all: children: controllers: hosts: controller: null zuul_unreachable: hosts: {} hosts: controller: ansible_connection: ssh ansible_host: 199.19.213.139 ansible_port: 22 ansible_python_interpreter: auto ansible_user: zuul cilium_helm_values: operator: replicas: 1 cilium_ipv4_cidr: 172.24.0.0/16 kube_vip_address: 172.17.0.100 kube_vip_interface: '{{ ansible_facts[''default_ipv4''].interface }}' kubernetes_hostname: '{{ ansible_facts[''default_ipv4''].address }}' kubernetes_version: 1.28.13 molecule_install_collection_siblings: true molecule_scenario: secretgen-controller nodepool: az: nova cloud: public external_id: e7cc53c5-f560-45b2-b2f2-068f4ea60a6d host_id: f373a28d302a4990c6af48a982661c254feecb826df4c059c9d84662 interface_ip: 199.19.213.139 label: ubuntu-noble node_properties: {} private_ipv4: 199.19.213.139 private_ipv6: null provider: yul1 public_ipv4: 199.19.213.139 public_ipv6: 2604:e100:1:0:f816:3eff:fe38:5469 region: ca-ymq-1 slot: null zuul_node: az: nova cloud: public external_id: e7cc53c5-f560-45b2-b2f2-068f4ea60a6d host_id: f373a28d302a4990c6af48a982661c254feecb826df4c059c9d84662 interface_ip: 199.19.213.139 label: ubuntu-noble node_properties: {} private_ipv4: 199.19.213.139 private_ipv6: null provider: yul1 public_ipv4: 199.19.213.139 public_ipv6: 2604:e100:1:0:f816:3eff:fe38:5469 region: ca-ymq-1 slot: null uuid: null vars: cilium_helm_values: operator: replicas: 1 kubernetes_version: 1.28.13 molecule_install_collection_siblings: true molecule_scenario: secretgen-controller zuul: _inheritance_path: - '' - '' - '' - '' - '' ansible_version: '9' attempts: 1 branch: main build: df925605a75e40088f795833ad47c03e build_refs: - branch: main change: '105' change_message: "chore(deps): update helm release cert-manager to v1.21.1\n\n> \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.21.1` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.21.1`](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n### [`v1.21.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.21.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\ncert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values \u2014 review them carefully before upgrading.\n\n#### Known Issues\n\n- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` \u2014 `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#​9031](https://redirect.github.com/cert-manager/cert-manager/issues/9031) for details.\n- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#​8407](https://redirect.github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`\"OnAdd missing Object\"`, `\"OnUpdate missing ObjectOld\"`, `\"OnDelete missing Object\"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** \u2014 the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#​8994](https://redirect.github.com/cert-manager/cert-manager/issues/8994) for details.\n- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation \u2014 the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#​9036](https://redirect.github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal.\n\n#### Major Themes\n\n##### Default `tokenrequest` RBAC removed from Helm chart\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC \u2014 the Route53 docs section that motivated it was removed in 2024.\n\nIf you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended \u2014 see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).\n\n##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole\n\n> \u26A0\uFE0F Potentially breaking change\n\nThe `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers.\n\nThis change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.\n\n##### Metrics port name and path Helm values removed\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade \u2014 remove them before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952))\n\n##### ACME and Certificate Management\n\n- **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798))\n- **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858))\n- **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422))\n- **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258))\n- **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893))\n- **Modern2026 [PKCS#12](https://redirect.github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841))\n- **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464))\n\n##### Gateway API and cainjector\n\n- **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: \"true\"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749))\n- **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727))\n- **Additional listener protocols**: configurable listener protocols beyond the default set. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683))\n- **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732))\n- **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583))\n- **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692))\n- **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614))\n\n##### Deployment and Observability\n\n- **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779))\n- **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976))\n- **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523))\n- **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761))\n\n##### Notable Bug Fixes\n\n- **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947))\n- **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610))\n- **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760))\n- **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803))\n- **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930))\n- **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255))\n\n#### Community\n\nAs always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.\n\nA special thanks to:\n\n- [@​Copilot](https://redirect.github.com/Copilot)\n- [@​FelixPhipps](https://redirect.github.com/FelixPhipps)\n- [@​Peac36](https://redirect.github.com/Peac36)\n- [@​SebTardif](https://redirect.github.com/SebTardif)\n- [@​apkatsikas](https://redirect.github.com/apkatsikas)\n- [@​bitloi](https://redirect.github.com/bitloi)\n- [@​dap0am](https://redirect.github.com/dap0am)\n- [@​figaw](https://redirect.github.com/figaw)\n- [@​immanuwell](https://redirect.github.com/immanuwell)\n- [@​jabbrwcky](https://redirect.github.com/jabbrwcky)\n- [@​jnohlgard](https://redirect.github.com/jnohlgard)\n- [@​jsoref](https://redirect.github.com/jsoref)\n- [@​ltwongaa](https://redirect.github.com/ltwongaa)\n- [@​lunarwhite](https://redirect.github.com/lunarwhite)\n- [@​mateenali66](https://redirect.github.com/mateenali66)\n- [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari)\n- [@​putongyong](https://redirect.github.com/putongyong)\n- [@​seanorama](https://redirect.github.com/seanorama)\n- [@​texasich](https://redirect.github.com/texasich)\n\nfor their contributions, comments and support!\n\nAlso, thanks to the cert-manager maintainer team for their help in this release:\n\n- [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish)\n- [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot)\n- [@​erikgb](https://redirect.github.com/erikgb)\n- [@​hjoshi123](https://redirect.github.com/hjoshi123)\n- [@​inteon](https://redirect.github.com/inteon)\n- [@​maelvls](https://redirect.github.com/maelvls)\n- [@​munnerz](https://redirect.github.com/munnerz)\n- [@​wallrj](https://redirect.github.com/wallrj)\n- [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)\n\nAnd finally, thanks to the cert-manager steering committee for their feedback in this release cycle:\n\n- [@​FlorianLiebhart](https://redirect.github.com/FlorianLiebhart)\n- [@​TrilokGeer](https://redirect.github.com/TrilokGeer)\n- [@​ianarsenault](https://redirect.github.com/ianarsenault)\n- [@​ssyno](https://redirect.github.com/ssyno)\n\n#### Changes since v1.20.0\n\n##### Feature\n\n- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858), [@​wallrj](https://redirect.github.com/wallrj))\n- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [@​jsoref](https://redirect.github.com/jsoref))\n- Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976), [@​erikgb](https://redirect.github.com/erikgb))\n- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523), [@​dap0am](https://redirect.github.com/dap0am))\n- Added ARI support through the ACMEUseARI feature gate. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422), [@​bitloi](https://redirect.github.com/bitloi))\n- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841), [@​seanorama](https://redirect.github.com/seanorama))\n- Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614), [@​figaw](https://redirect.github.com/figaw))\n- Disabled client side rate-limiting if AP\\&F is enabled. ([#​8757](https://redirect.github.com/cert-manager/cert-manager/issues/8757), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Adding certificate renewal policies ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692), [@​erikgb](https://redirect.github.com/erikgb))\n- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#​8927](https://redirect.github.com/cert-manager/cert-manager/issues/8927), [@​jabbrwcky](https://redirect.github.com/jabbrwcky))\n- Promote the CAInjectorMerging feature gate to GA ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583), [@​Copilot](https://redirect.github.com/Copilot))\n- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: \"true\"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749), [@​apkatsikas](https://redirect.github.com/apkatsikas))\n\n##### Bug or Regression\n\n- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#​7213](https://redirect.github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#​8931](https://redirect.github.com/cert-manager/cert-manager/issues/8931), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760), [@​texasich](https://redirect.github.com/texasich))\n- Add dns issuer secrets validation before marking it as ready ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255), [@​Peac36](https://redirect.github.com/Peac36))\n- Add missing issuer finalizer RBAC to the order controller to support owner references ([#​8654](https://redirect.github.com/cert-manager/cert-manager/issues/8654), [@​erikgb](https://redirect.github.com/erikgb))\n- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#​8822](https://redirect.github.com/cert-manager/cert-manager/issues/8822), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808). ([#​8843](https://redirect.github.com/cert-manager/cert-manager/issues/8843), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#​8651](https://redirect.github.com/cert-manager/cert-manager/issues/8651), [@​mateenali66](https://redirect.github.com/mateenali66))\n- Fix webhook serving certificate not being renewed after system suspend. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#​8962](https://redirect.github.com/cert-manager/cert-manager/issues/8962), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8619](https://redirect.github.com/cert-manager/cert-manager/issues/8619), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610), [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari))\n- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#​8821](https://redirect.github.com/cert-manager/cert-manager/issues/8821), [@​wallrj](https://redirect.github.com/wallrj))\n- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803), [@​SebTardif](https://redirect.github.com/SebTardif))\n- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#​8813](https://redirect.github.com/cert-manager/cert-manager/issues/8813), [@​immanuwell](https://redirect.github.com/immanuwell))\n- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#​8753](https://redirect.github.com/cert-manager/cert-manager/issues/8753), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8664](https://redirect.github.com/cert-manager/cert-manager/issues/8664), [@​jnohlgard](https://redirect.github.com/jnohlgard))\n- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#​8958](https://redirect.github.com/cert-manager/cert-manager/issues/8958), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8743](https://redirect.github.com/cert-manager/cert-manager/issues/8743), [@​erikgb](https://redirect.github.com/erikgb))\n- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#​8577](https://redirect.github.com/cert-manager/cert-manager/issues/8577), [@​putongyong](https://redirect.github.com/putongyong))\n- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- API cleanup: removed deprecated ObjectReference ([#​8625](https://redirect.github.com/cert-manager/cert-manager/issues/8625), [@​inteon](https://redirect.github.com/inteon))\n- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952), [@​erikgb](https://redirect.github.com/erikgb))\n- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Update base images to Debian 13 ([#​8849](https://redirect.github.com/cert-manager/cert-manager/issues/8849), [@​ltwongaa](https://redirect.github.com/ltwongaa))\n\n### [`v1.20.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.\n\nAll users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8940](https://redirect.github.com/cert-manager/cert-manager/issues/8940), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8759](https://redirect.github.com/cert-manager/cert-manager/issues/8759), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.26.3, other deps to fix several govulncheck issues ([#​8789](https://redirect.github.com/cert-manager/cert-manager/issues/8789), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8926](https://redirect.github.com/cert-manager/cert-manager/issues/8926), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.20.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config`\nand `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies\nto address reported vulnerabilities.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8665](https://redirect.github.com/cert-manager/cert-manager/issues/8665), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8704](https://redirect.github.com/cert-manager/cert-manager/issues/8704), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.26.2 ([#​8703](https://redirect.github.com/cert-manager/cert-manager/issues/8703), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).\n\n##### Bug or Regression\n\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8658](https://redirect.github.com/cert-manager/cert-manager/issues/8658), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#​8655](https://redirect.github.com/cert-manager/cert-manager/issues/8655), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#​8657](https://redirect.github.com/cert-manager/cert-manager/issues/8657), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.\n\n##### Changes by Kind\n\n##### Feature\n\n- Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#​8370](https://redirect.github.com/cert-manager/cert-manager/issues/8370), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#​8256](https://redirect.github.com/cert-manager/cert-manager/issues/8256), [@​tareksha](https://redirect.github.com/tareksha))\n- Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#​8186](https://redirect.github.com/cert-manager/cert-manager/issues/8186), [@​mathieu-clnk](https://redirect.github.com/mathieu-clnk))\n- Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#​8355](https://redirect.github.com/cert-manager/cert-manager/issues/8355), [@​dancmeyers](https://redirect.github.com/dancmeyers))\n- Added `parentRef` override annotations on the Certificate resource. ([#​8518](https://redirect.github.com/cert-manager/cert-manager/issues/8518), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for azure private zones for dns01 issuer. ([#​8494](https://redirect.github.com/cert-manager/cert-manager/issues/8494), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#​7642](https://redirect.github.com/cert-manager/cert-manager/issues/7642), [@​robertlestak](https://redirect.github.com/robertlestak))\n- Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#​7728](https://redirect.github.com/cert-manager/cert-manager/issues/7728), [@​jcpunk](https://redirect.github.com/jcpunk))\n- For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#​8301](https://redirect.github.com/cert-manager/cert-manager/issues/8301), [@​k0da](https://redirect.github.com/k0da))\n- Improve error message when CA issuers are misconfigured to use a clashing secret name ([#​8374](https://redirect.github.com/cert-manager/cert-manager/issues/8374), [@​majiayu000](https://redirect.github.com/majiayu000))\n- Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#​8244](https://redirect.github.com/cert-manager/cert-manager/issues/8244), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8195](https://redirect.github.com/cert-manager/cert-manager/issues/8195), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#​8228](https://redirect.github.com/cert-manager/cert-manager/issues/8228), [@​terinjokes](https://redirect.github.com/terinjokes))\n- Added experimental `XListenerSets` feature gate ([#​8394](https://redirect.github.com/cert-manager/cert-manager/issues/8394), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Documentation\n\n- Add GWAPI documentation to NOTES.TXT in helm chart ([#​8353](https://redirect.github.com/cert-manager/cert-manager/issues/8353), [@​jaxels10](https://redirect.github.com/jaxels10))\n\n##### Bug or Regression\n\n- Adds logs for cases when acme server returns us a fatal error in the order controller ([#​8199](https://redirect.github.com/cert-manager/cert-manager/issues/8199), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8160](https://redirect.github.com/cert-manager/cert-manager/issues/8160), [@​inteon](https://redirect.github.com/inteon))\n- Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#​8232](https://redirect.github.com/cert-manager/cert-manager/issues/8232), [@​eleanor-merry](https://redirect.github.com/eleanor-merry))\n- Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#​8456](https://redirect.github.com/cert-manager/cert-manager/issues/8456), [@​tkna](https://redirect.github.com/tkna))\n- Fix unregulated retries with the DigitalOcean DNS-01 solver\n Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#​8221](https://redirect.github.com/cert-manager/cert-manager/issues/8221), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8403](https://redirect.github.com/cert-manager/cert-manager/issues/8403), [@​calm329](https://redirect.github.com/calm329))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8424](https://redirect.github.com/cert-manager/cert-manager/issues/8424), [@​SlashNephy](https://redirect.github.com/SlashNephy))\n- Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#​8443](https://redirect.github.com/cert-manager/cert-manager/issues/8443), [@​alviss7](https://redirect.github.com/alviss7))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8173](https://redirect.github.com/cert-manager/cert-manager/issues/8173), [@​erikgb](https://redirect.github.com/erikgb))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8469](https://redirect.github.com/cert-manager/cert-manager/issues/8469), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8290](https://redirect.github.com/cert-manager/cert-manager/issues/8290), [@​octo-sts](https://redirect.github.com/octo-sts)\\[bot])\n- When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#​8162](https://redirect.github.com/cert-manager/cert-manager/issues/8162), [@​LiquidPL](https://redirect.github.com/LiquidPL))\n\n##### Other (Cleanup or Flake)\n\n- Promoted the OtherNames feature to Beta and enabled it by default ([#​8288](https://redirect.github.com/cert-manager/cert-manager/issues/8288), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Promoting `XListenerSets` feature gate to `ListenerSets` ([#​8501](https://redirect.github.com/cert-manager/cert-manager/issues/8501), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Rebranding of the Venafi Issuer to CyberArk ([#​8215](https://redirect.github.com/cert-manager/cert-manager/issues/8215), [@​iossifbenbassat123](https://redirect.github.com/iossifbenbassat123))\n- Switched to SSA for challenge finalizer updates ([#​8519](https://redirect.github.com/cert-manager/cert-manager/issues/8519), [@​inteon](https://redirect.github.com/inteon))\n- The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#​8408](https://redirect.github.com/cert-manager/cert-manager/issues/8408), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#​8287](https://redirect.github.com/cert-manager/cert-manager/issues/8287), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update cert-manager's ACME client, forked from golang/x/crypto ([#​8268](https://redirect.github.com/cert-manager/cert-manager/issues/8268), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#​8389](https://redirect.github.com/cert-manager/cert-manager/issues/8389), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#​8426](https://redirect.github.com/cert-manager/cert-manager/issues/8426), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n### [`v1.19.6`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.6)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.5...v1.19.6)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also includes Go version bumps to address reported CVEs. All users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8941](https://redirect.github.com/cert-manager/cert-manager/pull/8941), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update Go to `v1.25.11` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8925](https://redirect.github.com/cert-manager/cert-manager/pull/8925), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Upgrade Go to 1.25.10 to fix reported vulnerabilities, along with other dependency bumps ([#​8788](https://redirect.github.com/cert-manager/cert-manager/pull/8788), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.4...v1.19.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.\n\n##### Changes by Kind\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8706](https://redirect.github.com/cert-manager/cert-manager/pull/8706), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.25.8 to address several reported vulnerabilities ([#​8628](https://redirect.github.com/cert-manager/cert-manager/pull/8628), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump go to 1.25.9 ([#​8705](https://redirect.github.com/cert-manager/cert-manager/pull/8705), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.6...