Add kubernetes service account provisioner
max furman
5 years ago
parent
64c72cf938
commit
8f07ff6a39
@ -0,0 +1,259 @@
|
||||
package provisioner
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ecdsa"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"github.com/smallstep/cli/crypto/pemutil"
|
||||
"github.com/smallstep/cli/jose"
|
||||
"golang.org/x/crypto/ed25519"
|
||||
)
|
||||
|
||||
// NOTE: There can be at most one kubernetes service account provisioner configured
|
||||
// per instance of step-ca. This is due to a lack of distinguishing information
|
||||
// contained in kubernetes service account tokens.
|
||||
|
||||
const (
|
||||
// K8sSAName is the default name used for kubernetes service account provisioners.
|
||||
K8sSAName = "k8sSA-default"
|
||||
// K8sSAID is the default ID for kubernetes service account provisioners.
|
||||
K8sSAID = "k8ssa/" + K8sSAName
|
||||
k8sSAIssuer = "kubernetes/serviceaccount"
|
||||
)
|
||||
|
||||
// This number must <= 1. We'll verify this in Init() below.
|
||||
var numK8sSAProvisioners = 0
|
||||
|
||||
// jwtPayload extends jwt.Claims with step attributes.
|
||||
type k8sSAPayload struct {
|
||||
jose.Claims
|
||||
Namespace string `json:"kubernetes.io/serviceaccount/namespace,omitempty"`
|
||||
SecretName string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"`
|
||||
ServiceAccountName string `json:"kubernetes.io/serviceaccount/service-account.name,omitempty"`
|
||||
ServiceAccountUID string `json:"kubernetes.io/serviceaccount/service-account.uid,omitempty"`
|
||||
}
|
||||
|
||||
// K8sSA represents a Kubernetes ServiceAccount provisioner; an
|
||||
// entity trusted to make signature requests.
|
||||
type K8sSA struct {
|
||||
Type string `json:"type"`
|
||||
Name string `json:"name"`
|
||||
Claims *Claims `json:"claims,omitempty"`
|
||||
PubKeys []byte `json:"publicKeys,omitempty"`
|
||||
claimer *Claimer
|
||||
audiences Audiences
|
||||
//kauthn kauthn.AuthenticationV1Interface
|
||||
pubKeys []interface{}
|
||||
}
|
||||
|
||||
// GetID returns the provisioner unique identifier. The name and credential id
|
||||
// should uniquely identify any K8sSA provisioner.
|
||||
func (p *K8sSA) GetID() string {
|
||||
return K8sSAID
|
||||
}
|
||||
|
||||
// GetTokenID returns an unimplemented error and does not use the input ott.
|
||||
func (p *K8sSA) GetTokenID(ott string) (string, error) {
|
||||
return "", errors.New("not implemented")
|
||||
}
|
||||
|
||||
// GetName returns the name of the provisioner.
|
||||
func (p *K8sSA) GetName() string {
|
||||
return p.Name
|
||||
}
|
||||
|
||||
// GetType returns the type of provisioner.
|
||||
func (p *K8sSA) GetType() Type {
|
||||
return TypeK8sSA
|
||||
}
|
||||
|
||||
// GetEncryptedKey returns false, because the kubernetes provisioner does not
|
||||
// have access to the private key.
|
||||
func (p *K8sSA) GetEncryptedKey() (string, string, bool) {
|
||||
return "", "", false
|
||||
}
|
||||
|
||||
// Init initializes and validates the fields of a K8sSA type.
|
||||
func (p *K8sSA) Init(config Config) (err error) {
|
||||
switch {
|
||||
case p.Type == "":
|
||||
return errors.New("provisioner type cannot be empty")
|
||||
case p.Name == "":
|
||||
return errors.New("provisioner name cannot be empty")
|
||||
case numK8sSAProvisioners >= 1:
|
||||
return errors.New("cannot have more than one kubernetes service account provisioner")
|
||||
}
|
||||
|
||||
if p.PubKeys != nil {
|
||||
var (
|
||||
block *pem.Block
|
||||
rest = p.PubKeys
|
||||
)
|
||||
for rest != nil {
|
||||
block, rest = pem.Decode(rest)
|
||||
if block == nil {
|
||||
break
|
||||
}
|
||||
key, err := pemutil.ParseKey(pem.EncodeToMemory(block))
|
||||
if err != nil {
|
||||
return errors.Wrapf(err, "error parsing public key in provisioner %s", p.GetID())
|
||||
}
|
||||
switch q := key.(type) {
|
||||
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
|
||||
default:
|
||||
return errors.Errorf("Unexpected public key type %T in provisioner %s", q, p.GetID())
|
||||
}
|
||||
p.pubKeys = append(p.pubKeys, key)
|
||||
}
|
||||
} else {
|
||||
// TODO: Use the TokenReview API if no pub keys provided. This will need to
|
||||
// be configured with additional attributes in the K8sSA struct for
|
||||
// connecting to the kubernetes API server.
|
||||
return errors.New("K8s Service Account provisioner cannot be initialized without pub keys")
|
||||
}
|
||||
/*
|
||||
// NOTE: Not sure if we should be doing this initialization here ...
|
||||
// If you have a k8sSA provisioner defined in your config, but you're not
|
||||
// in a kubernetes pod then your CA will fail to startup. Maybe we just postpone
|
||||
// creating the authn until token validation time?
|
||||
if err := checkAccess(k8s.AuthorizationV1()); err != nil {
|
||||
return errors.Wrapf(err, "error verifying access to kubernetes authz service for provisioner %s", p.GetID())
|
||||
}
|
||||
|
||||
p.kauthn = k8s.AuthenticationV1()
|
||||
*/
|
||||
|
||||
// Update claims with global ones
|
||||
if p.claimer, err = NewClaimer(p.Claims, config.Claims); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
p.audiences = config.Audiences
|
||||
numK8sSAProvisioners++
|
||||
return err
|
||||
}
|
||||
|
||||
// authorizeToken performs common jwt authorization actions and returns the
|
||||
// claims for case specific downstream parsing.
|
||||
// e.g. a Sign request will auth/validate different fields than a Revoke request.
|
||||
func (p *K8sSA) authorizeToken(token string, audiences []string) (*k8sSAPayload, error) {
|
||||
jwt, err := jose.ParseSigned(token)
|
||||
if err != nil {
|
||||
return nil, errors.Wrapf(err, "error parsing token")
|
||||
}
|
||||
|
||||
var (
|
||||
valid bool
|
||||
claims k8sSAPayload
|
||||
)
|
||||
if p.pubKeys == nil {
|
||||
return nil, errors.New("TokenReview API integration not implemented")
|
||||
/* NOTE: We plan to support the TokenReview API in a future release.
|
||||
Below is some code that should be useful when we prioritize
|
||||
this integration.
|
||||
|
||||
tr := kauthnApi.TokenReview{Spec: kauthnApi.TokenReviewSpec{Token: string(token)}}
|
||||
rvw, err := p.kauthn.TokenReviews().Create(&tr)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "error using kubernetes TokenReview API")
|
||||
}
|
||||
if rvw.Status.Error != "" {
|
||||
return nil, errors.Errorf("error from kubernetes TokenReviewAPI: %s", rvw.Status.Error)
|
||||
}
|
||||
if !rvw.Status.Authenticated {
|
||||
return nil, errors.New("error from kubernetes TokenReviewAPI: token could not be authenticated")
|
||||
}
|
||||
if err = jwt.UnsafeClaimsWithoutVerification(&claims); err != nil {
|
||||
return nil, errors.Wrap(err, "error parsing claims")
|
||||
}
|
||||
*/
|
||||
}
|
||||
for _, pk := range p.pubKeys {
|
||||
if err = jwt.Claims(pk, &claims); err == nil {
|
||||
valid = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !valid {
|
||||
return nil, errors.New("error validating token and extracting claims")
|
||||
}
|
||||
|
||||
// According to "rfc7519 JSON Web Token" acceptable skew should be no
|
||||
// more than a few minutes.
|
||||
if err = claims.Validate(jose.Expected{
|
||||
Issuer: k8sSAIssuer,
|
||||
}); err != nil {
|
||||
return nil, errors.Wrapf(err, "invalid token claims")
|
||||
}
|
||||
|
||||
if claims.Subject == "" {
|
||||
return nil, errors.New("token subject cannot be empty")
|
||||
}
|
||||
|
||||
return &claims, nil
|
||||
}
|
||||
|
||||
// AuthorizeRevoke returns an error if the provisioner does not have rights to
|
||||
// revoke the certificate with serial number in the `sub` property.
