From ed58fcccd3b44e012fc7734441b0571cbfd03c3c Mon Sep 17 00:00:00 2001
From: Malte Poll <mp@edgeless.systems>
Date: Fri, 4 Nov 2022 16:48:52 +0100
Subject: [PATCH] CI: Add secure boot prod keys (#462)

* Add production secure boot keys
* Refactor OS build and upload settings
---
 .github/actions/os_build_variables/action.yml | 242 ++++++++++++++++++
 .github/workflows/build-os-image.yml          | 197 +++++++-------
 cli/internal/libvirt/Dockerfile               |  15 +-
 .../nvram/constellation_vars.production.fd    | Bin 0 -> 131072 bytes
 image/README.md                               |   1 +
 image/pki_prod/KEK.auth                       | Bin 0 -> 4103 bytes
 image/pki_prod/KEK.cer                        | Bin 0 -> 979 bytes
 image/pki_prod/KEK.crt                        |  23 ++
 image/pki_prod/KEK.esl                        | Bin 0 -> 2583 bytes
 image/pki_prod/MicCorKEKCA2011_2011-06-24.crt | Bin 0 -> 1516 bytes
 image/pki_prod/MicCorKEKCA2011_2011-06-24.esl | Bin 0 -> 1560 bytes
 image/pki_prod/MicCorUEFCA2011_2011-06-27.crt | Bin 0 -> 1556 bytes
 image/pki_prod/MicCorUEFCA2011_2011-06-27.esl | Bin 0 -> 1600 bytes
 .../pki_prod/MicWinProPCA2011_2011-10-19.crt  | Bin 0 -> 1499 bytes
 .../pki_prod/MicWinProPCA2011_2011-10-19.esl  | Bin 0 -> 1543 bytes
 image/pki_prod/PK.auth                        | Bin 0 -> 2545 bytes
 image/pki_prod/PK.cer                         | Bin 0 -> 981 bytes
 image/pki_prod/PK.crt                         |  23 ++
 image/pki_prod/PK.esl                         | Bin 0 -> 1025 bytes
 image/pki_prod/db.auth                        | Bin 0 -> 5699 bytes
 image/pki_prod/db.cer                         | Bin 0 -> 995 bytes
 image/pki_prod/db.crt                         |  23 ++
 image/pki_prod/db.esl                         | Bin 0 -> 4182 bytes
 23 files changed, 424 insertions(+), 100 deletions(-)
 create mode 100644 .github/actions/os_build_variables/action.yml
 create mode 100644 cli/internal/libvirt/nvram/constellation_vars.production.fd
 create mode 100644 image/pki_prod/KEK.auth
 create mode 100644 image/pki_prod/KEK.cer
 create mode 100644 image/pki_prod/KEK.crt
 create mode 100644 image/pki_prod/KEK.esl
 create mode 100644 image/pki_prod/MicCorKEKCA2011_2011-06-24.crt
 create mode 100644 image/pki_prod/MicCorKEKCA2011_2011-06-24.esl
 create mode 100644 image/pki_prod/MicCorUEFCA2011_2011-06-27.crt
 create mode 100644 image/pki_prod/MicCorUEFCA2011_2011-06-27.esl
 create mode 100644 image/pki_prod/MicWinProPCA2011_2011-10-19.crt
 create mode 100644 image/pki_prod/MicWinProPCA2011_2011-10-19.esl
 create mode 100644 image/pki_prod/PK.auth
 create mode 100644 image/pki_prod/PK.cer
 create mode 100644 image/pki_prod/PK.crt
 create mode 100644 image/pki_prod/PK.esl
 create mode 100644 image/pki_prod/db.auth
 create mode 100644 image/pki_prod/db.cer
 create mode 100644 image/pki_prod/db.crt
 create mode 100644 image/pki_prod/db.esl

diff --git a/.github/actions/os_build_variables/action.yml b/.github/actions/os_build_variables/action.yml
new file mode 100644
index 000000000..09a2b1dac
--- /dev/null
+++ b/.github/actions/os_build_variables/action.yml
@@ -0,0 +1,242 @@
+name: Determine OS image upload variables
+description: "Determine parameters used for image upload to various CSPs."
+inputs:
+  csp:
+    description: "Cloud Service Provider"
+    required: true
+  uploadVariant:
+    description: "Upload variant"
+    required: true
+  basePath:
+    description: "Base path to the image build directory"
+    required: true
+  imageVersion:
+    description: "Semantic version including patch e.g. v<major>.<minor>.<patch> (only used for releases)"
+    required: false
+  imageType:
+    description: "Type of image to build"
+    required: true
+  debug:
+    description: "Build debug image"
+    required: false
+    default: "false"
+outputs:
+  awsRegion:
+    description: "Primary AWS region"
+    value: ${{ steps.aws.outputs.region }}
+  awsReplicationRegions:
+    description: "AWS regions to replicate the image to"
+    value: ${{ steps.aws.outputs.replicationRegions }}
+  awsBucket:
+    description: "AWS S3 bucket to upload the image to"
+    value: ${{ steps.aws.outputs.bucket }}
+  awsEfivarsPath:
+    description: "AWS efivars path"
+    value: ${{ steps.aws.outputs.efivarsPath }}
+  awsImagePath:
+    description: "AWS image path"
+    value: ${{ steps.aws.outputs.imagePath }}
+  awsAmiOutput:
+    description: "AWS ami output path"
+    value: ${{ steps.aws.outputs.amiOutput }}
+  awsImageFilename:
+    description: "AWS raw image filename"
+    value: ${{ steps.aws.outputs.imageFilename }}
+  awsImageName:
+    description: "AWS image name"
+    value: ${{ steps.aws.outputs.imageName }}
+  azureResourceGroupName:
+    description: "Azure resource group name"
+    value: ${{ steps.azure.outputs.resourceGroupName }}
+  azureRegion:
+    description: "Primary Azure region"
+    value: ${{ steps.azure.outputs.region }}
+  azureReplicationRegions:
+    description: "Azure regions to replicate the image to"
+    value: ${{ steps.azure.outputs.replicationRegions }}
+  azureVmgsRegion:
+    description: "Azure VMGS region (AWS S3 bucket region where VMGS blob is stored)"
+    value: ${{ steps.azure.outputs.vmgsRegion }}
+  azureSku:
+    description: "Azure SIG SKU"
+    value: ${{ steps.azure.outputs.sku }}
+  azurePublisher:
+    description: "Azure SIG publisher"
+    value: ${{ steps.azure.outputs.publisher }}
+  azureRawImagePath:
+    description: "Azure raw image path"
+    value: ${{ steps.azure.outputs.rawImagePath }}
+  azureImagePath:
+    description: "Azure image path"
+    value: ${{ steps.azure.outputs.imagePath }}
+  azureSecurityType:
+    description: "Azure security type"
+    value: ${{ steps.azure.outputs.securityType }}
+  azureDiskName:
+    description: "Azure disk name"
+    value: ${{ steps.azure.outputs.diskName }}
+  azureImageDefinition:
+    description: "Azure image definition"
+    value: ${{ steps.azure.outputs.imageDefinition }}
+  azureImageVersion:
+    description: "Azure image version"
+    value: ${{ steps.azure.outputs.imageVersion }}
+  azureGalleryName:
+    description: "Azure gallery name"
+    value: ${{ steps.azure.outputs.galleryName }}
+  azureVmgsPath:
+    description: "Azure VMGS path"
+    value: ${{ steps.azure.outputs.vmgsPath }}
+  gcpProject:
+    description: "GCP project"
+    value: ${{ steps.gcp.outputs.project }}
+  gcpBucket:
+    description: "GCP bucket"
+    value: ${{ steps.gcp.outputs.bucket }}
+  gcpRegion:
+    description: "GCP region"
+    value: ${{ steps.gcp.outputs.region }}
+  gcpRawImagePath:
+    description: "GCP raw image path"
+    value: ${{ steps.gcp.outputs.rawImagePath }}
+  gcpImagePath:
+    description: "GCP image path"
+    value: ${{ steps.gcp.outputs.imagePath }}
+  gcpImageName:
+    description: "GCP image name"
+    value: ${{ steps.gcp.outputs.imageName }}
+  gcpImageFilename:
+    description: "GCP image filename"
+    value: ${{ steps.gcp.outputs.imageFilename }}
+  gcpImageFamily:
+    description: "GCP image family"
+    value: ${{ steps.gcp.outputs.imageFamily }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Determine version
+      id: version
+      uses: ./.github/actions/pseudo_version
+
+    - name: Configure AWS input variables
+      id: aws
+      if: ${{ inputs.csp == 'aws' }}
+      shell: bash
+      env:
+        basePath: ${{ inputs.basePath }}
+        imageVersion: ${{ inputs.imageVersion }}
+        imageType: ${{ inputs.imageType }}
+        timestamp: ${{ steps.version.outputs.timestamp }}
+        semver: ${{ steps.version.outputs.semanticVersion }}
+        branchName: ${{ steps.version.outputs.branchName }}
+      run: |
+        echo "region=eu-central-1" >> $GITHUB_OUTPUT
+        echo "replicationRegions=us-east-2 ap-south-1" >> $GITHUB_OUTPUT
+        echo "bucket=constellation-images" >> $GITHUB_OUTPUT
+        echo "efivarsPath=${basePath}/mkosi.output.aws/fedora~36/efivars.bin" >> $GITHUB_OUTPUT
+        echo "imagePath=${basePath}/mkosi.output.aws/fedora~36/image.raw" >> $GITHUB_OUTPUT
+        echo "amiOutput=${basePath}/mkosi.output.aws/fedora~36/ami.json" >> $GITHUB_OUTPUT
+        echo "imageFilename=image-$(date +%s).raw" >> $GITHUB_OUTPUT
+        if [ "${imageType}" = release ]
+        then
+          echo "imageName=constellation-${imageVersion}" >> $GITHUB_OUTPUT
+        elif [ "${imageType}" = debug ]
+        then
+          echo "imageName=constellation-debug-${semver}-${timestamp}" >> $GITHUB_OUTPUT
+        else
+          echo "imageName=constellation-${branchName}-${timestamp}" >> $GITHUB_OUTPUT
+        fi
+
+    #    gallery name may include alphanumeric characters, dots and underscores. Must end and begin with an alphanumeric character
+    #    image definition may include alphanumeric characters, dots, dashes and underscores. Must end and begin with an alphanumeric character
+    #    image version has to be semantic version in the form <uint>.<uint>.<uint> . uint may not be larger than 2,147,483,647
+    - name: Configure Azure input variables
+      id: azure
+      if: ${{ inputs.csp == 'azure' }}
+      shell: bash
+      env:
+        basePath: ${{ inputs.basePath }}
+        imageVersion: ${{ inputs.imageVersion }}
+        imageType: ${{ inputs.imageType }}
+        timestamp: ${{ steps.version.outputs.timestamp }}
+        semver: ${{ steps.version.outputs.semanticVersion }}
+        pseudover: ${{ steps.version.outputs.pseudoVersion }}
+        branchName: ${{ steps.version.outputs.branchName }}
+      run: |
+        echo "resourceGroupName=constellation-images" >> $GITHUB_OUTPUT
+        echo "region=northeurope" >> $GITHUB_OUTPUT
+        echo "vmgsRegion=eu-central-1" >> $GITHUB_OUTPUT
+        echo "replicationRegions=northeurope eastus westeurope westus" >> $GITHUB_OUTPUT
+        echo "sku=constellation" >> $GITHUB_OUTPUT
+        echo "publisher=edgelesssys" >> $GITHUB_OUTPUT
+        echo "rawImagePath=${basePath}/mkosi.output.azure/fedora~36/image.raw" >> $GITHUB_OUTPUT
+        echo "imagePath=${basePath}/mkosi.output.azure/fedora~36/image.vhd" >> $GITHUB_OUTPUT
+        # TODO: set default security type to "ConfidentialVM" once replication is possible
+        securityType=${{ inputs.uploadVariant }}
+        if [ -z "${securityType}" ]; then
+          securityType=ConfidentialVMSupported
+        fi
+        echo "securityType=${securityType}" >> $GITHUB_OUTPUT
+        echo "diskName=constellation-${pseudover//./-}-${securityType,,}" >> $GITHUB_OUTPUT
+        if [ "${imageType}" = release ]
+        then
+          echo "imageDefinition=constellation" >> $GITHUB_OUTPUT
+          echo "imageOffer=constellation" >> $GITHUB_OUTPUT
+          echo "imageVersion=${imageVersion:1}" >> $GITHUB_OUTPUT
+          galleryName=Constellation
+        elif [ "${imageType}" = debug ]
+        then
+          echo "imageDefinition=${semver}" >> $GITHUB_OUTPUT
+          echo "imageDefinition=${semver}" >> $GITHUB_OUTPUT
+          echo "imageVersion=${timestamp:0:4}.${timestamp:4:4}.${timestamp:8}" >> $GITHUB_OUTPUT
+          galleryName=Constellation_Debug
+        else
+          echo "imageDefinition=${branchName}" >> $GITHUB_OUTPUT
+          echo "imageOffer=${branchName}" >> $GITHUB_OUTPUT
+          echo "imageVersion=${timestamp:0:4}.${timestamp:4:4}.${timestamp:8}" >> $GITHUB_OUTPUT
+          galleryName=Constellation_Testing
+        fi
+        # TODO: enable VMGS upload for ConfidentialVM images once replication is possible
+        if [ "${securityType}" == "ConfidentialVMSupported" ]; then
+          echo "galleryName=${galleryName}_CVM" >> $GITHUB_OUTPUT
+          echo "vmgsPath=" >> $GITHUB_OUTPUT
+        else
+          echo "galleryName=${galleryName}" >> $GITHUB_OUTPUT
+          echo "vmgsPath=${basePath}/pki/${securityType}.vmgs" >> $GITHUB_OUTPUT
+        fi
+
+    #    image family and image name may include lowercase alphanumeric characters and dashes.
+    #    Must not end or begin with a dash
+    - name: Configure GCP input variables
+      id: gcp
+      if: ${{ inputs.csp == 'gcp' }}
+      shell: bash
+      env:
+        basePath: ${{ inputs.basePath }}
+        imageVersion: ${{ inputs.imageVersion }}
+        imageType: ${{ inputs.imageType }}
+        timestamp: ${{ steps.version.outputs.timestamp }}
+        semver: ${{ steps.version.outputs.semanticVersion }}
+        branchName: ${{ steps.version.outputs.branchName }}
+      run: |
+        echo "project=constellation-images" >> $GITHUB_OUTPUT
+        echo "bucket=constellation-images" >> $GITHUB_OUTPUT
+        echo "region=europe-west3" >> $GITHUB_OUTPUT
+        echo "rawImagePath=${basePath}/mkosi.output.gcp/fedora~36/image.raw" >> $GITHUB_OUTPUT
+        echo "imagePath=${basePath}/mkosi.output.gcp/fedora~36/image.tar.gz" >> $GITHUB_OUTPUT
+        if [ "${imageType}" = release ]
+        then
+          echo "imageName=constellation-${imageVersion//./-}" >> $GITHUB_OUTPUT
+          echo "imageFilename=constellation-${imageVersion//./-}.tar.gz" >> $GITHUB_OUTPUT
+          echo "imageFamily=constellation" >> $GITHUB_OUTPUT
+        elif [ "${imageType}" = debug ]
+        then
+          echo "imageName=constellation-${timestamp}" >> $GITHUB_OUTPUT
+          echo "imageFilename=constellation-${timestamp}.tar.gz" >> $GITHUB_OUTPUT
+          echo "imageFamily=constellation-debug-${semver//./-}" >> $GITHUB_OUTPUT
+        else
+          echo "imageName=constellation-${timestamp}" >> $GITHUB_OUTPUT
+          echo "imageFilename=constellation-${timestamp}.tar.gz" >> $GITHUB_OUTPUT
+          echo "imageFamily=constellation-${branchName}" >> $GITHUB_OUTPUT
+        fi
diff --git a/.github/workflows/build-os-image.yml b/.github/workflows/build-os-image.yml
index 404d4ab1b..1f194be28 100644
--- a/.github/workflows/build-os-image.yml
+++ b/.github/workflows/build-os-image.yml
@@ -57,9 +57,49 @@ jobs:
           echo "disk-mapper-sha256=$(sha256sum disk-mapper | head -c 64)" >> $GITHUB_OUTPUT
         working-directory: ${{ github.workspace }}/build
 
+  build-settings:
+    name: "Determine build settings"
+    runs-on: ubuntu-22.04
+    outputs:
+      imageType: ${{ steps.image-type.outputs.imageType }}
+      pkiSet: ${{ steps.pki-set.outputs.pkiSet }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # tag=v2.5.0
+
+      - name: Determine version
+        id: version
+        uses: ./.github/actions/pseudo_version
+
+      - name: Determine type of image build
+        shell: bash
+        id: image-type
+        run: |
+          if [ "${{ startsWith(github.ref, 'refs/heads/release/') && (inputs.debug == 'false') }}" = true ]
+          then
+            echo "imageType=release" >> $GITHUB_OUTPUT
+          elif [ "${{ ((github.ref == 'refs/heads/main') || startsWith(github.ref, 'refs/heads/release/')) && (inputs.debug == 'true') }}" = true ]
+          then
+            echo "imageType=debug" >> $GITHUB_OUTPUT
+          else
+            echo "imageType=branch" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Determine PKI set
+        id: pki-set
+        shell: bash
+        run: |
+          if [ "${{ steps.image-type.outputs.image-type }}" = "release" ]
+          then
+            echo "pkiSet=pki_prod" >> $GITHUB_OUTPUT
+          else
+            echo "pkiSet=pki_testing" >> $GITHUB_OUTPUT
+          fi
+
   make-os-image:
     name: "Build OS using mkosi"
-    needs: build-dependencies
+    needs: [build-settings, build-dependencies]
     runs-on: ubuntu-22.04
     # TODO: flatten outputs once possible
     # https://github.com/community/community/discussions/17245
@@ -121,13 +161,15 @@ jobs:
           version: 058046019e7ed2e8e93af87b8c14a808dcc6bbc3
 
       - name: Prepare PKI for secure boot signing
+        id: prepare-pki
         shell: bash
         run: |
-          ln -s pki_testing pki
-          echo "${DB_KEY}" > pki/db.key
+          echo "${DB_KEY}" > ${PKI_SET}/db.key
+          ln -s ${PKI_SET} pki
         working-directory: ${{ github.workspace }}/image
         env:
-          DB_KEY: ${{ secrets.SECURE_BOOT_TESTING_DB_KEY }}
+          PKI_SET: ${{ needs.build-settings.outputs.pkiSet }}
+          DB_KEY: ${{ (needs.build-settings.outputs.imageType == 'release' && secrets.SECURE_BOOT_RELEASE_DB_KEY) || secrets.SECURE_BOOT_TESTING_DB_KEY }}
 