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://re\n\n> \u2702 **Note**\n> \n> PR body was truncated to here.\n\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 commit_id: 4ab174a72079e89cc7e61a674221eb9e91158c0c patchset: 4ab174a72079e89cc7e61a674221eb9e91158c0c project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common topic: null buildset: d40995eaf32441479bb0887dcd0982a8 buildset_refs: - branch: main change: '105' change_message: "chore(deps): update helm release cert-manager to v1.21.1\n\n> \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.21.1` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.21.1`](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n### [`v1.21.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.21.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\ncert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values \u2014 review them carefully before upgrading.\n\n#### Known Issues\n\n- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` \u2014 `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#​9031](https://redirect.github.com/cert-manager/cert-manager/issues/9031) for details.\n- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#​8407](https://redirect.github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`\"OnAdd missing Object\"`, `\"OnUpdate missing ObjectOld\"`, `\"OnDelete missing Object\"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** \u2014 the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#​8994](https://redirect.github.com/cert-manager/cert-manager/issues/8994) for details.\n- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation \u2014 the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#​9036](https://redirect.github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal.\n\n#### Major Themes\n\n##### Default `tokenrequest` RBAC removed from Helm chart\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC \u2014 the Route53 docs section that motivated it was removed in 2024.\n\nIf you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended \u2014 see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).\n\n##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole\n\n> \u26A0\uFE0F Potentially breaking change\n\nThe `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers.\n\nThis change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.\n\n##### Metrics port name and path Helm values removed\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade \u2014 remove them before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952))\n\n##### ACME and Certificate Management\n\n- **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798))\n- **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858))\n- **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422))\n- **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258))\n- **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893))\n- **Modern2026 [PKCS#12](https://redirect.github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841))\n- **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464))\n\n##### Gateway API and cainjector\n\n- **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: \"true\"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749))\n- **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727))\n- **Additional listener protocols**: configurable listener protocols beyond the default set. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683))\n- **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732))\n- **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583))\n- **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692))\n- **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614))\n\n##### Deployment and Observability\n\n- **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779))\n- **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976))\n- **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523))\n- **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761))\n\n##### Notable Bug Fixes\n\n- **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947))\n- **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610))\n- **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760))\n- **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803))\n- **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930))\n- **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255))\n\n#### Community\n\nAs always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.\n\nA special thanks to:\n\n- [@​Copilot](https://redirect.github.com/Copilot)\n- [@​FelixPhipps](https://redirect.github.com/FelixPhipps)\n- [@​Peac36](https://redirect.github.com/Peac36)\n- [@​SebTardif](https://redirect.github.com/SebTardif)\n- [@​apkatsikas](https://redirect.github.com/apkatsikas)\n- [@​bitloi](https://redirect.github.com/bitloi)\n- [@​dap0am](https://redirect.github.com/dap0am)\n- [@​figaw](https://redirect.github.com/figaw)\n- [@​immanuwell](https://redirect.github.com/immanuwell)\n- [@​jabbrwcky](https://redirect.github.com/jabbrwcky)\n- [@​jnohlgard](https://redirect.github.com/jnohlgard)\n- [@​jsoref](https://redirect.github.com/jsoref)\n- [@​ltwongaa](https://redirect.github.com/ltwongaa)\n- [@​lunarwhite](https://redirect.github.com/lunarwhite)\n- [@​mateenali66](https://redirect.github.com/mateenali66)\n- [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari)\n- [@​putongyong](https://redirect.github.com/putongyong)\n- [@​seanorama](https://redirect.github.com/seanorama)\n- [@​texasich](https://redirect.github.com/texasich)\n\nfor their contributions, comments and support!\n\nAlso, thanks to the cert-manager maintainer team for their help in this release:\n\n- [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish)\n- [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot)\n- [@​erikgb](https://redirect.github.com/erikgb)\n- [@​hjoshi123](https://redirect.github.com/hjoshi123)\n- [@​inteon](https://redirect.github.com/inteon)\n- [@​maelvls](https://redirect.github.com/maelvls)\n- [@​munnerz](https://redirect.github.com/munnerz)\n- [@​wallrj](https://redirect.github.com/wallrj)\n- [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)\n\nAnd finally, thanks to the cert-manager steering committee for their feedback in this release cycle:\n\n- [@​FlorianLiebhart](https://redirect.github.com/FlorianLiebhart)\n- [@​TrilokGeer](https://redirect.github.com/TrilokGeer)\n- [@​ianarsenault](https://redirect.github.com/ianarsenault)\n- [@​ssyno](https://redirect.github.com/ssyno)\n\n#### Changes since v1.20.0\n\n##### Feature\n\n- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858), [@​wallrj](https://redirect.github.com/wallrj))\n- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [@​jsoref](https://redirect.github.com/jsoref))\n- Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976), [@​erikgb](https://redirect.github.com/erikgb))\n- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523), [@​dap0am](https://redirect.github.com/dap0am))\n- Added ARI support through the ACMEUseARI feature gate. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422), [@​bitloi](https://redirect.github.com/bitloi))\n- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841), [@​seanorama](https://redirect.github.com/seanorama))\n- Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614), [@​figaw](https://redirect.github.com/figaw))\n- Disabled client side rate-limiting if AP\\&F is enabled. ([#​8757](https://redirect.github.com/cert-manager/cert-manager/issues/8757), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Adding certificate renewal policies ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692), [@​erikgb](https://redirect.github.com/erikgb))\n- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#​8927](https://redirect.github.com/cert-manager/cert-manager/issues/8927), [@​jabbrwcky](https://redirect.github.com/jabbrwcky))\n- Promote the CAInjectorMerging feature gate to GA ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583), [@​Copilot](https://redirect.github.com/Copilot))\n- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: \"true\"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749), [@​apkatsikas](https://redirect.github.com/apkatsikas))\n\n##### Bug or Regression\n\n- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#​7213](https://redirect.github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#​8931](https://redirect.github.com/cert-manager/cert-manager/issues/8931), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760), [@​texasich](https://redirect.github.com/texasich))\n- Add dns issuer secrets validation before marking it as ready ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255), [@​Peac36](https://redirect.github.com/Peac36))\n- Add missing issuer finalizer RBAC to the order controller to support owner references ([#​8654](https://redirect.github.com/cert-manager/cert-manager/issues/8654), [@​erikgb](https://redirect.github.com/erikgb))\n- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#​8822](https://redirect.github.com/cert-manager/cert-manager/issues/8822), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808). ([#​8843](https://redirect.github.com/cert-manager/cert-manager/issues/8843), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#​8651](https://redirect.github.com/cert-manager/cert-manager/issues/8651), [@​mateenali66](https://redirect.github.com/mateenali66))\n- Fix webhook serving certificate not being renewed after system suspend. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#​8962](https://redirect.github.com/cert-manager/cert-manager/issues/8962), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8619](https://redirect.github.com/cert-manager/cert-manager/issues/8619), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610), [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari))\n- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#​8821](https://redirect.github.com/cert-manager/cert-manager/issues/8821), [@​wallrj](https://redirect.github.com/wallrj))\n- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803), [@​SebTardif](https://redirect.github.com/SebTardif))\n- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#​8813](https://redirect.github.com/cert-manager/cert-manager/issues/8813), [@​immanuwell](https://redirect.github.com/immanuwell))\n- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#​8753](https://redirect.github.com/cert-manager/cert-manager/issues/8753), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8664](https://redirect.github.com/cert-manager/cert-manager/issues/8664), [@​jnohlgard](https://redirect.github.com/jnohlgard))\n- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#​8958](https://redirect.github.com/cert-manager/cert-manager/issues/8958), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8743](https://redirect.github.com/cert-manager/cert-manager/issues/8743), [@​erikgb](https://redirect.github.com/erikgb))\n- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#​8577](https://redirect.github.com/cert-manager/cert-manager/issues/8577), [@​putongyong](https://redirect.github.com/putongyong))\n- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- API cleanup: removed deprecated ObjectReference ([#​8625](https://redirect.github.com/cert-manager/cert-manager/issues/8625), [@​inteon](https://redirect.github.com/inteon))\n- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952), [@​erikgb](https://redirect.github.com/erikgb))\n- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Update base images to Debian 13 ([#​8849](https://redirect.github.com/cert-manager/cert-manager/issues/8849), [@​ltwongaa](https://redirect.github.com/ltwongaa))\n\n### [`v1.20.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.\n\nAll users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8940](https://redirect.github.com/cert-manager/cert-manager/issues/8940), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8759](https://redirect.github.com/cert-manager/cert-manager/issues/8759), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.26.3, other deps to fix several govulncheck issues ([#​8789](https://redirect.github.com/cert-manager/cert-manager/issues/8789), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8926](https://redirect.github.com/cert-manager/cert-manager/issues/8926), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.20.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config`\nand `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies\nto address reported vulnerabilities.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8665](https://redirect.github.com/cert-manager/cert-manager/issues/8665), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8704](https://redirect.github.com/cert-manager/cert-manager/issues/8704), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.26.2 ([#​8703](https://redirect.github.com/cert-manager/cert-manager/issues/8703), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).\n\n##### Bug or Regression\n\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8658](https://redirect.github.com/cert-manager/cert-manager/issues/8658), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#​8655](https://redirect.github.com/cert-manager/cert-manager/issues/8655), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#​8657](https://redirect.github.com/cert-manager/cert-manager/issues/8657), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.\n\n##### Changes by Kind\n\n##### Feature\n\n- Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#​8370](https://redirect.github.com/cert-manager/cert-manager/issues/8370), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#​8256](https://redirect.github.com/cert-manager/cert-manager/issues/8256), [@​tareksha](https://redirect.github.com/tareksha))\n- Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#​8186](https://redirect.github.com/cert-manager/cert-manager/issues/8186), [@​mathieu-clnk](https://redirect.github.com/mathieu-clnk))\n- Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#​8355](https://redirect.github.com/cert-manager/cert-manager/issues/8355), [@​dancmeyers](https://redirect.github.com/dancmeyers))\n- Added `parentRef` override annotations on the Certificate resource. ([#​8518](https://redirect.github.com/cert-manager/cert-manager/issues/8518), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for azure private zones for dns01 issuer. ([#​8494](https://redirect.github.com/cert-manager/cert-manager/issues/8494), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#​7642](https://redirect.github.com/cert-manager/cert-manager/issues/7642), [@​robertlestak](https://redirect.github.com/robertlestak))\n- Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#​7728](https://redirect.github.com/cert-manager/cert-manager/issues/7728), [@​jcpunk](https://redirect.github.com/jcpunk))\n- For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#​8301](https://redirect.github.com/cert-manager/cert-manager/issues/8301), [@​k0da](https://redirect.github.com/k0da))\n- Improve error message when CA issuers are misconfigured to use a clashing secret name ([#​8374](https://redirect.github.com/cert-manager/cert-manager/issues/8374), [@​majiayu000](https://redirect.github.com/majiayu000))\n- Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#​8244](https://redirect.github.com/cert-manager/cert-manager/issues/8244), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8195](https://redirect.github.com/cert-manager/cert-manager/issues/8195), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#​8228](https://redirect.github.com/cert-manager/cert-manager/issues/8228), [@​terinjokes](https://redirect.github.com/terinjokes))\n- Added experimental `XListenerSets` feature gate ([#​8394](https://redirect.github.com/cert-manager/cert-manager/issues/8394), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Documentation\n\n- Add GWAPI documentation to NOTES.TXT in helm chart ([#​8353](https://redirect.github.com/cert-manager/cert-manager/issues/8353), [@​jaxels10](https://redirect.github.com/jaxels10))\n\n##### Bug or Regression\n\n- Adds logs for cases when acme server returns us a fatal error in the order controller ([#​8199](https://redirect.github.com/cert-manager/cert-manager/issues/8199), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8160](https://redirect.github.com/cert-manager/cert-manager/issues/8160), [@​inteon](https://redirect.github.com/inteon))\n- Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#​8232](https://redirect.github.com/cert-manager/cert-manager/issues/8232), [@​eleanor-merry](https://redirect.github.com/eleanor-merry))\n- Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#​8456](https://redirect.github.com/cert-manager/cert-manager/issues/8456), [@​tkna](https://redirect.github.com/tkna))\n- Fix unregulated retries with the DigitalOcean DNS-01 solver\n Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#​8221](https://redirect.github.com/cert-manager/cert-manager/issues/8221), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8403](https://redirect.github.com/cert-manager/cert-manager/issues/8403), [@​calm329](https://redirect.github.com/calm329))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8424](https://redirect.github.com/cert-manager/cert-manager/issues/8424), [@​SlashNephy](https://redirect.github.com/SlashNephy))\n- Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#​8443](https://redirect.github.com/cert-manager/cert-manager/issues/8443), [@​alviss7](https://redirect.github.com/alviss7))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8173](https://redirect.github.com/cert-manager/cert-manager/issues/8173), [@​erikgb](https://redirect.github.com/erikgb))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8469](https://redirect.github.com/cert-manager/cert-manager/issues/8469), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8290](https://redirect.github.com/cert-manager/cert-manager/issues/8290), [@​octo-sts](https://redirect.github.com/octo-sts)\\[bot])\n- When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#​8162](https://redirect.github.com/cert-manager/cert-manager/issues/8162), [@​LiquidPL](https://redirect.github.com/LiquidPL))\n\n##### Other (Cleanup or Flake)\n\n- Promoted the OtherNames feature to Beta and enabled it by default ([#​8288](https://redirect.github.com/cert-manager/cert-manager/issues/8288), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Promoting `XListenerSets` feature gate to `ListenerSets` ([#​8501](https://redirect.github.com/cert-manager/cert-manager/issues/8501), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Rebranding of the Venafi Issuer to CyberArk ([#​8215](https://redirect.github.com/cert-manager/cert-manager/issues/8215), [@​iossifbenbassat123](https://redirect.github.com/iossifbenbassat123))\n- Switched to SSA for challenge finalizer updates ([#​8519](https://redirect.github.com/cert-manager/cert-manager/issues/8519), [@​inteon](https://redirect.github.com/inteon))\n- The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#​8408](https://redirect.github.com/cert-manager/cert-manager/issues/8408), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#​8287](https://redirect.github.com/cert-manager/cert-manager/issues/8287), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update cert-manager's ACME client, forked from golang/x/crypto ([#​8268](https://redirect.github.com/cert-manager/cert-manager/issues/8268), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#​8389](https://redirect.github.com/cert-manager/cert-manager/issues/8389), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#​8426](https://redirect.github.com/cert-manager/cert-manager/issues/8426), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n### [`v1.19.6`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.6)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.5...v1.19.6)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also includes Go version bumps to address reported CVEs. All users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8941](https://redirect.github.com/cert-manager/cert-manager/pull/8941), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update Go to `v1.25.11` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8925](https://redirect.github.com/cert-manager/cert-manager/pull/8925), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Upgrade Go to 1.25.10 to fix reported vulnerabilities, along with other dependency bumps ([#​8788](https://redirect.github.com/cert-manager/cert-manager/pull/8788), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.4...v1.19.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.\n\n##### Changes by Kind\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8706](https://redirect.github.com/cert-manager/cert-manager/pull/8706), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.25.8 to address several reported vulnerabilities ([#​8628](https://redirect.github.com/cert-manager/cert-manager/pull/8628), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump go to 1.25.9 ([#​8705](https://redirect.github.com/cert-manager/cert-manager/pull/8705), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.6...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://re\n\n> \u2702 **Note**\n> \n> PR body was truncated to here.\n\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 commit_id: 4ab174a72079e89cc7e61a674221eb9e91158c0c patchset: 4ab174a72079e89cc7e61a674221eb9e91158c0c project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common topic: null change: '105' change_message: "chore(deps): update helm release cert-manager to v1.21.1\n\n> \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.21.1` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.21.1`](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n### [`v1.21.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.21.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\ncert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values \u2014 review them carefully before upgrading.\n\n#### Known Issues\n\n- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` \u2014 `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#​9031](https://redirect.github.com/cert-manager/cert-manager/issues/9031) for details.\n- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#​8407](https://redirect.github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`\"OnAdd missing Object\"`, `\"OnUpdate missing ObjectOld\"`, `\"OnDelete missing Object\"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** \u2014 the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#​8994](https://redirect.github.com/cert-manager/cert-manager/issues/8994) for details.