Repository: elastic/go-libaudit
Pull request #62 (2020-05-13 20:36:06)

ECS normalization
So, unfortunately, the normalization file is pretty hard to review due to moving things around for the sake of ergonomics (i.e. ordering by similarly categorized events rather than alphabetically). Aside from the reorg and addition of ECS categorization fields--there is:

1. a bug fix with the way we were unmarshaling yaml that was breaking yaml anchor node behavior.
2. extending some of the normalization code, especially for compound events so that we have the associated syscall normalization information RE ECS categorization.
3. removing the following normalization rule, which AFAIK doesn't actually do anything due to us stripping the `AUDIT_` prefixes in our `GetAuditMessageType` code in the `auparse` subpackage.

```
  object:
    what: mac-config
  record_types:
  - AUDIT_DEV_ALLOC
  - AUDIT_DEV_DEALLOC
  - AUDIT_FS_RELABEL
  - AUDIT_USER_MAC_POLICY_LOAD
  - AUDIT_USER_MAC_CONFIG_CHANGE
```

andrewstucki: I know that the yaml manifest is pretty hard to review--but would be appreciative if you took a look @webmat -- it's not as straightforward as last round in `beats` itself--but it should implement all the stuff we talked about in your former review + some.

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 372eb51..84da0b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,5 @@
 # Change Log
+
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
@@ -12,6 +13,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 - Added support for big endian. #48
 - Added semantic versioning support via go modules. #61
+- Add ECS categorization support for events by record type and syscall. #62
 
 ### Removed
 
@@ -29,7 +31,6 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Removed
 
-
 ## [0.3.0]
 
 ### Added
@@ -75,12 +76,12 @@ This project adheres to [Semantic Versioning](http://semver.org/).
   PATH records. #20
 
 ## [0.0.7]
- 
+
 ### Added
 
 - Added WaitForPendingACKs to receive pending ACK messages from the kernel. #14
 - The AuditClient will unregister with the kernel if `SetPID` has been called. #19
- 
+
 ### Changed
 
 - auparse - Fixed an issue where the proctitle value was being truncated. #15
@@ -102,11 +103,13 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 ## [0.0.5]
 
 ### Changed
+
 - auparse - Apply hex decoding to CWD field. #10
 
 ## [0.0.4]
 
 ### Added
+
 - Add a package for building audit rules that can be added to the kernel.
 - Add GetRules, DeleteRules, DeleteRule, and AddRule methods to AuditClient.
 - auparse - Add conversion of POSIX exit code values to their name.
@@ -115,12 +118,14 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 ## [0.0.3]
 
 ### Added
+
 - auparse - Convert auid and session values of `4294967295` or `-1` to "unset". #5
 - auparse - Added `MarshallText` method to AuditMessageType to enable the value
   to be marshaled as a string in JSON. faabfa94ec9479bdc1ad6c0334ff178b8193fce5
 - aucoalesce - Enhanced aucoalesce to normalize events. 666ff1c30fe624e9fcd9a108b20fceb82331f5fa
 
 ### Changed
+
 - Rename RawAuditMessage fields `MessageType` and `RawData` to `Type` and
   `Data` respectively. 8622833714fccd7810669b1265df1c1f918ec0c4
 - Make Reassembler concurrency-safe. c57b59c20a684e2a6298a1a5929a79192d76d61b
@@ -134,6 +139,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 ## [0.0.2]
 
 ### Added
+
 - Added `libaudit.Reassembler` for reassembling out of order or interleaved
   messages and providing notification for lost events based on gaps in sequence
   numbers. a60bdd3b1b642cc80a3872d999114ae675456768
@@ -148,6 +154,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
   event. #1
 
 ### Changed
+
 - auparse - Changed the behavior of `ParseLogLine()` and `Parse()` to only parse
   the message header. To parse the message body, call `Data()` on the returned
   `AuditMessage`.
@@ -159,6 +166,7 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 ## [0.0.1]
 
 ### Added
+
 - Added AuditClient for communicating with the Linux Audit Framework in the
   Linux kernel.
 - Added auparse package for parsing audit logs.
diff --git a/README.md b/README.md
index 502fbdd..5c105c7 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,6 @@ The second is _auparse_ which parses the log files from the Linux auditd
 process or the output of the _audit_ example command. It combines related log
 messages that are a part of the same event.
 
-
 ```
 $ go install github.com/elastic/go-libaudit/cmd/auparse
 $ sudo cat /var/log/audit/audit.log | auparse
@@ -111,6 +110,12 @@ data:
   grantors: pam_env,pam_unix
   op: PAM:setcred
   terminal: /dev/pts/1
+ecs:
+  event:
+    category:
+    - authentication
+    type:
+    - info
 
 ---
 timestamp: 2016-12-07T02:22:14.303Z
@@ -148,6 +153,12 @@ data:
   grantors: pam_keyinit,pam_limits
   op: PAM:session_open
   terminal: /dev/pts/1
+ecs:
+  event:
+    category:
+    - authentication
+    type:
+    - info
 
 ---
 timestamp: 2016-12-07T02:22:14.304Z
@@ -250,4 +261,14 @@ paths:
   ogid: "0"
   ouid: "0"
   rdev: "00:00"
+ecs:
+  event:
+    category:
+    - process
+    type:
+    - start
 ```
+
+## ECS compatibility
+
+This currently provides [Elastic Common Schema (ECS) 1.5](https://www.elastic.co/guide/en/ecs/current/index.html) categorization support for some of the more prominent or meaningful auditd events and syscalls.
diff --git a/aucoalesce/coalesce.go b/aucoalesce/coalesce.go
index 068e00a..ce57c28 100644
--- a/aucoalesce/coalesce.go
+++ b/aucoalesce/coalesce.go
@@ -34,6 +34,13 @@ import (
 // package does not have a constant defined for this.
 const modeBlockDevice = 060000
 
+// ECSEvent contains ECS-specific categorization fields
+type ECSEvent struct {
+	Category []string `json:"category,omitempty" yaml:"category,omitempty"`
+	Type     []string `json:"type,omitempty" yaml:"type,omitempty"`
+	Outcome  string   `json:"outcome,omitempty" yaml:"outcome,omitempty"`
+}
+
 type Event struct {
 	Timestamp time.Time                `json:"@timestamp"       yaml:"timestamp"`
 	Sequence  uint32                   `json:"sequence"         yaml:"sequence"`
@@ -54,6 +61,10 @@ type Event struct {
 	Data  map[string]string   `json:"data,omitempty"  yaml:"data,omitempty"`
 	Paths []map[string]string `json:"paths,omitempty" yaml:"paths,omitempty"`
 
+	ECS struct {
+		Event ECSEvent `json:"event" yaml:"event"`
+	} `json:"ecs" yaml:"ecs"`
+
 	Warnings []error `json:"-" yaml:"-"`
 }
 
@@ -427,10 +438,17 @@ func addFieldsToEventData(msg *auparse.AuditMessage, event *Event) {
 func applyNormalization(event *Event) {
 	setHowDefaults(event)
 
+	var syscallNorm *Normalization
+	if syscall, ok := event.Data["syscall"]; ok {
+		syscallNorm, ok = syscallNorms[syscall]
+		if !ok {
+			syscallNorm = syscallNorms["*"] // get the default to add some basic categorization
+		}
+	}
+
 	var norm *Normalization
 	if event.Type == auparse.AUDIT_SYSCALL {
-		syscall := event.Data["syscall"]
-		norm = syscallNorms[syscall]
+		norm = syscallNorm
 	} else {
 		norms := recordTypeNorms[event.Type.String()]
 		switch len(norms) {
@@ -454,6 +472,23 @@ func applyNormalization(event *Event) {
 		return
 	}
 
+	event.ECS.Event.Category = norm.ECS.Category.Values
+	event.ECS.Event.Type = norm.ECS.Type.Values
+
+	// we check to see if the non-AUDIT_SYSCALL event has an associated syscall
+	// from another part of the auditd message log, if it does and we have normalizations
+	// for that syscall, we merge the ECS categorization and type information so that
+	// the event has both enrichment for the record type itself and for the syscall it
+	// captures
+	hasAdditionalNormalization := syscallNorm != nil && syscallNorm != norm
+	if hasAdditionalNormalization {
+		event.ECS.Event.Category = append(event.ECS.Event.Category, syscallNorm.ECS.Category.Values...)
+		event.ECS.Event.Type = append(event.ECS.Event.Type, syscallNorm.ECS.Type.Values...)
+		if event.Result == "fail" {
+			event.ECS.Event.Outcome = "failure"
+		}
+	}
+
 	event.Summary.Action = norm.Action
 
 	switch norm.Object.What {
diff --git a/aucoalesce/normalizations.yaml b/aucoalesce/normalizations.yaml
index 622cf51..4162f0d 100644
--- a/aucoalesce/normalizations.yaml
+++ b/aucoalesce/normalizations.yaml
@@ -2,36 +2,66 @@
 # Macros declares some YAML anchors that can be referenced for some common
 # object type normalizations like user-session, socket, or process.
 macros:
-- &defaults
-  subject:
-    primary: auid
-    secondary: uid
-  how: [exe, comm]
-
-- &macro-user-session
-  subject:
-    primary: auid
-    secondary: [acct, id, uid]
-  object:
-    primary: terminal
-    secondary: [addr, hostname]
-    what: user-session
-  how: [exe, terminal]
-
-- &macro-socket
-  <<: *defaults
-  object:
-    primary: [addr, path]
-    secondary: port
-    what: socket
-
-- &macro-process
-  <<: *defaults
-  object:
-    primary: [cmd, exe, comm]
-    secondary: pid
-    what: process
-  how: terminal
+  - &defaults
+    subject:
+      primary: auid
+      secondary: uid
+    how: [exe, comm]
+
+  - &macro-user-session
+    subject:
+      primary: auid
+      secondary: [acct, id, uid]
+    object:
+      primary: terminal
+      secondary: [addr, hostname]
+      what: user-session
+    how: [exe, terminal]
+
+  - &macro-socket
+    <<: *defaults
+    object:
+      primary: [addr, path]
+      secondary: port
+      what: socket
+
+  - &macro-process
+    <<: *defaults
+    object:
+      primary: [cmd, exe, comm]
+      secondary: pid
+      what: process
+    how: terminal
+
+  - &ecs-iam
+    category: iam
+    type: info
+
+  - &ecs-auth
+    category: authentication
+    type: info
+
+  - &ecs-host
+    category: host
+    type: info
+
+  - &ecs-process
+    category: process
+    type: info
+
+  - &ecs-file
+    category: file
+    type: info
+
+  - &ecs-driver
+    category: driver
+    type: info
+
+  - &ecs-network
+    category: network
+    type:
+      - connection
+      - info
 