       - name: Build
         shell: bash
@@ -190,7 +232,7 @@ jobs:
 
   upload-os-image:
     name: "Upload OS image to CSP"
-    needs: make-os-image
+    needs: [build-settings, make-os-image]
     runs-on: ubuntu-22.04
     permissions:
       id-token: write
@@ -213,6 +255,17 @@ jobs:
           name: image-${{ matrix.csp }}
           path: ${{ github.workspace }}/image/mkosi.output.${{ matrix.csp }}/fedora~36
 
+      - name: Configure input variables
+        id: vars
+        uses: ./.github/actions/os_build_variables
+        with:
+          csp: ${{ matrix.csp }}
+          uploadVariant: ${{ matrix.upload-variant }}
+          basePath: ${{ github.workspace }}/image
+          imageVersion: ${{ inputs.imageVersion }}
+          imageType: ${{ needs.build-settings.outputs.imageType }}
+          debug: ${{ inputs.debug }}
+
       - name: Install tools
         shell: bash
         run: |
@@ -243,102 +296,25 @@ jobs:
           gcp_service_account_json: ${{ secrets.GCP_IMAGE_UPLOAD_SERVICE_ACCOUNT }}
 
       - name: Prepare PKI for image upload
-        shell: bash
-        run: ln -s pki_testing pki
-        working-directory: ${{ github.workspace }}/image
-
-      - name: Determine version
-        id: version
-        uses: ./.github/actions/pseudo_version
-
-      # Make sure to set valid names for AWS, Azure and GCP
-      #  Azure
-      #    gallery name may include alphanumeric characters, dots and underscores. Must end and begin with an alphanumeric character
-      #    image definition may include alphanumeric characters, dots, dashes and underscores. Must end and begin with an alphanumeric character
-      #    image version has to be semantic version in the form <uint>.<uint>.<uint> . uint may not be larger than 2,147,483,647
-      #
-      #  GCP
-      #    image family and image name may include lowercase alphanumeric characters and dashes. Must not end or begin with a dash
-      - name: Configure input variables
+        id: prepare-pki
         shell: bash
         run: |
-          timestamp=${{ steps.version.outputs.timestamp }}
-          semver=${{ steps.version.outputs.semanticVersion }}
-          imageVersion=${{ inputs.imageVersion }}
-          pseudover=${{ steps.version.outputs.pseudoVersion }}
-          echo "PKI=${{ github.workspace }}/image/pki" >> $GITHUB_ENV
-          echo "AWS_REGION=eu-central-1" >> $GITHUB_ENV
-          echo "AWS_REPLICATION_REGIONS=us-east-2 ap-south-1" >> $GITHUB_ENV
-          echo "AWS_BUCKET=constellation-images" >> $GITHUB_ENV
-          echo "AWS_EFIVARS_PATH=${{ github.workspace }}/image/mkosi.output.aws/fedora~36/efivars.bin" >> $GITHUB_ENV
-          echo "AWS_IMAGE_PATH=${{ github.workspace }}/image/mkosi.output.aws/fedora~36/image.raw" >> $GITHUB_ENV
-          echo "AWS_AMI_OUTPUT=${{ github.workspace }}/image/mkosi.output.aws/fedora~36/ami.json" >> $GITHUB_ENV
-          echo "AWS_IMAGE_FILENAME=image-$(date +%s).raw" >> $GITHUB_ENV
-          echo "GCP_PROJECT=constellation-images" >> $GITHUB_ENV
-          echo "GCP_BUCKET=constellation-images" >> $GITHUB_ENV
-          echo "GCP_REGION=europe-west3" >> $GITHUB_ENV
-          echo "GCP_RAW_IMAGE_PATH=${{ github.workspace }}/image/mkosi.output.gcp/fedora~36/image.raw" >> $GITHUB_ENV
-          echo "GCP_IMAGE_PATH=${{ github.workspace }}/image/mkosi.output.gcp/fedora~36/image.tar.gz" >> $GITHUB_ENV
-          echo "AZURE_RESOURCE_GROUP_NAME=constellation-images" >> $GITHUB_ENV
-          echo "AZURE_REGION=northeurope" >> $GITHUB_ENV
-          echo "AZURE_REPLICATION_REGIONS=northeurope eastus westeurope westus" >> $GITHUB_ENV
-          echo "AZURE_SKU=constellation" >> $GITHUB_ENV
-          echo "AZURE_PUBLISHER=edgelesssys" >> $GITHUB_ENV
-          echo "AZURE_RAW_IMAGE_PATH=${{ github.workspace }}/image/mkosi.output.azure/fedora~36/image.raw" >> $GITHUB_ENV
-          echo "AZURE_IMAGE_PATH=${{ github.workspace }}/image/mkosi.output.azure/fedora~36/image.vhd" >> $GITHUB_ENV
-          # TODO: set default security type to "ConfidentialVM" once replication is possible
-          AZURE_SECURITY_TYPE=${{ matrix.upload-variant }}
-          if [ -z "${AZURE_SECURITY_TYPE}" ]; then
-            AZURE_SECURITY_TYPE=ConfidentialVMSupported
-          fi
-          echo "AZURE_SECURITY_TYPE=${AZURE_SECURITY_TYPE}" >> $GITHUB_ENV
-          echo "AZURE_DISK_NAME=constellation-${pseudover//./-}-${AZURE_SECURITY_TYPE,,}" >> $GITHUB_ENV
-          if [ "${{ startsWith(github.ref, 'refs/heads/release/') && (inputs.debug == false) }}" = true ]
-          then
-            echo "AWS_IMAGE_NAME=constellation-${imageVersion}" >> $GITHUB_ENV
-            GCP_IMAGE_NAME=constellation-${imageVersion//./-}
-            echo "GCP_IMAGE_FAMILY=constellation" >> $GITHUB_ENV
-            AZURE_IMAGE_DEFINITION=constellation
-            echo "AZURE_IMAGE_VERSION=${imageVersion:1}" >> $GITHUB_ENV
-            AZURE_GALLERY_NAME=Constellation
-          elif [ "${{ ((github.ref == 'refs/heads/main') || startsWith(github.ref, 'refs/heads/release/')) && (inputs.debug == true) }}" = true ]
-          then
-            echo "AWS_IMAGE_NAME=constellation-debug-${semver}-${{ steps.version.outputs.timestamp }}" >> $GITHUB_ENV
-            GCP_IMAGE_NAME=constellation-${{ steps.version.outputs.timestamp }}
-            echo "GCP_IMAGE_FAMILY=constellation-debug-${semver//./-}" >> $GITHUB_ENV
-            AZURE_IMAGE_DEFINITION=${semver}
-            echo "AZURE_IMAGE_VERSION=${timestamp:0:4}.${timestamp:4:4}.${timestamp:8}" >> $GITHUB_ENV
-            AZURE_GALLERY_NAME=Constellation_Debug
-          else
-            echo "AWS_IMAGE_NAME=constellation-${{ steps.version.outputs.branchName }}-${{ steps.version.outputs.timestamp }}" >> $GITHUB_ENV
-            GCP_IMAGE_NAME=constellation-${{ steps.version.outputs.timestamp }}
-            echo "GCP_IMAGE_FAMILY=constellation-${{ steps.version.outputs.branchName }}" >> $GITHUB_ENV
-            AZURE_IMAGE_DEFINITION=${{ steps.version.outputs.branchName }}
-            echo "AZURE_IMAGE_VERSION=${timestamp:0:4}.${timestamp:4:4}.${timestamp:8}" >> $GITHUB_ENV
-            AZURE_GALLERY_NAME=Constellation_Testing
-          fi
-          # TODO: enable VMGS upload for ConfidentialVM images once replication is possible
-          if [ "${AZURE_SECURITY_TYPE}" == "ConfidentialVMSupported" ]; then
-            echo "AZURE_GALLERY_NAME=${AZURE_GALLERY_NAME}_CVM" >> $GITHUB_ENV
-            echo "AZURE_VMGS_PATH=" >> $GITHUB_ENV
-          else
-            echo "AZURE_GALLERY_NAME=${AZURE_GALLERY_NAME}" >> $GITHUB_ENV
-            echo "AZURE_VMGS_PATH=${{ github.workspace }}/image/pki/${AZURE_SECURITY_TYPE}.vmgs" >> $GITHUB_ENV
-          fi
-          echo "AZURE_IMAGE_DEFINITION=${AZURE_IMAGE_DEFINITION}" >> $GITHUB_ENV
-          echo "AZURE_IMAGE_OFFER=${AZURE_IMAGE_DEFINITION}" >> $GITHUB_ENV
-          echo "GCP_IMAGE_NAME=${GCP_IMAGE_NAME}" >> $GITHUB_ENV
-          echo "GCP_IMAGE_FILENAME=${GCP_IMAGE_NAME}.tar.gz" >> $GITHUB_ENV
+          ln -s ${{ needs.build-settings.outputs.pkiSet }} pki
+        working-directory: ${{ github.workspace }}/image
 
       - name: Download VMGS blob
         run: |
           aws s3 cp \
-            --region ${AWS_REGION} \
-            s3://constellation-secure-boot/pki_testing/${AZURE_SECURITY_TYPE}.vmgs \
-            pki_testing/${AZURE_SECURITY_TYPE}.vmgs \
+            --region ${AZURE_VMGS_REGION} \
+            s3://constellation-secure-boot/${PKI_SET}/${AZURE_SECURITY_TYPE}.vmgs \
+            ${PKI_SET}/${AZURE_SECURITY_TYPE}.vmgs \
             --no-progress
         working-directory: ${{ github.workspace }}/image
         if: ${{ matrix.csp == 'azure' && !endsWith(env.AZURE_SECURITY_TYPE, 'Supported') }}
+        env:
+          PKI_SET: ${{ needs.build-settings.outputs.pkiSet }}
+          AZURE_VMGS_REGION: ${{ steps.vars.outputs.azureVmgsRegion }}
+          AZURE_SECURITY_TYPE: ${{ steps.vars.outputs.azureSecurityType }}
 
       - name: Upload AWS image
         shell: bash
@@ -350,6 +326,16 @@ jobs:
           echo "::endgroup::"
         working-directory: ${{ github.workspace }}/image
         if: ${{ matrix.csp == 'aws' }}
+        env:
+          PKI: ${{ github.workspace }}/image/pki
+          AWS_AMI_OUTPUT: ${{ steps.vars.outputs.awsAmiOutput }}
+          AWS_BUCKET: ${{ steps.vars.outputs.awsBucket }}
+          AWS_EFIVARS_PATH: ${{ steps.vars.outputs.awsEfivarsPath }}
+          AWS_IMAGE_FILENAME: ${{ steps.vars.outputs.awsImageFilename }}
+          AWS_IMAGE_NAME: ${{ steps.vars.outputs.awsImageName }}
+          AWS_IMAGE_PATH: ${{ steps.vars.outputs.awsImagePath }}
+          AWS_REGION: ${{ steps.vars.outputs.awsRegion }}
+          AWS_REPLICATION_REGIONS: ${{ steps.vars.outputs.awsReplicationRegions }}
 
       - name: Upload GCP image
         shell: bash
@@ -361,6 +347,16 @@ jobs:
           echo "::endgroup::"
         working-directory: ${{ github.workspace }}/image
         if: ${{ matrix.csp == 'gcp' }}
+        env:
+          PKI: ${{ github.workspace }}/image/pki
+          GCP_BUCKET: ${{ steps.vars.outputs.gcpBucket }}
+          GCP_IMAGE_FAMILY: ${{ steps.vars.outputs.gcpImageFamily }}
+          GCP_IMAGE_FILENAME: ${{ steps.vars.outputs.gcpImageFilename }}
+          GCP_IMAGE_NAME: ${{ steps.vars.outputs.gcpImageName }}
+          GCP_IMAGE_PATH: ${{ steps.vars.outputs.gcpImagePath }}
+          GCP_PROJECT: ${{ steps.vars.outputs.gcpProject }}
+          GCP_RAW_IMAGE_PATH: ${{ steps.vars.outputs.gcpRawImagePath }}
+          GCP_REGION: ${{ steps.vars.outputs.gcpRegion }}
 
       - name: Upload Azure image
         shell: bash
@@ -372,6 +368,23 @@ jobs:
           echo "::endgroup::"
         working-directory: ${{ github.workspace }}/image
         if: ${{ matrix.csp == 'azure' }}
+        env:
+          PKI: ${{ github.workspace }}/image/pki
+          AZURE_DISK_NAME: ${{ steps.vars.outputs.azureDiskName }}
+          AZURE_GALLERY_NAME: ${{ steps.vars.outputs.azureGalleryName }}
+          AZURE_IMAGE_DEFINITION: ${{ steps.vars.outputs.azureImageDefinition }}
+          AZURE_IMAGE_OFFER: ${{ steps.vars.outputs.azureImageOffer }}
+          AZURE_IMAGE_PATH: ${{ steps.vars.outputs.azureImagePath }}
+          AZURE_IMAGE_VERSION: ${{ steps.vars.outputs.azureImageVersion }}
+          AZURE_PUBLISHER: ${{ steps.vars.outputs.azurePublisher }}
+          AZURE_RAW_IMAGE_PATH: ${{ steps.vars.outputs.azureRawImagePath }}
+          AZURE_REGION: ${{ steps.vars.outputs.azureRegion }}
+          AZURE_REPLICATION_REGIONS: ${{ steps.vars.outputs.azureReplicationRegions }}
+          AZURE_VMGS_REGION: ${{ steps.vars.outputs.azureVmgsRegion }}
+          AZURE_RESOURCE_GROUP_NAME: ${{ steps.vars.outputs.azureResourceGroupName }}
+          AZURE_SECURITY_TYPE: ${{ steps.vars.outputs.azureSecurityType }}
+          AZURE_SKU: ${{ steps.vars.outputs.azureSku }}
+          AZURE_VMGS_PATH: ${{ steps.vars.outputs.azureVmgsPath }}
 
   calculate-pcrs:
     name: "Calculate PCRs"
diff --git a/cli/internal/libvirt/Dockerfile b/cli/internal/libvirt/Dockerfile
index 2a0983f08..826cda25e 100644
--- a/cli/internal/libvirt/Dockerfile
+++ b/cli/internal/libvirt/Dockerfile
@@ -1,12 +1,12 @@
 FROM fedora:36@sha256:455fec9590de794fbc21f61dbc7e90bf9918b58492d2a03fa269c09db47b43f6 AS deploy
 RUN dnf -y update && \
     dnf -y install dnf-plugins-core \
-        libvirt-daemon-config-network \
-        libvirt-daemon-kvm \
-        qemu-kvm \
-        swtpm \
-        swtpm-tools \
-        libvirt-client && \
+    libvirt-daemon-config-network \
+    libvirt-daemon-kvm \
+    qemu-kvm \
+    swtpm \
+    swtpm-tools \
+    libvirt-client && \
     dnf clean all
 
 # Prevent cgroup issues on Fedora and configure libvirt
@@ -19,8 +19,7 @@ RUN echo "cgroup_controllers = []" >> /etc/libvirt/qemu.conf && \
 
 # Copy nvram templates
 COPY ./cli/internal/libvirt/nvram/constellation_vars.testing.fd /usr/share/OVMF/constellation_vars.testing.fd
-# TODO: Uncomment this line when we have a production template
-# COPY ./cli/internal/libvirt/nvram/constellation_vars.production.fd /usr/share/OVMF/constellation_vars.production.fd
+COPY ./cli/internal/libvirt/nvram/constellation_vars.production.fd /usr/share/OVMF/constellation_vars.production.fd
 