\n- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation \u2014 the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#​9036](https://redirect.github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal.\n\n#### Major Themes\n\n##### Default `tokenrequest` RBAC removed from Helm chart\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC \u2014 the Route53 docs section that motivated it was removed in 2024.\n\nIf you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended \u2014 see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).\n\n##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole\n\n> \u26A0\uFE0F Potentially breaking change\n\nThe `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers.\n\nThis change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.\n\n##### Metrics port name and path Helm values removed\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade \u2014 remove them before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952))\n\n##### ACME and Certificate Management\n\n- **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798))\n- **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858))\n- **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422))\n- **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258))\n- **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893))\n- **Modern2026 [PKCS#12](https://redirect.github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841))\n- **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464))\n\n##### Gateway API and cainjector\n\n- **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: \"true\"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749))\n- **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727))\n- **Additional listener protocols**: configurable listener protocols beyond the default set. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683))\n- **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732))\n- **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583))\n- **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692))\n- **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614))\n\n##### Deployment and Observability\n\n- **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779))\n- **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976))\n- **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523))\n- **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761))\n\n##### Notable Bug Fixes\n\n- **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947))\n- **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610))\n- **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760))\n- **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803))\n- **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930))\n- **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255))\n\n#### Community\n\nAs always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.\n\nA special thanks to:\n\n- [@​Copilot](https://redirect.github.com/Copilot)\n- [@​FelixPhipps](https://redirect.github.com/FelixPhipps)\n- [@​Peac36](https://redirect.github.com/Peac36)\n- [@​SebTardif](https://redirect.github.com/SebTardif)\n- [@​apkatsikas](https://redirect.github.com/apkatsikas)\n- [@​bitloi](https://redirect.github.com/bitloi)\n- [@​dap0am](https://redirect.github.com/dap0am)\n- [@​figaw](https://redirect.github.com/figaw)\n- [@​immanuwell](https://redirect.github.com/immanuwell)\n- [@​jabbrwcky](https://redirect.github.com/jabbrwcky)\n- [@​jnohlgard](https://redirect.github.com/jnohlgard)\n- [@​jsoref](https://redirect.github.com/jsoref)\n- [@​ltwongaa](https://redirect.github.com/ltwongaa)\n- [@​lunarwhite](https://redirect.github.com/lunarwhite)\n- [@​mateenali66](https://redirect.github.com/mateenali66)\n- [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari)\n- [@​putongyong](https://redirect.github.com/putongyong)\n- [@​seanorama](https://redirect.github.com/seanorama)\n- [@​texasich](https://redirect.github.com/texasich)\n\nfor their contributions, comments and support!\n\nAlso, thanks to the cert-manager maintainer team for their help in this release:\n\n- [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish)\n- [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot)\n- [@​erikgb](https://redirect.github.com/erikgb)\n- [@​hjoshi123](https://redirect.github.com/hjoshi123)\n- [@​inteon](https://redirect.github.com/inteon)\n- [@​maelvls](https://redirect.github.com/maelvls)\n- [@​munnerz](https://redirect.github.com/munnerz)\n- [@​wallrj](https://redirect.github.com/wallrj)\n- [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)\n\nAnd finally, thanks to the cert-manager steering committee for their feedback in this release cycle:\n\n- [@​FlorianLiebhart](https://redirect.github.com/FlorianLiebhart)\n- [@​TrilokGeer](https://redirect.github.com/TrilokGeer)\n- [@​ianarsenault](https://redirect.github.com/ianarsenault)\n- [@​ssyno](https://redirect.github.com/ssyno)\n\n#### Changes since v1.20.0\n\n##### Feature\n\n- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858), [@​wallrj](https://redirect.github.com/wallrj))\n- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [@​jsoref](https://redirect.github.com/jsoref))\n- Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976), [@​erikgb](https://redirect.github.com/erikgb))\n- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523), [@​dap0am](https://redirect.github.com/dap0am))\n- Added ARI support through the ACMEUseARI feature gate. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422), [@​bitloi](https://redirect.github.com/bitloi))\n- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841), [@​seanorama](https://redirect.github.com/seanorama))\n- Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614), [@​figaw](https://redirect.github.com/figaw))\n- Disabled client side rate-limiting if AP\\&F is enabled. ([#​8757](https://redirect.github.com/cert-manager/cert-manager/issues/8757), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Adding certificate renewal policies ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692), [@​erikgb](https://redirect.github.com/erikgb))\n- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#​8927](https://redirect.github.com/cert-manager/cert-manager/issues/8927), [@​jabbrwcky](https://redirect.github.com/jabbrwcky))\n- Promote the CAInjectorMerging feature gate to GA ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583), [@​Copilot](https://redirect.github.com/Copilot))\n- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: \"true\"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749), [@​apkatsikas](https://redirect.github.com/apkatsikas))\n\n##### Bug or Regression\n\n- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#​7213](https://redirect.github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#​8931](https://redirect.github.com/cert-manager/cert-manager/issues/8931), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760), [@​texasich](https://redirect.github.com/texasich))\n- Add dns issuer secrets validation before marking it as ready ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255), [@​Peac36](https://redirect.github.com/Peac36))\n- Add missing issuer finalizer RBAC to the order controller to support owner references ([#​8654](https://redirect.github.com/cert-manager/cert-manager/issues/8654), [@​erikgb](https://redirect.github.com/erikgb))\n- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#​8822](https://redirect.github.com/cert-manager/cert-manager/issues/8822), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808). ([#​8843](https://redirect.github.com/cert-manager/cert-manager/issues/8843), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#​8651](https://redirect.github.com/cert-manager/cert-manager/issues/8651), [@​mateenali66](https://redirect.github.com/mateenali66))\n- Fix webhook serving certificate not being renewed after system suspend. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#​8962](https://redirect.github.com/cert-manager/cert-manager/issues/8962), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8619](https://redirect.github.com/cert-manager/cert-manager/issues/8619), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610), [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari))\n- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#​8821](https://redirect.github.com/cert-manager/cert-manager/issues/8821), [@​wallrj](https://redirect.github.com/wallrj))\n- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803), [@​SebTardif](https://redirect.github.com/SebTardif))\n- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#​8813](https://redirect.github.com/cert-manager/cert-manager/issues/8813), [@​immanuwell](https://redirect.github.com/immanuwell))\n- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#​8753](https://redirect.github.com/cert-manager/cert-manager/issues/8753), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8664](https://redirect.github.com/cert-manager/cert-manager/issues/8664), [@​jnohlgard](https://redirect.github.com/jnohlgard))\n- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#​8958](https://redirect.github.com/cert-manager/cert-manager/issues/8958), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8743](https://redirect.github.com/cert-manager/cert-manager/issues/8743), [@​erikgb](https://redirect.github.com/erikgb))\n- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#​8577](https://redirect.github.com/cert-manager/cert-manager/issues/8577), [@​putongyong](https://redirect.github.com/putongyong))\n- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- API cleanup: removed deprecated ObjectReference ([#​8625](https://redirect.github.com/cert-manager/cert-manager/issues/8625), [@​inteon](https://redirect.github.com/inteon))\n- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952), [@​erikgb](https://redirect.github.com/erikgb))\n- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Update base images to Debian 13 ([#​8849](https://redirect.github.com/cert-manager/cert-manager/issues/8849), [@​ltwongaa](https://redirect.github.com/ltwongaa))\n\n### [`v1.20.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.\n\nAll users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8940](https://redirect.github.com/cert-manager/cert-manager/issues/8940), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8759](https://redirect.github.com/cert-manager/cert-manager/issues/8759), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.26.3, other deps to fix several govulncheck issues ([#​8789](https://redirect.github.com/cert-manager/cert-manager/issues/8789), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8926](https://redirect.github.com/cert-manager/cert-manager/issues/8926), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.20.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config`\nand `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies\nto address reported vulnerabilities.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8665](https://redirect.github.com/cert-manager/cert-manager/issues/8665), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8704](https://redirect.github.com/cert-manager/cert-manager/issues/8704), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.26.2 ([#​8703](https://redirect.github.com/cert-manager/cert-manager/issues/8703), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).\n\n##### Bug or Regression\n\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8658](https://redirect.github.com/cert-manager/cert-manager/issues/8658), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#​8655](https://redirect.github.com/cert-manager/cert-manager/issues/8655), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#​8657](https://redirect.github.com/cert-manager/cert-manager/issues/8657), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.\n\n##### Changes by Kind\n\n##### Feature\n\n- Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#​8370](https://redirect.github.com/cert-manager/cert-manager/issues/8370), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#​8256](https://redirect.github.com/cert-manager/cert-manager/issues/8256), [@​tareksha](https://redirect.github.com/tareksha))\n- Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#​8186](https://redirect.github.com/cert-manager/cert-manager/issues/8186), [@​mathieu-clnk](https://redirect.github.com/mathieu-clnk))\n- Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#​8355](https://redirect.github.com/cert-manager/cert-manager/issues/8355), [@​dancmeyers](https://redirect.github.com/dancmeyers))\n- Added `parentRef` override annotations on the Certificate resource. ([#​8518](https://redirect.github.com/cert-manager/cert-manager/issues/8518), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for azure private zones for dns01 issuer. ([#​8494](https://redirect.github.com/cert-manager/cert-manager/issues/8494), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#​7642](https://redirect.github.com/cert-manager/cert-manager/issues/7642), [@​robertlestak](https://redirect.github.com/robertlestak))\n- Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#​7728](https://redirect.github.com/cert-manager/cert-manager/issues/7728), [@​jcpunk](https://redirect.github.com/jcpunk))\n- For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#​8301](https://redirect.github.com/cert-manager/cert-manager/issues/8301), [@​k0da](https://redirect.github.com/k0da))\n- Improve error message when CA issuers are misconfigured to use a clashing secret name ([#​8374](https://redirect.github.com/cert-manager/cert-manager/issues/8374), [@​majiayu000](https://redirect.github.com/majiayu000))\n- Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#​8244](https://redirect.github.com/cert-manager/cert-manager/issues/8244), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8195](https://redirect.github.com/cert-manager/cert-manager/issues/8195), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#​8228](https://redirect.github.com/cert-manager/cert-manager/issues/8228), [@​terinjokes](https://redirect.github.com/terinjokes))\n- Added experimental `XListenerSets` feature gate ([#​8394](https://redirect.github.com/cert-manager/cert-manager/issues/8394), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Documentation\n\n- Add GWAPI documentation to NOTES.TXT in helm chart ([#​8353](https://redirect.github.com/cert-manager/cert-manager/issues/8353), [@​jaxels10](https://redirect.github.com/jaxels10))\n\n##### Bug or Regression\n\n- Adds logs for cases when acme server returns us a fatal error in the order controller ([#​8199](https://redirect.github.com/cert-manager/cert-manager/issues/8199), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8160](https://redirect.github.com/cert-manager/cert-manager/issues/8160), [@​inteon](https://redirect.github.com/inteon))\n- Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#​8232](https://redirect.github.com/cert-manager/cert-manager/issues/8232), [@​eleanor-merry](https://redirect.github.com/eleanor-merry))\n- Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#​8456](https://redirect.github.com/cert-manager/cert-manager/issues/8456), [@​tkna](https://redirect.github.com/tkna))\n- Fix unregulated retries with the DigitalOcean DNS-01 solver\n Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#​8221](https://redirect.github.com/cert-manager/cert-manager/issues/8221), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8403](https://redirect.github.com/cert-manager/cert-manager/issues/8403), [@​calm329](https://redirect.github.com/calm329))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8424](https://redirect.github.com/cert-manager/cert-manager/issues/8424), [@​SlashNephy](https://redirect.github.com/SlashNephy))\n- Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#​8443](https://redirect.github.com/cert-manager/cert-manager/issues/8443), [@​alviss7](https://redirect.github.com/alviss7))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8173](https://redirect.github.com/cert-manager/cert-manager/issues/8173), [@​erikgb](https://redirect.github.com/erikgb))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8469](https://redirect.github.com/cert-manager/cert-manager/issues/8469), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8290](https://redirect.github.com/cert-manager/cert-manager/issues/8290), [@​octo-sts](https://redirect.github.com/octo-sts)\\[bot])\n- When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#​8162](https://redirect.github.com/cert-manager/cert-manager/issues/8162), [@​LiquidPL](https://redirect.github.com/LiquidPL))\n\n##### Other (Cleanup or Flake)\n\n- Promoted the OtherNames feature to Beta and enabled it by default ([#​8288](https://redirect.github.com/cert-manager/cert-manager/issues/8288), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Promoting `XListenerSets` feature gate to `ListenerSets` ([#​8501](https://redirect.github.com/cert-manager/cert-manager/issues/8501), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Rebranding of the Venafi Issuer to CyberArk ([#​8215](https://redirect.github.com/cert-manager/cert-manager/issues/8215), [@​iossifbenbassat123](https://redirect.github.com/iossifbenbassat123))\n- Switched to SSA for challenge finalizer updates ([#​8519](https://redirect.github.com/cert-manager/cert-manager/issues/8519), [@​inteon](https://redirect.github.com/inteon))\n- The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#​8408](https://redirect.github.com/cert-manager/cert-manager/issues/8408), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#​8287](https://redirect.github.com/cert-manager/cert-manager/issues/8287), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update cert-manager's ACME client, forked from golang/x/crypto ([#​8268](https://redirect.github.com/cert-manager/cert-manager/issues/8268), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#​8389](https://redirect.github.com/cert-manager/cert-manager/issues/8389), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#​8426](https://redirect.github.com/cert-manager/cert-manager/issues/8426), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n### [`v1.19.6`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.6)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.5...v1.19.6)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also includes Go version bumps to address reported CVEs. All users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8941](https://redirect.github.com/cert-manager/cert-manager/pull/8941), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update Go to `v1.25.11` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8925](https://redirect.github.com/cert-manager/cert-manager/pull/8925), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Upgrade Go to 1.25.10 to fix reported vulnerabilities, along with other dependency bumps ([#​8788](https://redirect.github.com/cert-manager/cert-manager/pull/8788), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.4...v1.19.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.\n\n##### Changes by Kind\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8706](https://redirect.github.com/cert-manager/cert-manager/pull/8706), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.25.8 to address several reported vulnerabilities ([#​8628](https://redirect.github.com/cert-manager/cert-manager/pull/8628), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump go to 1.25.9 ([#​8705](https://redirect.github.com/cert-manager/cert-manager/pull/8705), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.6...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://re\n\n> \u2702 **Note**\n> \n> PR body was truncated to here.\n\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 child_jobs: [] commit_id: 4ab174a72079e89cc7e61a674221eb9e91158c0c event_id: 3d762ff0-8b7b-11f1-818d-d90a9db3412f executor: hostname: 2d72f0692154 inventory_file: /var/lib/zuul/builds/df925605a75e40088f795833ad47c03e/ansible/inventory.yaml log_root: /var/lib/zuul/builds/df925605a75e40088f795833ad47c03e/work/logs result_data_file: /var/lib/zuul/builds/df925605a75e40088f795833ad47c03e/work/results.json src_root: /var/lib/zuul/builds/df925605a75e40088f795833ad47c03e/work/src work_root: /var/lib/zuul/builds/df925605a75e40088f795833ad47c03e/work include_vars: [] items: - branch: main change: '105' change_message: "chore(deps): update helm release cert-manager to v1.21.1\n\n> \u2139\uFE0F **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n| [cert-manager](https://cert-manager.io) ([source](https://redirect.github.com/cert-manager/cert-manager)) | minor | `1.18.2` \u2192 `1.21.1` |\n\n---\n\n### Release Notes\n\n
