietf.org>


    Subject: Re: [Id-event] Use cases for multiple events per SET?

    =C2=A0

    Inline...

    Phil


    On Oct 30, 2017, at 2:22 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

    Hi Phil

    =C2=A0

    Correct me if I am misunderstanding, but there is a = RISC profile event=C2=A0

    =C2=A0
    "=
http://=
schemas.openid.net/secevent/risc/event-type/account-cred=
ential-change-required=E2=80=9D
    =C2=A0

    and an SCIM profile event

    =C2=A0

    I'm suggesting that two different events would b= e sent. Embedding one in the other does not make sense.

    <ph>It is a hypothetical example. Just because= you disagree on this does not mean others are not valid.=C2=A0

    =C2=A0

    I just picked overlapping proposals that have differ= ent meaning (but not the same) to illustrate the difference from issuing a = single set with different events.=C2=A0

    =C2=A0

    As I have stated this= is very different from asserting multiple distinct events in one SET.=C2= =A0

    =C2=A0

    Also, I think it is simpler to have event_type be at= the same level as event

    =C2=A0

    <ph>may be. I w= as working from Annabelle's proposed format.=C2=A0

    =C2=A0

    = {

    = =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30&qu= ot;,

    = =C2=A0 "iat": 1458496025,

    = =C2=A0 "iss": "https://scim.example.com",

    = =C2=A0 "aud": [

    = =C2=A0 =C2=A0],

    = =C2=A0 =C2=A0"event_type": "https://example.com/scim/event/passwordResetExt",

    = =C2=A0 =C2=A0"event": {=C2=A0=C2=A0

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"id":"44f6142df96bd6a= b61e7521d9",

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"resetAttempts":5=

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0}

    = }

    =C2=A0

    = {

    = =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30&qu= ot;,

    = =C2=A0 "iat": 1458496025,

    = =C2=A0 "iss": "https://scim.example.com",

    = =C2=A0 "aud": [

    = =C2=A0 =C2=A0],

    = =C2=A0 =C2=A0"event": {

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2= =80=9D,

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9Ciss=E2=80=9D:"https://idp.example.com/"= =C2=A0 =C2=A0 =C2=A0 =C2=A0

    = =C2=A0 =C2=A0 =C2=A0 =C2=A0}

    = }

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    =C2=A0

    On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt <phil.hunt@oracle.com<= /a>> wrote:

    Annabelle/Dick,

    =C2=A0

    Thanks for the comments. I think we need to examine = the consequences of the proposal in JSON.

    =C2=A0

    As I stated, what causes most of the issue is the pr= oposed extension mechanism in the payload (possibly using events in a recur= sive way). Does it follow the old format or the new?

    =C2=A0

    Let=E2=80=99s =C2=A0consider a use case where we hav= e an identity management system that uses SCIM, but the SCIM system is also= the underlying data store for Connect.=C2=A0 A Password reset might generate the following event which has an extension (conveying reset count= ) AND overlapping statement from RISC.=C2=A0 BOTH of which might be importa= nt to a similar receiver using SCIM and OIDC. =C2=A0

    =C2=A0

    The 03 spec currently would allow:<= /u>

    =C2=A0

    {
    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    =C2=A0 "iat": 1458496025,
    =C2=A0 "iss": "https://scim.example.com",
    =C2=A0 "aud": [
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    =C2=A0=C2=A0 ],
    =C2=A0=C2=A0 "events": {
    =C2=A0=C2=A0=C2=A0=C2=A0 "urn:ietf:params:scim:event:passwor=
dReset":
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { "id":"44f61=
42df96bd6ab61e7521d9"},
    =C2=A0=C2=A0=C2=A0=C2=A0 "https://example.com/scim/event/=
passwordResetExt":
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { "resetAttempts":5},
    =C2=A0=C2=A0=C2=A0=C2=A0 "http://schema=
s.openid.net/secevent/risc/event-type/\
    =C2=A0 =C2=A0 =C2=A0 =
=C2=A0account-credential-change-required": {    =

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,=

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Ciss=E2=80=9D:"https://idp.ex=
ample.com/"
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
}
    =C2=A0 }
    }
    =C2=A0
    In the ab=
ove - each payload is a =E2=80=98peer' and issued without preference by=
 the transmitter. The receiver can assign priority in its own context if th=
at matters.
    =C2=A0
    The ne=
w proposal:
    =C2=A0
    {
    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    =C2=A0 "iat": 1458496025,
    =C2=A0 "iss": "https://scim.example.com",
    =C2=A0 "aud": [
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    =C2=A0=C2=A0 ],
    =C2=A0=C2=A0 "event": {
    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:p=
arams:scim:event:passwordReset=E2=80=9D,
    =C2=A0=C2=A0=C2=A0=C2=A0 "id":=E2=80=9D44f6142df96bd6ab=
61e7521d9=E2=80=9D,
    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevents=E2=80=9D:{

    =C2=A0=C2=A0=C2=A0=C2=A0 ->note =E2=80=A6is this the old or new str=
ucture? <-
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "https://example.com/scim=
/event/passwordResetExt":
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 { "resetAttempts=
":5},
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
"=
http://schemas.openid.net/secevent/risc/event-type/\
    =C2=A0 =C2=
=A0 =C2=A0=C2=A0=C2=A0 =C2=A0account-credential-change-required":=
 {
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,=

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =E2=80=9Ciss=E2=80=9D:"https://idp.ex=
ample.com/"
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
}
    

    =C2=A0=C2=A0=C2=A0=C2=A0 }<=
/u>
    

    =C2=A0=C2=A0 }=C2=A0=C2=A0=C2=
=A0 
    

    }
    

    =C2=A0
    

    In the ab=
ove, sub-events or extensions have a different format. The same complaint a=
bout the original stands.
    

    =C2=A0
    

    *OR* (=
if the receiver cares about RISC more).=C2=A0 Note that this leads to a tri=
ple nested structure.
    

    =C2=A0
    

    {
    

    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    

    =C2=A0 "iat": 1458496025,
    

    =C2=A0 "iss": "https://scim.example.com",
    

    =C2=A0 "aud": [
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    

    =C2=A0=C2=A0 ],
    

    =C2=A0=C2=A0 "event": {
    

    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-typ=
e/\
    

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0account-credential-change-required=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,

    =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=E2=80=
=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Cevents=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 "urn:ietf:params:scim:event:passwordReset":=

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 {=C2=A0
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "id":=
=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevents=
=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 "https://example.com/scim/event/passwordResetExt"=
:
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 { "resetAttempts":5},=C2=A0 
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0}=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }=C2=A0=C2=A0=C2=A0=C2=A0 
    

    =C2=A0=C2=A0=C2=A0}<=
/u>
    

    }
    

    

    =C2=A0
    

    

    

    In the ab=
ove, the extension is placed inside the event it extends. It follows the ol=
d format (or should it follow the new?)
    

    

    

    *OR* F=
ollowing the top layer pattern of singular event=C2=A0 Note that this leads=
 to a triple nested structure.
    

    =C2=A0
    

    {
    

    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d=
30",
    

    =C2=A0 "iat": 1458496025,
    

    =C2=A0 "iss": "https://scim.example.com",
    

    =C2=A0 "aud": [
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/98d52461fa5bbc879593b7754",
    

    =C2=A0=C2=A0=C2=A0 "https://jhub.example.com/Fee=
ds/5d7604516b1d08641d7676ee7"
    

    =C2=A0=C2=A0 ],
    

    =C2=A0=C2=A0 "event": {
    

    =C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/event-typ=
e/\
    

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0account=
-credential-change-required=E2=80=9D,=

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=E2=80=9C,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=
=9Cevent=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:p=
asswordReset=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=
=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent=E2=80=9D:{
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =E2=80=9Cevent_=
type=E2=80=9D:"https://example.com/scim/event/passwordRes=
etExt=E2=80=9D,
    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "resetAtte=
mpts":5 
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0}
    

    

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }=C2=A0=C2=A0=C2=A0=C2=A0 
    

    =C2=A0=C2=A0=C2=A0}<=
/u>
    

    }
    

    =C2=A0
    

    This form=
at follows the proposed singular event format recursively and is 3 layers d=
eep. Note that the parser has to continue to search the document for things=
 that aren=E2=80=99t there as it has to stop when no =E2=80=9Cevent=E2=80=
=9D attribute is found rather than iterate over an array.<=
/u>
    

    

    =C2=A0

    Phil

    Oracle Corporation, Identity Cloud Services Architect
    @independentid
    www.independentid.com
    phil.hunt@oracle.= com

    =C2=A0

    On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabe= lle <richanna@a= mazon.com> wrote:

    =C2=A0

    Replies inline.

    =C2=A0

    --=C2=A0

    Annabelle Richard Backman

    Identity Services

    =C2=A0

    =C2=A0

    From:=C2=A0Phil Hunt <p= hil.hunt@oracle.com>
    Date:=C2=A0Sunday, October 29, 2017 = at 5:25 PM
    To:=C2=A0Dick Hardt <= dick.hardt@gmail.com>
    Cc:=C2=A0Yaron Sheffer <yaronf.ietf@gmail.com>, Mike Jones <Michael.Jones@microsoft.com>, "Richard Backman, Annabelle" <richanna@amazon.com<= /span>>, ID Events Mailing List <id-event@ietf.org>
    Subject:=C2=A0Re: [Id-event] Use cas= es for multiple events per SET?

    =C2=A0

    I hope this answers your question.

    =C2=A0

    My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reason why not. = The question should be, what is the justification to make =E2=80=9Cevents= =E2=80=9D singular?

    [richanna]The singular =E2=80=9Cevent=E2=80= =9D claim has clearer semantics and is easier to process. We should opt for= easier solutions unless there are use cases that require more complexity.[= /richanna]

    =C2=A0

    There are many reasons for multiple events in a SET.=C2=A0 Some are good, s= ome not so good. Some of the reasons...

    =C2=A0

    1.=C2=A0 Multiple event payloads expressing statements about largely the *s= ame*thing. For example, SCIM password reset AND RISC password reset.=C2=A0 = A RISC Event and an OpenBanking Event. Is one a complement to the other?=C2= =A0 Do they overlap or are they distinct? =C2=A0

    [richanna]Copy/pasted from my earlier email:<= /span>

    Why is it necessary or appropriate to include= these events in the same SET? They are likely being generated by different= systems at different times on the transmitter=E2=80=99s side, consumed by = different systems on the receiver=E2=80=99s side, and possibly being transmitted over different event streams. I know the la= tter would be the case for us, as a receiver. Even if it=E2=80=99s not, is = it burdensome to send these events separately? What value is gained in comb= ining them?

    =C2=A0

    Additionally, since the signature is over the= SET and not the event objects, Receivers independently route separate even= ts from a single token without either losing the ability to verify the auth= enticity of the event or sharing all information in the SET with every system handling any event in the token.[= /richanna]

    =C2=A0

    2.=C2=A0 Multiple events payloads expressing different statements about the= same transaction - RISC Password Reset and RISC Session Cancel
    [richanna]Same as above[/richanna]<= /u>

    3.=C2=A0 A new profile defines new event attributes to be added on to an ex= isting event type (a pure extension)=C2=A0
    [richanna]I have suggested a way to support e= xtensions within an event body, multiple times now. If you see problems wit= h it, please point them out.[/richanna]

    =C2=A0

    I think it is quite valid to allow 1 and 3. =C2=A02 could be limited by spe= cific profiles like RISC if they want.

    =C2=A0

    I am not in agreement that making event singular simplifies anything. For o= ne is makes extensions complex (another nested JSON structure) and potentia= lly conflicting.=C2=A0
    [richanna]

    Ways that multiple-event SETs are more compli= cated:

    1. It results in a more complex structure for the single event use case, which= I think we all agree is the majority use case.
    2. Multiple-event SETs have ambiguous semantics. The presence of two events A = and B in the same SET could mean any of:
      1. They are related to the same logical event (i.e. the same thing as if they = were from different SETs that have a common txn).
      2. A is an extension of B.
      3. B is an extension of A.
      4. They are aliases for one another.
      5. They are not actually related to one another in any way.
        6. =
    1. Claim semantics become harder to define, as different profiles may want to = use the same claims in different ways.

    =C2=A0

    If the WG wants to block 1 and 2 above, then I believe we have to establish= an event registry to ensure new Event profiles do not overlap to eliminate= the need to express multiple events.

    [richanna]I=E2=80=99m not sure what you mean = by this. Are you referring to event names? Those are already defined by the= spec to be URIs.[/richanna]

    Phil

    =C2=A0

    Oracle Corporation, Identity Cloud Services Architect

    @independentid

    =C2=A0

    On Oct 29, 2017, at 4:12 PM, Dick Hardt <dick.hardt@gmail.co= m> wrote:

    =C2=A0

    Phil:

    =C2=A0

    In your examples for having a plurality of events, you use the word "= ;may", which leads me to question if a plurality of events is really r= equired in SET.

    =C2=A0

    You posit that it will be difficult for a distributed system to correlate= multiple SETs with the same "txn", but the distributed system wi= ll certainly need to correlate events on the same subject -- correlating events on the same "txn" on the same subject seem= s fairly simple.

    =C2=A0

    I think that a receiver will need to correlate multiple SEts on the same = subject, so having multiple events in a SET is redundant, and adds complexi= ty with no clear benefit that I can see.

    =C2=A0

    An implementor may choose to send multiple SETs, or send a single SET wit= h multiple events, so a receiver will need to support both. I prefer we pic= k one way and minimize the code paths, and we will need to support correlating across multiple SETs, so that seems the b= est mechanism.

    =C2=A0

    Let me know if there is something I missed in my logic.<= /u>

    =C2=A0

    /Dick

    =C2=A0

    =C2=A0

    On Sun, Oct 29, 2017 at 11:28 AM, Yaron Sheffer= =C2=A0<yaronf.ietf@gmail.com>=C2=A0wrote:

    In that case, let's add text to that effect, e.g. we could add to the= definition of the "events" claim:

    Profiling specifications SHOULD define the allowed event statements, and MA= Y restrict their number. For example, some profiles may require this claim = to contain only a single event statement.

    Thanks,
    =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0Yaron

    On 24/10/17 22:10, Mike Jones wrote:

    I agree with much of Phil=E2=80=99s rationale here.

    It=E2=80=99s fine for some profiles to say that the =E2=80=9Cevents=E2=80= =9D set must be a singleton.=C2=A0 That doesn=E2=80=99t have to be true for= all events.=C2=A0 I think things are fine as-is.

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0-- Mike

    *From:* Id-event [mailto:id-event-bounces@ietf.org] *On Behalf Of *Phil Hunt
    *Sent:* Monday, October 23, 2017 8:47 PM
    *To:* Richard Backman, Annabelle <richanna@amazon.com<= /a>>
    *Cc:* ID Events Mailing List <    id-event@ietf.org><= br> *Subject:* Re: [Id-event] Use cases for multiple events per SET?

    Annabelle,

    I have a number of concerns with this proposal.

    Profiling Independence / Keeping Event Payloads Independent

    Indicating that extensions should be handled by profiles leads to more inte= r-operability issues and more importantly intrudes on the Event payload spa= ce by suggesting a sub-schema creates potential limitations and conflicts t= hat may add to complexity later on. The current format allows a parser to discover and unload one or more = JSON payloads which can each have independent structure.

    General extensions

    The proposal also rules out general purpose extensions not related to any s= pecific event. Given the emergence of items like GPRD, I would not want to = block the ability to add meta-data or other general purpose items. We can a= lso anticipate some delivery scenarios where additional data might be required. Even though there is no current p= lanned use, I see no good reason to rule this out.

    Multiple Events From Different Families (vs. Multiple Events from a single = family like RISC)

    In our RISC session we discussed expressing multiple distinct RISC events i= n one SET. The discussion was that only one RISC event at a time. We did no= t discuss other event profiles. I don=E2=80=99t see a reason to rule out mu= lti-events from different families at the SET level. Each profile is expressing slightly different things about the = same event.

    I can forsee some cases where it is not clear which is the primary and whic= h is the extension.=C2=A0 There may not be a clear winner.

    A couple of examples (these are necessarily real=E2=80=A6just possibilities= ):

    * It is probably useful to be able to express simlar/overlapping events fro= m different SET profiles in one SET.=C2=A0 For example a Backchannel Logout= & a RISC session cancel event.

    * SCIM may want to represent a single transaction as causing multiple state= changes in an event (e.g. a password change causes multiple effects). Havi= ng to chase down multiple events and correlate by =E2=80=9Ctxn=E2=80=9D wou= ld be challenging in a multi-threaded/multi-node delivery system.=C2=A0 =C2=A0The SCIM list has not discussed this, but I w= ould not want to block this capability.=C2=A0 IOW - Just because RISC does = not want to express multiple events does not make this true for other profi= les.

    * We may wish to indicate a SCIM Password Reset was performed and a Logout/= session cancellation is expressed at the same time.=C2=A0 The events are re= lated but express different data.

    Avoiding Confusion From Similar Events Originating from the Same Transactio= n

    If events are sent separately, then more tracking of state (e.g. by txn) wo= uld be required to ensure similar events are not mistaken or handled as rep= eats. While txn provides useful audit analysis capability, I=E2=80=99m not = sure it can be used in live or near-real time systems given distributed multi-node, multi-threading architectures.<= br>
    Previous Discussion

    I note that I originally raised having an attribute to designate primary ev= ent attribute to alleviate your concern, but this was not accepted. See:
    *=C2=A0= https://www.ietf.org/mail-archive/web/id-event/current/msg00406.h= tml

    *=C2=A0= https://www.ietf.org/mail-archive/web/id-event/current/msg00140.h= tml

    The consensus, at least as I interpreted it is up to the receiver to figure= this out based on the definitions it has for each event URI and the profil= es they represent. IOW - RISC is free to limit that only one RISC event be = expressed at a time.

    Phil

    Oracle Corporation, Identity Cloud Services Architect

    @independentid

    www.inde= pendentid.com=C2=A0<http://www= .independentid.com>

    phil.hunt@oracle.com=C2=A0<= /span><mailto:= phil.hunt@oracle.com>

    =C2=A0 =C2=A0 On Oct 23, 2017, at 7:02 PM, Richard Backman, Annabelle
    =C2=A0 =C2=A0 <= richanna@amazon.com=C2=A0<mailto:richanna@amazon.com= >> wrote:

    =C2=A0 =C2=A0 The current draft of the SET spec allows for expressing multi= ple
    =C2=A0 =C2=A0 events within the same token, which introduces additional com= plexity
    =C2=A0 =C2=A0 and room for ambiguous semantics. We=E2=80=99ve discussed thi= s in the OIDF
    =C2=A0 =C2=A0 RISC working group and the current consensus there is that RI= SC will
    =C2=A0 =C2=A0 require that RISC events must be the only event in the SET, h= aving
    =C2=A0 =C2=A0 identified ways to clearly and easily support the handful of = use
    =C2=A0 =C2=A0 cases for multiple events per token that people have raised. = With
    =C2=A0 =C2=A0 that context in mind, I propose striking the definition of th= e
    =C2=A0 =C2=A0 =E2=80=9Cevents=E2=80=9D claim from the Security Event Token = spec, and replacing it
    =C2=A0 =C2=A0 with the following definition for an =E2=80=9Cevent=E2=80=9D = claim (singular):

    =C2=A0 =C2=A0 event

    =C2=A0 =C2=A0 A JSON object containing an "event_type" member who= se value is a URI
    =C2=A0 =C2=A0 representing a type of event defined in a Profiling Specifica= tion.
    =C2=A0 =C2=A0 The object MAY otherwise be empty, or MAY contain additional = members
    =C2=A0 =C2=A0 as described by the Profiling Specification.

    =C2=A0 =C2=A0 Here is the example SET from section 2.3, rewritten with this= change
    =C2=A0 =C2=A0 mind:

    =C2=A0 =C2=A0=C2=A0{

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "jti": "4d3559ec67504aaba65d= 40b0363faad8",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "iat": 1458496404,

    =C2=A0 =C2=A0 =C2=A0=C2=A0"iss": "https://scim.exa= mple.com=C2=A0<htt<= wbr>ps://scim.example.com/>",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "aud": [

    =C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/98d52461fa5bbc879593b77= 54",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/5d7604516b1d08641d7676e= e7"

    =C2=A0 =C2=A0 =C2=A0=C2=A0 ],

    =C2=A0 =C2=A0 =C2=A0=C2=A0 "event": {

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "event_type": "urn:ie= tf:params:scim:event:create",

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "ref": "<= span style=3D"color:purple">https://scim.example.com/Users/44f614= 2df96bd6ab61e7521d9    ",

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "attributes": ["id&qu= ot;, "name", "userName", "password", "em= ails"]

    =C2=A0 =C2=A0 =C2=A0=C2=A0 }

    =C2=A0 =C2=A0 }

    =C2=A0 =C2=A0 Does anyone in the working group have use cases for SETs that= cannot
    =C2=A0 =C2=A0 be met by this proposed text? Within RISC, we identified thre= e use
    =C2=A0 =C2=A0 cases, with solutions outlined below:

    =C2=A0 =C2=A0 **

    =C2=A0 =C2=A0 *Extensions*

    =C2=A0 =C2=A0 Event extension mechanisms can be defined internal to the eve= nt
    =C2=A0 =C2=A0 object. A simple approach would be to =C2=A0define an =E2=80= =9Cextensions=E2=80=9D member
    =C2=A0 =C2=A0 that is a list of event objects (or set resembling the =E2=80= =9Cevents=E2=80=9D
    =C2=A0 =C2=A0 claim as defined in the current spec). This has the advantage= of
    =C2=A0 =C2=A0 making it clear in the data structure that there is a single = primary
    =C2=A0 =C2=A0 event, with zero or more extensions. There is no room for con= fusion
    =C2=A0 =C2=A0 over which event is primary, or if there is a primary event a= t all.
    =C2=A0 =C2=A0 I would be fine with adding something like this to my propose= d text,
    =C2=A0 =C2=A0 if there is consensus that it is broadly useful.

    =C2=A0 =C2=A0 *Aliases*

    =C2=A0 =C2=A0 This use case was brought up in the context of migrating clie= nts
    =C2=A0 =C2=A0 from draft event names to standardized event names. In this c= ase,
    =C2=A0 =C2=A0 the event transmitter can transmit two tokens for the logical= event,
    =C2=A0 =C2=A0 one using the old name and another using the new name.

    =C2=A0 =C2=A0 *Related Events*

    =C2=A0 =C2=A0 The SET spec defines the txn claim as a means of correlating<= br> =C2=A0 =C2=A0 independent tokens that relate to the same logical event.

    =C2=A0 =C2=A0 --=C2=A0
    =C2=A0 =C2=A0 Annabelle Richard Backman

    =C2=A0 =C2=A0 Amazon =E2=80=93 Identity Services

    =C2=A0 =C2=A0 _______________________________________________
    =C2=A0 =C2=A0 Id-event mailing list
    =C2=A0 =C2=A0=C2=A0Id-event@ietf.o= rg=C2=A0<mailto:Id-event@ietf.org>
    =C2=A0 =C2=A0=C2=A0https://urld= efense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_<= wbr>listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjW<= wbr>wlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG5JIUUwWGFS= ibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoIY&e=3D=



    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event<= /span>


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event<= /span>



    =C2=A0

    --=C2=A0

    Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am working on!

    =C2=A0

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org

    https://urldefense.proofpoint.co= m/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&a= mp;d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE= &r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DU-a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3DrvdrtI7rYNRA= nqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e=3D

    =C2=A0



    =C2=A0

    --

    Subscribe to the HARDTWARE mail list to learn about projects I am working on!<= /u>



    =C2=A0

    --

    Subscribe to the HARDTWARE mail list to learn about projects I am working on!<= /u>




    --
    Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
    --94eb2c119bb836f972055ce4a2cf-- From nobody Tue Oct 31 23:04:27 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DFAD13FD20 for ; Tue, 31 Oct 2017 23:04:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.71 X-Spam-Level: X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ZFD0To1fdRh for ; Tue, 31 Oct 2017 23:04:23 -0700 (PDT) Received: from mail-io0-x22b.google.com (mail-io0-x22b.google.com [IPv6:2607:f8b0:4001:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 844C713FD1E for ; Tue, 31 Oct 2017 23:04:23 -0700 (PDT) Received: by mail-io0-x22b.google.com with SMTP id i38so3872905iod.2 for ; Tue, 31 Oct 2017 23:04:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=S4nqM65avkKLM80Mqtp3mZLd3EBEE3l4Fp1hb9tNfA8=; b=YI/i/gjgXMcTw5gKQ8eJ/pYE7B3iUC6rWo9kIVP1uZyNUdEgHkmUZPewnX395SDWBB NBm6ZzxEFQoyV+aX8JhWS+dyTP2BMKHAu4cyCtyLIjBPeh/BKnqYs8D5a3KdebHguVJW bessMrhAGQkHRxMNozLq44YhqNb34g/eG+Q8wmKbiP9Uz1gHZvdb1Zw84mqWH+SYUiY1 0wSdedgeCwKi3kNxa9ldy/PpycdN7JMcOJUB3ARSPlwr725GFVm5/P4qH+jUCcq/sTa4 lMMNUcm6anUPoqx4vbn0mZAhWm0SKJ2N67OXxtoJ3L5EMfMnxYjYwQn6uta6RxObLj4r 6tSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=S4nqM65avkKLM80Mqtp3mZLd3EBEE3l4Fp1hb9tNfA8=; b=dW4SghftHXvUQjeVht1JKv/BGqz8j81xaLgTBigtJt4EVRPv1wyWKVNIuAsh6GR3MM 9x3TaQe6TzKbKTE4UDCLY6MXB3zrcm27yFIIkDFKl5Qd2DkzwndiixEFMp/vQWSfXPpl 1Pt1qeuqNbjITAccm7UyCeUXH+wSQp/LEdwBHE7qu1y5+sPOlq9hLekwrM+lbXrdq/cs lMhGHqGI9pDIVn5PHDOGStKSTTE+56g6jtk2xHdkX5xH7xU4eN/+MFRoouwR34ZMTEmQ 8tSBNGKxLaO5r3xAfYXzfdScJCifNA/Yvm8AlETXX7Jvpyi+an6JIoqhJ7R0cnRvHIeW xH5Q== X-Gm-Message-State: AMCzsaVyVEXDj7C6PGjDrWFZUZ3vMnea0/gKKWrGdEXUZjMD/KVs10nG lWNKgmyprhYyWE8pwPaizyDo3v3Xlr3lzFNjq0ZO5g== X-Google-Smtp-Source: ABhQp+QxOM5nC7waJx90ZDaGiMwz8xb7bnI62AnPtjnH0PG+D+cVtw29n3w3JhzN+YsV7tvM5VIebT++mwBUvPODa4E= X-Received: by 10.36.227.7 with SMTP id d7mr6305934ith.141.1509516262337; Tue, 31 Oct 2017 23:04:22 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.34.9 with HTTP; Tue, 31 Oct 2017 23:04:01 -0700 (PDT) In-Reply-To: References: <67C37F1B-B6F2-4F00-AF39-CF9C526236A0@oracle.com> From: Marius Scurtescu Date: Tue, 31 Oct 2017 23:04:01 -0700 Message-ID: To: Dick Hardt Cc: "Phil Hunt (IDM)" , SecEvent , Mike Jones , Annabelle Richard Content-Type: multipart/alternative; boundary="94eb2c111b069a1510055ce5a4c4" Archived-At: Subject: Re: [Id-event] IETF 100 draft agenda X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 06:04:26 -0000 --94eb2c111b069a1510055ce5a4c4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Oct 31, 2017 at 9:23 PM, Dick Hardt wrote: > Thanks Marius. I've updated the agenda to reflect above. Also please note > the authorization header discussion brought up by Adam in my previous ema= il. > Yes, I will cover the authorization header. > > On Tue, Oct 31, 2017 at 9:21 AM, Marius Scurtescu > wrote: > >> For https://datatracker.ietf.org/doc/draft-scurtescu-seceven >> t-event-stream-mgmt-api/ Annabelle and I are proposing a two part >> presentation: I will present the current draft and changes since Prague, >> Annabelle will then present a concrete example of profiling this managem= ent >> API spec in RISC. >> >> The delta on the delivery spec is relatively small, I am happy to presen= t >> that as well. >> >> Marius >> >> On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt wrote= : >> >>> Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if one o= f >>> the other authors will do the Delivery. >>> >>> On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) >>> wrote: >>> >>>> Dick, >>>> >>>> I believe Mike won't be able to make the monday meeting. so Mike and I >>>> are working on a presentation for the current state of set that I will= do. >>>> >>>> Not much has happened with delivery other than removing verify event >>>> (because that was going in control plane). I can do that very quickly. >>>> >>>> I do have concerns about config on control planes and delivery streams >>>> when firewalls are involved. I will include a couple of slides on this= that >>>> may be important to control plane discussion. >>>> >>>> I can do my control plane ID draft proposal after marius/annabelle's. >>>> It will be similar to the deck we discussed at the amazon hq f2f. >>>> >>>> Phil >>>> >>>> On Oct 30, 2017, at 2:09 PM, Dick Hardt wrote: >>>> >>>> Here is the draft agenda. Mike, Phil, Marius, Annabelle - please let m= e >>>> know who is presenting what where it is xxx >>>> >>>> Thanks! >>>> >>>> Here are the documents we will be discussing: >>>> >>>> https://datatracker.ietf.org/doc/draft-ietf-secevent-delivery/ >>>> >>>> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ >>>> >>>> https://datatracker.ietf.org/doc/draft-scurtescu-secevent-ev >>>> ent-stream-mgmt-api/ >>>> >>>> https://datatracker.ietf.org/doc/draft-hunt-secevent-stream-mgmt/ >>>> >>>> >>>> /Dick >>>> >>>> ----- >>>> IETF 100 Singapore >>>> Bras Basah Monday Nov 13, 2017, 13:30 - 15:30 >>>> >>>> Agenda Setting Dick Hardt (chair) 13:3= 0 >>>> - 13:40 >>>> Security Event Token (SET) xxx 13:4= 0 >>>> - 14:00 >>>> SET Delivery using HTTP xxx 14:0= 0 >>>> - 14:20 >>>> Chair Slides on Managment APIs Dick Hardt (chair) 14:2= 0 >>>> - 14:30 >>>> Management API for SET Event Streams xxx 14:3= 0 >>>> - 14:50 >>>> SET Stream Managment and Provisioning Phil Hunt 14:5= 0 >>>> - 15:10 >>>> Management API Discussion Dick Hardt (chair) 15:1= 0 >>>> - 15:20 >>>> AOB Dick Hardt (chair) 15:2= 0 >>>> - 15:30 >>>> >>>> >>>> >>>> >>> >>> >>> -- >>> Subscribe to the HARDTWARE mail list to learn >>> about projects I am working on! >>> >> >> > > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > --94eb2c111b069a1510055ce5a4c4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
    On T= ue, Oct 31, 2017 at 9:23 PM, Dick Hardt <dick.hardt@gm= ail.com> wrote:
    Thanks Marius. I've updated the agenda to reflect above. Also ple= ase note the authorization header discussion brought up by Adam in my previ= ous email.

    Yes, I will cover the auth= orization header.
    =C2=A0

    On Tue, Oct 31, 2017 at 9:21 AM, Marius Scurtescu <mscurtescu@google.com> wrote:
    For=C2=A0https://datatracker.ietf.org/doc/draft-scurtes= cu-secevent-event-stream-mgmt-api/ Annabelle and I are proposing a= two part presentation: I will present the current draft and changes since = Prague, Annabelle will then present a concrete example of profiling this ma= nagement API spec in RISC.

    The delta on the delivery spe= c is relatively small, I am happy to present that as well.

    Marius
    =

    On Mon, Oct 30, 2017 at 2:39 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:
    <= div dir=3D"ltr">Hey Phil, Thanks! I'll slot you in for the SET slot. Le= t's see if one of the other authors will do the Delivery.

    On Mon, Oct 30, 2017 at 2:32= PM, Phil Hunt (IDM) <p= hil.hunt@oracle.com> wrote:
    Dick,

    I believe Mike won't be able to make the monday meeting. so Mik= e and I are working on a presentation for the current state of set that I w= ill do.=C2=A0

    Not much has happened with = delivery other than removing verify event (because that was going in contro= l plane). I can do that very quickly.=C2=A0

    I do have concerns about config on control planes and delivery streams w= hen firewalls are involved. I will include a couple of slides on this that = may be important to control plane discussion.=C2=A0

    I can do my control plane ID draft proposal after marius/annabel= le's. It will be similar to the deck we discussed at the amazon hq f2f.= =C2=A0

    Phil

    On Oct 30, 2017, at 2:09 PM, Di= ck Hardt <dick.hardt@gmail.com> wr= ote:

    IETF 100 Singapore
    Bras Basah Monday Nov 13, 20= 17, 13:30 - 15:30

    Agenda Setting=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 D= ick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 13:30 - 13:40
    Securi= ty Event Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 xxx=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A013:40 - 14:00=C2=A0 =C2=A0
    SET Delivery using HTTP=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0xxx=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:00 - 1= 4:20=C2=A0
    Chair Slides on Managment APIs=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 14:20 - 14:30
    Management API for SET Event Streams=C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:30 = - 14:50=C2=A0
    SET Stream Managment and Provisioning=C2=A0 =C2=A0P= hil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A014:50= - 15:10=C2=A0 =C2=A0=C2=A0
    Management API Discussion=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2= =A0 =C2=A0 =C2=A0 15:10 - 15:20
    AOB=C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2= =A0 15:20 - 15:30






    --
    Subscribe to the HARDTWARE mail list to learn about projects I am working on!