 COPY --chmod=755 ./cli/internal/libvirt/start.sh /start.sh
 
diff --git a/cli/internal/libvirt/nvram/constellation_vars.production.fd b/cli/internal/libvirt/nvram/constellation_vars.production.fd
new file mode 100644
index 0000000000000000000000000000000000000000..7913e23880761b2f4a16992f8b797e92d3656cae
GIT binary patch
literal 131072
zcmeI52_RJ4|G@8<v1W~wqJ~1Dx-+&m*+N2O*J_O^jBF8)NR*|tDO42oL?mrUrPBV=
zqO`vhqEac+&i~wDB$4S?z25Kt`yOw)bMHO(-0%6E@BMzy`Q9_<Vc3@`LHT7{Qed3v
zuH}kGytB+LFpP_pVV<Gw)V5X%HWib4hYoO2iKC*#KkX?<r71gPeTx3JrDG(fpIp4Q
z@IHpkY;8Z6ZKI7TvNNLXBVPUi!U`iWJbs!w`!Emsa+!=_PWNl#&ab;FmMw%;Z6Yhj
zTVN*W%r=M89X0F!oECE+XTWUbMqeT)k@ll)MpkjU3?*x7Nz6&F{zK+!;gRHYJd$fg
zI+=^a#l?@czFtw^lvMf>7vkYpik=$%Mu<e}$Bp4LXv+8~9<mLEEG}p1=1QIF<WIG7
za|!Tuqv|o4{?w5cCSy$uOsEUpf~mAoG&!8wc|AW#QryqY#mUpn*I&oi&DF!ne~b&$
z3m-aAh^9uvRcR=xt7^_1D5R=M!|CcByT9U=ktDgU6(ezD<VcbThDVYFxFSg;EOA&=
zNJ7cejS7)oD{^Ab#e4X?yKll<pt-Cc*I9QDd~0=MWAd~@2fNd{E#u-^=bIWo*3?`(
zW)o@XED4K8Sqbt&ucII3;1_fxpCrUdM*HY%zA7(WbAOS<s$}7n2Ti?342`cDYc7Ae
znCI>3dZ|HyelihWSvR>aO*k7e@~lRNq|m7N<P?v)Ii+R^$7UW@-ZkEYvQhe-#^F;F
zqA7WMu0@7a<@{~T?eVcC&ttG>qM4o4B-i=mmNS;AZ`NO0w_uycx$H~H3rn)+^3{!(
ze)CqOm?!Mzh5EpIt#Y?>C(NCt_GI6=Dl^KcutLWo?iUAc4YaqFbS%Q@jT+NVz6wt0
zujA9iMJ8dSj1W8+=SOWVBTnJMF<ga*-!XbBDf+D*Nr*B`QpViJ&D+Y#lxpPW?dI#`
zkCZ_lwJc*k!v*c&GQ@?#6iJH2q{oicZBp9=LNfH46ZFRHzrNYG0Ut)39!?pAOD^p>
z!<Tx8numnVHe0)5f8;!w+&Hm@`#d|B>`+eAv=L13=Eial3F@w7T&i^ANu3dNHTTT1
z&3C!|!s~{P7vKNnApVC=K+b0Ue)scF3^|5ZHMf@DahBcGa%#`t6U~hU9u0jLov$ra
zdCgGsj<x^XHn9_qr+w^CNi!P?ZhA9MmZ-*z%WRtBx>;@F$n^?AifNJq>nAb<<ahaL
zgl*NF-B7Q6XU)6*`?SjI?hQDZ7tc*~O5N~x>Yn#|XG_;^tUIYDw)}OhqC%#RMuT9>
zGOffn8cpw-23$*YK5DgpPlfTG7tMb4A%Qhhlr)PYGLr=-&_*muuc<jS_<~VQw%nx`
z0ZvP+^$$(8^ApnwN@ZYJZ#E%6ZGNXs;6qP%J^$A>!2~k^tH3g3y%{2~3Sbrf`>aBD
zFF%Or6rl8x8^eyIykG1<rkfpc9NApAI>-c%<gQ1a{&KsQ7jP1|vVxVD+|?TrZa!iS
ztsl$wQ+UL=Y^-SFxESH|`NRe6ocuf(-tPWPZ<;7BOdRAD=S4jMFQ&IEZ742H91##7
zV8(FqW%@Da`&0FqzCKLk9~kJ0iTHTpJXxIH<9VvJ2gBEuYT@MTA51lK@?GfW@8jv@
z;zqSZT?<w}fre|))#$hyjXoar6X+W4yXwR)9<lV7$gG5qY?oQKXPJrKj=nCHj?-wU
z|M2a8MOpoU*kieN3i%2rpVWP@TQY@f4zJMdX|?`JkMcztyq-3M7gf)6p@)hMG#9S!
z_vg3)>sFn9T@|%AB~_*F^`SMD{0|<MQnGgA()Xt}@mQp|{y8K3>~izf)adfou@BPP
zB1@k=zF6LDwZM5oKmDSI@}F9{-(4${$Ps%ud}V^qp-dUGhP>L%?<G&%IDX+;ec9OB
z<mV&e$PEdv;+~wG_Ca5)f4{H;Mr%FqKBBCA`dXFpRFtH&sP^45@kwp+{9`==4cm&%
zkKWB)q-3A{LHKI0R!yqg#J@%<rG4~u*#0zc?TZ$5@ujD^8fxbKwI%T43zxOW_XO)i
z1;>O}TV~a73E^d|9?;&eh$NXKQYN@455F=Gi9(9h96+L=ekazY)8PD3|6=;&%nR=Q
zug<z<vpeLkgR%2)sm==|xF~`{1u!ct0CUFlF<rbLY9kpD3Q<fnE<)^xlSpk8Zk&uZ
zU-UK%=3DAN2(uSERylp^a2vjf6XX_T;j@V=hEZ&AD||+}dAeD&iHE<x&xEmKU3@*q
zc(HYv=&p|SS;!!cj`i_nx(2xT`;A3vfpi?HF49}1v`AOyA!WcvqyKRAF(@nU$is&!
z%FWG7B2lbyOWcCJk8?#&>A2D2#fy8o5$aL(eFy(;k1shA!Mql=;<d#3L0spRCVfy^
zD=l~<{mRRF%lTQ)w;u>tl89xG&J3LSB=}H~=7Jd^qOL6uTwigyAAOTGB<M(S`3iei
z!AiTcQW^8OEAO1X%qX8~LO=9$&Q<(%>FdJcAl?k+*3>&{wowg{=ks*seKs$A+?ptI
zBWYM|-TGk#N`eU{Z6imChP=5Ey5mY<5%<~PXCjGfH=k&|&kXYv3AuLM;GWuyr12uP
zb8T-9;!bMj-Kn=PeeowgsaK0^|4NG<o*8pt=O_EHYYg`RYr-O4g^Sk;#l=pFiF#UH
zenh`EcXZUcRST47hE92JnH_O<wDjRB%lnwv+Z3(ij`<H%4`i&k;wB|9xNdi7=JCjw
z>Erf}6*?sm!~B#mreyrVx<@CgYAz~9y;!gJVpLqBq3*<pA?`Qd={vYx5GwhEtu=2B
znE2<e5g#pdb%Lu#n+q&Z4D_~qmc$6zBl0GO`?A4_Tq}u)VIOcxwx)*D?P-i5YBxQe
zRdQYOTrXI0$x|*kcW+|}dAp(Gt}@;evXL)8y{ZqUJ082adxxBa$@$|qO`iUtZKq!F
z$UI<wz9U)ADsN4&Ol7L>umRE5J_UaZsf&c>tN9jhbez~2{B(PP^qlRIg)yfd4{15D
zQJy(2t$NM-*x*ek8N!D$q^aB+-=3Gq!)}x{l}d;PEL2M$av<5UX?Ff8yXhKN=~2hF
z_SRRNN^$(6uV{)qz=Z;-8xypW3^Gb?Ulw+EW4fZJDhM4{kSsfHYOz*l_b%Oc8te2&
z5_yS)qfhq{WOaU--lmVz5-A^=&n7dAMkwa#*0`pwGtJzPJS51n(55$e2DJrt%0sv=
zBf*~K`FcFd+u`Y+_U!3yAWwIU?df;}Z3)3KzHW~S9<kz=cnvy^w|k9IpS=d*#k!7>
zsJa3E9!y^ba(0BlXm@ZloHm{|PK~BUXF0g`U3Fp?kBIsuqK-i$JC;+H|17E<!`qd)
z*pF(_Zsd^frdn|7<n9R`-d;0?zq;<!n<PdFCVPaTs`?_Aa>07(bDm{~Pf??8y}26K
zG%i0UGk0{Tb1-*X^)zjYI@PDTtZre|=2DG-$Fa0~2|l%VH4pe3CXJjG<2YR9*j=L?
z?r&x&ZuNc2yYpPp(1}*+p|uqaibXNftwraC^E0yy*BtjwnxtECAwzo(*8;N!#xVJj
zvo+d2=?@TCUnRBw()|<tAD)<{_*^jvkDH~$zff+am7}CesfUbJaf5Nw7N_{-9{he&
z=KQhUTKQh^n*o>9=Xgph&n_?7JUou+eL&%shWJVIO2xb)`b6EeDi6+FTwI@RJ^jt>
zev}xu{rZEl3aY%M7B|cs@qQ|q?d0^4lhgjDliM|lYy2w7vW-C(6W?t$Pk9h(v&ZV^
zIJxUBwii~{Z=db#aYbu=;;b9xDTB&z+jb{sj+@~o>Bi|s(FWh;<dFKJ0Y1{%cK3#B
zjHauy+}ljHJ45bmI&O+jWA7vPHkmW`)=SwvIyQ-qp^Ikh2tMIm@M8Srl1Y{#-pbmd
z;(o1J9+#)?R5OcB;#PQ0GfZ>}u524O#$aJ{Y3<0u+cK+T@9^Ike8yBjWB!8ph9Ng7
ziCKdNW~LTB)S+txmK~pY`dAI6^oeA}?voxboOj=|_O!t5cRmemUH|9wRm}~d(SCL(
zEM@)FW;SKS+McD{=H-9(Hm<t7Ic!y4V@tnSz7N{xWPHP|3ZEWzsjAkZx#dUHzS@0J
zGBZspYj5fay~~MF^Q>jsRz4|~F-m0S`%TwP(@C3GyG^M;Y>i*6?8wIQzx~F~o18P-
zvEe>hG^>LDadS)3@`K?sR?Ih&O4y#?Un@e%gM0DeHKxuX2aoffDP9tzMiw@4UXuLy
z{KxWXn&(Dm+J#EDYTYdqnfbo5Y#-Nht_e@}-SVzs$ZGx_ait|dirc+no!#6~L&l$d
zKKjAM8Uw#sm#>yD$&r+bG_=1wcT2=R_dTBKuS#mQM?6&DE)c-eGRQXhT9C>W?jcVv
zuOMy77JbQmzc@_A<q%KmaM`kVL7oro2l8krujx<zEA!T?(Z%o9Z_#-+$lzsp?Cgb;
zbI27wgOmgoRLwKGa@|FM{%X$+jbTbYGi&u6_!gPi6^AX0Xq27QEPeb`QQ|t`6$a~~
zAMd3mAKi4})P~GC&XwsdeAFWWqKp5~YBDHF+n9F2ZYfiB7v<98OlN6_u<ipMoenoJ
z0&Tw@@bHKtH}ID22KXw<SZ;vwl^ggM4|p``G&)^Poju?|yQ;)49ue_N{K4k{?`MC|
zWe`WTF)%ddc*L`V&(rjb0sjIM!OYT_aGn4`eUi0nm1H>Yv$cQpEATreC~$h3fm8Y^
z$<av_ua(n3m>H+)E=`<NWc}$;$(1c-nS)}(bz^5cEc2irjyF2@d{K$4c}i?(+Z64D
z)${^|sd)hho}V)vI!!99CNf1PXt9}K{*e}u3dxF+_sTnFjGOcNL-Cy;t~+fF0z;Cn
zFDsN1e|)esL?`6Iu#t-A-oLP&EBz>JeOPJZl!D;#wYLkL<IIkY^LgkoLgJiiCZFbY
zd&b;~&}YXfR(y5S^Oa&;_?(z7100?dC<osVbaIcK^=WQyOn7m$yZIvf{&EyKx$?Ld
z){C%m3w8Uz4SdfR?A=bf&UOZY$Qk(J{W}LRXvD+KI)@Mce2j|-m%cr|@KE?-t7%R0
znljV3DTIhneU^3^7>VZ|)8{`D>9aZhx;f4Jy4<GNA=iG6&-h;%7^(B=wc&r2zX=q~
z74@)JA7w}nR1AI5Usq9Y$h2&)h;dUL#BG`$+pF!A>=&6mCpYr;(q+0ltM|*iA{R9c
zo-^d7MdG`CHc@&brKv{>@@7b!D&4(tgRFGo9g&ZVw{GxTv*P@bBbG(n7DD&!wx&Bh
z6RP!+zojEGQ0HuU#<UY=ds6z#@L8`ua;Bt6S<6^?82#e{S%!J)*)Tn|j~YA!<5p93
zO82G62Pj@VN6u)ObEQthdP$MRfr|cDc#j?Szkhe=>ZRA84Qd`MA-Qnu-}B@1hu5Bo
zy7}zMan;CNTa!VfUwUldy?Ck7w=wVVz3AneRAfz6l^aE-HG0GxSZhNM*tQ^Y!K4g%
zvCL<=Hz;`*Zt6IsM_t)q>byp7u)j>amXYw3oi+KXYU+F6AGFF+iD<~=UUYU#VR8MC
zDf4TLtc6$EhVM(0+*A;K*<*6z@B?G#uC`d7a5^D!p6<5hF+x?zS3Lu24l)kNM!)C1
z((=&k%I#d0#a2V*>6&LeEqymc=f6~US|IhhU}A)Y?N0jW*6l0b=|w9Jve_1SerD=h
ze3P}rPNO9Gv1b)(bk`4_&81zNRK0xGq{-TcjU;_-9?Hw@y%kbN=26OcGc?igBqmfT
zwX#}RUD27mXu!@Fmle~~9W))^j$2<?73A}_*fct3eM?mym%($l69+TG7?J_JYg1qE
zEOA(7j~oCo7U_5y#&QQe{Ue7ClF;W&zl=t{J+=nPWtb@cxd~IOFgMHv#T|UnRu5yM
zKYtWi_r{#in8_0zBd+44e94aT1seiONBSh|r~58?K6^@Bnm#Jq50%Npyf8ELuPdv}
zuVeq{@~@IGIzmAo@7klc?grd4-hbnOnyiS+5*Jj4FDjE5*R|(pYa?VF{#6NI9vF;v
z2?kX)eu)i^-X_UpQ@KeBB9m-UdETfrCMwkgeGf(wPsaj@+^F1181I+Ge6>fsqafrI
z)A4!AB~c-^YB836j^R7e46{bjoc4PX<@D7?BRld+RvMX9W?33+netce7!lKV#z;B_
zsxJeziYKOvzWF05y)YlNHAgZNOnr%K+uAwwbsq_oR|*MiU`%(I(ja8I_u`hl<L~nd
zepxaVqoI6XB?2HT>H7P-dHMKLd(6eo^qaONXw(hqn*{3n(vojp{r~%9r;h*suI3Nb
zj%8~&vuVWak^k7Has6DIM(?T8?bBP(8MaO9F;`Dl{)5NBru7LMY+CP#z^3)ihJEHc
zY#QM`|8tv0X7yM5^1z(-(^T2=cinat&bDbi=IVOIZ}<*2txxD+(|Sh)Hm!Fy>@(kC
z(}*$b57;ycCvgH!ZJHWe{;pd>KvrVgv>tP@GySG5*t9;ugH7ul5!kfe*|5)ihfPD1
zDSpVNakK8#cYKvoyVf~5gk2Y6O9;tIY`fNDE_SBhv<17?CwQ=Hy(0p<);k;aneVV`
z#4Ldy>8o+`{M@*j2D=Vjw;fX%KF8I1%+>XZ-|!vmTA$FtuJw)x>{{<^*k``Ot`YBA
zf6T7&{?yo-Cc6$@x1BG9+5NR1b9KGqH+%=X)+cnZYrP`^yVg4!_8AVxhQz!MVvfiU
z+BLqP8DAU6u0z)?AtWoY?OKny*qMIQ7VKJ|;K8o-jtJ~p?`+s-IJ9djC_jNS=Gu6d
zVg(bulsO(@@;7u!h*@t&7#*93O+j-BZ82lCZ_u%4jlSuld2z;Q=Gt_0Et=lJQGZRL
z&wJ^!N;E_z8(}t>C7LJK^)8&uza!=c63dzNULRW|y(RjcCR=)x`HRF^UB3T5v@z{(
zZ`m(Ei2L+CFOi5z5>s2cucyME=h=1cAcnQe-r2SNqF$eO`lGLtzfmSyS%dY5Vf;un
zR8UJWP)qorKQu>@R{}eCq%id9TQ&3SCzEUTxJhoK@JL{?*(!z-fn<Ya-mwRp=MSfa
zw^7iX)4uCRv{g^_vqtyyLUSUSXzr;$%EM{hh;|`fn|J4Bfo5Ggp_1maW{7%WrfAO_
zb4NMdyb(5*{`SR90OclHuY1{D%W~(i4cPNo>%;d^@>=>$J#t<1R{Y$R*|tb7U!<YF
z=#QAoYRHnCkdrfgA?Di-?LkI;RGK$>y4q=Skp!{Jx@4k47>R^JJR~kM>Nt={OF3;f
zVsfTjulFHlyP|gOewSe#M_BV3h&yp!CxSqC?i|;NMCnx)w9pPpWMOe)gJCDyT?-$H
zL>7?1tc;FV9esCIEJYAYRMb9h)-Ezf&n>}cA^P+zGe>-Ws??l3i-hhN_aJk-HukDJ
z9j*HPBsrBSzXzHA`L_RNa}a9tT}s4B-3cAq-)r6fSsnVBwdbVngf6b_q3*vz7ys$H
z5$)R4L*3eS`oFYY5kwM20!y7aGkQ*;sZo@T+m)kHCJ#Fw3RK^Y)T?FXR4-njf_k>A
zz1pbH{_UHMO-R@&aUZ_mn+1K3J@^UaIQOGhdSLgjex`l`9ZvL$cqX|}tM#l`|C`Sw
zLQfXyNA!-{(3&;h*IyIqmF559GuolV+lKqw<hXe191UA@v4pS8j@9WVw|BZ(W00RW
zULtci4k5;0gs<(c_wB!-`#cgvS#)OH*qDZ4#FN6=c!`s;JAQfAQTD)&vis&h$b1@o
zy374r`h`E@_&87vPV5)KBj(@4<0t4kQK$dLabHod?eLHLkss8|ugpKkW8WqJ9tK}k
zg45?|MGtlOMSZ0oX{Yasqx{>(_e6ZNr<hvL@y+(%vGby9zLkjhrZ@U@_YLea+r1j$
zd5CU06~#9VP@K&eeVc*4nW23uS|3{%MTw`NKVuXtHesDJ>xhfu=vUQLbY=JW7S}Lx
ze<GyT)`nq3Z)y5&z6h~22eakE4+mSSI23TAcLWb&%2jW&e;My3q1Y+mi?#aveLKN~
zSZAQOa@(2EQ4SLNsB{t`EEe%gbzih4ez{IXG(6D0C;IC>8oX==C3NyuY4cpSDoc;c
z`>$}`cl>^R=)14*J!KNL=j0u&3d)D0PZ~waR8zOYY_n+G#w_hm@68Y!FIMC>7`?j)
zMlo|Yq(R=Dac3e1&0xi1F^tfarRal}M($jKo!DoEB#|J59uUnTLTpjuL@uJPL|a?r
z%yBfV!t`?vYTXpQ7dPArt+PPf+Z4$Y$Z9_f^K*9cSD~rUaXMP-9Q`v+puJz$`Li?P
zradI0Unhbd+V1xt)`nP!?!aKJ7V-7!c*HeCYC<>Yel1!O={{QR{Y?9^ND_>ao$(q*
zWdY=crTP`B$xRQ0#RI-tAgSv*c~cB%()eIv)i^#u@##!oS6>e|hBwvD&Ch>6THoE9
zCW0<UXL$vA^q4Ll0bZRe!wL>CaCLX{bo2A0S_S)|^$`51MqbWSY3x;21!eV_-srfe
zCu_ynuNR=B(}{KR=ybH&swxdvLy1@y39XRSx%=gke!o}Lz7~XC6<q0JFRRM9%5~~h
zt^bKj19yb|kyEkZyxfW+_qO1QR;Ey>&;AgR58-hYZ$u{wkB~?R)!n#bWX+QKjB0UL
zr3>n55)5y7z1^>v_w5Jx{V^(kbExTVOligQpqK7x^X90YX&X>~ajd&dzy*ndhI7$g
z8~?iNxono;<z4!Z%?(#(rNq<e53;kzZM!G9U2xdsi|a~B`GuMKydI(sbvInMttb@R
zVE1VK{=?I=`LwAPJ9nf_V94e4`!Hz3y20BA?yC?!(XzW)RV*dNDU(SHW(wY^Oi5m%
zy7{h0;Vs&21$|QE)zeqcRX%jWVoYDn;%&&9WLVR0)y1<P#x>6RGwWrDg6g*R<&m^;
ztu8AZwOvY8@VayG)8J2MpS`ia6J)6pck$~bUB6iHwTH#xRj(gfsz0syw7|zX+y?P)
zqO30ucHZ(xaQULW8Jp#eXKLy-YRrhSS$cB!sr}x5F}PsqCVOp{d5eas_>W9T8hT7P
zu2kCo(i!ntuO~krN)fmhXI<bHmo(pscU`>BlG6T@&zmG#D$<V)k8xq}dxcgyD}=`3
zzOI$|+OxO|J(TZk;!(hrH%hqQS;oAVVv#Uc>B)O>+s6(%TFx5YH!B5l<ObFr4G%c8
zF*Jzcz4AfK!)VIU7TM`(^iy`5UJXmEwJV8yRQ+%t9&e;SqvEf`t#L9h_O6m`E-S27
zvT;tInEW>65r2k7oo-IXp<#L9nQ~*Psup!Rv)3%!s$^>wPK(|hcbKDhY{c{x!c6qG
z4h!+FkP|;j*eK55EB5U}h_OgM`gHf7zh%7Hz2kv(zJej#7pDPCj{A+oi2r1-b^pi5
zG+q1iX!QK^U~r;WgdVKzfyFNx7yPu!aZ)#;o&QBK&|lKd9pRQAc}>C57?{u#cu(=4
zy*nq^!Fvh>p@&4Uf!KOiz2YE%%HjMTPWudG)|i{KJ_E$4KPxezyZ>D=YVAJbDny+i
zM$MW-*4YUqTAb5PD0+Ik`S~9Xg>p2`Ao@BGqyDaT`r(El;#YmeZi(mV-x#CjG$u<7
z!2Y{pvVFJ7_r_0&2?LOT01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8(di-7Vd`>h_Ke;B8iyJ4TwhHOyTqvG0%gsBoi|3i9|ewSQuUmySkfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
U0zd!=00AHX1b_e#__+lB5BxLC?*IS*