\ncert-manager/cert-manager (cert-manager)\n\n### [`v1.21.1`](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1)\n\n### [`v1.21.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.21.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\ncert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values \u2014 review them carefully before upgrading.\n\n#### Known Issues\n\n- **Controller crash-loops when a Certificate sets `renewal.policy: Disabled`**: the new Certificate renewal policies feature ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258)) causes a nil pointer dereference panic in the trigger controller whenever a Certificate's `spec.renewal.policy` is set to `Disabled` \u2014 `pki.RenewalTime()` returns `(nil, nil)` for that policy, but the caller unconditionally dereferences the result. This crashes the controller process (crash-loop) for any cluster with such a Certificate. **Workaround**: do not set `renewal.policy: Disabled` on any Certificate until this is fixed; remove the field (or set a different policy) from any Certificate that already has it, and restart the controller if it is currently crash-looping. See [#​9031](https://redirect.github.com/cert-manager/cert-manager/issues/9031) for details.\n- **Log spam for non-cert-manager-labelled Secret events**: the typed predicates refactoring ([#​8407](https://redirect.github.com/cert-manager/cert-manager/issues/8407)) causes `filteredEventHandler` type assertion failures (`\"OnAdd missing Object\"`, `\"OnUpdate missing ObjectOld\"`, `\"OnDelete missing Object\"`) for every non-cert-manager-labelled Secret event, multiplied by 7 certificate sub-controllers. **This is cosmetic only** \u2014 the affected controllers only need events from cert-manager-labelled Secrets (which arrive via the typed informer); the metadata informer events were always filtered out by predicates in previous versions. Issuer and ClusterIssuer controllers are not affected. See [#​8994](https://redirect.github.com/cert-manager/cert-manager/issues/8994) for details.\n- **Issuer/ClusterIssuer can get stuck at `Ready: False, Reason: InvalidSolver` and never self-correct**: new eager validation of ACME solver Secrets ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255)) means an Issuer/ClusterIssuer referencing a solver Secret (e.g. a DNS01 provider credential) that doesn't exist yet will correctly report `Ready: False`, but creating the missing Secret afterwards does not trigger re-reconciliation \u2014 the controller's Secret-watch logic was never updated to recognise solver Secrets. It will only recover on the next 10-hour informer resync, a change to the Issuer/ClusterIssuer's own spec, or a controller restart. **Workaround**: after creating the missing Secret, make a trivial edit to the Issuer/ClusterIssuer spec (or delete and recreate it) to force reconciliation. See [#​9036](https://redirect.github.com/cert-manager/cert-manager/issues/9036) for details and a fix proposal.\n\n#### Major Themes\n\n##### Default `tokenrequest` RBAC removed from Helm chart\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC \u2014 the Route53 docs section that motivated it was removed in 2024.\n\nIf you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended \u2014 see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation).\n\n##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole\n\n> \u26A0\uFE0F Potentially breaking change\n\nThe `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers.\n\nThis change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.\n\n##### Metrics port name and path Helm values removed\n\n> \u26A0\uFE0F Breaking change\n\nThe Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade \u2014 remove them before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952))\n\n##### ACME and Certificate Management\n\n- **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798))\n- **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858))\n- **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422))\n- **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258))\n- **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893))\n- **Modern2026 [PKCS#12](https://redirect.github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841))\n- **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464))\n\n##### Gateway API and cainjector\n\n- **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: \"true\"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749))\n- **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727))\n- **Additional listener protocols**: configurable listener protocols beyond the default set. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683))\n- **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732))\n- **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583))\n- **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692))\n- **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614))\n\n##### Deployment and Observability\n\n- **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779))\n- **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976))\n- **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523))\n- **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761))\n\n##### Notable Bug Fixes\n\n- **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947))\n- **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610))\n- **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760))\n- **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803))\n- **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930))\n- **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255))\n\n#### Community\n\nAs always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.\n\nA special thanks to:\n\n- [@​Copilot](https://redirect.github.com/Copilot)\n- [@​FelixPhipps](https://redirect.github.com/FelixPhipps)\n- [@​Peac36](https://redirect.github.com/Peac36)\n- [@​SebTardif](https://redirect.github.com/SebTardif)\n- [@​apkatsikas](https://redirect.github.com/apkatsikas)\n- [@​bitloi](https://redirect.github.com/bitloi)\n- [@​dap0am](https://redirect.github.com/dap0am)\n- [@​figaw](https://redirect.github.com/figaw)\n- [@​immanuwell](https://redirect.github.com/immanuwell)\n- [@​jabbrwcky](https://redirect.github.com/jabbrwcky)\n- [@​jnohlgard](https://redirect.github.com/jnohlgard)\n- [@​jsoref](https://redirect.github.com/jsoref)\n- [@​ltwongaa](https://redirect.github.com/ltwongaa)\n- [@​lunarwhite](https://redirect.github.com/lunarwhite)\n- [@​mateenali66](https://redirect.github.com/mateenali66)\n- [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari)\n- [@​putongyong](https://redirect.github.com/putongyong)\n- [@​seanorama](https://redirect.github.com/seanorama)\n- [@​texasich](https://redirect.github.com/texasich)\n\nfor their contributions, comments and support!\n\nAlso, thanks to the cert-manager maintainer team for their help in this release:\n\n- [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish)\n- [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot)\n- [@​erikgb](https://redirect.github.com/erikgb)\n- [@​hjoshi123](https://redirect.github.com/hjoshi123)\n- [@​inteon](https://redirect.github.com/inteon)\n- [@​maelvls](https://redirect.github.com/maelvls)\n- [@​munnerz](https://redirect.github.com/munnerz)\n- [@​wallrj](https://redirect.github.com/wallrj)\n- [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)\n\nAnd finally, thanks to the cert-manager steering committee for their feedback in this release cycle:\n\n- [@​FlorianLiebhart](https://redirect.github.com/FlorianLiebhart)\n- [@​TrilokGeer](https://redirect.github.com/TrilokGeer)\n- [@​ianarsenault](https://redirect.github.com/ianarsenault)\n- [@​ssyno](https://redirect.github.com/ssyno)\n\n#### Changes since v1.20.0\n\n##### Feature\n\n- Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#​8893](https://redirect.github.com/cert-manager/cert-manager/issues/8893), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#​8858](https://redirect.github.com/cert-manager/cert-manager/issues/8858), [@​wallrj](https://redirect.github.com/wallrj))\n- Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#​8791](https://redirect.github.com/cert-manager/cert-manager/issues/8791), [@​jsoref](https://redirect.github.com/jsoref))\n- Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#​8976](https://redirect.github.com/cert-manager/cert-manager/issues/8976), [@​erikgb](https://redirect.github.com/erikgb))\n- Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#​8761](https://redirect.github.com/cert-manager/cert-manager/issues/8761), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#​8523](https://redirect.github.com/cert-manager/cert-manager/issues/8523), [@​dap0am](https://redirect.github.com/dap0am))\n- Added ARI support through the ACMEUseARI feature gate. ([#​8798](https://redirect.github.com/cert-manager/cert-manager/issues/8798), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#​8422](https://redirect.github.com/cert-manager/cert-manager/issues/8422), [@​bitloi](https://redirect.github.com/bitloi))\n- Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#​8727](https://redirect.github.com/cert-manager/cert-manager/issues/8727), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#​8683](https://redirect.github.com/cert-manager/cert-manager/issues/8683), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#​8841](https://redirect.github.com/cert-manager/cert-manager/issues/8841), [@​seanorama](https://redirect.github.com/seanorama))\n- Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#​8614](https://redirect.github.com/cert-manager/cert-manager/issues/8614), [@​figaw](https://redirect.github.com/figaw))\n- Disabled client side rate-limiting if AP\\&F is enabled. ([#​8757](https://redirect.github.com/cert-manager/cert-manager/issues/8757), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#​8779](https://redirect.github.com/cert-manager/cert-manager/issues/8779), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Adding certificate renewal policies ([#​8258](https://redirect.github.com/cert-manager/cert-manager/issues/8258), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#​8692](https://redirect.github.com/cert-manager/cert-manager/issues/8692), [@​erikgb](https://redirect.github.com/erikgb))\n- Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#​8927](https://redirect.github.com/cert-manager/cert-manager/issues/8927), [@​jabbrwcky](https://redirect.github.com/jabbrwcky))\n- Promote the CAInjectorMerging feature gate to GA ([#​8583](https://redirect.github.com/cert-manager/cert-manager/issues/8583), [@​Copilot](https://redirect.github.com/Copilot))\n- When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: \"true\"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#​8749](https://redirect.github.com/cert-manager/cert-manager/issues/8749), [@​apkatsikas](https://redirect.github.com/apkatsikas))\n\n##### Bug or Regression\n\n- **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#​7213](https://redirect.github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#​8931](https://redirect.github.com/cert-manager/cert-manager/issues/8931), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#​8760](https://redirect.github.com/cert-manager/cert-manager/issues/8760), [@​texasich](https://redirect.github.com/texasich))\n- Add dns issuer secrets validation before marking it as ready ([#​8255](https://redirect.github.com/cert-manager/cert-manager/issues/8255), [@​Peac36](https://redirect.github.com/Peac36))\n- Add missing issuer finalizer RBAC to the order controller to support owner references ([#​8654](https://redirect.github.com/cert-manager/cert-manager/issues/8654), [@​erikgb](https://redirect.github.com/erikgb))\n- ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#​8822](https://redirect.github.com/cert-manager/cert-manager/issues/8822), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#​8808](https://redirect.github.com/cert-manager/cert-manager/issues/8808). ([#​8843](https://redirect.github.com/cert-manager/cert-manager/issues/8843), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#​8651](https://redirect.github.com/cert-manager/cert-manager/issues/8651), [@​mateenali66](https://redirect.github.com/mateenali66))\n- Fix webhook serving certificate not being renewed after system suspend. ([#​8464](https://redirect.github.com/cert-manager/cert-manager/issues/8464), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#​8962](https://redirect.github.com/cert-manager/cert-manager/issues/8962), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#​8947](https://redirect.github.com/cert-manager/cert-manager/issues/8947), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8619](https://redirect.github.com/cert-manager/cert-manager/issues/8619), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#​8610](https://redirect.github.com/cert-manager/cert-manager/issues/8610), [@​onurmicoogullari](https://redirect.github.com/onurmicoogullari))\n- Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#​8821](https://redirect.github.com/cert-manager/cert-manager/issues/8821), [@​wallrj](https://redirect.github.com/wallrj))\n- Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#​8803](https://redirect.github.com/cert-manager/cert-manager/issues/8803), [@​SebTardif](https://redirect.github.com/SebTardif))\n- Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#​8813](https://redirect.github.com/cert-manager/cert-manager/issues/8813), [@​immanuwell](https://redirect.github.com/immanuwell))\n- Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#​8753](https://redirect.github.com/cert-manager/cert-manager/issues/8753), [@​FelixPhipps](https://redirect.github.com/FelixPhipps))\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8664](https://redirect.github.com/cert-manager/cert-manager/issues/8664), [@​jnohlgard](https://redirect.github.com/jnohlgard))\n- Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#​8958](https://redirect.github.com/cert-manager/cert-manager/issues/8958), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8743](https://redirect.github.com/cert-manager/cert-manager/issues/8743), [@​erikgb](https://redirect.github.com/erikgb))\n- Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#​8577](https://redirect.github.com/cert-manager/cert-manager/issues/8577), [@​putongyong](https://redirect.github.com/putongyong))\n- Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#​8930](https://redirect.github.com/cert-manager/cert-manager/issues/8930), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- API cleanup: removed deprecated ObjectReference ([#​8625](https://redirect.github.com/cert-manager/cert-manager/issues/8625), [@​inteon](https://redirect.github.com/inteon))\n- Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#​8952](https://redirect.github.com/cert-manager/cert-manager/issues/8952), [@​erikgb](https://redirect.github.com/erikgb))\n- The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#​8732](https://redirect.github.com/cert-manager/cert-manager/issues/8732), [@​ThatsMrTalbot](https://redirect.github.com/ThatsMrTalbot))\n- Update base images to Debian 13 ([#​8849](https://redirect.github.com/cert-manager/cert-manager/issues/8849), [@​ltwongaa](https://redirect.github.com/ltwongaa))\n\n### [`v1.20.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also removes the issuer owner reference from Challenges which was blocking Challenge garbage collection, and updates Go to fix reported CVEs.\n\nAll users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8940](https://redirect.github.com/cert-manager/cert-manager/issues/8940), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Remove issuer owner reference from challenges blocking challenge garbage collection ([#​8759](https://redirect.github.com/cert-manager/cert-manager/issues/8759), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.26.3, other deps to fix several govulncheck issues ([#​8789](https://redirect.github.com/cert-manager/cert-manager/issues/8789), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8926](https://redirect.github.com/cert-manager/cert-manager/issues/8926), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.20.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.1...v1.20.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.2 fixes invalid YAML generated in the Helm chart when both `webhook.config`\nand `webhook.volumes` are defined, and bumps Go to 1.26.2 along with dependencies\nto address reported vulnerabilities.\n\n#### Changes by Kind\n\n##### Bug or Regression\n\n- Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#​8665](https://redirect.github.com/cert-manager/cert-manager/issues/8665), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8704](https://redirect.github.com/cert-manager/cert-manager/issues/8704), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.26.2 ([#​8703](https://redirect.github.com/cert-manager/cert-manager/issues/8703), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.20.0...v1.20.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.1 fixes an issue for OpenShift users that has to do with the finalizer RBAC, bumps gRPC to address a reported non-affecting vulnerability, and fixes a duplicate `parentRef` bug when both issuer config and annotations are present (Gateway API).\n\n##### Bug or Regression\n\n- Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#​8658](https://redirect.github.com/cert-manager/cert-manager/issues/8658), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Add missing issuer finalizer RBAC to the order controller to support owner references. This was preventing OpenShift users from being able to upgrade to v1.20.0. ([#​8655](https://redirect.github.com/cert-manager/cert-manager/issues/8655), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump google.golang.org/grpc to fix vulnerability reported by scanners. This isn't a vulnerability that affects cert-manager, but we are bumping it because it is reported by scanners. ([#​8657](https://redirect.github.com/cert-manager/cert-manager/issues/8657), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.20.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.20.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.6...v1.20.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.20.0 adds alpha support for the new ListenerSet resource, adds support for Azure Private DNS; parentRefs are no longer required when using ACME with Gateway API, and OtherNames was promoted to Beta.\n\n##### Changes by Kind\n\n##### Feature\n\n- Added a set of flags to permit setting NetworkPolicy across all deployed containers. Remove redundant global IP ranges from example policies. ([#​8370](https://redirect.github.com/cert-manager/cert-manager/issues/8370), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Added selectable fields to custom resource definitions for .spec.issuerRef.{group, kind, name} ([#​8256](https://redirect.github.com/cert-manager/cert-manager/issues/8256), [@​tareksha](https://redirect.github.com/tareksha))\n- Added support for specifying `imagePullSecrets` in the `startupapicheck-job` Helm template to enable pulling images from private registries. ([#​8186](https://redirect.github.com/cert-manager/cert-manager/issues/8186), [@​mathieu-clnk](https://redirect.github.com/mathieu-clnk))\n- Added 'extraContainers' helm chart value, allowing the deployment of arbitrary sidecar containers within the cert-manager operator pod. This can be used to support, for e.g., AWS IAM Roles Anywhere for Route53 DNS01 verification. ([#​8355](https://redirect.github.com/cert-manager/cert-manager/issues/8355), [@​dancmeyers](https://redirect.github.com/dancmeyers))\n- Added `parentRef` override annotations on the Certificate resource. ([#​8518](https://redirect.github.com/cert-manager/cert-manager/issues/8518), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for azure private zones for dns01 issuer. ([#​8494](https://redirect.github.com/cert-manager/cert-manager/issues/8494), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Added support for configuring PEM decoding size limits, allowing operators to handle larger certificates and keys. ([#​7642](https://redirect.github.com/cert-manager/cert-manager/issues/7642), [@​robertlestak](https://redirect.github.com/robertlestak))\n- Added support for unhealthyPodEvictionPolicy in PodDisruptionBudget ([#​7728](https://redirect.github.com/cert-manager/cert-manager/issues/7728), [@​jcpunk](https://redirect.github.com/jcpunk))\n- For Venafi provider, read `venafi.cert-manager.io/custom-fields` annotation on Issuer/ClusterIssuer and use it as base with override/append capabilities on Certificate level. ([#​8301](https://redirect.github.com/cert-manager/cert-manager/issues/8301), [@​k0da](https://redirect.github.com/k0da))\n- Improve error message when CA issuers are misconfigured to use a clashing secret name ([#​8374](https://redirect.github.com/cert-manager/cert-manager/issues/8374), [@​majiayu000](https://redirect.github.com/majiayu000))\n- Introduce a new Ingress annotation `acme.cert-manager.io/http01-ingress-ingressclassname` to override `http01.ingress.ingressClassName` field in HTTP-01 challenge solvers. ([#​8244](https://redirect.github.com/cert-manager/cert-manager/issues/8244), [@​lunarwhite](https://redirect.github.com/lunarwhite))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8195](https://redirect.github.com/cert-manager/cert-manager/issues/8195), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Vault issuers will now include the Vault server address as one of the default audiences on generated service account tokens. ([#​8228](https://redirect.github.com/cert-manager/cert-manager/issues/8228), [@​terinjokes](https://redirect.github.com/terinjokes))\n- Added experimental `XListenerSets` feature gate ([#​8394](https://redirect.github.com/cert-manager/cert-manager/issues/8394), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n##### Documentation\n\n- Add GWAPI documentation to NOTES.TXT in helm chart ([#​8353](https://redirect.github.com/cert-manager/cert-manager/issues/8353), [@​jaxels10](https://redirect.github.com/jaxels10))\n\n##### Bug or Regression\n\n- Adds logs for cases when acme server returns us a fatal error in the order controller ([#​8199](https://redirect.github.com/cert-manager/cert-manager/issues/8199), [@​Peac36](https://redirect.github.com/Peac36))\n- Fixed an issue where kind or group in the issuerRef of a Certificate was omitted, upgrading to 1.19.x incorrectly caused the certificate to be renewed ([#​8160](https://redirect.github.com/cert-manager/cert-manager/issues/8160), [@​inteon](https://redirect.github.com/inteon))\n- Changes to the Duration and RenewBefore annotations on ingress and gateway-api resources will now trigger certificate updates. ([#​8232](https://redirect.github.com/cert-manager/cert-manager/issues/8232), [@​eleanor-merry](https://redirect.github.com/eleanor-merry))\n- Fix an issue where ACME challenge TXT records are not cleaned up when there are many resource records in CloudDNS. ([#​8456](https://redirect.github.com/cert-manager/cert-manager/issues/8456), [@​tkna](https://redirect.github.com/tkna))\n- Fix unregulated retries with the DigitalOcean DNS-01 solver\n Add full detailed DNS-01 errors to the events attached to the Challenge, for easier debugging ([#​8221](https://redirect.github.com/cert-manager/cert-manager/issues/8221), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8403](https://redirect.github.com/cert-manager/cert-manager/issues/8403), [@​calm329](https://redirect.github.com/calm329))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contains an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8424](https://redirect.github.com/cert-manager/cert-manager/issues/8424), [@​SlashNephy](https://redirect.github.com/SlashNephy))\n- Fixed the HTTP-01 Gateway solver creating invalid HTTPRoutes by not setting spec.hostnames when the challenge DNSName is an IP