 # Normalizations is a list of declarations specifying how to normalize the data
 # contained in an event. The normalization can be applied based on the syscall
@@ -45,708 +75,1492 @@ macros:
 #   object - what was the "thing" involved in the action (e.g. process, socket)
 #   how    - how was the action performed (e.g. exe or terminal)
 normalizations:
--
-  action: opened-file
-  object:
-    what: file
-  syscalls:
-  - creat
-  - fallocate
-  - truncate
-  - ftruncate
-  - open
-  - openat
-  - readlink
-  - readlinkat
--
-  action: changed-file-attributes-of
-  object:
-    what: file
-  syscalls:
-  - setxattr
-  - fsetxattr
-  - lsetxattr
-  - removexattr
-  - fremovexattr
-  - lremovexattr
--
-  action: changed-file-permissions-of
-  object:
-    what: file
-  syscalls:
-  - chmod
-  - fchmod
-  - fchmodat
--
-  action: changed-file-ownership-of
-  object:
-    what: file
-  syscalls:
-  - chown
-  - fchown
-  - fchownat
-  - lchown
--
-  action: loaded-kernel-module
-  object:
-    what: file
-    primary: name
-  record_types:
-  - KERN_MODULE
-  syscalls:
-  - finit_module
-  - init_module
--
-  action: unloaded-kernel-module
-  object:
-    what: file
-  syscalls:
-  - delete_module
--
-  action: created-directory
-  object:
-    what: file
-    path_index: 1
-  syscalls:
-  - mkdir
-  - mkdirat
--
-  action: mounted
-  object:
-    what: filesystem
-    path_index: 1
-  syscalls:
-  - mount
--
-  action: renamed
-  object:
-    what: file
-    path_index: 2
-  syscalls:
-  - rename
-  - renameat
-  - renameat2
--
-  action: checked-metadata-of
-  object:
-    what: file
-  syscalls:
-  - access
-  - faccessat
-  - newfstatat
-  - stat
-  - fstat
-  - lstat
-  - stat64
-  - getxattr
-  - lgetxattr
-  - fgetxattr
--
-  action: checked-filesystem-metadata-of
-  object:
-    what: filesystem
-  syscalls:
-  - statfs
-  - fstatfs
--
-  action: symlinked
-  object:
-    what: file
-  syscalls:
-  - symlink
-  - symlinkat
--
-  action: unmounted
-  object:
-    what: filesystem
-  syscalls:
-  - umount2
--
-  action: deleted
-  object:
-    what: file
-  syscalls:
-  - rmdir
-  - unlink
-  - unlinkat
--
-  action: changed-timestamp-of
-  object:
-    what: file
-  syscalls:
-  - utime
-  - utimes
-  - futimesat
-  - futimens
-  - utimensat
--
-  action: executed
-  object:
-    what: file
-  syscalls:
-  - execve
-  - execveat
--
-  action: listen-for-connections
-  object:
-    what: socket
-  syscalls:
-  - listen
--
-  action: accepted-connection-from
-  object:
-    what: socket
-  syscalls:
-  - accept
-  - accept4
--
-  action: bound-socket
-  object:
-    what: socket
-  syscalls:
-  - bind
--
-  action: connected-to
-  object:
-    what: socket
-  syscalls:
-  - connect
--
-  action: received-from
-  object:
-    what: socket
-  syscalls:
-  - recvfrom
-  - recvmsg
--
-  action: sent-to
-  object:
-    what: socket
-  syscalls:
-  - sendto
-  - sendmsg
--
-  action: killed-pid
-  object:
-    what: process
-  syscalls:
-  - kill
-  - tkill
-  - tgkill
--
-  action: changed-identity-of
-  object:
-    what: process
-  how: syscall
-  syscalls:
-  - setuid
-  - seteuid
-  - setfsuid
-  - setreuid
-  - setresuid
-  - setgid
-  - setegid
-  - setfsgid
-  - setregid
-  - setresgid
--
-  action: changed-system-time
-  object:
-    what: system
-  syscalls:
-  - settimeofday
-  - clock_settime
-  - stime
-  - adjtimex
--
-  action: make-device
-  object:
-    what: file
-  syscalls:
-  - mknod
-  - mknodat
--
-  action: changed-system-name
-  object:
-    what: system
-  syscalls:
-  - sethostname
-  - setdomainname
--
-  action: allocated-memory
-  object:
-    what: memory
-  syscalls:
-  - mmap
-  - brk
--
-  action: adjusted-scheduling-policy-of
-  object:
-    what: process
-  how: syscall
-  syscalls:
-  - sched_setparam
-  - sched_setscheduler
-  - sched_setattr
--
-  action: caused-mac-policy-error
-  object:
-    what: system
-  record_types: SELINUX_ERR
--
-  action: loaded-firewall-rule-to
-  object:
-    primary: table
-    what: firewall
-  record_types: NETFILTER_CFG
--
-  # Could be entered or exited based on prom field.
-  action: changed-promiscuous-mode-on-device
-  object:
-    primary: dev
-    what: network-device
-  record_types: ANOM_PROMISCUOUS
--
-  action: locked-account
-  record_types: ACCT_LOCK
--
-  action: unlocked-account
-  record_types: ACCT_UNLOCK
--
-  action: added-group-account-to
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: ADD_GROUP
--
-  action: added-user-account
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: ADD_USER
--
-  action: crashed-program
-  object:
-    primary: [comm, exe]
-    secondary: pid
-    what: process
-  how: sig
-  record_types: ANOM_ABEND
--
-  action: attempted-execution-of-forbidden-program
-  object:
-    primary: cmd
-    what: process
-  how: terminal
-  record_types: ANOM_EXEC
--
-  action: used-suspcious-link
-  record_types: ANOM_LINK
--
-  <<: *macro-user-session
-  action: failed-log-in-too-many-times-to
-  record_types: ANOM_LOGIN_FAILURES
--
-  <<: *macro-user-session
-  action: attempted-log-in-from-unusual-place-to
-  record_types: ANOM_LOGIN_LOCATION
--
-  <<: *macro-user-session
-  action: opened-too-many-sessions-to
-  record_types: ANOM_LOGIN_SESSIONS
--
-  <<: *macro-user-session
-  action: attempted-log-in-during-unusual-hour-to
-  record_types: ANOM_LOGIN_TIME
--
-  action: tested-file-system-integrity-of
-  object:
-    primary: hostname
-    what: filesystem
-  record_types: ANOM_RBAC_INTEGRITY_FAIL
--
-  action: violated-selinux-policy
-  subject:
-    primary: scontext
-  object:
-    primary: tcontext
-    secondary: tclass
-  record_types: AVC
-  has_fields:
-  - seresult
--
-  action: violated-apparmor-policy
-  object:
-    primary: operation
-    secondary: [requested_mask, denied_mask, capname]
-    what: policy
-  record_types: AVC
-  has_fields:
-  - apparmor
--
-  action: changed-group
-  record_types: CHGRP_ID
--
-  action: changed-user-id
-  record_types: CHUSER_ID
--
-  action: changed-audit-configuration
-  object:
-    primary: [op, key, audit_enabled, audit_pid, audit_backlog_limit, audit_failure]
-    what: audit-config
-  record_types: CONFIG_CHANGE
--
-  <<: *macro-user-session
-  action: acquired-credentials
-  record_types: CRED_ACQ
--
-  <<: *macro-user-session
-  action: disposed-credentials
-  record_types: CRED_DISP
--
-  <<: *macro-user-session
-  action: refreshed-credentials
-  record_types: CRED_REFR
--
-  <<: *macro-user-session
-  action: negotiated-crypto-key
-  object:
-    primary: fp
-    secondary: [addr, hostname]
-    what: user-session
-  record_types: CRYPTO_KEY_USER
-  source_ip: [addr]
--
-  action: crypto-officer-logged-in
-  record_types: CRYPTO_LOGIN
--
-  action: crypto-officer-logged-out
-  record_types: CRYPTO_LOGOUT
--
-  <<: *macro-user-session
-  action: started-crypto-session
-  object:
-    primary: addr
-    secondary: [rport]
-  record_types: CRYPTO_SESSION
-  source_ip: [addr]
--
-  action: access-result
-  record_types: DAC_CHECK
--
-  action: aborted-auditd-startup
-  object:
-    what: service
-  record_types: DAEMON_ABORT
--
-  action: remote-audit-connected
-  object:
-    what: service
-  record_types: DAEMON_ACCEPT
--
-  action: remote-audit-disconnected
-  object:
-    what: service
-  record_types: DAEMON_CLOSE
--
-  action: changed-auditd-configuration
-  object:
-    what: service
-  record_types: DAEMON_CONFIG
--
-  action: shutdown-audit
-  object:
-    what: service
-  record_types: DAEMON_END
--
-  action: audit-error
-  object:
-    what: service
-  record_types: DAEMON_ERR
--
-  action: reconfigured-auditd
-  object:
-    what: service
-  record_types: DAEMON_RECONFIG
--
-  action: resumed-audit-logging
-  object:
-    what: service
-  record_types: DAEMON_RESUME
--
-  action: rotated-audit-logs
-  object:
-    what: service
-  record_types: DAEMON_ROTATE
--
-  action: started-audit
-  object:
-    what: service
-  record_types: DAEMON_START
--
-  action: deleted-group-account-from
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: DEL_GROUP
--
-  action: deleted-user-account
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: DEL_USER
--
-  action: changed-audit-feature
-  object:
-    primary: feature
-    what: system
-  record_types: FEATURE_CHANGE
--
-  action: relabeled-filesystem
-  record_types: FS_RELABEL
--
-  action: authenticated-to-group
-  record_types: GRP_AUTH
--
-  <<: *macro-user-session
-  action: changed-group-password
-  object:
-    primary: acct
-    what: user-session
-  record_types: GRP_CHAUTHTOK
--
-  action: modified-group-account
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: GRP_MGMT
--
-  action: initialized-audit-subsystem
-  record_types: KERNEL
--
-  action: modified-level-of
-  object:
-    primary: printer
-    what: printer
-  record_types: LABEL_LEVEL_CHANGE
--
-  action: overrode-label-of
-  object:
-    what: mac-config
-  record_types: LABEL_OVERRIDE
--
-  object:
-    what: mac-config
-  record_types:
-  - AUDIT_DEV_ALLOC
-  - AUDIT_DEV_DEALLOC
-  - AUDIT_FS_RELABEL
-  - AUDIT_USER_MAC_POLICY_LOAD
-  - AUDIT_USER_MAC_CONFIG_CHANGE
--
-  action: changed-login-id-to
-  subject:
-    primary: [old_auid, old-auid]
-    secondary: uid
-  object:
-    primary: auid
-    what: user-session
-  record_types: LOGIN
--
-  action: mac-permission
-  record_types: MAC_CHECK
--
-  action: changed-selinux-boolean
-  object:
-    primary: bool
-    what: mac-config
-  record_types: MAC_CONFIG_CHANGE
--
-  action: loaded-selinux-policy
-  object:
-    what: mac-config
-  record_types: MAC_POLICY_LOAD
--
-  action: changed-selinux-enforcement
-  object:
-    primary: enforcing
-    what: mac-config
-  record_types: MAC_STATUS
--
-  action: assigned-user-role-to
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: ROLE_ASSIGN
--
-  action: modified-role
-  record_types: ROLE_MODIFY
--
-  action: removed-use-role-from
-  object:
-    primary: [id, acct]
-    what: account
-  record_types: ROLE_REMOVE
--
-  action: violated-seccomp-policy
-  object:
-    primary: syscall
-    what: process
-  record_types: SECCOMP
--
-  action: started-service
-  object:
-    primary: unit
-    what: service
-  record_types: SERVICE_START
--
-  action: stopped-service
-  object:
-    primary: unit
-    what: service
-  record_types: SERVICE_STOP
--
-  action: booted-system
-  object:
-    what: system
-  record_types: SYSTEM_BOOT
--
-  action: changed-to-runlevel
-  object:
-    primary: new-level
-    what: system
-  record_types: SYSTEM_RUNLEVEL
--
-  action: shutdown-system
-  object:
-    what: system
-  record_types: SYSTEM_SHUTDOWN
--
-  action: sent-test
-  record_types: TEST
--
-  action: unknown
-  record_types: TRUSTED_APP
--
-  action: sent-message
-  object:
-    primary: addr
-  record_types: USER
--
-  <<: *macro-user-session
-  action: was-authorized
-  record_types: USER_ACCT
--
-  <<: *macro-user-session
-  action: authenticated
-  record_types: USER_AUTH
--
-  action: access-permission
-  record_types: USER_AVC
--
-  <<: *macro-user-session
-  action: changed-password
-  record_types: USER_CHAUTHTOK
--
-  action: ran-command
-  object:
-    primary: cmd
-    what: process
-  record_types: USER_CMD
-  description: >
-    These messages are from user-space apps, like sudo, that log commands
-    being run by a user. The uid contained in these messages is user's UID at
-    the time the command was run. It is not the "target" UID used to run the
-    command, which is normally root.
--
-  <<: *macro-user-session
-  action: ended-session
-  record_types: USER_END
--
-  <<: *macro-user-session
-  action: error
-  record_types: USER_ERR
-  source_ip: [addr]
--
-  <<: *macro-user-session
-  action: logged-in
-  record_types: USER_LOGIN
-  source_ip: [addr]
--
-  <<: *macro-user-session
-  action: logged-out
-  record_types: USER_LOGOUT
--
-  action: changed-mac-configuration
-  record_types: USER_MAC_CONFIG_CHANGE
--
-  action: loaded-mac-policy
-  record_types: USER_MAC_POLICY_LOAD
--
-  <<: *macro-user-session
-  action: modified-user-account
-  record_types: USER_MGMT
--
-  <<: *macro-user-session
-  action: changed-role-to
-  object:
-    primary: selected-context
-    what: user-session
-  record_types: USER_ROLE_CHANGE
--
-  action: access-error
-  record_types: USER_SELINUX_ERR
--
-  <<: *macro-user-session
-  action: started-session
-  record_types: USER_START
-  source_ip: [addr]
--
-  action: changed-configuration
-  object:
-    primary: op