literal 0
HcmV?d00001

diff --git a/image/README.md b/image/README.md
index 27c2df286..c5f998f6e 100644
--- a/image/README.md
+++ b/image/README.md
@@ -106,6 +106,7 @@ export AZURE_SECURITY_TYPE=ConfidentialVM # or TrustedLaunch
 export AZURE_RESOURCE_GROUP_NAME= # e.g. "constellation-images"
 
 export AZURE_REGION=northeurope
+export AZURE_REPLICATION_REGIONS=
 export AZURE_DISK_NAME=constellation-$(date +%s)
 export AZURE_SNAPSHOT_NAME=${AZURE_DISK_NAME}
 export AZURE_RAW_IMAGE_PATH=${PWD}/mkosi.output.azure/fedora~36/image.raw
diff --git a/image/pki_prod/KEK.auth b/image/pki_prod/KEK.auth
new file mode 100644
index 0000000000000000000000000000000000000000..bb18b516cfdefce0e7853b20af1419813ccc22ab
GIT binary patch
literal 4103
zcmd6p2UHX37RNIwM4FUP1tDNTV3A1-T~r92MUWO1eAEchKxjcCA`n@s^eiYK9Vv<w
zMFc^r$kGHB5D^PYl_01Ht|;&Z-Sz0Md-lC^-aBXK%sDgn`@Wg)&Yl1NckUFL8^QhE
zZrJa~GZb_Of3^8if0@Zs_j%*!VnUFbEx8b6qFUhqfa3#sIXE4|jQ}zN2?tOxkeh>3
zA>1hZEiZruvYCiMkcsF6neduy1RQ|Fg?0#tzbD^H8I)aVn&2ZYOQ_Q?&uqNnw`Txu
z=oO)%IBt-W17U;Yz`*tNagyMcjbIZG<{-_-)yJJo@x+qIzJAA@sASKN89=jW9u8fa
zi#y!|Ck0AwEa&18)^~LyQ^~%*SSyCFAKAkfYv|!@gxdznY|JBgwh(Ea&^VRq<VT@-
zVr}#djIl%=EFQ$;K`BvQJRXMw_uxPRfw1T3#}NNH{72--1Z2M~9aMb;6X1h^On?i{
z1OQmu@Ki(5NF=j+@%-%rcB3nWqBnJH;?pr)OI=!`Q+;^dytt_6;otSCcHBwxC-ixe
z3<=}(1nPV)c3JKG#RHY{=MeLXj^=wBF3MYwo}DM8P%#eMW#ZFA&M3Bda);U@&Y>6M
z1SAM=WW_3GL2=ZJ%5&L!vHA_}-cFu1HtZV-2FniJ4jePt@|i=9rIY(qHEcZy--j5H
zLa0Q?OAn5gRA*s*EkrA8=L~eZ_zSG1L_sTo`7zefrU&qI_Q>#|nf;D#Wugl)hQ1}q
zo1~Uli#!u2#^PWmawZ3M4d-3g{{CL~@~O#eMZu~XvAxQ6#m}l&qLo_0vX?u@!4JMT
zI0AqHdHX?aa4Yn~w{Av?Acf8wv-K|VGma+<IuB~(ho34b%1H(JHl{HEu#QB52<QTd
z7#iS1A|cI&e_3KkoluDZm~U$F*8Uls<vr_wrv=fq%_rOJ{X|$w&8%#>&R<Wf@86<?
zt@v=R*orI9RQ9KRNltSlUBe`OhGE<VYW?XSlU0fXJe*(}KWTOZKH?RuuD@)-heN8~
z#fo3F>@M}XXH+qLx~lYH-$VdFU-G!Y>a{hsG}GTUxT~NLONwvy5T78=$Sk&XEWpTm
zJ+RFA-T}iXEmja%cQNDbcyEr0x01om-DMtPTfeuc=}johlAM0RHE^fxOfANQRjxUO
zvulWS+|;SjPPYm6ej}c7QHOh(eRk6G5&IBYP#$klM9WhVNo*iBJC*BA<Q!WW1+ez^
zsaU7_pB-e_*haG(GD0{e&<4q@86p4}n)XjH!(Wr-OE`T28pth3CICZ%rMiopDMIBD
za*WaYf^lamuI4M<DYl6tIg1bXRDF<foxG4ayZmzwgO^D!GFrD!4R=V3Y9ht4>8J+T
zf?Y=((gj%0q|CZm*{qK1K7DV*QU_$k8Zm~UW_HS@c~g&l1g$u4IP=i;(J8a$0b<GS
zFLkdP*uImP?Uc)!Vz=zVlySCd-j>>%lh`%RYX%od8A}e|b=NtlVJg8jEq*MI$aOfw
ziq@H@;^I)&V`eGxVXuMBtvfjfWAxY41|(~0qI#^Q)<$sK&<>;?a7u3EdX`iEmc}j0
z^ts!julIRg=JD5wN^h^oN%E#CvN>xl?+*vL?mIf3Sg^TxpEfEk=SXA01gp>_qUwsU
zz2Zxsb;Kv~k3-k<gJ!Q5I$BI4y+x~=?Rr=c%I`xcul^0?+LCKDj)CdpTddJ~8gG6o
zC)CyC{lP3?XvqH+<+3356UxQEM!BiJ>0gkX@HNQ^NB;>a{vF68<`W4A_r1i`;3L=9
zO-}Qa&j-#JPLfnZYG*wB%?Gt5hJ<bo2LWeY9(K{}sFYPoLZ?{Wf<YD!VgI}<(pVv5
zSgq0co~AQx=Sr&htVUvHjOGFNhfP7T$8iA9bB?kW;|lM#S$LmPlH45K#^Z_(mY5!F
zi+y@J-Zw6YVh}Oh^)P<DyQm*8+nh!5N7d=FTPrw6@9-v7zBD3cR*e|GRcn#joHoY-
zBHKDc#PejYvv*Y8c;$<p!WnN;83~=WnN*oM%-AhG=Op>G&o@S0;c_IOp#Kvs+$}X>
zBCcdd>w?qOALV)$ua%v&lU(&3x;cDsz42a?p8dHWU2fe8{1(W|5@Iz26|anE#LK%-
z3Ie!zV^=x;dypGG=h#VntW$JMJ6gS?D`K~M>`aYSlc}`e`-Rf!TUXDiwKtmjXWAQU
zxvXxjKhSPmKk~y}0_DoBtf9gu|Ke7+z7iE?TLWgdj;y8;D9b^8OAn?K)Y?_~oZDBe
z>pX13j>YEkUiWJ>3+nH*UDzY$CSQrEQH8V0k|P{tx3^3_M~Sm|0J+3mqnv@qy1f!0
zJa|+WyGCkS3odhWw$GP-p)n@XH7XP!Hkx~(^Kkl$3uf9aC6}<rGKIx{VAwxeEy|@$
zRq57>`xy*a+;%vxe|u1>uarvP!!ao6TzD|$+Bkl(`JPT5bu>U(&ss?#dnQy!P(7`^
z^pNf&#Off4{73tXaeT7>2dM3<Pg^;41c5iJcii=6IzGS@YWZd$1oVEgKbI3%U*yNd
zh(DP=@e9-2Sm7|Bz=lgVVYo<6zU~xHH$R#ujvw5-F^I;XEy=DPG*8#heH%vDjN;-$
z^Q9g4!xCveUNoPN{TWUR)c9z24E~$*SZjBRk1N)~$;Xd@HFNSgN%r%iI=PUsmNc5*
zMn4C2bE<d(9wgxK8XFW){S>NfgkMwOf0wfYxa(8SGT+YmGpL~C{*D5zGgZ+IrKFwZ
zJ6mR_-;+-3!H=PNM@%OD6sF4g<~-PQ!8PMYUGQfFM9nvka~G-$C&#rdJqxQyOaE?q
zsXB3pbL^K!WYJYn@~P1xheeue;i2I6AI#&i;XP~0V_ECW#uv}Kd)`=`aMt7|*8H+#
zbq)1ypjGIKz%SdPV!f*Kx0=meo6J}dX@1buIWW_zJb7_`dkkVO_I1o`i^+SUfFSqT
zD#Ik|=oB)Fy|f3(<_8qKC*PgJ>|Ni%sqF4=uwH9^XSCE?;c&_O&HW7RiFC47m%KvO
z2cILk>}yF2%PN?VHu&6xL)Rt$?gf{mrZUEXFh)f1xMk7Ir9d<#UicFQn1DG{DN~T2
zgHw?MKmtrPVPK<AgMHEDIe#E_XYb4JbQA2iduVetu<K^D11SFa0U<b&M~Vw(1*5~9
zVMLhD*X`b)nn7vk4{qIt6az&<g!GSF635OS7HAkcn7Penla{9Ji6YQ`V}Uf%2DAbX
zWt(T4g`2wj`FUw7E4%nmcYFM<<=rkc4`r{Dl#NkkFCUsK-NnyW8IlF0aY(w5ZXwY^
zT6MsKI8X^XL6zOmQqYlO6ZD}d6dC}K)}SS5@p}xy!}WgK=+voG-`a@m^B?Ts_XqnT
zm{2hX!XlT1SYq%Fg}v_;k|cQ^WcR(Au{>ThpIb#god7FQ%J)Ay%c!nVJ8>wG-*tJ+
z^)=k>&f6l1fcn~=$iuEYL!@@`JO|X!qqbg3kC7?9ntiMvTxwjpRU3fLQ(Q}bM6eB;
zV|HBA+2NIO^7&c<--8tC$!V5!r2<c^>H02t{=l~n&J^_d*Pz-NFZdFYGMd+((#}%(
z0tcG(9}^CxXz)$`%XU}{mGTCCS@(MOsnt#5uf1)%vck9JM|56ZJ$!b6;wGGUHuQBc
zW|B81dT&G+d%UNfI9aL`mK=9N@#q=770Z&)b|uN%&n%z91b$7^ZgMOi+f$Vn*+&-V
z+A@9hOnwtH;-GqkGVfiX2-<4w?mCT|(^D<aCc5Rq7FfCq@-YbpI$EI;Zo}`0N64ML
zb*r!>^EY&@!s6{8EOZVqo++7gosjeQw0x052`uA#8-eQ8Z!WbG3YC5jB1_a%okmP3
z5`<y*7eny-R2I+A_o=ds(u$XLh+G55;#PFC4D;3M>lp^#v0?aXfvk{eN7Jw=J7_;i
zrE<!gexuwGA!~Ilk+F3sT}N6t+}f-139ky@nR0?pZK|WzO9nf)Qu0`?$gPOG&n1?t
zQg_hQv&Iuwq8S%jD4VPEB(bQ}Ups`Z!5*|OHVX06PZF{vsxCS%+LzxY9aQbdhc#sW
E8$kRVA^-pY

literal 0
HcmV?d00001

diff --git a/image/pki_prod/KEK.cer b/image/pki_prod/KEK.cer
new file mode 100644
index 0000000000000000000000000000000000000000..ced2e388f709794b66f8f7dd73a0eee3773a998a
GIT binary patch
literal 979
zcmXqLVm@!s#I$_@GZP~dlZdU%zkIeU&(owr*j+5YoZMitXXj!AUN%mxHjlRNyo`+8
ztPBQ?4TjtXoNUaYENsF|F0O_$22vmn2am8{eo;zMMrvlBLU?L%Nm^n~YMvoKP&-hT
zorldSKRKf`*HF$t1|-16BkG!xo|=<dT&xgWSzMBuTdd%oo8)1rWS{_&XXcS~&d&pi
z=j0@oWaj57c)NNlI6EpB85kKE$cghB85tTH7#kXx06`R(YXs*G1}8Q#Dj^3PBP#=Q
z6C*!^K@%evQxhX2L;JglCVqAw40jrJ{QvJ&#k1jE^$Yi>;bslHUgVbfU$vFKCbI2D
zEn{8s%`^GYIhlVmC!Chp^WJSfkBR-e6c$gdIXBD?cpkS(%2)d}UGkOX#ChFT4jDHO
z*7l|uGV;7+TYuPdW8tw^Oc!-0slO==&0X!N;5@rNOyPc2e{o-Jrd#`sGdKJHpIvdu
zNa@i0%re$JPOpz_<h-+wchaU09?tW&-g5tLeprrg)|)Ae9mh^LNG?{|{91MEmXF2k
z&kQ{|Om8*53Vmw&BBD}H{!OCH{fouj7Fx?X_=U>uSsU&!7j-sVrF!Ij;+m=I=RU7n
zpB*jpxA@w&8-D)}96#t1(>yhK$G&PNW=00a#r6ia2C~5DmgQp+V-Z<Dq1UQfd-dZv
z{hG;{ODni|d;hW-@Pnj<85#exuo^G}DFbeh06z;0FvYeZ2Qe^h0)v>5!Tlwhn)6-9
z6|uHm7N^d%>t*!5*cp7#TVCk*`?b$^tZ6nsalpH5UW})8@?Y7#4ktYK-fBH+lDT@v
z{A<ha#c^ANtnO?H+i9@i$gRJ#OftXKUi^Cf`2_P5X8cJf{)X(y4Qq+*UBtV&<bZGO
zrPE>WjV01GHwo`FW16yla(jZ3%HgLkStY0NFse^n<gxI|U8f7u22AyLoD}|rAN*Ip
zK0PUBiTqp3hhk^$h*U`2Sv2Ex#O${-d~FY}nyU~yPgJ6{GUoQ*6^rtpZFSluS>kpj
zV0V0v>+Y*^7uV*L8nay$N?PtWZQWy|&xejXF3!1Aq3;r+tF_=oqll2jtP^Vkoo+M#
Iy&9eh02o<wf&c&j