    --
    Subscribe t= o the = HARDTWARE mail list to learn about projects I am working on!

    --94eb2c111b069a1510055ce5a4c4-- From nobody Tue Oct 31 23:05:34 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18ECB13FD20 for ; Tue, 31 Oct 2017 23:05:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.018 X-Spam-Level: X-Spam-Status: No, score=-2.018 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3vgn_FIR6kUD for ; Tue, 31 Oct 2017 23:05:28 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0129.outbound.protection.outlook.com [104.47.38.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDDD713FC76 for ; Tue, 31 Oct 2017 23:05:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ZrHQyiWbK2ro1Y+H0mV0U7VY7oDni7mWSEPSwqNVgoM=; b=eN0XDDgMKXmD48ZHFLS3vBn7ZNqbMgjclRUqdw9+Z4G3qQ9Zo5vv9I6RzP/h8YL26GeGmiZxUNswNCfY48hFYSp98AkBwY0730xgwHDF6mcEPJn0Idz2tpLjc8vVSoEIECDkcjf85qVqnmVmjbHWyGQwDzbjrOni4xGrKYhklUQ= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0120.namprd21.prod.outlook.com (10.173.189.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.218.2; Wed, 1 Nov 2017 06:05:24 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.20.0218.004; Wed, 1 Nov 2017 06:05:24 +0000 From: Mike Jones To: Dick Hardt CC: Yaron Sheffer , "Richard Backman, Annabelle" , ID Events Mailing List , "Phil Hunt (IDM)" Thread-Topic: [Id-event] Use cases for multiple events per SET? Thread-Index: AQHTTGwev6cV0D/tE06azbqzz7my9aLyXLkAgAEBjXCAB9BnAIAAT1IAgAAUagCAAQQ9AIAANauAgAAlNACAAAV2gIABcZJQgACUvYCAAADCcIAAA1kAgAASxcA= Date: Wed, 1 Nov 2017 06:05:24 +0000 Message-ID: References: <2FF066DE-A1EB-4656-AC23-74FC11104FFA@amazon.com> <48EAF13C-5A37-4D22-A649-8257A49F8EC7@oracle.com> <57447694-2AA9-4987-BB99-9E5FD358F562@oracle.com> <65C74B5D-9BDE-4FEA-9D02-0F041DC11A0F@amazon.com> <541716DB-A028-4A1C-A9A8-A8EC9EE3A76A@oracle.com> <26D99BCD-3647-452A-90BA-8F13761A1362@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.47.85.199] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0120; 6:N7I3PL55LI2/7E7KKvh5dqAD4Grm7qywkvpxJfyKKAXLGATTEw0NHAKn/97/GZW3j8yd3eVOZGoipNESqq4jCBYb3w4A65fjc9hVdUHpyITXFPnUYTETtA0Nte8bMVkSmE5V2Pgs1ph2KSL8OznDLmZU8Bl2g28dGSag1uy/pxrZkxe8r6KXO/XMN6NwDwn2LlKHJb/oGQcET2UIUxw9+i+Vaogt4zZOIMIvBDfr+5T+VuWDRFRrEPotCFlxoVZnDCQltR+XlxlRIRLGgmULTy+zbllQXmFu6+g4Bml1DtgMNBA0lzFyy4UtmUwzrgxJrJn2inst1rLjimGsC31RaZ2WqXUkK8RcKw0YHDMHQqE=; 5:B2SpkXZJEHlw3joAbDLumhodm6ErEYlPfmN+5A2ihkKF2i2hLYP1b6Ixd85+JeN3lX/iuN7NubHAyyZEEebczTdUVALmZO296xioulNef/XeOsK6/TzB0o8mYTWzngMCbd4QjsRDHjeFO5/VJ0XOCuBDhGUFnHnAKdOdGndfjB0=; 24:/kDlM98Kb4QtnkM2QA/NXDUGXQX9j5DTKK30pQpXq2XyOZ3E+Zyk3hDIyZRvWbUYYbZ++l6AC6es61WmYiL7e5u8uMOzRtS6BfImuasLvRY=; 7:89SeQbOlqOenjO8R/H3WFtmrHc4I6G1wRoLwGTvty+YUFkFY8li0bN6nFT7hKtCJlDWGntaNBZa6NjWw7aGhVFXBUe9kzpbj0rK7G8BHWnCLUDJhD0Bcf7CMksCk/0zRmEqO7C3YZtf4JrNoTXgQKUatAH2KnaTjGJmWZpiUcvmaPlycNqiHm/ExTojyoAzyAUdXeiBuDTptIu9AFF/dFP1QCJcjNmaNfVXua2U9cneaTfMSbre14PrKz/v5caY/ x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 2d1a6847-cc20-44cd-bd01-08d520ee8acd x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081)(4534020)(4602075)(2017052603238); SRVR:CY4PR21MB0120; x-ms-traffictypediagnostic: CY4PR21MB0120: x-exchange-antispam-report-test: UriScan:(10436049006162)(89211679590171)(192374486261705)(33061846794335)(100405760836317)(21748063052155)(5213294742642)(146099531331640)(47284530071512)(17755550239193); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(10201501046)(3231020)(100000703101)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123558100)(20161123564025)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123555025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR21MB0120; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR21MB0120; x-forefront-prvs: 0478C23FE0 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(39860400002)(47760400005)(199003)(24454002)(51444003)(189002)(51914003)(99286003)(105586002)(55016002)(106356001)(316002)(6306002)(93886005)(236005)(9686003)(54896002)(33656002)(54906003)(7736002)(7066003)(53546010)(53936002)(606006)(53386004)(19609705001)(53376002)(7696004)(6916009)(6246003)(97736004)(551544002)(2950100002)(6436002)(53946003)(22452003)(5660300001)(14454004)(16200700003)(39060400002)(72206003)(6506006)(3660700001)(966005)(10090500001)(6116002)(478600001)(81156014)(81166006)(8676002)(102836003)(790700001)(3846002)(50986999)(8990500004)(77096006)(76176999)(54356999)(3280700002)(4326008)(189998001)(101416001)(561944003)(551934003)(10290500003)(86362001)(575784001)(2906002)(86612001)(25786009)(68736007)(2900100001)(66066001)(74316002)(229853002)(8936002)(559001)(579004)(569006); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0120; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504B87D31F6EB68C0D223E0F55F0CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2d1a6847-cc20-44cd-bd01-08d520ee8acd X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Nov 2017 06:05:24.5056 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0120 Archived-At: Subject: Re: [Id-event] Use cases for multiple events per SET? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Nov 2017 06:05:33 -0000 --_000_CY4PR21MB0504B87D31F6EB68C0D223E0F55F0CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TWFyaXVz4oCZIHByb3Bvc2VkIHN5bnRheCwgcGFzdGVkIGluIGJlbG93LCBoYXMgZXhhY3RseSB0 aGlzIGNoYXJhY3RlcmlzdGljLiAgVGhlIHdheSBJIHNlZSBpdCwgaGlzIHByb3Bvc2FsIGVzc2Vu dGlhbGx5IGhhcyBhIHByaW1hcnkgcGFzc3dvcmRSZXNldCBldmVudCBhbmQgYSBzZWNvbmRhcnkg cGFzc3dvcmRSZXNldEV4dCBkYXRhIHN0cnVjdHVyZSwgd2hpY2ggY291bGQgaGF2ZSBiZWVuIHNp bXBseSBhbm90aGVyIGV2ZW50IHZhbHVlIGluIHRoZSBjdXJyZW50IGRyYWZ0Lg0KDQpUaGlzIGJy ZWFraW5nIGNoYW5nZSBtYWtlcyB0aGUgZGF0YSBzdHJ1Y3R1cmVzIG1vcmUgY29tcGxpY2F0ZWQg LSBub3QgbGVzcy4gIEFuZCBpdCBtYWtlcyB0aGluZ3MgdGhhdCB1c2VkIHRvIGJlIHBvc3NpYmxl IGltcG9zc2libGUsIHJlZHVjaW5nIGZsZXhpYmlsaXR5IHRvIHRob3NlIHdobyB3b3VsZCB1c2Ug dGhlIHNwZWMuDQoNClRoZXNlIHNlZW0gbGlrZSBiYWQgdHJhZGVvZmZzIHRvIG1lLg0KDQp7DQog ICJqdGkiOiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAiLA0KICAiaWF0IjogMTQ1 ODQ5NjAyNSwNCiAgImlzcyI6ICJodHRwczovL3NjaW0uZXhhbXBsZS5jb208aHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tLz4iLA0KICAiYXVkIjogWw0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5j b20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIsDQogICAgImh0dHBzOi8vamh1Yi5l eGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ig0KICAgXSwNCiAgICJl dmVudF90eXBlIjogImh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0 RXh0IiwNCiAgICJldmVudCI6IHsNCiAgICAgICAgICJpZCI6IjQ0ZjYxNDJkZjk2YmQ2YWI2MWU3 NTIxZDkiLA0KICAgICAgICAgImV4dGVuc2lvbnMiOiB7DQogICAgICAgICAgICJodHRwczovL2V4 YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dOKAnTogew0KICAgICAgICAgICAg ICJyZXNldEF0dGVtcHRzIjo1LA0KICAgICAgICAgICB9DQogICAgICAgICB9DQogICAgICAgfQ0K fQ0KDQpJbiBwYXJ0aWN1bGFyLCBpdCBtYWtlcyBpdCBpbXBvc3NpYmxlIHRvIHNpZ24gbXVsdGlw bGUgcmVsYXRlZCBldmVudHMgc2hhcmluZyBhIGNvbW1vbiBjbGFpbXMgc2NoZW1hIHdpdGggYSBz aW5nbGUgc2lnbmF0dXJlIGJ5IHRoZSBpc3N1ZXIuICBJdCBmb3JjZXMgdGhlIGlzc3VlciB0byBk byB0aGUgZXh0cmEgd29yayBvZiBzaWduaW5nIGVhY2ggb2YgdGhlIHJlbGF0ZWQgZXZlbnRzIChv ciBmYWNldHMgb2YgdGhlIHNhbWUgbG9naWNhbCBldmVudCkgaW5kaXZpZHVhbGx5IGFuZCBmb3Jj ZXMgdGhlIHJlY2lwaWVudHMgdG8gZG8gdGhlIGV4dHJhIHdvcmsgb2YgY2hlY2tpbmcgYWxsIHRo b3NlIHVubmVjZXNzYXJ5IHNpZ25hdHVyZXMuDQoNCk5vdCBldmVyeSBwcm9maWxlIHdpbGwgZXZl ciBoYXZlIG11bHRpcGxlIGtleXMgaW4gdGhlIOKAnGV2ZW50c+KAnSBzZXQgYnV0IHRoZXJl4oCZ cyBhYnNvbHV0ZWx5IG5vIHJlYXNvbiB0byBwcmVjbHVkZSBpdC4NCg0KICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTog SWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2Yg RGljayBIYXJkdA0KU2VudDogVHVlc2RheSwgT2N0b2JlciAzMSwgMjAxNyA5OjUyIFBNDQpUbzog TWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0KQ2M6IFlhcm9uIFNoZWZm ZXIgPHlhcm9uZi5pZXRmQGdtYWlsLmNvbT47IFJpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlIDxy aWNoYW5uYUBhbWF6b24uY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0 Zi5vcmc+OyBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPg0KU3ViamVjdDog UmU6IFtJZC1ldmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD8NCg0K UGxlYXNlIGRpcmVjdCBtZSB0byBhIHByb3Bvc2FsIHRoYXQgaGFzIGEgInByaW1hcnkiIGFuZCAi c2Vjb25kYXJ5IiBldmVudHMuIEkgYWdyZWUgdGhhdCBpcyB1bmRlc2lyYWJsZS4gSSB3b3VsZCBh bHNvIGVuY291cmFnZSB0byBlbmdhZ2UgaW4gdGhlIGRpc2N1c3Npb25zIHNvIHRoYXQgd2UgY2Fu IGRyaXZlIGNsYXJpdHkgYW5kIHNpbXBsaWNpdHkuDQoNCkkgdGhpbmsgdGhlIHByb3Bvc2FsIGlz IHRoYXQgdGhlcmUgaXMgb25lIGV2ZW50IHBlciBTRVQuDQoNCkkgdGhpbmsgaGF2aW5nIG1vcmUg dGhhbiBvbmUgZXZlbnQgcGVyIFNFVCBhZGRzIGNvbXBsZXhpdHkgYXMgYSByZWNlaXZlciBtdXN0 IGRlYWwgd2l0aCByZWNlaXZpbmcgY29ycmVsYXRlZCBldmVudHMgaW4gb25lIFNFVCBhcyB3ZWxs IGFzIGNvcnJlbGF0ZWQgZXZlbnRzIGluIHRoZSBzYW1lIFNFVC4NCg0KL0RpY2sNCg0KT24gVHVl LCBPY3QgMzEsIDIwMTcgYXQgOTo0MiBQTSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCkkg aGVhciB5b3Ugb24gdGhlIGZhY3QgdGhhdCBkaWZmZXJlbnQgcGVvcGxlIGhhdmUgam9pbmVkIHRo ZSBlZmZvcnQgYXQgZGlmZmVyZW50IHRpbWVzLiAgVGhhdOKAmXMgYSBub3JtYWwgcHJvY2VzcyBh cyBhbiBlZmZvcnQgYnVpbGRzIG1vbWVudHVtLiAgSSBnZXQgdGhhdCBub3QgZXZlcnlvbmUgd2Fz IHRoZXJlIHdoZW4gcHJldmlvdXMgY29uc2Vuc3VzIGNhbGxzIHdlcmUgdGFrZW4uDQoNCkkgc2hv dWxkIG5vdGUgdGhhdCBJIGhhdmUgc3BlY2lmaWMgdGVjaG5pY2FsIG9iamVjdGlvbnMgdG8gdGhl IHNwZWNpZmljIHByb3Bvc2VkIGNoYW5nZXMgYmVpbmcgZGlzY3Vzc2VkIGFzIHdlbGwuICBDdXJy ZW50bHkgYWxsIGV2ZW50cyBpbiB0aGUgc2V0IGhhdmUgdGhlIHNhbWUgc3ludGF4LiAgVGhlIHBy b3Bvc2FscywgYXMgSSB1bmRlcnN0YW5kIHRoZW0sIHJldmVydCB1cyB0byBhIHN0YXRlIHdoZXJl IHRoZXJl4oCZcyBhIOKAnHByaW1hcnnigJ0gYW5kIOKAnHNlY29uZGFyeeKAnSBldmVudHMsIHdp dGggZGlmZmVyZW50IHN5bnRheCBmb3IgdGhlIHR3byBjbGFzc2VzLiAgVGhhdOKAmXMgbmVlZGxl c3NseSBtb3JlIGNvbXBsaWNhdGVkLCBhZGRpbmcgbm8gYWN0dWFsIHZhbHVlLg0KDQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg LS0gTWlrZQ0KDQpGcm9tOiBEaWNrIEhhcmR0IFttYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb208 bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPl0NClNlbnQ6IFR1ZXNkYXksIE9jdG9iZXIgMzEs IDIwMTcgOTozNyBQTQ0KVG86IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNv bTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBQaGlsIEh1bnQgKElE TSkgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+OyBZ YXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlhcm9uZi5pZXRmQGdt YWlsLmNvbT4+OyBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSA8cmljaGFubmFAYW1hem9uLmNv bTxtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbT4+OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0IDxp ZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+Pg0KDQpTdWJqZWN0OiBS ZTogW0lkLWV2ZW50XSBVc2UgY2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgU0VUPw0KDQpN aWtlDQoNCkFzIHlvdSB3ZWxsIGtub3csIG1hbnkgcGVvcGxlIGluIGEgV0cgZG9uJ3QgbG9vayBj bG9zZWx5IGF0IGEgc3BlY2lmaWNhdGlvbiB1bnRpbCBsYXN0IGNhbGwgaXMgbWFkZS4gQWRkaXRp b25hbGx5LCB3ZSBhcmUgY29taW5nIHVwIG9uIG9ubHkgdGhlIDNyZCBXRyBtZWV0aW5nLiBUaGUg V0cgaGFzIG5vdCBleGlzdGVkIGZvciB2ZXJ5IGxvbmcuIFdoaWxlIHNvbWUgb2YgdGhlIHBhcnRp Y2lwYW50cyBoYXZlIGJlZW4gd29ya2luZyBvbiB0aGlzIGZvciBhIHdoaWxlLCBtYW55IGhhdmUg bm90LCBhbmQgd2UgYXJlIGxvb2tpbmcgZm9yIGNvbnNlbnN1cyBhY3Jvc3MgdGhlIFdHLg0KDQpT aW5jZSBTZWNFdmVudCBpcyBhIGZyYW1ld29yayB0aGF0IHdlIGV4cGVjdCB0byBiZSBwcm9maWxl ZCwgSSBmZWVsIGl0IGlzIGltcG9ydGFudCB0byBlbnN1cmUgdGhhdCBTZWNFdmVudCBzcGVjaWZp Y2F0aW9ucyBhcmUgZWFzeSBmb3IgYSB2YXJpZXR5IG9mIHByb2ZpbGVzIHRvIGFkb3B0LCBhbmQg dGhhdCB0aGUgc2VtYW50aWNzIG1ha2Ugc2Vuc2UuIEkgYWxzbyB0aGluayB0aGF0IHByb3BlcnRp ZXMgdGhhdCBhcmUgc3BlY2lmaWMgdG8gYSBwcm9maWxlIHNob3VsZCBiZSBsZWZ0IHRvIHRoYXQg cHJvZmlsZSBhbmQgbm90IGJlIGluY2x1ZGVkIGluIFNlY0V2ZW50Lg0KDQpTaW5jZSB0aGlzIGlz IGEgZnJhbWV3b3JrLCBpdCBpcyBleHBlY3RlZCB0aGF0IGFzIGRpZmZlcmVudCBncm91cHMgcHJv ZmlsZSBpdCwgdGhlcmUgd2lsbCBiZSBhZGRpdGlvbmFsIGZlZWRiYWNrLg0KDQpTcGVjaWZpY2Fs bHksIGFzIGEgcGFydGljaXBhbnQgaW4gdGhlIFJJU0MgcHJvZmlsZSBvZiBTRVQsIGEgbnVtYmVy IG9mIGlzc3VlcyBpbiBTRVQgaGF2ZSBzdXJmYWNlZCBhcyB0aGUgUklTQyBXRyBoYXMgbG9va2Vk IGF0IGhvdyB0byB1c2UgdGhlIFNFVC4NCg0KQXMgZm9yIFNFVCBiZWluZyBzdGFibGUgZm9yIG92 ZXIgYSB5ZWFyLCB0aGVyZSBoYXZlIGJlZW4gYSBudW1iZXIgb2YgY2hhbmdlcyB0byBTRVQgc2lu Y2UgdGhlbi4gSSBhbHNvIGRvbid0IHRoaW5rIHRoZXJlIHdhcyBjb25zZW5zdXMuIEJlZm9yZSB0 aGUgV0cgd2FzIGZvcm1lZCwgSSBhbmQgc2V2ZXJhbCBvdGhlcnMgaGFkIGV4cHJlc3NlZCBjb25j ZXJuIG9uIHRoZSBkZXNpZ24gb2YgU0VUIHdoZW4gUGhpbCBwcmVzZW50ZWQgaXQgYXQgYW4gSUlX IHNlc3Npb24uDQoNCkFzIHRvIHRha2luZyBhbm90aGVyIHllYXIsIEkgYW0gaG9wZWZ1bCB3ZSBj YW4gcmVzb2x2ZSB0aGUgcmVtYWluaW5nIGlzc3VlcyBpbiBTRVQgYW5kIHB1Ymxpc2ggYSBuZXcg ZHJhZnQgZm9yIGxhc3QgY2FsbC4gSSBkbyBub3QgdGhpbmsgd2Ugd2lsbCBuZWVkIHRvIHdhaXQg Zm9yIGFub3RoZXIgV0cgbWVldGluZyB0byBhc2sgZm9yIGxhc3QgY2FsbC4NCg0KV2UgYWxzbyBo YXZlIGEgbnVtYmVyIG9mIG90aGVyIGRvY3VtZW50cyB0aGF0IGFyZSBub3QgaW4gbGFzdCBjYWxs LCBhbmQgd2UgZG9uJ3QgaGF2ZSBhIFdHIGFkb3B0ZWQgZHJhZnQgeWV0IGZvciBtYW5hZ2VtZW50 LiBTbyB0aGVyZSBhcmUgc3RpbGwgYSBudW1iZXIgb2YgZG9jdW1lbnRzIHRvIHdvcmsgdGhyb3Vn aCBiZWZvcmUgd2UgaGF2ZSBhbGwgdGhlIGJpdHMgZm9yIHNvbWVvbmUgdG8gd29yayB3aXRoLg0K DQpJIGRvIHRoaW5rIHdlIGhhdmUgYmVlbiBtYWtpbmcgZ29vZCBwcm9ncmVzcyBzaW5jZSB0aGUg bGFzdCBJRVRGIG1lZXRpbmcsIGFuZCBJIGFtIGhvcGVmdWwgd2UgY2FuIGtlZXAgdXAgdGhpcyBt b21lbnR1bSBhbmQgZmluYWxpemUgYWxsIHRoZSBkb2N1bWVudHMgaW4gYSB0aW1lbHkgbWFubmVy Lg0KDQovRGljaw0KDQoNCk9uIFR1ZSwgT2N0IDMxLCAyMDE3IGF0IDEyOjQ4IFBNLCBNaWtlIEpv bmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbT4+IHdyb3RlOg0KSXTigJlzIGhhcmQgZm9yIG1lIHRvIGV2ZW4gZXhwcmVzcyBt eSBsZXZlbCBvZiBmcnVzdHJhdGlvbiB3aXRoIHRoZSByZWNlbnQgYXR0ZW1wdHMgdG8gb25jZSBh Z2FpbiByZWRlc2lnbiB0aGUgU2VjRXZlbnQgVG9rZW4gc3BlYy4gIFdl4oCZdmUgYmVlbiBhdCB0 aGlzIGZvciBtdWx0aXBsZSB5ZWFycyBiZWNhdXNlIHBlb3BsZSBrZWVwIHRyeWluZyB0byByZXZp c2l0IGRlY2lzaW9ucyB0aGF0IHdlcmUgbG9uZyBhZ28gbWFkZSBieSBjb25zZW5zdXMuICBJdOKA mXMgYmVlbiBzdGFibGUgZm9yIG92ZXIgYSB5ZWFyIGFuZCB0aGUgbWFqb3JpdHkgb2YgV0dMQyBy ZXNwb25kZW50cyBzYWlkIHNvbWUgdmFyaWFudCBvZiDigJxXb3JrcyBmb3IgbWUg4oCTIHNoaXAg aXQh4oCdDQoNClRoZXJl4oCZcyBub3Qgc3VmZmljaWVudCBqdXN0aWZpY2F0aW9uIHRvIHRyeSB0 byB1bmRvIGNvbnNlbnN1cyBwb3NpdGlvbnMgdGhhdCBoYXZlIGJlZW4gZGViYXRlZCBhbmQgYWZm aXJtZWQgb3ZlciBhbmQgb3Zlci4gIENvdW50ZW5hbmNpbmcgd2hvbGVzYWxlIGNoYW5nZXMgYXQg dGhpcyBsYXRlIGRhdGUgaXMgY291bnRlcnByb2R1Y3RpdmUgaW4gdGhlIGV4dHJlbWUhDQoNCkl0 4oCZcyBmYXIgYmV0dGVyIHRoYW4gZ29vZCBlbm91Z2ggYXMtaXMuICBJbiBteSBleHBlcmllbmNl LCBpZiB3ZSBzdGFydCByZWRlc2lnbmluZyBpdCwgaXQgd2lsbCByZXN1bHQgaW4gYW5vdGhlciB5 ZWFy4oCZcyBkZWxheS4gIEl0IGRvZXMgc29tZXRoaW5nIHNpbXBsZSBhbmQgdXNlZnVsLiAgUGxl YXNlLCBsZXTigJlzIGp1c3Qgc2hpcCBpdCwgc28gcGVvcGxlIGNhbiByZWx5IG9uIGl0Lg0KDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0g TWlrZQ0KDQpGcm9tOiBQaGlsIEh1bnQgKElETSkgW21haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNv bTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+XQ0KU2VudDogTW9uZGF5LCBPY3RvYmVyIDMw LCAyMDE3IDI6NDIgUE0NClRvOiBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWls dG86ZGljay5oYXJkdEBnbWFpbC5jb20+Pg0KQ2M6IFlhcm9uIFNoZWZmZXIgPHlhcm9uZi5pZXRm QGdtYWlsLmNvbTxtYWlsdG86eWFyb25mLmlldGZAZ21haWwuY29tPj47IFJpY2hhcmQgQmFja21h biwgQW5uYWJlbGxlIDxyaWNoYW5uYUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6b24u Y29tPj47IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWlj aGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj47IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2 ZW50QGlldGYub3JnPG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQoNClN1YmplY3Q6IFJlOiBb SWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/DQoNCklubGlu ZS4uLg0KDQpQaGlsDQoNCk9uIE9jdCAzMCwgMjAxNywgYXQgMjoyMiBQTSwgRGljayBIYXJkdCA8 ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6 DQpIaSBQaGlsDQoNCkNvcnJlY3QgbWUgaWYgSSBhbSBtaXN1bmRlcnN0YW5kaW5nLCBidXQgdGhl cmUgaXMgYSBSSVNDIHByb2ZpbGUgZXZlbnQNCg0KDQoNCiJodHRwOi8vc2NoZW1hcy5vcGVuaWQu bmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS88aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNldmVudF9yaXNj X2V2ZW50LTJEdHlwZV8tMjU1QyZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2 N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNM TjRLWk5BJm09aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTI1 bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlESno0MHRDUmpGYWxoa3cmZT0+YWNjb3VudC1jcmVk ZW50aWFsLWNoYW5nZS1yZXF1aXJlZOKAnQ0KDQoNCmFuZCBhbiBTQ0lNIHByb2ZpbGUgZXZlbnQN Cg0KDQoiaHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHTigJ0N Cg0KDQpJJ20gc3VnZ2VzdGluZyB0aGF0IHR3byBkaWZmZXJlbnQgZXZlbnRzIHdvdWxkIGJlIHNl bnQuIEVtYmVkZGluZyBvbmUgaW4gdGhlIG90aGVyIGRvZXMgbm90IG1ha2Ugc2Vuc2UuDQo8cGg+ SXQgaXMgYSBoeXBvdGhldGljYWwgZXhhbXBsZS4gSnVzdCBiZWNhdXNlIHlvdSBkaXNhZ3JlZSBv biB0aGlzIGRvZXMgbm90IG1lYW4gb3RoZXJzIGFyZSBub3QgdmFsaWQuDQoNCkkganVzdCBwaWNr ZWQgb3ZlcmxhcHBpbmcgcHJvcG9zYWxzIHRoYXQgaGF2ZSBkaWZmZXJlbnQgbWVhbmluZyAoYnV0 IG5vdCB0aGUgc2FtZSkgdG8gaWxsdXN0cmF0ZSB0aGUgZGlmZmVyZW5jZSBmcm9tIGlzc3Vpbmcg YSBzaW5nbGUgc2V0IHdpdGggZGlmZmVyZW50IGV2ZW50cy4NCg0KQXMgSSBoYXZlIHN0YXRlZCB0 aGlzIGlzIHZlcnkgZGlmZmVyZW50IGZyb20gYXNzZXJ0aW5nIG11bHRpcGxlIGRpc3RpbmN0IGV2 ZW50cyBpbiBvbmUgU0VULg0KDQpBbHNvLCBJIHRoaW5rIGl0IGlzIHNpbXBsZXIgdG8gaGF2ZSBl dmVudF90eXBlIGJlIGF0IHRoZSBzYW1lIGxldmVsIGFzIGV2ZW50DQoNCjxwaD5tYXkgYmUuIEkg d2FzIHdvcmtpbmcgZnJvbSBBbm5hYmVsbGUncyBwcm9wb3NlZCBmb3JtYXQuDQoNCnsNCiAgImp0 aSI6ICIzZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCIsDQogICJpYXQiOiAxNDU4NDk2 MDI1LA0KICAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbSIsDQogICJhdWQiOiBbDQog ICAgImh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3 NzU0IiwNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4 NjQxZDc2NzZlZTciDQogICBdLA0KICAgImV2ZW50X3R5cGUiOiAiaHR0cHM6Ly9leGFtcGxlLmNv bS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQiLA0KICAgImV2ZW50Ijogew0KICAgICAgICAg ImlkIjoiNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSIsDQogICAgICAgICAicmVzZXRBdHRlbXB0 cyI6NQ0KICAgICAgIH0NCn0NCg0Kew0KICAianRpIjogIjNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZi MWJkNGU3ZDMwIiwNCiAgImlhdCI6IDE0NTg0OTYwMjUsDQogICJpc3MiOiAiaHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tIiwNCiAgImF1ZCI6IFsNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29t L0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0KICAgICJodHRwczovL2podWIuZXhh bXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyINCiAgIF0sDQogICAiZXZl bnRfdHlwZSI6ICJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQt dHlwZS9hY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdlLXJlcXVpcmVkPGh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2Vj ZXZlbnRfcmlzY19ldmVudC0yRHR5cGVfYWNjb3VudC0yRGNyZWRlbnRpYWwtMkRjaGFuZ2UtMkRy ZXF1aXJlZCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFw SV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09aXlW bnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPW5ReTllelBSakRHZHZS VENhaUR0aTRPSGVsSDNES2dVQ1RLakYyR1Etc28mZT0+IiwNCiAgICJldmVudCI6IHsNCiAgICAg ICDigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sDQogICAgICAg4oCcaXNz4oCdOiJodHRw czovL2lkcC5leGFtcGxlLmNvbS8iDQogICAgICAgfQ0KfQ0KDQoNCg0KDQoNCk9uIE1vbiwgT2N0 IDMwLCAyMDE3IGF0IDEyOjA5IFBNLCBQaGlsIEh1bnQgPHBoaWwuaHVudEBvcmFjbGUuY29tPG1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KQW5uYWJlbGxlL0RpY2ssDQoNClRo YW5rcyBmb3IgdGhlIGNvbW1lbnRzLiBJIHRoaW5rIHdlIG5lZWQgdG8gZXhhbWluZSB0aGUgY29u c2VxdWVuY2VzIG9mIHRoZSBwcm9wb3NhbCBpbiBKU09OLg0KDQpBcyBJIHN0YXRlZCwgd2hhdCBj YXVzZXMgbW9zdCBvZiB0aGUgaXNzdWUgaXMgdGhlIHByb3Bvc2VkIGV4dGVuc2lvbiBtZWNoYW5p c20gaW4gdGhlIHBheWxvYWQgKHBvc3NpYmx5IHVzaW5nIGV2ZW50cyBpbiBhIHJlY3Vyc2l2ZSB3 YXkpLiBEb2VzIGl0IGZvbGxvdyB0aGUgb2xkIGZvcm1hdCBvciB0aGUgbmV3Pw0KDQpMZXTigJlz ICBjb25zaWRlciBhIHVzZSBjYXNlIHdoZXJlIHdlIGhhdmUgYW4gaWRlbnRpdHkgbWFuYWdlbWVu dCBzeXN0ZW0gdGhhdCB1c2VzIFNDSU0sIGJ1dCB0aGUgU0NJTSBzeXN0ZW0gaXMgYWxzbyB0aGUg dW5kZXJseWluZyBkYXRhIHN0b3JlIGZvciBDb25uZWN0LiAgQSBQYXNzd29yZCByZXNldCBtaWdo dCBnZW5lcmF0ZSB0aGUgZm9sbG93aW5nIGV2ZW50IHdoaWNoIGhhcyBhbiBleHRlbnNpb24gKGNv bnZleWluZyByZXNldCBjb3VudCkgQU5EIG92ZXJsYXBwaW5nIHN0YXRlbWVudCBmcm9tIFJJU0Mu ICBCT1RIIG9mIHdoaWNoIG1pZ2h0IGJlIGltcG9ydGFudCB0byBhIHNpbWlsYXIgcmVjZWl2ZXIg dXNpbmcgU0NJTSBhbmQgT0lEQy4NCg0KVGhlIDAzIHNwZWMgY3VycmVudGx5IHdvdWxkIGFsbG93 Og0KDQoNCnsNCg0KICAianRpIjogIjNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwIiwN Cg0KICAiaWF0IjogMTQ1ODQ5NjAyNSwNCg0KICAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFtcGxl LmNvbSIsDQoNCiAgImF1ZCI6IFsNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVl ZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIsDQoNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1w bGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciDQoNCiAgIF0sDQoNCiAgICJl dmVudHMiOiB7DQoNCiAgICAgInVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OnBhc3N3b3JkUmVz ZXQiOg0KDQogICAgICAgeyAiaWQiOiI0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5In0sDQoNCiAg ICAgImh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IjoNCg0K ICAgICAgIHsgInJlc2V0QXR0ZW1wdHMiOjV9LA0KDQogICAgICJodHRwOi8vc2NoZW1hcy5vcGVu aWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9v ZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRf cmlzY19ldmVudC0yRHR5cGVfLTI1NUMmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBa aDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkx YUxjTE40S1pOQSZtPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cm cz0yNWwwOXNIOFlWNDJ4emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmU9Pg0KICAgICAg IGFjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQiOiB7DQoNCiAgICAgICAgIOKAnHN1 YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSwNCg0KICAgICAgICAg4oCcaXNz4oCdOiJodHRwczov L2lkcC5leGFtcGxlLmNvbS8iDQoNCiAgICAgICB9DQoNCiAgfQ0KDQp9DQoNCg0KDQpJbiB0aGUg YWJvdmUgLSBlYWNoIHBheWxvYWQgaXMgYSDigJhwZWVyJyBhbmQgaXNzdWVkIHdpdGhvdXQgcHJl ZmVyZW5jZSBieSB0aGUgdHJhbnNtaXR0ZXIuIFRoZSByZWNlaXZlciBjYW4gYXNzaWduIHByaW9y aXR5IGluIGl0cyBvd24gY29udGV4dCBpZiB0aGF0IG1hdHRlcnMuDQoNCg0KDQpUaGUgbmV3IHBy b3Bvc2FsOg0KDQoNCg0Kew0KDQogICJqdGkiOiAiM2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0 ZTdkMzAiLA0KDQogICJpYXQiOiAxNDU4NDk2MDI1LA0KDQogICJpc3MiOiAiaHR0cHM6Ly9zY2lt LmV4YW1wbGUuY29tIiwNCg0KICAiYXVkIjogWw0KDQogICAgImh0dHBzOi8vamh1Yi5leGFtcGxl LmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0IiwNCg0KICAgICJodHRwczovL2po dWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNyINCg0KICAgXSwN Cg0KICAgImV2ZW50Ijogew0KDQogICAgIOKAnGV2ZW50X3R5cGXigJ06InVybjppZXRmOnBhcmFt czpzY2ltOmV2ZW50OnBhc3N3b3JkUmVzZXTigJ0sDQoNCiAgICAgImlkIjrigJ00NGY2MTQyZGY5 NmJkNmFiNjFlNzUyMWQ54oCdLA0KDQogICAgIOKAnGV2ZW50c+KAnTp7DQoNCiAgICAgLT5ub3Rl IOKApmlzIHRoaXMgdGhlIG9sZCBvciBuZXcgc3RydWN0dXJlPyA8LQ0KDQogICAgICAgImh0dHBz Oi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IjoNCg0KICAgICAgICAg eyAicmVzZXRBdHRlbXB0cyI6NX0sDQoNCiAgICAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5l dC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvXDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jpc2Nf ZXZlbnQtMkR0eXBlXy0yNTVDJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3 cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xO NEtaTkEmbT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9MjVs MDlzSDhZVjQyeHpnVS1DWFNnOHhIOXR2eURKejQwdENSakZhbGhrdyZlPT4NCiAgICAgICAgIGFj Y291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQiOiB7DQoNCiAgICAgICAgIOKAnHN1YuKA nTrigJ03Mzc1NjI2QTY1NjM3NOKAnSwNCg0KICAgICAgICAg4oCcaXNz4oCdOiJodHRwczovL2lk cC5leGFtcGxlLmNvbS8iDQoNCiAgICAgICB9DQoNCiAgICAgfQ0KDQogICB9DQoNCn0NCg0KDQoN CkluIHRoZSBhYm92ZSwgc3ViLWV2ZW50cyBvciBleHRlbnNpb25zIGhhdmUgYSBkaWZmZXJlbnQg Zm9ybWF0LiBUaGUgc2FtZSBjb21wbGFpbnQgYWJvdXQgdGhlIG9yaWdpbmFsIHN0YW5kcy4NCg0K DQoNCipPUiogKGlmIHRoZSByZWNlaXZlciBjYXJlcyBhYm91dCBSSVNDIG1vcmUpLiAgTm90ZSB0 aGF0IHRoaXMgbGVhZHMgdG8gYSB0cmlwbGUgbmVzdGVkIHN0cnVjdHVyZS4NCg0KDQoNCnsNCg0K ICAianRpIjogIjNkMGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwIiwNCg0KICAiaWF0Ijog MTQ1ODQ5NjAyNSwNCg0KICAiaXNzIjogImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbSIsDQoNCiAg ImF1ZCI6IFsNCg0KICAgICJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFm YTViYmM4Nzk1OTNiNzc1NCIsDQoNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRz LzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciDQoNCiAgIF0sDQoNCiAgICJldmVudCI6IHsNCg0K ICAgICDigJxldmVudF90eXBl4oCdOiJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3NlY2V2ZW50 L3Jpc2MvZXZlbnQtdHlwZS9cPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2VjZXZlbnRfcmlzY19ldmVudC0yRHR5 cGVfLTI1NUMmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVh cElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPWl5 Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5Rl84dThfcVNDX3cmcz0yNWwwOXNIOFlWNDJ4 emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1JqRmFsaGt3JmU9Pg0KDQogICAgICAgICAgICAgYWNjb3Vu dC1jcmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZOKAnSwNCg0KICAgICAg4oCcc3Vi4oCdOuKAnTcz NzU2MjZBNjU2Mzc04oCdLA0KDQogICAgICDigJxpc3PigJ06Imh0dHBzOi8vaWRwLmV4YW1wbGUu Y29tL+KAnCwNCg0KICAgICAg4oCcZXZlbnRz4oCdOnsNCg0KICAgICAgICAidXJuOmlldGY6cGFy YW1zOnNjaW06ZXZlbnQ6cGFzc3dvcmRSZXNldCI6DQoNCiAgICAgICAgew0KDQogICAgICAgICAg ImlkIjrigJ00NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ54oCdLA0KDQogICAgICAgICAg4oCcZXZl bnRz4oCdOnsNCg0KICAgICAgICAgICAgICJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQv cGFzc3dvcmRSZXNldEV4dCI6DQoNCiAgICAgICAgICAgICAgIHsgInJlc2V0QXR0ZW1wdHMiOjV9 LA0KDQogICAgICAgICAgfQ0KDQogICAgICAgIH0NCg0KICAgICAgfQ0KDQogICB9DQoNCn0NCg0K DQoNCkluIHRoZSBhYm92ZSwgdGhlIGV4dGVuc2lvbiBpcyBwbGFjZWQgaW5zaWRlIHRoZSBldmVu dCBpdCBleHRlbmRzLiBJdCBmb2xsb3dzIHRoZSBvbGQgZm9ybWF0IChvciBzaG91bGQgaXQgZm9s bG93IHRoZSBuZXc/KQ0KDQoqT1IqIEZvbGxvd2luZyB0aGUgdG9wIGxheWVyIHBhdHRlcm4gb2Yg c2luZ3VsYXIgZXZlbnQgIE5vdGUgdGhhdCB0aGlzIGxlYWRzIHRvIGEgdHJpcGxlIG5lc3RlZCBz dHJ1Y3R1cmUuDQoNCg0KDQp7DQoNCiAgImp0aSI6ICIzZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFi ZDRlN2QzMCIsDQoNCiAgImlhdCI6IDE0NTg0OTYwMjUsDQoNCiAgImlzcyI6ICJodHRwczovL3Nj aW0uZXhhbXBsZS5jb20iLA0KDQogICJhdWQiOiBbDQoNCiAgICAiaHR0cHM6Ly9qaHViLmV4YW1w bGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiLA0KDQogICAgImh0dHBzOi8v amh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3Ig0KDQogICBd LA0KDQogICAiZXZlbnQiOiB7DQoNCiAgICAg4oCcZXZlbnRfdHlwZeKAnToiaHR0cDovL3NjaGVt YXMub3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvXDxodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3Nl Y2V2ZW50X3Jpc2NfZXZlbnQtMkR0eXBlXy0yNTVDJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1 WXFQa0FJMWFMY0xONEtaTkEmbT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4 X3FTQ193JnM9MjVsMDlzSDhZVjQyeHpnVS1DWFNnOHhIOXR2eURKejQwdENSakZhbGhrdyZlPT4N Cg0KICAgICAgICAgICAgIGFjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWTigJ0sDQoN CiAgICAgIOKAnHN1YuKAnTrigJ03Mzc1NjI2QTY1NjM3NOKAnSwNCg0KICAgICAg4oCcaXNz4oCd OiJodHRwczovL2lkcC5leGFtcGxlLmNvbS/igJwsDQoNCiAgICAgIOKAnGV2ZW504oCdOnsNCg0K ICAgICAgICDigJxldmVudF90eXBl4oCdOiJ1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNz d29yZFJlc2V04oCdLA0KDQogICAgICAgICJpZCI64oCdNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFk OeKAnSwNCg0KICAgICAgICDigJxldmVudOKAnTp7DQoNCiAgICAgICAgICDigJxldmVudF90eXBl 4oCdOiJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dOKAnSwN Cg0KICAgICAgICAgICJyZXNldEF0dGVtcHRzIjo1DQoNCiAgICAgICAgfQ0KDQogICAgICB9DQoN CiAgIH0NCg0KfQ0KDQoNCg0KVGhpcyBmb3JtYXQgZm9sbG93cyB0aGUgcHJvcG9zZWQgc2luZ3Vs YXIgZXZlbnQgZm9ybWF0IHJlY3Vyc2l2ZWx5IGFuZCBpcyAzIGxheWVycyBkZWVwLiBOb3RlIHRo YXQgdGhlIHBhcnNlciBoYXMgdG8gY29udGludWUgdG8gc2VhcmNoIHRoZSBkb2N1bWVudCBmb3Ig dGhpbmdzIHRoYXQgYXJlbuKAmXQgdGhlcmUgYXMgaXQgaGFzIHRvIHN0b3Agd2hlbiBubyDigJxl dmVudOKAnSBhdHRyaWJ1dGUgaXMgZm91bmQgcmF0aGVyIHRoYW4gaXRlcmF0ZSBvdmVyIGFuIGFy cmF5Lg0KDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2 aWNlcyBBcmNoaXRlY3QNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRl cGVuZGVudGlkLmNvbSZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1V QjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5B Jm09aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZzPTlzWWhncEV6 Yjd4UGxRRm1DQ1hObUhvNmZRTjlJQnUtU0hKYW1nX0I0SHMmZT0+DQpwaGlsLmh1bnRAb3JhY2xl LmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9jdCAzMCwgMjAxNywgYXQg ODo1NyBBTSwgUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb208 bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+PiB3cm90ZToNCg0KUmVwbGllcyBpbmxpbmUuDQoN Ci0tDQpBbm5hYmVsbGUgUmljaGFyZCBCYWNrbWFuDQpJZGVudGl0eSBTZXJ2aWNlcw0KDQoNCkZy b206IFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tPj4NCkRhdGU6IFN1bmRheSwgT2N0b2JlciAyOSwgMjAxNyBhdCA1OjI1IFBNDQpUbzog RGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwu Y29tPj4NCkNjOiBZYXJvbiBTaGVmZmVyIDx5YXJvbmYuaWV0ZkBnbWFpbC5jb208bWFpbHRvOnlh cm9uZi5pZXRmQGdtYWlsLmNvbT4+LCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+LCAiUmljaGFyZCBCYWNr bWFuLCBBbm5hYmVsbGUiIDxyaWNoYW5uYUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6 b24uY29tPj4sIElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1haWx0 bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBVc2UgY2FzZXMg Zm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgU0VUPw0KDQpJIGhvcGUgdGhpcyBhbnN3ZXJzIHlvdXIg cXVlc3Rpb24uDQoNCk15IOKAnG1heeKAnSB3YXMgYmVjYXVzZSBJIGNhbuKAmXQgc2VlIGEgcmVh c29uIHdoeSBub3QuIFRoZSBxdWVzdGlvbiBzaG91bGQgYmUsIHdoYXQgaXMgdGhlIGp1c3RpZmlj YXRpb24gdG8gbWFrZSDigJxldmVudHPigJ0gc2luZ3VsYXI/DQpbcmljaGFubmFdVGhlIHNpbmd1 bGFyIOKAnGV2ZW504oCdIGNsYWltIGhhcyBjbGVhcmVyIHNlbWFudGljcyBhbmQgaXMgZWFzaWVy IHRvIHByb2Nlc3MuIFdlIHNob3VsZCBvcHQgZm9yIGVhc2llciBzb2x1dGlvbnMgdW5sZXNzIHRo ZXJlIGFyZSB1c2UgY2FzZXMgdGhhdCByZXF1aXJlIG1vcmUgY29tcGxleGl0eS5bL3JpY2hhbm5h XQ0KDQpUaGVyZSBhcmUgbWFueSByZWFzb25zIGZvciBtdWx0aXBsZSBldmVudHMgaW4gYSBTRVQu ICBTb21lIGFyZSBnb29kLCBzb21lIG5vdCBzbyBnb29kLiBTb21lIG9mIHRoZSByZWFzb25zLi4u DQoNCjEuICBNdWx0aXBsZSBldmVudCBwYXlsb2FkcyBleHByZXNzaW5nIHN0YXRlbWVudHMgYWJv dXQgbGFyZ2VseSB0aGUgKnNhbWUqdGhpbmcuIEZvciBleGFtcGxlLCBTQ0lNIHBhc3N3b3JkIHJl c2V0IEFORCBSSVNDIHBhc3N3b3JkIHJlc2V0LiAgQSBSSVNDIEV2ZW50IGFuZCBhbiBPcGVuQmFu a2luZyBFdmVudC4gSXMgb25lIGEgY29tcGxlbWVudCB0byB0aGUgb3RoZXI/ICBEbyB0aGV5IG92 ZXJsYXAgb3IgYXJlIHRoZXkgZGlzdGluY3Q/DQpbcmljaGFubmFdQ29weS9wYXN0ZWQgZnJvbSBt eSBlYXJsaWVyIGVtYWlsOg0KV2h5IGlzIGl0IG5lY2Vzc2FyeSBvciBhcHByb3ByaWF0ZSB0byBp bmNsdWRlIHRoZXNlIGV2ZW50cyBpbiB0aGUgc2FtZSBTRVQ/IFRoZXkgYXJlIGxpa2VseSBiZWlu ZyBnZW5lcmF0ZWQgYnkgZGlmZmVyZW50IHN5c3RlbXMgYXQgZGlmZmVyZW50IHRpbWVzIG9uIHRo ZSB0cmFuc21pdHRlcuKAmXMgc2lkZSwgY29uc3VtZWQgYnkgZGlmZmVyZW50IHN5c3RlbXMgb24g dGhlIHJlY2VpdmVy4oCZcyBzaWRlLCBhbmQgcG9zc2libHkgYmVpbmcgdHJhbnNtaXR0ZWQgb3Zl ciBkaWZmZXJlbnQgZXZlbnQgc3RyZWFtcy4gSSBrbm93IHRoZSBsYXR0ZXIgd291bGQgYmUgdGhl IGNhc2UgZm9yIHVzLCBhcyBhIHJlY2VpdmVyLiBFdmVuIGlmIGl04oCZcyBub3QsIGlzIGl0IGJ1 cmRlbnNvbWUgdG8gc2VuZCB0aGVzZSBldmVudHMgc2VwYXJhdGVseT8gV2hhdCB2YWx1ZSBpcyBn YWluZWQgaW4gY29tYmluaW5nIHRoZW0/DQoNCkFkZGl0aW9uYWxseSwgc2luY2UgdGhlIHNpZ25h dHVyZSBpcyBvdmVyIHRoZSBTRVQgYW5kIG5vdCB0aGUgZXZlbnQgb2JqZWN0cywgUmVjZWl2ZXJz IGluZGVwZW5kZW50bHkgcm91dGUgc2VwYXJhdGUgZXZlbnRzIGZyb20gYSBzaW5nbGUgdG9rZW4g d2l0aG91dCBlaXRoZXIgbG9zaW5nIHRoZSBhYmlsaXR5IHRvIHZlcmlmeSB0aGUgYXV0aGVudGlj aXR5IG9mIHRoZSBldmVudCBvciBzaGFyaW5nIGFsbCBpbmZvcm1hdGlvbiBpbiB0aGUgU0VUIHdp dGggZXZlcnkgc3lzdGVtIGhhbmRsaW5nIGFueSBldmVudCBpbiB0aGUgdG9rZW4uWy9yaWNoYW5u YV0NCg0KMi4gIE11bHRpcGxlIGV2ZW50cyBwYXlsb2FkcyBleHByZXNzaW5nIGRpZmZlcmVudCBz dGF0ZW1lbnRzIGFib3V0IHRoZSBzYW1lIHRyYW5zYWN0aW9uIC0gUklTQyBQYXNzd29yZCBSZXNl dCBhbmQgUklTQyBTZXNzaW9uIENhbmNlbA0KW3JpY2hhbm5hXVNhbWUgYXMgYWJvdmVbL3JpY2hh bm5hXQ0KMy4gIEEgbmV3IHByb2ZpbGUgZGVmaW5lcyBuZXcgZXZlbnQgYXR0cmlidXRlcyB0byBi ZSBhZGRlZCBvbiB0byBhbiBleGlzdGluZyBldmVudCB0eXBlIChhIHB1cmUgZXh0ZW5zaW9uKQ0K W3JpY2hhbm5hXUkgaGF2ZSBzdWdnZXN0ZWQgYSB3YXkgdG8gc3VwcG9ydCBleHRlbnNpb25zIHdp dGhpbiBhbiBldmVudCBib2R5LCBtdWx0aXBsZSB0aW1lcyBub3cuIElmIHlvdSBzZWUgcHJvYmxl bXMgd2l0aCBpdCwgcGxlYXNlIHBvaW50IHRoZW0gb3V0LlsvcmljaGFubmFdDQoNCkkgdGhpbmsg aXQgaXMgcXVpdGUgdmFsaWQgdG8gYWxsb3cgMSBhbmQgMy4gIDIgY291bGQgYmUgbGltaXRlZCBi eSBzcGVjaWZpYyBwcm9maWxlcyBsaWtlIFJJU0MgaWYgdGhleSB3YW50Lg0KDQpJIGFtIG5vdCBp biBhZ3JlZW1lbnQgdGhhdCBtYWtpbmcgZXZlbnQgc2luZ3VsYXIgc2ltcGxpZmllcyBhbnl0aGlu Zy4gRm9yIG9uZSBpcyBtYWtlcyBleHRlbnNpb25zIGNvbXBsZXggKGFub3RoZXIgbmVzdGVkIEpT T04gc3RydWN0dXJlKSBhbmQgcG90ZW50aWFsbHkgY29uZmxpY3RpbmcuDQpbcmljaGFubmFdDQpX YXlzIHRoYXQgbXVsdGlwbGUtZXZlbnQgU0VUcyBhcmUgbW9yZSBjb21wbGljYXRlZDoNCg0KICAx LiAgSXQgcmVzdWx0cyBpbiBhIG1vcmUgY29tcGxleCBzdHJ1Y3R1cmUgZm9yIHRoZSBzaW5nbGUg ZXZlbnQgdXNlIGNhc2UsIHdoaWNoIEkgdGhpbmsgd2UgYWxsIGFncmVlIGlzIHRoZSBtYWpvcml0 eSB1c2UgY2FzZS4NCiAgMi4gIE11bHRpcGxlLWV2ZW50IFNFVHMgaGF2ZSBhbWJpZ3VvdXMgc2Vt YW50aWNzLiBUaGUgcHJlc2VuY2Ugb2YgdHdvIGV2ZW50cyBBIGFuZCBCIGluIHRoZSBzYW1lIFNF VCBjb3VsZCBtZWFuIGFueSBvZjoNCg0KICAgICAqICAgVGhleSBhcmUgcmVsYXRlZCB0byB0aGUg c2FtZSBsb2dpY2FsIGV2ZW50IChpLmUuIHRoZSBzYW1lIHRoaW5nIGFzIGlmIHRoZXkgd2VyZSBm cm9tIGRpZmZlcmVudCBTRVRzIHRoYXQgaGF2ZSBhIGNvbW1vbiB0eG4pLg0KICAgICAqICAgQSBp cyBhbiBleHRlbnNpb24gb2YgQi4NCiAgICAgKiAgIEIgaXMgYW4gZXh0ZW5zaW9uIG9mIEEuDQog ICAgICogICBUaGV5IGFyZSBhbGlhc2VzIGZvciBvbmUgYW5vdGhlci4NCiAgICAgKiAgIFRoZXkg YXJlIG5vdCBhY3R1YWxseSByZWxhdGVkIHRvIG9uZSBhbm90aGVyIGluIGFueSB3YXkuDQoNCiAg MS4gIENsYWltIHNlbWFudGljcyBiZWNvbWUgaGFyZGVyIHRvIGRlZmluZSwgYXMgZGlmZmVyZW50 IHByb2ZpbGVzIG1heSB3YW50IHRvIHVzZSB0aGUgc2FtZSBjbGFpbXMgaW4gZGlmZmVyZW50IHdh eXMuDQoNCklmIHRoZSBXRyB3YW50cyB0byBibG9jayAxIGFuZCAyIGFib3ZlLCB0aGVuIEkgYmVs aWV2ZSB3ZSBoYXZlIHRvIGVzdGFibGlzaCBhbiBldmVudCByZWdpc3RyeSB0byBlbnN1cmUgbmV3 IEV2ZW50IHByb2ZpbGVzIGRvIG5vdCBvdmVybGFwIHRvIGVsaW1pbmF0ZSB0aGUgbmVlZCB0byBl eHByZXNzIG11bHRpcGxlIGV2ZW50cy4NCltyaWNoYW5uYV1J4oCZbSBub3Qgc3VyZSB3aGF0IHlv dSBtZWFuIGJ5IHRoaXMuIEFyZSB5b3UgcmVmZXJyaW5nIHRvIGV2ZW50IG5hbWVzPyBUaG9zZSBh cmUgYWxyZWFkeSBkZWZpbmVkIGJ5IHRoZSBzcGVjIHRvIGJlIFVSSXMuWy9yaWNoYW5uYV0NClBo aWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRl Y3QNCkBpbmRlcGVuZGVudGlkDQp3d3cuaW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNv bSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUm cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09VS1hNUhCTkQw SGFUWDRhbk5aZnpYN3BEc2ZLNWYwaDltWjlDWmtrR2llYyZzPUtCd0tQRm5xWV9ROTVDVEFfX1dH Q1lHVHhyRDdBR0N4dWVvUFhuS0VVVDAmZT0+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86 cGhpbC5odW50QG9yYWNsZS5jb20+DQoNCk9uIE9jdCAyOSwgMjAxNywgYXQgNDoxMiBQTSwgRGlj ayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29t Pj4gd3JvdGU6DQoNClBoaWw6DQoNCkluIHlvdXIgZXhhbXBsZXMgZm9yIGhhdmluZyBhIHBsdXJh bGl0eSBvZiBldmVudHMsIHlvdSB1c2UgdGhlIHdvcmQgIm1heSIsIHdoaWNoIGxlYWRzIG1lIHRv IHF1ZXN0aW9uIGlmIGEgcGx1cmFsaXR5IG9mIGV2ZW50cyBpcyByZWFsbHkgcmVxdWlyZWQgaW4g U0VULg0KDQpZb3UgcG9zaXQgdGhhdCBpdCB3aWxsIGJlIGRpZmZpY3VsdCBmb3IgYSBkaXN0cmli dXRlZCBzeXN0ZW0gdG8gY29ycmVsYXRlIG11bHRpcGxlIFNFVHMgd2l0aCB0aGUgc2FtZSAidHhu IiwgYnV0IHRoZSBkaXN0cmlidXRlZCBzeXN0ZW0gd2lsbCBjZXJ0YWlubHkgbmVlZCB0byBjb3Jy ZWxhdGUgZXZlbnRzIG9uIHRoZSBzYW1lIHN1YmplY3QgLS0gY29ycmVsYXRpbmcgZXZlbnRzIG9u IHRoZSBzYW1lICJ0eG4iIG9uIHRoZSBzYW1lIHN1YmplY3Qgc2VlbXMgZmFpcmx5IHNpbXBsZS4N Cg0KSSB0aGluayB0aGF0IGEgcmVjZWl2ZXIgd2lsbCBuZWVkIHRvIGNvcnJlbGF0ZSBtdWx0aXBs ZSBTRXRzIG9uIHRoZSBzYW1lIHN1YmplY3QsIHNvIGhhdmluZyBtdWx0aXBsZSBldmVudHMgaW4g YSBTRVQgaXMgcmVkdW5kYW50LCBhbmQgYWRkcyBjb21wbGV4aXR5IHdpdGggbm8gY2xlYXIgYmVu ZWZpdCB0aGF0IEkgY2FuIHNlZS4NCg0KQW4gaW1wbGVtZW50b3IgbWF5IGNob29zZSB0byBzZW5k IG11bHRpcGxlIFNFVHMsIG9yIHNlbmQgYSBzaW5nbGUgU0VUIHdpdGggbXVsdGlwbGUgZXZlbnRz LCBzbyBhIHJlY2VpdmVyIHdpbGwgbmVlZCB0byBzdXBwb3J0IGJvdGguIEkgcHJlZmVyIHdlIHBp Y2sgb25lIHdheSBhbmQgbWluaW1pemUgdGhlIGNvZGUgcGF0aHMsIGFuZCB3ZSB3aWxsIG5lZWQg dG8gc3VwcG9ydCBjb3JyZWxhdGluZyBhY3Jvc3MgbXVsdGlwbGUgU0VUcywgc28gdGhhdCBzZWVt cyB0aGUgYmVzdCBtZWNoYW5pc20uDQoNCkxldCBtZSBrbm93IGlmIHRoZXJlIGlzIHNvbWV0aGlu ZyBJIG1pc3NlZCBpbiBteSBsb2dpYy4NCg0KL0RpY2sNCg0KDQpPbiBTdW4sIE9jdCAyOSwgMjAx NyBhdCAxMToyOCBBTSwgWWFyb24gU2hlZmZlciA8eWFyb25mLmlldGZAZ21haWwuY29tPG1haWx0 bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20+PiB3cm90ZToNCkluIHRoYXQgY2FzZSwgbGV0J3MgYWRk IHRleHQgdG8gdGhhdCBlZmZlY3QsIGUuZy4gd2UgY291bGQgYWRkIHRvIHRoZSBkZWZpbml0aW9u IG9mIHRoZSAiZXZlbnRzIiBjbGFpbToNCg0KUHJvZmlsaW5nIHNwZWNpZmljYXRpb25zIFNIT1VM RCBkZWZpbmUgdGhlIGFsbG93ZWQgZXZlbnQgc3RhdGVtZW50cywgYW5kIE1BWSByZXN0cmljdCB0 aGVpciBudW1iZXIuIEZvciBleGFtcGxlLCBzb21lIHByb2ZpbGVzIG1heSByZXF1aXJlIHRoaXMg Y2xhaW0gdG8gY29udGFpbiBvbmx5IGEgc2luZ2xlIGV2ZW50IHN0YXRlbWVudC4NCg0KVGhhbmtz LA0KICAgICAgICBZYXJvbg0KDQpPbiAyNC8xMC8xNyAyMjoxMCwgTWlrZSBKb25lcyB3cm90ZToN CkkgYWdyZWUgd2l0aCBtdWNoIG9mIFBoaWzigJlzIHJhdGlvbmFsZSBoZXJlLg0KDQpJdOKAmXMg ZmluZSBmb3Igc29tZSBwcm9maWxlcyB0byBzYXkgdGhhdCB0aGUg4oCcZXZlbnRz4oCdIHNldCBt dXN0IGJlIGEgc2luZ2xldG9uLiAgVGhhdCBkb2VzbuKAmXQgaGF2ZSB0byBiZSB0cnVlIGZvciBh bGwgZXZlbnRzLiAgSSB0aGluayB0aGluZ3MgYXJlIGZpbmUgYXMtaXMuDQoNCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0g TWlrZQ0KDQoqRnJvbToqIElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9y ZzxtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZz5dICpPbiBCZWhhbGYgT2YgKlBoaWwg SHVudA0KKlNlbnQ6KiBNb25kYXksIE9jdG9iZXIgMjMsIDIwMTcgODo0NyBQTQ0KKlRvOiogUmlj aGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgPHJpY2hhbm5hQGFtYXpvbi5jb208bWFpbHRvOnJpY2hh bm5hQGFtYXpvbi5jb20+Pg0KKkNjOiogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRA aWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NCipTdWJqZWN0OiogUmU6IFtJZC1l dmVudF0gVXNlIGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD8NCg0KQW5uYWJlbGxl LA0KDQpJIGhhdmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHByb3Bvc2FsLg0KDQpQ cm9maWxpbmcgSW5kZXBlbmRlbmNlIC8gS2VlcGluZyBFdmVudCBQYXlsb2FkcyBJbmRlcGVuZGVu dA0KDQpJbmRpY2F0aW5nIHRoYXQgZXh0ZW5zaW9ucyBzaG91bGQgYmUgaGFuZGxlZCBieSBwcm9m aWxlcyBsZWFkcyB0byBtb3JlIGludGVyLW9wZXJhYmlsaXR5IGlzc3VlcyBhbmQgbW9yZSBpbXBv cnRhbnRseSBpbnRydWRlcyBvbiB0aGUgRXZlbnQgcGF5bG9hZCBzcGFjZSBieSBzdWdnZXN0aW5n IGEgc3ViLXNjaGVtYSBjcmVhdGVzIHBvdGVudGlhbCBsaW1pdGF0aW9ucyBhbmQgY29uZmxpY3Rz IHRoYXQgbWF5IGFkZCB0byBjb21wbGV4aXR5IGxhdGVyIG9uLiBUaGUgY3VycmVudCBmb3JtYXQg YWxsb3dzIGEgcGFyc2VyIHRvIGRpc2NvdmVyIGFuZCB1bmxvYWQgb25lIG9yIG1vcmUgSlNPTiBw YXlsb2FkcyB3aGljaCBjYW4gZWFjaCBoYXZlIGluZGVwZW5kZW50IHN0cnVjdHVyZS4NCg0KR2Vu ZXJhbCBleHRlbnNpb25zDQoNClRoZSBwcm9wb3NhbCBhbHNvIHJ1bGVzIG91dCBnZW5lcmFsIHB1 cnBvc2UgZXh0ZW5zaW9ucyBub3QgcmVsYXRlZCB0byBhbnkgc3BlY2lmaWMgZXZlbnQuIEdpdmVu IHRoZSBlbWVyZ2VuY2Ugb2YgaXRlbXMgbGlrZSBHUFJELCBJIHdvdWxkIG5vdCB3YW50IHRvIGJs b2NrIHRoZSBhYmlsaXR5IHRvIGFkZCBtZXRhLWRhdGEgb3Igb3RoZXIgZ2VuZXJhbCBwdXJwb3Nl IGl0ZW1zLiBXZSBjYW4gYWxzbyBhbnRpY2lwYXRlIHNvbWUgZGVsaXZlcnkgc2NlbmFyaW9zIHdo ZXJlIGFkZGl0aW9uYWwgZGF0YSBtaWdodCBiZSByZXF1aXJlZC4gRXZlbiB0aG91Z2ggdGhlcmUg aXMgbm8gY3VycmVudCBwbGFubmVkIHVzZSwgSSBzZWUgbm8gZ29vZCByZWFzb24gdG8gcnVsZSB0 aGlzIG91dC4NCg0KTXVsdGlwbGUgRXZlbnRzIEZyb20gRGlmZmVyZW50IEZhbWlsaWVzICh2cy4g TXVsdGlwbGUgRXZlbnRzIGZyb20gYSBzaW5nbGUgZmFtaWx5IGxpa2UgUklTQykNCg0KSW4gb3Vy IFJJU0Mgc2Vzc2lvbiB3ZSBkaXNjdXNzZWQgZXhwcmVzc2luZyBtdWx0aXBsZSBkaXN0aW5jdCBS SVNDIGV2ZW50cyBpbiBvbmUgU0VULiBUaGUgZGlzY3Vzc2lvbiB3YXMgdGhhdCBvbmx5IG9uZSBS SVNDIGV2ZW50IGF0IGEgdGltZS4gV2UgZGlkIG5vdCBkaXNjdXNzIG90aGVyIGV2ZW50IHByb2Zp bGVzLiBJIGRvbuKAmXQgc2VlIGEgcmVhc29uIHRvIHJ1bGUgb3V0IG11bHRpLWV2ZW50cyBmcm9t IGRpZmZlcmVudCBmYW1pbGllcyBhdCB0aGUgU0VUIGxldmVsLiBFYWNoIHByb2ZpbGUgaXMgZXhw cmVzc2luZyBzbGlnaHRseSBkaWZmZXJlbnQgdGhpbmdzIGFib3V0IHRoZSBzYW1lIGV2ZW50Lg0K DQpJIGNhbiBmb3JzZWUgc29tZSBjYXNlcyB3aGVyZSBpdCBpcyBub3QgY2xlYXIgd2hpY2ggaXMg dGhlIHByaW1hcnkgYW5kIHdoaWNoIGlzIHRoZSBleHRlbnNpb24uICBUaGVyZSBtYXkgbm90IGJl IGEgY2xlYXIgd2lubmVyLg0KDQpBIGNvdXBsZSBvZiBleGFtcGxlcyAodGhlc2UgYXJlIG5lY2Vz c2FyaWx5IHJlYWzigKZqdXN0IHBvc3NpYmlsaXRpZXMpOg0KDQoqIEl0IGlzIHByb2JhYmx5IHVz ZWZ1bCB0byBiZSBhYmxlIHRvIGV4cHJlc3Mgc2ltbGFyL292ZXJsYXBwaW5nIGV2ZW50cyBmcm9t IGRpZmZlcmVudCBTRVQgcHJvZmlsZXMgaW4gb25lIFNFVC4gIEZvciBleGFtcGxlIGEgQmFja2No YW5uZWwgTG9nb3V0ICYgYSBSSVNDIHNlc3Npb24gY2FuY2VsIGV2ZW50Lg0KDQoqIFNDSU0gbWF5 IHdhbnQgdG8gcmVwcmVzZW50IGEgc2luZ2xlIHRyYW5zYWN0aW9uIGFzIGNhdXNpbmcgbXVsdGlw bGUgc3RhdGUgY2hhbmdlcyBpbiBhbiBldmVudCAoZS5nLiBhIHBhc3N3b3JkIGNoYW5nZSBjYXVz ZXMgbXVsdGlwbGUgZWZmZWN0cykuIEhhdmluZyB0byBjaGFzZSBkb3duIG11bHRpcGxlIGV2ZW50 cyBhbmQgY29ycmVsYXRlIGJ5IOKAnHR4buKAnSB3b3VsZCBiZSBjaGFsbGVuZ2luZyBpbiBhIG11 bHRpLXRocmVhZGVkL211bHRpLW5vZGUgZGVsaXZlcnkgc3lzdGVtLiAgIFRoZSBTQ0lNIGxpc3Qg aGFzIG5vdCBkaXNjdXNzZWQgdGhpcywgYnV0IEkgd291bGQgbm90IHdhbnQgdG8gYmxvY2sgdGhp cyBjYXBhYmlsaXR5LiAgSU9XIC0gSnVzdCBiZWNhdXNlIFJJU0MgZG9lcyBub3Qgd2FudCB0byBl eHByZXNzIG11bHRpcGxlIGV2ZW50cyBkb2VzIG5vdCBtYWtlIHRoaXMgdHJ1ZSBmb3Igb3RoZXIg cHJvZmlsZXMuDQoNCiogV2UgbWF5IHdpc2ggdG8gaW5kaWNhdGUgYSBTQ0lNIFBhc3N3b3JkIFJl c2V0IHdhcyBwZXJmb3JtZWQgYW5kIGEgTG9nb3V0L3Nlc3Npb24gY2FuY2VsbGF0aW9uIGlzIGV4 cHJlc3NlZCBhdCB0aGUgc2FtZSB0aW1lLiAgVGhlIGV2ZW50cyBhcmUgcmVsYXRlZCBidXQgZXhw cmVzcyBkaWZmZXJlbnQgZGF0YS4NCg0KQXZvaWRpbmcgQ29uZnVzaW9uIEZyb20gU2ltaWxhciBF dmVudHMgT3JpZ2luYXRpbmcgZnJvbSB0aGUgU2FtZSBUcmFuc2FjdGlvbg0KDQpJZiBldmVudHMg YXJlIHNlbnQgc2VwYXJhdGVseSwgdGhlbiBtb3JlIHRyYWNraW5nIG9mIHN0YXRlIChlLmcuIGJ5 IHR4bikgd291bGQgYmUgcmVxdWlyZWQgdG8gZW5zdXJlIHNpbWlsYXIgZXZlbnRzIGFyZSBub3Qg bWlzdGFrZW4gb3IgaGFuZGxlZCBhcyByZXBlYXRzLiBXaGlsZSB0eG4gcHJvdmlkZXMgdXNlZnVs IGF1ZGl0IGFuYWx5c2lzIGNhcGFiaWxpdHksIEnigJltIG5vdCBzdXJlIGl0IGNhbiBiZSB1c2Vk IGluIGxpdmUgb3IgbmVhci1yZWFsIHRpbWUgc3lzdGVtcyBnaXZlbiBkaXN0cmlidXRlZCBtdWx0 aS1ub2RlLCBtdWx0aS10aHJlYWRpbmcgYXJjaGl0ZWN0dXJlcy4NCg0KUHJldmlvdXMgRGlzY3Vz c2lvbg0KDQpJIG5vdGUgdGhhdCBJIG9yaWdpbmFsbHkgcmFpc2VkIGhhdmluZyBhbiBhdHRyaWJ1 dGUgdG8gZGVzaWduYXRlIHByaW1hcnkgZXZlbnQgYXR0cmlidXRlIHRvIGFsbGV2aWF0ZSB5b3Vy IGNvbmNlcm4sIGJ1dCB0aGlzIHdhcyBub3QgYWNjZXB0ZWQuIFNlZToNCg0KKiBodHRwczovL3d3 dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYuaHRt bDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3 dy5pZXRmLm9yZ19tYWlsLTJEYXJjaGl2ZV93ZWJfaWQtMkRldmVudF9jdXJyZW50X21zZzAwNDA2 Lmh0bWwmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElf Sm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0ds SzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz1TM3NNVmlxTXZFZ253R2JK d09RTnljck95cjdTZWZwcV9Nb0ZPS2NFZUNFJmU9Pg0KDQoqIGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQvY3VycmVudC9tc2cwMDE0MC5odG1sPGh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2ZW50X2N1cnJlbnRfbXNnMDAxNDAuaHRtbCZkPUR3 TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVG VnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNq LTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPUd5OWd5Um9JSXRhLWNTaFY3Yk4xNjFheTR5 RTZyOUcxX0FhX05lQm55bGcmZT0+DQoNClRoZSBjb25zZW5zdXMsIGF0IGxlYXN0IGFzIEkgaW50 ZXJwcmV0ZWQgaXQgaXMgdXAgdG8gdGhlIHJlY2VpdmVyIHRvIGZpZ3VyZSB0aGlzIG91dCBiYXNl ZCBvbiB0aGUgZGVmaW5pdGlvbnMgaXQgaGFzIGZvciBlYWNoIGV2ZW50IFVSSSBhbmQgdGhlIHBy b2ZpbGVzIHRoZXkgcmVwcmVzZW50LiBJT1cgLSBSSVNDIGlzIGZyZWUgdG8gbGltaXQgdGhhdCBv bmx5IG9uZSBSSVNDIGV2ZW50IGJlIGV4cHJlc3NlZCBhdCBhIHRpbWUuDQoNClBoaWwNCg0KT3Jh Y2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QNCg0KQGlu ZGVwZW5kZW50aWQNCg0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20mZD1E d01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1 RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZtPVlCQ0dsSzltampoY0Zz ai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmcz05TlA1bmFtZzZySVZ6d3VuOWMtMXEwd2hz eVh3U3Z0SEIwZjJkS2tmQ1g4JmU9PiA8aHR0cDovL3d3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRw czovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVw ZW5kZW50aWQuY29tJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVC NjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEm bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JnM9OU5QNW5hbWc2 cklWend1bjljLTFxMHdoc3lYd1N2dEhCMGYyZEtrZkNYOCZlPT4+DQoNCnBoaWwuaHVudEBvcmFj bGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4gPG1haWx0bzpwaGlsLmh1bnRAb3Jh Y2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+Pg0KDQogICAgT24gT2N0IDIzLCAy MDE3LCBhdCA3OjAyIFBNLCBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZQ0KICAgIDxyaWNoYW5u YUBhbWF6b24uY29tPG1haWx0bzpyaWNoYW5uYUBhbWF6b24uY29tPiA8bWFpbHRvOnJpY2hhbm5h QGFtYXpvbi5jb208bWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20+Pj4gd3JvdGU6DQoNCiAgICBU aGUgY3VycmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMgYWxsb3dzIGZvciBleHByZXNzaW5nIG11 bHRpcGxlDQogICAgZXZlbnRzIHdpdGhpbiB0aGUgc2FtZSB0b2tlbiwgd2hpY2ggaW50cm9kdWNl cyBhZGRpdGlvbmFsIGNvbXBsZXhpdHkNCiAgICBhbmQgcm9vbSBmb3IgYW1iaWd1b3VzIHNlbWFu dGljcy4gV2XigJl2ZSBkaXNjdXNzZWQgdGhpcyBpbiB0aGUgT0lERg0KICAgIFJJU0Mgd29ya2lu ZyBncm91cCBhbmQgdGhlIGN1cnJlbnQgY29uc2Vuc3VzIHRoZXJlIGlzIHRoYXQgUklTQyB3aWxs DQogICAgcmVxdWlyZSB0aGF0IFJJU0MgZXZlbnRzIG11c3QgYmUgdGhlIG9ubHkgZXZlbnQgaW4g dGhlIFNFVCwgaGF2aW5nDQogICAgaWRlbnRpZmllZCB3YXlzIHRvIGNsZWFybHkgYW5kIGVhc2ls eSBzdXBwb3J0IHRoZSBoYW5kZnVsIG9mIHVzZQ0KICAgIGNhc2VzIGZvciBtdWx0aXBsZSBldmVu dHMgcGVyIHRva2VuIHRoYXQgcGVvcGxlIGhhdmUgcmFpc2VkLiBXaXRoDQogICAgdGhhdCBjb250 ZXh0IGluIG1pbmQsIEkgcHJvcG9zZSBzdHJpa2luZyB0aGUgZGVmaW5pdGlvbiBvZiB0aGUNCiAg ICDigJxldmVudHPigJ0gY2xhaW0gZnJvbSB0aGUgU2VjdXJpdHkgRXZlbnQgVG9rZW4gc3BlYywg YW5kIHJlcGxhY2luZyBpdA0KICAgIHdpdGggdGhlIGZvbGxvd2luZyBkZWZpbml0aW9uIGZvciBh biDigJxldmVudOKAnSBjbGFpbSAoc2luZ3VsYXIpOg0KDQogICAgZXZlbnQNCg0KICAgIEEgSlNP TiBvYmplY3QgY29udGFpbmluZyBhbiAiZXZlbnRfdHlwZSIgbWVtYmVyIHdob3NlIHZhbHVlIGlz IGEgVVJJDQogICAgcmVwcmVzZW50aW5nIGEgdHlwZSBvZiBldmVudCBkZWZpbmVkIGluIGEgUHJv ZmlsaW5nIFNwZWNpZmljYXRpb24uDQogICAgVGhlIG9iamVjdCBNQVkgb3RoZXJ3aXNlIGJlIGVt cHR5LCBvciBNQVkgY29udGFpbiBhZGRpdGlvbmFsIG1lbWJlcnMNCiAgICBhcyBkZXNjcmliZWQg YnkgdGhlIFByb2ZpbGluZyBTcGVjaWZpY2F0aW9uLg0KDQogICAgSGVyZSBpcyB0aGUgZXhhbXBs ZSBTRVQgZnJvbSBzZWN0aW9uIDIuMywgcmV3cml0dGVuIHdpdGggdGhpcyBjaGFuZ2UNCiAgICBt aW5kOg0KDQogICAgew0KDQogICAgICAgImp0aSI6ICI0ZDM1NTllYzY3NTA0YWFiYTY1ZDQwYjAz NjNmYWFkOCIsDQoNCiAgICAgICAiaWF0IjogMTQ1ODQ5NjQwNCwNCg0KICAgICAgImlzcyI6ICJo dHRwczovL3NjaW0uZXhhbXBsZS5jb208aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tLz4gPGh0dHBz Oi8vc2NpbS5leGFtcGxlLmNvbS8+IiwNCg0KICAgICAgICJhdWQiOiBbDQoNCiAgICAgICAgICJo dHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NCIs DQoNCiAgICAgICAgICJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFk MDg2NDFkNzY3NmVlNyINCg0KICAgICAgIF0sDQoNCiAgICAgICAiZXZlbnQiOiB7DQoNCiAgICAg ICAgICJldmVudF90eXBlIjogInVybjppZXRmOnBhcmFtczpzY2ltOmV2ZW50OmNyZWF0ZSIsDQoN CiAgICAgICAgICJyZWYiOiAiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL1VzZXJzLzQ0ZjYxNDJk Zjk2YmQ2YWI2MWU3NTIxZDkiLA0KDQogICAgICAgICAiYXR0cmlidXRlcyI6IFsiaWQiLCAibmFt ZSIsICJ1c2VyTmFtZSIsICJwYXNzd29yZCIsICJlbWFpbHMiXQ0KDQogICAgICAgfQ0KDQogICAg fQ0KDQogICAgRG9lcyBhbnlvbmUgaW4gdGhlIHdvcmtpbmcgZ3JvdXAgaGF2ZSB1c2UgY2FzZXMg Zm9yIFNFVHMgdGhhdCBjYW5ub3QNCiAgICBiZSBtZXQgYnkgdGhpcyBwcm9wb3NlZCB0ZXh0PyBX aXRoaW4gUklTQywgd2UgaWRlbnRpZmllZCB0aHJlZSB1c2UNCiAgICBjYXNlcywgd2l0aCBzb2x1 dGlvbnMgb3V0bGluZWQgYmVsb3c6DQoNCiAgICAqKg0KDQogICAgKkV4dGVuc2lvbnMqDQoNCiAg ICBFdmVudCBleHRlbnNpb24gbWVjaGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRlcm5hbCB0byB0 aGUgZXZlbnQNCiAgICBvYmplY3QuIEEgc2ltcGxlIGFwcHJvYWNoIHdvdWxkIGJlIHRvICBkZWZp bmUgYW4g4oCcZXh0ZW5zaW9uc+KAnSBtZW1iZXINCiAgICB0aGF0IGlzIGEgbGlzdCBvZiBldmVu dCBvYmplY3RzIChvciBzZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCdDQogICAgY2xhaW0g YXMgZGVmaW5lZCBpbiB0aGUgY3VycmVudCBzcGVjKS4gVGhpcyBoYXMgdGhlIGFkdmFudGFnZSBv Zg0KICAgIG1ha2luZyBpdCBjbGVhciBpbiB0aGUgZGF0YSBzdHJ1Y3R1cmUgdGhhdCB0aGVyZSBp cyBhIHNpbmdsZSBwcmltYXJ5DQogICAgZXZlbnQsIHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lv bnMuIFRoZXJlIGlzIG5vIHJvb20gZm9yIGNvbmZ1c2lvbg0KICAgIG92ZXIgd2hpY2ggZXZlbnQg aXMgcHJpbWFyeSwgb3IgaWYgdGhlcmUgaXMgYSBwcmltYXJ5IGV2ZW50IGF0IGFsbC4NCiAgICBJ IHdvdWxkIGJlIGZpbmUgd2l0aCBhZGRpbmcgc29tZXRoaW5nIGxpa2UgdGhpcyB0byBteSBwcm9w b3NlZCB0ZXh0LA0KICAgIGlmIHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0IGlzIGJyb2FkbHkg dXNlZnVsLg0KDQogICAgKkFsaWFzZXMqDQoNCiAgICBUaGlzIHVzZSBjYXNlIHdhcyBicm91Z2h0 IHVwIGluIHRoZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRzDQogICAgZnJvbSBkcmFmdCBl dmVudCBuYW1lcyB0byBzdGFuZGFyZGl6ZWQgZXZlbnQgbmFtZXMuIEluIHRoaXMgY2FzZSwNCiAg ICB0aGUgZXZlbnQgdHJhbnNtaXR0ZXIgY2FuIHRyYW5zbWl0IHR3byB0b2tlbnMgZm9yIHRoZSBs b2dpY2FsIGV2ZW50LA0KICAgIG9uZSB1c2luZyB0aGUgb2xkIG5hbWUgYW5kIGFub3RoZXIgdXNp bmcgdGhlIG5ldyBuYW1lLg0KDQogICAgKlJlbGF0ZWQgRXZlbnRzKg0KDQogICAgVGhlIFNFVCBz cGVjIGRlZmluZXMgdGhlIHR4biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJlbGF0aW5nDQogICAg aW5kZXBlbmRlbnQgdG9rZW5zIHRoYXQgcmVsYXRlIHRvIHRoZSBzYW1lIGxvZ2ljYWwgZXZlbnQu DQoNCiAgICAtLQ0KICAgIEFubmFiZWxsZSBSaWNoYXJkIEJhY2ttYW4NCg0KICAgIEFtYXpvbiDi gJMgSWRlbnRpdHkgU2VydmljZXMNCg0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQogICAgSWQtZXZlbnQgbWFpbGluZyBsaXN0DQogICAgSWQtZXZl bnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPiA8bWFpbHRvOklkLWV2ZW50QGll dGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4+DQogICAgaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9s aXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktD WDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENf bExJR2smbT1zNWJ5QmU1S0FObkdWdUFiMW1BdXBFR29KbjhYRzVKSVVVd1dHRlNpYkVjJnM9WDhv UlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZkNGVFWmZneW9JWSZlPQ0KDQoNCg0KX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxp bmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pZC1ldmVudDxodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWls bWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBa aDhCdjdxSXJNVUI2NWVhcElfSm5FJnI9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkx YUxjTE40S1pOQSZtPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcm cz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmU9Pg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFp bGluZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21h aWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4 UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtB STFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFp dyZzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZLMDJFWHMmZT0+DQoNCg0K DQotLQ0KU3Vic2NyaWJlIHRvIHRoZSBIQVJEVFdBUkU8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2hhcmR0d2FyZS5jb21fJmQ9RHdNRmFRJmM9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFX Tnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1 eHVydWliOUtBVGtSbFFHMWl3JnM9TFlONzJHZ0tWaEhzVDZ0QXFCZS1lTW9XTXZ5XzdkZkZuMXVa MEhLNll1USZlPT4gbWFpbCBsaXN0IHRvIGxlYXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2lu ZyBvbiENCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJ ZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBp ZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdt YW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJm09WUJDR2xLOW1qamhjRnNqLTJ0RGtu MzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6Ymhj VzAwMWZLMDJFWHMmZT0NCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRv OklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50 JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZy PW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmbT1VLWE1SEJORDBI YVRYNGFuTlpmelg3cERzZks1ZjBoOW1aOUNaa2tHaWVjJnM9cnZkcnRJN3JZTlJBbnFaRGx0Q3dC QVpWSEtwLU1KMjB1aTJubTQ2UVN6MCZlPQ0KDQoNCg0KDQotLQ0KU3Vic2NyaWJlIHRvIHRoZSBI QVJEVFdBUkU8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAt M0FfX2hhcmR0d2FyZS5jb21fJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3 cUlyTVVCNjVlYXBJX0puRSZyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xO NEtaTkEmbT1peVZuclptcjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JnM9d3Rn RDNOcDB2eWhMZHBFd1VpcXNmNEl0aXdBM09tN0dyb2I3MEx4MHIzayZlPT4gbWFpbCBsaXN0IHRv IGxlYXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiENCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklk LWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVm ZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxt YW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpo OEJ2N3FJck1VQjY1ZWFwSV9KbkUmcj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFh TGNMTjRLWk5BJm09aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZz PU9lMHFmTEVYODN2dFhNN1dsMmNZQmUtR2cxRFZQamhYalZKa2ZoVlJ6d2MmZT0NCg0KDQoNCi0t DQpTdWJzY3JpYmUgdG8gdGhlIEhBUkRUV0FSRTxodHRwOi8vaGFyZHR3YXJlLmNvbS8+IG1haWwg bGlzdCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hDQoNCg0KDQotLQ0K U3Vic2NyaWJlIHRvIHRoZSBIQVJEVFdBUkU8aHR0cDovL2hhcmR0d2FyZS5jb20vPiBtYWlsIGxp c3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBhbSB3b3JraW5nIG9uIQ0K --_000_CY4PR21MB0504B87D31F6EB68C0D223E0F55F0CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhU TUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAw MXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRN TCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4ubS01MDEzODU0 ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxl LWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTptXy01MDEzODU0ODYxNDEwMjY1MzAx bTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBs eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30N Ci5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5O30NCkBwYWdlIFdv cmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4w aW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBM aXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoyMjQ4NzMyNjU7DQoJ bXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xMzc5MDc1NjY2O30NCkBsaXN0IGwwOmxldmVsMQ0KCXtt c28tbGV2ZWwtc3RhcnQtYXQ6MzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGww OmxldmVsMg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7 bXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10 YWItc3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mi41 aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3Qg bDA6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOA0K CXttc28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVs LXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6NzY0MDMzNDQ1Ow0KCW1z by1saXN0LXRlbXBsYXRlLWlkczoxMTc0OTQxNjc4O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28t bGV2ZWwtc3RhcnQtYXQ6MjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxl dmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjEu NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC10YWItc3RvcDoyLjBpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0 IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDYN Cgl7bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZl bC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6 NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxp c3QgbDINCgl7bXNvLWxpc3QtaWQ6MTIxOTcwNzk0NzsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6 LTE4OTIwODE5Mjt9DQpAbGlzdCBsMjpsZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOi41aW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsMjpsZXZlbDINCgl7bXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6 bGV2ZWwzDQoJe21zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwyOmxldmVsNA0KCXtt c28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMjpsZXZlbDUNCgl7bXNvLWxldmVsLXRh Yi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6bGV2ZWw2DQoJe21zby1sZXZlbC10YWItc3RvcDozLjBp bjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBs MjpsZXZlbDgNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDI6bGV2ZWw5DQoJ e21zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVs DQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4 bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94 bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2 OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFw ZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBs aW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+TWFyaXVz4oCZ IHByb3Bvc2VkIHN5bnRheCwgcGFzdGVkIGluIGJlbG93LCBoYXMgZXhhY3RseSB0aGlzIGNoYXJh Y3RlcmlzdGljLiZuYnNwOyBUaGUgd2F5IEkgc2VlIGl0LCBoaXMgcHJvcG9zYWwgZXNzZW50aWFs bHkgaGFzIGEgcHJpbWFyeSBwYXNzd29yZFJlc2V0IGV2ZW50IGFuZCBhIHNlY29uZGFyeSBwYXNz d29yZFJlc2V0RXh0IGRhdGEgc3RydWN0dXJlLCB3aGljaA0KIGNvdWxkIGhhdmUgYmVlbiBzaW1w bHkgYW5vdGhlciBldmVudCB2YWx1ZSBpbiB0aGUgY3VycmVudCBkcmFmdC48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2 MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlRoaXMgYnJlYWtpbmcgY2hhbmdlIG1ha2VzIHRoZSBk YXRhIHN0cnVjdHVyZXMgbW9yZSBjb21wbGljYXRlZCAtIG5vdCBsZXNzLiZuYnNwOyBBbmQgaXQg bWFrZXMgdGhpbmdzIHRoYXQgdXNlZCB0byBiZSBwb3NzaWJsZSBpbXBvc3NpYmxlLCByZWR1Y2lu ZyBmbGV4aWJpbGl0eSB0byB0aG9zZSB3aG8gd291bGQgdXNlIHRoZSBzcGVjLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAy MDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+VGhlc2Ugc2VlbSBsaWtlIGJhZCB0cmFkZW9mZnMg dG8gbWUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPns8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjVwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjVwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7M2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIx YmQ0ZTdkMzAmcXVvdDssPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAm cXVvdDtpYXQmcXVvdDs6IDE0NTg0OTYwMjUsPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS41cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDsiPiZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vc2NpbS5l eGFtcGxlLmNvbS8iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb208L2E+ JnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuNXB0Ij48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku NXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7YXVk JnF1b3Q7OiBbPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsg JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1 YmJjODc5NTkzYjc3NTQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20v RmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvYT4mcXVvdDssPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS41cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9q aHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0i X2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFk NzY3NmVlNzwvYT4mcXVvdDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjVwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7 ICZuYnNwO10sPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsm cXVvdDtldmVudF90eXBlJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL2V4YW1wbGUuY29t L3NjaW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZXhh bXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0PC9hPiZxdW90Oyw8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyZxdW90O2V2ZW50JnF1b3Q7OiB7 Jm5ic3A7Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmcXVvdDtpZCZxdW90OzomcXVvdDs0NGY2MTQyZGY5NmJk NmFiNjFlNzUyMWQ5JnF1b3Q7LDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuNXB0Ij48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7ZXh0ZW5zaW9ucyZxdW90Ozogezwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuNXB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuNXB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9l dmVudC9wYXNzd29yZFJlc2V0RXh0Ij5odHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFz c3dvcmRSZXNldEV4dDwvYT7igJ06IHs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuNXB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsmcXVvdDtyZXNldEF0dGVtcHRzJnF1b3Q7OjUsPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS41cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZu YnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt9PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS41cHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO308L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjVwdCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuNXB0Ij48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkluIHBhcnRpY3VsYXIsIGl0IG1ha2Vz IGl0IGltcG9zc2libGUgdG8gc2lnbiBtdWx0aXBsZSByZWxhdGVkIGV2ZW50cyBzaGFyaW5nIGEg Y29tbW9uIGNsYWltcyBzY2hlbWEgd2l0aCBhIHNpbmdsZSBzaWduYXR1cmUgYnkgdGhlIGlzc3Vl ci4mbmJzcDsgSXQgZm9yY2VzIHRoZSBpc3N1ZXIgdG8gZG8gdGhlIGV4dHJhIHdvcmsgb2Ygc2ln bmluZyBlYWNoIG9mIHRoZSByZWxhdGVkDQogZXZlbnRzIChvciBmYWNldHMgb2YgdGhlIHNhbWUg bG9naWNhbCBldmVudCkgaW5kaXZpZHVhbGx5IGFuZCBmb3JjZXMgdGhlIHJlY2lwaWVudHMgdG8g ZG8gdGhlIGV4dHJhIHdvcmsgb2YgY2hlY2tpbmcgYWxsIHRob3NlIHVubmVjZXNzYXJ5IHNpZ25h dHVyZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5Ob3QgZXZlcnkgcHJv ZmlsZSB3aWxsIGV2ZXIgaGF2ZSBtdWx0aXBsZSBrZXlzIGluIHRoZSDigJxldmVudHPigJ0gc2V0 IGJ1dCB0aGVyZeKAmXMgYWJzb2x1dGVseSBubyByZWFzb24gdG8gcHJlY2x1ZGUgaXQuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8c3BhbiBzdHlsZT0ibXNv LWJvb2ttYXJrOl9NYWlsRW5kQ29tcG9zZSI+PC9zcGFuPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PGI+RnJvbTo8L2I+IElkLWV2ZW50IFttYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZ10g PGI+DQpPbiBCZWhhbGYgT2YgPC9iPkRpY2sgSGFyZHQ8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2Rh eSwgT2N0b2JlciAzMSwgMjAxNyA5OjUyIFBNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZs dDtNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBZYXJvbiBT aGVmZmVyICZsdDt5YXJvbmYuaWV0ZkBnbWFpbC5jb20mZ3Q7OyBSaWNoYXJkIEJhY2ttYW4sIEFu bmFiZWxsZSAmbHQ7cmljaGFubmFAYW1hem9uLmNvbSZndDs7IElEIEV2ZW50cyBNYWlsaW5nIExp c3QgJmx0O2lkLWV2ZW50QGlldGYub3JnJmd0OzsgUGhpbCBIdW50IChJRE0pICZsdDtwaGlsLmh1 bnRAb3JhY2xlLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVudF0gVXNl IGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIFNFVD88bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlBsZWFzZSBkaXJlY3QgbWUgdG8gYSBwcm9wb3NhbCB0aGF0IGhhcyBhICZxdW90 O3ByaW1hcnkmcXVvdDsgYW5kICZxdW90O3NlY29uZGFyeSZxdW90OyBldmVudHMuIEkgYWdyZWUg dGhhdCBpcyB1bmRlc2lyYWJsZS4gSSB3b3VsZCBhbHNvIGVuY291cmFnZSB0byBlbmdhZ2UgaW4g dGhlIGRpc2N1c3Npb25zIHNvIHRoYXQgd2UgY2FuIGRyaXZlIGNsYXJpdHkgYW5kIHNpbXBsaWNp dHkuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5r IHRoZSBwcm9wb3NhbCBpcyB0aGF0IHRoZXJlIGlzIG9uZSBldmVudCBwZXIgU0VULjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIGhh dmluZyBtb3JlIHRoYW4gb25lIGV2ZW50IHBlciBTRVQgYWRkcyBjb21wbGV4aXR5IGFzIGEgcmVj ZWl2ZXIgbXVzdCBkZWFsIHdpdGggcmVjZWl2aW5nIGNvcnJlbGF0ZWQgZXZlbnRzIGluIG9uZSBT RVQgYXMgd2VsbCBhcyBjb3JyZWxhdGVkIGV2ZW50cyBpbiB0aGUgc2FtZSBTRVQuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi9EaWNrPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIFR1ZSwg T2N0IDMxLCAyMDE3IGF0IDk6NDIgUE0sIE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpN aWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3Rl IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRp bmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9y OiMwMDIwNjAiPkkgaGVhciB5b3Ugb24gdGhlIGZhY3QgdGhhdCBkaWZmZXJlbnQgcGVvcGxlIGhh dmUgam9pbmVkIHRoZSBlZmZvcnQgYXQgZGlmZmVyZW50IHRpbWVzLiZuYnNwOyBUaGF04oCZcyBh IG5vcm1hbCBwcm9jZXNzIGFzIGFuIGVmZm9ydCBidWlsZHMgbW9tZW50dW0uJm5ic3A7IEkgZ2V0 DQogdGhhdCBub3QgZXZlcnlvbmUgd2FzIHRoZXJlIHdoZW4gcHJldmlvdXMgY29uc2Vuc3VzIGNh bGxzIHdlcmUgdGFrZW4uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ SSBzaG91bGQgbm90ZSB0aGF0IEkgaGF2ZSBzcGVjaWZpYyB0ZWNobmljYWwgb2JqZWN0aW9ucyB0 byB0aGUgc3BlY2lmaWMgcHJvcG9zZWQgY2hhbmdlcyBiZWluZyBkaXNjdXNzZWQgYXMgd2VsbC4m bmJzcDsgQ3VycmVudGx5IGFsbCBldmVudHMgaW4gdGhlIHNldCBoYXZlDQogdGhlIHNhbWUgc3lu dGF4LiZuYnNwOyBUaGUgcHJvcG9zYWxzLCBhcyBJIHVuZGVyc3RhbmQgdGhlbSwgcmV2ZXJ0IHVz IHRvIGEgc3RhdGUgd2hlcmUgdGhlcmXigJlzIGEg4oCccHJpbWFyeeKAnSBhbmQg4oCcc2Vjb25k YXJ54oCdIGV2ZW50cywgd2l0aCBkaWZmZXJlbnQgc3ludGF4IGZvciB0aGUgdHdvIGNsYXNzZXMu Jm5ic3A7IFRoYXTigJlzIG5lZWRsZXNzbHkgbW9yZSBjb21wbGljYXRlZCwgYWRkaW5nIG5vIGFj dHVhbCB2YWx1ZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGEgbmFtZT0ibV8tNTAxMzg1NDg2MTQxMDI2 NTMwMV9fTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8 L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj5Gcm9t OjwvYj4gRGljayBIYXJkdCBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWls LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPl0NCjxicj4NCjxi PlNlbnQ6PC9iPiBUdWVzZGF5LCBPY3RvYmVyIDMxLCAyMDE3IDk6MzcgUE08YnI+DQo8Yj5Ubzo8 L2I+IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0 Ozxicj4NCjxiPkNjOjwvYj4gUGhpbCBIdW50IChJRE0pICZsdDs8YSBocmVmPSJtYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwv YT4mZ3Q7OyBZYXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21h aWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+eWFyb25mLmlldGZAZ21haWwuY29tPC9hPiZndDs7IFJp Y2hhcmQgQmFja21hbiwgQW5uYWJlbGxlICZsdDs8YSBocmVmPSJtYWlsdG86cmljaGFubmFAYW1h em9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnJpY2hhbm5hQGFtYXpvbi5jb208L2E+Jmd0OzsNCiBJ RCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQtZXZlbnRAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4mZ3Q7PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxiPlN1YmplY3Q6 PC9iPiBSZTogW0lkLWV2ZW50XSBVc2UgY2FzZXMgZm9yIG11bHRpcGxlIGV2ZW50cyBwZXIgU0VU PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPk1pa2U8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj5BcyB5b3Ugd2VsbCBrbm93LCBtYW55IHBlb3BsZSBpbiBhIFdHIGRvbid0IGxvb2sg Y2xvc2VseSBhdCBhIHNwZWNpZmljYXRpb24gdW50aWwgbGFzdCBjYWxsIGlzIG1hZGUuIEFkZGl0 aW9uYWxseSwgd2UgYXJlIGNvbWluZyB1cCBvbiBvbmx5IHRoZSAzcmQgV0cgbWVldGluZy4gVGhl IFdHIGhhcyBub3QgZXhpc3RlZA0KIGZvciB2ZXJ5IGxvbmcuIFdoaWxlIHNvbWUgb2YgdGhlIHBh cnRpY2lwYW50cyBoYXZlIGJlZW4gd29ya2luZyBvbiB0aGlzIGZvciBhIHdoaWxlLCBtYW55IGhh dmUgbm90LCBhbmQgd2UgYXJlIGxvb2tpbmcgZm9yIGNvbnNlbnN1cyBhY3Jvc3MgdGhlIFdHLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ U2luY2UgU2VjRXZlbnQgaXMgYSBmcmFtZXdvcmsgdGhhdCB3ZSBleHBlY3QgdG8gYmUgcHJvZmls ZWQsIEkgZmVlbCBpdCBpcyBpbXBvcnRhbnQgdG8gZW5zdXJlIHRoYXQgU2VjRXZlbnQgc3BlY2lm aWNhdGlvbnMgYXJlIGVhc3kgZm9yIGEgdmFyaWV0eSBvZiBwcm9maWxlcyB0byBhZG9wdCwgYW5k IHRoYXQNCiB0aGUgc2VtYW50aWNzIG1ha2Ugc2Vuc2UuIEkgYWxzbyB0aGluayB0aGF0IHByb3Bl cnRpZXMgdGhhdCBhcmUgc3BlY2lmaWMgdG8gYSBwcm9maWxlIHNob3VsZCBiZSBsZWZ0IHRvIHRo YXQgcHJvZmlsZSBhbmQgbm90IGJlIGluY2x1ZGVkIGluIFNlY0V2ZW50LjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+U2luY2UgdGhpcyBp cyBhIGZyYW1ld29yaywgaXQgaXMgZXhwZWN0ZWQgdGhhdCBhcyBkaWZmZXJlbnQgZ3JvdXBzIHBy b2ZpbGUgaXQsIHRoZXJlIHdpbGwgYmUgYWRkaXRpb25hbCBmZWVkYmFjay48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlNwZWNpZmljYWxs eSwgYXMgYSBwYXJ0aWNpcGFudCBpbiB0aGUgUklTQyBwcm9maWxlIG9mIFNFVCwgYSBudW1iZXIg b2YgaXNzdWVzIGluIFNFVCBoYXZlIHN1cmZhY2VkIGFzIHRoZSBSSVNDIFdHIGhhcyBsb29rZWQg YXQgaG93IHRvIHVzZSB0aGUgU0VULjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QXMgZm9yIFNFVCBiZWluZyBzdGFibGUgZm9yIG92ZXIg YSB5ZWFyLCB0aGVyZSBoYXZlIGJlZW4gYSBudW1iZXIgb2YgY2hhbmdlcyB0byBTRVQgc2luY2Ug dGhlbi4gSSBhbHNvIGRvbid0IHRoaW5rIHRoZXJlIHdhcyBjb25zZW5zdXMuIEJlZm9yZSB0aGUg V0cgd2FzIGZvcm1lZCwgSSBhbmQgc2V2ZXJhbCBvdGhlcnMNCiBoYWQgZXhwcmVzc2VkIGNvbmNl cm4gb24gdGhlIGRlc2lnbiBvZiBTRVQgd2hlbiBQaGlsIHByZXNlbnRlZCBpdCBhdCBhbiBJSVcg c2Vzc2lvbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPkFzIHRvIHRha2luZyBhbm90aGVyIHllYXIsIEkgYW0gaG9wZWZ1bCB3ZSBjYW4g cmVzb2x2ZSB0aGUgcmVtYWluaW5nIGlzc3VlcyBpbiBTRVQgYW5kIHB1Ymxpc2ggYSBuZXcgZHJh ZnQgZm9yIGxhc3QgY2FsbC4gSSBkbyBub3QgdGhpbmsgd2Ugd2lsbCBuZWVkIHRvIHdhaXQgZm9y IGFub3RoZXIgV0cgbWVldGluZw0KIHRvIGFzayBmb3IgbGFzdCBjYWxsLiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+V2UgYWxz byBoYXZlIGEgbnVtYmVyIG9mIG90aGVyIGRvY3VtZW50cyB0aGF0IGFyZSBub3QgaW4gbGFzdCBj YWxsLCBhbmQgd2UgZG9uJ3QgaGF2ZSBhIFdHIGFkb3B0ZWQgZHJhZnQgeWV0IGZvciBtYW5hZ2Vt ZW50LiBTbyB0aGVyZSBhcmUgc3RpbGwgYSBudW1iZXIgb2YgZG9jdW1lbnRzIHRvIHdvcmsgdGhy b3VnaA0KIGJlZm9yZSB3ZSBoYXZlIGFsbCB0aGUgYml0cyBmb3Igc29tZW9uZSB0byB3b3JrIHdp dGguPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5JIGRvIHRoaW5rIHdlIGhhdmUgYmVlbiBtYWtpbmcgZ29vZCBwcm9ncmVzcyBzaW5jZSB0 aGUgbGFzdCBJRVRGIG1lZXRpbmcsIGFuZCBJIGFtIGhvcGVmdWwgd2UgY2FuIGtlZXAgdXAgdGhp cyBtb21lbnR1bSBhbmQgZmluYWxpemUgYWxsIHRoZSBkb2N1bWVudHMgaW4gYSB0aW1lbHkgbWFu bmVyLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+L0RpY2s8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5PbiBUdWUsIE9jdCAzMSwgMjAxNyBhdCAxMjo0OCBQTSwgTWlrZSBK b25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSIgdGFy Z2V0PSJfYmxhbmsiPk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVm dDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImNvbG9yOiMwMDIwNjAiPkl04oCZcyBoYXJkIGZvciBtZSB0byBldmVuIGV4cHJlc3MgbXkgbGV2 ZWwgb2YgZnJ1c3RyYXRpb24gd2l0aCB0aGUgcmVjZW50IGF0dGVtcHRzIHRvIG9uY2UgYWdhaW4g cmVkZXNpZ24gdGhlIFNlY0V2ZW50IFRva2VuIHNwZWMuJm5ic3A7IFdl4oCZdmUgYmVlbiBhdCB0 aGlzDQogZm9yIG11bHRpcGxlIHllYXJzIGJlY2F1c2UgcGVvcGxlIGtlZXAgdHJ5aW5nIHRvIHJl dmlzaXQgZGVjaXNpb25zIHRoYXQgd2VyZSBsb25nIGFnbyBtYWRlIGJ5IGNvbnNlbnN1cy4mbmJz cDsgSXTigJlzIGJlZW4gc3RhYmxlIGZvciBvdmVyIGEgeWVhciBhbmQgdGhlIG1ham9yaXR5IG9m IFdHTEMgcmVzcG9uZGVudHMgc2FpZCBzb21lIHZhcmlhbnQgb2Yg4oCcV29ya3MgZm9yIG1lIOKA kyBzaGlwIGl0IeKAnTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlRo ZXJl4oCZcyBub3Qgc3VmZmljaWVudCBqdXN0aWZpY2F0aW9uIHRvIHRyeSB0byB1bmRvIGNvbnNl bnN1cyBwb3NpdGlvbnMgdGhhdCBoYXZlIGJlZW4gZGViYXRlZCBhbmQgYWZmaXJtZWQgb3ZlciBh bmQgb3Zlci4mbmJzcDsgQ291bnRlbmFuY2luZyB3aG9sZXNhbGUgY2hhbmdlcw0KIGF0IHRoaXMg bGF0ZSBkYXRlIGlzIGNvdW50ZXJwcm9kdWN0aXZlIGluIHRoZSBleHRyZW1lITwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMw MDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkl04oCZcyBmYXIgYmV0dGVyIHRoYW4gZ29v ZCBlbm91Z2ggYXMtaXMuJm5ic3A7IEluIG15IGV4cGVyaWVuY2UsIGlmIHdlIHN0YXJ0IHJlZGVz aWduaW5nIGl0LCBpdCB3aWxsIHJlc3VsdCBpbiBhbm90aGVyIHllYXLigJlzIGRlbGF5LiZuYnNw OyBJdCBkb2VzIHNvbWV0aGluZyBzaW1wbGUNCiBhbmQgdXNlZnVsLiZuYnNwOyBQbGVhc2UsIGxl dOKAmXMganVzdCBzaGlwIGl0LCBzbyBwZW9wbGUgY2FuIHJlbHkgb24gaXQuPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxhIG5hbWU9Im1fLTUwMTM4NTQ4NjE0MTAyNjUzMDFfbV82OTU4Nzc2OTgwMjQ2 NjYiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PC9hPjxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PGI+RnJvbTo8L2I+IFBoaWwgSHVudCAoSURNKSBbbWFpbHRvOjxhIGhyZWY9Im1h aWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnBoaWwuaHVudEBvcmFj bGUuY29tPC9hPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIE9jdG9iZXIgMzAsIDIwMTcg Mjo0MiBQTTxicj4NCjxiPlRvOjwvYj4gRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRp Y2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+ZGljay5oYXJkdEBnbWFpbC5jb208 L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gWWFyb24gU2hlZmZlciAmbHQ7PGEgaHJlZj0ibWFpbHRv Onlhcm9uZi5pZXRmQGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnlhcm9uZi5pZXRmQGdtYWls LmNvbTwvYT4mZ3Q7OyBSaWNoYXJkIEJhY2ttYW4sIEFubmFiZWxsZSAmbHQ7PGEgaHJlZj0ibWFp bHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0iX2JsYW5rIj5yaWNoYW5uYUBhbWF6b24u Y29tPC9hPiZndDs7IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVz QG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b208L2E+Jmd0OzsNCiBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86 aWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5pZC1ldmVudEBpZXRmLm9yZzwvYT4m Z3Q7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRdIFVzZSBjYXNlcyBmb3IgbXVsdGlw bGUgZXZlbnRzIHBlciBTRVQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPklubGluZS4uLjxicj4N Cjxicj4NClBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBw dCI+PGJyPg0KT24gT2N0IDMwLCAyMDE3LCBhdCAyOjIyIFBNLCBEaWNrIEhhcmR0ICZsdDs8YSBo cmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5kaWNrLmhh cmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5IaSBQaGlsPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Q29ycmVjdCBtZSBpZiBJIGFtIG1p c3VuZGVyc3RhbmRpbmcsIGJ1dCB0aGVyZSBpcyBhIFJJU0MgcHJvZmlsZSBldmVudCZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZSBzdHlsZT0id2hpdGUtc3BhY2U6cHJl LXdyYXAiPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJ3aGl0ZS1zcGFjZTpw cmUtd3JhcCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPiZxdW90OzxhIGhyZWY9Imh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFz Lm9wZW5pZC5uZXRfc2VjZXZlbnRfcmlzY19ldmVudC0yRHR5cGVfLTI1NUMmYW1wO2Q9RHdNRmFR JmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9 bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1peVZuclpt cjlfdUdDUTZNRDB6RjJ5bVJRUzZsSzY3eUZfOHU4X3FTQ193JmFtcDtzPTI1bDA5c0g4WVY0Mnh6 Z1UtQ1hTZzh4SDl0dnlESno0MHRDUmpGYWxoa3cmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0 cDovL3NjaGVtYXMub3BlbmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvPC9hPjwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1 b3Q7LHNhbnMtc2VyaWYiPmFjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQ8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZiI+4oCdPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJ3 aGl0ZS1zcGFjZTpwcmUtd3JhcCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+YW5kIGFuIFNDSU0gcHJvZmlsZSBldmVudDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9IndoaXRlLXNwYWNlOnBy ZS13cmFwIj4mcXVvdDs8YSBocmVmPSJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFz c3dvcmRSZXNldEV4dCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9l dmVudC9wYXNzd29yZFJlc2V0RXh0PC9hPuKAnTxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxl PSJ3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SSdtIHN1Z2dlc3RpbmcgdGhhdCB0d28gZGlm ZmVyZW50IGV2ZW50cyB3b3VsZCBiZSBzZW50LiBFbWJlZGRpbmcgb25lIGluIHRoZSBvdGhlciBk b2VzIG5vdCBtYWtlIHNlbnNlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbHQ7cGgmZ3Q7SXQgaXMg YSBoeXBvdGhldGljYWwgZXhhbXBsZS4gSnVzdCBiZWNhdXNlIHlvdSBkaXNhZ3JlZSBvbiB0aGlz IGRvZXMgbm90IG1lYW4gb3RoZXJzIGFyZSBub3QgdmFsaWQuJm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SSBqdXN0IHBpY2tlZCBvdmVybGFw cGluZyBwcm9wb3NhbHMgdGhhdCBoYXZlIGRpZmZlcmVudCBtZWFuaW5nIChidXQgbm90IHRoZSBz YW1lKSB0byBpbGx1c3RyYXRlIHRoZSBkaWZmZXJlbmNlIGZyb20gaXNzdWluZyBhIHNpbmdsZSBz ZXQgd2l0aCBkaWZmZXJlbnQgZXZlbnRzLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+QXMgSSBoYXZlIHN0YXRlZCB0aGlzIGlzIHZlcnkg ZGlmZmVyZW50IGZyb20gYXNzZXJ0aW5nIG11bHRpcGxlIGRpc3RpbmN0IGV2ZW50cyBpbiBvbmUg U0VULiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj5BbHNvLCBJIHRoaW5rIGl0IGlzIHNpbXBsZXIgdG8gaGF2ZSBl dmVudF90eXBlIGJlIGF0IHRoZSBzYW1lIGxldmVsIGFzIGV2ZW50PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0 Ij4mbHQ7cGgmZ3Q7bWF5IGJlLiBJIHdhcyB3b3JraW5nIGZyb20gQW5uYWJlbGxlJ3MgcHJvcG9z ZWQgZm9ybWF0LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6ICZxdW90OzNk MGMzY2Y3OTc1ODRiZDE5M2JkMGZiMWJkNGU3ZDMwJnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7 OiAxNDU4NDk2MDI1LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczov L3NjaW0uZXhhbXBsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5j b208L2E+JnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIg TmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJnF1b3Q7PGEg aHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkz Yjc3NTQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThk NTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJnF1b3Q7PGEgaHJl Zj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZl ZTciIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0 NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4mcXVvdDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwO10sPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsmcXVv dDtldmVudF90eXBlJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL2V4YW1wbGUuY29tL3Nj aW0vZXZlbnQvcGFzc3dvcmRSZXNldEV4dCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZXhhbXBs ZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0PC9hPiZxdW90Oyw8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyZx dW90O2V2ZW50JnF1b3Q7OiB7Jm5ic3A7Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsmcXVvdDtpZCZxdW90OzomcXVvdDs0NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5JnF1b3Q7 LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4m bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7JnF1b3Q7cmVzZXRBdHRlbXB0cyZxdW90 Ozo1PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO308L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ezwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVv dDszZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCZxdW90Oyw8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZxdW90O2lhdCZx dW90OzogMTQ1ODQ5NjAyNSw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0 cHM6Ly9zY2ltLmV4YW1wbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9zY2ltLmV4YW1w bGUuY29tPC9hPiZxdW90Oyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZxdW90 OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg3 OTU5M2I3NzU0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRz Lzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQ8L2E+JnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3 Njc2ZWU3IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVk NzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L2E+JnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiZuYnNwOyAmbmJzcDtdLDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7 JnF1b3Q7ZXZlbnRfdHlwZSZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNl dmVudF9yaXNjX2V2ZW50LTJEdHlwZV9hY2NvdW50LTJEY3JlZGVudGlhbC0yRGNoYW5nZS0yRHJl cXVpcmVkJmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJN VUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xO NEtaTkEmYW1wO209aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZh bXA7cz1uUXk5ZXpQUmpER2R2UlRDYWlEdGk0T0hlbEgzREtnVUNUS2pGMkdRLXNvJmFtcDtlPSIg dGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9l dmVudC10eXBlL2FjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQ8L2E+JnF1b3Q7LDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJz cDsgJm5ic3A7JnF1b3Q7ZXZlbnQmcXVvdDs6IHs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A74oCc c3Vi4oCdOuKAnTczNzU2MjZBNjU2Mzc04oCdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDvigJxp c3PigJ06JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vPC9hPiZxdW90OyZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDt9PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPn08L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj5PbiBNb24sIE9jdCAzMCwgMjAxNyBhdCAxMjowOSBQTSwgUGhpbCBIdW50ICZs dDs8YSBocmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5w aGlsLmh1bnRAb3JhY2xlLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QW5uYWJlbGxlL0RpY2ssPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5UaGFua3MgZm9yIHRoZSBj b21tZW50cy4gSSB0aGluayB3ZSBuZWVkIHRvIGV4YW1pbmUgdGhlIGNvbnNlcXVlbmNlcyBvZiB0 aGUgcHJvcG9zYWwgaW4gSlNPTi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+QXMgSSBzdGF0ZWQsIHdoYXQgY2F1c2VzIG1vc3Qgb2YgdGhlIGlzc3Vl IGlzIHRoZSBwcm9wb3NlZCBleHRlbnNpb24gbWVjaGFuaXNtIGluIHRoZSBwYXlsb2FkIChwb3Nz aWJseSB1c2luZyBldmVudHMgaW4gYSByZWN1cnNpdmUgd2F5KS4gRG9lcyBpdCBmb2xsb3cgdGhl IG9sZCBmb3JtYXQgb3IgdGhlIG5ldz88bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj5MZXTigJlzICZuYnNwO2NvbnNpZGVyIGEgdXNlIGNhc2Ugd2hlcmUg d2UgaGF2ZSBhbiBpZGVudGl0eSBtYW5hZ2VtZW50IHN5c3RlbSB0aGF0IHVzZXMgU0NJTSwgYnV0 IHRoZSBTQ0lNIHN5c3RlbSBpcyBhbHNvIHRoZSB1bmRlcmx5aW5nIGRhdGEgc3RvcmUgZm9yIENv bm5lY3QuJm5ic3A7IEEgUGFzc3dvcmQgcmVzZXQgbWlnaHQNCiBnZW5lcmF0ZSB0aGUgZm9sbG93 aW5nIGV2ZW50IHdoaWNoIGhhcyBhbiBleHRlbnNpb24gKGNvbnZleWluZyByZXNldCBjb3VudCkg QU5EIG92ZXJsYXBwaW5nIHN0YXRlbWVudCBmcm9tIFJJU0MuJm5ic3A7IEJPVEggb2Ygd2hpY2gg bWlnaHQgYmUgaW1wb3J0YW50IHRvIGEgc2ltaWxhciByZWNlaXZlciB1c2luZyBTQ0lNIGFuZCBP SURDLiAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxiPlRoZSAwMyBzcGVjIGN1cnJlbnRseSB3b3VsZCBhbGxvdzo8L2I+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZT57PG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7M2QwYzNjZjc5NzU4NGJkMTkzYmQw ZmIxYmQ0ZTdkMzAmcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lh dCZxdW90OzogMTQ1ODQ5NjAyNSw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7 aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iIHRhcmdl dD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb208L2E+JnF1b3Q7LDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDthdWQmcXVvdDs6IFs8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1w bGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwv YT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90 OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0 MWQ3Njc2ZWU3IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRz LzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L2E+JnF1b3Q7PG86cD48L286cD48L3ByZT4NCjxw cmU+Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7ICZx dW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAmcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJlc2V0 JnF1b3Q7OjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB7ICZxdW90O2lkJnF1b3Q7OiZxdW90OzQ0ZjYxNDJkZjk2YmQ2YWI2MWU3NTIx ZDkmcXVvdDt9LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyAmcXVvdDs8YSBocmVmPSJodHRwczovL2V4YW1wbGUuY29tL3NjaW0vZXZlbnQvcGFzc3dvcmRS ZXNldEV4dCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9w YXNzd29yZFJlc2V0RXh0PC9hPiZxdW90Ozo8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgeyAmcXVvdDtyZXNldEF0dGVtcHRzJnF1b3Q7 OjV9LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9z ZWNldmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1QyZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5x V055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpG MnltUlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9MjVsMDlzSDhZVjQyeHpnVS1DWFNnOHhIOXR2 eURKejQwdENSakZhbGhrdyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vc2NoZW1hcy5v cGVuaWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPC9hPjxicj4mbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDthY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdlLXJlcXVpcmVkJnF1b3Q7OiB7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCc c3Vi4oCdOuKAnTczNzU2MjZBNjU2Mzc04oCdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGlzc+KAnTomcXVvdDs8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMy41cHQiPjxhIGhyZWY9Imh0dHBzOi8vaWRwLmV4YW1wbGUuY29tLyIg dGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vaWRwLmV4YW1wbGUuY29tLzwvYT4mcXVvdDs8L3NwYW4+ PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB9PC9zcGFuPjxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgfTwvc3Bhbj48 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+fTwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2Vy aWYiPkluIHRoZSBhYm92ZSAtIGVhY2ggcGF5bG9hZCBpcyBhIOKAmHBlZXInIGFuZCBpc3N1ZWQg d2l0aG91dCBwcmVmZXJlbmNlIGJ5IHRoZSB0cmFuc21pdHRlci4gVGhlIHJlY2VpdmVyIGNhbiBh c3NpZ24gcHJpb3JpdHkgaW4gaXRzIG93biBjb250ZXh0IGlmIHRoYXQgbWF0dGVycy48L3NwYW4+ PG86cD48L286cD48L3ByZT4NCjxkaXY+DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8 L2Rpdj4NCjxkaXY+DQo8cHJlPjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+VGhlIG5ldyBwcm9wb3NhbDo8L3NwYW4+PC9iPjxvOnA+ PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+ DQo8cHJlPns8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAm cXVvdDszZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCZxdW90Oyw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBz Oi8vc2NpbS5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vc2NpbS5leGFtcGxl LmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2F1ZCZx dW90OzogWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8 YSBocmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1 OTNiNzc1NCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85 OGQ1MjQ2MWZhNWJiYzg3OTU5M2I3NzU0PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUu Y29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0iX2JsYW5rIj5odHRw czovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4m cXVvdDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgXSw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6IHs8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZlbnRfdHlwZeKAnTomcXVv dDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJlc2V04oCdLDxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpZCZxdW90OzrigJ00 NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ54oCdLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyDigJxldmVudHPigJ06ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtJmd0O25vdGUg4oCmaXMgdGhpcyB0aGUgb2xkIG9y IG5ldyBzdHJ1Y3R1cmU/ICZsdDstPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5j b20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9l eGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQ8L2E+JnF1b3Q7OjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyB7ICZxdW90O3Jlc2V0QXR0ZW1wdHMmcXVvdDs6NX0sPG86cD48L286cD48L3ByZT4N CjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3NlY2V2ZW50X3Jp c2NfZXZlbnQtMkR0eXBlXy0yNTVDJmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZs WllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlY UHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2 N3lGXzh1OF9xU0NfdyZhbXA7cz0yNWwwOXNIOFlWNDJ4emdVLUNYU2c4eEg5dHZ5REp6NDB0Q1Jq RmFsaGt3JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQv c2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL1w8L2E+PGJyPiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5i c3A7Jm5ic3A7ICZuYnNwO2FjY291bnQtY3JlZGVudGlhbC1jaGFuZ2UtcmVxdWlyZWQmcXVvdDs6 IHs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDi gJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcaXNz4oCdOiZxdW90Ozwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEzLjVwdCI+PGEgaHJlZj0iaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20v IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vPC9hPiZxdW90Ozwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyB9PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsgfTwvc3Bhbj4mbmJzcDsmbmJzcDsmbmJzcDsg PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08 L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNl cmlmIj5JbiB0aGUgYWJvdmUsIHN1Yi1ldmVudHMgb3IgZXh0ZW5zaW9ucyBoYXZlIGEgZGlmZmVy ZW50IGZvcm1hdC4gVGhlIHNhbWUgY29tcGxhaW50IGFib3V0IHRoZSBvcmlnaW5hbCBzdGFuZHMu PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Kk9SKiAoaWYgdGhlIHJlY2VpdmVyIGNhcmVzIGFib3V0IFJJU0MgbW9yZSkuJm5i c3A7IE5vdGUgdGhhdCB0aGlzIGxlYWRzIHRvIGEgdHJpcGxlIG5lc3RlZCBzdHJ1Y3R1cmUuPC9z cGFuPjwvYj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDs8bzpwPjwvbzpwPjwvcHJlPg0K PHByZT57PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1 b3Q7M2QwYzNjZjc5NzU4NGJkMTkzYmQwZmIxYmQ0ZTdkMzAmcXVvdDssPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ1ODQ5NjAyNSw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczov L3NjaW0uZXhhbXBsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3NjaW0uZXhhbXBsZS5j b208L2E+JnF1b3Q7LDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyAmcXVvdDthdWQmcXVv dDs6IFs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEg aHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkz Yjc3NTQiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThk NTI0NjFmYTViYmM4Nzk1OTNiNzc1NDwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+ Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vamh1Yi5leGFtcGxlLmNv bS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly9qaHViLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L2E+JnF1 b3Q7PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IF0sPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7ICZxdW90O2V2ZW50JnF1b3Q7OiB7PG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW50X3R5cGXigJ06PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPiZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfc2Vj ZXZlbnRfcmlzY19ldmVudC0yRHR5cGVfLTI1NUMmYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1D WENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdO eTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1peVZuclptcjlfdUdDUTZNRDB6RjJ5 bVJRUzZsSzY3eUZfOHU4X3FTQ193JmFtcDtzPTI1bDA5c0g4WVY0Mnh6Z1UtQ1hTZzh4SDl0dnlE Sno0MHRDUmpGYWxoa3cmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3NjaGVtYXMub3Bl bmlkLm5ldC9zZWNldmVudC9yaXNjL2V2ZW50LXR5cGUvXDwvYT48L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdCI+Jm5ic3A7ICZuYnNwOyAm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7YWNjb3VudC1j cmVkZW50aWFsLWNoYW5nZS1yZXF1aXJlZDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+4oCdLDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEzLjVwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnHN1YuKAnTri gJ03Mzc1NjI2QTY1NjM3NOKAnSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwO+KA nGlzc+KAnTomcXVvdDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxhIGhy ZWY9Imh0dHBzOi8vaWRwLmV4YW1wbGUuY29tL+KAnCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8v aWRwLmV4YW1wbGUuY29tL+KAnDwvYT4sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsg4oCcZXZlbnRz4oCdOns8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyAmcXVvdDt1cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpwYXNzd29yZFJlc2V0JnF1 b3Q7Ojwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHsmbmJz cDs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lkJnF1b3Q7OuKAnTQ0ZjYxNDJk Zjk2YmQ2YWI2MWU3NTIxZDnigJ0sPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW50c+KAnTp7 PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90OzxhIGhyZWY9Imh0 dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVzZXRFeHQ8L2E+ JnF1b3Q7OjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyB7ICZxdW90O3Jlc2V0QXR0ZW1wdHMmcXVvdDs6NX0sPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox My41cHQiPiZuYnNwOyA8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwO308L3NwYW4+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IDxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDt9PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPHBy ZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgfSZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyA8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4N CjxwcmU+Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5JbiB0 aGUgYWJvdmUsIHRoZSBleHRlbnNpb24gaXMgcGxhY2VkIGluc2lkZSB0aGUgZXZlbnQgaXQgZXh0 ZW5kcy4gSXQgZm9sbG93cyB0aGUgb2xkIGZvcm1hdCAob3Igc2hvdWxkIGl0IGZvbGxvdyB0aGUg bmV3Pyk8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwcmU+PGI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj4q T1IqIEZvbGxvd2luZyB0aGUgdG9wIGxheWVyIHBhdHRlcm4gb2Ygc2luZ3VsYXIgZXZlbnQmbmJz cDsgTm90ZSB0aGF0IHRoaXMgbGVhZHMgdG8gYSB0cmlwbGUgbmVzdGVkIHN0cnVjdHVyZS48L3Nw YW4+PC9iPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOzxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlPns8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVv dDszZDBjM2NmNzk3NTg0YmQxOTNiZDBmYjFiZDRlN2QzMCZxdW90Oyw8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDU4NDk2MDI1LDxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlPiZuYnNwOyAmcXVvdDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8v c2NpbS5leGFtcGxlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNv bTwvYT4mcXVvdDssPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7ICZxdW90O2F1ZCZxdW90 OzogWzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8YSBo cmVmPSJodHRwczovL2podWIuZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFmYTViYmM4Nzk1OTNi Nzc1NCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vamh1Yi5leGFtcGxlLmNvbS9GZWVkcy85OGQ1 MjQ2MWZhNWJiYzg3OTU5M2I3NzU0PC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4m bmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9qaHViLmV4YW1wbGUuY29t L0ZlZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTciIHRhcmdldD0iX2JsYW5rIj5odHRwczov L2podWIuZXhhbXBsZS5jb20vRmVlZHMvNWQ3NjA0NTE2YjFkMDg2NDFkNzY3NmVlNzwvYT4mcXVv dDs8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgXSw8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6IHs8bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZlbnRfdHlwZeKAnTo8c3BhbiBz dHlsZT0iZm9udC1zaXplOjEzLjVwdCI+JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9zZWNl dmVudF9yaXNjX2V2ZW50LTJEdHlwZV8tMjU1QyZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055 NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnlt UlFTNmxLNjd5Rl84dThfcVNDX3cmYW1wO3M9MjVsMDlzSDhZVjQyeHpnVS1DWFNnOHhIOXR2eURK ejQwdENSakZhbGhrdyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vc2NoZW1hcy5vcGVu aWQubmV0L3NlY2V2ZW50L3Jpc2MvZXZlbnQtdHlwZS9cPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAmbmJzcDthY2NvdW50LWNyZWRlbnRpYWwtY2hhbmdlLXJlcXVpcmVkPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPuKAnSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyDigJxzdWLigJ064oCdNzM3NTYyNkE2NTYzNzTigJ0sPC9zcGFuPjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxpc3PigJ06JnF1 b3Q7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxhIGhyZWY9Imh0dHBzOi8vaWRwLmV4 YW1wbGUuY29tL+KAnCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vaWRwLmV4YW1wbGUuY29tL+KA nDwvYT4sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCcZXZlbnTigJ06ezwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKAnGV2ZW50X3R5 cGXigJ06JnF1b3Q7dXJuOmlldGY6cGFyYW1zOnNjaW06ZXZlbnQ6cGFzc3dvcmRSZXNldOKAnSw8 L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4w cHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+JnF1 b3Q7aWQmcXVvdDs64oCdNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOeKAnSw8bzpwPjwvbzpwPjwv cHJlPg0KPHByZT4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg4oCc ZXZlbnTigJ06ezxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigJxldmVudF90eXBl4oCdOiZxdW90Ozxh IGhyZWY9Imh0dHBzOi8vZXhhbXBsZS5jb20vc2NpbS9ldmVudC9wYXNzd29yZFJlc2V0RXh0IiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9leGFtcGxlLmNvbS9zY2ltL2V2ZW50L3Bhc3N3b3JkUmVz ZXRFeHQ8L2E+4oCdLDxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtyZXNldEF0dGVtcHRzJnF1 b3Q7OjU8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+IDwvc3Bhbj48bzpwPjwvbzpwPjwv cHJlPg0KPGRpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7fTxvOnA+PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IH0mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPG86cD48L286cD48L3By ZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNw O308L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPn08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj5UaGlzIGZvcm1hdCBmb2xsb3dzIHRoZSBwcm9wb3NlZCBzaW5ndWxhciBl dmVudCBmb3JtYXQgcmVjdXJzaXZlbHkgYW5kIGlzIDMgbGF5ZXJzIGRlZXAuIE5vdGUgdGhhdCB0 aGUgcGFyc2VyIGhhcyB0byBjb250aW51ZSB0byBzZWFyY2ggdGhlIGRvY3VtZW50IGZvciB0aGlu Z3MgdGhhdCBhcmVu4oCZdCB0aGVyZSBhcyBpdCBoYXMgdG8gc3RvcCB3aGVuIG5vIOKAnGV2ZW50 4oCdIGF0dHJpYnV0ZSBpcyBmb3VuZCByYXRoZXIgdGhhbiBpdGVyYXRlIG92ZXIgYW4gYXJyYXku PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjxwcmU+Jm5ic3A7PG86cD48L286cD48 L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+UGhpbDxicj4NCjxi cj4NCk9yYWNsZSBDb3Jwb3JhdGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0 PGJyPg0KQGluZGVwZW5kZW50aWQ8YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmFtcDtk PUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5F JmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209 aXlWbnJabXI5X3VHQ1E2TUQwekYyeW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZhbXA7cz05c1loZ3BF emI3eFBsUUZtQ0NYTm1IbzZmUU45SUJ1LVNISmFtZ19CNEhzJmFtcDtlPSIgdGFyZ2V0PSJfYmxh bmsiPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48YnI+DQo8YSBocmVmPSJtYWlsdG86cGhpbC5o dW50QG9yYWNsZS5jb20iIHRhcmdldD0iX2JsYW5rIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+T24gT2N0IDMwLCAyMDE3LCBhdCA4OjU3IEFNLCBSaWNoYXJkIEJhY2ttYW4sIEFu bmFiZWxsZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJpY2hhbm5hQGFtYXpvbi5jb20iIHRhcmdldD0i X2JsYW5rIj5yaWNoYW5uYUBhbWF6b24uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iY29sb3I6I0Mz NDZFMCI+UmVwbGllcyBpbmxpbmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2Jh Y2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj4tLSZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3Jv dW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+QW5uYWJlbGxlIFJpY2hhcmQgQmFja21h bjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+SWRlbnRpdHkgU2Vy dmljZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUi Pg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGlu Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8Yj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+RnJvbTo8c3BhbiBjbGFzcz0ibS01MDEzODU0 ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQiPlBoaWwgSHVudCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBv cmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhp bC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5EYXRlOjxzcGFuIGNsYXNz PSJtLTUwMTM4NTQ4NjE0MTAyNjUzMDFtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgw MzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlN1bmRheSwgT2N0 b2JlciAyOSwgMjAxNyBhdCA1OjI1IFBNPGJyPg0KPGI+VG86PHNwYW4gY2xhc3M9Im0tNTAxMzg1 NDg2MTQxMDI2NTMwMW02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2NDRhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+RGljayBIYXJkdCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+ZGljay5oYXJkdEBnbWFpbC5jb208L3NwYW4+PC9hPiZndDs8YnI+ DQo8Yj5DYzo8c3BhbiBjbGFzcz0ibS01MDEzODU0ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAyNDY2 NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjwvYj5ZYXJvbiBTaGVmZmVyICZsdDs8YSBocmVmPSJtYWlsdG86eWFyb25mLmlldGZAZ21h aWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+eWFyb25m LmlldGZAZ21haWwuY29tPC9zcGFuPjwvYT4mZ3Q7LCBNaWtlIEpvbmVzDQogJmx0OzxhIGhyZWY9 Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L3NwYW4+ PC9hPiZndDssICZxdW90O1JpY2hhcmQgQmFja21hbiwgQW5uYWJlbGxlJnF1b3Q7ICZsdDs8YSBo cmVmPSJtYWlsdG86cmljaGFubmFAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPnJpY2hhbm5hQGFtYXpvbi5jb208L3NwYW4+PC9hPiZndDssDQog SUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmlkLWV2ZW50QGlldGYu b3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQtZXZlbnRA aWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjxzcGFuIGNsYXNzPSJtLTUw MTM4NTQ4NjE0MTAyNjUzMDFtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0 YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlJlOiBbSWQtZXZlbnRdIFVz ZSBjYXNlcyBmb3IgbXVsdGlwbGUgZXZlbnRzIHBlciBTRVQ/PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2Jh Y2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQpJ IGhvcGUgdGhpcyBhbnN3ZXJzIHlvdXIgcXVlc3Rpb24uPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3 aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCk15IOKAnG1heeKA nSB3YXMgYmVjYXVzZSBJIGNhbuKAmXQgc2VlIGEgcmVhc29uIHdoeSBub3QuIFRoZSBxdWVzdGlv biBzaG91bGQgYmUsIHdoYXQgaXMgdGhlIGp1c3RpZmljYXRpb24gdG8gbWFrZSDigJxldmVudHPi gJ0gc2luZ3VsYXI/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iY29sb3I6I0MzNDZFMCI+ W3JpY2hhbm5hXVRoZSBzaW5ndWxhciDigJxldmVudOKAnSBjbGFpbSBoYXMgY2xlYXJlciBzZW1h bnRpY3MgYW5kIGlzIGVhc2llciB0byBwcm9jZXNzLiBXZSBzaG91bGQgb3B0IGZvciBlYXNpZXIg c29sdXRpb25zIHVubGVzcyB0aGVyZSBhcmUgdXNlIGNhc2VzIHRoYXQgcmVxdWlyZSBtb3JlIGNv bXBsZXhpdHkuWy9yaWNoYW5uYV08L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+ DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NClRoZXJlIGFyZSBtYW55IHJl YXNvbnMgZm9yIG11bHRpcGxlIGV2ZW50cyBpbiBhIFNFVC4mbmJzcDsgU29tZSBhcmUgZ29vZCwg c29tZSBub3Qgc28gZ29vZC4gU29tZSBvZiB0aGUgcmVhc29ucy4uLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tn cm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQoxLiZu YnNwOyBNdWx0aXBsZSBldmVudCBwYXlsb2FkcyBleHByZXNzaW5nIHN0YXRlbWVudHMgYWJvdXQg bGFyZ2VseSB0aGUgKnNhbWUqdGhpbmcuIEZvciBleGFtcGxlLCBTQ0lNIHBhc3N3b3JkIHJlc2V0 IEFORCBSSVNDIHBhc3N3b3JkIHJlc2V0LiZuYnNwOyBBIFJJU0MgRXZlbnQgYW5kIGFuIE9wZW5C YW5raW5nIEV2ZW50LiBJcyBvbmUgYSBjb21wbGVtZW50IHRvIHRoZSBvdGhlcj8mbmJzcDsgRG8g dGhleSBvdmVybGFwIG9yIGFyZSB0aGV5IGRpc3RpbmN0PyAmbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4N CjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdQ29weS9wYXN0ZWQgZnJvbSBt eSBlYXJsaWVyIGVtYWlsOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJjb2xv cjojQzM0NkUwIj5XaHkgaXMgaXQgbmVjZXNzYXJ5IG9yIGFwcHJvcHJpYXRlIHRvIGluY2x1ZGUg dGhlc2UgZXZlbnRzIGluIHRoZSBzYW1lIFNFVD8gVGhleSBhcmUgbGlrZWx5IGJlaW5nIGdlbmVy YXRlZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBhdCBkaWZmZXJlbnQgdGltZXMgb24gdGhlIHRyYW5z bWl0dGVy4oCZcyBzaWRlLCBjb25zdW1lZCBieSBkaWZmZXJlbnQgc3lzdGVtcyBvbiB0aGUgcmVj ZWl2ZXLigJlzIHNpZGUsDQogYW5kIHBvc3NpYmx5IGJlaW5nIHRyYW5zbWl0dGVkIG92ZXIgZGlm ZmVyZW50IGV2ZW50IHN0cmVhbXMuIEkga25vdyB0aGUgbGF0dGVyIHdvdWxkIGJlIHRoZSBjYXNl IGZvciB1cywgYXMgYSByZWNlaXZlci4gRXZlbiBpZiBpdOKAmXMgbm90LCBpcyBpdCBidXJkZW5z b21lIHRvIHNlbmQgdGhlc2UgZXZlbnRzIHNlcGFyYXRlbHk/IFdoYXQgdmFsdWUgaXMgZ2FpbmVk IGluIGNvbWJpbmluZyB0aGVtPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJj b2xvcjojQzM0NkUwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0i Y29sb3I6I0MzNDZFMCI+QWRkaXRpb25hbGx5LCBzaW5jZSB0aGUgc2lnbmF0dXJlIGlzIG92ZXIg dGhlIFNFVCBhbmQgbm90IHRoZSBldmVudCBvYmplY3RzLCBSZWNlaXZlcnMgaW5kZXBlbmRlbnRs eSByb3V0ZSBzZXBhcmF0ZSBldmVudHMgZnJvbSBhIHNpbmdsZSB0b2tlbiB3aXRob3V0IGVpdGhl ciBsb3NpbmcgdGhlIGFiaWxpdHkgdG8gdmVyaWZ5IHRoZSBhdXRoZW50aWNpdHkgb2YgdGhlIGV2 ZW50IG9yIHNoYXJpbmcgYWxsDQogaW5mb3JtYXRpb24gaW4gdGhlIFNFVCB3aXRoIGV2ZXJ5IHN5 c3RlbSBoYW5kbGluZyBhbnkgZXZlbnQgaW4gdGhlIHRva2VuLlsvcmljaGFubmFdPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tn cm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEy LjBwdDtiYWNrZ3JvdW5kOndoaXRlIj4NCjIuJm5ic3A7IE11bHRpcGxlIGV2ZW50cyBwYXlsb2Fk cyBleHByZXNzaW5nIGRpZmZlcmVudCBzdGF0ZW1lbnRzIGFib3V0IHRoZSBzYW1lIHRyYW5zYWN0 aW9uIC0gUklTQyBQYXNzd29yZCBSZXNldCBhbmQgUklTQyBTZXNzaW9uIENhbmNlbDxicj4NCjxz cGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdU2FtZSBhcyBhYm92ZVsvcmljaGFu bmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KMy4mbmJzcDsgQSBuZXcg cHJvZmlsZSBkZWZpbmVzIG5ldyBldmVudCBhdHRyaWJ1dGVzIHRvIGJlIGFkZGVkIG9uIHRvIGFu IGV4aXN0aW5nIGV2ZW50IHR5cGUgKGEgcHVyZSBleHRlbnNpb24pJm5ic3A7PGJyPg0KPHNwYW4g c3R5bGU9ImNvbG9yOiNDMzQ2RTAiPltyaWNoYW5uYV1JIGhhdmUgc3VnZ2VzdGVkIGEgd2F5IHRv IHN1cHBvcnQgZXh0ZW5zaW9ucyB3aXRoaW4gYW4gZXZlbnQgYm9keSwgbXVsdGlwbGUgdGltZXMg bm93LiBJZiB5b3Ugc2VlIHByb2JsZW1zIHdpdGggaXQsIHBsZWFzZSBwb2ludCB0aGVtIG91dC5b L3JpY2hhbm5hXTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KSSB0aGluayBpdCBpcyBxdWl0ZSB2YWxpZCB0 byBhbGxvdyAxIGFuZCAzLiAmbmJzcDsyIGNvdWxkIGJlIGxpbWl0ZWQgYnkgc3BlY2lmaWMgcHJv ZmlsZXMgbGlrZSBSSVNDIGlmIHRoZXkgd2FudC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRl Ij4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KSSBhbSBub3QgaW4gYWdy ZWVtZW50IHRoYXQgbWFraW5nIGV2ZW50IHNpbmd1bGFyIHNpbXBsaWZpZXMgYW55dGhpbmcuIEZv ciBvbmUgaXMgbWFrZXMgZXh0ZW5zaW9ucyBjb21wbGV4IChhbm90aGVyIG5lc3RlZCBKU09OIHN0 cnVjdHVyZSkgYW5kIHBvdGVudGlhbGx5IGNvbmZsaWN0aW5nLiZuYnNwOzxicj4NCjxzcGFuIHN0 eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNw YW4gc3R5bGU9ImNvbG9yOiNDMzQ2RTAiPldheXMgdGhhdCBtdWx0aXBsZS1ldmVudCBTRVRzIGFy ZSBtb3JlIGNvbXBsaWNhdGVkOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPG9sIHN0 YXJ0PSIxIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6I0Mz NDZFMDttc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt c28tbGlzdDpsMiBsZXZlbDEgbGZvMTtiYWNrZ3JvdW5kOndoaXRlIj4NCkl0IHJlc3VsdHMgaW4g YSBtb3JlIGNvbXBsZXggc3RydWN0dXJlIGZvciB0aGUgc2luZ2xlIGV2ZW50IHVzZSBjYXNlLCB3 aGljaCBJIHRoaW5rIHdlIGFsbCBhZ3JlZSBpcyB0aGUgbWFqb3JpdHkgdXNlIGNhc2UuPG86cD48 L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY29sb3I6I0MzNDZFMDttc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDps MiBsZXZlbDEgbGZvMTtiYWNrZ3JvdW5kOndoaXRlIj4NCk11bHRpcGxlLWV2ZW50IFNFVHMgaGF2 ZSBhbWJpZ3VvdXMgc2VtYW50aWNzLiBUaGUgcHJlc2VuY2Ugb2YgdHdvIGV2ZW50cyBBIGFuZCBC IGluIHRoZSBzYW1lIFNFVCBjb3VsZCBtZWFuIGFueSBvZjo8bzpwPjwvbzpwPjwvbGk+PC9vbD4N CjxvbCBzdGFydD0iMiIgdHlwZT0iMSI+DQo8b2wgc3RhcnQ9IjEiIHR5cGU9ImEiPg0KPGxpIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUwO21zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxldmVsMiBsZm8yO2Jh Y2tncm91bmQ6d2hpdGUiPg0KVGhleSBhcmUgcmVsYXRlZCB0byB0aGUgc2FtZSBsb2dpY2FsIGV2 ZW50IChpLmUuIHRoZSBzYW1lIHRoaW5nIGFzIGlmIHRoZXkgd2VyZSBmcm9tIGRpZmZlcmVudCBT RVRzIHRoYXQgaGF2ZSBhIGNvbW1vbiB0eG4pLjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9ImNvbG9yOiNDMzQ2RTA7bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwyIGxmbzI7YmFja2dyb3Vu ZDp3aGl0ZSI+DQpBIGlzIGFuIGV4dGVuc2lvbiBvZiBCLjxvOnA+PC9vOnA+PC9saT48bGkgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNvbG9yOiNDMzQ2RTA7bXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwyIGxmbzI7YmFj a2dyb3VuZDp3aGl0ZSI+DQpCIGlzIGFuIGV4dGVuc2lvbiBvZiBBLjxvOnA+PC9vOnA+PC9saT48 bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9ImNvbG9yOiNDMzQ2RTA7bXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwyIGxm bzI7YmFja2dyb3VuZDp3aGl0ZSI+DQpUaGV5IGFyZSBhbGlhc2VzIGZvciBvbmUgYW5vdGhlci48 bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJjb2xvcjojQzM0NkUw O21zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwxIGxldmVsMiBsZm8yO2JhY2tncm91bmQ6d2hpdGUiPg0KVGhleSBhcmUgbm90IGFjdHVh bGx5IHJlbGF0ZWQgdG8gb25lIGFub3RoZXIgaW4gYW55IHdheS48bzpwPjwvbzpwPjwvbGk+PC9v bD4NCjwvb2w+DQo8b2wgc3RhcnQ9IjMiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJjb2xvcjojQzM0NkUwO21zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMSBsZm8zO2JhY2tncm91bmQ6d2hpdGUi Pg0KQ2xhaW0gc2VtYW50aWNzIGJlY29tZSBoYXJkZXIgdG8gZGVmaW5lLCBhcyBkaWZmZXJlbnQg cHJvZmlsZXMgbWF5IHdhbnQgdG8gdXNlIHRoZSBzYW1lIGNsYWltcyBpbiBkaWZmZXJlbnQgd2F5 cy48bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3Jv dW5kOndoaXRlIj4NCklmIHRoZSBXRyB3YW50cyB0byBibG9jayAxIGFuZCAyIGFib3ZlLCB0aGVu IEkgYmVsaWV2ZSB3ZSBoYXZlIHRvIGVzdGFibGlzaCBhbiBldmVudCByZWdpc3RyeSB0byBlbnN1 cmUgbmV3IEV2ZW50IHByb2ZpbGVzIGRvIG5vdCBvdmVybGFwIHRvIGVsaW1pbmF0ZSB0aGUgbmVl ZCB0byBleHByZXNzIG11bHRpcGxlIGV2ZW50cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRl Ij4NCjxzcGFuIHN0eWxlPSJjb2xvcjojQzM0NkUwIj5bcmljaGFubmFdSeKAmW0gbm90IHN1cmUg d2hhdCB5b3UgbWVhbiBieSB0aGlzLiBBcmUgeW91IHJlZmVycmluZyB0byBldmVudCBuYW1lcz8g VGhvc2UgYXJlIGFscmVhZHkgZGVmaW5lZCBieSB0aGUgc3BlYyB0byBiZSBVUklzLlsvcmljaGFu bmFdPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KUGhp bDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dy b3VuZDp3aGl0ZSI+DQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2Vz IEFyY2hpdGVjdDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KQGluZGVwZW5kZW50aWQ8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5jb20m YW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFw SV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZh bXA7bT1VLWE1SEJORDBIYVRYNGFuTlpmelg3cERzZks1ZjBoOW1aOUNaa2tHaWVjJmFtcDtzPUtC d0tQRm5xWV9ROTVDVEFfX1dHQ1lHVHhyRDdBR0N4dWVvUFhuS0VVVDAmYW1wO2U9IiB0YXJnZXQ9 Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+d3d3LmluZGVwZW5kZW50aWQuY29t PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUi Pg0KPGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNr Z3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJs b2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCk9u IE9jdCAyOSwgMjAxNywgYXQgNDoxMiBQTSwgRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRv OmRpY2suaGFyZHRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+ZGljay5oYXJkdEBnbWFpbC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzti YWNrZ3JvdW5kOndoaXRlIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj5QaGlsOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+ DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGlj YSZxdW90OyxzYW5zLXNlcmlmIj5JbiB5b3VyIGV4YW1wbGVzIGZvciBoYXZpbmcgYSBwbHVyYWxp dHkgb2YgZXZlbnRzLCB5b3UgdXNlIHRoZSB3b3JkICZxdW90O21heSZxdW90Oywgd2hpY2ggbGVh ZHMgbWUgdG8gcXVlc3Rpb24gaWYgYSBwbHVyYWxpdHkgb2YgZXZlbnRzIGlzIHJlYWxseSByZXF1 aXJlZCBpbiBTRVQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+WW91IHBvc2l0IHRoYXQgaXQgd2lsbCBiZSBkaWZmaWN1bHQgZm9y IGEgZGlzdHJpYnV0ZWQgc3lzdGVtIHRvIGNvcnJlbGF0ZSBtdWx0aXBsZSBTRVRzIHdpdGggdGhl IHNhbWUgJnF1b3Q7dHhuJnF1b3Q7LCBidXQgdGhlIGRpc3RyaWJ1dGVkIHN5c3RlbSB3aWxsIGNl cnRhaW5seSBuZWVkIHRvIGNvcnJlbGF0ZSBldmVudHMgb24gdGhlIHNhbWUgc3ViamVjdA0KIC0t IGNvcnJlbGF0aW5nIGV2ZW50cyBvbiB0aGUgc2FtZSAmcXVvdDt0eG4mcXVvdDsgb24gdGhlIHNh bWUgc3ViamVjdCBzZWVtcyBmYWlybHkgc2ltcGxlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3Jv dW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzti YWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgdGhpbmsgdGhhdCBhIHJlY2Vp dmVyIHdpbGwgbmVlZCB0byBjb3JyZWxhdGUgbXVsdGlwbGUgU0V0cyBvbiB0aGUgc2FtZSBzdWJq ZWN0LCBzbyBoYXZpbmcgbXVsdGlwbGUgZXZlbnRzIGluIGEgU0VUIGlzIHJlZHVuZGFudCwgYW5k IGFkZHMgY29tcGxleGl0eSB3aXRoIG5vIGNsZWFyIGJlbmVmaXQgdGhhdCBJIGNhbiBzZWUuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+QW4gaW1wbGVtZW50b3IgbWF5IGNob29zZSB0byBzZW5kIG11bHRpcGxlIFNFVHMsIG9yIHNl bmQgYSBzaW5nbGUgU0VUIHdpdGggbXVsdGlwbGUgZXZlbnRzLCBzbyBhIHJlY2VpdmVyIHdpbGwg