-    what: system
-  record_types: USYS_CONFIG
--
-  action: issued-vm-control
-  object:
-    primary: op
-    secondary: vm
-    what: virtual-machine
-  record_types: VIRT_CONTROL
--
-  action: created-vm-image
-  record_types: VIRT_CREATE
--
-  action: deleted-vm-image
-  record_types: VIRT_DESTROY
--
-  action: checked-integrity-of
-  record_types: VIRT_INTEGRITY_CHECK
--
-  action: assigned-vm-id
-  object:
-    primary: vm
-    what: virtual-machine
-  record_types: VIRT_MACHINE_ID
--
-  action: migrated-vm-from
-  record_types: VIRT_MIGRATE_IN
--
-  action: migrated-vm-to
-  record_types: VIRT_MIGRATE_OUT
--
-  action: assigned-vm-resource
-  object:
-    primary: resrc
-    secondary: vm
-    what: virtual-machine
-  record_types: VIRT_RESOURCE
-- action: typed
-  object:
-    primary: data
-    what: keystrokes
-  how: [comm, exe]
-  record_types:
-  - TTY
-  - USER_TTY
+  - ecs: *ecs-process
+    syscalls:
+      - '*' # this is a catch all
+  - action: opened-file
+    object:
+      what: file
+    syscalls:
+      # creat - open and possibly create a file
+      - creat
+    ecs:
+      <<: *ecs-file
+      type: creation
+  - action: opened-file
+    object:
+      what: file
+    syscalls:
+      # fallocate - manipulate file space
+      - fallocate
+      # truncate - truncate a file to a specified length
+      - truncate
+      # ftruncate - truncate a file to a specified length
+      - ftruncate
+    ecs:
+      <<: *ecs-file
+      # technically you can truncate a file to the same length
+      # but regardless, we consider this a change
+      type: change
+  - action: opened-file
+    object:
+      what: file
+    syscalls:
+      # open - open and possibly create a file
+      - open
+      # openat - open and possibly create a file
+      - openat
+      # readlink - read value of a symbolic link
+      - readlink
+      # readlinkat - read value of a symbolic link
+      - readlinkat
+    ecs: *ecs-file
+  - action: read-file
+    object:
+      what: file
+    syscalls:
+      # read - read from a file descriptor
+      - read
+    ecs: *ecs-file
+  - action: wrote-to-file
+    object:
+      what: file
+    syscalls:
+      # write - write to a file descriptor
+      - write
+    ecs:
+      <<: *ecs-file
+      type: change
+  - action: changed-file-attributes-of
+    object:
+      what: file
+    syscalls:
+      # setxattr - set an extended attribute value
+      - setxattr
+      # fsetxattr - set an extended attribute value
+      - fsetxattr
+      # lsetxattr - set an extended attribute value
+      - lsetxattr
+      # removexattr - remove an extended attribute
+      - removexattr
+      # fremovexattr - remove an extended attribute
+      - fremovexattr
+      # lremovexattr - remove an extended attribute
+      - lremovexattr
+    ecs:
+      <<: *ecs-file
+      type: change
+  - action: changed-file-permissions-of
+    object:
+      what: file
+    syscalls:
+      # chmod - change permissions of a file
+      - chmod
+      # fchmod - change permissions of a file
+      - fchmod
+      # fchmodat - change permissions of a file
+      - fchmodat
+    ecs:
+      <<: *ecs-file
+      type: change
+  - action: changed-file-ownership-of
+    object:
+      what: file
+    syscalls:
+      # chown - change ownership of a file
+      - chown
+      # fchown - change ownership of a file
+      - fchown
+      # fchownat - change ownership of a file
+      - fchownat
+      # lchown - change ownership of a file
+      - lchown
+    ecs:
+      <<: *ecs-file
+      type: change
+  - action: loaded-kernel-module
+    object:
+      what: file
+      primary: name
+    record_types:
+      - KERN_MODULE
+    syscalls:
+      # finit_module - load a kernel module
+      - finit_module
+      # init_module - load a kernel module
+      - init_module
+    ecs:
+      <<: *ecs-driver
+      type: start
+  - action: unloaded-kernel-module
+    object:
+      what: file
+    syscalls:
+      # delete_module - unload a kernel module
+      - delete_module
+    ecs:
+      <<: *ecs-driver
+      type: end
+  - action: created-directory
+    object:
+      what: file
+      path_index: 1
+    syscalls:
+      # mkdir - create a directory
+      - mkdir
+      # mkdirat - create a directory
+      - mkdirat
+    ecs:
+      <<: *ecs-file
+      type: creation
+  - action: mounted
+    object:
+      what: filesystem
+      path_index: 1
+    syscalls:
+      # mount - mount filesystem
+      - mount
+    ecs:
+      <<: *ecs-file
+      # since a new mount appears on the system
+      # we consider this a high-level "creation" event
+      type: creation
+  - action: renamed
+    object:
+      what: file
+      path_index: 2
+    syscalls:
+      # rename - change the name or location of a file
+      - rename
+      # renameat - change the name or location of a file
+      - renameat
+      # renameat2 - change the name or location of a file
+      - renameat2
+    ecs:
+      <<: *ecs-file
+      type: change
+  - action: checked-metadata-of
+    object:
+      what: file
+    syscalls:
+      # access - check user's permissions for a file
+      - access
+      # faccessat - check user's permissions for a file
+      - faccessat
+      # fstatat - get file status
+      - fstatat
+      # newfstatat - get file status
+      - newfstatat
+      # stat - get file status
+      - stat
+      # stat64 - get file status
+      - stat64
+      # fstat - get file status
+      - fstat
+      # lstat - get file status
+      - lstat
+      # getxattr - retrieve an extended attribute value
+      - getxattr
+      # lgetxattr - retrieve an extended attribute value
+      - lgetxattr
+      # fgetxattr - retrieve an extended attribute value
+      - fgetxattr
+    ecs: *ecs-file
+  - action: checked-filesystem-metadata-of
+    object:
+      what: filesystem
+    syscalls:
+      # statfs - get filesystem statistics
+      - statfs
+      # fstatfs - get filesystem statistics
+      - fstatfs
+    ecs: *ecs-file
+  - action: symlinked
+    object:
+      what: file
+    syscalls:
+      # symlink - make a new name for a file
+      - symlink
+      # symlinkat - make a new name for a file
+      - symlinkat
+    ecs:
+      <<: *ecs-file
+      # "creation" since we're creating a new file system
+      # entry for the symlink
+      type: creation
+  - action: unmounted
+    object:
+      what: filesystem
+    syscalls:
+      # umount - unmount filesystem
+      - umount
+      # umount2 - unmount filesystem
+      - umount2
+    ecs:
+      <<: *ecs-file
+      # "deletion" to mirror the "creation" of the mount
+      type: deletion
+  - action: deleted
+    object:
+      what: file
+    syscalls:
+      # rmdir - delete a directory
+      - rmdir
+      # unlink - delete a name and possibly the file it refers to
+      - unlink
+      # unlinkat - delete a name and possibly the file it refers to
+      - unlinkat
+    ecs:
+      <<: *ecs-file
+      type: deletion
+  - action: changed-timestamp-of
+    object:
+      what: file
+    syscalls:
+      # utime - change file last access and modification times
+      - utime
+      # utimes - change file last access and modification times
+      - utimes
+      # futimesat - change timestamps of a file relative to a \ directory file descriptor
+      - futimesat
+      # futimens - change file timestamps with nanosecond precision
+      - futimens
+      # utimensat - change file timestamps with nanosecond precision
+      - utimensat
+    ecs: *ecs-file
+  - action: executed
+    object:
+      what: file
+    syscalls:
+      # execve - execute program
+      - execve
+      # execveat - execute program relative to a directory file descriptor
+      - execveat
+    ecs:
+      <<: *ecs-process
+      type: start
+  - action: listen-for-connections
+    object:
+      what: socket
+    syscalls:
+      # listen- listen for connections on a socket
+      - listen
+    ecs:
+      <<: *ecs-network
+      type: start
+  - action: accepted-connection-from
+    object:
+      what: socket
+    syscalls:
+      # accept - accept a connection on a socket
+      - accept
+      # accept4 - accept a connection on a socket
+      - accept4
+    ecs:
+      <<: *ecs-network
+      type:
+        - connection
+        - start
+  - action: bound-socket
+    object:
+      what: socket
+    syscalls:
+      # bind -bind a name to a socket
+      - bind
+    ecs:
+      <<: *ecs-network
+      type: start
+  - action: connected-to
+    object:
+      what: socket
+    syscalls:
+      - connect
+    ecs:
+      <<: *ecs-network
+      type:
+        - connection
+        - start
+  - action: received-from
+    object:
+      what: socket
+    syscalls:
+      # recv - receive a message from a socket
+      - recv
+      # recvfrom - receive a message from a socket
+      - recvfrom
+      # recvmsg - receive a message from a socket
+      - recvmsg
+      # recvmmsg - receive multiple messages on a socket
+      - recvmmsg
+    ecs:
+      <<: *ecs-network
+  - action: sent-to
+    object:
+      what: socket
+    syscalls:
+      # send - send a message on a socket
+      - send
+      # sendto - send a message on a socket
+      - sendto
+      # sendmsg - send a message on a socket
+      - sendmsg
+      # sendmmsg - send multiple messages on a socket
+      - sendmmsg
+    ecs:
+      <<: *ecs-network
+  - action: killed-pid
+    object:
+      what: process
+    syscalls:
+      # kill - send signal to a process
+      - kill
+      # tkill - send a signal to a thread
+      - tkill
+      # tgkill - send a signal to a thread
+      - tgkill
+    ecs:
+      <<: *ecs-process
+      type: end
+  - action: changed-identity-of
+    object:
+      what: process
+    how: syscall
+    syscalls:
+      # setuid - set user identity
+      - setuid
+      # seteuid - set effective user or group ID
+      - seteuid
+      # setfsuid - set user identity used for filesystem checks
+      - setfsuid
+      # setreuid - set real and/or effective user or group ID
+      - setreuid
+      # setgid - set group identity
+      - setgid
+      # setegid - set effective user or group ID
+      - setegid
+      # setfsgid - set group identity used for filesystem checks
+      - setfsgid
+      # setregid - set real and/or effective user or group ID
+      - setregid
+      # setresuid - set real, effective and saved user or group ID
+      - setresuid
+      # setresgid - set real, effective and saved user or group ID
+      - setresgid
+    ecs:
+      <<: *ecs-process
+      type: change
+  - action: changed-system-time
+    object:
+      what: system
+    syscalls:
+      # settimeofday - get / set time
+      - settimeofday
+      # clock_settime - clock and time functions
+      - clock_settime
+      # stime - set time
+      - stime
+      # adjtimex - tune kernel clock
+      - adjtimex
+    ecs:
+      <<: *ecs-host
+      type: change
+  - action: make-device
+    object:
+      what: file
+    syscalls:
+      # mknod - create a special or ordinary file
+      - mknod
+      # mknodat - create a special or ordinary file
+      - mknodat
+    ecs:
+      <<: *ecs-file
+      type: creation
+  - action: changed-system-name
+    object:
+      what: system
+    syscalls:
+      # sethostname - get/set hostname
+      - sethostname
+      # setdomainname - get/set NIS domain name
+      - setdomainname
+    ecs:
+      <<: *ecs-host
+      type: change
+  - action: allocated-memory
+    object:
+      what: memory
+    syscalls:
+      # mmap - map or unmap files or devices into memory
+      - mmap
+      # mmap2 - map files or devices into memory
+      - mmap2
+      # brk - change data segment size
+      - brk
+    ecs: *ecs-process
+  - action: adjusted-scheduling-policy-of
+    object:
+      what: process
+    how: syscall
+    syscalls:
+      # sched_setparam - set and get scheduling parameters
+      - sched_setparam
+      # sched_setscheduler - set and get scheduling policy/parameters
+      - sched_setscheduler
+      # sched_setattr - set and get scheduling policy and attributes
+      - sched_setattr
+    ecs:
+      <<: *ecs-process
+      type: change
+
+  # Currently unhandled
+  # this list comes from parsing linux man pages at https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git
+
+  # sigaction - examine and change a signal action
+  # rt_sigaction - examine and change a signal action