literal 0
HcmV?d00001

diff --git a/image/pki_prod/KEK.crt b/image/pki_prod/KEK.crt
new file mode 100644
index 000000000..62da6d5b5
--- /dev/null
+++ b/image/pki_prod/KEK.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIUPRz+bwbU52YaVAdEOfTJsDS8uaMwDQYJKoZIhvcNAQEL
+BQAwgYAxCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNOb3JkcmhlaW4gV2VzdGZhbGVu
+MQ8wDQYDVQQHDAZCb2NodW0xHjAcBgNVBAoMFUVkZ2VsZXNzIFN5c3RlbXMgR21i
+SDEiMCAGA1UEAwwZQ29uc3RlbGxhdGlvbiBLRUsgQ0EgMjAyMjAeFw0yMjExMDMx
+MDQ0NDRaFw0yMjEyMDMxMDQ0NDRaMIGAMQswCQYDVQQGEwJERTEcMBoGA1UECAwT
+Tm9yZHJoZWluIFdlc3RmYWxlbjEPMA0GA1UEBwwGQm9jaHVtMR4wHAYDVQQKDBVF
+ZGdlbGVzcyBTeXN0ZW1zIEdtYkgxIjAgBgNVBAMMGUNvbnN0ZWxsYXRpb24gS0VL
+IENBIDIwMjIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCH7pE0Tj7w
+MbkyiP//SnoMsO576EflVzaAuuhtdk/VPRvWFLbYfQF+Y9nMb1tsaf1pkMsYvO9G
+nww0P+5kBEkqnNg3wEnHOmJvJvqXGeo5kZ6LOkBo2cF9jWYxAQzpBq/DSbFxxuoC
+0S2SJ+x1VW2rQSBDm39WIN96j3OOfWlGh9jM2Y//zajSMiLCn2l2BbxC68SxCdy+
+DZKy8EhDnrXaR/c3wx4OmuyUAYjGy4AZoyKz6yW1tPFzB+YxSQg12oHqVeU16Fh5
+Lh/sYRzf0XOLOCqmiA8Sdt47Mbg3FUMxqiXE72GslSfO866va1sc/XPWtthO/8DH
+wURcg5VjuL57AgMBAAGjPzA9MB0GA1UdDgQWBBSvkI06eyur45yPKWNppXgKDY39
+BjAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAR+kGJkPdQahdPYo4ysyHLmiN6LlTwUsfEvvvree4rIM3yMBLdp5cSTtj/R29
+QMhJvdqFxTRpq7if1qfeXgs4VKuJhFa5MKDE2v2aNGn2fdH11+eQN8g2D2LI/VS8
+bVaEXY2iDbN0wE190stW7zMYZymyE7k2ApSvk4dgIiTD5ekFGZQMASeRokih1N1C
+0BswAn/cQiD+V8H+f69nYlykH+054RbM3BR4GNyimMtYm+2YTT3Dqp0gXZ4VGIV5
+XNv9qKJv5rVCuhl0RtRQu1+MRbvVHtGtbHUzBtUSYqdOlq7jMvPCx0GjbNx4L0RU
+LSqg6IEUEjiayK1RQtsD/dVXZQ==
+-----END CERTIFICATE-----
diff --git a/image/pki_prod/KEK.esl b/image/pki_prod/KEK.esl
new file mode 100644
index 0000000000000000000000000000000000000000..7d60da266f404029f9d6076e0c27c818293ccae4
GIT binary patch
literal 2583
zcmd5+do+~m8lP{jE;9x*ijdh#m+9b}Y234mK{N~HUa`X%Obw%%A(N0vM%i-7t~P~G
zZ1=R~66IDoNO6Rui!|=iP3_WfzNxcY?M`c*^T+w)yz5)*UC(Vj&-c8)-|zg+rVGz9
z3b%=?OVqqKyx=V%V4uz?bpL$M@#S1cD<g6L@|u?2-5H<=aR(H^YjP2A01hWwYAtfn
zedB>E+%Ps~Z~k6MYpBZyacFsRf_=g}8~`YyU|`%~iXteFMz|x<1h|bYMGIUZGvu%Y
zCoV657tCUZk~~>_L7*Rp6-vQF<xmuZMO$;3!Qmm4m7tc)p@3Dh4G3a!SbRRoRmc~x
zLinVuA^!FhU63S;Bd{8DZYbpEaQp;pZYYUi%OKIMNK}wY1y?S|QK=LPxRC<VptI|f
zN&RB}Ka3~>biZC4fPx`J03HU400p=R0AS+hX*8!FUr_3(iAzh{4q_{xM@?*%cp4wB
zp9qO?zGtb~PrNc14a6|-cX4-f*iv?Cr+UMjT@IGE`FQ}+fqZt*q{-oyxj%Q!htnEU
zW@*_;=39dAH%BK2QUL5Ex}w$L(*B!M@E-m2wKL)FAthEMdRD9l>G8o7{)uR|op`Y8
ze#+AAqF$<QOAb2%)nGl{c1eEt8ZN!+g*`pHdT8rAlh&0=nKKzc;?2&(8u_}Hr}e6T
zf62#;Q5@uqhT^8&B}NloLIa%{Kdr|-{3KKI#YDVn#3Ktzt%(|)QmofD=U4j6+V0oo
z75jE;N%{R(2A!6gZZ+F@ANhq@do2o%0AN7=X3!GUhMrqn3AqeOtVm5ZkJ?Z&dNyS}
zlYJpl0hcUAgLqk(002u!6o`N>P*LW<Baskd6TV(CgiUD00Bq|ddJX-dRgsV7anp`2
zu|aV1M4f9hLq~OCu57%v^oU7&6C)zq+rfe<)o$F<?$9`N^ahPxQk&CX_~<7^Q@4_1
z@g8+xZrhMFlg54<-7`Nho@&x=jQ4Msx;2D&#QP-Y;VuiB9HV<XJ?1v52d%Fn)EUDw
zDo%=hbyv4aCQ%w0SYT~hp8fg0ht_vBL3r%2HEGeac`>#k$ltp_XVz?FS=TTzQhhk@
zOs7}Y>={SP*5Y#{pKLYtqeAZo(xN=>ShaP%hQO|G`_(-^+g`o5vZss_z7c&-)xXf`
zRQV|Nb;~WQe9myBp^ck9Id>wCsA`(oUbe&f0YZAulXd<Z`m3Wq)Bht125Zdxa9}5b
z>e%SJ?#*~gBm)$oCLjs8`<ea<ehNK_pOO*ZEEbGQ`-=4Lt`q{OB4eo>LBZ3HAIuI7
z5^zH)%Ak_Wi6LNISOFp2(10&wC#X5HnLI9^8z>;rxx6qg?-Qvh7ND7|0zsgDH%@X3
zX7d6_+x>U~A<5B?w~r+V<M=UIBo{7MAX5QI1B|IODoCSH&15QI{Mj^;nSWJ*|J}@F
zaNXybfB62)UxW%8?mwwO+eG#8>t&v6D%Z45jW2i}w1N9za6{W90`gcTekNpkCbn*L
z7n6EOWx2D`sA8e1+Q}0)=byx1%FO!P_<T)Tzx>G4CS*}5sP)+XHF|qyK;e$q_M^@z
zq=fE8!;zdNQPb???d~_Od;QH7>2*)_q>HHceQm@Nm8YwYC5P1%Xgki7OU`~+)-urC
z**DQ<DEamI>LkQW@~fn&)@=)P6;;KU>aFRV;W6Z~>G_SwX=Q-CU-JG4VbhYHykT&J
z-BP{twc)b;WUt}{rCy=svn-ZH*Lrf!N8Zl7>GJfsw?>4+H{mnS_H><#xIM>AZ>|t-
zi5H4vM_r00&P8F^DQcfpKm<5Ln__^<X!#9j011dp)BqX1VP9#3|3~`m+#d@%gH(HW
z-*+#K>bi1#52*2_fCxuoS1Q0<Vc{@;7#(KySC#lT4bg#KP<s_p9b9&pXdCE4ABpi&
zx!&)Ty~<tA!d!Q65$G*T&_TL`uHcSb=Um4GMzBB-W^QQ6<Z%o_{=~8YlN(|fwvR3I
z8iw(>0pUym-w=WYgmDPE5N;vRLRj5H1u39D^npeOP%7w)mV<s2g~9*;(hYP0xBqE_
z@C2KGH9BzM!1o%lc>hHQ!8i0ph@fTm#V5`aGt}W7<V_3YbS>;aZqLgJm%yUudDY<u
zQ(?vW1rfWZgf(?0dv`=B2fQ5#cm)r-_O3`Xva!B9(JKJk@7b=AzX#R-;O1R+w>^Ve
zGwst0&Nt21)<<IUH!Nm7pn1g4h&sxx^uo^Wn_NuA51i7GjA!Unk+I2)rFH9-quvc1
zy3i9*hiVtj;#1Slwk$s8#&Gaaea*HHX**7t;UzzL4636}y}?|xzMOkNDyQ*kzeiV2
z!m0vs=S8VkOdmT)EiESQRV+b*OFF(u96vqU-AI>|>BpZuv3J9+LpC2=isRb#wXQyK
zc??teBh#|kw{m1-b$((GOG9DBc<G^nW|7#*^pYX&22sqFCL1)ET^S#1ee&$~+W5H)
z>$&wwsdiQtahgGc@98^Powx=mEZzA{xJBV_t3PhH+9G_S@2s$QZA7Tc>?w9s1^%5F
zb=S6~%#|3Yvj8HCO^p49wy`y7gTb@?@H?Cg>_6^sbcJP?UNj)`?0kP~!?gS$dMSN1
zA*A|VA1u9~OJsC34>G2sH+vdYjX8(^Ug?X_buCX5YWHVZ>8K^Rg;hPm8Q~9A(s=c!
zeJx%Hr}L_`eDapnif>G6zO6p3$2H9vP5W?Mc&3%DRFkhoLY@AjgIEq5XnWm6R1V)q
X%hjy@)%Ue`<qc0K<6dg~_3VEFN!sY^

literal 0
HcmV?d00001

diff --git a/image/pki_prod/MicCorKEKCA2011_2011-06-24.crt b/image/pki_prod/MicCorKEKCA2011_2011-06-24.crt
new file mode 100644
index 0000000000000000000000000000000000000000..2787083e0cb615ff8c7beaac3b0a598ff5ec5870
GIT binary patch
literal 1516
zcmXqLVtrxI#C%}^GZP~d6IUYF#SR7#U^d`o<J4;NX#38~$jHsgV9+?xklTQhjX9Ks
zO_(V(*ihI&5X9jS<_b?N&dAJ5FUij{6foce39<{b2c@Ru=I5mt${EOjM7V@SeKV7b
z@{9A+N)(*)iwg3K5=%0HI;;&WLGsMPMp)$)LNYRoQWOFbi%KdLd=rbZQ%eeR5|dLE
zg7WiA4CKUl4Gj&<j7*FSObm@Iqr`cQ%phD-5Z9owfhKO&GSGmySrNONy<NQ(oE;U6
z41kVnVpKv7Nk&!%<|amd2B0_>QxhX2!;u$TyY{aQSKFX=_|@~@;Z-h7vFyCJyq=b5
zJ=?(lCinH5`kjxXl8tHv#r^pnb1%0Lo!ocq>w}h!vu5i&|GItRHO_~R4zR3PV<2<i
z<1<^ptd!+}^(R{W`xV;G{nLLq|9{hgw=d70`x2a$WX0{g^O5S`f2=>R91&S9_(-|4
zw_y7cS>HG7p3eCtcIf)S(^p;`(SJJgok}<Jo8C{|uMT_tb`})kuG{K9Dd)~Jmd@8-
zjagm`FlrS({n;#R^Iw%yKcmd;|1ST1ch(kaMXdVGcd63$$?R0?Gn!iS{}e?odcAJa
z`){Vg4ab<?Jc&Oux9sfu<VgqDS30y*w%0!nTJd6THG5{iC=)Xy1LNW*Mt@+4cpC_?
zacZ+MvM@H8i!!nRQzV0dEHI>H`B=nQM3VkEpIu<L<aD~wrRbZXYpTy|>xws!gliCC
zV&ReFVhCm^Wk_OhW^gp%2I=Hy0U6U~zz^aGGcx{XVKra|QU>xM0c92m1F;4X*R&w#
zhjkHx`>*-UQx4^@wo=MkVGsjSAkPwN5Nr^*z<+^nn|DS@Nr9EVesWQcUM?&x>m}#s
z>K9~Zf<*NTit<xRlS_*Afyn}x#(_x}m~MfI7MND!fr-ID7l;f@^?*tZ64*F^9%W@^
zXJljvF$gjUfbk8O+FYO(m6w-evnaKQ2pdX}6CE)7GB*JO^GZv{SCJ_aOsBMLerrvV
z;kmxx;>Q<3X)E3>+FDvQfnk;IlCr2*mD_ikX9ZRZq<njr@`)*Z-}e>L6?=D`>xf9<
zxfXsxa&bKCwcE!oWS;ZzHroC=_L9NZ17COSs$gHN{crYdldzUIO{dm5sus-2e)(?#
z|Mh9|PoGbb-=xLU>-}FtQ=t0$^_ry@%XYG!sC>&mVbYvK|L*74<?vTuIp})VBygG~
z|I@gz8xpM3zOXNI+Pt9rFNfr(!mu;*+mx5IpI-JiqV7s&y6D8Z#!vOaPkFn$Y}#91
zKR&nD`RQ8SmdSlt+EFzwzk*gZp3s%q{UGQ*gW!)@wg(e7JT%_AxZ`4~B$w3lH8o2P
zHnsa%Y}DsHD$<_+w^whE<+kU~4nKHuR=wr@6sPx^-4om#tsAA&Z~SzQOg+uJ=P$z~
z|1YK1%U7!W32=0%e4y*km8D*m7xZ>oX7zgh@9nG?To0`c7HO3KZNRe1+$`~ySEjVd
zjf}U~n9k=+;kkT1N2zk{#t(a#7r7;@Ji>lRvFYRAPcJHs687I%vs6jM`_#c3-mh!z
z!%a6m^Do`9A%R&bc-_QG*=w^M<we^<3O3#2HRZ3_U{bVedV=+b%GZlF$;2)a+tGgX
zrS!M0(^c~==0BeJtE+Ox;Y_~mi)9p8r~f!5vX0^Uk<SN21WL0_7D#WMneaJg!_ja*
Lvr9%T`{w}w_XAHz

literal 0
HcmV?d00001

diff --git a/image/pki_prod/MicCorKEKCA2011_2011-06-24.esl b/image/pki_prod/MicCorKEKCA2011_2011-06-24.esl
new file mode 100644
index 0000000000000000000000000000000000000000..1e4417185ddab385b0825b4db37aae5a49d9518e
GIT binary patch
literal 1560
zcmZ1&d0^?2Da*aux2_hA(f&{*!Nvdve^?n9_RjiM9?5LvyEj4O%k%yUZ-XY*7Y0qt
z7ZxxxF)}f6C30Qt0IOv-;AP{~YV&CO&dbQi&B|cVIMI;XfRl|ml!Z;0DKywn*gz1(
z;SlBuPb|*J%u6rH&odM--~$P=3$q8MrsU@5r5MT?$bdw+ghhQblZ*0;^V3Qcob!tc
z@{1BnGJ!g*4J<+O%)&-k<rP9QGK*3a0uqZ#DiwSai?UNo3UU&YQx$^p^Ggim#CZ)3
z4a|&8j0{W+jVz<Yd5z2<TvHI&ps|4_Zq_o;fVf!^yPLgTy%n4t6^smkj%#96LJmnr
zRtDxKMt%mMI2ThBBO}9+7hAjbuMJn*pmzAx^WWiBE=;lPytllbmS{cO!2c%q^_%*g
zkE4=}Y6Qjo`5tpGw-BA&ckJtfmW{J!>pcIued0CFhmQ`htXN|pbKm1LTfnT8<$?7l
zTK)SK+Rpvce>net(}A}y&z}1doRwt7?Y#4m>fe8?Kd&4SSuOZTxwE%m`x05-H|w6x
z`6YJf`oYszUL4VXI`f@MH}jj`Pu;H$d;NA66ymPi>OLvw&NG(I*I$iUUJEd46+Zph
zENt^%l~X^X%<ca!|9yAX7HUPT`ptK#()P*hRO>UETJ!%DMJ{^1Zqoa2ros)!nBF{z
zKQp)N?EB<N2iI3Rv{bg&KMq>)Vs15iX1^#CGb01z;wDCaV2F4d2(WQ#voW$THkpeu
zvH(*ggMlnCq-FV7#8^a<{y3jqV7KISy3nQQo1tr}&ur_8H;{yD5Mg5Bk>g?rW+-Jy
zVsK_~G~fp5<YxgH(`LXA;s`S`{%2t|U<OhK@*n|a76}8f1`*e^Am@j55rX@#`OQ-f
z<*>F=%35I%15zN*5^4}^5V*j9fp434MoCG5mA-y*QI1|NEG_FL=jZAdWM_gz^$Uvf
zQ%aLdiuHlX0+_~uNf(%Ifr%EFR^x$*!9W*?3{3TaN(~a&IDj5yWo2h%WC<|{G6;b2
z4Vc<opca*vmt(UiwTK8CN{|yBF#9q$0R!_&OUGA{DH2Slv}}HBO_JfczTo1=7eQ$&
z-Ywc%S~Y=TmF|+Vs8^NScbaDfRtuzjdzkWxDShAf719-Zcb)5qNa48_enN6_JnOaF
z$1Y@^^YAv>{yO%O!Pf&{ckHTQU#$Ia_HC1}mN!kO);X#c%*lTFZvy}IY4T5>Pm$lG
z#nbEkUqe%%`up{or5DR~vYx1X%Rgb#oJ0Ta=hx-%S6?~kde<aynkE0!xUd@%tkb@*
zFLT<wp!_d~<fp>0GxOV&m$aW=_BW#LN@lv~#Ja{$^}<hiySr@KTV6jtx7YdUTHTh(
zeOcO3H7>t`RyCf`mD&9u=sttsk6E?{6E-|F-nzKsVyYyU)blkpOAa=*`&n$%=RGRY
zp8vO3Z;$1+=g$s5cyd;~<^2?=_nO@k+#IbNrPFWxbdF3t&AaC>!zBMNrPj+=s{9FX
zbf|ow>(7;?UX~a1c3Nijdj9Y2tQTAltqm4wl>cqOvdY{n@s?Mnw8@Q(x7V1?=S<<b
zd_G61a_z<sdzcrwC9FKcen_$D<KIs&Dvc8M-&nI$NyPiq!5iMMYwg2LH$C$&-LfHp
zSt)qk#7fy~vmNC{+d>L9-QzXoui0Qyv}<~T^@qyWi#Ex`E)v_(e)OgEx2@Av^DX8-
zp7^V)a>n6IzU_-;6j-PKI3==<;rfx!2Sfx)vrQIAZ=IR&IcCGra6hw4MlJj20RViQ
BVJQFr

literal 0
HcmV?d00001

diff --git a/image/pki_prod/MicCorUEFCA2011_2011-06-27.crt b/image/pki_prod/MicCorUEFCA2011_2011-06-27.crt
new file mode 100644
index 0000000000000000000000000000000000000000..9aa6ac6c79b21cf1c23b01b5a747aea6ca15da37
GIT binary patch
literal 1556
zcmXqLViPcEV*as!nTe5!i7S!g@(~6QU@_oj<J4;NX#38~$jHsgV9+?xklTQhjX9Ks
zO_(V(*ihI&5X9jS<_b?N&dAJ5FUij{6foce39<{b2c@Ru=I5mt${EOjM7V@SeKV7b
z@{9A+N)(*)iwg3K5=%0HI;;&WLGsMPMp)$)LNYRoQWOFbi%KdLd=rbZQ%eeR5|dLE
zg7WiA4CKUl4Gj&<jLeM;jf_l8qr`cQ%phE25Z9owktS}|HqeB)SqZzFLtWiG6`UOv
zj0}LTYhqMF4oXH=2IeM4eg>d87gG}>Bg0aT9G~N^oLSyHOAfTxvz78VGlrx*5UXc@
zJE@j?Q}KQtu47)Vi3^U3=}x=+ReQm2U(eZ&4HIm3hWvfD=i=NWOC-AL9lK&8n=_1d
z_qd;YSGY&fe^yt`e;51Sexprl9_vcCzB}n7=OtP9q-mCHMY%7}hP~hTFN<B?^Gkba
zphfK0-@9&CFx~$DhD&<d)#e?N!Y{WSsCKA+D6gS@^4I&YIGJa4Q|b<UaM@I8`SjMN
zq;B8+76p$oR76f1FX1r18j%@yx#sObmSB$OejBvflQ|OelSLz6ZPKp1&Xbtl75z7E
zZF~K$wsil(2q7gFC8cxS??Vb1&IOo8luhM$m$h*b<5ebRMh3>kO^jv05GgVcV&l|i
zV`O1$G8biJVFk+>C?mv}Sj1RFejLo+USA&U^;y+i)^DL&HNQeZgMlnCMr8Rw(!y)^
zJ9F-BDwxxA)!#7hs?v-u=_>}3a5F@hSa{^P7=jr}8Il;B85|9`K|1+aSb!Oz&43@o
z5oTok&%$cJ45SR?K?2Gw5(Z)oBCcsc&JXJ%1ovO_o2MMgVQr<9wZb3<q(Gh})F9X(
zaDo2<-!|`zl9B=|ef{L39KBpvn%7It&($x;&IF0-7Zl~ElqQ!H>jRSyFfRa;I52$!
z6E`qT#{<)hfi4gknCbzQ8YHlB0K<com7S51CBz`eAOOZUU}|%LT2x+Mj?JRfA|h-k
zK~9^%Y|h-o#K>UE;q>3&%(?GnJZl9qB1|>ijLOt&-U~UZJ4t)3%5Ajph!hU}{4&C1
znHYD|s@Sznw;Gxq+4{H0eq!GFSt?fgW59%;n?qZiG-MR^Zdw;8a`eEO=~ESDCfw%#
zQ$BBM@x+c(d-n$IWDVfGA3kqE;#=OQxvDoE_{AMgoLlU5$anoLAz6-){=LWd?9{gP
z)Rs5;lckvHKl?<TlgS@5Hu3I$1&0HhXQ`H|pFPRE_*?A7=Vl>QI|H^}7P`p3e|O3K
zJ97OESKmr}(H9ZR*1wn5vqAak@s=BJUmY}VS{vpqq5CmoD*M^<ABsM#+kLmKb%u_j
zkFoX#ey<N1?OP{>8kH{0YRa-%tSY$V?b_=s>rUTrh+NQeajH+!L?x*b*&bVWK9^-r
zHq16L-S}%;@Cu#AH%nLxPt4u1>xHyS+7tH>zP_;f&GW@(Y-+oZVK+f}tA1R6Kx^-@
z-lllRg<te|AI!XzQ~G3E=2peFU+fpZJ@UPHYpqUsu$-!q`SF~fqN!~gKAI+GNq*gA
z-53zI%t-g&qRyXAZR!%C3!6?w&HiC9BSd7G`!rSk6KYQ!r%1&x**~53xHa0w&VIMM
zSW)OBRi%wLtDiHoX)XRPH^J>N1MfA-&c}SF>PgInqRZZ2P+zbh(mdgZ#grWnDhht=
h@@Z?I^6kMoCf9eVhqf)Q%M>eRpEUdHvOST_5de>mHUa<u