bmVlZCB0byBzdXBwb3J0IGJvdGguIEkgcHJlZmVyIHdlIHBpY2sgb25lIHdheSBhbmQgbWluaW1p emUgdGhlIGNvZGUgcGF0aHMsIGFuZCB3ZQ0KIHdpbGwgbmVlZCB0byBzdXBwb3J0IGNvcnJlbGF0 aW5nIGFjcm9zcyBtdWx0aXBsZSBTRVRzLCBzbyB0aGF0IHNlZW1zIHRoZSBiZXN0IG1lY2hhbmlz bS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5MZXQgbWUga25vdyBpZiB0aGVyZSBpcyBzb21ldGhpbmcgSSBtaXNzZWQgaW4gbXkg bG9naWMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDss c2Fucy1zZXJpZiI+L0RpY2s8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3aGl0ZSI+DQo8 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZx dW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3Jv dW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3Vu ZDp3aGl0ZSI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5PbiBTdW4sIE9jdCAyOSwgMjAxNyBhdCAxMToy OCBBTSwgWWFyb24gU2hlZmZlcjxzcGFuIGNsYXNzPSJtLTUwMTM4NTQ4NjE0MTAyNjUzMDFtNjk1 ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNl Ij4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Im1haWx0bzp5YXJvbmYuaWV0ZkBnbWFpbC5jb20i IHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj55YXJvbmYuaWV0ZkBn bWFpbC5jb208L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0ibS01MDEzODU0ODYxNDEwMjY1MzAx bTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPndyb3RlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0Mg MS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJp ZiI+SW4gdGhhdCBjYXNlLCBsZXQncyBhZGQgdGV4dCB0byB0aGF0IGVmZmVjdCwgZS5nLiB3ZSBj b3VsZCBhZGQgdG8gdGhlIGRlZmluaXRpb24gb2YgdGhlICZxdW90O2V2ZW50cyZxdW90OyBjbGFp bTo8YnI+DQo8YnI+DQpQcm9maWxpbmcgc3BlY2lmaWNhdGlvbnMgU0hPVUxEIGRlZmluZSB0aGUg YWxsb3dlZCBldmVudCBzdGF0ZW1lbnRzLCBhbmQgTUFZIHJlc3RyaWN0IHRoZWlyIG51bWJlci4g Rm9yIGV4YW1wbGUsIHNvbWUgcHJvZmlsZXMgbWF5IHJlcXVpcmUgdGhpcyBjbGFpbSB0byBjb250 YWluIG9ubHkgYSBzaW5nbGUgZXZlbnQgc3RhdGVtZW50Ljxicj4NCjxicj4NClRoYW5rcyw8YnI+ DQombmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0ibS01MDEzODU0ODYxNDEw MjY1MzAxbTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPllhcm9uPGJyPg0KPGJyPg0KT24gMjQvMTAvMTcgMjI6 MTAsIE1pa2UgSm9uZXMgd3JvdGU6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8Ymxv Y2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEy LjBwdDtiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPkkgYWdyZWUgd2l0aCBt dWNoIG9mIFBoaWzigJlzIHJhdGlvbmFsZSBoZXJlLjxicj4NCjxicj4NCkl04oCZcyBmaW5lIGZv ciBzb21lIHByb2ZpbGVzIHRvIHNheSB0aGF0IHRoZSDigJxldmVudHPigJ0gc2V0IG11c3QgYmUg YSBzaW5nbGV0b24uJm5ic3A7IFRoYXQgZG9lc27igJl0IGhhdmUgdG8gYmUgdHJ1ZSBmb3IgYWxs IGV2ZW50cy4mbmJzcDsgSSB0aGluayB0aGluZ3MgYXJlIGZpbmUgYXMtaXMuPGJyPg0KPGJyPg0K Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9Im0t NTAxMzg1NDg2MTQxMDI2NTMwMW02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2 NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4tLSBNaWtlPGJyPg0KPGJyPg0K KkZyb206KiBJZC1ldmVudCBbbWFpbHRvOjxhIGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2Vz QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQt ZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XSAqT24gQmVoYWxmIE9mICpQaGlsIEh1 bnQ8YnI+DQoqU2VudDoqIE1vbmRheSwgT2N0b2JlciAyMywgMjAxNyA4OjQ3IFBNPGJyPg0KKlRv OiogUmljaGFyZCBCYWNrbWFuLCBBbm5hYmVsbGUgJmx0OzxhIGhyZWY9Im1haWx0bzpyaWNoYW5u YUBhbWF6b24uY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ cmljaGFubmFAYW1hem9uLmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCipDYzoqIElEIEV2ZW50cyBN YWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmlkLWV2ZW50QGlldGYub3JnPC9z cGFuPjwvYT4mZ3Q7PGJyPg0KKlN1YmplY3Q6KiBSZTogW0lkLWV2ZW50XSBVc2UgY2FzZXMgZm9y IG11bHRpcGxlIGV2ZW50cyBwZXIgU0VUPzxicj4NCjxicj4NCkFubmFiZWxsZSw8YnI+DQo8YnI+ DQpJIGhhdmUgYSBudW1iZXIgb2YgY29uY2VybnMgd2l0aCB0aGlzIHByb3Bvc2FsLjxicj4NCjxi cj4NClByb2ZpbGluZyBJbmRlcGVuZGVuY2UgLyBLZWVwaW5nIEV2ZW50IFBheWxvYWRzIEluZGVw ZW5kZW50PGJyPg0KPGJyPg0KSW5kaWNhdGluZyB0aGF0IGV4dGVuc2lvbnMgc2hvdWxkIGJlIGhh bmRsZWQgYnkgcHJvZmlsZXMgbGVhZHMgdG8gbW9yZSBpbnRlci1vcGVyYWJpbGl0eSBpc3N1ZXMg YW5kIG1vcmUgaW1wb3J0YW50bHkgaW50cnVkZXMgb24gdGhlIEV2ZW50IHBheWxvYWQgc3BhY2Ug Ynkgc3VnZ2VzdGluZyBhIHN1Yi1zY2hlbWEgY3JlYXRlcyBwb3RlbnRpYWwgbGltaXRhdGlvbnMg YW5kIGNvbmZsaWN0cyB0aGF0IG1heSBhZGQgdG8gY29tcGxleGl0eSBsYXRlcg0KIG9uLiBUaGUg Y3VycmVudCBmb3JtYXQgYWxsb3dzIGEgcGFyc2VyIHRvIGRpc2NvdmVyIGFuZCB1bmxvYWQgb25l IG9yIG1vcmUgSlNPTiBwYXlsb2FkcyB3aGljaCBjYW4gZWFjaCBoYXZlIGluZGVwZW5kZW50IHN0 cnVjdHVyZS48YnI+DQo8YnI+DQpHZW5lcmFsIGV4dGVuc2lvbnM8YnI+DQo8YnI+DQpUaGUgcHJv cG9zYWwgYWxzbyBydWxlcyBvdXQgZ2VuZXJhbCBwdXJwb3NlIGV4dGVuc2lvbnMgbm90IHJlbGF0 ZWQgdG8gYW55IHNwZWNpZmljIGV2ZW50LiBHaXZlbiB0aGUgZW1lcmdlbmNlIG9mIGl0ZW1zIGxp a2UgR1BSRCwgSSB3b3VsZCBub3Qgd2FudCB0byBibG9jayB0aGUgYWJpbGl0eSB0byBhZGQgbWV0 YS1kYXRhIG9yIG90aGVyIGdlbmVyYWwgcHVycG9zZSBpdGVtcy4gV2UgY2FuIGFsc28gYW50aWNp cGF0ZSBzb21lIGRlbGl2ZXJ5IHNjZW5hcmlvcw0KIHdoZXJlIGFkZGl0aW9uYWwgZGF0YSBtaWdo dCBiZSByZXF1aXJlZC4gRXZlbiB0aG91Z2ggdGhlcmUgaXMgbm8gY3VycmVudCBwbGFubmVkIHVz ZSwgSSBzZWUgbm8gZ29vZCByZWFzb24gdG8gcnVsZSB0aGlzIG91dC48YnI+DQo8YnI+DQpNdWx0 aXBsZSBFdmVudHMgRnJvbSBEaWZmZXJlbnQgRmFtaWxpZXMgKHZzLiBNdWx0aXBsZSBFdmVudHMg ZnJvbSBhIHNpbmdsZSBmYW1pbHkgbGlrZSBSSVNDKTxicj4NCjxicj4NCkluIG91ciBSSVNDIHNl c3Npb24gd2UgZGlzY3Vzc2VkIGV4cHJlc3NpbmcgbXVsdGlwbGUgZGlzdGluY3QgUklTQyBldmVu dHMgaW4gb25lIFNFVC4gVGhlIGRpc2N1c3Npb24gd2FzIHRoYXQgb25seSBvbmUgUklTQyBldmVu dCBhdCBhIHRpbWUuIFdlIGRpZCBub3QgZGlzY3VzcyBvdGhlciBldmVudCBwcm9maWxlcy4gSSBk b27igJl0IHNlZSBhIHJlYXNvbiB0byBydWxlIG91dCBtdWx0aS1ldmVudHMgZnJvbSBkaWZmZXJl bnQgZmFtaWxpZXMgYXQgdGhlDQogU0VUIGxldmVsLiBFYWNoIHByb2ZpbGUgaXMgZXhwcmVzc2lu ZyBzbGlnaHRseSBkaWZmZXJlbnQgdGhpbmdzIGFib3V0IHRoZSBzYW1lIGV2ZW50Ljxicj4NCjxi cj4NCkkgY2FuIGZvcnNlZSBzb21lIGNhc2VzIHdoZXJlIGl0IGlzIG5vdCBjbGVhciB3aGljaCBp cyB0aGUgcHJpbWFyeSBhbmQgd2hpY2ggaXMgdGhlIGV4dGVuc2lvbi4mbmJzcDsgVGhlcmUgbWF5 IG5vdCBiZSBhIGNsZWFyIHdpbm5lci48YnI+DQo8YnI+DQpBIGNvdXBsZSBvZiBleGFtcGxlcyAo dGhlc2UgYXJlIG5lY2Vzc2FyaWx5IHJlYWzigKZqdXN0IHBvc3NpYmlsaXRpZXMpOjxicj4NCjxi cj4NCiogSXQgaXMgcHJvYmFibHkgdXNlZnVsIHRvIGJlIGFibGUgdG8gZXhwcmVzcyBzaW1sYXIv b3ZlcmxhcHBpbmcgZXZlbnRzIGZyb20gZGlmZmVyZW50IFNFVCBwcm9maWxlcyBpbiBvbmUgU0VU LiZuYnNwOyBGb3IgZXhhbXBsZSBhIEJhY2tjaGFubmVsIExvZ291dCAmYW1wOyBhIFJJU0Mgc2Vz c2lvbiBjYW5jZWwgZXZlbnQuPGJyPg0KPGJyPg0KKiBTQ0lNIG1heSB3YW50IHRvIHJlcHJlc2Vu dCBhIHNpbmdsZSB0cmFuc2FjdGlvbiBhcyBjYXVzaW5nIG11bHRpcGxlIHN0YXRlIGNoYW5nZXMg aW4gYW4gZXZlbnQgKGUuZy4gYSBwYXNzd29yZCBjaGFuZ2UgY2F1c2VzIG11bHRpcGxlIGVmZmVj dHMpLiBIYXZpbmcgdG8gY2hhc2UgZG93biBtdWx0aXBsZSBldmVudHMgYW5kIGNvcnJlbGF0ZSBi eSDigJx0eG7igJ0gd291bGQgYmUgY2hhbGxlbmdpbmcgaW4gYSBtdWx0aS10aHJlYWRlZC9tdWx0 aS1ub2RlDQogZGVsaXZlcnkgc3lzdGVtLiZuYnNwOyAmbmJzcDtUaGUgU0NJTSBsaXN0IGhhcyBu b3QgZGlzY3Vzc2VkIHRoaXMsIGJ1dCBJIHdvdWxkIG5vdCB3YW50IHRvIGJsb2NrIHRoaXMgY2Fw YWJpbGl0eS4mbmJzcDsgSU9XIC0gSnVzdCBiZWNhdXNlIFJJU0MgZG9lcyBub3Qgd2FudCB0byBl eHByZXNzIG11bHRpcGxlIGV2ZW50cyBkb2VzIG5vdCBtYWtlIHRoaXMgdHJ1ZSBmb3Igb3RoZXIg cHJvZmlsZXMuPGJyPg0KPGJyPg0KKiBXZSBtYXkgd2lzaCB0byBpbmRpY2F0ZSBhIFNDSU0gUGFz c3dvcmQgUmVzZXQgd2FzIHBlcmZvcm1lZCBhbmQgYSBMb2dvdXQvc2Vzc2lvbiBjYW5jZWxsYXRp b24gaXMgZXhwcmVzc2VkIGF0IHRoZSBzYW1lIHRpbWUuJm5ic3A7IFRoZSBldmVudHMgYXJlIHJl bGF0ZWQgYnV0IGV4cHJlc3MgZGlmZmVyZW50IGRhdGEuPGJyPg0KPGJyPg0KQXZvaWRpbmcgQ29u ZnVzaW9uIEZyb20gU2ltaWxhciBFdmVudHMgT3JpZ2luYXRpbmcgZnJvbSB0aGUgU2FtZSBUcmFu c2FjdGlvbjxicj4NCjxicj4NCklmIGV2ZW50cyBhcmUgc2VudCBzZXBhcmF0ZWx5LCB0aGVuIG1v cmUgdHJhY2tpbmcgb2Ygc3RhdGUgKGUuZy4gYnkgdHhuKSB3b3VsZCBiZSByZXF1aXJlZCB0byBl bnN1cmUgc2ltaWxhciBldmVudHMgYXJlIG5vdCBtaXN0YWtlbiBvciBoYW5kbGVkIGFzIHJlcGVh dHMuIFdoaWxlIHR4biBwcm92aWRlcyB1c2VmdWwgYXVkaXQgYW5hbHlzaXMgY2FwYWJpbGl0eSwg SeKAmW0gbm90IHN1cmUgaXQgY2FuIGJlIHVzZWQgaW4gbGl2ZSBvciBuZWFyLXJlYWwNCiB0aW1l IHN5c3RlbXMgZ2l2ZW4gZGlzdHJpYnV0ZWQgbXVsdGktbm9kZSwgbXVsdGktdGhyZWFkaW5nIGFy Y2hpdGVjdHVyZXMuPGJyPg0KPGJyPg0KUHJldmlvdXMgRGlzY3Vzc2lvbjxicj4NCjxicj4NCkkg bm90ZSB0aGF0IEkgb3JpZ2luYWxseSByYWlzZWQgaGF2aW5nIGFuIGF0dHJpYnV0ZSB0byBkZXNp Z25hdGUgcHJpbWFyeSBldmVudCBhdHRyaWJ1dGUgdG8gYWxsZXZpYXRlIHlvdXIgY29uY2Vybiwg YnV0IHRoaXMgd2FzIG5vdCBhY2NlcHRlZC4gU2VlOjxicj4NCjxicj4NCio8c3BhbiBjbGFzcz0i bS01MDEzODU0ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0 OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWwtMkRhcmNoaXZlX3dlYl9pZC0yRGV2ZW50X2N1cnJlbnRfbXNnMDA0MDYuaHRtbCZhbXA7 ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0pu RSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDtt PVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9UzNzTVZp cU12RWdud0diSndPUU55Y3JPeXI3U2VmcHFfTW9GT0tjRWVDRSZhbXA7ZT0iIHRhcmdldD0iX2Js YW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWls LWFyY2hpdmUvd2ViL2lkLWV2ZW50L2N1cnJlbnQvbXNnMDA0MDYuaHRtbDwvc3Bhbj48L2E+PGJy Pg0KPGJyPg0KKjxzcGFuIGNsYXNzPSJtLTUwMTM4NTQ4NjE0MTAyNjUzMDFtNjk1ODc3Njk4MDI0 NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbC0yRGFyY2hpdmVfd2ViX2lkLTJEZXZlbnRfY3Vy cmVudF9tc2cwMDE0MC5odG1sJmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllS OFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1 WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlL QVRrUmxRRzFpdyZhbXA7cz1HeTlneVJvSUl0YS1jU2hWN2JOMTYxYXk0eUU2cjlHMV9BYV9OZUJu eWxnJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWwtYXJjaGl2ZS93ZWIvaWQtZXZlbnQvY3VycmVudC9tc2cw MDE0MC5odG1sPC9zcGFuPjwvYT48YnI+DQo8YnI+DQpUaGUgY29uc2Vuc3VzLCBhdCBsZWFzdCBh cyBJIGludGVycHJldGVkIGl0IGlzIHVwIHRvIHRoZSByZWNlaXZlciB0byBmaWd1cmUgdGhpcyBv dXQgYmFzZWQgb24gdGhlIGRlZmluaXRpb25zIGl0IGhhcyBmb3IgZWFjaCBldmVudCBVUkkgYW5k IHRoZSBwcm9maWxlcyB0aGV5IHJlcHJlc2VudC4gSU9XIC0gUklTQyBpcyBmcmVlIHRvIGxpbWl0 IHRoYXQgb25seSBvbmUgUklTQyBldmVudCBiZSBleHByZXNzZWQgYXQgYSB0aW1lLjxicj4NCjxi cj4NClBoaWw8YnI+DQo8YnI+DQpPcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNl cnZpY2VzIEFyY2hpdGVjdDxicj4NCjxicj4NCkBpbmRlcGVuZGVudGlkPGJyPg0KPGJyPg0KPGEg aHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0Ff X3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5 WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERrbjMxQXV4dXJ1 aWI5S0FUa1JsUUcxaXcmYW1wO3M9OU5QNW5hbWc2cklWend1bjljLTFxMHdoc3lYd1N2dEhCMGYy ZEtrZkNYOCZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxl Ij53d3cuaW5kZXBlbmRlbnRpZC5jb208L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtLTUwMTM4NTQ4 NjE0MTAyNjUzMDFtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVm ZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX193d3cuaW5kZXBlbmRlbnRpZC5j b20mYW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1 ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pO QSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtSbFFHMWl3JmFtcDtz PTlOUDVuYW1nNnJJVnp3dW45Yy0xcTB3aHN5WHdTdnRIQjBmMmRLa2ZDWDgmYW1wO2U9IiB0YXJn ZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cDovL3d3dy5pbmRlcGVu ZGVudGlkLmNvbTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxicj4NCjxhIGhyZWY9Im1haWx0bzpwaGls Lmh1bnRAb3JhY2xlLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0ibS01MDEzODU0 ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPiZsdDttYWlsdG86PGEgaHJlZj0ibWFpbHRv OnBoaWwuaHVudEBvcmFjbGUuY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDs8YnI+DQo8YnI+DQom bmJzcDsgJm5ic3A7IE9uIE9jdCAyMywgMjAxNywgYXQgNzowMiBQTSwgUmljaGFyZCBCYWNrbWFu LCBBbm5hYmVsbGU8YnI+DQombmJzcDsgJm5ic3A7ICZsdDs8YSBocmVmPSJtYWlsdG86cmljaGFu bmFAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PnJpY2hhbm5hQGFtYXpvbi5jb208L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtLTUwMTM4NTQ4NjE0 MTAyNjUzMDFtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+Jmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86cmlj aGFubmFAYW1hem9uLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPnJpY2hhbm5hQGFtYXpvbi5jb208L3NwYW4+PC9hPiZndDsmZ3Q7DQogd3JvdGU6PGJyPg0K PGJyPg0KJm5ic3A7ICZuYnNwOyBUaGUgY3VycmVudCBkcmFmdCBvZiB0aGUgU0VUIHNwZWMgYWxs b3dzIGZvciBleHByZXNzaW5nIG11bHRpcGxlPGJyPg0KJm5ic3A7ICZuYnNwOyBldmVudHMgd2l0 aGluIHRoZSBzYW1lIHRva2VuLCB3aGljaCBpbnRyb2R1Y2VzIGFkZGl0aW9uYWwgY29tcGxleGl0 eTxicj4NCiZuYnNwOyAmbmJzcDsgYW5kIHJvb20gZm9yIGFtYmlndW91cyBzZW1hbnRpY3MuIFdl 4oCZdmUgZGlzY3Vzc2VkIHRoaXMgaW4gdGhlIE9JREY8YnI+DQombmJzcDsgJm5ic3A7IFJJU0Mg d29ya2luZyBncm91cCBhbmQgdGhlIGN1cnJlbnQgY29uc2Vuc3VzIHRoZXJlIGlzIHRoYXQgUklT QyB3aWxsPGJyPg0KJm5ic3A7ICZuYnNwOyByZXF1aXJlIHRoYXQgUklTQyBldmVudHMgbXVzdCBi ZSB0aGUgb25seSBldmVudCBpbiB0aGUgU0VULCBoYXZpbmc8YnI+DQombmJzcDsgJm5ic3A7IGlk ZW50aWZpZWQgd2F5cyB0byBjbGVhcmx5IGFuZCBlYXNpbHkgc3VwcG9ydCB0aGUgaGFuZGZ1bCBv ZiB1c2U8YnI+DQombmJzcDsgJm5ic3A7IGNhc2VzIGZvciBtdWx0aXBsZSBldmVudHMgcGVyIHRv a2VuIHRoYXQgcGVvcGxlIGhhdmUgcmFpc2VkLiBXaXRoPGJyPg0KJm5ic3A7ICZuYnNwOyB0aGF0 IGNvbnRleHQgaW4gbWluZCwgSSBwcm9wb3NlIHN0cmlraW5nIHRoZSBkZWZpbml0aW9uIG9mIHRo ZTxicj4NCiZuYnNwOyAmbmJzcDsg4oCcZXZlbnRz4oCdIGNsYWltIGZyb20gdGhlIFNlY3VyaXR5 IEV2ZW50IFRva2VuIHNwZWMsIGFuZCByZXBsYWNpbmcgaXQ8YnI+DQombmJzcDsgJm5ic3A7IHdp dGggdGhlIGZvbGxvd2luZyBkZWZpbml0aW9uIGZvciBhbiDigJxldmVudOKAnSBjbGFpbSAoc2lu Z3VsYXIpOjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnQ8YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7IEEgSlNPTiBvYmplY3QgY29udGFpbmluZyBhbiAmcXVvdDtldmVudF90eXBlJnF1b3Q7 IG1lbWJlciB3aG9zZSB2YWx1ZSBpcyBhIFVSSTxicj4NCiZuYnNwOyAmbmJzcDsgcmVwcmVzZW50 aW5nIGEgdHlwZSBvZiBldmVudCBkZWZpbmVkIGluIGEgUHJvZmlsaW5nIFNwZWNpZmljYXRpb24u PGJyPg0KJm5ic3A7ICZuYnNwOyBUaGUgb2JqZWN0IE1BWSBvdGhlcndpc2UgYmUgZW1wdHksIG9y IE1BWSBjb250YWluIGFkZGl0aW9uYWwgbWVtYmVyczxicj4NCiZuYnNwOyAmbmJzcDsgYXMgZGVz Y3JpYmVkIGJ5IHRoZSBQcm9maWxpbmcgU3BlY2lmaWNhdGlvbi48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7IEhlcmUgaXMgdGhlIGV4YW1wbGUgU0VUIGZyb20gc2VjdGlvbiAyLjMsIHJld3JpdHRl biB3aXRoIHRoaXMgY2hhbmdlPGJyPg0KJm5ic3A7ICZuYnNwOyBtaW5kOjxicj4NCjxicj4NCiZu YnNwOyAmbmJzcDs8c3BhbiBjbGFzcz0ibS01MDEzODU0ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAy NDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPns8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyAmcXVvdDtqdGkm cXVvdDs6ICZxdW90OzRkMzU1OWVjNjc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4JnF1b3Q7LDxicj4N Cjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ1ODQ5 NjQwNCw8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90O2lzcyZxdW90 OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbTwv c3Bhbj48L2E+PHNwYW4gY2xhc3M9Im0tNTAxMzg1NDg2MTQxMDI2NTMwMW02OTU4Nzc2OTgwMjQ2 NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwv c3Bhbj4mbHQ7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tLyIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS88 L3NwYW4+PC9hPiZndDsmcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJz cDsgJnF1b3Q7YXVkJnF1b3Q7OiBbPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJz cDsgJm5ic3A7Jm5ic3A7JnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0Zl ZWRzLzk4ZDUyNDYxZmE1YmJjODc5NTkzYjc3NTQiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5odHRwczovL3NjaW0uZXhhbXBsZS5jb20vRmVlZHMvOThkNTI0NjFm YTViYmM4Nzk1OTNiNzc1NDwvc3Bhbj48L2E+JnF1b3Q7LDxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDsgJm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vc2NpbS5l eGFtcGxlLmNvbS9GZWVkcy81ZDc2MDQ1MTZiMWQwODY0MWQ3Njc2ZWU3IiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0Zl ZWRzLzVkNzYwNDUxNmIxZDA4NjQxZDc2NzZlZTc8L3NwYW4+PC9hPiZxdW90Ozxicj4NCjxicj4N CiZuYnNwOyAmbmJzcDsgJm5ic3A7Jm5ic3A7IF0sPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAm bmJzcDsmbmJzcDsgJnF1b3Q7ZXZlbnQmcXVvdDs6IHs8YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7 ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtldmVudF90eXBlJnF1b3Q7OiAmcXVvdDt1 cm46aWV0ZjpwYXJhbXM6c2NpbTpldmVudDpjcmVhdGUmcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7 ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7cmVmJnF1b3Q7OiAmcXVvdDs8 YSBocmVmPSJodHRwczovL3NjaW0uZXhhbXBsZS5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYx ZTc1MjFkOSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBz Oi8vc2NpbS5leGFtcGxlLmNvbS9Vc2Vycy80NGY2MTQyZGY5NmJkNmFiNjFlNzUyMWQ5PC9zcGFu PjwvYT4mcXVvdDssPGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgJnF1b3Q7YXR0cmlidXRlcyZxdW90OzogWyZxdW90O2lkJnF1b3Q7LCAmcXVvdDtuYW1l JnF1b3Q7LCAmcXVvdDt1c2VyTmFtZSZxdW90OywgJnF1b3Q7cGFzc3dvcmQmcXVvdDssICZxdW90 O2VtYWlscyZxdW90O108YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7ICZuYnNwOyZuYnNwOyB9PGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwOyB9PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBEb2VzIGFu eW9uZSBpbiB0aGUgd29ya2luZyBncm91cCBoYXZlIHVzZSBjYXNlcyBmb3IgU0VUcyB0aGF0IGNh bm5vdDxicj4NCiZuYnNwOyAmbmJzcDsgYmUgbWV0IGJ5IHRoaXMgcHJvcG9zZWQgdGV4dD8gV2l0 aGluIFJJU0MsIHdlIGlkZW50aWZpZWQgdGhyZWUgdXNlPGJyPg0KJm5ic3A7ICZuYnNwOyBjYXNl cywgd2l0aCBzb2x1dGlvbnMgb3V0bGluZWQgYmVsb3c6PGJyPg0KPGJyPg0KJm5ic3A7ICZuYnNw OyAqKjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgKkV4dGVuc2lvbnMqPGJyPg0KPGJyPg0KJm5i c3A7ICZuYnNwOyBFdmVudCBleHRlbnNpb24gbWVjaGFuaXNtcyBjYW4gYmUgZGVmaW5lZCBpbnRl cm5hbCB0byB0aGUgZXZlbnQ8YnI+DQombmJzcDsgJm5ic3A7IG9iamVjdC4gQSBzaW1wbGUgYXBw cm9hY2ggd291bGQgYmUgdG8gJm5ic3A7ZGVmaW5lIGFuIOKAnGV4dGVuc2lvbnPigJ0gbWVtYmVy PGJyPg0KJm5ic3A7ICZuYnNwOyB0aGF0IGlzIGEgbGlzdCBvZiBldmVudCBvYmplY3RzIChvciBz ZXQgcmVzZW1ibGluZyB0aGUg4oCcZXZlbnRz4oCdPGJyPg0KJm5ic3A7ICZuYnNwOyBjbGFpbSBh cyBkZWZpbmVkIGluIHRoZSBjdXJyZW50IHNwZWMpLiBUaGlzIGhhcyB0aGUgYWR2YW50YWdlIG9m PGJyPg0KJm5ic3A7ICZuYnNwOyBtYWtpbmcgaXQgY2xlYXIgaW4gdGhlIGRhdGEgc3RydWN0dXJl IHRoYXQgdGhlcmUgaXMgYSBzaW5nbGUgcHJpbWFyeTxicj4NCiZuYnNwOyAmbmJzcDsgZXZlbnQs IHdpdGggemVybyBvciBtb3JlIGV4dGVuc2lvbnMuIFRoZXJlIGlzIG5vIHJvb20gZm9yIGNvbmZ1 c2lvbjxicj4NCiZuYnNwOyAmbmJzcDsgb3ZlciB3aGljaCBldmVudCBpcyBwcmltYXJ5LCBvciBp ZiB0aGVyZSBpcyBhIHByaW1hcnkgZXZlbnQgYXQgYWxsLjxicj4NCiZuYnNwOyAmbmJzcDsgSSB3 b3VsZCBiZSBmaW5lIHdpdGggYWRkaW5nIHNvbWV0aGluZyBsaWtlIHRoaXMgdG8gbXkgcHJvcG9z ZWQgdGV4dCw8YnI+DQombmJzcDsgJm5ic3A7IGlmIHRoZXJlIGlzIGNvbnNlbnN1cyB0aGF0IGl0 IGlzIGJyb2FkbHkgdXNlZnVsLjxicj4NCjxicj4NCiZuYnNwOyAmbmJzcDsgKkFsaWFzZXMqPGJy Pg0KPGJyPg0KJm5ic3A7ICZuYnNwOyBUaGlzIHVzZSBjYXNlIHdhcyBicm91Z2h0IHVwIGluIHRo ZSBjb250ZXh0IG9mIG1pZ3JhdGluZyBjbGllbnRzPGJyPg0KJm5ic3A7ICZuYnNwOyBmcm9tIGRy YWZ0IGV2ZW50IG5hbWVzIHRvIHN0YW5kYXJkaXplZCBldmVudCBuYW1lcy4gSW4gdGhpcyBjYXNl LDxicj4NCiZuYnNwOyAmbmJzcDsgdGhlIGV2ZW50IHRyYW5zbWl0dGVyIGNhbiB0cmFuc21pdCB0 d28gdG9rZW5zIGZvciB0aGUgbG9naWNhbCBldmVudCw8YnI+DQombmJzcDsgJm5ic3A7IG9uZSB1 c2luZyB0aGUgb2xkIG5hbWUgYW5kIGFub3RoZXIgdXNpbmcgdGhlIG5ldyBuYW1lLjxicj4NCjxi cj4NCiZuYnNwOyAmbmJzcDsgKlJlbGF0ZWQgRXZlbnRzKjxicj4NCjxicj4NCiZuYnNwOyAmbmJz cDsgVGhlIFNFVCBzcGVjIGRlZmluZXMgdGhlIHR4biBjbGFpbSBhcyBhIG1lYW5zIG9mIGNvcnJl bGF0aW5nPGJyPg0KJm5ic3A7ICZuYnNwOyBpbmRlcGVuZGVudCB0b2tlbnMgdGhhdCByZWxhdGUg dG8gdGhlIHNhbWUgbG9naWNhbCBldmVudC48YnI+DQo8YnI+DQombmJzcDsgJm5ic3A7IC0tPHNw YW4gY2xhc3M9Im0tNTAxMzg1NDg2MTQxMDI2NTMwMW02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYy MzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQom bmJzcDsgJm5ic3A7IEFubmFiZWxsZSBSaWNoYXJkIEJhY2ttYW48YnI+DQo8YnI+DQombmJzcDsg Jm5ic3A7IEFtYXpvbiDigJMgSWRlbnRpdHkgU2VydmljZXM8YnI+DQo8YnI+DQombmJzcDsgJm5i c3A7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K Jm5ic3A7ICZuYnNwOyBJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQombmJzcDsgJm5ic3A7PHNw YW4gY2xhc3M9Im0tNTAxMzg1NDg2MTQxMDI2NTMwMW02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYy MzY0NTYwODAzNDk2NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVm PSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gY2xhc3M9Im0t NTAxMzg1NDg2MTQxMDI2NTMwMW02OTU4Nzc2OTgwMjQ2NjYwNzAzbTQwMjYyMzY0NTYwODAzNDk2 NDRhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj4mbHQ7bWFpbHRvOjxhIGhyZWY9 Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KJm5ic3A7 ICZuYnNwOzxzcGFuIGNsYXNzPSJtLTUwMTM4NTQ4NjE0MTAyNjUzMDFtNjk1ODc3Njk4MDI0NjY2 MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3 SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFt cDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209czVi eUJlNUtBTm5HVnVBYjFtQXVwRUdvSm44WEc1SklVVXdXR0ZTaWJFYyZhbXA7cz1YOG9SU3EzSXps RjdqaVJBZVpoWHBSM2VWSTBJNThaRmQ0ZUVaZmd5b0lZJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJmFtcDttPXM1YnlCZTVLQU5uR1Z1QWIxbUF1cEVHb0puOFhHNUpJVVV3V0dGU2liRWMm YW1wO3M9WDhvUlNxM0l6bEY3amlSQWVaaFhwUjNlVkkwSTU4WkZkNGVFWmZneW9JWSZhbXA7ZT08 L3NwYW4+PC9hPjxicj4NCjxicj4NCjxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0K PGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxh IGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0z QV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01GYVEm YW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1u YTVGVnpCVFdtYW5xV055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzlt ampoY0Zzai0ydERrbjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9V3JNdVFSd0xWODAyaU1R NHdZQjFmMnJGVUd1NHpiaGNXMDAxZkswMkVYcyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2lkLWV2ZW50PC9zcGFuPjwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5v cmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVt Q1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFX Tnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209WUJDR2xLOW1qamhjRnNqLTJ0RGtu MzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz1Xck11UVJ3TFY4MDJpTVE0d1lCMWYyckZVR3U0 emJoY1cwMDFmSzAyRVhzJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8 L3NwYW4+PC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0K PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2Em cXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztiYWNr Z3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tn cm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+LS08c3BhbiBjbGFzcz0ibS01MDEzODU0 ODYxNDEwMjY1MzAxbTY5NTg3NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bztiYWNrZ3JvdW5kOndoaXRlIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYi PlN1YnNjcmliZSB0byB0aGU8c3BhbiBjbGFzcz0ibS01MDEzODU0ODYxNDEwMjY1MzAxbTY5NTg3 NzY5ODAyNDY2NjA3MDNtNDAyNjIzNjQ1NjA4MDM0OTY0NGFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwLTNBX19oYXJkdHdhcmUuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5x V055NERwY3R5WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPVlCQ0dsSzltampoY0Zzai0ydERr bjMxQXV4dXJ1aWI5S0FUa1JsUUcxaXcmYW1wO3M9TFlONzJHZ0tWaEhzVDZ0QXFCZS1lTW9XTXZ5 XzdkZkZuMXVaMEhLNll1USZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5IQVJEVFdBUkU8L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJtLTUwMTM4NTQ4NjE0 MTAyNjUzMDFtNjk1ODc3Njk4MDI0NjY2MDcwM200MDI2MjM2NDU2MDgwMzQ5NjQ0YXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+bWFpbA0KIGxpc3QgdG8gbGVhcm4gYWJvdXQgcHJv amVjdHMgSSBhbSB3b3JraW5nIG9uITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO2JhY2tncm91bmQ6d2hpdGUiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOklkLWV2 ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJw bGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8 L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtk PUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5F JmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209 WUJDR2xLOW1qamhjRnNqLTJ0RGtuMzFBdXh1cnVpYjlLQVRrUmxRRzFpdyZhbXA7cz1Xck11UVJ3 TFY4MDJpTVE0d1lCMWYyckZVR3U0emJoY1cwMDFmSzAyRVhzJmFtcDtlPSIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5odHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3Rp bmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFpo OEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRXbWFucVdOeTREcGN0eVhQcHVZcVBr QUkxYUxjTE40S1pOQSZhbXA7bT1ZQkNHbEs5bWpqaGNGc2otMnREa24zMUF1eHVydWliOUtBVGtS bFFHMWl3JmFtcDtzPVdyTXVRUndMVjgwMmlNUTR3WUIxZjJyRlVHdTR6YmhjVzAwMWZLMDJFWHMm YW1wO2U9PC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87YmFja2dyb3VuZDp3 aGl0ZSI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtiYWNrZ3JvdW5kOndoaXRlIj5f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48YnI+DQo8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp3aGl0ZSI+SWQtZXZl bnQgbWFpbGluZyBsaXN0PC9zcGFuPjxicj4NCjwvc3Bhbj48YSBocmVmPSJtYWlsdG86SWQtZXZl bnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBs ZTtiYWNrZ3JvdW5kOndoaXRlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48YSBocmVmPSJo dHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5p ZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJv UDFZdW1DWENnYVdIdmxaWVI4UFpoOEJ2N3FJck1VQjY1ZWFwSV9KbkUmYW1wO3I9bmE1RlZ6QlRX bWFucVdOeTREcGN0eVhQcHVZcVBrQUkxYUxjTE40S1pOQSZhbXA7bT1VLWE1SEJORDBIYVRYNGFu Tlpmelg3cERzZks1ZjBoOW1aOUNaa2tHaWVjJmFtcDtzPXJ2ZHJ0STdyWU5SQW5xWkRsdEN3QkFa VkhLcC1NSjIwdWkybm00NlFTejAmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjpwdXJwbGU7YmFja2dyb3VuZDp3aGl0ZSI+aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBa aDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFXTnk0RHBjdHlYUHB1WXFQ a0FJMWFMY0xONEtaTkEmYW1wO209VS1hNUhCTkQwSGFUWDRhbk5aZnpYN3BEc2ZLNWYwaDltWjlD WmtrR2llYyZhbXA7cz1ydmRydEk3cllOUkFucVpEbHRDd0JBWlZIS3AtTUoyMHVpMm5tNDZRU3ow JmFtcDtlPTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4tLQ0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPlN1YnNjcmliZSB0byB0 aGUNCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwLTNBX19oYXJkdHdhcmUuY29tXyZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5 WFBwdVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxL Njd5Rl84dThfcVNDX3cmYW1wO3M9d3RnRDNOcDB2eWhMZHBFd1VpcXNmNEl0aXdBM09tN0dyb2I3 MEx4MHIzayZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj4NCkhBUkRUV0FSRTwvYT4gbWFpbCBsaXN0 IHRvIGxlYXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiE8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZl bnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0 YXJnZXQ9Il9ibGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5v cmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVt Q1hDZ2FXSHZsWllSOFBaaDhCdjdxSXJNVUI2NWVhcElfSm5FJmFtcDtyPW5hNUZWekJUV21hbnFX Tnk0RHBjdHlYUHB1WXFQa0FJMWFMY0xONEtaTkEmYW1wO209aXlWbnJabXI5X3VHQ1E2TUQwekYy eW1SUVM2bEs2N3lGXzh1OF9xU0NfdyZhbXA7cz1PZTBxZkxFWDgzdnRYTTdXbDJjWUJlLUdnMURW UGpoWGpWSmtmaFZSendjJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5f bGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQWmg4QnY3cUlyTVVCNjVlYXBJX0puRSZhbXA7cj1uYTVGVnpCVFdtYW5xV055NERwY3R5WFBw dVlxUGtBSTFhTGNMTjRLWk5BJmFtcDttPWl5Vm5yWm1yOV91R0NRNk1EMHpGMnltUlFTNmxLNjd5 Rl84dThfcVNDX3cmYW1wO3M9T2UwcWZMRVg4M3Z0WE03V2wyY1lCZS1HZzFEVlBqaFhqVkprZmhW Unp3YyZhbXA7ZT08L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJyPg0KPGJyIGNsZWFyPSJhbGwiPg0KPG86cD48 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4tLQ0KPG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPlN1YnNjcmliZSB0byB0aGUNCjxhIGhyZWY9Imh0dHA6Ly9oYXJkdHdhcmUuY29t LyIgdGFyZ2V0PSJfYmxhbmsiPkhBUkRUV0FSRTwvYT4gbWFpbCBsaXN0IHRvIGxlYXJuIGFib3V0 IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiE8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxicj4NCjxiciBjbGVhcj0iYWxsIj4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1YnNjcmliZSB0byB0aGUgPGEg aHJlZj0iaHR0cDovL2hhcmR0d2FyZS5jb20vIiB0YXJnZXQ9Il9ibGFuayI+DQpIQVJEVFdBUkU8 L2E+IG1haWwgbGlzdCB0byBsZWFybiBhYm91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CY4PR21MB0504B87D31F6EB68C0D223E0F55F0CY4PR21MB0504namp_--
    Hi Adam