+  # pread - read from or write to a file descriptor at a given offset
+  # pwrite - read from or write to a file descriptor at a given offset
+  # s390_guarded_storage - operations with z/Architecture guarded storage facility
+  # sched_getattr - set and get scheduling policy and attributes
+  # getrusage - get resource usage
+  # flock - apply or remove an advisory lock on an open file
+  # pidfd_getfd - obtain a duplicate of another process's file descriptor
+  # clock_nanosleep - high-resolution sleep with specifiable clock
+  # getpagesize - get memory page size
+  # pidfd_open - obtain a file descriptor that refers to a process
+  # splice - splice data to/from a pipe
+  # getresuid - get real, effective and saved user/group IDs
+  # getresgid - get real, effective and saved user/group IDs
+  # remap_file_pages - create a nonlinear file mapping
+  # io_cancel - cancel an outstanding asynchronous I/O operation
+  # prctl - operations on a process or thread
+  # clock_getres - clock and time functions
+  # clock_gettime - clock and time functions
+  # getgroups - get/set list of supplementary group IDs
+  # setgroups - get/set list of supplementary group IDs
+  # vmsplice - splice user pages to/from a pipe
+  # epoll_create - open an epoll file descriptor
+  # epoll_create1 - open an epoll file descriptor
+  # posix_fadvise - predeclare an access pattern for file data
+  # sigwaitinfo - synchronously wait for queued signals
+  # sigtimedwait - synchronously wait for queued signals
+  # rt_sigtimedwait - synchronously wait for queued signals
+  # sigreturn - return from signal handler and cleanup stack frame
+  # rt_sigreturn - return from signal handler and cleanup stack frame
+  # getrandom - obtain a series of random bytes
+  # keyctl - manipulate the kernel's key management facility
+  # sched_getscheduler - set and get scheduling policy/parameters
+  # mbind - set memory policy for a memory range
+  # getpriority - get/set program scheduling priority
+  # setpriority - get/set program scheduling priority
+  # inotify_init - initialize an inotify instance
+  # inotify_init1 - initialize an inotify instance
+  # semctl - System V semaphore control operations
+  # gethostname - get/set hostname
+  # ptrace - process trace
+  # sysctl - read/write system parameters
+  # getpeername - get name of connected peer socket
+  # fork - create a child process
+  # query_module - query the kernel for various bits pertaining to modules
+  # ioctl_list - list of ioctl calls in Linux/i386 kernel
+  # msgget - get a System V message queue identifier
+  # spu_create - create a new spu context
+  # subpage_prot - define a subpage protection for an address range
+  # quotactl - manipulate disk quotas
+  # nfsservctl - syscall interface to kernel nfs daemon
+  # openat2 - open and possibly create a file (extended)
+  # getrlimit - get/set resource limits
+  # setrlimit - get/set resource limits
+  # prlimit - get/set resource limits
+  # tee - duplicating pipe content
+  # shmget - allocates a System V shared memory segment
+  # create_module - create a loadable module entry
+  # gettimeofday - get / set time
+  # timer_create - create a POSIX per-process timer
+  # fanotify_mark - add, remove, or modify an fanotify mark on a filesystem object
+  # pipe - create pipe
+  # pipe2 - create pipe
+  # intro - introduction to system calls
+  # lookup_dcookie - return a directory entry's path
+  # sysfs - get filesystem type information
+  # s390_runtime_instr - enable/disable s390 CPU run-time instrumentation
+  # setns - reassociate thread with a namespace
+  # set_mempolicy - set default NUMA memory policy for a thread and its children
+  # nice - change process priority
+  # io_setup - create an asynchronous I/O context
+  # mincore - determine whether pages are resident in memory
+  # ioctl_console - ioctls for console terminal and virtual consoles
+  # poll - wait for some event on a file descriptor
+  # ppoll - wait for some event on a file descriptor
+  # capget - set/get capabilities of thread(s)
+  # capset - set/get capabilities of thread(s)
+  # ioctl_tty - ioctls for terminals and serial lines
+  # iopl - change I/O privilege level
+  # io_getevents - read asynchronous I/O events from the completion queue
+  # process_vm_readv - transfer data between process address spaces
+  # process_vm_writev - transfer data between process address spaces
+  # pciconfig_read - pci device information handling
+  # pciconfig_write - pci device information handling
+  # pciconfig_iobase - pci device information handling
+  # sbrk - change data segment size
+  # set_tid_address - set pointer to thread ID
+  # pkey_alloc - allocate or free a protection key
+  # pkey_free - allocate or free a protection key
+  # select - synchronous I/O multiplexing
+  # pselect - synchronous I/O multiplexing
+  # kexec_load - load a new kernel for later execution
+  # kexec_file_load - load a new kernel for later execution
+  # personality - set the process execution domain
+  # ioctl_getfsmap - retrieve the physical layout of the filesystem
+  # inotify_rm_watch - remove an existing watch from an inotify instance
+  # perf_event_open - set up performance monitoring
+  # timer_getoverrun - get overrun count for a POSIX per-process timer
+  # wait3 - wait for process to change state, BSD style
+  # wait4 - wait for process to change state, BSD style
+  # link - make a new name for a file
+  # linkat - make a new name for a file
+  # sched_rr_get_interval - get the SCHED_RR interval for the named process
+  # munmap - map or unmap files or devices into memory
+  # socketcall - socket system calls
+  # mremap - remap a virtual memory address
+  # vfork - create a child process and block parent
+  # seccomp - operate on Secure Computing state of the process
+  # request_key - request a key from the kernel's key management facility
+  # syscall - indirect system call
+  # kcmp - compare two processes to determine if they share a kernel resource
+  # readdir - read directory entry
+  # ioperm - set port input/output permissions
+  # spu_run - execute an SPU context
+  # reboot - reboot or enable/disable Ctrl-Alt-Del
+  # readahead - initiate file readahead into page cache
+  # sched_getparam - set and get scheduling parameters
+  # acct - switch process accounting on or off
+  # sigsuspend - wait for a signal
+  # rt_sigsuspend - wait for a signal
+  # exit_group - exit all threads in a process
+  # socket - create an endpoint for communication
+  # ioctl_userfaultfd - create a file descriptor for handling page faults in user space
+  # sched_get_priority_max - get static priority range
+  # sched_get_priority_min  - get static priority range
+  # getdents - get directory entries
+  # getdents64 - get directory entries
+  # select - synchronous I/O multiplexing
+  # pselect - synchronous I/O multiplexing
+  # alloc_hugepages - allocate or free huge pages
+  # free_hugepages - allocate or free huge pages
+  # fsync - synchronize a file's in-core state with storage device
+  # fdatasync - synchronize a file's in-core state with storage device
+  # syscalls - Linux system calls
+  # memfd_create - create an anonymous file
+  # modify_ldt - get or set a per-process LDT entry
+  # get_kernel_syms - retrieve exported kernel and module symbols
+  # lseek - reposition read/write file offset
+  # shmat - System V shared memory operations
+  # shmdt - System V shared memory operations
+  # timer_delete - delete a POSIX per-process timer
+  # perfmonctl - interface to IA-64 performance monitoring unit
+  # move_pages - move individual pages of a process to another node
+  # chdir - change working directory
+  # fchdir - change working directory
+  # time - get time in seconds
+  # _exit - terminate the calling process
+  # _Exit - terminate the calling process
+  # s390_sthyi - emulate STHYI instruction
+  # io_submit - submit asynchronous I/O blocks for processing
+  # mlock - lock and unlock memory
+  # mlock2 - lock and unlock memory
+  # munlock - lock and unlock memory
+  # mlockall - lock and unlock memory
+  # munlockall - lock and unlock memory
+  # umask - set file mode creation mask
+  # arch_prctl - set architecture-specific thread state
+  # uselib - load shared library
+  # sendfile - transfer data between file descriptors
+  # shmctl - System V shared memory control
+  # epoll_wait - wait for an I/O event on an epoll file descriptor
+  # epoll_pwait - wait for an I/O event on an epoll file descriptor
+  # sigaltstack - set and/or get signal stack context
+  # ioctl - control device
+  # signalfd - create a file descriptor for accepting signals
+  # unshare - disassociate parts of the process execution context
+  # chroot - change root directory
+  # madvise - give advice about use of memory
+  # gettid - get thread identification
+  # getsockname - get socket name
+  # io_destroy - destroy an asynchronous I/O context
+  # setup - setup devices and filesystems, mount root filesystem
+  # ntp_adjtime - tune kernel clock
+  # semget - get a System V semaphore set identifier
+  # getuid - get user identity
+  # geteuid - get user identity
+  # _syscall - invoking a system call without library support (OBSOLETE)
+  # sched_setaffinity - \ set and get a thread's CPU affinity mask
+  # sched_getaffinity - \ set and get a thread's CPU affinity mask
+  # cacheflush - flush contents of instruction and/or data cache
+  # pivot_root - change the root mount
+  # msgctl - System V message control operations
+  # ioctl_fat - manipulating the FAT filesystem
+  # setpgid - set/get process group
+  # getpgid - set/get process group
+  # setpgrp - set/get process group
+  # getpgrp - set/get process group
+  # socketpair - create a pair of connected sockets
+  # bdflush - start, flush, or tune buffer-dirty-flush daemon
+  # alarm - set an alarm clock for delivery of a signal
+  # timer_settime - arm/disarm and fetch state of POSIX per-process timer
+  # timer_gettime - arm/disarm and fetch state of POSIX per-process timer
+  # add_key - add a key to the kernel's key management facility
+  # rt_sigqueueinfo - queue a signal and data
+  # rt_tgsigqueueinfo - queue a signal and data
+  # userfaultfd - create a file descriptor for handling page faults in user space
+  # semop - System V semaphore operations
+  # semtimedop - System V semaphore operations
+  # getgid - get group identity
+  # getegid - get group identity
+  # getpid - get process identification
+  # getppid - get process identification
+  # sigprocmask - examine and change blocked signals
+  # rt_sigprocmask - examine and change blocked signals
+  # uname - get name and information about current kernel
+  # statx - get file status (extended)
+  # ioctl_ficlonerange - share some the data of one file with another file
+  # ioctl_ficlone - share some the data of one file with another file
+  # mq_getsetattr - get/set message queue attributes
+  # ioprio_get - get/set I/O scheduling class and priority
+  # ioprio_set - get/set I/O scheduling class and priority
+  # epoll_ctl - control interface for an epoll file descriptor
+  # sync - commit filesystem caches to disk
+  # syncfs - commit filesystem caches to disk
+  # setsid - creates a session and sets the process group ID
+  # shutdown - shut down part of a full-duplex connection
+  # getsid - get session ID
+  # get_thread_area - manipulate thread-local storage information
+  # set_thread_area - manipulate thread-local storage information
+  # timerfd_create - timers that notify via file descriptors
+  # timerfd_settime - timers that notify via file descriptors
+  # timerfd_gettime - timers that notify via file descriptors
+  # ioctl_fideduperange - share some the data of one file with another file
+  # name_to_handle_at - obtain handle for a pathname and open file via a handle
+  # open_by_handle_at - obtain handle for a pathname and open file via a handle
+  # futex - fast user-space locking
+  # ioctl_ns - ioctl() operations for Linux namespaces
+  # pidfd_send_signal - send a signal to a process specified by a file descriptor
+  # clone - create a child process
+  # __clone2 - create a child process
+  # clone3 - create a child process
+  # times - get process times
+  # sysinfo - return system information
+  # ipc - System V IPC system calls
+  # eventfd - create a file descriptor for event notification
+  # wait - wait for process to change state
+  # waitpid - wait for process to change state