|
||||
func (p *K8sSA) AuthorizeRevoke(token string) error {
|
||||
_, err := p.authorizeToken(token, p.audiences.Revoke)
|
||||
return err
|
||||
}
|
||||
|
||||
// AuthorizeSign validates the given token.
|
||||
func (p *K8sSA) AuthorizeSign(ctx context.Context, token string) ([]SignOption, error) {
|
||||
_, err := p.authorizeToken(token, p.audiences.Sign)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Check for SSH sign-ing request.
|
||||
if MethodFromContext(ctx) == SignSSHMethod {
|
||||
return nil, errors.New("ssh certificates not enabled for k8s ServiceAccount provisioners")
|
||||
}
|
||||
|
||||
return []SignOption{
|
||||
// modifiers / withOptions
|
||||
newProvisionerExtensionOption(TypeK8sSA, p.Name, ""),
|
||||
profileDefaultDuration(p.claimer.DefaultTLSCertDuration()),
|
||||
// validators
|
||||
defaultPublicKeyValidator{},
|
||||
newValidityValidator(p.claimer.MinTLSCertDuration(), p.claimer.MaxTLSCertDuration()),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// AuthorizeRenewal returns an error if the renewal is disabled.
|
||||
func (p *K8sSA) AuthorizeRenewal(cert *x509.Certificate) error {
|
||||
if p.claimer.IsDisableRenewal() {
|
||||
return errors.Errorf("renew is disabled for provisioner %s", p.GetID())
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
/*
|
||||
func checkAccess(authz kauthz.AuthorizationV1Interface) error {
|
||||
r := &kauthzApi.SelfSubjectAccessReview{
|
||||
Spec: kauthzApi.SelfSubjectAccessReviewSpec{
|
||||
ResourceAttributes: &kauthzApi.ResourceAttributes{
|
||||
Group: "authentication.k8s.io",
|
||||
Version: "v1",
|
||||
Resource: "tokenreviews",
|
||||
Verb: "create",
|
||||
},
|
||||
},
|
||||
}
|
||||
rvw, err := authz.SelfSubjectAccessReviews().Create(r)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !rvw.Status.Allowed {
|
||||
return fmt.Errorf("Unable to create kubernetes token reviews: %s", rvw.Status.Reason)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
*/
|
||||
@ -0,0 +1,264 @@
|
||||
package provisioner
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/x509"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
"github.com/smallstep/assert"
|
||||
"github.com/smallstep/cli/jose"
|
||||
)
|
||||
|
||||
func TestK8sSA_Getters(t *testing.T) {
|
||||
p, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
id := "k8ssa/" + p.Name
|
||||
if got := p.GetID(); got != id {
|
||||
t.Errorf("K8sSA.GetID() = %v, want %v", got, id)
|
||||
}
|
||||
if got := p.GetName(); got != p.Name {
|
||||
t.Errorf("K8sSA.GetName() = %v, want %v", got, p.Name)
|
||||
}
|
||||
if got := p.GetType(); got != TypeK8sSA {
|
||||
t.Errorf("K8sSA.GetType() = %v, want %v", got, TypeK8sSA)
|
||||
}
|
||||
kid, key, ok := p.GetEncryptedKey()
|
||||
if kid != "" || key != "" || ok == true {
|
||||
t.Errorf("K8sSA.GetEncryptedKey() = (%v, %v, %v), want (%v, %v, %v)",
|
||||
kid, key, ok, "", "", false)
|
||||
}
|
||||
}
|
||||
|
||||
func TestK8sSA_authorizeToken(t *testing.T) {
|
||||
type test struct {
|
||||
p *K8sSA
|
||||
token string
|
||||
err error
|
||||
}
|
||||
tests := map[string]func(*testing.T) test{
|
||||
"fail/bad-token": func(t *testing.T) test {
|
||||
p, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: "foo",
|
||||
err: errors.New("error parsing token"),
|
||||
}
|
||||
},
|
||||
"fail/error-validating-token": func(t *testing.T) test {
|
||||
jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
|
||||
assert.FatalError(t, err)
|
||||
p, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