    Thanks for raising these points= . I think all of them will be covered in the agenda, but I will clarify whe= re they will be covered.

    The agenda is set up for = both management APIs to be presented, and then I have a slot for the WG to = discuss how to proceed.
    I expect the issues wrt. the SET document= will be addressed in the time allotted for SET, similarly for the "to= e" attribute.
    The authorization header I would expect to be = covered in the SET Delivery time slot.

    wrt. compos= ite object, that also should be discussed in the SET time slot -- I think t= he proposal is that subjects NOT be in SET, and that each profile defines h= ow subjects are represented.

    Phil: would you confi= rm you will be covering these topics in your slot on SET?

    Marius: same for the authorization header in the Delivery discussio= n?

    /Dick


    On Tue, Oct 31, 2017 at 12:20 AM= , Adam Dawes <adawes@google.com> wrote:
    Thanks for sending out the agenda.

    <= /div>
    From our perspective, there are two important issues that are blo= cking implementation and I think it would be very helpful to shift the agen= da a bit so we have more time to discuss these. It would be very beneficial= to implementors if we could resolve these issues so we can finish our serv= ices and start to receive operational feedback on the specs.=C2=A0
    • Management API resolution. We have two approaches (Phil's=C2=A0 and Marius/Ann= abelle's). The management API is the key to being able to scale our= implementation and start interop with multiple providers. Perhaps Phil and= Marius/Annabelle can each provide a summary of their drafts and we can hav= e try to reach consensus.
    • Single/multiple event per SET
      This is = currently being discussed on list and within RISC working group. It would b= e helpful to also nail this down to free up our engineers to build this rig= ht the first time instead of making a guessing and having the community lat= er choose differently.=C2=A0
    In addition, but less critically, we&= #39;d like to propose the following topics too:
    • "toe" = SET attribute
    • authorization header for push delivery
      • re= ceiver configures full authorization header as static/bearer header
      • composite subject claim defined in SET
        • present RISC appro= ach as example

    On Mon, Oct 30, 2017 at 2:39= PM, Dick Hardt <dick.hardt@gmail.com> wrote:
    = Hey Phil, Thanks! I'll slot you in for the SET slot. Let's see if o= ne of the other authors will do the Delivery.

    On Mon, Oct 30, 2017 at 2:32 PM, Phil Hunt (IDM) <<= a href=3D"mailto:phil.hunt@oracle.com" target=3D"_blank">phil.hunt@oracle.c= om> wrote:
    Dick,

    I believe= Mike won't be able to make the monday meeting. so Mike and I are worki= ng on a presentation for the current state of set that I will do.=C2=A0

    Not much has happened wit= h delivery other than removing verify event (because that was going in cont= rol plane). I can do that very quickly.=C2=A0

    <= /div>
    I do have concerns about config on control planes a= nd delivery streams when firewalls are involved. I will include a couple of= slides on this that may be important to control plane discussion.=C2=A0

    I can do my control plan= e ID draft proposal after marius/annabelle's. It will be similar to the= deck we discussed at the amazon hq f2f.=C2=A0
    <= font color=3D"#888888">

    Phil=

    On Oct 30, 2017, at 2:09 PM, Dick Hardt <dick.hardt@gmail.com> = wrote:


    -----
    IETF 100 Singapore
    Bras Basah Monday Nov 13, 2017, 13:30 - 15:30

    Ag= enda Setting=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 1= 3:30 - 13:40
    Security Event Token (SET)=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A013:40 - 14:00=C2=A0 =C2=A0
    = SET Delivery using HTTP=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A014:00 - 14:20=C2=A0
    Chair Slides on Managmen= t APIs=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Dick Hardt (chair)=C2=A0 =C2=A0 = =C2=A0 =C2=A0 14:20 - 14:30
    Management API for SET Event Streams= =C2=A0 =C2=A0 xxx=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A014:30 - 14:50=C2=A0
    SET Stream Managme= nt and Provisioning=C2=A0 =C2=A0Phil Hunt=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A014:50 - 15:10=C2=A0 =C2=A0=C2=A0
    Mana= gement API Discussion=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0Dick Hardt (chair)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:10 - 15:20
    AO= B=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Dick Hardt (chai= r)=C2=A0 =C2=A0 =C2=A0 =C2=A0 15:20 - 15:30






    --
    Subscribe to = the HARDTWARE mail = list to learn about projects I am working on!
    =

    Hi Phil

    Correct me if I am mis= understanding, but there is a RISC profile event 

    "=
http://schemas.openid.net/secevent/risc/event-type/account-credential-c=
hange-required    =E2=80=9D

    and an SCIM profile event

    "https://exam=
ple.com/scim/event/passwordResetExt=E2=80=9D

    I'm sugges= ting that two different events would be sent. Embedding one in the other doe= s not make sense.
    I started writing something very similar. What Dick says. = I totally support single events at this point, even though at the beginning= I was challenging this approach. We do have to formally define an extensio= n mechanism.