+  # waitid - wait for process to change state
+  # getdomainname - get/set NIS domain name
+  # idle - make process 0 idle
+  # inotify_add_watch - add a watch to an initialized inotify instance
+  # get_mempolicy - retrieve NUMA memory policy for a thread
+  # bpf - perform a command on an extended BPF map or program
+  # getsockopt - get and set options on sockets
+  # setsockopt - get and set options on sockets
+  # getitimer - get or set value of an interval timer
+  # setitimer - get or set value of an interval timer
+  # membarrier - issue memory barriers on a set of threads
+  # mprotect - set protection on a region of memory
+  # pkey_mprotect - set protection on a region of memory
+  # getcpu - determine CPU and NUMA node on which the calling thread is running
+  # ioctl_fslabel - get or set a filesystem label
+  # listxattr - list extended attribute names
+  # llistxattr - list extended attribute names
+  # flistxattr - list extended attribute names
+  # _llseek - reposition read/write file offset
+  # fcntl - manipulate file descriptor
+  # ustat - get filesystem statistics
+  # signal - ANSI C signal handling
+  # nanosleep - high-resolution sleep
+  # connect - initiate a connection on a socket
+  # vm86old - enter virtual 8086 mode
+  # vm86 - enter virtual 8086 mode
+  # fanotify_init - create and initialize fanotify group
+  # migrate_pages - move all pages in a process to another set of nodes
+  # restart_syscall - restart a system call after interruption by a stop signal
+  # close - close a file descriptor
+  # msgrcv - System V message queue operations
+  # msgsnd - System V message queue operations
+  # readv - read or write data into multiple buffers
+  # writev - read or write data into multiple buffers
+  # preadv - read or write data into multiple buffers
+  # pwritev - read or write data into multiple buffers
+  # preadv2 - read or write data into multiple buffers
+  # pwritev2 - read or write data into multiple buffers
+  # syslog - read and/or clear kernel message ring buffer; set console_loglevel
+  # klogctl - read and/or clear kernel message ring buffer; set console_loglevel
+  # sched_yield - yield the processor
+  # vhangup - virtually hangup the current terminal
+  # ioctl_iflags - ioctl() operations for inode flags
+  # sgetmask - manipulation of signal mask (obsolete)
+  # ssetmask - manipulation of signal mask (obsolete)
+  # sync_file_range - sync a file segment with disk
+  # copy_file_range - Copy a range of data from one file to another
+  # sigpending - examine pending signals
+  # rt_sigpending - examine pending signals
+  # getunwind - copy the unwind data to caller's buffer
+  # msync - synchronize a file with a memory map
+  # get_robust_list - get/set list of robust futexes
+  # set_robust_list - get/set list of robust futexes
+  # dup - duplicate a file descriptor
+  # dup2 - duplicate a file descriptor
+  # dup3 - duplicate a file descriptor
+  # s390_pci_mmio_write - transfer data to/from PCI MMIO memory page
+  # s390_pci_mmio_read - transfer data to/from PCI MMIO memory page
+  # pause - wait for signal
+  # swapon - start/stop swapping to file/device
+  # swapoff - start/stop swapping to file/device
+
+  # Record type normalizations
+  # Useful links:
+  # https://raw.githubusercontent.com/torvalds/linux/v4.16/include/uapi/linux/audit.h
+  # https://raw.githubusercontent.com/linux-audit/audit-userspace/4d933301b1835cafa08b9e9ef705c8fb6c96cb62/lib/libaudit.h
+  # https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-category.html
+
+  # IAM related events
+
+  # AUDIT_ACCT_LOCK - User's account locked by admin
+  - record_types: ACCT_LOCK
+    action: locked-account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - info
+  # AUDIT_ACCT_UNLOCK - User's account unlocked by admin
+  - record_types: ACCT_UNLOCK
+    action: unlocked-account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - info
+  # AUDIT_ADD_GROUP - Group account added
+  - record_types: ADD_GROUP
+    action: added-group-account-to
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - group
+        - creation
+  # AUDIT_ADD_USER - User account added
+  - record_types: ADD_USER
+    action: added-user-account
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - creation
+  # AUDIT_DEL_GROUP - Group account deleted
+  - record_types: DEL_GROUP
+    action: deleted-group-account-from
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - group
+        - deletion
+  # AUDIT_DEL_USER - User account deleted
+  - record_types: DEL_USER
+    action: deleted-user-account
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - deletion
+  # AUDIT_GRP_MGMT - Group account attr was modified
+  - record_types: GRP_MGMT
+    action: modified-group-account
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - group
+        - change
+  # AUDIT_ROLE_ASSIGN - Admin assigned user to role
+  - record_types: ROLE_ASSIGN
+    action: assigned-user-role-to
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - change
+  # AUDIT_ROLE_MODIFY - Admin modified a role
+  - record_types: ROLE_MODIFY
+    action: modified-role
+    ecs:
+      <<: *ecs-iam
+      type:
+        - change
+  # AUDIT_ROLE_REMOVE - Admin removed user from role
+  - record_types: ROLE_REMOVE
+    action: removed-use-role-from
+    object:
+      primary: [id, acct]
+      what: account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - change
+  # AUDIT_USER_MGMT - User acct attribute change
+  - <<: *macro-user-session
+    record_types: USER_MGMT
+    action: modified-user-account
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - change
+  # AUDIT_USER_CHAUTHTOK - User acct password or pin changed
+  - <<: *macro-user-session
+    record_types: USER_CHAUTHTOK
+    action: changed-password
+    ecs:
+      <<: *ecs-iam
+      type:
+        - user
+        - change
+  # AUDIT_GRP_CHAUTHTOK - Group acct password or pin changed
+  - <<: *macro-user-session
+    record_types: GRP_CHAUTHTOK
+    action: changed-group-password
+    object:
+      primary: acct
+      what: user-session
+    ecs:
+      <<: *ecs-iam
+      type:
+        - group
+        - change
+
+  # Authentication related events
+
+  # AUDIT_CRED_ACQ - User credential acquired
+  - <<: *macro-user-session
+    record_types: CRED_ACQ
+    action: acquired-credentials
+    ecs: *ecs-auth
+  # AUDIT_CRED_DISP - User credential disposed
+  - <<: *macro-user-session
+    record_types: CRED_DISP
+    action: disposed-credentials
+    ecs: *ecs-auth
+  # AUDIT_CRED_REFR - User credential refreshed
+  - <<: *macro-user-session
+    record_types: CRED_REFR
+    action: refreshed-credentials
+    ecs: *ecs-auth
+  # AUDIT_GRP_AUTH - Authentication for group password
+  - record_types: GRP_AUTH
+    action: authenticated-to-group
+    ecs: *ecs-auth
+  # AUDIT_LOGIN - Define the login id and information
+  - record_types: LOGIN
+    action: changed-login-id-to
+    subject:
+      primary: [old_auid, old-auid]
+      secondary: uid
+    object:
+      primary: auid
+      what: user-session
+    ecs:
+      <<: *ecs-auth
+      type: start
+  # AUDIT_USER_ACCT - User system access authorization
+  - <<: *macro-user-session
+    record_types: USER_ACCT
+    action: was-authorized
+    ecs: *ecs-auth
+  # AUDIT_USER_AUTH - User system access authentication
+  - <<: *macro-user-session
+    record_types: USER_AUTH
+    action: authenticated
+    ecs: *ecs-auth
+  # AUDIT_USER_END - User session end
+  - <<: *macro-user-session
+    record_types: USER_END
+    action: ended-session
+    ecs: *ecs-auth
+  # AUDIT_USER_ERR - User acct state error
+  - <<: *macro-user-session
+    record_types: USER_ERR
+    action: error
+    source_ip: [addr]
+    ecs: *ecs-auth
+  # AUDIT_USER_LOGIN - User has logged in
+  - <<: *macro-user-session
+    record_types: USER_LOGIN
+    action: logged-in
+    source_ip: [addr]
+    ecs:
+      <<: *ecs-auth
+      type: start
+  # AUDIT_USER_LOGOUT - User has logged out
+  - <<: *macro-user-session
+    record_types: USER_LOGOUT
+    action: logged-out
+    ecs:
+      <<: *ecs-auth
+      type: end
+  # AUDIT_USER_ROLE_CHANGE - User changed to a new role
+  - <<: *macro-user-session
+    record_types: USER_ROLE_CHANGE
+    action: changed-role-to
+    object:
+      primary: selected-context
+      what: user-session
+  # AUDIT_USER_START - User session start
+  - <<: *macro-user-session
+    record_types: USER_START
+    action: started-session
+    source_ip: [addr]
+    ecs: *ecs-auth
+
+  # Host virtualization events
+
+  # AUDIT_VIRT_CONTROL - Start, Pause, Stop VM
+  - record_types: VIRT_CONTROL
+    action: issued-vm-control
+    object:
+      primary: op
+      secondary: vm
+      what: virtual-machine
+    ecs: *ecs-host
+  # AUDIT_VIRT_CREATE - Creation of guest image
+  - record_types: VIRT_CREATE
+    action: created-vm-image
+    ecs: *ecs-host
+  # AUDIT_VIRT_DESTROY - Destruction of guest image
+  - record_types: VIRT_DESTROY
+    action: deleted-vm-image
+    ecs: *ecs-host
+  # AUDIT_VIRT_INTEGRITY_CHECK - Guest integrity results
+  - record_types: VIRT_INTEGRITY_CHECK
+    action: checked-integrity-of
+    ecs: *ecs-host
+  # AUDIT_VIRT_MACHINE_ID - Binding of label to VM
+  - record_types: VIRT_MACHINE_ID
+    action: assigned-vm-id
+    object:
+      primary: vm
+      what: virtual-machine
+    ecs: *ecs-host
+  # AUDIT_VIRT_MIGRATE_IN - Inbound guest migration info
+  - record_types: VIRT_MIGRATE_IN
+    action: migrated-vm-from
+    ecs: *ecs-host
+  # AUDIT_VIRT_MIGRATE_OUT - Outbound guest migration info
+  - record_types: VIRT_MIGRATE_OUT
+    action: migrated-vm-to
+    ecs: *ecs-host
+  # AUDIT_VIRT_RESOURCE - Resource assignment
+  - record_types: VIRT_RESOURCE
+    action: assigned-vm-resource
+    object:
+      primary: resrc
+      secondary: vm
+      what: virtual-machine
+    ecs: *ecs-host
+
+  # Userspace process events
+
+  # AUDIT_CHGRP_ID - User space group ID changed
+  - record_types: CHGRP_ID
+    action: changed-group
+    ecs:
+      <<: *ecs-process
+      type: change
+  # AUDIT_CHUSER_ID - Changed user ID supplemental data
+  - record_types: CHUSER_ID
+    action: changed-user-id
+    ecs:
+      <<: *ecs-process
+      type: change
+  # AUDIT_TEST - Used for test success messages
+  - record_types: TEST
+    action: sent-test
+    ecs: *ecs-process
+  # AUDIT_TRUSTED_APP - Trusted app msg - freestyle text
+  - record_types: TRUSTED_APP
+    action: unknown
+    ecs: *ecs-process
+  # AUDIT_USER_CMD - User shell command and args
+  - record_types: USER_CMD
+    action: ran-command
+    object:
+      primary: cmd
+      what: process
+    description: >
+      These messages are from user-space apps, like sudo, that log commands
+      being run by a user. The uid contained in these messages is user's UID at
+      the time the command was run. It is not the "target" UID used to run the
+      command, which is normally root.
+    ecs:
+      <<: *ecs-process
+      type: start
+
+  # Host-level events
+
+  # AUDIT_SYSTEM_BOOT - System boot
+  - record_types: SYSTEM_BOOT
+    action: booted-system
+    object:
+      what: system
+    ecs:
+      <<: *ecs-host
+      type: start
+  # AUDIT_SYSTEM_RUNLEVEL - System runlevel change
+  - record_types: SYSTEM_RUNLEVEL
+    action: changed-to-runlevel
+    object:
+      primary: new-level
+      what: system
+    ecs:
+      <<: *ecs-host
+      type: change
+  # AUDIT_SYSTEM_SHUTDOWN - System shutdown
+  - record_types: SYSTEM_SHUTDOWN
+    action: shutdown-system
+    object:
+      what: system
+    ecs:
+      <<: *ecs-host
+      type: end
+
+  # Service-level events
+
+  # AUDIT_SERVICE_START - Service (daemon) start
+  - record_types: SERVICE_START
+    action: started-service
+    object:
+      primary: unit
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: start
+  # AUDIT_SERVICE_STOP - Service (daemon) stop
+  - record_types: SERVICE_STOP
+    action: stopped-service
+    object:
+      primary: unit
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: stop
+
+  # Auditd internal events
+
+  # AUDIT_CONFIG_CHANGE - Audit system configuration change
+  - record_types: CONFIG_CHANGE
+    action: changed-audit-configuration
+    object:
+      primary:
+        [op, key, audit_enabled, audit_pid, audit_backlog_limit, audit_failure]
+      what: audit-config
+    ecs:
+      <<: *ecs-process
+      type: change
+  # AUDIT_DAEMON_ABORT - Daemon error stop record
+  - record_types: DAEMON_ABORT