literal 0
HcmV?d00001

diff --git a/image/pki_prod/MicCorUEFCA2011_2011-06-27.esl b/image/pki_prod/MicCorUEFCA2011_2011-06-27.esl
new file mode 100644
index 0000000000000000000000000000000000000000..37325b002b91869387bedd84604b4188614c41b3
GIT binary patch
literal 1600
zcmZ1&d0^?2Da*aux2_hA(f&~6z{UUuDnNSgtY77k%tpR@6Ewa&@2~JSXkrsEXkz}c
zfSHMriHR$b<MI)(S{4IdHcqWJkGAi;jEvl@3<ix84Y>_C*_cCF*o2uvgAIiZ1VJ1Q
zVXpAR;*89^^pgBMLjeOmkRZD-dr)dhZhl^hp`3vXNQ6sR)HgG^D8D#Atwg~&zo;O;
zD6u3HsKeU85+u(oY=l)_AtWQSC`BP4v8bd{!8freJGG=BCowryAt*n;#6V7**U-?w
z%*fox(8$QdG)kP;$PB_Y25}7<8)@QZZ39h+o0YJ;In>q7Q^DC$!N>sUx+X>?<e+3^
zWngY%<Yxeib1^kBGBPaX$niPu%9-WOv*bW~JzFV{Gh;}~1F?Gcx07nQHx=*a;X3B!
znz-PonC`U8U$qzf_Vt|Y*f7CnXUN}YdoIpBvP7b*-mxntvN^+OcaQtYcZGWt{bzO6
z{CBbM?Kj$_=CQ7H>${Uaa$b^kPnu@QR+RhlY}osa|FYQSJ-@V<23o{^{k`jU1=H>S
zZ@8qVU2WbWDg1KVfog~9hw>WgCx5*Ui<5a)H>K{t2bWEimQQbOO6vCAZ&C0lLq+7I
z@e&U6s}Y%Tmuuc0WC`YY?zcg!J((jhKUp;L)h6xA>pY3+UD1Ez*0$I0YD@Poj1W>{
zQBpeB{XV3S;aq@eMA=l1cUc=3F<xb2W@KPo+{9Q043Q!OAvR8JHbxf4CUa3n7FMvF
zfigmjiA9V><j2A6?e*osUY}LXW&IYaRr4zpG#JPNV?>q@BrUvlzcc6Frh+*=SN#q1
zt}4ywlD=Xf2{%K8iG@dwiy@eylp%@1nZeP38>Ew;g$0-a+6?$X9AQSr|17Kq%s|RO
z9wea5B4HrbAmW-9<ovKMLU8{zzj?}`9M)D!St|@;KnmnpLJfiq0vGr%@NM(XC@Cqh
z($`Ne%F)Y(rFp&N{9OHl>`aiTenC-wN@;RQu|6>Q0P_Mci38I&FmVIZbUZN480Z3#
zfvFx)sX+o82QWNXS=kvGSwakg3<6+$1Ew|?s72-F<=8ArEh55(66CZA%;wBZOpFYs
z98UiY&Yb&R#<Nx+Bf?bE&8SSh=Dm=kx|6ims@z5kk4WLr&o3iPmWgpUt%_aSbgQA+
zk*$A=>?h`(pQU1@KL$+rxjD4ONkc|q@1}KuB1aFbnLbrfX2Na$KjrhL7EkOrwRdmO
zPSyb4`{DBzB);W+nyY%#fnVI=#JR;@hkV!15|ZTz>EC;N&rWSyPi=XlKUs>I{<BZi
zIhp)1V-xT0S8zD6d6sIa`q`7ri@(KQd~Oy}wKHJrWuc4g`*)Yzza!V*aP_Uk7kv@2
zZ2fy_JsXst9&fqv_SHe-rnO<-61pEVrm~+s|Dou^y4`o%T4(4e`WS0};P?8F(Y|$3
zs8Q*{tfnlR#j1i!-mbmQvhMT^hsXsj7pM9pO;nO9k?pZ{=W|*1WW#I|(~ZBj1+UO)
ze6xhL@Wk95yIx4Uq&;yD;p+>l-#lMz#-_Fl8Fmwtx9Z3B2ekGc>urj6T=+$g_rc6d
zIi*jwWo}h$`^A3o+auqLx7O;E2g|7%nIF#yDw^81;iG9{mgLt>){OyS%ZzmYE$aN~
z)TS;Gy0Ga~)a)MyGeSg`xldEoKcV)-af(z7ll{|ak6WW{?Cf{Dixq`FQdQb`v-&wR
zo7Up*aueJRGw@!M?0n2;s-DDLD7x(Z1@#3BBFz(iSWMaRprYW%E}ypcDc>HfV{(0$
WdT86?x=gWB_DQq9F545?9035V8Amh#

literal 0
HcmV?d00001

diff --git a/image/pki_prod/MicWinProPCA2011_2011-10-19.crt b/image/pki_prod/MicWinProPCA2011_2011-10-19.crt
new file mode 100644
index 0000000000000000000000000000000000000000..a6d001c219389bbdd9f011ccac1b620defcd44bd
GIT binary patch
literal 1499
zcmXqLV!dwA#Jqn2GZP~d6IUX8Sr`Kda2W8iacZ@Bw0-AgWaMULFlg*B<Tl`BV-96u
z6J`nxHWW4x1aUZoxxy2RGcxniOY-v!1q}E=g6zWVL8&RZ`FSaZat1OW5iVg--^}Eq
z{Nnty5(Ve{qJsRQ#F9*)4kH5tkUX=nCPF?aKOd+lwWuUBEi*Z>Bvrw&v?L?HD6^ze
z!N|bSz(7u%*U-?=z|hjr!o<+TC`z2y$PB_Y1#t};TWI1`Jp&zxQ&ka84bRL=$uBQf
z2q?-=DNP3XNFl)45#&rmgC<5L<UnL(WngY%<Yxeib1^kBGBVud*}dqA9_QodN54<Y
z+{2)_H`Cbo{aTjOAr0@?ns*;nXu0|QQuk+z4Xc-|)vZaYWc~lx%bvwlq2Te6=h+YD
z955?=*=2aQx8Ug=^Q|Rr(=?*n6O?uK-*I1>{yk8AUeRmzWhZyaSqGceJiYuzeP_GO
zznv$QIrCSzO+1)4&BpQa>BaW3Oj*8fGUZh@V$A;kbr$8C@<4LS`TK{29vzBSf2Uqy
z&>gMCnXS|roFJxiAVW5I*Bj5za}#@7GdPP~Vrv(LXy2{;E_&WHHb+J~=G>k+%H8>S
zTh(rw2_N>qroL{ck+tI_orlNImcLjP;`cp<o25N<i?hUvO%HM<%ilz){PJLCVrFDu
zT-?Oy3=9!_0|7QpZ8k<0#wK%7MiyXVWH68ghPEspix`W@N=+uqKCvUyE6z^%InRIA
z!<x|b!3L6W4I)e|JaSwN!3?DgNes>mjt1Nyo%}2yW7-V(K^$R5#{Vp=2FyUpKprHZ
z%pzeR)*y2ATiEIT7mH$&GA`OqnGk*b+$@PB24Nrt@+|%az6Rb4JQujPxn`7<6j<r&
zCl}@D<-(G&UUGh}enEC7NL0T7692{ez@!08zQDu_OtbNz)T(P>rfX!Z2UKJb#l`{j
zA}cF9BO{BSfscU~jBmiyW(T#Ryu2Kn6~N4Z&+HQ9ga*v5%uT=m6!}wA7`U|ZP~N8Z
zmUeq=g81{a?FEF3|E<Wl;IYiaw`&@!+B-wH35k{0{#)p|W`8;GRAa|2+5WEEoY$p}
z`*4}1W%ay~zRogXg@pK$**hOO7@3tFIT&?p{}Yx2uf#5|Ih^r6Y0ce`oB)G}Wv^@g
zO<C^O_vKAZTXFcIAjM*nsLzYL!cMT<V&{DOqx<o>FLizEK78Zu;`nWUQnsi*c*pB~
z$qyde8m4Y&eEMn4S+OPaZC7lZeaPv;gqHXa+5erdcFDR=$lp-x=Q!VCe*DvgTAKtX
z7I!IXd^mTn*fQR3bxgvW`^*9>E_1&8@@-n{w)()1G<V6~MH_@{8?`c6%Xd%oNvhs<
zkp1|ss&*4*KJTQenJ-WMIp<}5Qg=ysjm$sWJ3IKJeqB4VnW>e@>ec3(c~3GG&F?i{
z{8lQ-ntpk5c$}uR<%xH?56?bvEsnl$>0H%nG07&khzoIZ8#kw~&oTY9=c&EQBhy7(
zrEK3M!e(Bn(7DJe{rW-&<J?sOA6f73s?$l{&Nf?F@yO4LoJSGjY-ZXMg_zGQx%o+V
z*Uu?)9o|Z~emvI|lWn(}`Er4T7FX7Tc=wA}levsOt-o$2uT>EB)G3mq&^vrrU323H
zMVl`&2aoQYFqyBzb#mLwjS4gO%{YB@>XO)`YYUP&6!w-1l-JsRcHKFD`ux-34f)0^
NS<aU)Ns@`I0|1HPHT?hp

literal 0
HcmV?d00001

diff --git a/image/pki_prod/MicWinProPCA2011_2011-10-19.esl b/image/pki_prod/MicWinProPCA2011_2011-10-19.esl
new file mode 100644
index 0000000000000000000000000000000000000000..58cb0a1b24a15865edaf7cb6f3bf4d253c9fbcad
GIT binary patch
literal 1543
zcmZ1&d0^?2Da*aux2_hA(f&}x&c*-+uUQ!w_RjiM9?5LvyEj4O%k%yUZ-XY*>jq8C
z`xh`XF)}f6C9;==fz@&t@Un4gwRyCC=VfH%W@RvF>@egu;ACSCWnmL$3Jo?CHV_1H
zIE1;v6N@u4^U_Q5^9%(H_&|c}!t6n*DY^N1DTZ<eG9VEyVNu`A<f8oI{In7U=lr6A
z{G!B?OrQ=U0|Ssev#=&YJ}5sQs3^6lBr`2DIk6;F!LhU?BfluKq*B4iz|g=zPMp`!
z(9pop($K=h(8MT8oY%+<!ZihP4H{c$;#55Y9f(s^5l#)y%uC5HFIEUB%1<dx2Kh)K
zz}XSxOhbbvMkVAxWMpMvZerwT0E%-lH8C<W+~wK5=!qWZ<L5`ePs`lHptv{F*!cZg
zmeU~(@7S7mA600%`TbJ&XNwK1m#o#TNvdT1|Jci(#Z;l-@sa1*59S;&D}C8zc(=FU
z=^gW}C2rF+qT3Ucb@tzJUz+|sP<>v}YxZR)cgk4@o7OzN{6>9eyUf3xCzUz#SGY|)
zm^aPF@$%`#_OVP^zHc(+RW)MF{{M9r<(l$9a?APqhlCy-idKK8USZH3t;LzG)ES&0
zrgI=eHh9+?&(Cucds;I%i(O)C7lmlwt^6)}-ZVBxMmy%*o;k|h`FUH_Zkh=n_P?gS
zZl{s8<0PGj$Iq6(SQX;;J%*d5J#~w-#EMN1awW^(M5+ApU}j=wWMEv}#OMqR5qkpx
zHco9eMi#~<b5TYXU}9u2kOhXeEFX&)i^xh%Cd)ptBhxF+PWU;`f7ZjA(DlIvl5h<o
zOe{QdTnxbsr3^_7&J2zQ+#sF&EFfdr4ERADVMfOPEUX61K*~TKB%sV9VIbBZa`ju-
z>HZgsVv;g0+D@4eef``li6aJKAO-R){sz7V-U~bzxVO1xl#~=$>FXyK<>=+YlCfTL
zey)B&b|y$vzW@^d#rnXc0ZhKY#0yNb@u1YIYhb2pWUL2NWDv#10rVm(D?1}2i=Tmy
zfftN#z|>|3wW7Sd9Gexu%z)4A66Ayi%&p8#zyK8aQ&SkYwDM5iruUY1du)RE^R(>+
zgp2>J$hhFK%*3~A8mrnnL$?WumDm1T=(%QpIq+0t$1U0ZuG^f~rH=b>nWbg*ypg`n
zGGT>;_>$Q>A2}GAl^r=4b!`6=mIJTEF0VP9@jhwI-H@CBgNS9XYyM4H?$`I_O-);I
z_@N-hVw0%Pi@U;3u-szjeEXyO@wqQ`ed|7a<L=`4ZGTd>s6Ked>wU=&9@`qGZfJb^
zY0X)&CG%}pY@B__>B5AT_z>Cuov(Jux=+a8Q0(V8-(i0I(}h}_1Sb}EDQbK;cdyto
z-fneF!khcd0xK?azWnlSTI;s@z>YL`$=*d9glrqNGFZ!ZPxMKu-gc1v_^zsU6J|c|
zq^g-OPyIRPWqwk3NqCLSKifMy_@jPZJF=OnmC5SW=9_s>G8N75HD3HyD#@CDd2)E1
zrnKdWce)SHK5;FMzHsSW)oL-xCbx(SadR6tr?1a3{j}$)y~-ogMO>w9-z36jUa8Qz
z$SVE%LI>mARRSMb@9(P9N#4#jTUqhQ&x)K!5#nrS+7pGC&n&t5Nq5)JDRUj(O1OSJ
z*A<g(x0?BKfrJ)U)`NKWi&vAmj6SWuZYHl)5cSk4lB3W&d{<p_;|E2XFER&@?wl~0
zufuh6+slm#GxyCneRS%Q*raO<k~tLimI{>D+J1K3Ie+^6)8P&I#w%IQmoG_@iL3(v
D6(vW!

literal 0
HcmV?d00001

diff --git a/image/pki_prod/PK.auth b/image/pki_prod/PK.auth
new file mode 100644
index 0000000000000000000000000000000000000000..ce7228c62d0e4b33cf35187453f38bc98aa930d4
GIT binary patch
literal 2545
zcmaFH&dtoNqsIUP4_JXLrjLAcFRk~wpYhJKYo$r8d06UlgC^D^OpJ_%{06*ioC$3n
zjH%2lOpL4y2Hb3%T5TR}-+39?85cA$Uo~iAzG%?Iv~vM76C)Foh^nCE@6;XBt}6XH
z_=Mm2o3usgvKJsDpn4d&fkreo8gd(OvN4CUun9A{xEjhBNP##UJi>nYMJYuYshN2S
z;i<(XX^A<hd0-a+W!ZVyobr=1N^=e63}iscxp+ifQ_@p&Qj3cff-8$lQge$H+;fvW
z43!NOLGsKzQqK8#K=GWM#FEVXJcUqKH%|p;M+GATBO?Pjab6=MLqh{&Ljw~N6XPf_
z*9guX6mD!{R6-6qVCXY9G4eAQG%<29H8C<W9J}#s|B723O=my%>~@I0^J}^IHpkHZ
z*}`03&sd8;yJ+OJxUchNo6beEQ~PF>nOw{ZcQ<)lIw9xXB86|}Ju@9PX*M&z(@yX=
z-ak__ApAj($+R5dcooI|*$p+?$MU!vW0;%SKlcern|x7{*!apolJ)JT<^?tiuKP0z
z6Z3Y4zTPsy?OXiWc(xY{H0NDQSo_q@%rY$3#HYa{ydlRqVea*)Romw)6bFcJ+V#fG
z@r=OI5IJ#!V8M3}r$imR&eR;k(su2IeM0(r@%P>C#j7TB$bFsindeE?!#)NtbuR~v
z8;dvF`W!#|t^DZ%ZK16@C2aJgS3cPOt4sHA%YtvG9~=BBHe_OEWMEuuZ(wU63yg4C
zJ{B<+ksi<2E^`Gc(<TcgUA0`&R=#S*!s!P5AZcMn#{Vp=2FySTn23P_{46ZMG~0$8
z#K6=E3}Qxx;^`}8FTF4fIv!GSe`(jQL)ph-O2nq<9-6X1{q&D23wtSDg^hojR|az}
z_EtJ+H!1N=xRd)N*Gl)k8995arcO3pS&^H_V0qH&RP}9Mq3wH@1@IfPm>pG+oEda>
zZNYJmjnAvLuDyBjNd;r+*W4{rE`)gp`MN4!)mXY*A-w-kuH=){7mA;coqErZ>T-@@
z-n$D|+&itO)EexWIp_Q13k$spb=}nT*5^vd`ULE}Fk$_CndkSouIxKjvrE`($_A@v
zhSB>w5;#s<o+u5iFZ?1oXQm_fx7T$~^KQQmWEavj3Rsc9*i>xd{_sPI8(f|&jQw?o
zQ6VN~x<caK%khe@6%P1rQ4}$3Vmt;+W`}?!fI;J|!H^knmn_JI6H-9~%q=WUj0|S+
z3NJmUPM920wfxT6U`9FrYW3NlrY~KtcY5!Wiz!nxrdrh&baIPx#C*GOXQzrTN1j)5
z!MgOID{fDJh4DUn(9k^Vm457#lhe&P`1>|gP29`-fq~IWpjma<<X1g8v!$N9Gg^xO
z&6(`6IBoZh9Erm}SPBfyoL+XWwG%kI{8wB3F3V_Z$BpGLGvZIpQ0$t1i~FMdtnXJ|
zcivmN=F@|Q=)J2Rnk-wZXm`pWazg#Bs_Lmy7Z{pcCp`ImQt(>csi`p&^dcYj><Fl@
z?dEIbF<4>0>Ic{VW9A16*<~gQMf571GOP+e8UB}5T+V|*V9UFjs2e-({JP7|?@-_Q
z_)|HzQ|+oh3nLFKeKKXaSNqo0qA}VZiWpfSCI3@q28N!iz8~M8I_%w1D8Btr^tmac
SMLEr?o6(|tv?w2#q8tF!MY4MU