tok, err := generateToken("", p.Name, testAudiences.Sign[0], "",
|
||||
[]string{"test.smallstep.com"}, time.Now(), jwk)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: tok,
|
||||
err: errors.New("error validating token and extracting claims"),
|
||||
}
|
||||
},
|
||||
"fail/invalid-issuer": func(t *testing.T) test {
|
||||
jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
|
||||
assert.FatalError(t, err)
|
||||
p, err := generateK8sSA(jwk.Public().Key)
|
||||
assert.FatalError(t, err)
|
||||
claims := getK8sSAPayload()
|
||||
claims.Claims.Issuer = "invalid"
|
||||
tok, err := generateK8sSAToken(jwk, claims)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: tok,
|
||||
err: errors.New("invalid token claims: square/go-jose/jwt: validation failed, invalid issuer claim (iss)"),
|
||||
}
|
||||
},
|
||||
"ok": func(t *testing.T) test {
|
||||
jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
|
||||
assert.FatalError(t, err)
|
||||
p, err := generateK8sSA(jwk.Public().Key)
|
||||
assert.FatalError(t, err)
|
||||
tok, err := generateK8sSAToken(jwk, nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: tok,
|
||||
}
|
||||
},
|
||||
}
|
||||
for name, tt := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
tc := tt(t)
|
||||
if claims, err := tc.p.authorizeToken(tc.token, testAudiences.Sign); err != nil {
|
||||
if assert.NotNil(t, tc.err) {
|
||||
assert.HasPrefix(t, err.Error(), tc.err.Error())
|
||||
}
|
||||
} else {
|
||||
if assert.Nil(t, tc.err) {
|
||||
assert.NotNil(t, claims)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestK8sSA_AuthorizeSign(t *testing.T) {
|
||||
type test struct {
|
||||
p *K8sSA
|
||||
token string
|
||||
ctx context.Context
|
||||
err error
|
||||
}
|
||||
tests := map[string]func(*testing.T) test{
|
||||
"fail/invalid-token": func(t *testing.T) test {
|
||||
p, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: "foo",
|
||||
err: errors.New("error parsing token"),
|
||||
}
|
||||
},
|
||||
"fail/ssh-unimplemented": func(t *testing.T) test {
|
||||
jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
|
||||
assert.FatalError(t, err)
|
||||
p, err := generateK8sSA(jwk.Public().Key)
|
||||
assert.FatalError(t, err)
|
||||
tok, err := generateK8sSAToken(jwk, nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
ctx: NewContextWithMethod(context.Background(), SignSSHMethod),
|
||||
token: tok,
|
||||
err: errors.Errorf("ssh certificates not enabled for k8s ServiceAccount provisioners"),
|
||||
}
|
||||
},
|
||||
"ok": func(t *testing.T) test {
|
||||
jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
|
||||
assert.FatalError(t, err)
|
||||
p, err := generateK8sSA(jwk.Public().Key)
|
||||
assert.FatalError(t, err)
|
||||
tok, err := generateK8sSAToken(jwk, nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
ctx: NewContextWithMethod(context.Background(), SignMethod),
|
||||
token: tok,
|
||||
}
|
||||
},
|
||||
}
|
||||
for name, tt := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
tc := tt(t)
|
||||
if opts, err := tc.p.AuthorizeSign(tc.ctx, tc.token); err != nil {
|
||||
if assert.NotNil(t, tc.err) {
|
||||
assert.HasPrefix(t, err.Error(), tc.err.Error())
|
||||
}
|
||||
} else {
|
||||
if assert.Nil(t, tc.err) {
|
||||
if assert.NotNil(t, opts) {
|
||||
tot := 0
|
||||
for _, o := range opts {
|
||||
switch v := o.(type) {
|
||||
case *provisionerExtensionOption:
|
||||
assert.Equals(t, v.Type, int(TypeK8sSA))
|
||||
assert.Equals(t, v.Name, tc.p.GetName())
|
||||
assert.Equals(t, v.CredentialID, "")