+    action: aborted-auditd-startup
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: stop
+  # AUDIT_DAEMON_ACCEPT - Auditd accepted remote connection
+  - record_types: DAEMON_ACCEPT
+    action: remote-audit-connected
+    object:
+      what: service
+    ecs:
+      <<: *ecs-network
+      type:
+        - connection
+        - start
+  # AUDIT_DAEMON_CLOSE - Auditd closed remote connection
+  - record_types: DAEMON_CLOSE
+    action: remote-audit-disconnected
+    object:
+      what: service
+    ecs:
+      <<: *ecs-network
+      type:
+        - connection
+        - start
+  # AUDIT_DAEMON_CONFIG - Daemon config change
+  - record_types: DAEMON_CONFIG
+    action: changed-auditd-configuration
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: stop
+  # AUDIT_DAEMON_END - Daemon normal stop record
+  - record_types: DAEMON_END
+    action: shutdown-audit
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: stop
+  # AUDIT_DAEMON_ERR - Auditd internal error
+  - record_types: DAEMON_ERR
+    action: audit-error
+    object:
+      what: service
+    ecs: *ecs-process
+  # AUDIT_DAEMON_RECONFIG - Auditd should reconfigure
+  - record_types: DAEMON_RECONFIG
+    action: reconfigured-auditd
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: change
+  # AUDIT_DAEMON_RESUME - Auditd should resume logging
+  - record_types: DAEMON_RESUME
+    action: resumed-audit-logging
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: change
+  # AUDIT_DAEMON_ROTATE - Auditd should rotate logs
+  - record_types: DAEMON_ROTATE
+    action: rotated-audit-logs
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: change
+  # AUDIT_DAEMON_START - Daemon startup record
+  - record_types: DAEMON_START
+    action: started-audit
+    object:
+      what: service
+    ecs:
+      <<: *ecs-process
+      type: start
+  # AUDIT_KERNEL - Asynchronous audit record. NOT A REQUEST.
+  - record_types: KERNEL
+    action: initialized-audit-subsystem
+    ecs: *ecs-process
+
+  # Configuration change events
+
+  # AUDIT_USYS_CONFIG - User space system config change
+  - record_types: USYS_CONFIG
+    action: changed-configuration
+    object:
+      primary: op
+      what: system
+  # AUDIT_NETFILTER_CFG - Netfilter chain modifications
+  - record_types: NETFILTER_CFG
+    action: loaded-firewall-rule-to
+    object:
+      primary: table
+      what: firewall
+  # AUDIT_FEATURE_CHANGE - audit log listing feature changes
+  - record_types: FEATURE_CHANGE
+    action: changed-audit-feature
+    object:
+      primary: feature
+      what: system
+  # AUDIT_REPLACE - Replace auditd if this packet unanswerd
+
+  # TTY events
+
+  - record_types:
+      # AUDIT_TTY - Input on an administrative TTY
+      - TTY
+      # AUDIT_USER_TTY - Non-ICANON TTY input meaning
+      - USER_TTY
+    action: typed
+    object:
+      primary: data
+      what: keystrokes
+    how: [comm, exe]
+
+  # Policy events
+
+  # AUDIT_AVC - SE Linux avc denial or grant (selinux)
+  - record_types: AVC
+    action: violated-selinux-policy
+    subject:
+      primary: scontext
+    object:
+      primary: tcontext
+      secondary: tclass
+    has_fields:
+      - seresult
+  # AUDIT_AVC - SE Linux avc denial or grant (apparmor)
+  - record_types: AVC
+    action: violated-apparmor-policy
+    object:
+      primary: operation
+      secondary: [requested_mask, denied_mask, capname]
+      what: policy
+    has_fields:
+      - apparmor
+  # AUDIT_FS_RELABEL - Filesystem relabeled
+  - record_types: FS_RELABEL
+    action: relabeled-filesystem
+    object:
+      what: mac-config
+  # AUDIT_LABEL_LEVEL_CHANGE - Object's level was changed
+  - record_types: LABEL_LEVEL_CHANGE
+    action: modified-level-of
+    object:
+      primary: printer
+      what: printer
+  # AUDIT_LABEL_OVERRIDE - Admin is overriding a label
+  - record_types: LABEL_OVERRIDE
+    action: overrode-label-of
+    object:
+      what: mac-config
+  # AUDIT_MAC_CHECK - User space MAC decision results
+  - record_types: MAC_CHECK
+    action: mac-permission
+  # AUDIT_MAC_CONFIG_CHANGE - Changes to booleans
+  - record_types: MAC_CONFIG_CHANGE
+    action: changed-selinux-boolean
+    object:
+      primary: bool
+      what: mac-config
+  # AUDIT_MAC_POLICY_LOAD - Policy file load
+  - record_types: MAC_POLICY_LOAD
+    action: loaded-selinux-policy
+    object:
+      what: mac-config
+  # AUDIT_MAC_STATUS - Changed enforcing,permissive,off
+  - record_types: MAC_STATUS
+    action: changed-selinux-enforcement
+    object:
+      primary: enforcing
+      what: mac-config
+  # AUDIT_USER_AVC - User space avc message
+  - record_types: USER_AVC
+    action: access-permission
+  # AUDIT_USER_MAC_CONFIG_CHANGE - Change made to MAC policy
+  - record_types: USER_MAC_CONFIG_CHANGE
+    action: changed-mac-configuration
+    object:
+      what: mac-config
+  # AUDIT_USER_MAC_POLICY_LOAD - Userspc daemon loaded polic
+  - record_types: USER_MAC_POLICY_LOAD
+    action: loaded-mac-policy
+    object:
+      what: mac-config
+  # AUDIT_USER_SELINUX_ERR - SE Linux user space error
+  - record_types: USER_SELINUX_ERR
+    action: access-error
+  # AUDIT_SECCOMP - Secure Computing event
+  - record_types: SECCOMP
+    action: violated-seccomp-policy
+    object:
+      primary: syscall
+      what: process
+  # AUDIT_SELINUX_ERR - Internal SE Linux Errors
+  - action: caused-mac-policy-error
+    object:
+      what: system
+    record_types: SELINUX_ERR
+  # AUDIT_APPARMOR_ALLOWED
+  # AUDIT_APPARMOR_DENIED
+  # AUDIT_APPARMOR_ERROR
+  # AUDIT_AVC_PATH - dentry, vfsmount pair from avc
+  # AUDIT_APPARMOR_AUDIT
+  # AUDIT_APPARMOR_HINT
+  # AUDIT_APPARMOR_STATUS
+  # AUDIT_APPARMOR_ERROR
+  # AUDIT_DEV_ALLOC - Device was allocated
+  # AUDIT_DEV_DEALLOC - Device was deallocated
+  # AUDIT_MAC_UNLBL_ALLOW - NetLabel: allow unlabeled traffic
+  # AUDIT_MAC_CIPSOV4_ADD - NetLabel: add CIPSOv4 DOI entry
+  # AUDIT_MAC_CIPSOV4_DEL - NetLabel: del CIPSOv4 DOI entry
+  # AUDIT_MAC_MAP_ADD - NetLabel: add LSM domain mapping
+  # AUDIT_MAC_MAP_DEL - NetLabel: del LSM domain mapping
+  # AUDIT_MAC_IPSEC_EVENT - Audit an IPSec event
+  # AUDIT_MAC_UNLBL_STCADD - NetLabel: add a static label
+  # AUDIT_MAC_UNLBL_STCDEL - NetLabel: del a static label
+  # AUDIT_MAC_CALIPSO_ADD - NetLabel: add CALIPSO DOI entry
+  # AUDIT_MAC_CALIPSO_DEL - NetLabel: del CALIPSO DOI entry
+  # AUDIT_USER_LABELED_EXPORT - Object exported with label
+  # AUDIT_USER_UNLABELED_EXPORT - Object exported without label
+
+  # Crypto events
+
+  - <<: *macro-user-session
+    action: negotiated-crypto-key
+    object:
+      primary: fp
+      secondary: [addr, hostname]
+      what: user-session
+    record_types: CRYPTO_KEY_USER
+    source_ip: [addr]
+    ecs: *ecs-process
+  - action: crypto-officer-logged-in
+    record_types: CRYPTO_LOGIN
+  - action: crypto-officer-logged-out
+    record_types: CRYPTO_LOGOUT
+    ecs: *ecs-process
+  - <<: *macro-user-session
+    action: started-crypto-session
+    object:
+      primary: addr
+      secondary: [rport]
+    record_types: CRYPTO_SESSION
+    source_ip: [addr]
+    ecs: *ecs-process
+  - action: access-result
+    record_types: DAC_CHECK
+
+  # Anomalies
+
+  # AUDIT_ANOM_ABEND - Process ended abnormally
+  - record_types: ANOM_ABEND
+    action: crashed-program
+    object:
+      primary: [comm, exe]
+      secondary: pid
+      what: process
+    how: sig
+    ecs:
+      # consider adding an anomaly category when we introduce
+      # to ECS
+      <<: *ecs-process
+      type: end
+  # AUDIT_ANOM_EXEC - Execution of file
+  - record_types: ANOM_EXEC
+    action: attempted-execution-of-forbidden-program
+    object:
+      primary: cmd
+      what: process
+    how: terminal
+    ecs:
+      # consider adding an anomaly category when we introduce
+      # to ECS
+      <<: *ecs-process
+      type: start
+  # AUDIT_ANOM_LINK - Suspicious use of file links
+  - record_types: ANOM_LINK
+    action: used-suspcious-link
+  # AUDIT_ANOM_LOGIN_FAILURES - Failed login limit reached
+  - <<: *macro-user-session
+    record_types: ANOM_LOGIN_FAILURES
+    action: failed-log-in-too-many-times-to
+  # AUDIT_ANOM_LOGIN_LOCATION - Login from forbidden location
+  - <<: *macro-user-session
+    record_types: ANOM_LOGIN_LOCATION
+    action: attempted-log-in-from-unusual-place-to
+  # AUDIT_ANOM_LOGIN_SESSIONS - Max concurrent sessions reached
+  - <<: *macro-user-session
+    record_types: ANOM_LOGIN_SESSIONS
+    action: opened-too-many-sessions-to
+  # AUDIT_ANOM_LOGIN_TIME - Login attempted at bad time
+  - <<: *macro-user-session
+    record_types: ANOM_LOGIN_TIME
+    action: attempted-log-in-during-unusual-hour-to
+  # AUDIT_ANOM_PROMISCUOUS - Device changed promiscuous mode
+  - record_types: ANOM_PROMISCUOUS
+    action: changed-promiscuous-mode-on-device # Could be entered or exited based on prom field.
+    object:
+      primary: dev
+      what: network-device
+  # AUDIT_ANOM_RBAC_INTEGRITY_FAIL - RBAC file integrity failure
+  - record_types: ANOM_RBAC_INTEGRITY_FAIL
+    action: tested-file-system-integrity-of
+    object:
+      primary: hostname
+      what: filesystem
+  # AUDIT_ANOM_LOGIN_ACCT - Login attempted to watched acct
+  # AUDIT_ANOM_MAX_DAC - Max DAC failures reached
+  # AUDIT_ANOM_MAX_MAC - Max MAC failures reached
+  # AUDIT_ANOM_AMTU_FAIL - AMTU failure
+  # AUDIT_ANOM_RBAC_FAIL - RBAC self test failure
+  # AUDIT_ANOM_CRYPTO_FAIL - Crypto system test failure
+  # AUDIT_ANOM_MK_EXE - Make an executable
+  # AUDIT_ANOM_ACCESS_FS - Access of file or dir
+  # AUDIT_ANOM_ADD_ACCT - Adding an acct
+  # AUDIT_ANOM_DEL_ACCT - Deleting an acct
+  # AUDIT_ANOM_MOD_ACCT - Changing an acct
+  # AUDIT_ANOM_ROOT_TRANS - User became root
+  # AUDIT_ANOM_LOGIN_SERVICE - Service acct attempted login
+
+  # Anomaly responses
+
+  # AUDIT_RESP_ANOMALY - Anomaly not reacted to
+  # AUDIT_RESP_ALERT - Alert email was sent
+  # AUDIT_RESP_KILL_PROC - Kill program
+  # AUDIT_RESP_TERM_ACCESS - Terminate session
+  # AUDIT_RESP_ACCT_REMOTE - Acct locked from remote access
+  # AUDIT_RESP_ACCT_LOCK_TIMED - User acct locked for time
+  # AUDIT_RESP_ACCT_UNLOCK_TIMED - User acct unlocked from time
+  # AUDIT_RESP_ACCT_LOCK - User acct was locked
+  # AUDIT_RESP_TERM_LOCK - Terminal was locked
+  # AUDIT_RESP_SEBOOL - Set an SE Linux boolean
+  # AUDIT_RESP_EXEC - Execute a script
+  # AUDIT_RESP_SINGLE - Go to single user mode
+  # AUDIT_RESP_HALT - take the system down
+  # AUDIT_RESP_ORIGIN_BLOCK - Address blocked by iptables
+  # AUDIT_RESP_ORIGIN_BLOCK_TIMED - Address blocked for time
+
+  # Audit rule events
+
+  # AUDIT_SYSCALL - Syscall event
+  # AUDIT_PATH - Filename path information
+  # AUDIT_IPC - IPC record
+  # AUDIT_SOCKETCALL - sys_socketcall arguments
+  # AUDIT_SOCKADDR - sockaddr copied as syscall arg
+  # AUDIT_CWD - Current working directory
+  # AUDIT_EXECVE - execve arguments
+  # AUDIT_IPC_SET_PERM - IPC new permissions record type
+  # AUDIT_MQ_OPEN - POSIX MQ open record type
+  # AUDIT_MQ_SENDRECV- POSIX MQ send/receive record type
+  # AUDIT_MQ_NOTIFY - POSIX MQ notify record type
+  # AUDIT_MQ_GETSETATTR - POSIX MQ get/set attribute record type
+  # AUDIT_FD_PAIR - audit record for pipe/socketpair
+  # AUDIT_OBJ_PID - ptrace target
+  # AUDIT_BPRM_FCAPS - Information about fcaps increasing perms
+  # AUDIT_CAPSET - Record showing argument to sys_capset
+  # AUDIT_MMAP - Record showing descriptor and flags in mmap
+  # AUDIT_NETFILTER_PKT - Packets traversing netfilter chains
+
+  # Integrity checks
+
+  # AUDIT_INTEGRITY_DATA - Data integrity verification
+  # AUDIT_INTEGRITY_METADATA - Metadata integrity verification
+  # AUDIT_INTEGRITY_STATUS - Integrity enable status
+  # AUDIT_INTEGRITY_HASH - Integrity HASH type
+  # AUDIT_INTEGRITY_PCR - PCR invalidation msgs
+  # AUDIT_INTEGRITY_RULE - Policy rule
+
+  # Various
+
+  # AUDIT_USER - Message from userspace -- deprecated
+  - record_types: USER
+    action: sent-message
+    object:
+      primary: addr
diff --git a/aucoalesce/normalize.go b/aucoalesce/normalize.go
index 2004bcc..c8deb8f 100644
--- a/aucoalesce/normalize.go
+++ b/aucoalesce/normalize.go
@@ -52,7 +52,7 @@ type Strings struct {
 func (s *Strings) UnmarshalYAML(unmarshal func(interface{}) error) error {
 	var singleValue string
 	if err := unmarshal(&singleValue); err == nil {
-		s.Values = append(s.Values, singleValue)
+		s.Values = []string{singleValue}
 		return nil
 	}
 