literal 0
HcmV?d00001

diff --git a/image/pki_prod/PK.cer b/image/pki_prod/PK.cer
new file mode 100644
index 0000000000000000000000000000000000000000..3ed594eeadc60d89426f0c9db6738039e1ef5051
GIT binary patch
literal 981
zcmXqLV!mk5#I$n(GZP~dlZdLI<nPoS)2=H0I{1X&`J1#w>9Q9Fylk9WZ60mkc^MhG
zSs4r(8x6S)IN6v(S=fY`TwD!h45UCD4jy5@{GybijMU6Lh49qklC;E})I39epmv}v
zI}e*vesV@>uA!WP3`l^BN7OYXJvAq_xL6^$vbZEQw^+eFH_5|L*+3B_&&(s`oSz32
z&&f$F$;{7F2z7PyRB(1wFfuSQGLRGJH8L_ZG%z+aFflPPjskOy;M_ss#wJE3<e+0@
zWngY%<YzEwV&r0KVq|1EcH`Op6}LK?&VKIM?GSzE*K+Y~j-matg}J_-u@--J(a33W
zU+2p<or`9t_RT6YxtJI3Zt}QvLe9HI3g66oW;$%rY-WC^o#1c0f2L+Y_=6skX*t62
zDvJHH8)~$V<#9L0FgLS*?h}+Y`JyDT@s)uj>)TDu3v3iz_h%F)=Iso9y=8*ixA?R1
zY%dmQ&byYd_NkqjWmv9>PlHEzLymL8-0M-Rw$E264iMk8>y4Y^8G)rCa^eQTg6|$q
zi8^?lsX2zF?b-|bg!J{|@4MZLS54-S`#R+_&y%c&eGFdeUJe>J7H_uoIezwA`O^j3
zLR)uA*yu;Ee6amjm+s+~1>a6THuzI)$i&RZz_{4nz}7$(7~!&fEMhDoJ)W;!<_c7%
zO%_VJYPqDXeASAD(+&7R(!z|4|5;cKn1Pf5H%Ne=g$0;q+mM48m^y($%*aqYeWmQB
z7luK{Ln`hs?b>xH`&dkg*c9DEQx>S7{!wLNFQu!n@lW&0V6Mg9N+<0mCB6xFa-ZZ{
z>E1UZXK&Ti$)+nSauXRWPg<R-zRfGNeebdWenS?sqY9EUgU+rkIPS6WdDYgnH!nV^
zU@ZNbyJgCSFz+B=SLLf3OP4Ez_aDlYe3JS?@$<1$?-^2E&N0k;cj1bAr}dOtgFQ3n
ze1Cjlp;w`<o0{JGTnSm9fSng6te-FQ{2tepeaC8c342Z1VD-!}dVfa($7#zGrJ?nO
zUnJ+ubmac_y6$P-?bm_qLYhVaEAkhcicQ=fekgH+%aet%zwR(9#KcTjNZfllUh%cU
J0pBf(A^_?{YvKR^

literal 0
HcmV?d00001

diff --git a/image/pki_prod/PK.crt b/image/pki_prod/PK.crt
new file mode 100644
index 000000000..1bc5671ed
--- /dev/null
+++ b/image/pki_prod/PK.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID0TCCArmgAwIBAgIUJREZ+2W4ltUi+sHkD0P2Gzh1pugwDQYJKoZIhvcNAQEL
+BQAwgYExCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNOb3JkcmhlaW4gV2VzdGZhbGVu
+MQ8wDQYDVQQHDAZCb2NodW0xHjAcBgNVBAoMFUVkZ2VsZXNzIFN5c3RlbXMgR21i
+SDEjMCEGA1UEAwwaQ29uc3RlbGxhdGlvbiBVRUZJIENBIDIwMjIwHhcNMjIxMTAz
+MTA0NDQzWhcNMjIxMjAzMTA0NDQzWjCBgTELMAkGA1UEBhMCREUxHDAaBgNVBAgM
+E05vcmRyaGVpbiBXZXN0ZmFsZW4xDzANBgNVBAcMBkJvY2h1bTEeMBwGA1UECgwV
+RWRnZWxlc3MgU3lzdGVtcyBHbWJIMSMwIQYDVQQDDBpDb25zdGVsbGF0aW9uIFVF
+RkkgQ0EgMjAyMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbY5r+o
+2oiCzfOMu0Bb3PqnF7ZBVY+bEwr1zDsX5tEyQqOOiemGLNE2yr6adjTRbldHNON1
+kGzuoiD2N4yZQLIpgwPuK2BPM7+ZKVBX4Iw0lmwTXyQhj5uAfCvGbguBXAODB/OO
+ERs09CIYseowGQXtsoOgPCBFv2hxYW65Veu0kEb2X81fBuigKZ7WYK3lPjY5Vm00
+TIBIV4BsQ2Cd11qqt58gc1AXsrrsRkHMEKVUHhcwUxHu4ZRawdcCg1wEhtboP2Bn
+rxfvi0dzqpMIHvWU8wzkauGOAEonSkAo2KOzPUzHzfZ35aArErW5GDwvW6ngt/qK
+LcOEoPbL4zD8czECAwEAAaM/MD0wHQYDVR0OBBYEFIxJ60SdEHlmkxJi1Tmkhneq
+qKGXMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgGGMA0GCSqGSIb3DQEBCwUA
+A4IBAQBzl6kd0ugxUsdUeN+lirrCa8ZcdBaULcKUoCfL+Ho4PxotILH8g6lTCqNL
+Isk+kmHsV0JHkkV5R46YbL16lZM1qXhtYQA5yTrKe9sNEre9plAPMQQ2xSAZmVLN
+rXDHSLHnerWt2dHkeAF19W20lNBWS1JNRSPVKKWnIFePwm0Z5GXoIfPGyu8AZUTO
+AJ7u0NRHiTuUfTC8mZz349ChSnEtRiYur20YHUxQudCQr58c594K1L7GfLoTSpSw
+OuYxW7+IYAjLOch1VX9x9BmcmUEL9ut+5W7b61EHEikyUKhvozUWkb9XwmGwROSh
+XfrcASBcXJcgYb3TXyHrIMBNtCEU
+-----END CERTIFICATE-----
diff --git a/image/pki_prod/PK.esl b/image/pki_prod/PK.esl
new file mode 100644
index 0000000000000000000000000000000000000000..eab36e8baf071ff7bc9740ed3453cb64c4d65412
GIT binary patch
literal 1025
zcmZ1&d0^?2Da*aux2_hA(f&}x$ie^yPnj7Qdan9@e1Gb&cSoW4_CwL<rWiCaUo>c9
z+PQ$4iIIs(L{(7ocj}I5SCxJpe8TViP1>S#*$V?+HcqWJkGAi;jEvl@3<iyjhTI06
zY|No7Y{E<~u7)xOQXmcokFZ~UQA$xpYG$57cxrJ;T4GLWo*_R_J5ZLLhs`NJIiob!
zP|iRGB*4WZ>Y9?Cnv+^wtPosTT#}kwtl*xT<YB06pa_y@=8<yF&jX6*<Rq44=I1Gd
zy1IEPI6EpB85kKE$cghB85tTH7#kXxn3xzxfw@L-?x1jE6QdGx&@r+yFgG#sGZ-{6
zaxpbAGBO;y@ofK!TOCbjKlki*h`#e{x%f86(Ei!NTwl*vi$A+)<g~c2^JSaPMYB`;
zW|f&-%nNrnd0aXn=iMTOZ{|HS9X4q;Gr!YL@HgH+Q!^m^L66C_9N~Bs#s1k1HQLAW
zxEo`bo7q422}+xMQIgpB%0QC!?WX1hHVUr$GYS*)c80#*GQsUz{MmT67Yj7!T}xQ|
z)XvN@EZ4-R!6UpO$2no{^{7?b=PMKkh;Q2U#?A4Jz|s&oaf4vNcMqpT9lXxe9K+If
z?S*|p`g-yA-R{M!CUeMro${IIN!G(Y1}}9l2aOwxH{1FgKl`ox=>lz`tve-b^rKfk
z*#4_a_i)RCZ>Jv{{3$kMVrFDuTx@S(Yak1Za9KVUF&2>?&(|(<1uD}f3ng8(T+&v)
zYQ@6o2K*ptVMfOPEUX61K+1p{B*4$Y0!*`Q$UzKDoxmVwWGJ4#Qufjd!=U3K75A5R
z?K+fwET%+kiteE)3)D~lsIst^(pA{_r+H;C*J5v_lXjC5--J84Pjanv@0*dcw`%HS
z)0Gvui42w}txi?n<`vq$cUb_xA&c2j1<9E~XV(@S_t^NnYU|pY7oSuxmVV9MGUY;;
zcaX2E@>Pwc%N4@=59LZeNqwRC`PixV45=>X80NjZaK*jTdP=Rqo|$vLKfbWgt5DZX
zO>cd!gse}%&I=RP&zE_AkL$|5V>P>ky{2ridS)2CzaxR;wB?D?(E7qJl5=J{a({bW
z_cZVJ>p*rPO{0Jn`HM}(ChiYEl(@m=$->xQcNi67Vx}u3?!6qZ_*&tB?-oT70CR4C
AC;$Ke

literal 0
HcmV?d00001

diff --git a/image/pki_prod/db.auth b/image/pki_prod/db.auth
new file mode 100644
index 0000000000000000000000000000000000000000..c2b6d50276e71a4521b124b409a6f927ff567a46
GIT binary patch
literal 5699
zcmd6rc|276|HsW@Y-7nT+aQ$n%-Ad0LUu8>EM;snw!sjxk3yDEsK~zLW=W*1S+XWd
zLiU72wj#Qf{Epo2?R)S2-S7QA9^d<Te9u2;-k;Csob#T~dA(oH_v5^#qJz;%NKt%0
zCMdyQ(02@(&u;5Z;a7BGf07MRFn78MkSSZB5D1zPphwW0i8=vsg2AB>N(z7uK_eD*
zB5I2sLIueo!v+8{><K`I-p_$SAy6o*GS62c;`zMuek|2-rH$?i*@oKu-CO)}4TKK7
zMMOB74xmB6%-{$X=y6Rn53qkXphmJ75`7$f@J<9zl!X(?*V*3P$@5zV;4Bpqp-yzb
z`+1=G0G{3Dv`98hM;9k|ClU!|8c6bW@*ttKJ#Z(`f&glF9){%7AbNu1?(X)!1fnNO
zPg4)2p@zZ$7!1J2L65<p(SQsZkOhxZ-$Kl<;r~L4WQgF88wc(^j0|C<0LTzpC>a8w
zh+avSH9WS4uEoUc?C73DR;&cQ(VnxA53hUUan@*1nR|%!-ir`OsKdx(qP06=n~>DQ
z*|4gWjg(bcafIuL-FTtUtkZcIM-=&Vm1|KcIV<k4Dt@FTB*7UCK`tO}Kh(M7-LVMm
zm%J>x<Y(qlqK4AQ2s1}bol7KL3L$7kzj!>7xYJww3?tZ@O*l*0p#HY)4$b%j`pcDT
zCp5CEN42*U9`Z4yFQq_YI(ovn@&&8j3RmBKN1}R-)}fXgjaW3BlY3(sD8;{I&ok9e
zic=ITieY3vJ9z|Mqrj$tz9rnYYG0Zv+P7YQ+s&G1n>2Lqh2c(fXUlP$$W(`#2SHF6
zgaVSU0w@E#;OpjPfV0C{Zzm-j4iYb!xsiCtflwGgOP{cf02p_tSs;)dI3)lBPoRXs
z0Y*3+RBY6bTMTLw++qlY_5wmgV?wRiRykJj(c@?-e8QVr(-u8`=Fh8T^EIWB3SG^5
zXR~Z{jyP=dHmY{%G>%?qmnD?cWDnh(w4+nRmRvk<UJK;3jc%vQ5;jBnKMc<&DRjv*
z;<~o64Ibv_Z4>h7t9+XcLZ0=QugY+`9I9lgm4~L>z7l;#@W8{l1xl_IBt$eh??mqN
z3H7Jk05oh|9re|s<!jh&7o1H2|FY6F`{Qxe0M7BeYdw}3%hwE)AKuDD*=DhEUI?@q
z+b+%{zOGiU<MP#dZd`vlUbB9XufNRQPX;l_jJs)=Rz8DSZ|zjecOMUsK8}?X%Xt&Q
z%B+~)Rd!N+47NRJ;e;kb+CiD^);|z&{ePeq{(oEf(V2d58L(L3WC(?3$BBtarIATK
zyCb7^!;ZDAxtIri@V11b3M~a+ENIH(C%5(~O@xWSvbZU#UrQ(vHPY1NaVGaB*=RoV
zGHDcU`EX;&0qvH^ipBd_GEk>*7jUuW)sDT3Ok&;i6RZlq|5L6to9G(O8J6}!=;C6~
zq;SLg(T+Yv#Y}QAWev-h2Y236+aK`Erd4MZJl`55k?`<wHfL6dz1@etY*Kqt&OX6p
z;mjKx6SEgnPU$Bb5>-3g=m*4|5@M&cd3xk5r1p)@)~r4DI}~*@^2T(>NK-%^v^~un
zp5kl7c;I;xqa^JIZCA_c^^<Q4^@cgl;U=d&Ys>X$l%xas=&Fk#s<~Fpg|jI)b)&0G
z*lfhtd>G+-w!aRepokwdc(?lKp<awP$Ng68z7){Mr$8U?{Kdx!4Mp+t+HHO?w`Pq2
znd|G*3@m=Xs}&$3<{$NOG2q~yj|=>(j~n|C9sL}>S-SDx_VfRpRR5i?UkV&@uoRFX
zJcG8spYv^f!ciC+QZkVGNHC_>WhZdpE0I3f>uwO^=dieeEv6$32Urt=)vgvEoIU4E
zm|<}g>ygW5C3p&}m%b-XS+bEr4prO;)-R<Hi&+VH=aPNeR;F`@?M<(=i<w^!YvodR
zl*iS_<L;5x$frMPEEs8BEKZNdV5V=~Qp}w|<{|ly^<HU)RMZq`P~n-Z=7$|~V`}!L
zTD(rVTW@%aS_NfXRG593AXq~8nKSju{ydJV0fyGi(hZq?>FM?bM06k#IX0Aj{hZ8=
zaeU1PdQ?OMvi7XwS@+N@dx~iN_tsQP#YeSf=`QtleO6qvzFGV(NJJ+0&wPF7Nrs5W
z*uCxj+g;0BmSX`X5^=r%xv$F%-VfK%-RPkGVoRwRzjYq_bU!ZhHS&V@o%|cZI;RxW
z*W^z|n}t6tZNKYDiUyF)*DO^WPJ8o7_#RA1<7;AwYv!?h(#c}|;n)fvoOU7(Tj>;+
z=4?uJC0_MhGxM=WdPydtm?oiU2Lg>p@DNTUI1cb}9I8;UrmVq>k6lBE0OD6!UB)7b
z6Y0hYc4CX4Sj-o!RF!e^o-c-IO9VOQ9)$UIUJVX_dtRK5eia3Ouqj}ejcK>I_MSg!
z&Z2?*dgfIX5U;Iqa^P`NRvho@ol626Z8bAuX1JUq*FOfmrpY&+S1ZZC&tD!^ASjKJ
zF`ieoNsi1CGdB%GN0r9a|K1L$5PNp;7VH5V(?9uJ!7v7mXAW-6CkE(&{ogQX2~B%;
zKx<ER*8JOI>c2DrGgCARuy40&saa?(>`8cnr;9Jq6U_uL><&_~P?<P6dJsJwe{JGe
z*bE2`K134H*%zfj^zkD4d~4Rw7y$TI{49rln>Qg6!9`9!z6582gT1d4O3lv~PxK-9
z27*l;8rW^>&|pu8RzfSvqGd6=O`ZH+D7PB|5$AvKtN&iAQh>x>s=~jeYC-UHB>Iz3
zfAA_Wzkg={6Uh3!St**C`Sz_eLIZ_BBSA)HwG7^a4PQY-*0-b1k8C}QTUV?oDJYW+
z#syOD%;>7X<xpNTZS!s~Z#2vMEySWH61?Wd6{>x;(hgcjpAnL18rLp#**Ynj<@1)R
zsJoW$h^bug+`y7(Z8Xo<+HN5lVzE|oi)Y$VwSk^|6<esQ!4iRA_@Isa&b9^{ZOTio
zyHBQCnP0V9i>`<U0CCo0G;V?yP0z4PG~;<q>y~uZGwtIq;Au$5ZA0>~;uC>eY)|BD
z-Fd`q`WkKs#SuNLMMmUV9vTgame*pAs9lzr?(Fq{a|>&@WkUy#cDk#<SzP(jgUf&E
z)PYYYV0#8YhG>90r2;S^Xv7f^IE1Xg2HEY{D1K=7emVqIy2RdgHJ~@?=PaZ2>0q<l
zrU2Kk7qCL%NIqH$Qwl!{9EApj+P^k_e`pK&!MDgO1m^_U!&wJ6&3h8x<k{fx{mLmx
z*28`2oNa*l?gD<e5nur5<>=&SM`_}HeZ3A#OFQ_uOL=^kv6KVRL)y!YusbU4wZ|%w
zG$;*FzMyzP&7R&>t0W*ViII^47Xhab)ZkyFq@;pC;D&%cp!+=rpi#$ud4#{e|DQbq
zEQY_jx9{(&6-EX(ko8Nj_sPP*R?o^+rDF|8O&C4JRhU>vUyJciPZY@-#HLY-te~}$
z>;s2(6s0uXHk#)S){OEd#*Wbp@9)&7m3MZHU*aByClzyY6lB!CQpL!hZEHEz(KHKh
zUSuCAeTZMhl}=#YjRDJ|x4~aiZW><NSPG6JS+tr6kYrD-=f|3N!AGfRmOsYL^lgM*
zDqq{Ai>3ao(#`7=W?J+1fy2ugWwcX8#N7MRUiN})<>EUTt?Eyc&Y#Be?p$1~<JC?g
zR*($UvQ@KB&*h3$?n@@c3LISPn<OcnK2~CLW@!q>R6Iblu(6qT;a=Fu7-wy+guDu7
z<p?o6rGI_0J}&593sq;`xoBA!gC6eO^@T@Y`g9e#B?~NqdA=%-*D#*?G}KlFy#PJD
zST*7~OAt_)jOgF=<DzsKxME><h+C;^MRK}#R+D7?^jY7z5_T@KmgQ5s%!n$N+wOAj
z8|G9FypqeK^+RlOnqPk&Akk0B{q|`LB=Z*2JIblLPzi_ohzuctwx0vsUs-Y><i(Sj
zVUG(&-b>c~oRX=!%&GaVFV@EGSP5*vi&Ko&_2p^p{y_&?%=_EJ^88|6r{>hHsJ-<p
z>OvzU)&!1j@U*noCS75O(YzA1a0hk$!L^?D)B;=FP>usNs?m?hKSX(5vo`x`c8^6k
zQRXN36aNAnk5%aJF`)Vj1`dGdKVksE1Y+RhcMMPuw0*+>{CC0vB9i|RZ#@Di?RhKa
zH*fs`6DTa6;Nyrgw)X)UU|{d#=H%<;ZtviP+C{}44*+?L0tSu2$jW`=!Cok{8v+p#
z|47c_z@fdI1^+x}Gfgd>y$=z80|tfE?)sgYG_HEcg68Njgdb7^f^~e!9!9l%IfSl~
z)P$t%(ABihX=j&A8~7le^VvWrLoGb%Xf1a8bwht<TLEWmm|CojRU{r$AFtiL;@u!%
zlpY(rb6h1M5mPC0qTH`~rCXm*mn(FZoX#8IZ-A_5++-YJA87a_UU*W`_QU78u>k1U
z&Jrzm+F)c27t6xE<{;IeY5s$v-Je#??RZ{?ri3=H9j^>jnj5Xe#ThgydcDFQVC|ME
zpjH^PB-jlEFSo!=spkzV#G)Oj?THR-R*RM5fx}39mssm<yRzu8x+oVTZ%bxDxS(KP
z+$z?aqR&{)@@y*gitC*`$l!MvoCRUv12F&U?H~*&zs&(czl}k6zX5z~al0SpZ>qa4
ztiWrSD-y(r@(TZf87yT@8Z?b$uN(1$MrhAL!E3SH&;L8j&~!G@m=3kv*ED39C1gf@
z<glP?F<`UD3^TwKIGJOVV-ThHA29>eIw)~a-=MfbP4AIo7anro$Z_U7DL`^y0TaOZ
zdkm7}_}?SPUq0ba`5{NGz5_h&+d7LZW5Qd?9n!*_6%AfxRufg{*1hEsp?JcI#cX}S
zQnrYlj(p3uj6511sfI|r%ljTyyT0F+`<-#p&sApU)erKZ8Y|0BvbHyuUQHF?Ng8AP
z;-8gDN{)Hd*l1EqX-q$5k(Fb=Oh4x#Jfh0Tq1x4#uiI*HJDr)A8k^YI*-$I4tRv2k
z`Qj=-Fv{o(RhRuDkKl+)M5#7cr3?Fs_IAVaH*Ndp<+0~#jjIQk`>C4heW%9x62k|V
zIX9$P+1;cko#QKn<~q;6SYB+AA(xr!aZ0|!r&9GkS@T&dub+sza7{u$Uq*b5QFjd=
zU47XM<Cp77c0HOeysu!nY#3hN^Fq}s=X`&vJ}y~szb|jRvNpr<qS=ZJS-Cr(?wJ-#
zL@X6hdUs{k)V<+8?mVlFWw>M>R+Y_utupE<{#cSwwX|KL@r8tr1oCOM+zl!Em)D=U
z`_0}XR0~9XqUzs#WzaubCgE?&CyY_(bT{!yjjDJjXYb1Oq4G$Cv3U_j@@wA3pVgy8
zIn8p(k4|NL1g>FOi?q{(rMpCC)l&A`Kvm|_W-eGCJ*HBx&F*9NN?7pDNYFeCA(p?z
zm!$QOf_{kW;tYeFC=TY$R<!z5G$+SO;mk+Hl$w_TULWi9qoPwbUzS5PSDae!<%bg3
P{irTyd?;$LinRPcV-8Ix