|
||||
assert.Len(t, 0, v.KeyValuePairs)
|
||||
case profileDefaultDuration:
|
||||
assert.Equals(t, time.Duration(v), tc.p.claimer.DefaultTLSCertDuration())
|
||||
case defaultPublicKeyValidator:
|
||||
case *validityValidator:
|
||||
assert.Equals(t, v.min, tc.p.claimer.MinTLSCertDuration())
|
||||
assert.Equals(t, v.max, tc.p.claimer.MaxTLSCertDuration())
|
||||
default:
|
||||
assert.FatalError(t, errors.Errorf("unexpected sign option of type %T", v))
|
||||
}
|
||||
tot++
|
||||
}
|
||||
assert.Equals(t, tot, 4)
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestK8sSA_AuthorizeRevoke(t *testing.T) {
|
||||
type test struct {
|
||||
p *K8sSA
|
||||
token string
|
||||
err error
|
||||
}
|
||||
tests := map[string]func(*testing.T) test{
|
||||
"fail/invalid-token": func(t *testing.T) test {
|
||||
p, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: "foo",
|
||||
err: errors.New("error parsing token"),
|
||||
}
|
||||
},
|
||||
"ok": func(t *testing.T) test {
|
||||
jwk, err := jose.GenerateJWK("EC", "P-256", "ES256", "sig", "", 0)
|
||||
assert.FatalError(t, err)
|
||||
p, err := generateK8sSA(jwk.Public().Key)
|
||||
assert.FatalError(t, err)
|
||||
tok, err := generateK8sSAToken(jwk, nil)
|
||||
assert.FatalError(t, err)
|
||||
return test{
|
||||
p: p,
|
||||
token: tok,
|
||||
}
|
||||
},
|
||||
}
|
||||
for name, tt := range tests {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
tc := tt(t)
|
||||
if err := tc.p.AuthorizeRevoke(tc.token); err != nil {
|
||||
if assert.NotNil(t, tc.err) {
|
||||
assert.HasPrefix(t, err.Error(), tc.err.Error())
|
||||
}
|
||||
} else {
|
||||
assert.Nil(t, tc.err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestK8sSA_AuthorizeRenewal(t *testing.T) {
|
||||
p1, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
p2, err := generateK8sSA(nil)
|
||||
assert.FatalError(t, err)
|
||||
|
||||
// disable renewal
|
||||
disable := true
|
||||
p2.Claims = &Claims{DisableRenewal: &disable}
|
||||
p2.claimer, err = NewClaimer(p2.Claims, globalProvisionerClaims)
|
||||
assert.FatalError(t, err)
|
||||
|
||||
type args struct {
|
||||
cert *x509.Certificate
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
prov *K8sSA
|
||||
args args
|
||||
wantErr bool
|
||||
}{
|
||||
{"ok", p1, args{nil}, false},
|
||||
{"fail", p2, args{nil}, true},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if err := tt.prov.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
|
||||
t.Errorf("X5C.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,5 @@
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIM8wGIzCKjAOGdBFmYHtS791Ly2I9FtmknEsR2sa63s7oAoGCCqGSM49
|
||||
AwEHoUQDQgAEGQIXbsr73X28pzwC1wa+ccY2H3s8PplbkapCrwxyYVvM78y/GmeS
|
||||
A7fv2MKQ8iKpCw461MlOQGX+VlWT+ChRFw==
|
||||
-----END EC PRIVATE KEY-----
|
||||
@ -0,0 +1,4 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGQIXbsr73X28pzwC1wa+ccY2H3s8
|
||||
PplbkapCrwxyYVvM78y/GmeSA7fv2MKQ8iKpCw461MlOQGX+VlWT+ChRFw==
|
||||
-----END PUBLIC KEY-----
|
||||
@ -0,0 +1,5 @@
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIB8ovUg0Atvz+b+XiF8QV722OivOm1geGtI3sP0F48N1oAoGCCqGSM49
|
||||
AwEHoUQDQgAEzriaeV2e1aEz33x62kyqVC6ootU7rl41L8cyeOJ4SjTu4FV+o5i4
|
||||
NsS6DCE07JJSHlqc9PsrzjSs4LZD4gWVLQ==
|
||||
-----END EC PRIVATE KEY-----
|
||||
@ -0,0 +1,4 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzriaeV2e1aEz33x62kyqVC6ootU7
|
||||
rl41L8cyeOJ4SjTu4FV+o5i4NsS6DCE07JJSHlqc9PsrzjSs4LZD4gWVLQ==
|
||||
-----END PUBLIC KEY-----
|
||||
Loading…
Reference in New Issue