    Extension attributes could be simply merged= into the target event as in Dick's example.

    O= r, I think Annabelle suggested (if I understood correctly) that we could ha= ve a defined "extensions" attribute which is a dictionary with ke= ys being extension URIs and values being name/value pairs. In this case the= first event would look something like:
    {
    =C2=A0 "jti": &qu= ot;3d0c3cf797584bd193bd0fb1bd4e7d30",
    =C2=A0 "iat": 1458496025,
    =C2=A0 "iss": "= https://scim.example.com",
    =C2=A0 "aud": = [
    =C2=A0 =C2=A0 "https://jhub.= example.com/Feeds/5d7604516b1d08641d7676ee7"
    =C2=A0 =C2=A0],
    =C2=A0 =C2=A0"event": {=C2=A0=C2=A0
    =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0"id":"44f6142df96bd6ab61e75= 21d9",
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"extensions": = {
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"https://example.com/scim/event/pass= wordResetExt=E2=80=9D: {
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0"resetAttempts":5,
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0}
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}
    =C2=A0 =C2=A0 =C2=A0 =C2=A0}
    }

    =

    Marius

    On Mon, Oct 30, 2017 at 2:22 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:
    Hi Phil

    Correct me if I am misun= derstanding, but there is a RISC profile event=C2=A0

    "http://schemas.openid.net/secevent/risc/even=
t-type/account-credential-change-required=E2=80=9D

    and= an SCIM profile event

    I'm suggesting that two different events would be sent. Em= bedding one in the other does not make sense.

    = Also, I think it is simpler to have event_type be at the same level as even= t

    {
    =C2=A0 &qu= ot;jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
    =C2=A0 "iat": 145= 8496025,
    =C2=A0 "= iss": "htt= ps://scim.example.com",
    =C2=A0 "aud": [
    <= div>=C2=A0 =C2=A0],
    =
    =C2=A0 =C2=A0"event_type"= ;: "https://example.com/scim/event/passwordResetExt",=
    =C2=A0 =C2=A0"ev= ent": {=C2=A0=C2=A0
    =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"id":"44f6142df96b= d6ab61e7521d9",
    = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"resetAttempts":5
    <= span class=3D"">
    =C2=A0 =C2=A0 =C2= =A0 =C2=A0}
    }

    {
    =C2=A0 "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
    =C2=A0 &q= uot;iat": 1458496025,
    =C2=A0 "iss": "https://scim.example.com",
    =C2=A0 "aud": [
    =C2=A0 =C2=A0 "https://jh= ub.example.com/Feeds/98d52461fa5bbc879593b7754",<= /div>
    =C2=A0 =C2=A0],=
    =C2=A0 =C2=A0"event": {
    =C2=A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9C= sub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
    =C2=A0 =C2=A0 =C2=A0 =C2=A0=E2=80=9Ciss=E2=80=9D:= "https://idp.ex= ample.com/"=C2=A0 =C2=A0 =C2=A0 =C2=A0
    =C2=A0 =C2=A0 =C2=A0 =C2=A0}
    }




    <= /div>
    On Mon, Oct 30, 2017 at 12:09 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
    Annabelle/Dick,

    =
    Thanks for the comments. I think we need to examine the conseque= nces of the proposal in JSON.

    As I stated, what causes = most of the issue is the proposed extension mechanism in the payload (possi= bly using events in a recursive way). Does it follow the old format or the = new?

    Let=E2=80=99s =C2=A0consider a use case where we ha= ve an identity management system that uses SCIM, but the SCIM system is als= o the underlying data store for Connect.=C2=A0 A Password reset might gener= ate the following event which has an extension (conveying reset count) AND = overlapping statement from RISC.=C2=A0 BOTH of which might be important to = a similar receiver using SCIM and OIDC. =C2=A0

    = The 03 spec currently would allow:

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879=
593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641=
d7676ee7"
   ],
   "events": {
     "urn:ietf:params:scim:event:passwordReset":
       { "id":"44f6142df96bd6ab61e7521d9"},
     "https://example.com/scim/event/passwordResetExt"=
;:
       { "resetAttempts":5},
         "http://schemas.openid.net/sece=
vent/risc/event-type/\
    =C2=A0 =C2=A0 =C2=A0 =C2=A0account-credential=
-change-required": {
             =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=
=80=9D,
         =
    =E2=80=9Ciss=E2=80=9D:"https://idp.example.com=
/"
           }
  }
}

    =

    In the abov=
e - each payload is a =E2=80=98peer' and issued without preference by t=
he transmitter. The receiver can assign priority in its own context if that=
 matters.

    The new proposa=
l:

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879=
593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641=
d7676ee7"
   ],
   "event": {
     =E2=80=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:pas=
swordReset=E2=80=9D,
     "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
    =

         =E2=80=
=9Cevents=E2=80=9D:{
         ->note =E2=80=A6is this the old or new structure? &l=
t;-
      =
     "https://example.com/scim/event/passwordResetExt"=
;:
       =
      { "resetAttempts":5},
           "http://schemas.openid.net/sec=
event/risc/event-type/\
    =C2=A0 =C2=A0 =C2=A0   =C2=A0account-credent=
ial-change-required": {
             =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=
=E2=80=9D,
      =
       =E2=80=9Ciss=E2=80=9D:"=
https://idp.example.=
com/"
           }
         }
       =
}    
    }

    In the above, sub-events or extensions =
have a different format. The same complaint about the original stands.

    *OR* (=
if the receiver cares about RISC more).  Note that this leads to a triple n=
ested structure.

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879=
593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641=
d7676ee7"
   ],
   "event": {
         =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/even=
t-type/\
    =C2=A0 =C2=A0 =C2=A0       =C2=A0account-credential-=
change-required=E2=80=9D,
      =
    =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
       =
   =E2=80=9Ciss=E2=80=9D:"https://idp.example.com/=
=E2=80=9C,
          =E2=80=9Cevents=E2=80=9D:{
            "=
urn:ietf:params:scim:event:passwordReset":
        {=C2=A0
              "id":=E2=80=9D44f6142df96bd6ab61e7521d=
9=E2=80=9D,
              =E2=80=9Cevents=E2=80=9D:{
                 "https://exa=
mple.com/scim/event/passwordResetExt":
                   { "reset=
Attempts":5},  
              }      
            }
          }     

       }
}

    In the above, the extension is placed inside the event it extends. = It follows the old format (or should it follow the new?)
    = 
    *OR* Foll=
owing the top layer pattern of singular event  Note that this leads to a tr=
iple nested structure.

    {
  "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
  "iat": 1458496025,
  "iss": "https://scim.example.com",
  "aud": [
    "https://jhub.example.com/Feeds/98d52461fa5bbc879=
593b7754",
    "https://jhub.example.com/Feeds/5d7604516b1d08641=
d7676ee7"
   ],
   "event": {
         =E2=80=9Cevent_type=E2=80=9D:"http://schemas.openid.net/secevent/risc/even=
t-type/\
    =C2=A0 =C2=A0 =C2=
=A0       =C2=A0account-credential-change-required=E2=
=80=9D,
          =E2=80=9Csub=E2=80=9D:=E2=80=9D7375626A656374=E2=80=9D,
          =E2=80=9Ciss=E2=80=9D:&quo=
t;https://idp.example.com/=E2=80=9C,
          =E2=80=9Cevent=E2=80=9D:{
            =E2=80=
=9Cevent_type=E2=80=9D:"urn:ietf:params:scim:event:passwordReset=
=E2=80=9D,
            "id":=E2=80=9D44f6142df96bd6ab61e7521d9=E2=80=9D,
            =E2=80=9Cevent=E2=80=9D:{
              =E2=80=9Cevent_type=E2=
=80=9D:"https://example.com/scim/event/passwordResetExt=E2=80=9D,
              "resetAttempts":5 
          }     <=
font size=3D"3">

       }
}

    This format follo= ws the proposed singular event format recursively and is 3 layers deep. Not= e that the parser has to continue to search the document for things that ar= en=E2=80=99t there as it has to stop when no =E2=80=9Cevent=E2=80=9D attrib= ute is found rather than iterate over an array.


    On Oct 30, 2017, at 8:57 AM, Richard Backman, Annabelle <= ;richanna@amazon.c= om> wrote:

    Replies inline.
    =C2= =A0
    --=C2=A0
    Annabelle Richard Backman
    Identity Se= rvices
    =C2=A0
    =
    =C2=A0
    From:=C2=A0Phil Hunt <phil.hunt@oracle.com>
    Date:=C2=A0S= unday, October 29, 2017 at 5:25 PM
    To:=C2=A0Dick Hard= t <dick.hardt@gmail.com>
    Cc= :=C2=A0Yaron Sheffer <y= aronf.ietf@gmail.com>, Mike Jones <Michael.Jones@microsoft.com>, "Richard Backman, Annabe= lle" <richanna@amazon.com>, I= D Events Mailing List <id-event@ietf.org>
    Subject:=C2=A0Re: [Id-event] Use cases for mult= iple events per SET?
    My =E2=80=9Cmay=E2=80=9D was because I can=E2=80=99t see a reas= on why not. The question should be, what is the justification to make =E2= =80=9Cevents=E2=80=9D singular?
    [richanna]The singular =E2=80=9Cevent=E2=80=9D clai= m has clearer semantics and is easier to process. We should opt for easier = solutions unless there are use cases that require more complexity.[/richann= a]
    Additionally, since the signa= ture is over the SET and not the event objects, Receivers independently rou= te separate events from a single token without either losing the ability to= verify the authenticity of the event or sharing all information in the SET= with every system handling any event in the token.[/richanna]
    3.=C2=A0 A new profile defines new event attributes to be added = on to an existing event type (a pure extension)=C2=A0
    [richanna]I have suggested a way to support extensions = within an event body, multiple times now. If you see problems with it, plea= se point them out.[/richanna]
    1. It results in a more complex= structure for the single event use case, which I think we all agree is the= majority use case.
    2. Multiple-eve= nt SETs have ambiguous semantics. The presence of two events A and B in the= same SET could mean any of:
      1. They are= related to the same logical event (i.e. the same thing as if they were fro= m different SETs that have a common txn).
      2. A is an extension of B.
      3. B is an extension of A.
      4. They a= re aliases for one another.
      5. They= are not actually related to one another in any way.
      1. Claim semantics become harder to define, as diffe= rent profiles may want to use the same claims in different ways.<= /u>
    =C2=A0
    On Oct 29, 2017, at 4:= 12 PM, Dick Hardt <dick.hardt@gmail.com<= /a>> wrote:
    =C2=A0
    Phil:
    =C2=A0
    In your examples for having a plurality of events, you use the w= ord "may", which leads me to question if a plurality of events is= really required in SET.
    =C2=A0
    You posit that it will be difficult for a distri= buted system to correlate multiple SETs with the same "txn", but = the distributed system will certainly need to correlate events on the same = subject -- correlating events on the same "txn" on the same subje= ct seems fairly simple.
    =C2=A0=
    I think that a receiver will need to correlate mu= ltiple SEts on the same subject, so having multiple events in a SET is redu= ndant, and adds complexity with no clear benefit that I can see.<= /u>
    =C2=A0
    An imple= mentor may choose to send multiple SETs, or send a single SET with multiple= events, so a receiver will need to support both. I prefer we pick one way = and minimize the code paths, and we will need to support correlating across= multiple SETs, so that seems the best mechanism.
    =C2=A0
    Let me know if there is= something I missed in my logic.
    = =C2=A0
    /Dick
    =C2=A0
    =C2=A0
    In that case, let's add text to that effect, e.g. we could add = to the definition of the "events" claim:

    Profiling specifi= cations SHOULD define the allowed event statements, and MAY restrict their = number. For example, some profiles may require this claim to contain only a= single event statement.

    Thanks,
    =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0    Yaron

    On 24/10/17 22:10, Mike Jones wrote:

    <= span style=3D"font-size:9pt;font-family:Helvetica,sans-serif">I agree with = much of Phil=E2=80=99s rationale here.

    It=E2=80=99s fine for some pr= ofiles to say that the =E2=80=9Cevents=E2=80=9D set must be a singleton.=C2= =A0 That doesn=E2=80=99t have to be true for all events.=C2=A0 I think thin= gs are fine as-is.

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- Mike
    *From:* Id-event [mailto:id-event= -bounces@ietf.org] *On Behalf Of *Phil Hunt
    *Sent:* Monday, Oct= ober 23, 2017 8:47 PM
    *To:* Richard Backman, Annabelle <richanna@amazon.com>
    *Cc:* ID Events Mailing Li= st <id-event@ietf.org>
    *Subject:*= Re: [Id-event] Use cases for multiple events per SET?

    Annabelle,
    I have a number of concerns with this proposal.

    Profiling Indep= endence / Keeping Event Payloads Independent

    Indicating that extensi= ons should be handled by profiles leads to more inter-operability issues an= d more importantly intrudes on the Event payload space by suggesting a sub-= schema creates potential limitations and conflicts that may add to complexi= ty later on. The current format allows a parser to discover and unload one = or more JSON payloads which can each have independent structure.

    Gen= eral extensions

    The proposal also rules out general purpose extensio= ns not related to any specific event. Given the emergence of items like GPR= D, I would not want to block the ability to add meta-data or other general = purpose items. We can also anticipate some delivery scenarios where additio= nal data might be required. Even though there is no current planned use, I = see no good reason to rule this out.

    Multiple Events From Different = Families (vs. Multiple Events from a single family like RISC)

    In our= RISC session we discussed expressing multiple distinct RISC events in one = SET. The discussion was that only one RISC event at a time. We did not disc= uss other event profiles. I don=E2=80=99t see a reason to rule out multi-ev= ents from different families at the SET level. Each profile is expressing s= lightly different things about the same event.

    I can forsee some cas= es where it is not clear which is the primary and which is the extension.= =C2=A0 There may not be a clear winner.

    A couple of examples (these = are necessarily real=E2=80=A6just possibilities):

    * It is probably u= seful to be able to express simlar/overlapping events from different SET pr= ofiles in one SET.=C2=A0 For example a Backchannel Logout & a RISC sess= ion cancel event.

    * SCIM may want to represent a single transaction = as causing multiple state changes in an event (e.g. a password change cause= s multiple effects). Having to chase down multiple events and correlate by = =E2=80=9Ctxn=E2=80=9D would be challenging in a multi-threaded/multi-node d= elivery system.=C2=A0 =C2=A0The SCIM list has not discussed this, but I wou= ld not want to block this capability.=C2=A0 IOW - Just because RISC does no= t want to express multiple events does not make this true for other profile= s.

    * We may wish to indicate a SCIM Password Reset was performed and= a Logout/session cancellation is expressed at the same time.=C2=A0 The eve= nts are related but express different data.

    Avoiding Confusion From = Similar Events Originating from the Same Transaction

    If events are s= ent separately, then more tracking of state (e.g. by txn) would be required= to ensure similar events are not mistaken or handled as repeats. While txn= provides useful audit analysis capability, I=E2=80=99m not sure it can be = used in live or near-real time systems given distributed multi-node, multi-= threading architectures.

    Previous Discussion

    I note that I or= iginally raised having an attribute to designate primary event attribute to= alleviate your concern, but this was not accepted. See:

    *=C2= =A0https://w= ww.ietf.org/mail-archive/web/id-event/current/msg00406.html
    *=C2=A0https://www.ietf.org/mail-archive/web/id-event/current/msg0= 0140.html

    The consensus, at least as I interpreted it is up to t= he receiver to figure this out based on the definitions it has for each eve= nt URI and the profiles they represent. IOW - RISC is free to limit that on= ly one RISC event be expressed at a time.

    Phil

    Oracle Corpora= tion, Identity Cloud Services Architect

    @independentid

    www.independentid.com=C2=A0<http://www.independentid.com>

    phil= .hunt@oracle.com=C2=A0<mailto:phil.hunt@oracle.com>

    =C2=A0 =C2=A0 On Oct 23, 201= 7, at 7:02 PM, Richard Backman, Annabelle
    =C2=A0 =C2=A0 <richanna@amazon.com=C2=A0<mailto:richanna@amazon.com>> wrote:
    <= br>=C2=A0 =C2=A0 The current draft of the SET spec allows for expressing mu= ltiple
    =C2=A0 =C2=A0 events within the same token, which introduces addi= tional complexity
    =C2=A0 =C2=A0 and room for ambiguous semantics. We=E2= =80=99ve discussed this in the OIDF
    =C2=A0 =C2=A0 RISC working group and= the current consensus there is that RISC will
    =C2=A0 =C2=A0 require tha= t RISC events must be the only event in the SET, having
    =C2=A0 =C2=A0 id= entified ways to clearly and easily support the handful of use
    =C2=A0 = =C2=A0 cases for multiple events per token that people have raised. With=C2=A0 =C2=A0 that context in mind, I propose striking the definition of t= he
    =C2=A0 =C2=A0 =E2=80=9Cevents=E2=80=9D claim from the Security Event = Token spec, and replacing it
    =C2=A0 =C2=A0 with the following definition= for an =E2=80=9Cevent=E2=80=9D claim (singular):

    =C2=A0 =C2=A0 even= t

    =C2=A0 =C2=A0 A JSON object containing an "event_type" m= ember whose value is a URI
    =C2=A0 =C2=A0 representing a type of event de= fined in a Profiling Specification.
    =C2=A0 =C2=A0 The object MAY otherwi= se be empty, or MAY contain additional members
    =C2=A0 =C2=A0 as describe= d by the Profiling Specification.

    =C2=A0 =C2=A0 Here is the example = SET from section 2.3, rewritten with this change
    =C2=A0 =C2=A0 mind:
    =
    =C2=A0 =C2=A0=C2=A0{

    =C2=A0 =C2=A0 =C2=A0=C2=A0 &quo= t;jti": "4d3559ec67504aaba65d40b0363faad8",

    =C2= =A0 =C2=A0 =C2=A0=C2=A0 "iat": 1458496404,

    =C2=A0 =C2=A0 = =C2=A0=C2=A0"iss": "https://sc= im.example.com=C2=A0<https://scim.example.com/>",

    =C2=A0 =C2=A0 =C2=A0=C2=A0 = "aud": [

    =C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.examp= le.com/Feeds/98d52461fa5bbc879593b7754",

    =C2=A0 = =C2=A0 =C2=A0=C2=A0 =C2=A0=C2=A0"https://scim.example.com/Feeds/5d7604516b1d086= 41d7676ee7"

    =C2=A0 =C2=A0 =C2=A0=C2=A0 ],

    =C2=A0 =C2= =A0 =C2=A0=C2=A0 "event": {

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2= =A0=C2=A0 "event_type": "urn:ietf:params:scim:event:cre= ate",

    =C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "ref": &= quot;https://s= cim.example.com/Users/44f6142df96bd6ab61e7521d9",

    =C2= =A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0 "attributes": ["id"= , "name", "userName", "password", "email= s"]

    =C2=A0 =C2=A0 =C2=A0=C2=A0 }

    =C2=A0 =C2=A0 }

    = =C2=A0 =C2=A0 Does anyone in the working group have use cases for SETs that= cannot
    =C2=A0 =C2=A0 be met by this proposed text? Within RISC, we iden= tified three use
    =C2=A0 =C2=A0 cases, with solutions outlined below:
    =
    =C2=A0 =C2=A0 **

    =C2=A0 =C2=A0 *Extensions*

    =C2=A0 =C2=A0= Event extension mechanisms can be defined internal to the event
    =C2=A0 = =C2=A0 object. A simple approach would be to =C2=A0define an =E2=80=9Cexten= sions=E2=80=9D member
    =C2=A0 =C2=A0 that is a list of event objects (or = set resembling the =E2=80=9Cevents=E2=80=9D
    =C2=A0 =C2=A0 claim as defin= ed in the current spec). This has the advantage of
    =C2=A0 =C2=A0 making = it clear in the data structure that there is a single primary
    =C2=A0 =C2= =A0 event, with zero or more extensions. There is no room for confusion
    = =C2=A0 =C2=A0 over which event is primary, or if there is a primary event a= t all.
    =C2=A0 =C2=A0 I would be fine with adding something like this to = my proposed text,
    =C2=A0 =C2=A0 if there is consensus that it is broadly= useful.

    =C2=A0 =C2=A0 *Aliases*

    =C2=A0 =C2=A0 This use case = was brought up in the context of migrating clients
    =C2=A0 =C2=A0 from dr= aft event names to standardized event names. In this case,
    =C2=A0 =C2=A0= the event transmitter can transmit two tokens for the logical event,
    = =C2=A0 =C2=A0 one using the old name and another using the new name.
    =C2=A0 =C2=A0 *Related Events*

    =C2=A0 =C2=A0 The SET spec defines t= he txn claim as a means of correlating
    =C2=A0 =C2=A0 independent tokens = that relate to the same logical event.

    =C2=A0 =C2=A0 --=C2=A0=
    =C2=A0 =C2=A0 Annabelle Richard Backman

    =C2=A0 =C2=A0 Ama= zon =E2=80=93 Identity Services

    =C2=A0 =C2=A0 ______________________= _________________________
    =C2=A0 =C2=A0 Id-event mailing list
    = =C2=A0 =C2=A0=C2=A0Id-event@ietf= .org=C2=A0<mailto:Id-e= vent@ietf.org>
    =C2=A0 =C2=A0=C2=A0https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__ww= w.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP= 1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0Fk= ITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Ds5byBe5KANnGVuAb1mAupEGoJn8XG= 5JIUUwWGFSibEc&s=3DX8oRSq3IzlF7jiRAeZhXpR3eVI0I58ZFd4eEZfgyoI= Y&e=3D



    ________________________________________= _______
    Id-event mailing list
    Id-event@i= etf.org
    https://www.ietf.org/mailm= an/listinfo/id-event


    ______= _________________________________________
    Id-event mailing list
    = Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event<= u>


    =C2=A0
    --=C2=A0=
    Subscribe to the= =C2=A0HARDTWARE=C2=A0mail list to learn about p= rojects I am working on!
    =
    _______________________________________________
    Id-= event mailing list
    Id-event@ietf.org<= span style=3D"font-size:9pt;font-family:Helvetica,sans-serif">
    https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3= A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c= =3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=3Dna5FVzBTWm= anqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=3DYBCGlK9mjjhcFsj-2tDkn31= Auxuruib9KATkRlQG1iw&s=3DWrMuQRwLV802iMQ4wYB1f2rFUGu4zbhcW001= fK02EXs&e=3D
    =C2=A0
    _______________________________________________
    Id-event mailing list=
    Id-event@ietf.org
    https://urldefense.p= roofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_= id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PZh8Bv7qIrM= UB65eapI_JnE&r=3Dna5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&= amp;m=3DU-a5HBND0HaTX4anNZfzX7pDsfK5f0h9mZ9CZkkGiec&s=3Drvdrt= I7rYNRAnqZDltCwBAZVHKp-MJ20ui2nm46QSz0&e=3D

    <= br>

    --
    Subscribe to the HARDTWARE mail list to learn about p= rojects I am working on!

    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.org/mailman/listinfo/id-event


    Marius

    On Wed, Oct 25, 2017 at 1:56 PM, Phil Hunt (= IDM) <phil.hunt@oracle.com> wrote:
    In some cases, ordering of events agai= nst a single subject matters. Time is useful for this purpose though limite= d in the overall stream for ordering events overall.=C2=A0

    For example account locked vs unlocked. Knowi= ng what happened last would seem important no?

    Phil

    On Oct 25, 2017, at 1:46 PM, Marius Scurtescu <mscurtescu@google.co= m> wrote:

    On Wed, Oct 25, 20= 17 at 11:09 AM, Phil Hunt <phil.= hunt@oracle.com> wrote:
    It is not clear how to revise the document= with regards to the suggestion against using =E2=80=9Ciat=E2=80=9D when = =E2=80=9Ctoe=E2=80=9D is not asserted.=C2=A0

    If I remove= this clarification, it seems unclear what the time of the event is defined= as.=C2=A0 There seem to be two options:

    A. If =E2=80=9C= iat=E2=80=9D can=E2=80=99t be assumed to be the time of event, then =E2=80= =9Ctoe=E2=80=9D should be a required claim.
    <= div>
    Why? Why can't the Transmitter assert that an accoun= t was disabled and not provide a specific event time? I understand that an = event time is desirable, but why required?

    =C2=A0<= /div>

    B. For the majority of use cases, =E2=80=9Ciat=E2=80= =9D is commonly used to mark SET issuance and event time. =C2=A0=E2=80=9Cto= e=E2=80=9D is only needed when the time of the event is different (on an ex= ceptional basis).

    If SET = issuance and event time are indeed the same then both claims should be pres= ent. I don't think iat should imply toe.
    =C2=A0
    <= br>
    Some clarification from the group would be appreciated.=C2=A0= Should we proceed with B, or revise the text to A (or some other proposal)= .

    Thanks,

    Ph= il

    Oracle Corporation, Identity Cloud Services Arc= hitect
    @independentid
    phil.hunt@oracle.com

    On Oct 23, 2017, at 6:15 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

    On Mon, Oct 23, 2017 at 6:04 PM= , Richard Backman, Annabelle=C2=A0<richanna@a= mazon.com>=C2=A0wrote:
    =

    Agreed overall. Having reread the propos= ed text, I suggest striking the last sentence, =E2=80=9CWhen not asserted, = the value of =E2=80=9Ctoe=E2=80=9D MAY be assumed to be the value of =E2=80= =9Ciat=E2=80=9D.=E2=80=9D I do not think it is necessary or particularly he= lpful to standardize the semantics of a missing time-of-event claim at the = SET level.


    +1
    =C2=A0

    =C2=A0

    --=C2=A0

    = = Annabelle Richard Backman

    Am= azon =E2=80=93 Identity Services

    =C2=A0

    =C2=A0<= /u>

    <= b>From:=C2=A0Id-event <id-event-bounces@ietf.org> on= behalf of "Phil Hunt (IDM)" <phil.hunt@oracle.com>
    = Date:=C2=A0Monday, October 23, 2017 at 5:48 PM
    To:=C2=A0    Mike Jones <Michael.Jones@microsoft.com>=
    Cc:=C2=A0Brian Campbell <bcampbell@pingidenti= ty.com>, ID Events Mailing List <id-event@ietf.org>


    Subj= ect:=C2=A0Re: [Id-event] Replacing "nbf" claim w= ith a new "toe" claim

    =

    =C2=A0

    Agreed +1 on Brian's edits.=C2=A0

    Phil

    =


    On Oct 2= 3, 2017, at 5:05 PM, Mike Jones <Michael.Jones@microsoft.com>= wrote:

    A= nnabelle and I agreed with this proposed change (as correctly wordsmithed b= y Brian) during our in-person review =E2=80=93 as also noted in the reply t= o Marius=E2=80=99 comments.

    = =C2=A0

    =C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0Thanks Phil and all,

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0-- = Mike

    =C2=A0

    From:<= /b>=C2=A0Id-event [mailto:id-event-bounces@ietf.org= ]=C2=A0On Behalf Of=C2=A0Brian CampbellSent:=C2=A0Thursday, September 28, 2017 8:23 AM
    = To:=C2=A0Phil Hunt <phil.hunt@oracle.com>
    Cc:= =C2=A0ID Events Mailing List <id-event@ietf.org>
    Subject:    =C2=A0Re: [Id-event] Replacing "nbf" cl= aim with a new "toe" claim

    =C2=A0

    +1 to SET defining a time of event claim rather than tryi= ng to redefine a standard claim. And who doesn't like a claim named &qu= ot;toe"?

    However, the text there for nbf is still effectively redefini= ng it by saying it should be ignored, which isn't consistent with the &= quot;MUST NOT be accepted for processing" from RFC 7519. It would be m= ore appropriate to say that nbf should/must not be included in a SET. Or ju= st not mention nbf at all. But don't change the meaning.<= /p>

    Also toe would not be "Defined by Sect= ion 4.1.5 [RFC7519]", which is the nbf section. The value of the toe c= laim is a NumericDate, which is defined in Sec 2 RFC7519. But toe has no re= lation to nbf and no reason to reference nbf.=C2=A0

    =

    =C2=A0

    On Wed, Sep 27, 2017 at 2:53 PM, Phil Hunt <phil.hunt@oracle.com&g= t; wrote:

    During t= he OpenID RISC Face to Face meeting a question came up regarding SET=E2=80= =99s redefinition of =E2=80=9Cnbf=E2=80=9D and whether that redefinition wa= s appropriate.

    =C2=A0

    The intention of SETs definition= is to allow SET Transmitters to indicate that an event may have occurred a= s early as a specified date =E2=80=94 a date which is different from the is= suance date of the SET. In particular this is useful in cases where the sta= te change is believed to have occurred earlier than the time of issuance (e= .g. because the incident was discovered through an administrative review or= data analysis to have occurred in the past).

    <= p class=3D"MsoNormal">=C2=A0

    The definition from JWT is:

    4.1.5.=C2=A0 "nbf" (Not Before) Claim

    =C2=A0
    =C2=A0
    =C2=A0=C2=
=A0 The "nbf" (not before) claim identifies the time before which=
 the JWT
    =C2=A0=C2=A0 MUST NOT be accepted for proc=
essing.=C2=A0 The processing of the "nbf"
    =C2=A0=C2=A0 claim requires that the current date/time MUST be after or eq= ual to
    =C2=A0=C2=A0 the not-before date/time listed=
 in the "nbf" claim.=C2=A0 Implementers MAY
    =C2=A0=C2=A0 provide for some small leeway, usually no more than a few m= inutes, to
    =C2=A0=C2=A0 account for clock skew.=C2=
=A0 Its value MUST be a number containing a
    =C2=A0=
=C2=A0 NumericDate value.=C2=A0 Use of this claim is OPTIONAL.

    =C2=A0

    =C2=A0

    As defined in SET:

    =C2=A0=C2=A0 nbf=

    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Secti=
on=C2=A04.1.5 [RFC7519], a number whose value is a
    <= pre>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 In the context of the= SET token it SHALL be
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 interpreted to mean a date in which the event is believed to have
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occurred (in the past) or=
 will occur in the future.=C2=A0 Note: there
    =C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 MAY be some cases where "nbf" is still s=
maller than "iat" such as
    =C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 when it took an extended time for a SET to be issued (for e=
xample
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 after some an=
alysis).=C2=A0 This claim is OPTIONAL.

    =C2=A0

    = There is an argument that the redefinition will cause confusion.=C2=A0

    =C2=A0

    The proposal is to register a different claim= name such as =E2=80=9Ctoe=E2=80=9D (time of event). The proposed new

    definition:

    =

    =C2=A0

    t=
oe
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Defined by Sect=
ion=C2=A04.1.5 [RFC7519], a number whose value is a
    = 
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NumericDate.=C2=A0 The value is the dat=
e and time in which the event is believed to have
    =
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 occurred in the past or will occur in the fu=
ture. This claim is OPTIONAL.
    =C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 When not asserted, the value of =E2=80=9Ctoe=E2=80=9D MAY be assu=
med to be the value of =E2=80=9Ciat=E2=80=9D.
    =C2=
=A0
    nbf
    =C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 This claim is not used in SET Events. If asserted, the value S=
HOULD
    =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 be ignored.=

    =C2=A0

    =

    =C2=A0

    Are there any objections to the proposed change?=

    =C2=A0

    Phil

    =

    =C2=A0

    Oracle Corporation, Identity Cloud Serv= ices Architect

    @independentid

    phil.hunt@oracle.com

    =C2=A0


    ___________________________________= ____________
    Id-event mailing list
    Id-event@ietf.org
    https://www.ietf.o= rg/mailman/listinfo/id-event

    <= p class=3D"MsoNormal">=C2=A0

    =
    CONFIDENTIALITY NOT= ICE: This email may contain confidential and privileged material for the so= le use of the intended recipient(s). Any review, use, distribution or discl= osure by others is strictly prohibited.=C2=A0 If you have received this com= munication in error, please notify the sender immediately by e-mail and del= ete the message and any file attachments from your computer. Thank you.


    ______= _________________________________________
    Id-event mailing list
    = Id-eve= nt@ietf.org
    https://www.ietf.org/mailman/listin= fo/id-event


    _______________________________________________
    Id-event mailing list
    Id-event@ietf.org
    https://urldefense= .proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinf= o_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5= YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIG= k&m=3DXFb85vuDk0h3Ygd5qlx4iuR7LR7evV_BU0fLL05dXBM&s=3D-zJ= LNs_G_PXMbtuyAAo5KSnqZau4BHf7-JFfe7mYpBY&e=3D