literal 0
HcmV?d00001

diff --git a/image/pki_prod/db.cer b/image/pki_prod/db.cer
new file mode 100644
index 0000000000000000000000000000000000000000..9ce1842ed312517f60ecf76c7c976758b787fa54
GIT binary patch
literal 995
zcmXqLV!m(C#B_WCGZP~dlSt;CWj$u@M@pHq4>(^op85G9pKz%GFB_*;n@8JsUPeZ4
zRtAH{4nuAOPB!LH7B*of7gs|W11S)PgGbmezbK_BBQ-NmAw0FXBrP!~HP4VAs2wQF
z&co)EpPW&eYba+R0}|lk5p_*TPt8d!E>;MxEG|jSEmm;PP4Y0*GSC3YGxI1q=jQ>%
zb8-?(GV}8k0*dleN|PZ>XGaAi10y2?IdNViBSS+2V?zTIAcz8Ujo{qD<kTicCFFo)
zWMyD(V&rEqXkz4IYGPz$=&QVz9HD5Od5P)hr>7-{&WkUtt6hD0>M5m;o$3E8FaOKu
zttr@2&HuZ;`|@`IYd#f`-Wtd0OEsQUrDZ-APSHATI$tC+Pt|G7r~La7qQ$kE8|Kvb
ztYOgVcvtZ;eSUnb@$vtnFV5<xhnAie+4SaQTkiBTcXFDec`mGUe(CSlxnfq2k<r6d
zt1K4Y<ypidZ+CX`0mcnGmN>I#2t+==p0coGhv3xkXH&N9_FKhauMn_o>3pk9rPbWO
zC8kc6S|q;tGT)(ZYrYr@&YG3DB;T+ypXc_qSu?AQ=iJHIantaYnls~vOUEvqy!I%O
zq21?GH2a$sHf~S2`_7*DZSf&``HGL#YQ_thm>C%u7uy@y8pr~pUzU$Wj78-C`Ppi@
zx3~S3`g`K-_lVmSK|0-M4fsLQ!i<dnSy&C2fs_F^NPwS(1(<@{kb@YQR)Imx$Y6YR
zdxNvrmt$OiVp&~#zPE&2kV=~SjHk75<Kj80o>AsbAIt*VLmLjSIl3jUxZQx~z>Em{
z<oH54of3`SX>$Adx(~=ioIfrc{nhTB91GXo?vPEX-P6*7*(dinR2>kqJLNqgNZn|^
za(i+nXKu~4B(<7ugQApc8|<T5cVuYap24POpgmnA{dRNy-B|&>aayl_35UImbg)e_
z%e!%nYqgU2(|z@&$EVj+u;g_<Y=6|ovhSOs-+ZH^;WIwTPk0)>r|H?_N1F|L+?@k2
zpP4YPTlW3NKE*Fbc0AS!O<G_*^GEeF&cy-G9ak^jF2AmRiITp8almtjn2F8vw8Dbx
K4cpdq?*;&IRdrne

literal 0
HcmV?d00001

diff --git a/image/pki_prod/db.crt b/image/pki_prod/db.crt
new file mode 100644
index 000000000..11a78f938
--- /dev/null
+++ b/image/pki_prod/db.crt
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID3zCCAsegAwIBAgIUabymjDZHxHUDa8BD0zOZ8+EOE3UwDQYJKoZIhvcNAQEL
+BQAwgYgxCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNOb3JkcmhlaW4gV2VzdGZhbGVu
+MQ8wDQYDVQQHDAZCb2NodW0xHjAcBgNVBAoMFUVkZ2VsZXNzIFN5c3RlbXMgR21i
+SDEqMCgGA1UEAwwhQ29uc3RlbGxhdGlvbiBQcm9kdWN0aW9uIFBDQSAyMDIyMB4X
+DTIyMTEwMzEwNDQ0NFoXDTIyMTIwMzEwNDQ0NFowgYgxCzAJBgNVBAYTAkRFMRww
+GgYDVQQIDBNOb3JkcmhlaW4gV2VzdGZhbGVuMQ8wDQYDVQQHDAZCb2NodW0xHjAc
+BgNVBAoMFUVkZ2VsZXNzIFN5c3RlbXMgR21iSDEqMCgGA1UEAwwhQ29uc3RlbGxh
+dGlvbiBQcm9kdWN0aW9uIFBDQSAyMDIyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAjnnWY1ghM2nSAsXy5XTCzxelfn2r05XKIoi5Z/950/5vDXxwtHsP
++3+L0/cQOw4kFI18QZelKOR6ZmnjE2QqyzWfFGluJUKs8m/fWBVzfSmwnHxMrAAq
+iO548WefX10zx/8V6M0vZ1V1yxSy7MmGbZfM3GyDWwzQqUPpT0aJqJqMMjLhqqo4
+od0MogwfPs2TwAGwuKRDB2gQWefXZKGIuBGVV+aUtLtOqgg/IFCmpZ86aSKrC/sY
+lZMaohez0w7C9qz0MxGammGkbzF5bwzb1pqZejOc3Gi42THaJkMB8NLG0snW4mEA
+h0zyWwfsqDxG5AuOzcj7OPBbp6jxeyYzoQIDAQABoz8wPTAdBgNVHQ4EFgQU/8+b
+Jm3btv0a/cjt91jbeFIsi80wDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAYYw
+DQYJKoZIhvcNAQELBQADggEBADPVt4BDSvTGCvxdBUWM94RU0BpineYMhXGxo5wl
+SVo3QvA2UYdVgMOsxbRuc4cwDMCYWD9jX3EeLHQojZYevw6LwBxYz8cTW/U+7h4E
+Ct2LVLJli5ZmUweTjEB6wBI+ykuQUicyvyOHY2kJbXzWYiZ8izByZNawP1sFuGgr
+25gGJjArlxRn24Nv3ZpQjV4q6voTVulZQD1iNm7Y1gqrIhflvn91x5d8eARuieGH
+4oYEvvYhTp8yxVeY8h+Q5Ve8gubj4rMwjEdDUdPMkJ6LHe+xjiH0xLjjKlVioDuZ
++HvmCaNQ50Gro7cfrn+kIi8gM1DnQFyRg54qVlN/MYasi7s=
+-----END CERTIFICATE-----
diff --git a/image/pki_prod/db.esl b/image/pki_prod/db.esl
new file mode 100644
index 0000000000000000000000000000000000000000..86755a63a76112b85324083d076661a93b76b904
GIT binary patch
literal 4182
zcmd6pcT`i^7RJ*PAOaGqQUXYkA~y-mQM!QArB^l7gpxptfFdPmKtMqSR8XlhjDR9G
zsvv@h4hUwzQFKI#j7k#_?7SNo%Q&;<&0A|`t#|*q+54Px&(68u{(iT}tL5}a_V+d^
zmntNDHK!RO2*}bk3x_~5`s`m$-MVg@8YOk5)u%ff;J_aP99Tyo90rBK#Ho#C8T!_3
zY<O6U1&?%m_K7f#4Xi*3XmB@k7gj)_LP!XZlu8f+1W<4{1PTY+WJ!<(R`CN27Uw``
z1TrW=R2tqRh{*~jhX>IJBH(gx6pclh(*r2%2!cEy%TEYmB`gC&g2IECOuS1hlNA)f
z#9K%BZzgB}>ilsyR?&h^1M}hGWEPc9!#gqPf$V_gpB83#B0wYp@=_~^L;?XI5ddBA
z@?HvwpTqyBQaMniuMZN6guppa5eUG63c@&0DCA&le}JbViFy~-J~PT{y(4uxeoqB2
z=ay1xUC3fA?<0LhT;#>wBJUE?c?+T&gx824h%-BST76_!Fm)IgsBv4bK%7cbF|VAV
zKlYSh?pa%XBF?T7qLDfo^D?AhyC11zQR3Gwoe($nZSk7%PHx1}A0LJ%`(S&1uz2QZ
zwZA+sgGhXG=8R#{BWy8N!MN*43$(hn)B;Tr^%}buSd?13GRNa-_QeK=GZ+)RQ`zZ)
z@2E-@Lhqz=j;tz{y1)}|ov)lDt<1|Km(mHbbnHNX-tk?e6Avl1_X!VFEuhnPZ`|$d
zA0k6i>}Gt><K-KzMuZM_-F#;_?el&4%iXG^A{ZPBftHv6Mt~gn`sIWXk_hp|JNc>+
z1D8Ln`fzh%!E+$SSu4E@5aAEwpwLAG5`cp@K!~3ZK_EZ{bH6@fP^;h(Lm{NTD~T31
zb2kLv`ynke7WTUKtnxqk6uU3#e8~xwE#3y^)B0Oe+!C)>wqK+%QvhtsF;A0#?NRbt
zEcFAq^3B5OEwY|>I&eO(j3?z0f{)T&Yl6~qgI&-^GE8^1h#B9q&2m;FHY=wDPz565
z`u$bo(g8+bf3=AZvX-Jba15miXdV?08Azr-%5yrfP2>4nocl8`QzL(U+Ry!h6-rX0
zR}<JBN8@4;wEa&~hPa5U^NJ1y#CDHkGYVOw9*vx*!$TK<3~P(6ydSeprOQp7Kd3m@
zRy(ZW=3lts`0L$I1xlR8%qmK*D4b0wRnozeoW@Lj4<(<{aCb={a4XXrioUS}G-}xn
zULYZmro6Y&UT~s)(+>5yvCJ4-fP=gTT0--(9SD-qJKdKiW4<}q-*=Xq3jqhL<aaFw
zC+I<DQmC{L7M(^A1%&xYG!E??6c|CL1%7URoP<3!fI(-{gIRbBIwO+KSZZ<t5dior
z;JCG4#+~VOa8eM1MGd9~kXb=^Gd7DtXHZ$Opa~EFz6lUO4<M{380r#qiF^~#Uk>&7
zA&|89E5G{ZN?iwNEtjhDrBn|pEs!3~{G(Ta_5C*kc!X^z9$6<aJl4LDOKpTGHc?5W
zsVc;6*ThLwazi_Q@BM|l>9dB_6{S_$asIK$#bFy0gdRR}xNR(K@I;F~`&k;{(SgX(
zhX$8eR=MgvDLa(4njc!94q4c$c8c)=UDjDAzrjT>Zj?8!R+l3Cv942DfL?BO=o&3|
zqZ#jZiHRR9)P9_*prY=pzxcsILNI$!=Hi{ltztv1K5CO{F+jSHhCrCoewQ7RS}hbg
zm-_K7vnR<J`zQj;O@4cdT{R!YE=b(b^9z^N^zCjup`1>qT~fWTkGt;JuXeVMxWVkO
z){~B|=wHvcIxP4KAyR@aT1c1I3`WRAk9)6qyBWT0034_Vcv2>SC`v#R1w}wP1`<$y
zXG6ZSg&)?!)*qB?I~voK_2!gg-jg`Db1s0)=LO<01Xf-U;sRkq{2>+)v)>!UAM8T`
ze2a3*2x&kvQM_;7{dVTB#lHTOUZd<RpL^YT(rth{e}V$S5wHhr3%3+nb1f+>R^)d&
zIsuIEbrGLrye@zqp%WQK<!5ywms!Qs0i^-T7Zfk3+3kF_Y6JS(MAABN65x%(fPWE*
zL_?tn2fz-n`4j^%uJLbML`O&e*%n|k{MEBr-*hXS10JCG`?#pBr(;`bHB;-28#g+O
z&@@d%am<h9l%CCHy7p<gNYzP#RTeq6f6;KAW!PNHsCw-Kxy-ZyfqSbu>;(0LLo>!#
z-$P`TOG}mJ*A1Bx^>?;i^S;qMf@paz$*a6hnewlE<Qnb-c$U40`<VT`!@;@nI4;wp
z)mf3L>pfeN=6)0L04*@_I(@i%F8<)z>3N|v%sZ1#IYxp@?Tf1cgTqFIpz5U2naVE7
z(gLIM^ZBjjJz0CVyUH!@e_k(Vokg!^I+zuh7Hl6a(x_Q^h?%CSKHdEbbNzPX3f~>$
zkKv-_Jb`C(^SS#jCu~g(ww5_iTrFmlq(MPOHypC_-+lQSx}$zqiY{E()_>RWXSd#W
z+Zc3emwLp>el&VmE8_jOzwH8SAMCs57w*$WsEP)^B=yd-Wso7fBOcq<u3mq0Qu|5Q
zh$Yjf=Wh3|3P~A`m1obklSvms&V}pEG>)3A8PY2jWTWP#-H-niqt%OC{h}uodh(3u
zOXTDFc&&gdsC;F`wl^{1L!MG7ea%B+@E=R>&uG`b$v$a1A#M4xJIy!DxB||Ll-3Xo
z9o%l++ZP~6oH=(-UqK_%d(_+u6J_gBAD^5wt+;Vc_F8*g))C=U%Ol)p=kdp{9=qM1
zQ|jm6Ul@SFH?c*d_ZZDu))gErxb2ZhC;fo96J6>r>lObk226j$z#8!WM+~4uK@7b9
zgaHh%Z3zR2Z-fOT9r{<ibpx<|*;|QUy!9(g;9V(HMj+ma%m5i+PiBM#u_D9C0YP{^
zDwcTw=o1Zy1R_yaZ;1!XA&DOXNlE`o&6>d4<(ifLyk<8`t1bAY57)l|gVUIByADf%
zP+M$iOG*NYjkSQf1`bLlpeGLR5vpM}V+C*6Sdt6dCAD*TuQUta*>A}=OU&9>=lbDk
zWADkfQt7k=vov3?WD2n%!@6@as!`D~FD-6ylgWWhVvXwNv+PTgop$mzGVvpvJh_-?
zdu(;nya-Q{*Z5ZR^j1T^SMTZvVqgP{<ASSm`;u#AaL+Ec>^9x~L_uAx^X-)THrc1~
z+3_vYn`&a$k3OjJPq%M2j2xn@5$`0GVhs8`soQvQ6W0(fm@$WHjg$ZknI0hF^}I$i
z_8yiTlIHVaTUAOzJvYQL%2P}Up`_HEKIIw(>2}id+?j)!3_V{A?fV3SogfStfY@hm
z2VsC*8UvKS<Y4@7#n;!ut|Uae*vzUJ$T<|L?iRsECVs^XTvfA$KockOL`I(@f!3#V
zEN%5q{|qxMgPkp&#Cxu6?sqt)?1tI!ol<By;JeHWH^2qhTIg74&$a!Zm;q`XlsKqw
zP~4!Vm&w70hu#u7c6=fQNDf!P8F2a(gXGxs_sH>=JNzj>^f2a&z>nPvJF!)w6i>ai
zR>YlZaZ_SuYUZnL&O{^`ZuY{t%|7$gEt3@DobjvTJV;D7LuFo+n}OHOuJT*`(kbiB
z1-HHC>azHznzLKQ+gmD+<|xW$4T!vtK9$2flzOYF$+-^cwBoVHsY3F^iqQy_`=%mN
zrZ>AwY+CKl<%!8*Tr-<G8tXKTwrDC4--jwv9rJI-o9n*UM@gk;;!RsF<f*XLx;o({
z^M1W!`mVd`oG$UideO}dtj7=KGZXtJq~~<RCBt-n3C^fi9_`rs^ThLOBu<sPt+e(_
zN)Ec~&NO5CY{Mh&zGGU7b|lSd5u0gB%B90@M0QaqCv;<p%F5D-s(XmDw|_SED%{(f
zW9NTJX%$N@!^m2AQ`ty$zOLT+x0hYYwUWk5kx@5K*4F>JdQ<R-wX5(!_k;@tlE-Se
zJrv_C<x4u-GM)AvxN(59-K=PC-HO5Ecf;8um#LQ&xo^?E^F#K%5301HUF21W1|8wf
zj2v$DOFeR^%&VFWNlxx%MD35o``?&z)ui2uIJdm>UjxTn#mlU7RdjBuj+kYy@`ag<
z<__=k*=TIiU@ggT8&Xj^e}DHF9HmjRAfIJ*9kQZdX8*9To|->AN}_D4N3F2X%V5WA
o!|d9@n8?@lcHETg`N6X=%gLbD%O&wtNjCa${;RS^uVl~v0NXYfyZ`_I

literal 0
HcmV?d00001