address. ([#​8443](https://redirect.github.com/cert-manager/cert-manager/issues/8443), [@​alviss7](https://redirect.github.com/alviss7))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8173](https://redirect.github.com/cert-manager/cert-manager/issues/8173), [@​erikgb](https://redirect.github.com/erikgb))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8469](https://redirect.github.com/cert-manager/cert-manager/issues/8469), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8290](https://redirect.github.com/cert-manager/cert-manager/issues/8290), [@​octo-sts](https://redirect.github.com/octo-sts)\\[bot])\n- When Prometheus monitoring is enabled, the metrics label is now set to the intended value of `cert-manager`. Previously, it was set depending on various factors (namespace cert-manager is installed in and/or Helm release name). ([#​8162](https://redirect.github.com/cert-manager/cert-manager/issues/8162), [@​LiquidPL](https://redirect.github.com/LiquidPL))\n\n##### Other (Cleanup or Flake)\n\n- Promoted the OtherNames feature to Beta and enabled it by default ([#​8288](https://redirect.github.com/cert-manager/cert-manager/issues/8288), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Promoting `XListenerSets` feature gate to `ListenerSets` ([#​8501](https://redirect.github.com/cert-manager/cert-manager/issues/8501), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n- Rebranding of the Venafi Issuer to CyberArk ([#​8215](https://redirect.github.com/cert-manager/cert-manager/issues/8215), [@​iossifbenbassat123](https://redirect.github.com/iossifbenbassat123))\n- Switched to SSA for challenge finalizer updates ([#​8519](https://redirect.github.com/cert-manager/cert-manager/issues/8519), [@​inteon](https://redirect.github.com/inteon))\n- The default container user (UID) is now 65532 (previously 1000) and the default container group (GID) is now 65532 (previously 0) ([#​8408](https://redirect.github.com/cert-manager/cert-manager/issues/8408), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- The feature-gate DefaultPrivateKeyRotationPolicyAlways moved from Beta to GA and can no longer be disabled. ([#​8287](https://redirect.github.com/cert-manager/cert-manager/issues/8287), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update cert-manager's ACME client, forked from golang/x/crypto ([#​8268](https://redirect.github.com/cert-manager/cert-manager/issues/8268), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Use the latest version of Kyverno (1.16.2) in the best-practice installation tests ([#​8389](https://redirect.github.com/cert-manager/cert-manager/issues/8389), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- We stopped testing with Coutour due to it not supporting the new XListenerSet resource, and moved to kgateway. ([#​8426](https://redirect.github.com/cert-manager/cert-manager/issues/8426), [@​hjoshi123](https://redirect.github.com/hjoshi123))\n\n### [`v1.19.6`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.6)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.5...v1.19.6)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis patch release fixes a security issue ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258), HIGH) where the default `cert-manager-edit` aggregate ClusterRole granted namespace users permission to create ACME `Challenge` and `Order` resources directly. A user who could create a `Challenge` referencing a `ClusterIssuer` could supply attacker-controlled solver configuration while cert-manager loaded credentials from the `ClusterIssuer`'s namespace, bypassing Issuer solver selectors (`dnsZones`, `dnsNames`, `matchLabels`). With the acme-dns provider specifically, this could disclose DNS credentials to an attacker-controlled endpoint.\n\nThis release also includes Go version bumps to address reported CVEs. All users should upgrade.\n\n> \\[!WARNING]\n> **Potentially breaking change:** The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io`. These resources are internal to cert-manager's ACME workflow and are not intended to be created or modified directly by users. If you have tooling or workflows that create Challenge or Order resources directly (outside of the normal Certificate \u2192 CertificateRequest \u2192 Order \u2192 Challenge flow), you will need to grant those permissions explicitly.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Security (HIGH): Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole ([`GHSA-8rvj-mm4h-c258`](https://redirect.github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). ([#​8941](https://redirect.github.com/cert-manager/cert-manager/pull/8941), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n##### Other (Cleanup or Flake)\n\n- Update Go to `v1.25.11` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#​8925](https://redirect.github.com/cert-manager/cert-manager/pull/8925), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Upgrade Go to 1.25.10 to fix reported vulnerabilities, along with other dependency bumps ([#​8788](https://redirect.github.com/cert-manager/cert-manager/pull/8788), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.5`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.5)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.4...v1.19.5)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis is a simple patch release to fix some reported vulnerabilities. All users are recommended to upgrade.\n\n##### Changes by Kind\n\n##### Other (Cleanup or Flake)\n\n- Bump go dependencies with reported vulnerabilities ([#​8706](https://redirect.github.com/cert-manager/cert-manager/pull/8706), [@​erikgb](https://redirect.github.com/erikgb))\n- Bump go to 1.25.8 to address several reported vulnerabilities ([#​8628](https://redirect.github.com/cert-manager/cert-manager/pull/8628), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump go to 1.25.9 ([#​8705](https://redirect.github.com/cert-manager/cert-manager/pull/8705), [@​erikgb](https://redirect.github.com/erikgb))\n\n### [`v1.19.4`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.4)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.3...v1.19.4)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nv1.19.4 is a simple patch release to fix some reported vulnerabilities - notably CVE-2026-24051 and CVE-2025-68121. All users should upgrade.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Bump go to address CVE-2025-68121 ([#​8526](https://redirect.github.com/cert-manager/cert-manager/issues/8526), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Bump otel SDK to address GO-2026-4394 ([#​8531](https://redirect.github.com/cert-manager/cert-manager/issues/8531), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.3`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.3)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.2...v1.19.3)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nThis release contains three bug fixes, including a fix for the MODERATE severity DoS issue in GHSA-gx3x-vq4p-mhhv. All users should upgrade to the latest release.\n\n##### Changes by Kind\n\n##### Bug or Regression\n\n- Fixed an infinite re-issuance loop that could occur when an issuer returns a certificate with a public key that doesn't match the CSR. The issuing controller now validates the certificate before storing it and fails with backoff on mismatch. ([#​8415](https://redirect.github.com/cert-manager/cert-manager/issues/8415), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Fixed an issue where HTTP-01 challenges failed when the Host header contained an IPv6 address. This means that users can now issue IP address certificates for IPv6 address subjects. ([#​8436](https://redirect.github.com/cert-manager/cert-manager/issues/8436), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Security (MODERATE): Fix a potential panic in the cert-manager controller when a DNS response in an unexpected order was cached. If an attacker was able to modify DNS responses (or if they controlled the DNS server) it was possible to cause denial of service for the cert-manager controller. ([#​8468](https://redirect.github.com/cert-manager/cert-manager/issues/8468), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n##### Other (Cleanup or Flake)\n\n- Bump go to 1.25.6 ([#​8459](https://redirect.github.com/cert-manager/cert-manager/issues/8459), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n\n### [`v1.19.2`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.2)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.1...v1.19.2)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe updated Go to fix some vulnerabilities in the standard library.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\n#### Changes since `v1.19.1`\n\n##### Bug or Regression\n\n- Address false positive vulnerabilities `CVE-2025-47914` and `CVE-2025-58181` which were reported by Trivy. ([#​8283](https://redirect.github.com/cert-manager/cert-manager/issues/8283), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Update Go to `v1.25.5` to fix `CVE-2025-61727` and `CVE-2025-61729` ([#​8294](https://redirect.github.com/cert-manager/cert-manager/issues/8294), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Update `global.nodeSelector` to helm chart to perform a `merge` and allow for a single `nodeSelector` to be set across all services. ([#​8233](https://redirect.github.com/cert-manager/cert-manager/issues/8233), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n##### Other (Cleanup or Flake)\n\n- Update cert-manager's ACME client, forked from `golang/x/crypto` ([#​8270](https://redirect.github.com/cert-manager/cert-manager/issues/8270), [@​SgtCoDFish](https://redirect.github.com/SgtCoDFish))\n- Updated Debian 12 distroless base images ([#​8326](https://redirect.github.com/cert-manager/cert-manager/issues/8326), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n\n### [`v1.19.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.19.0...v1.19.1)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\nWe reverted the CRD-based API defaults for `Certificate.Spec.IssuerRef` and `CertificateRequest.Spec.IssuerRef` after they were found to cause unexpected certificate renewals after upgrading to 1.19.0. We will try re-introducing these API defaults in cert-manager `1.20`.\nWe fixed a bug that caused certificates to be re-issued unexpectedly if the `issuerRef` kind or group was changed to one of the \"runtime\" default values.\nWe upgraded Go to `1.25.3` to address the following security vulnerabilities: `CVE-2025-61724`, `CVE-2025-58187`, `CVE-2025-47912`, `CVE-2025-58183`, `CVE-2025-61723`, `CVE-2025-58186`, `CVE-2025-58185`, `CVE-2025-58188`, and `CVE-2025-61725`.\n\n> \U0001F4D6 Read the [full 1.19 release notes](https://cert-manager.io/docs/releases/release-notes/release-notes-1.19) on the cert-manager.io website before upgrading.\n\nChanges since `v1.19.0`:\n\n##### Bug or Regression\n\n- BUGFIX: in case kind or group in the `issuerRef` of a Certificate was omitted, upgrading to `1.19.x` incorrectly caused the certificate to be renewed ([#​8175](https://redirect.github.com/cert-manager/cert-manager/issues/8175), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n- Bump Go to 1.25.3 to fix a backwards incompatible change to the validation of DNS names in X.509 SAN fields which prevented the use of DNS names with a trailing dot ([#​8177](https://redirect.github.com/cert-manager/cert-manager/issues/8177), [@​wallrj-cyberark](https://redirect.github.com/wallrj-cyberark))\n- Revert API defaults for issuer reference kind and group introduced in 0.19.0 ([#​8178](https://redirect.github.com/cert-manager/cert-manager/issues/8178), [@​cert-manager-bot](https://redirect.github.com/cert-manager-bot))\n\n### [`v1.19.0`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.0)\n\n[Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.18.6...v1.19.0)\n\ncert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.\n\n> \u26A0\uFE0F **Known issues**: The following known issues are fixed in [v1.19.1](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.19.1):\n>\n> - [Unexpected certificate renewal after upgrading to 1.19.0](https://redirect.github.com/cert-manager/cert-manager/issues/8158)\n\nThis release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues.\n\n> \U0001F4D6 Read the full release notes at cert-manager.io: \n\nChanges since `v1.18.0`:\n\n##### Feature\n\n- Add IPv6 rules to the default network policy ([#​7726](https://redirect.github.com/cert-manager/cert-manager/issues/7726), [@​jcpunk](https://redirect.github.com/jcpunk))\n- Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#​7818](https://redirect.github.com/cert-manager/cert-manager/issues/7818), [@​StingRayZA](https://redirect.github.com/StingRayZA))\n- Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#​7795](https://redirect.github.com/cert-manager/cert-manager/issues/7795), [@​sspreitzer](https://redirect.github.com/sspreitzer))\n- Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#​7866](https://redirect.github.com/cert-manager/cert-manager/issues/7866), [@​erikgb](https://redirect.github.com/erikgb))\n- Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#​7414](https://redirect.github.com/cert-manager/cert-manager/issues/7414), [@​erikgb](https://redirect.github.com/erikgb))\n- Added `certmanager_certificate_challenge_status` Prometheus metric. ([#​7736](https://re\n\n> \u2702 **Note**\n> \n> PR body was truncated to here.\n\n\n
\n\n---\n\n### Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n - At any time (no schedule defined)\n- Automerge\n - At any time (no schedule defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and you won't be reminded about this update again.\n\n---\n\n - [ ] If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/vexxhost/atmosphere.common).\n\n" change_url: https://github.com/vexxhost/atmosphere.common/pull/105 commit_id: 4ab174a72079e89cc7e61a674221eb9e91158c0c patchset: 4ab174a72079e89cc7e61a674221eb9e91158c0c project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common topic: null job: atmosphere-common-molecule-secretgen-controller jobtags: [] max_attempts: 3 message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBoZWxtIHJlbGVhc2UgY2VydC1tYW5hZ2VyIHRvIHYxLjIxLjEKCj4g4oS577iPICoqTm90ZSoqCj4gCj4gVGhpcyBQUiBib2R5IHdhcyB0cnVuY2F0ZWQgZHVlIHRvIHBsYXRmb3JtIGxpbWl0cy4KClRoaXMgUFIgY29udGFpbnMgdGhlIGZvbGxvd2luZyB1cGRhdGVzOgoKfCBQYWNrYWdlIHwgVXBkYXRlIHwgQ2hhbmdlIHwKfC0tLXwtLS18LS0tfAp8IFtjZXJ0LW1hbmFnZXJdKGh0dHBzOi8vY2VydC1tYW5hZ2VyLmlvKSAoW3NvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIpKSB8IG1pbm9yIHwgYDEuMTguMmAg4oaSIGAxLjIxLjFgIHwKCi0tLQoKIyMjIFJlbGVhc2UgTm90ZXMKCjxkZXRhaWxzPgo8c3VtbWFyeT5jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyIChjZXJ0LW1hbmFnZXIpPC9zdW1tYXJ5PgoKIyMjIFtgdjEuMjEuMWBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMjEuMC4uLnYxLjIxLjEpCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMjEuMC4uLnYxLjIxLjEpCgojIyMgW2B2MS4yMS4wYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcmVsZWFzZXMvdGFnL3YxLjIxLjApCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMjAuMy4uLnYxLjIxLjApCgpjZXJ0LW1hbmFnZXIgaXMgdGhlIGVhc2llc3Qgd2F5IHRvIGF1dG9tYXRpY2FsbHkgbWFuYWdlIGNlcnRpZmljYXRlcyBpbiBLdWJlcm5ldGVzIGFuZCBPcGVuU2hpZnQgY2x1c3RlcnMuCgpjZXJ0LW1hbmFnZXIgMS4yMSBicmluZ3MgQUNNRSBSZW5ld2FsIEluZm9ybWF0aW9uIChBUkkpIHN1cHBvcnQsIEFXUyBJQU0gYXV0aGVudGljYXRpb24gZm9yIHRoZSBWYXVsdCBpc3N1ZXIsIHNldmVyYWwgc2VjdXJpdHkgaGFyZGVuaW5nIGNoYW5nZXMsIGFuZCBjb250aW51ZWQgaW1wcm92ZW1lbnRzIHRvIEdhdGV3YXkgQVBJIGludGVncmF0aW9uIGFuZCBjYWluamVjdG9yLiBUaGVyZSBhcmUgdGhyZWUgYnJlYWtpbmcgY2hhbmdlcyByZWxhdGVkIHRvIEhlbG0gY2hhcnQgUkJBQyBhbmQgbWV0cmljcyB2YWx1ZXMg4oCUIHJldmlldyB0aGVtIGNhcmVmdWxseSBiZWZvcmUgdXBncmFkaW5nLgoKIyMjIyBLbm93biBJc3N1ZXMKCi0gKipDb250cm9sbGVyIGNyYXNoLWxvb3BzIHdoZW4gYSBDZXJ0aWZpY2F0ZSBzZXRzIGByZW5ld2FsLnBvbGljeTogRGlzYWJsZWRgKio6IHRoZSBuZXcgQ2VydGlmaWNhdGUgcmVuZXdhbCBwb2xpY2llcyBmZWF0dXJlIChbIyYjODIwMzs4MjU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI1OCkpIGNhdXNlcyBhIG5pbCBwb2ludGVyIGRlcmVmZXJlbmNlIHBhbmljIGluIHRoZSB0cmlnZ2VyIGNvbnRyb2xsZXIgd2hlbmV2ZXIgYSBDZXJ0aWZpY2F0ZSdzIGBzcGVjLnJlbmV3YWwucG9saWN5YCBpcyBzZXQgdG8gYERpc2FibGVkYCDigJQgYHBraS5SZW5ld2FsVGltZSgpYCByZXR1cm5zIGAobmlsLCBuaWwpYCBmb3IgdGhhdCBwb2xpY3ksIGJ1dCB0aGUgY2FsbGVyIHVuY29uZGl0aW9uYWxseSBkZXJlZmVyZW5jZXMgdGhlIHJlc3VsdC4gVGhpcyBjcmFzaGVzIHRoZSBjb250cm9sbGVyIHByb2Nlc3MgKGNyYXNoLWxvb3ApIGZvciBhbnkgY2x1c3RlciB3aXRoIHN1Y2ggYSBDZXJ0aWZpY2F0ZS4gKipXb3JrYXJvdW5kKio6IGRvIG5vdCBzZXQgYHJlbmV3YWwucG9saWN5OiBEaXNhYmxlZGAgb24gYW55IENlcnRpZmljYXRlIHVudGlsIHRoaXMgaXMgZml4ZWQ7IHJlbW92ZSB0aGUgZmllbGQgKG9yIHNldCBhIGRpZmZlcmVudCBwb2xpY3kpIGZyb20gYW55IENlcnRpZmljYXRlIHRoYXQgYWxyZWFkeSBoYXMgaXQsIGFuZCByZXN0YXJ0IHRoZSBjb250cm9sbGVyIGlmIGl0IGlzIGN1cnJlbnRseSBjcmFzaC1sb29waW5nLiBTZWUgWyMmIzgyMDM7OTAzMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzkwMzEpIGZvciBkZXRhaWxzLgotICoqTG9nIHNwYW0gZm9yIG5vbi1jZXJ0LW1hbmFnZXItbGFiZWxsZWQgU2VjcmV0IGV2ZW50cyoqOiB0aGUgdHlwZWQgcHJlZGljYXRlcyByZWZhY3RvcmluZyAoWyMmIzgyMDM7ODQwN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg0MDcpKSBjYXVzZXMgYGZpbHRlcmVkRXZlbnRIYW5kbGVyYCB0eXBlIGFzc2VydGlvbiBmYWlsdXJlcyAoYCJPbkFkZCBtaXNzaW5nIE9iamVjdCJgLCBgIk9uVXBkYXRlIG1pc3NpbmcgT2JqZWN0T2xkImAsIGAiT25EZWxldGUgbWlzc2luZyBPYmplY3QiYCkgZm9yIGV2ZXJ5IG5vbi1jZXJ0LW1hbmFnZXItbGFiZWxsZWQgU2VjcmV0IGV2ZW50LCBtdWx0aXBsaWVkIGJ5IDcgY2VydGlmaWNhdGUgc3ViLWNvbnRyb2xsZXJzLiAqKlRoaXMgaXMgY29zbWV0aWMgb25seSoqIOKAlCB0aGUgYWZmZWN0ZWQgY29udHJvbGxlcnMgb25seSBuZWVkIGV2ZW50cyBmcm9tIGNlcnQtbWFuYWdlci1sYWJlbGxlZCBTZWNyZXRzICh3aGljaCBhcnJpdmUgdmlhIHRoZSB0eXBlZCBpbmZvcm1lcik7IHRoZSBtZXRhZGF0YSBpbmZvcm1lciBldmVudHMgd2VyZSBhbHdheXMgZmlsdGVyZWQgb3V0IGJ5IHByZWRpY2F0ZXMgaW4gcHJldmlvdXMgdmVyc2lvbnMuIElzc3VlciBhbmQgQ2x1c3Rlcklzc3VlciBjb250cm9sbGVycyBhcmUgbm90IGFmZmVjdGVkLiBTZWUgWyMmIzgyMDM7ODk5NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg5OTQpIGZvciBkZXRhaWxzLgotICoqSXNzdWVyL0NsdXN0ZXJJc3N1ZXIgY2FuIGdldCBzdHVjayBhdCBgUmVhZHk6IEZhbHNlLCBSZWFzb246IEludmFsaWRTb2x2ZXJgIGFuZCBuZXZlciBzZWxmLWNvcnJlY3QqKjogbmV3IGVhZ2VyIHZhbGlkYXRpb24gb2YgQUNNRSBzb2x2ZXIgU2VjcmV0cyAoWyMmIzgyMDM7ODI1NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyNTUpKSBtZWFucyBhbiBJc3N1ZXIvQ2x1c3Rlcklzc3VlciByZWZlcmVuY2luZyBhIHNvbHZlciBTZWNyZXQgKGUuZy4gYSBETlMwMSBwcm92aWRlciBjcmVkZW50aWFsKSB0aGF0IGRvZXNuJ3QgZXhpc3QgeWV0IHdpbGwgY29ycmVjdGx5IHJlcG9ydCBgUmVhZHk6IEZhbHNlYCwgYnV0IGNyZWF0aW5nIHRoZSBtaXNzaW5nIFNlY3JldCBhZnRlcndhcmRzIGRvZXMgbm90IHRyaWdnZXIgcmUtcmVjb25jaWxpYXRpb24g4oCUIHRoZSBjb250cm9sbGVyJ3MgU2VjcmV0LXdhdGNoIGxvZ2ljIHdhcyBuZXZlciB1cGRhdGVkIHRvIHJlY29nbmlzZSBzb2x2ZXIgU2VjcmV0cy4gSXQgd2lsbCBvbmx5IHJlY292ZXIgb24gdGhlIG5leHQgMTAtaG91ciBpbmZvcm1lciByZXN5bmMsIGEgY2hhbmdlIHRvIHRoZSBJc3N1ZXIvQ2x1c3Rlcklzc3VlcidzIG93biBzcGVjLCBvciBhIGNvbnRyb2xsZXIgcmVzdGFydC4gKipXb3JrYXJvdW5kKio6IGFmdGVyIGNyZWF0aW5nIHRoZSBtaXNzaW5nIFNlY3JldCwgbWFrZSBhIHRyaXZpYWwgZWRpdCB0byB0aGUgSXNzdWVyL0NsdXN0ZXJJc3N1ZXIgc3BlYyAob3IgZGVsZXRlIGFuZCByZWNyZWF0ZSBpdCkgdG8gZm9yY2UgcmVjb25jaWxpYXRpb24uIFNlZSBbIyYjODIwMzs5MDM2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvOTAzNikgZm9yIGRldGFpbHMgYW5kIGEgZml4IHByb3Bvc2FsLgoKIyMjIyBNYWpvciBUaGVtZXMKCiMjIyMjIERlZmF1bHQgYHRva2VucmVxdWVzdGAgUkJBQyByZW1vdmVkIGZyb20gSGVsbSBjaGFydAoKPiDimqDvuI8gQnJlYWtpbmcgY2hhbmdlCgpUaGUgSGVsbSBjaGFydCBubyBsb25nZXIgY3JlYXRlcyBhIGRlZmF1bHQgYFJvbGVgIGFuZCBgUm9sZUJpbmRpbmdgIGdyYW50aW5nIHRoZSBjZXJ0LW1hbmFnZXIgY29udHJvbGxlciBwZXJtaXNzaW9uIHRvIGNyZWF0ZSB0b2tlbnMgZm9yIGl0cyBvd24gU2VydmljZUFjY291bnQgKGBzZXJ2aWNlYWNjb3VudHMvdG9rZW46IGNyZWF0ZWApLiBObyBkb2N1bWVudGVkIHdvcmtmbG93IHJlcXVpcmVzIHRoaXMgUkJBQyDigJQgdGhlIFJvdXRlNTMgZG9jcyBzZWN0aW9uIHRoYXQgbW90aXZhdGVkIGl0IHdhcyByZW1vdmVkIGluIDIwMjQuCgpJZiB5b3UgdXNlIGBzZXJ2aWNlQWNjb3VudFJlZi5uYW1lYCBwb2ludGluZyBhdCB0aGUgY29udHJvbGxlciBTZXJ2aWNlQWNjb3VudCwgeW91IG11c3Qgbm93IGVpdGhlciBjcmVhdGUgeW91ciBvd24gYFJvbGVgL2BSb2xlQmluZGluZ2AgZ3JhbnRpbmcgYHNlcnZpY2VhY2NvdW50cy90b2tlbjogY3JlYXRlYCwgb3IgbWlncmF0ZSB0byBhIGRlZGljYXRlZCBTZXJ2aWNlQWNjb3VudCAocmVjb21tZW5kZWQg4oCUIHNlZSB0aGUgW1ZhdWx0XShodHRwczovL2NlcnQtbWFuYWdlci5pby9kb2NzL2NvbmZpZ3VyYXRpb24vdmF1bHQvKSBvciBbUm91dGU1M10oaHR0cHM6Ly9jZXJ0LW1hbmFnZXIuaW8vZG9jcy9jb25maWd1cmF0aW9uL2FjbWUvZG5zMDEvcm91dGU1My8pIGRvY3VtZW50YXRpb24pLgoKIyMjIyMgUmVzdHJpY3QgQ2hhbGxlbmdlIGFuZCBPcmRlciBSQkFDIGluIGBjZXJ0LW1hbmFnZXItZWRpdGAgQ2x1c3RlclJvbGUKCj4g4pqg77iPIFBvdGVudGlhbGx5IGJyZWFraW5nIGNoYW5nZQoKVGhlIGBjZXJ0LW1hbmFnZXItZWRpdGAgYWdncmVnYXRlIENsdXN0ZXJSb2xlIG5vIGxvbmdlciBncmFudHMgYGNyZWF0ZWAgZm9yIGBjaGFsbGVuZ2VzLmFjbWUuY2VydC1tYW5hZ2VyLmlvYCBvciBgY3JlYXRlYCwgYHBhdGNoYCwgYHVwZGF0ZWAgZm9yIGBvcmRlcnMuYWNtZS5jZXJ0LW1hbmFnZXIuaW9gIChbYEdIU0EtOHJ2ai1tbTRoLWMyNThgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtOHJ2ai1tbTRoLWMyNTgpKS4gVGhlc2UgcmVzb3VyY2VzIGFyZSBpbnRlcm5hbCB0byBjZXJ0LW1hbmFnZXIncyBBQ01FIHdvcmtmbG93LiBDaGFsbGVuZ2UgYHBhdGNoYCBhbmQgYHVwZGF0ZWAgYXJlIHJldGFpbmVkIGJlY2F1c2UgdXNlcnMgbWF5IG5lZWQgdGhlbSB0byByZW1vdmUgc3R1Y2sgZmluYWxpemVycy4KClRoaXMgY2hhbmdlIHdhcyBhbHJlYWR5IHNoaXBwZWQgaW4gdjEuMjAuMyBhbmQgdjEuMTkuNiwgc28gaWYgeW91IGFyZSBydW5uaW5nIG9uZSBvZiB0aG9zZSB2ZXJzaW9ucyB0aGlzIHdpbGwgbm90IGJlIGEgYnJlYWtpbmcgY2hhbmdlLiBJZiB5b3UgaGF2ZSB0b29saW5nIHRoYXQgY3JlYXRlcyBDaGFsbGVuZ2Ugb3IgT3JkZXIgcmVzb3VyY2VzIGRpcmVjdGx5LCB5b3Ugd2lsbCBuZWVkIHRvIGdyYW50IHRob3NlIHBlcm1pc3Npb25zIGV4cGxpY2l0bHkuCgojIyMjIyBNZXRyaWNzIHBvcnQgbmFtZSBhbmQgcGF0aCBIZWxtIHZhbHVlcyByZW1vdmVkCgo+IOKaoO+4jyBCcmVha2luZyBjaGFuZ2UKClRoZSBIZWxtIHZhbHVlcyBgcHJvbWV0aGV1cy5zZXJ2aWNlbW9uaXRvci50YXJnZXRQb3J0YCwgYHByb21ldGhldXMuc2VydmljZW1vbml0b3IucGF0aGAsIGFuZCBgcHJvbWV0aGV1cy5wb2Rtb25pdG9yLnBhdGhgIGhhdmUgYmVlbiByZW1vdmVkLiBUaGUgY29udHJvbGxlciBTZXJ2aWNlIG1ldHJpY3MgcG9ydCBoYXMgYmVlbiByZW5hbWVkIGZyb20gYHRjcC1wcm9tZXRoZXVzLXNlcnZpY2Vtb25pdG9yYCB0byBgaHR0cC1tZXRyaWNzYC4gQmVjYXVzZSB0aGUgSGVsbSB2YWx1ZXMgc2NoZW1hIHVzZXMgYGFkZGl0aW9uYWxQcm9wZXJ0aWVzOiBmYWxzZWAsIHVzZXJzIHdobyBzdGlsbCBoYXZlIGFueSBvZiB0aGUgcmVtb3ZlZCBrZXlzIGluIHRoZWlyIHZhbHVlcyBvdmVycmlkZXMgd2lsbCBzZWUgYSBzY2hlbWEgdmFsaWRhdGlvbiBlcnJvciBvbiB1cGdyYWRlIOKAlCByZW1vdmUgdGhlbSBiZWZvcmUgdXBncmFkaW5nLiAoWyMmIzgyMDM7ODk1Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg5NTIpKQoKIyMjIyMgQUNNRSBhbmQgQ2VydGlmaWNhdGUgTWFuYWdlbWVudAoKLSAqKkFDTUUgUmVuZXdhbCBJbmZvcm1hdGlvbiAoQVJJKSoqOiBleHBlcmltZW50YWwgc3VwcG9ydCBmb3IgW1JGQyA5NzczXShodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjOTc3MykgYmVoaW5kIHRoZSBgQUNNRVVzZUFSSWAgZmVhdHVyZSBnYXRlLiBXaGVuIGVuYWJsZWQsIGNlcnQtbWFuYWdlciBxdWVyaWVzIHRoZSBBQ01FIHNlcnZlcidzIGByZW5ld2FsSW5mb2AgZW5kcG9pbnQgZm9yIHRoZSByZWNvbW1lbmRlZCByZW5ld2FsIHdpbmRvdywgYWxsb3dpbmcgc2VydmVycyBsaWtlIExldCdzIEVuY3J5cHQgdG8gcHJvYWN0aXZlbHkgcHJvbXB0IHJlbmV3YWwgZHVyaW5nIG1hc3MgcmV2b2NhdGlvbnMgb3IgQ0Ega2V5IHJvbGxvdmVycy4gKFsjJiM4MjAzOzg3OThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84Nzk4KSkKLSAqKmB3YWl0SW5zdGVhZE9mU2VsZkNoZWNrYCBzb2x2ZXIgb3B0aW9uKio6IHNraXAgY2VydC1tYW5hZ2VyJ3Mgb3duIHNlbGYtY2hlY2sgYW5kIGluc3RlYWQgd2FpdCBhIGNvbmZpZ3VyZWQgZHVyYXRpb24gYmVmb3JlIGFza2luZyB0aGUgQUNNRSBzZXJ2ZXIgdG8gdmFsaWRhdGUuIEFuIGVzY2FwZSBoYXRjaCBmb3Igc3BsaXQtaG9yaXpvbiBETlMgYW5kIE5BVCBoYWlycGluIGVudmlyb25tZW50cy4gU2VlIFtjb25maWd1cmF0aW9uIGRldGFpbHNdKGh0dHBzOi8vY2VydC1tYW5hZ2VyLmlvL2RvY3MvY29uZmlndXJhdGlvbi9hY21lLyNza2lwLXRoZS1zZWxmLWNoZWNrLXdpdGgtd2FpdGluc3RlYWRvZnNlbGZjaGVjaykuIChbIyYjODIwMzs4ODU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODg1OCkpCi0gKipBV1MgSUFNIGF1dGhlbnRpY2F0aW9uIGZvciBWYXVsdCoqOiB0aGUgVmF1bHQgaXNzdWVyIG5vdyBzdXBwb3J0cyBJUlNBLCBFS1MgUG9kIElkZW50aXR5LCBhbmQgYW1iaWVudCBFQzIvRUNTIGNyZWRlbnRpYWxzLCByZW1vdmluZyB0aGUgbmVlZCBmb3IgbG9uZy1saXZlZCBBV1MgU2VjcmV0cy4gKFsjJiM4MjAzOzg0MjJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDIyKSkKLSAqKkNlcnRpZmljYXRlIHJlbmV3YWwgcG9saWNpZXMqKjogYSBuZXcgYHJlbmV3YWxQb2xpY2llc2AgZmllbGQgb24gdGhlIENlcnRpZmljYXRlIEFQSSBwcm92aWRlcyBtb3JlIGV4cHJlc3NpdmUgY29udHJvbCBvdmVyIHJlbmV3YWwgc2NoZWR1bGluZywgY29tcGxlbWVudGluZyBgcmVuZXdCZWZvcmVgIGFuZCBgcmVuZXdCZWZvcmVQZXJjZW50YWdlYC4gKFsjJiM4MjAzOzgyNThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjU4KSkKLSAqKkNvbmZpZ3VyYWJsZSBDZXJ0aWZpY2F0ZVJlcXVlc3QgcmV0cnkgYmFja29mZioqOiB0aGUgbmV3IGAtLWNlcnRpZmljYXRlLXJlcXVlc3QtbWF4aW11bS1iYWNrb2ZmLWR1cmF0aW9uYCBmbGFnIChkZWZhdWx0OiAzMiBob3VycykgY2FwcyB0aGUgZXhwb25lbnRpYWwgYmFja29mZiBmb3IgZmFpbGVkIENlcnRpZmljYXRlUmVxdWVzdHMsIHVzZWZ1bCBmb3IgZW52aXJvbm1lbnRzIHdpdGggc2NoZWR1bGVkIENBIG1haW50ZW5hbmNlIHdpbmRvd3MuIChbIyYjODIwMzs4ODkzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODg5MykpCi0gKipNb2Rlcm4yMDI2IFtQS0NTIzEyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vUEtDUy9jZXJ0LW1hbmFnZXIvaXNzdWVzLzEyKSBwcm9maWxlKio6IGEgbmV3IEZJUFMgMTQwLTMgY29tcGF0aWJsZSBlbmNvZGluZyBwcm9maWxlIHVzaW5nIEFFUy0yNTYgKyBTSEEtMjU2IEtERnMgaW5zdGVhZCBvZiBsZWdhY3kgM0RFUy9SQzIuIChbIyYjODIwMzs4ODQxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODg0MSkpCi0gKipXZWJob29rIGNlcnRpZmljYXRlIHJlbmV3YWwgYWZ0ZXIgc3lzdGVtIHN1c3BlbmQqKjogdGhlIHdlYmhvb2sgbm93IGRldGVjdHMgbWlzc2VkIGNlcnRpZmljYXRlIHJlbmV3YWxzIGFmdGVyIHN5c3RlbSBzdXNwZW5kIChTMy9TNCkgb3IgVk0gbGl2ZSBtaWdyYXRpb24gYnkgcG9sbGluZyB3YWxsLWNsb2NrIHRpbWUsIHJlY292ZXJpbmcgd2l0aGluIG9uZSBtaW51dGUgb2YgcmVzdW1lLiAoWyMmIzgyMDM7ODQ2NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg0NjQpKQoKIyMjIyMgR2F0ZXdheSBBUEkgYW5kIGNhaW5qZWN0b3IKCi0gKipIVFRQMDEgTGlzdGVuZXJTZXQgcGFyZW50UmVmIGZhbGxiYWNrKio6IHRoZSBgYWNtZS5jZXJ0LW1hbmFnZXIuaW8vaHR0cDAxLXBhcmVudHJlZmZhbGxiYWNrOiAidHJ1ZSJgIGFubm90YXRpb24gY2F1c2VzIGNlcnQtbWFuYWdlciB0byB1c2UgdGhlIHBhcmVudCBHYXRld2F5IGZvciBzb2x2ZXIgSFRUUFJvdXRlcyBpbnN0ZWFkIG9mIHRoZSBMaXN0ZW5lclNldCwgZW5hYmxpbmcgVExTLW9ubHkgTGlzdGVuZXJTZXRzIHRvIHVzZSBhIHNoYXJlZCBIVFRQIGxpc3RlbmVyIGZvciBBQ01FIGNoYWxsZW5nZXMuIChbIyYjODIwMzs4NzQ5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODc0OSkpCi0gKipgY2VydC1tYW5hZ2VyLmlvL2lnbm9yZS10bHMtbGlzdGVuZXJzYCBhbm5vdGF0aW9uKio6IGV4Y2x1ZGUgc3BlY2lmaWMgR2F0ZXdheSBUTFMgbGlzdGVuZXJzIGZyb20gY2VydGlmaWNhdGUgbWFuYWdlbWVudC4gKFsjJiM4MjAzOzg3MjddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NzI3KSkKLSAqKkFkZGl0aW9uYWwgbGlzdGVuZXIgcHJvdG9jb2xzKio6IGNvbmZpZ3VyYWJsZSBsaXN0ZW5lciBwcm90b2NvbHMgYmV5b25kIHRoZSBkZWZhdWx0IHNldC4gKFsjJiM4MjAzOzg2ODNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjgzKSkKLSAqKmBlbmFibGVHYXRld2F5QVBJYCBjb25maWd1cmF0aW9uIHJlc3RydWN0dXJlKio6IGBlbmFibGVHYXRld2F5QVBJYCBhbmQgYGVuYWJsZUdhdGV3YXlBUElMaXN0ZW5lclNldGAgYXJlIGRlcHJlY2F0ZWQgaW4gZmF2b3Igb2YgYGdhdGV3YXlBUEkuZW5hYmxlZGAgLyBgZ2F0ZXdheUFQSS5lbmFibGVMaXN0ZW5lclNldGAuIFRoZSBvbGQgZmllbGRzIGNvbnRpbnVlIHRvIHdvcmsuIChbIyYjODIwMzs4NzMyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODczMikpCi0gKipgQ0FJbmplY3Rvck1lcmdpbmdgIHByb21vdGVkIHRvIEdBKio6IHVuY29uZGl0aW9uYWxseSBlbmFibGVkOyB3aWxsIGJlIHJlbW92ZWQgaW4gYSBmdXR1cmUgcmVsZWFzZS4gKFsjJiM4MjAzOzg1ODNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NTgzKSkKLSAqKmNhaW5qZWN0b3Igc2VydmVyLXNpZGUgYXBwbHkgdW5jb25kaXRpb25hbCoqOiB0aGUgYFNlcnZlclNpZGVBcHBseWAgZmVhdHVyZSBnYXRlIGlzIGRlcHJlY2F0ZWQuIChbIyYjODIwMzs4NjkyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODY5MikpCi0gKipjYWluamVjdG9yIGAtLWlnbm9yZS1uYW1lc3BhY2VzYCBmbGFnKio6IHNraXAgc3BlY2lmaWVkIG5hbWVzcGFjZXMgd2hlbiB3YXRjaGluZyBTZWNyZXRzIGZvciBpbmplY3Rpb24uIChbIyYjODIwMzs4NjE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODYxNCkpCgojIyMjIyBEZXBsb3ltZW50IGFuZCBPYnNlcnZhYmlsaXR5CgotICoqVmVuYWZpIE9BdXRoIHRva2VuIG9ic2VydmFiaWxpdHkqKjogYSBuZXcgYEF1dGhGYWlsZWRgIElzc3VlciBjb25kaXRpb24gcmVhc29uIGRpc3Rpbmd1aXNoZXMgYmFkIGNyZWRlbnRpYWxzIGZyb20gdHJhbnNpZW50IGVycm9ycy4gUEFOVyBOR1RTIGlzIG5vdyBzdXBwb3J0ZWQgYXMgYSBWZW5hZmkgYmFja2VuZC4gKFsjJiM4MjAzOzg4MDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84ODA4KSwgWyMmIzgyMDM7ODc3OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3NzkpKQotICoqYHJ1bnRpbWVDbGFzc05hbWVgIHN1cHBvcnQqKjogY29uZmlndXJhYmxlIGZvciBjZXJ0LW1hbmFnZXIgY29tcG9uZW50cyBhbmQgQUNNRSBIVFRQMDEgc29sdmVyIHBvZHMuIChbIyYjODIwMzs4NzkxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODc5MSksIFsjJiM4MjAzOzg5NzZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84OTc2KSkKLSAqKmBzdGFydHVwYXBpY2hlY2sudHRsU2Vjb25kc0FmdGVyRmluaXNoZWRgKio6IG9wdC1pbiBhdXRvbWF0aWMgY2xlYW51cCBvZiB0aGUgc3RhcnR1cGFwaWNoZWNrIEpvYi4gKFsjJiM4MjAzOzg1MjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NTIzKSkKLSAqKmAtLWFjbWUtaHR0cDAxLXNvbHZlci1leHRyYS1sYWJlbHNgKio6IHByb3BhZ2F0ZSBgZ2xvYmFsLmNvbW1vbkxhYmVsc2AgdG8gZHluYW1pY2FsbHktY3JlYXRlZCBBQ01FIEhUVFAwMSBzb2x2ZXIgcmVzb3VyY2VzLiAoWyMmIzgyMDM7ODc2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3NjEpKQoKIyMjIyMgTm90YWJsZSBCdWcgRml4ZXMKCi0gKipJbnRlZ2VyIG92ZXJmbG93IGluIGByZW5ld0JlZm9yZVBlcmNlbnRhZ2VgKio6IENlcnRpZmljYXRlcyB3aXRoIGR1cmF0aW9ucyBsb25nZXIgdGhhbiBhcHByb3hpbWF0ZWx5IDMgeWVhcnMgd2VyZSBpbmNvcnJlY3RseSByZWplY3RlZCBvciBhc3NpZ25lZCBpbmNvcnJlY3QgcmVuZXdhbCB0aW1lcy4gKFsjJiM4MjAzOzg5NDddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84OTQ3KSkKLSAqKkluZmluaXRlIHJlLWlzc3VhbmNlIGxvb3AqKjogY2VydC1tYW5hZ2VyIG5vIGxvbmdlciBsb29wcyB3aGVuIGFuIGlzc3VlciByZXR1cm5zIGFuIGFscmVhZHktZXhwaXJlZCBjZXJ0aWZpY2F0ZS4gKFsjJiM4MjAzOzg2MTBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjEwKSkKLSAqKkFDTUUgdHJhbnNpZW50IG5ldHdvcmsgZXJyb3JzKio6IGNoYWxsZW5nZXMgbm8gbG9uZ2VyIHBlcm1hbmVudGx5IGZhaWwgb24gVExTIGhhbmRzaGFrZSB0aW1lb3V0cywgRE5TIHJlc29sdXRpb24gZmFpbHVyZXMsIG9yIGNvbnRleHQgY2FuY2VsbGF0aW9uIGR1cmluZyBub25jZSBmZXRjaGVzIGFuZCBhdXRob3JpemF0aW9uIHdhaXRzLiAoWyMmIzgyMDM7ODc2MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3NjApKQotICoqRE5TLW92ZXItSFRUUFMgcmVzcG9uc2UgYm9keSBjYXAqKjogcmVzcG9uc2UgYm9keSByZWFkcyBhcmUgbm93IGJvdW5kZWQgYXQgMTI4IEtCIHRvIHByZXZlbnQgcG90ZW50aWFsIE9PTS4gKFsjJiM4MjAzOzg4MDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84ODAzKSkKLSAqKlZhdWx0IHBhdGggdHJhdmVyc2FsKio6IHRoZSBWYXVsdCBpc3N1ZXIgd2ViaG9vayBub3cgcmVqZWN0cyBgLi5gIHBhdGggc2VnbWVudHMsIHByZXZlbnRpbmcgYHBhdGguSm9pbmAgZnJvbSBzaWxlbnRseSByZXNvbHZpbmcgcmVsYXRpdmUgc2VnbWVudHMuIChbIyYjODIwMzs4OTMwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODkzMCkpCi0gKipETlMgaXNzdWVyIHNlY3JldHMgdmFsaWRhdGVkIGJlZm9yZSByZWFkeSoqOiBwcmV2ZW50cyBzaWxlbnQgbWlzY29uZmlndXJhdGlvbi4gKFsjJiM4MjAzOzgyNTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjU1KSkKCiMjIyMgQ29tbXVuaXR5CgpBcyBhbHdheXMsIHdlJ2QgbGlrZSB0byB0aGFuayBhbGwgb2YgdGhlIGNvbW11bml0eSBtZW1iZXJzIHdobyBoZWxwZWQgaW4gdGhpcyByZWxlYXNlIGN5Y2xlLCBpbmNsdWRpbmcgYWxsIGJlbG93IHdobyBtZXJnZWQgYSBQUiBhbmQgYW55b25lIHRoYXQgaGVscGVkIGJ5IGNvbW1lbnRpbmcgb24gaXNzdWVzLCB0ZXN0aW5nLCBvciBnZXR0aW5nIGludm9sdmVkIGluIGNlcnQtbWFuYWdlciBtZWV0aW5ncy4gV2UncmUgbHVja3kgdG8gaGF2ZSB5b3UgaW52b2x2ZWQuCgpBIHNwZWNpYWwgdGhhbmtzIHRvOgoKLSBbQCYjODIwMztDb3BpbG90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vQ29waWxvdCkKLSBbQCYjODIwMztGZWxpeFBoaXBwc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0ZlbGl4UGhpcHBzKQotIFtAJiM4MjAzO1BlYWMzNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1BlYWMzNikKLSBbQCYjODIwMztTZWJUYXJkaWZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZWJUYXJkaWYpCi0gW0AmIzgyMDM7YXBrYXRzaWthc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fwa2F0c2lrYXMpCi0gW0AmIzgyMDM7Yml0bG9pXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYml0bG9pKQotIFtAJiM4MjAzO2RhcDBhbV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RhcDBhbSkKLSBbQCYjODIwMztmaWdhd10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2ZpZ2F3KQotIFtAJiM4MjAzO2ltbWFudXdlbGxdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9pbW1hbnV3ZWxsKQotIFtAJiM4MjAzO2phYmJyd2NreV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2phYmJyd2NreSkKLSBbQCYjODIwMztqbm9obGdhcmRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9qbm9obGdhcmQpCi0gW0AmIzgyMDM7anNvcmVmXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vanNvcmVmKQotIFtAJiM4MjAzO2x0d29uZ2FhXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHR3b25nYWEpCi0gW0AmIzgyMDM7bHVuYXJ3aGl0ZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2x1bmFyd2hpdGUpCi0gW0AmIzgyMDM7bWF0ZWVuYWxpNjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tYXRlZW5hbGk2NikKLSBbQCYjODIwMztvbnVybWljb29ndWxsYXJpXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vb251cm1pY29vZ3VsbGFyaSkKLSBbQCYjODIwMztwdXRvbmd5b25nXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcHV0b25neW9uZykKLSBbQCYjODIwMztzZWFub3JhbWFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9zZWFub3JhbWEpCi0gW0AmIzgyMDM7dGV4YXNpY2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS90ZXhhc2ljaCkKCmZvciB0aGVpciBjb250cmlidXRpb25zLCBjb21tZW50cyBhbmQgc3VwcG9ydCEKCkFsc28sIHRoYW5rcyB0byB0aGUgY2VydC1tYW5hZ2VyIG1haW50YWluZXIgdGVhbSBmb3IgdGhlaXIgaGVscCBpbiB0aGlzIHJlbGVhc2U6CgotIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKQotIFtAJiM4MjAzO1RoYXRzTXJUYWxib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9UaGF0c01yVGFsYm90KQotIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikKLSBbQCYjODIwMztoam9zaGkxMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9oam9zaGkxMjMpCi0gW0AmIzgyMDM7aW50ZW9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaW50ZW9uKQotIFtAJiM4MjAzO21hZWx2bHNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tYWVsdmxzKQotIFtAJiM4MjAzO211bm5lcnpdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tdW5uZXJ6KQotIFtAJiM4MjAzO3dhbGxyal0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyaikKLSBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspCgpBbmQgZmluYWxseSwgdGhhbmtzIHRvIHRoZSBjZXJ0LW1hbmFnZXIgc3RlZXJpbmcgY29tbWl0dGVlIGZvciB0aGVpciBmZWVkYmFjayBpbiB0aGlzIHJlbGVhc2UgY3ljbGU6CgotIFtAJiM4MjAzO0Zsb3JpYW5MaWViaGFydF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0Zsb3JpYW5MaWViaGFydCkKLSBbQCYjODIwMztUcmlsb2tHZWVyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vVHJpbG9rR2VlcikKLSBbQCYjODIwMztpYW5hcnNlbmF1bHRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9pYW5hcnNlbmF1bHQpCi0gW0AmIzgyMDM7c3N5bm9dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9zc3lubykKCiMjIyMgQ2hhbmdlcyBzaW5jZSB2MS4yMC4wCgojIyMjIyBGZWF0dXJlCgotIEFkZCBWZW5hZmkgT0F1dGggdG9rZW4gcmVxdWVzdCBvYnNlcnZhYmlsaXR5IGFuZCBhIG5ldyBgQXV0aEZhaWxlZGAgSXNzdWVyIGNvbmRpdGlvbiByZWFzb24gdG8gZGlzdGluZ3Vpc2ggYmFkIGNyZWRlbnRpYWxzIGZyb20gdHJhbnNpZW50IGluZnJhc3RydWN0dXJlIGVycm9ycy4gKFsjJiM4MjAzOzg4MDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84ODA4KSwgW0AmIzgyMDM7RmVsaXhQaGlwcHNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9GZWxpeFBoaXBwcykpCi0gQWRkIGBjZXJ0aWZpY2F0ZVJlcXVlc3RNYXhpbXVtQmFja29mZkR1cmF0aW9uYCBjb250cm9sbGVyIGNvbmZpZ3VyYXRpb24gb3B0aW9uIHRvIGNhcCByZXRyeSBiYWNrb2ZmIHRpbWUgZm9yIGZhaWxlZCBDZXJ0aWZpY2F0ZVJlcXVlc3RzLiBDb25maWd1cmFibGUgdmlhIGNvbmZpZyBmaWxlLCBgLS1jZXJ0aWZpY2F0ZS1yZXF1ZXN0LW1heGltdW0tYmFja29mZi1kdXJhdGlvbmAgQ0xJIGZsYWcsIG9yIEhlbG0gdmFsdWUgYGNvbmZpZy5jZXJ0aWZpY2F0ZVJlcXVlc3RNYXhpbXVtQmFja29mZkR1cmF0aW9uYC4gRGVmYXVsdHMgdG8gMzIgaG91cnMgZm9yIGJhY2t3YXJkIGNvbXBhdGliaWxpdHkuIChbIyYjODIwMzs4ODkzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODg5MyksIFtAJiM4MjAzO2x1bmFyd2hpdGVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9sdW5hcndoaXRlKSkKLSBBZGQgYW4gb3B0aW9uYWwgYHdhaXRJbnN0ZWFkT2ZTZWxmQ2hlY2tgIGZpZWxkIHRvIEFDTUUgSFRUUDAxIGFuZCBETlMwMSBzb2x2ZXJzIHNvIGNlcnQtbWFuYWdlciBjYW4gc2tpcCBpdHMgb3duIHNlbGYtY2hlY2sgYW5kIGFzayB0aGUgQUNNRSBzZXJ2ZXIgdG8gdmFsaWRhdGUgYWZ0ZXIgYSBjb25maWd1cmVkIHdhaXQuIChbIyYjODIwMzs4ODU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODg1OCksIFtAJiM4MjAzO3dhbGxyal0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyaikpCi0gQWRkIGNvbmZpZ3VyYWJsZSBgcnVudGltZUNsYXNzTmFtZWAgc3VwcG9ydCBmb3IgY2VydC1tYW5hZ2VyIGNvbXBvbmVudHMgYW5kIEFDTUUgSFRUUDAxIHNvbHZlciBwb2RzLiAoWyMmIzgyMDM7ODc5MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3OTEpLCBbQCYjODIwMztqc29yZWZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9qc29yZWYpKQotIEFkZCBkaXJlY3QgY29uZmlndXJhYmxlIGBydW50aW1lQ2xhc3NOYW1lYCBzdXBwb3J0IGZvciBBQ01FIEhUVFAwMSBzb2x2ZXIgcG9kcyB2aWEgdGhlIGBhY21lc29sdmVyLnJ1bnRpbWVDbGFzc05hbWVgIEhlbG0gdmFsdWUuIChbIyYjODIwMzs4OTc2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODk3NiksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCi0gQWRkIG5ldyBjb250cm9sbGVyIGZsYWcgYC0tYWNtZS1odHRwMDEtc29sdmVyLWV4dHJhLWxhYmVsc2AsIGFsbG93aW5nIEhlbG0ncyBgZ2xvYmFsLmNvbW1vbkxhYmVsc2AgdG8gcHJvcGFnYXRlIHRvIGFsbCBkeW5hbWljYWxseS1jcmVhdGVkIEFDTUUgSFRUUDAxIHNvbHZlciByZXNvdXJjZXMgKFBvZHMsIFNlcnZpY2VzLCBJbmdyZXNzZXMsIG9yIEdhdGV3YXkgQVBJIEhUVFBSb3V0ZXMpLiAoWyMmIzgyMDM7ODc2MV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3NjEpLCBbQCYjODIwMztsdW5hcndoaXRlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHVuYXJ3aGl0ZSkpCi0gQWRkIG9wdC1pbiBgc3RhcnR1cGFwaWNoZWNrLnR0bFNlY29uZHNBZnRlckZpbmlzaGVkYCBIZWxtIHZhbHVlIHRvIGVuYWJsZSBhdXRvbWF0aWMgY2xlYW51cCBvZiB0aGUgc3RhcnR1cGFwaWNoZWNrIEpvYiB2aWEgdGhlIEt1YmVybmV0ZXMgVFRMLWFmdGVyLWZpbmlzaGVkIGNvbnRyb2xsZXIuIChbIyYjODIwMzs4NTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODUyMyksIFtAJiM4MjAzO2RhcDBhbV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RhcDBhbSkpCi0gQWRkZWQgQVJJIHN1cHBvcnQgdGhyb3VnaCB0aGUgQUNNRVVzZUFSSSBmZWF0dXJlIGdhdGUuIChbIyYjODIwMzs4Nzk4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODc5OCksIFtAJiM4MjAzO2hqb3NoaTEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2hqb3NoaTEyMykpCi0gQWRkZWQgQVdTIElBTSBhdXRoZW50aWNhdGlvbiBzdXBwb3J0IGZvciBWYXVsdCBpc3N1ZXIsIGluY2x1ZGluZyBJUlNBIChJQU0gUm9sZXMgZm9yIFNlcnZpY2UgQWNjb3VudHMpIGFuZCBhbWJpZW50IGNyZWRlbnRpYWxzIChFQzIvRUNTKS4gKFsjJiM4MjAzOzg0MjJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDIyKSwgW0AmIzgyMDM7Yml0bG9pXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYml0bG9pKSkKLSBBZGRlZCBgY2VydC1tYW5hZ2VyLmlvL2lnbm9yZS10bHMtbGlzdGVuZXJzYCBhbm5vdGF0aW9uIGZvciBpZ25vcmluZyBnd2FwaSBsaXN0ZW5lcnMuIChbIyYjODIwMzs4NzI3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODcyNyksIFtAJiM4MjAzO2hqb3NoaTEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2hqb3NoaTEyMykpCi0gQWRkZWQgb3B0aW9uIHRvIHNwZWNpZnkgYWRkaXRpb25hbCBsaXN0ZW5lciBwcm90b2NvbHMgdGhlIEdhdGV3YXlBUEkgaW50ZWdyYXRpb24gd2lsbCBjb25zaWRlciB3aGVuIGNyZWF0aW5nIGNlcnRpZmljYXRlcy4gKFsjJiM4MjAzOzg2ODNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjgzKSwgW0AmIzgyMDM7VGhhdHNNclRhbGJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1RoYXRzTXJUYWxib3QpKQotIEFkZHMgc3VwcG9ydCBmb3IgdGhlIE1vZGVybjIwMjYgZ28tcGtjczEyIHByb2ZpbGUgYW5kIEZJUFMgMTQwLTMgKFsjJiM4MjAzOzg4NDFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84ODQxKSwgW0AmIzgyMDM7c2Vhbm9yYW1hXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vc2Vhbm9yYW1hKSkKLSBDYWluamVjdG9yOiBBIG5ldyBmbGFnIGAtLWlnbm9yZS1uYW1lc3BhY2VzYCB3YXMgYWRkZWQgdG8gdGhlIGNhaW5qZWN0b3IgYmluYXJ5LiBJdCBjYW4gYmUgdXNlZCB0byBmaWx0ZXIgb3V0IG5hbWVzcGFjZXMgZnJvbSBiZWluZyB3YXRjaGVkIGZvciBzZWNyZXRzIHRvIHVzZSBmb3IgaW5qZWN0YWJsZXMuIChbIyYjODIwMzs4NjE0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODYxNCksIFtAJiM4MjAzO2ZpZ2F3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZmlnYXcpKQotIERpc2FibGVkIGNsaWVudCBzaWRlIHJhdGUtbGltaXRpbmcgaWYgQVBcJkYgaXMgZW5hYmxlZC4gKFsjJiM4MjAzOzg3NTddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NzU3KSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKLSBFeHRlbmQgdGhlIFZlbmFmaS9DeWJlckFyayBpbnRlZ3JhdGlvbiB0byBhbHNvIHN1cHBvcnQgUEFOVyBOR1RTLiAoWyMmIzgyMDM7ODc3OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3NzkpLCBbQCYjODIwMztGZWxpeFBoaXBwc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0ZlbGl4UGhpcHBzKSkKLSBBZGRpbmcgY2VydGlmaWNhdGUgcmVuZXdhbCBwb2xpY2llcyAoWyMmIzgyMDM7ODI1OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyNTgpLCBbQCYjODIwMztoam9zaGkxMjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9oam9zaGkxMjMpKQotIE1ha2UgY2FpbmplY3RvciB1c2UgU1NBIHVuY29uZGl0aW9uYWxseSBhbmQgZGVwcmVjYXRlIHRoZSBTZXJ2ZXJTaWRlQXBwbHkgZmVhdHVyZSBnYXRlIChbIyYjODIwMzs4NjkyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODY5MiksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCi0gUHJvY2Vzc2VkIGFubm90YXRpb25zIGBjZXJ0LW1hbmFnZXIuaW8vYWx0LW5hbWVzYCwgYGNlcnQtbWFuYWdlci5pby9pcC1zYW5zYCB0byBDZXJ0aWZpY2F0ZXMgZ2VuZXJhdGVkIGZyb20gaW5ncmVzcyBsaWtlIG9iamVjdHMgaW4gY2VydC1zaGltIGNvbnRyb2xsZXJzLiAoWyMmIzgyMDM7ODkyN10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg5MjcpLCBbQCYjODIwMztqYWJicndja3ldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9qYWJicndja3kpKQotIFByb21vdGUgdGhlIENBSW5qZWN0b3JNZXJnaW5nIGZlYXR1cmUgZ2F0ZSB0byBHQSAoWyMmIzgyMDM7ODU4M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg1ODMpLCBbQCYjODIwMztDb3BpbG90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vQ29waWxvdCkpCi0gV2hlbiB1c2luZyBBQ01FIEhUVFAtMDEgd2l0aCBhIExpc3RlbmVyU2V0LCBzZXR0aW5nIHRoZSBhbm5vdGF0aW9uIGBhY21lLmNlcnQtbWFuYWdlci5pby9odHRwMDEtcGFyZW50cmVmZmFsbGJhY2s6ICJ0cnVlImAgY2F1c2VzIGNlcnQtbWFuYWdlciB0byB1c2UgdGhlIHBhcmVudCBHYXRld2F5IGFzIHRoZSBzb2x2ZXIgSFRUUFJvdXRlIHBhcmVudFJlZiBpbnN0ZWFkIG9mIHRoZSBMaXN0ZW5lclNldC4gVGhpcyBlbmFibGVzIFRMUy1vbmx5IExpc3RlbmVyU2V0cyB0byByZWx5IG9uIGEgc2hhcmVkIEdhdGV3YXkgSFRUUCBsaXN0ZW5lciBmb3IgQUNNRSBjaGFsbGVuZ2VzLiAoWyMmIzgyMDM7ODc0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3NDkpLCBbQCYjODIwMzthcGthdHNpa2FzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYXBrYXRzaWthcykpCgojIyMjIyBCdWcgb3IgUmVncmVzc2lvbgoKLSAqKkJSRUFLSU5HKio6IFRoZSBIZWxtIGNoYXJ0IG5vIGxvbmdlciBzaGlwcyBhIGRlZmF1bHQgYFJvbGVgIGFuZCBgUm9sZUJpbmRpbmdgIGdyYW50aW5nIHRoZSBjZXJ0LW1hbmFnZXIgY29udHJvbGxlciBTZXJ2aWNlQWNjb3VudCBwZXJtaXNzaW9uIHRvIGNyZWF0ZSB0b2tlbnMgZm9yIGl0c2VsZiAoYHNlcnZpY2VhY2NvdW50cy90b2tlbjogY3JlYXRlYCkuIFRoaXMgUkJBQyB3YXMgYWRkZWQgaW4gdjEuMTYgKFsjJiM4MjAzOzcyMTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83MjEzKSkgYnV0IG5vIGRvY3VtZW50ZWQgd29ya2Zsb3cgcmVxdWlyZXMgaXQsIGFuZCB0aGUgbW90aXZhdGluZyBSb3V0ZTUzIGRvY3Mgc2VjdGlvbiB3YXMgcmVtb3ZlZCBpbiBPY3QgMjAyNC4gSWYgeW91IHJlbHkgb24gYHNlcnZpY2VBY2NvdW50UmVmLm5hbWVgIHBvaW50aW5nIGF0IHRoZSBjb250cm9sbGVyIFNlcnZpY2VBY2NvdW50IChhbiB1bmRvY3VtZW50ZWQgcGF0dGVybiksIHlvdSBtdXN0IG5vdyBjcmVhdGUgeW91ciBvd24gYFJvbGVgIGFuZCBgUm9sZUJpbmRpbmdgIGdyYW50aW5nIGBzZXJ2aWNlYWNjb3VudHMvdG9rZW46IGNyZWF0ZWAgb24gdGhhdCBTZXJ2aWNlQWNjb3VudCwgb3IgbWlncmF0ZSB0byBvbmUgb2YgdGhlIGRvY3VtZW50ZWQgcGF0dGVybnMgKElSU0EgYW1iaWVudCwgb3IgYSBkZWRpY2F0ZWQgU2VydmljZUFjY291bnQgd2l0aCBpdHMgb3duIFJCQUMpLiAoWyMmIzgyMDM7ODkzMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg5MzEpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQotIEFDTUUgY2hhbGxlbmdlcyBubyBsb25nZXIgdGVybWluYWxseSBmYWlsIG9uIHRyYW5zaWVudCBuZXR3b3JrIGVycm9ycyAoVExTIGhhbmRzaGFrZSB0aW1lb3V0cywgRE5TIGZhaWx1cmVzLCBjb250ZXh0IGNhbmNlbGxhdGlvbikgZHVyaW5nIG5vbmNlIGZldGNoZXMgYW5kIGF1dGhvcml6YXRpb24gd2FpdHMuIFRoZSBjaGFsbGVuZ2UgY29udHJvbGxlciByZXR1cm5zIHRoZSBlcnJvciBhbmQgbGV0cyB0aGUgd29ya3F1ZXVlIHJldHJ5IHdpdGggYmFja29mZi4gKFsjJiM4MjAzOzg3NjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NzYwKSwgW0AmIzgyMDM7dGV4YXNpY2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS90ZXhhc2ljaCkpCi0gQWRkIGRucyBpc3N1ZXIgc2VjcmV0cyB2YWxpZGF0aW9uIGJlZm9yZSBtYXJraW5nIGl0IGFzIHJlYWR5IChbIyYjODIwMzs4MjU1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI1NSksIFtAJiM4MjAzO1BlYWMzNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1BlYWMzNikpCi0gQWRkIG1pc3NpbmcgaXNzdWVyIGZpbmFsaXplciBSQkFDIHRvIHRoZSBvcmRlciBjb250cm9sbGVyIHRvIHN1cHBvcnQgb3duZXIgcmVmZXJlbmNlcyAoWyMmIzgyMDM7ODY1NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg2NTQpLCBbQCYjODIwMztlcmlrZ2JdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9lcmlrZ2IpKQotIENsdXN0ZXJJc3N1ZXIgbWV0cmljcyBjb2xsZWN0b3Igbm93IGNvcnJlY3RseSByZXNwZWN0cyB0aGUgZW5hYmxlZC1jb250cm9sbGVycyBjb25maWd1cmF0aW9uLCBhdm9pZGluZyBhIHJlZHVuZGFudCBzdGFydHVwIHdoZW4gb25seSBvcGVyYXRpbmcgd2l0aGluIGEgbmFtZXNwYWNlLiAoWyMmIzgyMDM7ODgyMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg4MjIpLCBbQCYjODIwMztsdW5hcndoaXRlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHVuYXJ3aGl0ZSkpCi0gRml4IFZlbmFmaSBUUFAgaXNzdWVyIHNldHVwIGFuZCBzaWduaW5nIHJlZ3Jlc3Npb24gb24gbWFzdGVyOiByZXN0b3JlIGF1dGhlbnRpY2F0aW9uIG9mIHRoZSB2Y2VydCBjb25uZWN0b3IgaW4gdGhlIGNsaWVudCBjb25zdHJ1Y3Rvciwgd2hpY2ggd2FzIHJlbW92ZWQgaW4gWyMmIzgyMDM7ODgwOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg4MDgpLiAoWyMmIzgyMDM7ODg0M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg4NDMpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQotIEZpeCBhIHBlcmZvcm1hbmNlIGlzc3VlIGluIHRoZSBjZXJ0aWZpY2F0ZVJlcXVlc3RBcHByb3ZhbCB3ZWJob29rIHdoZXJlIENlcnRpZmljYXRlUmVxdWVzdHMgcmVmZXJlbmNpbmcgYSBHcm91cEtpbmQgd2hvc2UgQ1JEIGlzIG5vdCB5ZXQgaW5zdGFsbGVkIHdvdWxkIHRyaWdnZXIgcmVwZWF0ZWQgQVBJIHNlcnZlciBkaXNjb3ZlcnkgcXVlcmllcyBvbiBldmVyeSBhZG1pc3Npb24gcmVxdWVzdC4gTmVnYXRpdmUgcmVzdWx0cyBhcmUgbm93IGNhY2hlZCBmb3IgMzAgc2Vjb25kcy4gKFsjJiM4MjAzOzg2NTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjUxKSwgW0AmIzgyMDM7bWF0ZWVuYWxpNjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tYXRlZW5hbGk2NikpCi0gRml4IHdlYmhvb2sgc2VydmluZyBjZXJ0aWZpY2F0ZSBub3QgYmVpbmcgcmVuZXdlZCBhZnRlciBzeXN0ZW0gc3VzcGVuZC4gKFsjJiM4MjAzOzg0NjRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDY0KSwgW0AmIzgyMDM7UGVhYzM2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vUGVhYzM2KSkKLSBGaXhlZCBhIHJhcmUgcGFuaWMgaW4gdGhlIHRyaWdnZXIgY29udHJvbGxlciB3aGVuIGEgQ2VydGlmaWNhdGUgaXMgZGVsZXRlZCBmcm9tIHRoZSBpbmZvcm1lciBjYWNoZSB3aGlsZSBhIHJlY29uY2lsZSBpcyBpbiBwcm9ncmVzcyAoZS5nLiBkdXJpbmcgbmFtZXNwYWNlIHRlYXJkb3duKS4gKFsjJiM4MjAzOzg5NjJdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84OTYyKSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKLSBGaXhlZCBhbiBpbnRlZ2VyIG92ZXJmbG93IGluIGByZW5ld0JlZm9yZVBlcmNlbnRhZ2VgIGNhbGN1bGF0aW9ucyB0aGF0IGNhdXNlZCBDZXJ0aWZpY2F0ZXMgd2l0aCBkdXJhdGlvbnMgbG9uZ2VyIHRoYW4gYXBwcm94aW1hdGVseSAzIHllYXJzIHRvIGJlIGluY29ycmVjdGx5IHJlamVjdGVkIGJ5IHZhbGlkYXRpb24gb3IgYXNzaWduZWQgaW5jb3JyZWN0IHJlbmV3YWwgdGltZXMuIChbIyYjODIwMzs4OTQ3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODk0NyksIFtAJiM4MjAzO1RoYXRzTXJUYWxib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9UaGF0c01yVGFsYm90KSkKLSBGaXhlZCBkdXBsaWNhdGUgYHBhcmVudFJlZmAgYnVnIHdoZW4gYm90aCBpc3N1ZXIgY29uZmlnIGFuZCBhbm5vdGF0aW9ucyBhcmUgcHJlc2VudC4gKFsjJiM4MjAzOzg2MTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjE5KSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKLSBGaXhlZCBpbmZpbml0ZSByZS1pc3N1YW5jZSBsb29wIHdoZW4gaXNzdWVyIHJldHVybnMgYW4gYWxyZWFkeSBleHBpcmVkIGNlcnRpZmljYXRlIChbIyYjODIwMzs4NjEwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODYxMCksIFtAJiM4MjAzO29udXJtaWNvb2d1bGxhcmldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9vbnVybWljb29ndWxsYXJpKSkKLSBGaXhlZCBsb2NhbCBgZTJlLXNldHVwLXNhbXBsZXdlYmhvb2tgIGluc3RhbGxhdGlvbiB0byB1c2UgdGhlIHNhbXBsZXdlYmhvb2sgaW1hZ2UgcmVwb3NpdG9yeSBhbmQgdGFnIGZyb20gdGhlIHNhdmVkIGltYWdlIHRhcmJhbGwgbWFuaWZlc3QuIChbIyYjODIwMzs4ODIxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODgyMSksIFtAJiM4MjAzO3dhbGxyal0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyaikpCi0gRml4ZWQgcG90ZW50aWFsIE9PTSBpbiBETlMtb3Zlci1IVFRQUyBjbGllbnQgYnkgYm91bmRpbmcgcmVzcG9uc2UgYm9keSByZWFkIHdpdGggaW8uTGltaXRSZWFkZXIgKDEyOCBLQiBjYXApLiAoWyMmIzgyMDM7ODgwM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg4MDMpLCBbQCYjODIwMztTZWJUYXJkaWZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZWJUYXJkaWYpKQotIEZpeGVkIHZhbGlkYXRpb24gb2YgdGltZXpvbmUtcHJlZml4ZWQgcmVuZXdhbCB3aW5kb3cgY3JvbiBzcGVjcyB3aXRob3V0IGEgc2NoZWR1bGUuIChbIyYjODIwMzs4ODEzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODgxMyksIFtAJiM4MjAzO2ltbWFudXdlbGxdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9pbW1hbnV3ZWxsKSkKLSBIZWxtIGNoYXJ0IGJ1Z2ZpeDogcmVuYW1lIGltYWdlIGhlbHBlciB0byBhdm9pZCB1bWJyZWxsYSBjaGFydCBjb25mbGljdHMgKFsjJiM4MjAzOzg3NTNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NzUzKSwgW0AmIzgyMDM7RmVsaXhQaGlwcHNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9GZWxpeFBoaXBwcykpCi0gSGVsbTogRml4IGludmFsaWQgWUFNTCBnZW5lcmF0ZWQgd2hlbiBib3RoIGB3ZWJob29rLmNvbmZpZ2AgYW5kIGB3ZWJob29rLnZvbHVtZXNgIGFyZSBkZWZpbmVkLiAoWyMmIzgyMDM7ODY2NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg2NjQpLCBbQCYjODIwMztqbm9obGdhcmRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9qbm9obGdhcmQpKQotIFJlbW92ZSBBQ01FIENoYWxsZW5nZSBgY3JlYXRlYCBhbmQgT3JkZXIgYGNyZWF0ZWAvYHBhdGNoYC9gdXBkYXRlYCBmcm9tIHRoZSBjZXJ0LW1hbmFnZXItZWRpdCBhZ2dyZWdhdGUgQ2x1c3RlclJvbGUgdG8gcHJldmVudCBkaXJlY3QgbWFuaXB1bGF0aW9uIG9mIHRoZXNlIGludGVybmFsIHJlc291cmNlcyAoR0hTQS04cnZqLW1tNGgtYzI1OCkuIChbIyYjODIwMzs4OTU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODk1OCksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCi0gUmVtb3ZlIGlzc3VlciBvd25lciByZWZlcmVuY2UgZnJvbSBjaGFsbGVuZ2VzIGJsb2NraW5nIGNoYWxsZW5nZSBnYXJiYWdlIGNvbGxlY3Rpb24gKFsjJiM4MjAzOzg3NDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NzQzKSwgW0AmIzgyMDM7ZXJpa2diXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZXJpa2diKSkKLSBVcGRhdGUgbG9naWMgdG8gaWRlbnRpZnkgYW5kIHByZXNlcnZlIHRoZSBzZWNyZXQgbWF0Y2hpbmcgbmV4dFByaXZhdGVLZXlTZWNyZXROYW1lIChbIyYjODIwMzs4NTc3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODU3NyksIFtAJiM4MjAzO3B1dG9uZ3lvbmddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9wdXRvbmd5b25nKSkKLSBWYXVsdCBJc3N1ZXIgd2ViaG9vayB2YWxpZGF0aW9uIG5vdyByZWplY3RzIGAuLmAgcGF0aCBzZWdtZW50cyBpbiBgc3BlYy52YXVsdC5wYXRoYCBhbmQgYXV0aCBtb3VudCBwYXRoIGZpZWxkcywgcHJldmVudGluZyBgcGF0aC5Kb2luYCBmcm9tIHNpbGVudGx5IHJlc29sdmluZyByZWxhdGl2ZSBzZWdtZW50cyBiZWZvcmUgY29uc3RydWN0aW5nIHRoZSBWYXVsdCBBUEkgcmVxdWVzdC4gKFsjJiM4MjAzOzg5MzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84OTMwKSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKCiMjIyMjIE90aGVyIChDbGVhbnVwIG9yIEZsYWtlKQoKLSBBUEkgY2xlYW51cDogcmVtb3ZlZCBkZXByZWNhdGVkIE9iamVjdFJlZmVyZW5jZSAoWyMmIzgyMDM7ODYyNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg2MjUpLCBbQCYjODIwMztpbnRlb25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9pbnRlb24pKQotIFJlbW92ZSBIZWxtIHZhbHVlcyBgcHJvbWV0aGV1cy5zZXJ2aWNlbW9uaXRvci50YXJnZXRQb3J0YCwgYHByb21ldGhldXMuc2VydmljZW1vbml0b3IucGF0aGAsIGFuZCBgcHJvbWV0aGV1cy5wb2Rtb25pdG9yLnBhdGhgLiBUaGUgbWV0cmljcyBwYXRoIGlzIGFsd2F5cyBgL21ldHJpY3NgIGFuZCB0aGUgdGFyZ2V0IHBvcnQgaXMgYWx3YXlzIGBodHRwLW1ldHJpY3NgLiBSZW5hbWUgdGhlIGNvbnRyb2xsZXIgc2VydmljZSBtZXRyaWNzIHBvcnQgZnJvbSBgdGNwLXByb21ldGhldXMtc2VydmljZW1vbml0b3JgIHRvIGBodHRwLW1ldHJpY3NgIGZvciBjb25zaXN0ZW5jeSB3aXRoIG90aGVyIHdvcmtsb2Fkcy4gVXNlcnMgbXVzdCByZW1vdmUgdGhlc2Uga2V5cyBmcm9tIHRoZWlyIHZhbHVlIG92ZXJyaWRlcyBiZWZvcmUgdXBncmFkaW5nLiAoWyMmIzgyMDM7ODk1Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg5NTIpLCBbQCYjODIwMztlcmlrZ2JdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9lcmlrZ2IpKQotIFRoZSBgZW5hYmxlR2F0ZXdheUFQSWAgYW5kIGBlbmFibGVHYXRld2F5QVBJTGlzdGVuZXJTZXRgIGZpZWxkcyBvbiBgQ29udHJvbGxlckNvbmZpZ3VyYXRpb25gIGFyZSBkZXByZWNhdGVkIGFuZCBtb3ZlZCBpbnRvIHRoZSBgZ2F0ZXdheUFQSWAgc3ViLXN0cnVjdCBhcyBgZ2F0ZXdheUFQSS5lbmFibGVkYCBhbmQgYGdhdGV3YXlBUEkuZW5hYmxlTGlzdGVuZXJTZXRgLiBUaGUgb2xkIGZpZWxkcyBjb250aW51ZSB0byB3b3JrLiAoWyMmIzgyMDM7ODczMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg3MzIpLCBbQCYjODIwMztUaGF0c01yVGFsYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vVGhhdHNNclRhbGJvdCkpCi0gVXBkYXRlIGJhc2UgaW1hZ2VzIHRvIERlYmlhbiAxMyAoWyMmIzgyMDM7ODg0OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg4NDkpLCBbQCYjODIwMztsdHdvbmdhYV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2x0d29uZ2FhKSkKCiMjIyBbYHYxLjIwLjNgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMjAuMykKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4yMC4yLi4udjEuMjAuMykKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KClRoaXMgcGF0Y2ggcmVsZWFzZSBmaXhlcyBhIHNlY3VyaXR5IGlzc3VlIChbYEdIU0EtOHJ2ai1tbTRoLWMyNThgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtOHJ2ai1tbTRoLWMyNTgpLCBISUdIKSB3aGVyZSB0aGUgZGVmYXVsdCBgY2VydC1tYW5hZ2VyLWVkaXRgIGFnZ3JlZ2F0ZSBDbHVzdGVyUm9sZSBncmFudGVkIG5hbWVzcGFjZSB1c2VycyBwZXJtaXNzaW9uIHRvIGNyZWF0ZSBBQ01FIGBDaGFsbGVuZ2VgIGFuZCBgT3JkZXJgIHJlc291cmNlcyBkaXJlY3RseS4gQSB1c2VyIHdobyBjb3VsZCBjcmVhdGUgYSBgQ2hhbGxlbmdlYCByZWZlcmVuY2luZyBhIGBDbHVzdGVySXNzdWVyYCBjb3VsZCBzdXBwbHkgYXR0YWNrZXItY29udHJvbGxlZCBzb2x2ZXIgY29uZmlndXJhdGlvbiB3aGlsZSBjZXJ0LW1hbmFnZXIgbG9hZGVkIGNyZWRlbnRpYWxzIGZyb20gdGhlIGBDbHVzdGVySXNzdWVyYCdzIG5hbWVzcGFjZSwgYnlwYXNzaW5nIElzc3VlciBzb2x2ZXIgc2VsZWN0b3JzIChgZG5zWm9uZXNgLCBgZG5zTmFtZXNgLCBgbWF0Y2hMYWJlbHNgKS4gV2l0aCB0aGUgYWNtZS1kbnMgcHJvdmlkZXIgc3BlY2lmaWNhbGx5LCB0aGlzIGNvdWxkIGRpc2Nsb3NlIEROUyBjcmVkZW50aWFscyB0byBhbiBhdHRhY2tlci1jb250cm9sbGVkIGVuZHBvaW50LgoKVGhpcyByZWxlYXNlIGFsc28gcmVtb3ZlcyB0aGUgaXNzdWVyIG93bmVyIHJlZmVyZW5jZSBmcm9tIENoYWxsZW5nZXMgd2hpY2ggd2FzIGJsb2NraW5nIENoYWxsZW5nZSBnYXJiYWdlIGNvbGxlY3Rpb24sIGFuZCB1cGRhdGVzIEdvIHRvIGZpeCByZXBvcnRlZCBDVkVzLgoKQWxsIHVzZXJzIHNob3VsZCB1cGdyYWRlLgoKPiBcWyFXQVJOSU5HXQo+ICoqUG90ZW50aWFsbHkgYnJlYWtpbmcgY2hhbmdlOioqIFRoZSBgY2VydC1tYW5hZ2VyLWVkaXRgIGFnZ3JlZ2F0ZSBDbHVzdGVyUm9sZSBubyBsb25nZXIgZ3JhbnRzIGBjcmVhdGVgIGZvciBgY2hhbGxlbmdlcy5hY21lLmNlcnQtbWFuYWdlci5pb2Agb3IgYGNyZWF0ZWAsIGBwYXRjaGAsIGB1cGRhdGVgIGZvciBgb3JkZXJzLmFjbWUuY2VydC1tYW5hZ2VyLmlvYC4gVGhlc2UgcmVzb3VyY2VzIGFyZSBpbnRlcm5hbCB0byBjZXJ0LW1hbmFnZXIncyBBQ01FIHdvcmtmbG93IGFuZCBhcmUgbm90IGludGVuZGVkIHRvIGJlIGNyZWF0ZWQgb3IgbW9kaWZpZWQgZGlyZWN0bHkgYnkgdXNlcnMuIElmIHlvdSBoYXZlIHRvb2xpbmcgb3Igd29ya2Zsb3dzIHRoYXQgY3JlYXRlIENoYWxsZW5nZSBvciBPcmRlciByZXNvdXJjZXMgZGlyZWN0bHkgKG91dHNpZGUgb2YgdGhlIG5vcm1hbCBDZXJ0aWZpY2F0ZSDihpIgQ2VydGlmaWNhdGVSZXF1ZXN0IOKGkiBPcmRlciDihpIgQ2hhbGxlbmdlIGZsb3cpLCB5b3Ugd2lsbCBuZWVkIHRvIGdyYW50IHRob3NlIHBlcm1pc3Npb25zIGV4cGxpY2l0bHkuCgojIyMjIENoYW5nZXMgYnkgS2luZAoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gU2VjdXJpdHkgKEhJR0gpOiBSZW1vdmUgQ2hhbGxlbmdlIGBjcmVhdGVgIGFuZCBPcmRlciBgY3JlYXRlYCwgYHBhdGNoYCwgYHVwZGF0ZWAgdmVyYnMgZnJvbSB0aGUgYGNlcnQtbWFuYWdlci1lZGl0YCBhZ2dyZWdhdGUgQ2x1c3RlclJvbGUgKFtgR0hTQS04cnZqLW1tNGgtYzI1OGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS04cnZqLW1tNGgtYzI1OCkpLiAoWyMmIzgyMDM7ODk0MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg5NDApLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQotIFJlbW92ZSBpc3N1ZXIgb3duZXIgcmVmZXJlbmNlIGZyb20gY2hhbGxlbmdlcyBibG9ja2luZyBjaGFsbGVuZ2UgZ2FyYmFnZSBjb2xsZWN0aW9uIChbIyYjODIwMzs4NzU5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODc1OSksIFtAJiM4MjAzO2NlcnQtbWFuYWdlci1ib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXItYm90KSkKCiMjIyMjIE90aGVyIChDbGVhbnVwIG9yIEZsYWtlKQoKLSBCdW1wIGdvIHRvIDEuMjYuMywgb3RoZXIgZGVwcyB0byBmaXggc2V2ZXJhbCBnb3Z1bG5jaGVjayBpc3N1ZXMgKFsjJiM4MjAzOzg3ODldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84Nzg5KSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQotIFVwZGF0ZSBHbyB0byBgdjEuMjYuNGAgdG8gZml4IENWRS0yMDI2LTI3MTQ1LCBDVkUtMjAyNi00MjUwNCwgYW5kIENWRS0yMDI2LTQyNTA3IChbIyYjODIwMzs4OTI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODkyNiksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCgojIyMgW2B2MS4yMC4yYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcmVsZWFzZXMvdGFnL3YxLjIwLjIpCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMjAuMS4uLnYxLjIwLjIpCgpjZXJ0LW1hbmFnZXIgaXMgdGhlIGVhc2llc3Qgd2F5IHRvIGF1dG9tYXRpY2FsbHkgbWFuYWdlIGNlcnRpZmljYXRlcyBpbiBLdWJlcm5ldGVzIGFuZCBPcGVuU2hpZnQgY2x1c3RlcnMuCgp2MS4yMC4yIGZpeGVzIGludmFsaWQgWUFNTCBnZW5lcmF0ZWQgaW4gdGhlIEhlbG0gY2hhcnQgd2hlbiBib3RoIGB3ZWJob29rLmNvbmZpZ2AKYW5kIGB3ZWJob29rLnZvbHVtZXNgIGFyZSBkZWZpbmVkLCBhbmQgYnVtcHMgR28gdG8gMS4yNi4yIGFsb25nIHdpdGggZGVwZW5kZW5jaWVzCnRvIGFkZHJlc3MgcmVwb3J0ZWQgdnVsbmVyYWJpbGl0aWVzLgoKIyMjIyBDaGFuZ2VzIGJ5IEtpbmQKCiMjIyMjIEJ1ZyBvciBSZWdyZXNzaW9uCgotIEhlbG06IEZpeCBpbnZhbGlkIFlBTUwgZ2VuZXJhdGVkIHdoZW4gYm90aCBgd2ViaG9vay5jb25maWdgIGFuZCBgd2ViaG9vay52b2x1bWVzYCBhcmUgZGVmaW5lZC4gKFsjJiM4MjAzOzg2NjVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjY1KSwgW0AmIzgyMDM7Y2VydC1tYW5hZ2VyLWJvdF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci1ib3QpKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIEJ1bXAgZ28gZGVwZW5kZW5jaWVzIHdpdGggcmVwb3J0ZWQgdnVsbmVyYWJpbGl0aWVzIChbIyYjODIwMzs4NzA0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODcwNCksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCi0gQnVtcCBnbyB0byAxLjI2LjIgKFsjJiM4MjAzOzg3MDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NzAzKSwgW0AmIzgyMDM7ZXJpa2diXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZXJpa2diKSkKCiMjIyBbYHYxLjIwLjFgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMjAuMSkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4yMC4wLi4udjEuMjAuMSkKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KCnYxLjIwLjEgZml4ZXMgYW4gaXNzdWUgZm9yIE9wZW5TaGlmdCB1c2VycyB0aGF0IGhhcyB0byBkbyB3aXRoIHRoZSBmaW5hbGl6ZXIgUkJBQywgYnVtcHMgZ1JQQyB0byBhZGRyZXNzIGEgcmVwb3J0ZWQgbm9uLWFmZmVjdGluZyB2dWxuZXJhYmlsaXR5LCBhbmQgZml4ZXMgYSBkdXBsaWNhdGUgYHBhcmVudFJlZmAgYnVnIHdoZW4gYm90aCBpc3N1ZXIgY29uZmlnIGFuZCBhbm5vdGF0aW9ucyBhcmUgcHJlc2VudCAoR2F0ZXdheSBBUEkpLgoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gRml4ZWQgZHVwbGljYXRlIGBwYXJlbnRSZWZgIGJ1ZyB3aGVuIGJvdGggaXNzdWVyIGNvbmZpZyBhbmQgYW5ub3RhdGlvbnMgYXJlIHByZXNlbnQuIChbIyYjODIwMzs4NjU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODY1OCksIFtAJiM4MjAzO2hqb3NoaTEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2hqb3NoaTEyMykpCi0gQWRkIG1pc3NpbmcgaXNzdWVyIGZpbmFsaXplciBSQkFDIHRvIHRoZSBvcmRlciBjb250cm9sbGVyIHRvIHN1cHBvcnQgb3duZXIgcmVmZXJlbmNlcy4gVGhpcyB3YXMgcHJldmVudGluZyBPcGVuU2hpZnQgdXNlcnMgZnJvbSBiZWluZyBhYmxlIHRvIHVwZ3JhZGUgdG8gdjEuMjAuMC4gKFsjJiM4MjAzOzg2NTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NjU1KSwgW0AmIzgyMDM7ZXJpa2diXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZXJpa2diKSkKLSBCdW1wIGdvb2dsZS5nb2xhbmcub3JnL2dycGMgdG8gZml4IHZ1bG5lcmFiaWxpdHkgcmVwb3J0ZWQgYnkgc2Nhbm5lcnMuIFRoaXMgaXNuJ3QgYSB2dWxuZXJhYmlsaXR5IHRoYXQgYWZmZWN0cyBjZXJ0LW1hbmFnZXIsIGJ1dCB3ZSBhcmUgYnVtcGluZyBpdCBiZWNhdXNlIGl0IGlzIHJlcG9ydGVkIGJ5IHNjYW5uZXJzLiAoWyMmIzgyMDM7ODY1N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg2NTcpLCBbQCYjODIwMztlcmlrZ2JdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9lcmlrZ2IpKQoKIyMjIFtgdjEuMjAuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3JlbGVhc2VzL3RhZy92MS4yMC4wKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9jb21wYXJlL3YxLjE5LjYuLi52MS4yMC4wKQoKY2VydC1tYW5hZ2VyIGlzIHRoZSBlYXNpZXN0IHdheSB0byBhdXRvbWF0aWNhbGx5IG1hbmFnZSBjZXJ0aWZpY2F0ZXMgaW4gS3ViZXJuZXRlcyBhbmQgT3BlblNoaWZ0IGNsdXN0ZXJzLgoKdjEuMjAuMCBhZGRzIGFscGhhIHN1cHBvcnQgZm9yIHRoZSBuZXcgTGlzdGVuZXJTZXQgcmVzb3VyY2UsIGFkZHMgc3VwcG9ydCBmb3IgQXp1cmUgUHJpdmF0ZSBETlM7IHBhcmVudFJlZnMgYXJlIG5vIGxvbmdlciByZXF1aXJlZCB3aGVuIHVzaW5nIEFDTUUgd2l0aCBHYXRld2F5IEFQSSwgYW5kIE90aGVyTmFtZXMgd2FzIHByb21vdGVkIHRvIEJldGEuCgojIyMjIyBDaGFuZ2VzIGJ5IEtpbmQKCiMjIyMjIEZlYXR1cmUKCi0gQWRkZWQgYSBzZXQgb2YgZmxhZ3MgdG8gcGVybWl0IHNldHRpbmcgTmV0d29ya1BvbGljeSBhY3Jvc3MgYWxsIGRlcGxveWVkIGNvbnRhaW5lcnMuIFJlbW92ZSByZWR1bmRhbnQgZ2xvYmFsIElQIHJhbmdlcyBmcm9tIGV4YW1wbGUgcG9saWNpZXMuIChbIyYjODIwMzs4MzcwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODM3MCksIFtAJiM4MjAzO2pjcHVua10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2pjcHVuaykpCi0gQWRkZWQgc2VsZWN0YWJsZSBmaWVsZHMgdG8gY3VzdG9tIHJlc291cmNlIGRlZmluaXRpb25zIGZvciAuc3BlYy5pc3N1ZXJSZWYue2dyb3VwLCBraW5kLCBuYW1lfSAoWyMmIzgyMDM7ODI1Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyNTYpLCBbQCYjODIwMzt0YXJla3NoYV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3RhcmVrc2hhKSkKLSBBZGRlZCBzdXBwb3J0IGZvciBzcGVjaWZ5aW5nIGBpbWFnZVB1bGxTZWNyZXRzYCBpbiB0aGUgYHN0YXJ0dXBhcGljaGVjay1qb2JgIEhlbG0gdGVtcGxhdGUgdG8gZW5hYmxlIHB1bGxpbmcgaW1hZ2VzIGZyb20gcHJpdmF0ZSByZWdpc3RyaWVzLiAoWyMmIzgyMDM7ODE4Nl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxODYpLCBbQCYjODIwMzttYXRoaWV1LWNsbmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9tYXRoaWV1LWNsbmspKQotIEFkZGVkICdleHRyYUNvbnRhaW5lcnMnIGhlbG0gY2hhcnQgdmFsdWUsIGFsbG93aW5nIHRoZSBkZXBsb3ltZW50IG9mIGFyYml0cmFyeSBzaWRlY2FyIGNvbnRhaW5lcnMgd2l0aGluIHRoZSBjZXJ0LW1hbmFnZXIgb3BlcmF0b3IgcG9kLiBUaGlzIGNhbiBiZSB1c2VkIHRvIHN1cHBvcnQsIGZvciBlLmcuLCBBV1MgSUFNIFJvbGVzIEFueXdoZXJlIGZvciBSb3V0ZTUzIEROUzAxIHZlcmlmaWNhdGlvbi4gKFsjJiM4MjAzOzgzNTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MzU1KSwgW0AmIzgyMDM7ZGFuY21leWVyc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2RhbmNtZXllcnMpKQotIEFkZGVkIGBwYXJlbnRSZWZgIG92ZXJyaWRlIGFubm90YXRpb25zIG9uIHRoZSBDZXJ0aWZpY2F0ZSByZXNvdXJjZS4gKFsjJiM4MjAzOzg1MThdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NTE4KSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKLSBBZGRlZCBzdXBwb3J0IGZvciBhenVyZSBwcml2YXRlIHpvbmVzIGZvciBkbnMwMSBpc3N1ZXIuIChbIyYjODIwMzs4NDk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQ5NCksIFtAJiM4MjAzO2hqb3NoaTEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2hqb3NoaTEyMykpCi0gQWRkZWQgc3VwcG9ydCBmb3IgY29uZmlndXJpbmcgUEVNIGRlY29kaW5nIHNpemUgbGltaXRzLCBhbGxvd2luZyBvcGVyYXRvcnMgdG8gaGFuZGxlIGxhcmdlciBjZXJ0aWZpY2F0ZXMgYW5kIGtleXMuIChbIyYjODIwMzs3NjQyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvNzY0MiksIFtAJiM4MjAzO3JvYmVydGxlc3Rha10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3JvYmVydGxlc3RhaykpCi0gQWRkZWQgc3VwcG9ydCBmb3IgdW5oZWFsdGh5UG9kRXZpY3Rpb25Qb2xpY3kgaW4gUG9kRGlzcnVwdGlvbkJ1ZGdldCAoWyMmIzgyMDM7NzcyOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc3MjgpLCBbQCYjODIwMztqY3B1bmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9qY3B1bmspKQotIEZvciBWZW5hZmkgcHJvdmlkZXIsIHJlYWQgYHZlbmFmaS5jZXJ0LW1hbmFnZXIuaW8vY3VzdG9tLWZpZWxkc2AgYW5ub3RhdGlvbiBvbiBJc3N1ZXIvQ2x1c3Rlcklzc3VlciBhbmQgdXNlIGl0IGFzIGJhc2Ugd2l0aCBvdmVycmlkZS9hcHBlbmQgY2FwYWJpbGl0aWVzIG9uIENlcnRpZmljYXRlIGxldmVsLiAoWyMmIzgyMDM7ODMwMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgzMDEpLCBbQCYjODIwMztrMGRhXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vazBkYSkpCi0gSW1wcm92ZSBlcnJvciBtZXNzYWdlIHdoZW4gQ0EgaXNzdWVycyBhcmUgbWlzY29uZmlndXJlZCB0byB1c2UgYSBjbGFzaGluZyBzZWNyZXQgbmFtZSAoWyMmIzgyMDM7ODM3NF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgzNzQpLCBbQCYjODIwMzttYWppYXl1MDAwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbWFqaWF5dTAwMCkpCi0gSW50cm9kdWNlIGEgbmV3IEluZ3Jlc3MgYW5ub3RhdGlvbiBgYWNtZS5jZXJ0LW1hbmFnZXIuaW8vaHR0cDAxLWluZ3Jlc3MtaW5ncmVzc2NsYXNzbmFtZWAgdG8gb3ZlcnJpZGUgYGh0dHAwMS5pbmdyZXNzLmluZ3Jlc3NDbGFzc05hbWVgIGZpZWxkIGluIEhUVFAtMDEgY2hhbGxlbmdlIHNvbHZlcnMuIChbIyYjODIwMzs4MjQ0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI0NCksIFtAJiM4MjAzO2x1bmFyd2hpdGVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9sdW5hcndoaXRlKSkKLSBVcGRhdGUgYGdsb2JhbC5ub2RlU2VsZWN0b3JgIHRvIGhlbG0gY2hhcnQgdG8gcGVyZm9ybSBhIGBtZXJnZWAgYW5kIGFsbG93IGZvciBhIHNpbmdsZSBgbm9kZVNlbGVjdG9yYCB0byBiZSBzZXQgYWNyb3NzIGFsbCBzZXJ2aWNlcy4gKFsjJiM4MjAzOzgxOTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MTk1KSwgW0AmIzgyMDM7U3RpbmdSYXlaQV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1N0aW5nUmF5WkEpKQotIFZhdWx0IGlzc3VlcnMgd2lsbCBub3cgaW5jbHVkZSB0aGUgVmF1bHQgc2VydmVyIGFkZHJlc3MgYXMgb25lIG9mIHRoZSBkZWZhdWx0IGF1ZGllbmNlcyBvbiBnZW5lcmF0ZWQgc2VydmljZSBhY2NvdW50IHRva2Vucy4gKFsjJiM4MjAzOzgyMjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MjI4KSwgW0AmIzgyMDM7dGVyaW5qb2tlc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3Rlcmluam9rZXMpKQotIEFkZGVkIGV4cGVyaW1lbnRhbCBgWExpc3RlbmVyU2V0c2AgZmVhdHVyZSBnYXRlIChbIyYjODIwMzs4Mzk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODM5NCksIFtAJiM4MjAzO2hqb3NoaTEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2hqb3NoaTEyMykpCgojIyMjIyBEb2N1bWVudGF0aW9uCgotIEFkZCBHV0FQSSBkb2N1bWVudGF0aW9uIHRvIE5PVEVTLlRYVCBpbiBoZWxtIGNoYXJ0IChbIyYjODIwMzs4MzUzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODM1MyksIFtAJiM4MjAzO2pheGVsczEwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vamF4ZWxzMTApKQoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gQWRkcyBsb2dzIGZvciBjYXNlcyB3aGVuIGFjbWUgc2VydmVyIHJldHVybnMgdXMgYSBmYXRhbCBlcnJvciBpbiB0aGUgb3JkZXIgY29udHJvbGxlciAoWyMmIzgyMDM7ODE5OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxOTkpLCBbQCYjODIwMztQZWFjMzZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9QZWFjMzYpKQotIEZpeGVkIGFuIGlzc3VlIHdoZXJlIGtpbmQgb3IgZ3JvdXAgaW4gdGhlIGlzc3VlclJlZiBvZiBhIENlcnRpZmljYXRlIHdhcyBvbWl0dGVkLCB1cGdyYWRpbmcgdG8gMS4xOS54IGluY29ycmVjdGx5IGNhdXNlZCB0aGUgY2VydGlmaWNhdGUgdG8gYmUgcmVuZXdlZCAoWyMmIzgyMDM7ODE2MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxNjApLCBbQCYjODIwMztpbnRlb25dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9pbnRlb24pKQotIENoYW5nZXMgdG8gdGhlIER1cmF0aW9uIGFuZCBSZW5ld0JlZm9yZSBhbm5vdGF0aW9ucyBvbiBpbmdyZXNzIGFuZCBnYXRld2F5LWFwaSByZXNvdXJjZXMgd2lsbCBub3cgdHJpZ2dlciBjZXJ0aWZpY2F0ZSB1cGRhdGVzLiAoWyMmIzgyMDM7ODIzMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyMzIpLCBbQCYjODIwMztlbGVhbm9yLW1lcnJ5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZWxlYW5vci1tZXJyeSkpCi0gRml4IGFuIGlzc3VlIHdoZXJlIEFDTUUgY2hhbGxlbmdlIFRYVCByZWNvcmRzIGFyZSBub3QgY2xlYW5lZCB1cCB3aGVuIHRoZXJlIGFyZSBtYW55IHJlc291cmNlIHJlY29yZHMgaW4gQ2xvdWRETlMuIChbIyYjODIwMzs4NDU2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQ1NiksIFtAJiM4MjAzO3RrbmFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS90a25hKSkKLSBGaXggdW5yZWd1bGF0ZWQgcmV0cmllcyB3aXRoIHRoZSBEaWdpdGFsT2NlYW4gRE5TLTAxIHNvbHZlcgogIEFkZCBmdWxsIGRldGFpbGVkIEROUy0wMSBlcnJvcnMgdG8gdGhlIGV2ZW50cyBhdHRhY2hlZCB0byB0aGUgQ2hhbGxlbmdlLCBmb3IgZWFzaWVyIGRlYnVnZ2luZyAoWyMmIzgyMDM7ODIyMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyMjEpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQotIEZpeGVkIGFuIGluZmluaXRlIHJlLWlzc3VhbmNlIGxvb3AgdGhhdCBjb3VsZCBvY2N1ciB3aGVuIGFuIGlzc3VlciByZXR1cm5zIGEgY2VydGlmaWNhdGUgd2l0aCBhIHB1YmxpYyBrZXkgdGhhdCBkb2Vzbid0IG1hdGNoIHRoZSBDU1IuIFRoZSBpc3N1aW5nIGNvbnRyb2xsZXIgbm93IHZhbGlkYXRlcyB0aGUgY2VydGlmaWNhdGUgYmVmb3JlIHN0b3JpbmcgaXQgYW5kIGZhaWxzIHdpdGggYmFja29mZiBvbiBtaXNtYXRjaC4gKFsjJiM4MjAzOzg0MDNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDAzKSwgW0AmIzgyMDM7Y2FsbTMyOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NhbG0zMjkpKQotIEZpeGVkIGFuIGlzc3VlIHdoZXJlIEhUVFAtMDEgY2hhbGxlbmdlcyBmYWlsZWQgd2hlbiB0aGUgSG9zdCBoZWFkZXIgY29udGFpbnMgYW4gSVB2NiBhZGRyZXNzLiBUaGlzIG1lYW5zIHRoYXQgdXNlcnMgY2FuIG5vdyBpc3N1ZSBJUCBhZGRyZXNzIGNlcnRpZmljYXRlcyBmb3IgSVB2NiBhZGRyZXNzIHN1YmplY3RzLiAoWyMmIzgyMDM7ODQyNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzg0MjQpLCBbQCYjODIwMztTbGFzaE5lcGh5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vU2xhc2hOZXBoeSkpCi0gRml4ZWQgdGhlIEhUVFAtMDEgR2F0ZXdheSBzb2x2ZXIgY3JlYXRpbmcgaW52YWxpZCBIVFRQUm91dGVzIGJ5IG5vdCBzZXR0aW5nIHNwZWMuaG9zdG5hbWVzIHdoZW4gdGhlIGNoYWxsZW5nZSBETlNOYW1lIGlzIGFuIElQIGFkZHJlc3MuIChbIyYjODIwMzs4NDQzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQ0MyksIFtAJiM4MjAzO2FsdmlzczddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbHZpc3M3KSkKLSBSZXZlcnQgQVBJIGRlZmF1bHRzIGZvciBpc3N1ZXIgcmVmZXJlbmNlIGtpbmQgYW5kIGdyb3VwIGludHJvZHVjZWQgaW4gMC4xOS4wIChbIyYjODIwMzs4MTczXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODE3MyksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCi0gU2VjdXJpdHkgKE1PREVSQVRFKTogRml4IGEgcG90ZW50aWFsIHBhbmljIGluIHRoZSBjZXJ0LW1hbmFnZXIgY29udHJvbGxlciB3aGVuIGEgRE5TIHJlc3BvbnNlIGluIGFuIHVuZXhwZWN0ZWQgb3JkZXIgd2FzIGNhY2hlZC4gSWYgYW4gYXR0YWNrZXIgd2FzIGFibGUgdG8gbW9kaWZ5IEROUyByZXNwb25zZXMgKG9yIGlmIHRoZXkgY29udHJvbGxlZCB0aGUgRE5TIHNlcnZlcikgaXQgd2FzIHBvc3NpYmxlIHRvIGNhdXNlIGRlbmlhbCBvZiBzZXJ2aWNlIGZvciB0aGUgY2VydC1tYW5hZ2VyIGNvbnRyb2xsZXIuIChbIyYjODIwMzs4NDY5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQ2OSksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBVcGRhdGUgR28gdG8gYHYxLjI1LjVgIHRvIGZpeCBgQ1ZFLTIwMjUtNjE3MjdgIGFuZCBgQ1ZFLTIwMjUtNjE3MjlgIChbIyYjODIwMzs4MjkwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI5MCksIFtAJiM4MjAzO29jdG8tc3RzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vb2N0by1zdHMpXFtib3RdKQotIFdoZW4gUHJvbWV0aGV1cyBtb25pdG9yaW5nIGlzIGVuYWJsZWQsIHRoZSBtZXRyaWNzIGxhYmVsIGlzIG5vdyBzZXQgdG8gdGhlIGludGVuZGVkIHZhbHVlIG9mIGBjZXJ0LW1hbmFnZXJgLiBQcmV2aW91c2x5LCBpdCB3YXMgc2V0IGRlcGVuZGluZyBvbiB2YXJpb3VzIGZhY3RvcnMgKG5hbWVzcGFjZSBjZXJ0LW1hbmFnZXIgaXMgaW5zdGFsbGVkIGluIGFuZC9vciBIZWxtIHJlbGVhc2UgbmFtZSkuIChbIyYjODIwMzs4MTYyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODE2MiksIFtAJiM4MjAzO0xpcXVpZFBMXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vTGlxdWlkUEwpKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIFByb21vdGVkIHRoZSBPdGhlck5hbWVzIGZlYXR1cmUgdG8gQmV0YSBhbmQgZW5hYmxlZCBpdCBieSBkZWZhdWx0IChbIyYjODIwMzs4Mjg4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI4OCksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCi0gUHJvbW90aW5nIGBYTGlzdGVuZXJTZXRzYCBmZWF0dXJlIGdhdGUgdG8gYExpc3RlbmVyU2V0c2AgKFsjJiM4MjAzOzg1MDFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NTAxKSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKLSBSZWJyYW5kaW5nIG9mIHRoZSBWZW5hZmkgSXNzdWVyIHRvIEN5YmVyQXJrIChbIyYjODIwMzs4MjE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODIxNSksIFtAJiM4MjAzO2lvc3NpZmJlbmJhc3NhdDEyM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2lvc3NpZmJlbmJhc3NhdDEyMykpCi0gU3dpdGNoZWQgdG8gU1NBIGZvciBjaGFsbGVuZ2UgZmluYWxpemVyIHVwZGF0ZXMgKFsjJiM4MjAzOzg1MTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NTE5KSwgW0AmIzgyMDM7aW50ZW9uXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaW50ZW9uKSkKLSBUaGUgZGVmYXVsdCBjb250YWluZXIgdXNlciAoVUlEKSBpcyBub3cgNjU1MzIgKHByZXZpb3VzbHkgMTAwMCkgYW5kIHRoZSBkZWZhdWx0IGNvbnRhaW5lciBncm91cCAoR0lEKSBpcyBub3cgNjU1MzIgKHByZXZpb3VzbHkgMCkgKFsjJiM4MjAzOzg0MDhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDA4KSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKLSBUaGUgZmVhdHVyZS1nYXRlIERlZmF1bHRQcml2YXRlS2V5Um90YXRpb25Qb2xpY3lBbHdheXMgbW92ZWQgZnJvbSBCZXRhIHRvIEdBIGFuZCBjYW4gbm8gbG9uZ2VyIGJlIGRpc2FibGVkLiAoWyMmIzgyMDM7ODI4N10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgyODcpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQotIFVwZGF0ZSBjZXJ0LW1hbmFnZXIncyBBQ01FIGNsaWVudCwgZm9ya2VkIGZyb20gZ29sYW5nL3gvY3J5cHRvIChbIyYjODIwMzs4MjY4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI2OCksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBVc2UgdGhlIGxhdGVzdCB2ZXJzaW9uIG9mIEt5dmVybm8gKDEuMTYuMikgaW4gdGhlIGJlc3QtcHJhY3RpY2UgaW5zdGFsbGF0aW9uIHRlc3RzIChbIyYjODIwMzs4Mzg5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODM4OSksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCi0gV2Ugc3RvcHBlZCB0ZXN0aW5nIHdpdGggQ291dG91ciBkdWUgdG8gaXQgbm90IHN1cHBvcnRpbmcgdGhlIG5ldyBYTGlzdGVuZXJTZXQgcmVzb3VyY2UsIGFuZCBtb3ZlZCB0byBrZ2F0ZXdheS4gKFsjJiM4MjAzOzg0MjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDI2KSwgW0AmIzgyMDM7aGpvc2hpMTIzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vaGpvc2hpMTIzKSkKCiMjIyBbYHYxLjE5LjZgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuNikKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOS41Li4udjEuMTkuNikKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KClRoaXMgcGF0Y2ggcmVsZWFzZSBmaXhlcyBhIHNlY3VyaXR5IGlzc3VlIChbYEdIU0EtOHJ2ai1tbTRoLWMyNThgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtOHJ2ai1tbTRoLWMyNTgpLCBISUdIKSB3aGVyZSB0aGUgZGVmYXVsdCBgY2VydC1tYW5hZ2VyLWVkaXRgIGFnZ3JlZ2F0ZSBDbHVzdGVyUm9sZSBncmFudGVkIG5hbWVzcGFjZSB1c2VycyBwZXJtaXNzaW9uIHRvIGNyZWF0ZSBBQ01FIGBDaGFsbGVuZ2VgIGFuZCBgT3JkZXJgIHJlc291cmNlcyBkaXJlY3RseS4gQSB1c2VyIHdobyBjb3VsZCBjcmVhdGUgYSBgQ2hhbGxlbmdlYCByZWZlcmVuY2luZyBhIGBDbHVzdGVySXNzdWVyYCBjb3VsZCBzdXBwbHkgYXR0YWNrZXItY29udHJvbGxlZCBzb2x2ZXIgY29uZmlndXJhdGlvbiB3aGlsZSBjZXJ0LW1hbmFnZXIgbG9hZGVkIGNyZWRlbnRpYWxzIGZyb20gdGhlIGBDbHVzdGVySXNzdWVyYCdzIG5hbWVzcGFjZSwgYnlwYXNzaW5nIElzc3VlciBzb2x2ZXIgc2VsZWN0b3JzIChgZG5zWm9uZXNgLCBgZG5zTmFtZXNgLCBgbWF0Y2hMYWJlbHNgKS4gV2l0aCB0aGUgYWNtZS1kbnMgcHJvdmlkZXIgc3BlY2lmaWNhbGx5LCB0aGlzIGNvdWxkIGRpc2Nsb3NlIEROUyBjcmVkZW50aWFscyB0byBhbiBhdHRhY2tlci1jb250cm9sbGVkIGVuZHBvaW50LgoKVGhpcyByZWxlYXNlIGFsc28gaW5jbHVkZXMgR28gdmVyc2lvbiBidW1wcyB0byBhZGRyZXNzIHJlcG9ydGVkIENWRXMuIEFsbCB1c2VycyBzaG91bGQgdXBncmFkZS4KCj4gXFshV0FSTklOR10KPiAqKlBvdGVudGlhbGx5IGJyZWFraW5nIGNoYW5nZToqKiBUaGUgYGNlcnQtbWFuYWdlci1lZGl0YCBhZ2dyZWdhdGUgQ2x1c3RlclJvbGUgbm8gbG9uZ2VyIGdyYW50cyBgY3JlYXRlYCBmb3IgYGNoYWxsZW5nZXMuYWNtZS5jZXJ0LW1hbmFnZXIuaW9gIG9yIGBjcmVhdGVgLCBgcGF0Y2hgLCBgdXBkYXRlYCBmb3IgYG9yZGVycy5hY21lLmNlcnQtbWFuYWdlci5pb2AuIFRoZXNlIHJlc291cmNlcyBhcmUgaW50ZXJuYWwgdG8gY2VydC1tYW5hZ2VyJ3MgQUNNRSB3b3JrZmxvdyBhbmQgYXJlIG5vdCBpbnRlbmRlZCB0byBiZSBjcmVhdGVkIG9yIG1vZGlmaWVkIGRpcmVjdGx5IGJ5IHVzZXJzLiBJZiB5b3UgaGF2ZSB0b29saW5nIG9yIHdvcmtmbG93cyB0aGF0IGNyZWF0ZSBDaGFsbGVuZ2Ugb3IgT3JkZXIgcmVzb3VyY2VzIGRpcmVjdGx5IChvdXRzaWRlIG9mIHRoZSBub3JtYWwgQ2VydGlmaWNhdGUg4oaSIENlcnRpZmljYXRlUmVxdWVzdCDihpIgT3JkZXIg4oaSIENoYWxsZW5nZSBmbG93KSwgeW91IHdpbGwgbmVlZCB0byBncmFudCB0aG9zZSBwZXJtaXNzaW9ucyBleHBsaWNpdGx5LgoKIyMjIyMgQ2hhbmdlcyBieSBLaW5kCgojIyMjIyBCdWcgb3IgUmVncmVzc2lvbgoKLSBTZWN1cml0eSAoSElHSCk6IFJlbW92ZSBDaGFsbGVuZ2UgYGNyZWF0ZWAgYW5kIE9yZGVyIGBjcmVhdGVgLCBgcGF0Y2hgLCBgdXBkYXRlYCB2ZXJicyBmcm9tIHRoZSBgY2VydC1tYW5hZ2VyLWVkaXRgIGFnZ3JlZ2F0ZSBDbHVzdGVyUm9sZSAoW2BHSFNBLThydmotbW00aC1jMjU4YF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLThydmotbW00aC1jMjU4KSkuIChbIyYjODIwMzs4OTQxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9wdWxsLzg5NDEpLCBbQCYjODIwMzt3YWxscmotY3liZXJhcmtdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWxscmotY3liZXJhcmspKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIFVwZGF0ZSBHbyB0byBgdjEuMjUuMTFgIHRvIGZpeCBDVkUtMjAyNi0yNzE0NSwgQ1ZFLTIwMjYtNDI1MDQsIGFuZCBDVkUtMjAyNi00MjUwNyAoWyMmIzgyMDM7ODkyNV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcHVsbC84OTI1KSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKLSBVcGdyYWRlIEdvIHRvIDEuMjUuMTAgdG8gZml4IHJlcG9ydGVkIHZ1bG5lcmFiaWxpdGllcywgYWxvbmcgd2l0aCBvdGhlciBkZXBlbmRlbmN5IGJ1bXBzIChbIyYjODIwMzs4Nzg4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9wdWxsLzg3ODgpLCBbQCYjODIwMztTZ3RDb0RGaXNoXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vU2d0Q29ERmlzaCkpCgojIyMgW2B2MS4xOS41YF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcmVsZWFzZXMvdGFnL3YxLjE5LjUpCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMTkuNC4uLnYxLjE5LjUpCgpjZXJ0LW1hbmFnZXIgaXMgdGhlIGVhc2llc3Qgd2F5IHRvIGF1dG9tYXRpY2FsbHkgbWFuYWdlIGNlcnRpZmljYXRlcyBpbiBLdWJlcm5ldGVzIGFuZCBPcGVuU2hpZnQgY2x1c3RlcnMuCgpUaGlzIGlzIGEgc2ltcGxlIHBhdGNoIHJlbGVhc2UgdG8gZml4IHNvbWUgcmVwb3J0ZWQgdnVsbmVyYWJpbGl0aWVzLiBBbGwgdXNlcnMgYXJlIHJlY29tbWVuZGVkIHRvIHVwZ3JhZGUuCgojIyMjIyBDaGFuZ2VzIGJ5IEtpbmQKCiMjIyMjIE90aGVyIChDbGVhbnVwIG9yIEZsYWtlKQoKLSBCdW1wIGdvIGRlcGVuZGVuY2llcyB3aXRoIHJlcG9ydGVkIHZ1bG5lcmFiaWxpdGllcyAoWyMmIzgyMDM7ODcwNl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcHVsbC84NzA2KSwgW0AmIzgyMDM7ZXJpa2diXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vZXJpa2diKSkKLSBCdW1wIGdvIHRvIDEuMjUuOCB0byBhZGRyZXNzIHNldmVyYWwgcmVwb3J0ZWQgdnVsbmVyYWJpbGl0aWVzIChbIyYjODIwMzs4NjI4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9wdWxsLzg2MjgpLCBbQCYjODIwMztTZ3RDb0RGaXNoXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vU2d0Q29ERmlzaCkpCi0gQnVtcCBnbyB0byAxLjI1LjkgKFsjJiM4MjAzOzg3MDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL3B1bGwvODcwNSksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCgojIyMgW2B2MS4xOS40YF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcmVsZWFzZXMvdGFnL3YxLjE5LjQpCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMTkuMy4uLnYxLjE5LjQpCgpjZXJ0LW1hbmFnZXIgaXMgdGhlIGVhc2llc3Qgd2F5IHRvIGF1dG9tYXRpY2FsbHkgbWFuYWdlIGNlcnRpZmljYXRlcyBpbiBLdWJlcm5ldGVzIGFuZCBPcGVuU2hpZnQgY2x1c3RlcnMuCgp2MS4xOS40IGlzIGEgc2ltcGxlIHBhdGNoIHJlbGVhc2UgdG8gZml4IHNvbWUgcmVwb3J0ZWQgdnVsbmVyYWJpbGl0aWVzIC0gbm90YWJseSBDVkUtMjAyNi0yNDA1MSBhbmQgQ1ZFLTIwMjUtNjgxMjEuIEFsbCB1c2VycyBzaG91bGQgdXBncmFkZS4KCiMjIyMjIENoYW5nZXMgYnkgS2luZAoKIyMjIyMgQnVnIG9yIFJlZ3Jlc3Npb24KCi0gQnVtcCBnbyB0byBhZGRyZXNzIENWRS0yMDI1LTY4MTIxIChbIyYjODIwMzs4NTI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODUyNiksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBCdW1wIG90ZWwgU0RLIHRvIGFkZHJlc3MgR08tMjAyNi00Mzk0IChbIyYjODIwMzs4NTMxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODUzMSksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKCiMjIyBbYHYxLjE5LjNgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuMykKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOS4yLi4udjEuMTkuMykKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KClRoaXMgcmVsZWFzZSBjb250YWlucyB0aHJlZSBidWcgZml4ZXMsIGluY2x1ZGluZyBhIGZpeCBmb3IgdGhlIE1PREVSQVRFIHNldmVyaXR5IERvUyBpc3N1ZSBpbiBHSFNBLWd4M3gtdnE0cC1taGh2LiBBbGwgdXNlcnMgc2hvdWxkIHVwZ3JhZGUgdG8gdGhlIGxhdGVzdCByZWxlYXNlLgoKIyMjIyMgQ2hhbmdlcyBieSBLaW5kCgojIyMjIyBCdWcgb3IgUmVncmVzc2lvbgoKLSBGaXhlZCBhbiBpbmZpbml0ZSByZS1pc3N1YW5jZSBsb29wIHRoYXQgY291bGQgb2NjdXIgd2hlbiBhbiBpc3N1ZXIgcmV0dXJucyBhIGNlcnRpZmljYXRlIHdpdGggYSBwdWJsaWMga2V5IHRoYXQgZG9lc24ndCBtYXRjaCB0aGUgQ1NSLiBUaGUgaXNzdWluZyBjb250cm9sbGVyIG5vdyB2YWxpZGF0ZXMgdGhlIGNlcnRpZmljYXRlIGJlZm9yZSBzdG9yaW5nIGl0IGFuZCBmYWlscyB3aXRoIGJhY2tvZmYgb24gbWlzbWF0Y2guIChbIyYjODIwMzs4NDE1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQxNSksIFtAJiM4MjAzO2NlcnQtbWFuYWdlci1ib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXItYm90KSkKLSBGaXhlZCBhbiBpc3N1ZSB3aGVyZSBIVFRQLTAxIGNoYWxsZW5nZXMgZmFpbGVkIHdoZW4gdGhlIEhvc3QgaGVhZGVyIGNvbnRhaW5lZCBhbiBJUHY2IGFkZHJlc3MuIFRoaXMgbWVhbnMgdGhhdCB1c2VycyBjYW4gbm93IGlzc3VlIElQIGFkZHJlc3MgY2VydGlmaWNhdGVzIGZvciBJUHY2IGFkZHJlc3Mgc3ViamVjdHMuIChbIyYjODIwMzs4NDM2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQzNiksIFtAJiM4MjAzO2NlcnQtbWFuYWdlci1ib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXItYm90KSkKLSBTZWN1cml0eSAoTU9ERVJBVEUpOiBGaXggYSBwb3RlbnRpYWwgcGFuaWMgaW4gdGhlIGNlcnQtbWFuYWdlciBjb250cm9sbGVyIHdoZW4gYSBETlMgcmVzcG9uc2UgaW4gYW4gdW5leHBlY3RlZCBvcmRlciB3YXMgY2FjaGVkLiBJZiBhbiBhdHRhY2tlciB3YXMgYWJsZSB0byBtb2RpZnkgRE5TIHJlc3BvbnNlcyAob3IgaWYgdGhleSBjb250cm9sbGVkIHRoZSBETlMgc2VydmVyKSBpdCB3YXMgcG9zc2libGUgdG8gY2F1c2UgZGVuaWFsIG9mIHNlcnZpY2UgZm9yIHRoZSBjZXJ0LW1hbmFnZXIgY29udHJvbGxlci4gKFsjJiM4MjAzOzg0NjhdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84NDY4KSwgW0AmIzgyMDM7U2d0Q29ERmlzaF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1NndENvREZpc2gpKQoKIyMjIyMgT3RoZXIgKENsZWFudXAgb3IgRmxha2UpCgotIEJ1bXAgZ28gdG8gMS4yNS42IChbIyYjODIwMzs4NDU5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODQ1OSksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKCiMjIyBbYHYxLjE5LjJgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuMikKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOS4xLi4udjEuMTkuMikKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KCldlIHVwZGF0ZWQgR28gdG8gZml4IHNvbWUgdnVsbmVyYWJpbGl0aWVzIGluIHRoZSBzdGFuZGFyZCBsaWJyYXJ5LgoKPiDwn5OWIFJlYWQgdGhlIFtmdWxsIDEuMTkgcmVsZWFzZSBub3Rlc10oaHR0cHM6Ly9jZXJ0LW1hbmFnZXIuaW8vZG9jcy9yZWxlYXNlcy9yZWxlYXNlLW5vdGVzL3JlbGVhc2Utbm90ZXMtMS4xOSkgb24gdGhlIGNlcnQtbWFuYWdlci5pbyB3ZWJzaXRlIGJlZm9yZSB1cGdyYWRpbmcuCgojIyMjIENoYW5nZXMgc2luY2UgYHYxLjE5LjFgCgojIyMjIyBCdWcgb3IgUmVncmVzc2lvbgoKLSBBZGRyZXNzIGZhbHNlIHBvc2l0aXZlIHZ1bG5lcmFiaWxpdGllcyBgQ1ZFLTIwMjUtNDc5MTRgIGFuZCBgQ1ZFLTIwMjUtNTgxODFgIHdoaWNoIHdlcmUgcmVwb3J0ZWQgYnkgVHJpdnkuIChbIyYjODIwMzs4MjgzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI4MyksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBVcGRhdGUgR28gdG8gYHYxLjI1LjVgIHRvIGZpeCBgQ1ZFLTIwMjUtNjE3MjdgIGFuZCBgQ1ZFLTIwMjUtNjE3MjlgIChbIyYjODIwMzs4Mjk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI5NCksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCi0gVXBkYXRlIGBnbG9iYWwubm9kZVNlbGVjdG9yYCB0byBoZWxtIGNoYXJ0IHRvIHBlcmZvcm0gYSBgbWVyZ2VgIGFuZCBhbGxvdyBmb3IgYSBzaW5nbGUgYG5vZGVTZWxlY3RvcmAgdG8gYmUgc2V0IGFjcm9zcyBhbGwgc2VydmljZXMuIChbIyYjODIwMzs4MjMzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODIzMyksIFtAJiM4MjAzO2NlcnQtbWFuYWdlci1ib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXItYm90KSkKCiMjIyMjIE90aGVyIChDbGVhbnVwIG9yIEZsYWtlKQoKLSBVcGRhdGUgY2VydC1tYW5hZ2VyJ3MgQUNNRSBjbGllbnQsIGZvcmtlZCBmcm9tIGBnb2xhbmcveC9jcnlwdG9gIChbIyYjODIwMzs4MjcwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODI3MCksIFtAJiM4MjAzO1NndENvREZpc2hdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9TZ3RDb0RGaXNoKSkKLSBVcGRhdGVkIERlYmlhbiAxMiBkaXN0cm9sZXNzIGJhc2UgaW1hZ2VzIChbIyYjODIwMzs4MzI2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODMyNiksIFtAJiM4MjAzO3dhbGxyai1jeWJlcmFya10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dhbGxyai1jeWJlcmFyaykpCgojIyMgW2B2MS4xOS4xYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcmVsZWFzZXMvdGFnL3YxLjE5LjEpCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2NvbXBhcmUvdjEuMTkuMC4uLnYxLjE5LjEpCgpjZXJ0LW1hbmFnZXIgaXMgdGhlIGVhc2llc3Qgd2F5IHRvIGF1dG9tYXRpY2FsbHkgbWFuYWdlIGNlcnRpZmljYXRlcyBpbiBLdWJlcm5ldGVzIGFuZCBPcGVuU2hpZnQgY2x1c3RlcnMuCgpXZSByZXZlcnRlZCB0aGUgQ1JELWJhc2VkIEFQSSBkZWZhdWx0cyBmb3IgYENlcnRpZmljYXRlLlNwZWMuSXNzdWVyUmVmYCBhbmQgYENlcnRpZmljYXRlUmVxdWVzdC5TcGVjLklzc3VlclJlZmAgYWZ0ZXIgdGhleSB3ZXJlIGZvdW5kIHRvIGNhdXNlIHVuZXhwZWN0ZWQgY2VydGlmaWNhdGUgcmVuZXdhbHMgYWZ0ZXIgdXBncmFkaW5nIHRvIDEuMTkuMC4gV2Ugd2lsbCB0cnkgcmUtaW50cm9kdWNpbmcgdGhlc2UgQVBJIGRlZmF1bHRzIGluIGNlcnQtbWFuYWdlciBgMS4yMGAuCldlIGZpeGVkIGEgYnVnIHRoYXQgY2F1c2VkIGNlcnRpZmljYXRlcyB0byBiZSByZS1pc3N1ZWQgdW5leHBlY3RlZGx5IGlmIHRoZSBgaXNzdWVyUmVmYCBraW5kIG9yIGdyb3VwIHdhcyBjaGFuZ2VkIHRvIG9uZSBvZiB0aGUgInJ1bnRpbWUiIGRlZmF1bHQgdmFsdWVzLgpXZSB1cGdyYWRlZCBHbyB0byBgMS4yNS4zYCB0byBhZGRyZXNzIHRoZSBmb2xsb3dpbmcgc2VjdXJpdHkgdnVsbmVyYWJpbGl0aWVzOiBgQ1ZFLTIwMjUtNjE3MjRgLCBgQ1ZFLTIwMjUtNTgxODdgLCBgQ1ZFLTIwMjUtNDc5MTJgLCBgQ1ZFLTIwMjUtNTgxODNgLCBgQ1ZFLTIwMjUtNjE3MjNgLCBgQ1ZFLTIwMjUtNTgxODZgLCBgQ1ZFLTIwMjUtNTgxODVgLCBgQ1ZFLTIwMjUtNTgxODhgLCBhbmQgYENWRS0yMDI1LTYxNzI1YC4KCj4g8J+TliBSZWFkIHRoZSBbZnVsbCAxLjE5IHJlbGVhc2Ugbm90ZXNdKGh0dHBzOi8vY2VydC1tYW5hZ2VyLmlvL2RvY3MvcmVsZWFzZXMvcmVsZWFzZS1ub3Rlcy9yZWxlYXNlLW5vdGVzLTEuMTkpIG9uIHRoZSBjZXJ0LW1hbmFnZXIuaW8gd2Vic2l0ZSBiZWZvcmUgdXBncmFkaW5nLgoKQ2hhbmdlcyBzaW5jZSBgdjEuMTkuMGA6CgojIyMjIyBCdWcgb3IgUmVncmVzc2lvbgoKLSBCVUdGSVg6IGluIGNhc2Uga2luZCBvciBncm91cCBpbiB0aGUgYGlzc3VlclJlZmAgb2YgYSBDZXJ0aWZpY2F0ZSB3YXMgb21pdHRlZCwgdXBncmFkaW5nIHRvIGAxLjE5LnhgIGluY29ycmVjdGx5IGNhdXNlZCB0aGUgY2VydGlmaWNhdGUgdG8gYmUgcmVuZXdlZCAoWyMmIzgyMDM7ODE3NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzgxNzUpLCBbQCYjODIwMztjZXJ0LW1hbmFnZXItYm90XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyLWJvdCkpCi0gQnVtcCBHbyB0byAxLjI1LjMgdG8gZml4IGEgYmFja3dhcmRzIGluY29tcGF0aWJsZSBjaGFuZ2UgdG8gdGhlIHZhbGlkYXRpb24gb2YgRE5TIG5hbWVzIGluIFguNTA5IFNBTiBmaWVsZHMgd2hpY2ggcHJldmVudGVkIHRoZSB1c2Ugb2YgRE5TIG5hbWVzIHdpdGggYSB0cmFpbGluZyBkb3QgKFsjJiM4MjAzOzgxNzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MTc3KSwgW0AmIzgyMDM7d2FsbHJqLWN5YmVyYXJrXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2FsbHJqLWN5YmVyYXJrKSkKLSBSZXZlcnQgQVBJIGRlZmF1bHRzIGZvciBpc3N1ZXIgcmVmZXJlbmNlIGtpbmQgYW5kIGdyb3VwIGludHJvZHVjZWQgaW4gMC4xOS4wIChbIyYjODIwMzs4MTc4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvODE3OCksIFtAJiM4MjAzO2NlcnQtbWFuYWdlci1ib3RdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXItYm90KSkKCiMjIyBbYHYxLjE5LjBgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9yZWxlYXNlcy90YWcvdjEuMTkuMCkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvY29tcGFyZS92MS4xOC42Li4udjEuMTkuMCkKCmNlcnQtbWFuYWdlciBpcyB0aGUgZWFzaWVzdCB3YXkgdG8gYXV0b21hdGljYWxseSBtYW5hZ2UgY2VydGlmaWNhdGVzIGluIEt1YmVybmV0ZXMgYW5kIE9wZW5TaGlmdCBjbHVzdGVycy4KCj4g4pqg77iPICoqS25vd24gaXNzdWVzKio6IFRoZSBmb2xsb3dpbmcga25vd24gaXNzdWVzIGFyZSBmaXhlZCBpbiBbdjEuMTkuMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvcmVsZWFzZXMvdGFnL3YxLjE5LjEpOgo+Cj4gLSBbVW5leHBlY3RlZCBjZXJ0aWZpY2F0ZSByZW5ld2FsIGFmdGVyIHVwZ3JhZGluZyB0byAxLjE5LjBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy84MTU4KQoKVGhpcyByZWxlYXNlIGZvY3VzZXMgb24gZXhwYW5kaW5nIHBsYXRmb3JtIGNvbXBhdGliaWxpdHksIGltcHJvdmluZyBkZXBsb3ltZW50IGZsZXhpYmlsaXR5LCBlbmhhbmNpbmcgb2JzZXJ2YWJpbGl0eSwgYW5kIGFkZHJlc3Npbmcga2V5IHJlbGlhYmlsaXR5IGlzc3Vlcy4KCj4g8J+TliAgUmVhZCB0aGUgZnVsbCByZWxlYXNlIG5vdGVzIGF0IGNlcnQtbWFuYWdlci5pbzogPGh0dHBzOi8vY2VydC1tYW5hZ2VyLmlvL2RvY3MvcmVsZWFzZXMvcmVsZWFzZS1ub3Rlcy9yZWxlYXNlLW5vdGVzLTEuMTk+CgpDaGFuZ2VzIHNpbmNlIGB2MS4xOC4wYDoKCiMjIyMjIEZlYXR1cmUKCi0gQWRkIElQdjYgcnVsZXMgdG8gdGhlIGRlZmF1bHQgbmV0d29yayBwb2xpY3kgKFsjJiM4MjAzOzc3MjZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83NzI2KSwgW0AmIzgyMDM7amNwdW5rXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vamNwdW5rKSkKLSBBZGQgYGdsb2JhbC5ub2RlU2VsZWN0b3JgIHRvIGhlbG0gY2hhcnQgdG8gYWxsb3cgZm9yIGEgc2luZ2xlIGBub2RlU2VsZWN0b3JgIHRvIGJlIHNldCBhY3Jvc3MgYWxsIHNlcnZpY2VzLiAoWyMmIzgyMDM7NzgxOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc4MTgpLCBbQCYjODIwMztTdGluZ1JheVpBXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vU3RpbmdSYXlaQSkpCi0gQWRkIGEgZmVhdHVyZSBnYXRlIHRvIGRlZmF1bHQgdG8gSW5ncmVzcyBgcGF0aFR5cGVgIGBFeGFjdGAgaW4gQUNNRSBIVFRQMDEgSW5ncmVzcyBjaGFsbGVuZ2Ugc29sdmVycy4gKFsjJiM4MjAzOzc3OTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZXJ0LW1hbmFnZXIvY2VydC1tYW5hZ2VyL2lzc3Vlcy83Nzk1KSwgW0AmIzgyMDM7c3NwcmVpdHplcl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3NzcHJlaXR6ZXIpKQotIEFkZCBnZW5lcmF0ZWQgYGFwcGx5Y29uZmlndXJhdGlvbnNgIGFsbG93aW5nIGNsaWVudHMgdG8gbWFrZSB0eXBlLXNhZmUgc2VydmVyLXNpZGUgYXBwbHkgcmVxdWVzdHMgZm9yIGNlcnQtbWFuYWdlciByZXNvdXJjZXMuIChbIyYjODIwMzs3ODY2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vY2VydC1tYW5hZ2VyL2NlcnQtbWFuYWdlci9pc3N1ZXMvNzg2NiksIFtAJiM4MjAzO2VyaWtnYl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2VyaWtnYikpCi0gQWRkZWQgQVBJIGRlZmF1bHRzIHRvIGlzc3VlciByZWZlcmVuY2VzIGdyb3VwIChjZXJ0LW1hbmFnZXIuaW8pIGFuZCBraW5kIChJc3N1ZXIpLiAoWyMmIzgyMDM7NzQxNF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2NlcnQtbWFuYWdlci9jZXJ0LW1hbmFnZXIvaXNzdWVzLzc0MTQpLCBbQCYjODIwMztlcmlrZ2JdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9lcmlrZ2IpKQotIEFkZGVkIGBjZXJ0bWFuYWdlcl9jZXJ0aWZpY2F0ZV9jaGFsbGVuZ2Vfc3RhdHVzYCBQcm9tZXRoZXVzIG1ldHJpYy4gKFsjJiM4MjAzOzc3MzZdKGh0dHBzOi8vcmUKCj4g4pyCICoqTm90ZSoqCj4gCj4gUFIgYm9keSB3YXMgdHJ1bmNhdGVkIHRvIGhlcmUuCgoKPC9kZXRhaWxzPgoKLS0tCgojIyMgQ29uZmlndXJhdGlvbgoK8J+ThSAqKlNjaGVkdWxlKio6IChVVEMpCgotIEJyYW5jaCBjcmVhdGlvbgogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCi0gQXV0b21lcmdlCiAgLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCkKCvCfmqYgKipBdXRvbWVyZ2UqKjogRGlzYWJsZWQgYnkgY29uZmlnLiBQbGVhc2UgbWVyZ2UgdGhpcyBtYW51YWxseSBvbmNlIHlvdSBhcmUgc2F0aXNmaWVkLgoK4pm7ICoqUmViYXNpbmcqKjogV2hlbmV2ZXIgUFIgYmVjb21lcyBjb25mbGljdGVkLCBvciB5b3UgdGljayB0aGUgcmViYXNlL3JldHJ5IGNoZWNrYm94LgoK8J+UlSAqKklnbm9yZSoqOiBDbG9zZSB0aGlzIFBSIGFuZCB5b3Ugd29uJ3QgYmUgcmVtaW5kZWQgYWJvdXQgdGhpcyB1cGRhdGUgYWdhaW4uCgotLS0KCiAtIFsgXSA8IS0tIHJlYmFzZS1jaGVjayAtLT5JZiB5b3Ugd2FudCB0byByZWJhc2UvcmV0cnkgdGhpcyBQUiwgY2hlY2sgdGhpcyBib3gKCi0tLQoKVGhpcyBQUiB3YXMgZ2VuZXJhdGVkIGJ5IFtNZW5kIFJlbm92YXRlXShodHRwczovL21lbmQuaW8vcmVub3ZhdGUvKS4gVmlldyB0aGUgW3JlcG9zaXRvcnkgam9iIGxvZ10oaHR0cHM6Ly9kZXZlbG9wZXIubWVuZC5pby9naXRodWIvdmV4eGhvc3QvYXRtb3NwaGVyZS5jb21tb24pLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUkwTVM0eE16RXVPU0lzSW5Wd1pHRjBaV1JKYmxabGNpSTZJalF6TGpJNE1DNHdJaXdpZEdGeVoyVjBRbkpoYm1Ob0lqb2liV0ZwYmlJc0lteGhZbVZzY3lJNlcxMTktLT4K patchset: 4ab174a72079e89cc7e61a674221eb9e91158c0c pipeline: check playbook_context: playbook_projects: trusted/project_0/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 trusted/project_1/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 1a6ce7475e62704e5dde6282210bb88276736841 trusted/project_2/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_0/github.com/vexxhost/zuul-jobs: canonical_name: github.com/vexxhost/zuul-jobs checkout: main commit: c286bf94224b5660b8e49e9a058289e61062a9a0 untrusted/project_1/github.com/vexxhost/zuul-config: canonical_name: github.com/vexxhost/zuul-config checkout: main commit: 298983cd1253e6833abdb49d87d912527e0e6597 untrusted/project_2/opendev.org/zuul/zuul-jobs: canonical_name: opendev.org/zuul/zuul-jobs checkout: master commit: 1a6ce7475e62704e5dde6282210bb88276736841 untrusted/project_3/github.com/vexxhost/atmosphere.common: canonical_name: github.com/vexxhost/atmosphere.common checkout: main commit: efc39c0f1736643f058dfcd25f6e7e04f89f1840 untrusted/project_4/opendev.org/openstack/openstack-helm: canonical_name: opendev.org/openstack/openstack-helm checkout: master commit: c809f1257800cdd7df8c594be8159b07bbfcb815 playbooks: - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/run.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/playbook_0/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/playbook_0/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/playbook_0/role_2/zuul-jobs/roles post_playbooks: - path: untrusted/project_3/github.com/vexxhost/atmosphere.common/test-playbooks/molecule/post.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/post_playbook_0/role_0/atmosphere.common link_target: untrusted/project_3/github.com/vexxhost/atmosphere.common role_path: ansible/post_playbook_0/role_0/atmosphere.common/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/post_playbook_0/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_0/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_0/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_0/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_0/role_4/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_1/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_1/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_1/role_2/zuul-jobs/roles - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/post-logs.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/post_playbook_2/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/post_playbook_2/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/post_playbook_2/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/post_playbook_2/role_2/zuul-jobs/roles pre_playbooks: - path: trusted/project_0/github.com/vexxhost/zuul-config/playbooks/base/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_0/role_1/zuul-jobs link_target: trusted/project_1/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_0/role_1/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_0/role_2/zuul-jobs link_target: trusted/project_2/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_0/role_2/zuul-jobs/roles - path: untrusted/project_0/github.com/vexxhost/zuul-jobs/playbooks/molecule/pre.yaml roles: - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_1/role_1/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_1/role_1/zuul-jobs/roles - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_1/role_2/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_1/role_2/zuul-jobs/roles - path: untrusted/project_3/github.com/vexxhost/atmosphere.common/test-playbooks/molecule/pre.yml roles: - checkout: main checkout_description: playbook branch link_name: ansible/pre_playbook_2/role_0/atmosphere.common link_target: untrusted/project_3/github.com/vexxhost/atmosphere.common role_path: ansible/pre_playbook_2/role_0/atmosphere.common/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_1/openstack-helm link_target: untrusted/project_4/opendev.org/openstack/openstack-helm role_path: ansible/pre_playbook_2/role_1/openstack-helm/roles - checkout: master checkout_description: project default branch link_name: ansible/pre_playbook_2/role_3/zuul-jobs link_target: untrusted/project_2/opendev.org/zuul/zuul-jobs role_path: ansible/pre_playbook_2/role_3/zuul-jobs/roles - checkout: main checkout_description: zuul branch link_name: ansible/pre_playbook_2/role_4/zuul-jobs link_target: untrusted/project_0/github.com/vexxhost/zuul-jobs role_path: ansible/pre_playbook_2/role_4/zuul-jobs/roles post_review: false post_timeout: null pre_timeout: null project: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common name: vexxhost/atmosphere.common short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common projects: github.com/vexxhost/atmosphere.common: canonical_hostname: github.com canonical_name: github.com/vexxhost/atmosphere.common checkout: main checkout_description: zuul branch commit: efc39c0f1736643f058dfcd25f6e7e04f89f1840 name: vexxhost/atmosphere.common required: false short_name: atmosphere.common src_dir: src/github.com/vexxhost/atmosphere.common ref: refs/pull/105/head resources: {} tenant: oss timeout: 1800 topic: null voting: true