@@ -73,6 +73,12 @@ type Normalization struct {
 	Syscalls    Strings        `yaml:"syscalls"`
 	SourceIP    Strings        `yaml:"source_ip"`
 	HasFields   Strings        `yaml:"has_fields"`
+	ECS         ECSMapping     `yaml:"ecs"`
+}
+
+type ECSMapping struct {
+	Category Strings `yaml:"category"`
+	Type     Strings `yaml:"type"`
 }
 
 type SubjectMapping struct {
diff --git a/aucoalesce/znormalize_data.go b/aucoalesce/znormalize_data.go
index 5f6c14b..430afbd 100644
--- a/aucoalesce/znormalize_data.go
+++ b/aucoalesce/znormalize_data.go
@@ -31,7 +31,7 @@ func asset(key string) ([]byte, error) {
 		assets = map[string][]byte{}
 
 		var value []byte
-		value, _ = base64.StdEncoding.DecodeString("LS0tCiMgTWFjcm9zIGRlY2xhcmVzIHNvbWUgWUFNTCBhbmNob3JzIHRoYXQgY2FuIGJlIHJlZmVyZW5jZWQgZm9yIHNvbWUgY29tbW9uCiMgb2JqZWN0IHR5cGUgbm9ybWFsaXphdGlvbnMgbGlrZSB1c2VyLXNlc3Npb24sIHNvY2tldCwgb3IgcHJvY2Vzcy4KbWFjcm9zOgotICZkZWZhdWx0cwogIHN1YmplY3Q6CiAgICBwcmltYXJ5OiBhdWlkCiAgICBzZWNvbmRhcnk6IHVpZAogIGhvdzogW2V4ZSwgY29tbV0KCi0gJm1hY3JvLXVzZXItc2Vzc2lvbgogIHN1YmplY3Q6CiAgICBwcmltYXJ5OiBhdWlkCiAgICBzZWNvbmRhcnk6IFthY2N0LCBpZCwgdWlkXQogIG9iamVjdDoKICAgIHByaW1hcnk6IHRlcm1pbmFsCiAgICBzZWNvbmRhcnk6IFthZGRyLCBob3N0bmFtZV0KICAgIHdoYXQ6IHVzZXItc2Vzc2lvbgogIGhvdzogW2V4ZSwgdGVybWluYWxdCgotICZtYWNyby1zb2NrZXQKICA8PDogKmRlZmF1bHRzCiAgb2JqZWN0OgogICAgcHJpbWFyeTogW2FkZHIsIHBhdGhdCiAgICBzZWNvbmRhcnk6IHBvcnQKICAgIHdoYXQ6IHNvY2tldAoKLSAmbWFjcm8tcHJvY2VzcwogIDw8OiAqZGVmYXVsdHMKICBvYmplY3Q6CiAgICBwcmltYXJ5OiBbY21kLCBleGUsIGNvbW1dCiAgICBzZWNvbmRhcnk6IHBpZAogICAgd2hhdDogcHJvY2VzcwogIGhvdzogdGVybWluYWwKCiMgTm9ybWFsaXphdGlvbnMgaXMgYSBsaXN0IG9mIGRlY2xhcmF0aW9ucyBzcGVjaWZ5aW5nIGhvdyB0byBub3JtYWxpemUgdGhlIGRhdGEKIyBjb250YWluZWQgaW4gYW4gZXZlbnQuIFRoZSBub3JtYWxpemF0aW9uIGNhbiBiZSBhcHBsaWVkIGJhc2VkIG9uIHRoZSBzeXNjYWxsCiMgbmFtZSAoZS5nLiBjb25uZWN0LCBvcGVuKSBvciBiYXNlZCBvbiB0aGUgcmVjb3JkIHR5cGUgKGUuZy4gVVNFUl9MT0dJTikuCiMgTm8gdHdvIG5vcm1hbGl6YXRpb25zIGNhbiBhcHBseSB0byB0aGUgc2FtZSBzeXNjYWxsIG9yIHJlY29yZCB0eXBlLiBUaGlzCiMgd2lsbCByZXN1bHQgaW4gYSBmYWlsdXJlIGF0IGxvYWQgdGltZS4KIwojIEVhY2ggbm9ybWFsaXphdGlvbiBzaG91bGQgc3BlY2lmeToKIyAgIGFjdGlvbiAtIHdoYXQgaGFwcGVuZWQKIyAgIGFjdG9yICAtIHdobyBkaWQgdGhpcyBvciB3aG8gdHJpZ2dlcmVkIHRoZSBldmVudAojICAgb2JqZWN0IC0gd2hhdCB3YXMgdGhlICJ0aGluZyIgaW52b2x2ZWQgaW4gdGhlIGFjdGlvbiAoZS5nLiBwcm9jZXNzLCBzb2NrZXQpCiMgICBob3cgICAgLSBob3cgd2FzIHRoZSBhY3Rpb24gcGVyZm9ybWVkIChlLmcuIGV4ZSBvciB0ZXJtaW5hbCkKbm9ybWFsaXphdGlvbnM6Ci0KICBhY3Rpb246IG9wZW5lZC1maWxlCiAgb2JqZWN0OgogICAgd2hhdDogZmlsZQogIHN5c2NhbGxzOgogIC0gY3JlYXQKICAtIGZhbGxvY2F0ZQogIC0gdHJ1bmNhdGUKICAtIGZ0cnVuY2F0ZQogIC0gb3BlbgogIC0gb3BlbmF0CiAgLSByZWFkbGluawogIC0gcmVhZGxpbmthdAotCiAgYWN0aW9uOiBjaGFuZ2VkLWZpbGUtYXR0cmlidXRlcy1vZgogIG9iamVjdDoKICAgIHdoYXQ6IGZpbGUKICBzeXNjYWxsczoKICAtIHNldHhhdHRyCiAgLSBmc2V0eGF0dHIKICAtIGxzZXR4YXR0cgogIC0gcmVtb3ZleGF0dHIKICAtIGZyZW1vdmV4YXR0cgogIC0gbHJlbW92ZXhhdHRyCi0KICBhY3Rpb246IGNoYW5nZWQtZmlsZS1wZXJtaXNzaW9ucy1vZgogIG9iamVjdDoKICAgIHdoYXQ6IGZpbGUKICBzeXNjYWxsczoKICAtIGNobW9kCiAgLSBmY2htb2QKICAtIGZjaG1vZGF0Ci0KICBhY3Rpb246IGNoYW5nZWQtZmlsZS1vd25lcnNoaXAtb2YKICBvYmplY3Q6CiAgICB3aGF0OiBmaWxlCiAgc3lzY2FsbHM6CiAgLSBjaG93bgogIC0gZmNob3duCiAgLSBmY2hvd25hdAogIC0gbGNob3duCi0KICBhY3Rpb246IGxvYWRlZC1rZXJuZWwtbW9kdWxlCiAgb2JqZWN0OgogICAgd2hhdDogZmlsZQogICAgcHJpbWFyeTogbmFtZQogIHJlY29yZF90eXBlczoKICAtIEtFUk5fTU9EVUxFCiAgc3lzY2FsbHM6CiAgLSBmaW5pdF9tb2R1bGUKICAtIGluaXRfbW9kdWxlCi0KICBhY3Rpb246IHVubG9hZGVkLWtlcm5lbC1tb2R1bGUKICBvYmplY3Q6CiAgICB3aGF0OiBmaWxlCiAgc3lzY2FsbHM6CiAgLSBkZWxldGVfbW9kdWxlCi0KICBhY3Rpb246IGNyZWF0ZWQtZGlyZWN0b3J5CiAgb2JqZWN0OgogICAgd2hhdDogZmlsZQogICAgcGF0aF9pbmRleDogMQogIHN5c2NhbGxzOgogIC0gbWtkaXIKICAtIG1rZGlyYXQKLQogIGFjdGlvbjogbW91bnRlZAogIG9iamVjdDoKICAgIHdoYXQ6IGZpbGVzeXN0ZW0KICAgIHBhdGhfaW5kZXg6IDEKICBzeXNjYWxsczoKICAtIG1vdW50Ci0KICBhY3Rpb246IHJlbmFtZWQKICBvYmplY3Q6CiAgICB3aGF0OiBmaWxlCiAgICBwYXRoX2luZGV4OiAyCiAgc3lzY2FsbHM6CiAgLSByZW5hbWUKICAtIHJlbmFtZWF0CiAgLSByZW5hbWVhdDIKLQogIGFjdGlvbjogY2hlY2tlZC1tZXRhZGF0YS1vZgogIG9iamVjdDoKICAgIHdoYXQ6IGZpbGUKICBzeXNjYWxsczoKICAtIGFjY2VzcwogIC0gZmFjY2Vzc2F0CiAgLSBuZXdmc3RhdGF0CiAgLSBzdGF0CiAgLSBmc3RhdAogIC0gbHN0YXQKICAtIHN0YXQ2NAogIC0gZ2V0eGF0dHIKICAtIGxnZXR4YXR0cgogIC0gZmdldHhhdHRyCi0KICBhY3Rpb246IGNoZWNrZWQtZmlsZXN5c3RlbS1tZXRhZGF0YS1vZgogIG9iamVjdDoKICAgIHdoYXQ6IGZpbGVzeXN0ZW0KICBzeXNjYWxsczoKICAtIHN0YXRmcwogIC0gZnN0YXRmcwotCiAgYWN0aW9uOiBzeW1saW5rZWQKICBvYmplY3Q6CiAgICB3aGF0OiBmaWxlCiAgc3lzY2FsbHM6CiAgLSBzeW1saW5rCiAgLSBzeW1saW5rYXQKLQogIGFjdGlvbjogdW5tb3VudGVkCiAgb2JqZWN0OgogICAgd2hhdDogZmlsZXN5c3RlbQogIHN5c2NhbGxzOgogIC0gdW1vdW50MgotCiAgYWN0aW9uOiBkZWxldGVkCiAgb2JqZWN0OgogICAgd2hhdDogZmlsZQogIHN5c2NhbGxzOgogIC0gcm1kaXIKICAtIHVubGluawogIC0gdW5saW5rYXQKLQogIGFjdGlvbjogY2hhbmdlZC10aW1lc3RhbXAtb2YKICBvYmplY3Q6CiAgICB3aGF0OiBmaWxlCiAgc3lzY2FsbHM6CiAgLSB1dGltZQogIC0gdXRpbWVzCiAgLSBmdXRpbWVzYXQKICAtIGZ1dGltZW5zCiAgLSB1dGltZW5zYXQKLQogIGFjdGlvbjogZXhlY3V0ZWQKICBvYmplY3Q6CiAgICB3aGF0OiBmaWxlCiAgc3lzY2FsbHM6CiAgLSBleGVjdmUKICAtIGV4ZWN2ZWF0Ci0KICBhY3Rpb246IGxpc3Rlbi1mb3ItY29ubmVjdGlvbnMKICBvYmplY3Q6CiAgICB3aGF0OiBzb2NrZXQKICBzeXNjYWxsczoKICAtIGxpc3RlbgotCiAgYWN0aW9uOiBhY2NlcHRlZC1jb25uZWN0aW9uLWZyb20KICBvYmplY3Q6CiAgICB3aGF0OiBzb2NrZXQKICBzeXNjYWxsczoKICAtIGFjY2VwdAogIC0gYWNjZXB0NAotCiAgYWN0aW9uOiBib3VuZC1zb2NrZXQKICBvYmplY3Q6CiAgICB3aGF0OiBzb2NrZXQKICBzeXNjYWxsczoKICAtIGJpbmQKLQogIGFjdGlvbjogY29ubmVjdGVkLXRvCiAgb2JqZWN0OgogICAgd2hhdDogc29ja2V0CiAgc3lzY2FsbHM6CiAgLSBjb25uZWN0Ci0KICBhY3Rpb246IHJlY2VpdmVkLWZyb20KICBvYmplY3Q6CiAgICB3aGF0OiBzb2NrZXQKICBzeXNjYWxsczoKICAtIHJlY3Zmcm9tCiAgLSByZWN2bXNnCi0KICBhY3Rpb246IHNlbnQtdG8KICBvYmplY3Q6CiAgICB3aGF0OiBzb2NrZXQKICBzeXNjYWxsczoKICAtIHNlbmR0bwogIC0gc2VuZG1zZwotCiAgYWN0aW9uOiBraWxsZWQtcGlkCiAgb2JqZWN0OgogICAgd2hhdDogcHJvY2VzcwogIHN5c2NhbGxzOgogIC0ga2lsbAogIC0gdGtpbGwKICAtIHRna2lsbAotCiAgYWN0aW9uOiBjaGFuZ2VkLWlkZW50aXR5LW9mCiAgb2JqZWN0OgogICAgd2hhdDogcHJvY2VzcwogIGhvdzogc3lzY2FsbAogIHN5c2NhbGxzOgogIC0gc2V0dWlkCiAgLSBzZXRldWlkCiAgLSBzZXRmc3VpZAogIC0gc2V0cmV1aWQKICAtIHNldHJlc3VpZAogIC0gc2V0Z2lkCiAgLSBzZXRlZ2lkCiAgLSBzZXRmc2dpZAogIC0gc2V0cmVnaWQKICAtIHNldHJlc2dpZAotCiAgYWN0aW9uOiBjaGFuZ2VkLXN5c3RlbS10aW1lCiAgb2JqZWN0OgogICAgd2hhdDogc3lzdGVtCiAgc3lzY2FsbHM6CiAgLSBzZXR0aW1lb2ZkYXkKICAtIGNsb2NrX3NldHRpbWUKICAtIHN0aW1lCiAgLSBhZGp0aW1leAotCiAgYWN0aW9uOiBtYWtlLWRldmljZQogIG9iamVjdDoKICAgIHdoYXQ6IGZpbGUKICBzeXNjYWxsczoKICAtIG1rbm9kCiAgLSBta25vZGF0Ci0KICBhY3Rpb246IGNoYW5nZWQtc3lzdGVtLW5hbWUKICBvYmplY3Q6CiAgICB3aGF0OiBzeXN0ZW0KICBzeXNjYWxsczoKICAtIHNldGhvc3RuYW1lCiAgLSBzZXRkb21haW5uYW1lCi0KICBhY3Rpb246IGFsbG9jYXRlZC1tZW1vcnkKICBvYmplY3Q6CiAgICB3aGF0OiBtZW1vcnkKICBzeXNjYWxsczoKICAtIG1tYXAKICAtIGJyawotCiAgYWN0aW9uOiBhZGp1c3RlZC1zY2hlZHVsaW5nLXBvbGljeS1vZgogIG9iamVjdDoKICAgIHdoYXQ6IHByb2Nlc3MKICBob3c6IHN5c2NhbGwKICBzeXNjYWxsczoKICAtIHNjaGVkX3NldHBhcmFtCiAgLSBzY2hlZF9zZXRzY2hlZHVsZXIKICAtIHNjaGVkX3NldGF0dHIKLQogIGFjdGlvbjogY2F1c2VkLW1hYy1wb2xpY3ktZXJyb3IKICBvYmplY3Q6CiAgICB3aGF0OiBzeXN0ZW0KICByZWNvcmRfdHlwZXM6IFNFTElOVVhfRVJSCi0KICBhY3Rpb246IGxvYWRlZC1maXJld2FsbC1ydWxlLXRvCiAgb2JqZWN0OgogICAgcHJpbWFyeTogdGFibGUKICAgIHdoYXQ6IGZpcmV3YWxsCiAgcmVjb3JkX3R5cGVzOiBORVRGSUxURVJfQ0ZHCi0KICAjIENvdWxkIGJlIGVudGVyZWQgb3IgZXhpdGVkIGJhc2VkIG9uIHByb20gZmllbGQuCiAgYWN0aW9uOiBjaGFuZ2VkLXByb21pc2N1b3VzLW1vZGUtb24tZGV2aWNlCiAgb2JqZWN0OgogICAgcHJpbWFyeTogZGV2CiAgICB3aGF0OiBuZXR3b3JrLWRldmljZQogIHJlY29yZF90eXBlczogQU5PTV9QUk9NSVNDVU9VUwotCiAgYWN0aW9uOiBsb2NrZWQtYWNjb3VudAogIHJlY29yZF90eXBlczogQUNDVF9MT0NLCi0KICBhY3Rpb246IHVubG9ja2VkLWFjY291bnQKICByZWNvcmRfdHlwZXM6IEFDQ1RfVU5MT0NLCi0KICBhY3Rpb246IGFkZGVkLWdyb3VwLWFjY291bnQtdG8KICBvYmplY3Q6CiAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICB3aGF0OiBhY2NvdW50CiAgcmVjb3JkX3R5cGVzOiBBRERfR1JPVVAKLQogIGFjdGlvbjogYWRkZWQtdXNlci1hY2NvdW50CiAgb2JqZWN0OgogICAgcHJpbWFyeTogW2lkLCBhY2N0XQogICAgd2hhdDogYWNjb3VudAogIHJlY29yZF90eXBlczogQUREX1VTRVIKLQogIGFjdGlvbjogY3Jhc2hlZC1wcm9ncmFtCiAgb2JqZWN0OgogICAgcHJpbWFyeTogW2NvbW0sIGV4ZV0KICAgIHNlY29uZGFyeTogcGlkCiAgICB3aGF0OiBwcm9jZXNzCiAgaG93OiBzaWcKICByZWNvcmRfdHlwZXM6IEFOT01fQUJFTkQKLQogIGFjdGlvbjogYXR0ZW1wdGVkLWV4ZWN1dGlvbi1vZi1mb3JiaWRkZW4tcHJvZ3JhbQogIG9iamVjdDoKICAgIHByaW1hcnk6IGNtZAogICAgd2hhdDogcHJvY2VzcwogIGhvdzogdGVybWluYWwKICByZWNvcmRfdHlwZXM6IEFOT01fRVhFQwotCiAgYWN0aW9uOiB1c2VkLXN1c3BjaW91cy1saW5rCiAgcmVjb3JkX3R5cGVzOiBBTk9NX0xJTksKLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiBmYWlsZWQtbG9nLWluLXRvby1tYW55LXRpbWVzLXRvCiAgcmVjb3JkX3R5cGVzOiBBTk9NX0xPR0lOX0ZBSUxVUkVTCi0KICA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogIGFjdGlvbjogYXR0ZW1wdGVkLWxvZy1pbi1mcm9tLXVudXN1YWwtcGxhY2UtdG8KICByZWNvcmRfdHlwZXM6IEFOT01fTE9HSU5fTE9DQVRJT04KLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiBvcGVuZWQtdG9vLW1hbnktc2Vzc2lvbnMtdG8KICByZWNvcmRfdHlwZXM6IEFOT01fTE9HSU5fU0VTU0lPTlMKLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiBhdHRlbXB0ZWQtbG9nLWluLWR1cmluZy11bnVzdWFsLWhvdXItdG8KICByZWNvcmRfdHlwZXM6IEFOT01fTE9HSU5fVElNRQotCiAgYWN0aW9uOiB0ZXN0ZWQtZmlsZS1zeXN0ZW0taW50ZWdyaXR5LW9mCiAgb2JqZWN0OgogICAgcHJpbWFyeTogaG9zdG5hbWUKICAgIHdoYXQ6IGZpbGVzeXN0ZW0KICByZWNvcmRfdHlwZXM6IEFOT01fUkJBQ19JTlRFR1JJVFlfRkFJTAotCiAgYWN0aW9uOiB2aW9sYXRlZC1zZWxpbnV4LXBvbGljeQogIHN1YmplY3Q6CiAgICBwcmltYXJ5OiBzY29udGV4dAogIG9iamVjdDoKICAgIHByaW1hcnk6IHRjb250ZXh0CiAgICBzZWNvbmRhcnk6IHRjbGFzcwogIHJlY29yZF90eXBlczogQVZDCiAgaGFzX2ZpZWxkczoKICAtIHNlcmVzdWx0Ci0KICBhY3Rpb246IHZpb2xhdGVkLWFwcGFybW9yLXBvbGljeQogIG9iamVjdDoKICAgIHByaW1hcnk6IG9wZXJhdGlvbgogICAgc2Vjb25kYXJ5OiBbcmVxdWVzdGVkX21hc2ssIGRlbmllZF9tYXNrLCBjYXBuYW1lXQogICAgd2hhdDogcG9saWN5CiAgcmVjb3JkX3R5cGVzOiBBVkMKICBoYXNfZmllbGRzOgogIC0gYXBwYXJtb3IKLQogIGFjdGlvbjogY2hhbmdlZC1ncm91cAogIHJlY29yZF90eXBlczogQ0hHUlBfSUQKLQogIGFjdGlvbjogY2hhbmdlZC11c2VyLWlkCiAgcmVjb3JkX3R5cGVzOiBDSFVTRVJfSUQKLQogIGFjdGlvbjogY2hhbmdlZC1hdWRpdC1jb25maWd1cmF0aW9uCiAgb2JqZWN0OgogICAgcHJpbWFyeTogW29wLCBrZXksIGF1ZGl0X2VuYWJsZWQsIGF1ZGl0X3BpZCwgYXVkaXRfYmFja2xvZ19saW1pdCwgYXVkaXRfZmFpbHVyZV0KICAgIHdoYXQ6IGF1ZGl0LWNvbmZpZwogIHJlY29yZF90eXBlczogQ09ORklHX0NIQU5HRQotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IGFjcXVpcmVkLWNyZWRlbnRpYWxzCiAgcmVjb3JkX3R5cGVzOiBDUkVEX0FDUQotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IGRpc3Bvc2VkLWNyZWRlbnRpYWxzCiAgcmVjb3JkX3R5cGVzOiBDUkVEX0RJU1AKLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiByZWZyZXNoZWQtY3JlZGVudGlhbHMKICByZWNvcmRfdHlwZXM6IENSRURfUkVGUgotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IG5lZ290aWF0ZWQtY3J5cHRvLWtleQogIG9iamVjdDoKICAgIHByaW1hcnk6IGZwCiAgICBzZWNvbmRhcnk6IFthZGRyLCBob3N0bmFtZV0KICAgIHdoYXQ6IHVzZXItc2Vzc2lvbgogIHJlY29yZF90eXBlczogQ1JZUFRPX0tFWV9VU0VSCiAgc291cmNlX2lwOiBbYWRkcl0KLQogIGFjdGlvbjogY3J5cHRvLW9mZmljZXItbG9nZ2VkLWluCiAgcmVjb3JkX3R5cGVzOiBDUllQVE9fTE9HSU4KLQogIGFjdGlvbjogY3J5cHRvLW9mZmljZXItbG9nZ2VkLW91dAogIHJlY29yZF90eXBlczogQ1JZUFRPX0xPR09VVAotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IHN0YXJ0ZWQtY3J5cHRvLXNlc3Npb24KICBvYmplY3Q6CiAgICBwcmltYXJ5OiBhZGRyCiAgICBzZWNvbmRhcnk6IFtycG9ydF0KICByZWNvcmRfdHlwZXM6IENSWVBUT19TRVNTSU9OCiAgc291cmNlX2lwOiBbYWRkcl0KLQogIGFjdGlvbjogYWNjZXNzLXJlc3VsdAogIHJlY29yZF90eXBlczogREFDX0NIRUNLCi0KICBhY3Rpb246IGFib3J0ZWQtYXVkaXRkLXN0YXJ0dXAKICBvYmplY3Q6CiAgICB3aGF0OiBzZXJ2aWNlCiAgcmVjb3JkX3R5cGVzOiBEQUVNT05fQUJPUlQKLQogIGFjdGlvbjogcmVtb3RlLWF1ZGl0LWNvbm5lY3RlZAogIG9iamVjdDoKICAgIHdoYXQ6IHNlcnZpY2UKICByZWNvcmRfdHlwZXM6IERBRU1PTl9BQ0NFUFQKLQogIGFjdGlvbjogcmVtb3RlLWF1ZGl0LWRpc2Nvbm5lY3RlZAogIG9iamVjdDoKICAgIHdoYXQ6IHNlcnZpY2UKICByZWNvcmRfdHlwZXM6IERBRU1PTl9DTE9TRQotCiAgYWN0aW9uOiBjaGFuZ2VkLWF1ZGl0ZC1jb25maWd1cmF0aW9uCiAgb2JqZWN0OgogICAgd2hhdDogc2VydmljZQogIHJlY29yZF90eXBlczogREFFTU9OX0NPTkZJRwotCiAgYWN0aW9uOiBzaHV0ZG93bi1hdWRpdAogIG9iamVjdDoKICAgIHdoYXQ6IHNlcnZpY2UKICByZWNvcmRfdHlwZXM6IERBRU1PTl9FTkQKLQogIGFjdGlvbjogYXVkaXQtZXJyb3IKICBvYmplY3Q6CiAgICB3aGF0OiBzZXJ2aWNlCiAgcmVjb3JkX3R5cGVzOiBEQUVNT05fRVJSCi0KICBhY3Rpb246IHJlY29uZmlndXJlZC1hdWRpdGQKICBvYmplY3Q6CiAgICB3aGF0OiBzZXJ2aWNlCiAgcmVjb3JkX3R5cGVzOiBEQUVNT05fUkVDT05GSUcKLQogIGFjdGlvbjogcmVzdW1lZC1hdWRpdC1sb2dnaW5nCiAgb2JqZWN0OgogICAgd2hhdDogc2VydmljZQogIHJlY29yZF90eXBlczogREFFTU9OX1JFU1VNRQotCiAgYWN0aW9uOiByb3RhdGVkLWF1ZGl0LWxvZ3MKICBvYmplY3Q6CiAgICB3aGF0OiBzZXJ2aWNlCiAgcmVjb3JkX3R5cGVzOiBEQUVNT05fUk9UQVRFCi0KICBhY3Rpb246IHN0YXJ0ZWQtYXVkaXQKICBvYmplY3Q6CiAgICB3aGF0OiBzZXJ2aWNlCiAgcmVjb3JkX3R5cGVzOiBEQUVNT05fU1RBUlQKLQogIGFjdGlvbjogZGVsZXRlZC1ncm91cC1hY2NvdW50LWZyb20KICBvYmplY3Q6CiAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICB3aGF0OiBhY2NvdW50CiAgcmVjb3JkX3R5cGVzOiBERUxfR1JPVVAKLQogIGFjdGlvbjogZGVsZXRlZC11c2VyLWFjY291bnQKICBvYmplY3Q6CiAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICB3aGF0OiBhY2NvdW50CiAgcmVjb3JkX3R5cGVzOiBERUxfVVNFUgotCiAgYWN0aW9uOiBjaGFuZ2VkLWF1ZGl0LWZlYXR1cmUKICBvYmplY3Q6CiAgICBwcmltYXJ5OiBmZWF0dXJlCiAgICB3aGF0OiBzeXN0ZW0KICByZWNvcmRfdHlwZXM6IEZFQVRVUkVfQ0hBTkdFCi0KICBhY3Rpb246IHJlbGFiZWxlZC1maWxlc3lzdGVtCiAgcmVjb3JkX3R5cGVzOiBGU19SRUxBQkVMCi0KICBhY3Rpb246IGF1dGhlbnRpY2F0ZWQtdG8tZ3JvdXAKICByZWNvcmRfdHlwZXM6IEdSUF9BVVRICi0KICA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogIGFjdGlvbjogY2hhbmdlZC1ncm91cC1wYXNzd29yZAogIG9iamVjdDoKICAgIHByaW1hcnk6IGFjY3QKICAgIHdoYXQ6IHVzZXItc2Vzc2lvbgogIHJlY29yZF90eXBlczogR1JQX0NIQVVUSFRPSwotCiAgYWN0aW9uOiBtb2RpZmllZC1ncm91cC1hY2NvdW50CiAgb2JqZWN0OgogICAgcHJpbWFyeTogW2lkLCBhY2N0XQogICAgd2hhdDogYWNjb3VudAogIHJlY29yZF90eXBlczogR1JQX01HTVQKLQogIGFjdGlvbjogaW5pdGlhbGl6ZWQtYXVkaXQtc3Vic3lzdGVtCiAgcmVjb3JkX3R5cGVzOiBLRVJORUwKLQogIGFjdGlvbjogbW9kaWZpZWQtbGV2ZWwtb2YKICBvYmplY3Q6CiAgICBwcmltYXJ5OiBwcmludGVyCiAgICB3aGF0OiBwcmludGVyCiAgcmVjb3JkX3R5cGVzOiBMQUJFTF9MRVZFTF9DSEFOR0UKLQogIGFjdGlvbjogb3ZlcnJvZGUtbGFiZWwtb2YKICBvYmplY3Q6CiAgICB3aGF0OiBtYWMtY29uZmlnCiAgcmVjb3JkX3R5cGVzOiBMQUJFTF9PVkVSUklERQotCiAgb2JqZWN0OgogICAgd2hhdDogbWFjLWNvbmZpZwogIHJlY29yZF90eXBlczoKICAtIEFVRElUX0RFVl9BTExPQwogIC0gQVVESVRfREVWX0RFQUxMT0MKICAtIEFVRElUX0ZTX1JFTEFCRUwKICAtIEFVRElUX1VTRVJfTUFDX1BPTElDWV9MT0FECiAgLSBBVURJVF9VU0VSX01BQ19DT05GSUdfQ0hBTkdFCi0KICBhY3Rpb246IGNoYW5nZWQtbG9naW4taWQtdG8KICBzdWJqZWN0OgogICAgcHJpbWFyeTogW29sZF9hdWlkLCBvbGQtYXVpZF0KICAgIHNlY29uZGFyeTogdWlkCiAgb2JqZWN0OgogICAgcHJpbWFyeTogYXVpZAogICAgd2hhdDogdXNlci1zZXNzaW9uCiAgcmVjb3JkX3R5cGVzOiBMT0dJTgotCiAgYWN0aW9uOiBtYWMtcGVybWlzc2lvbgogIHJlY29yZF90eXBlczogTUFDX0NIRUNLCi0KICBhY3Rpb246IGNoYW5nZWQtc2VsaW51eC1ib29sZWFuCiAgb2JqZWN0OgogICAgcHJpbWFyeTogYm9vbAogICAgd2hhdDogbWFjLWNvbmZpZwogIHJlY29yZF90eXBlczogTUFDX0NPTkZJR19DSEFOR0UKLQogIGFjdGlvbjogbG9hZGVkLXNlbGludXgtcG9saWN5CiAgb2JqZWN0OgogICAgd2hhdDogbWFjLWNvbmZpZwogIHJlY29yZF90eXBlczogTUFDX1BPTElDWV9MT0FECi0KICBhY3Rpb246IGNoYW5nZWQtc2VsaW51eC1lbmZvcmNlbWVudAogIG9iamVjdDoKICAgIHByaW1hcnk6IGVuZm9yY2luZwogICAgd2hhdDogbWFjLWNvbmZpZwogIHJlY29yZF90eXBlczogTUFDX1NUQVRVUwotCiAgYWN0aW9uOiBhc3NpZ25lZC11c2VyLXJvbGUtdG8KICBvYmplY3Q6CiAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICB3aGF0OiBhY2NvdW50CiAgcmVjb3JkX3R5cGVzOiBST0xFX0FTU0lHTgotCiAgYWN0aW9uOiBtb2RpZmllZC1yb2xlCiAgcmVjb3JkX3R5cGVzOiBST0xFX01PRElGWQotCiAgYWN0aW9uOiByZW1vdmVkLXVzZS1yb2xlLWZyb20KICBvYmplY3Q6CiAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICB3aGF0OiBhY2NvdW50CiAgcmVjb3JkX3R5cGVzOiBST0xFX1JFTU9WRQotCiAgYWN0aW9uOiB2aW9sYXRlZC1zZWNjb21wLXBvbGljeQogIG9iamVjdDoKICAgIHByaW1hcnk6IHN5c2NhbGwKICAgIHdoYXQ6IHByb2Nlc3MKICByZWNvcmRfdHlwZXM6IFNFQ0NPTVAKLQogIGFjdGlvbjogc3RhcnRlZC1zZXJ2aWNlCiAgb2JqZWN0OgogICAgcHJpbWFyeTogdW5pdAogICAgd2hhdDogc2VydmljZQogIHJlY29yZF90eXBlczogU0VSVklDRV9TVEFSVAotCiAgYWN0aW9uOiBzdG9wcGVkLXNlcnZpY2UKICBvYmplY3Q6CiAgICBwcmltYXJ5OiB1bml0CiAgICB3aGF0OiBzZXJ2aWNlCiAgcmVjb3JkX3R5cGVzOiBTRVJWSUNFX1NUT1AKLQogIGFjdGlvbjogYm9vdGVkLXN5c3RlbQogIG9iamVjdDoKICAgIHdoYXQ6IHN5c3RlbQogIHJlY29yZF90eXBlczogU1lTVEVNX0JPT1QKLQogIGFjdGlvbjogY2hhbmdlZC10by1ydW5sZXZlbAogIG9iamVjdDoKICAgIHByaW1hcnk6IG5ldy1sZXZlbAogICAgd2hhdDogc3lzdGVtCiAgcmVjb3JkX3R5cGVzOiBTWVNURU1fUlVOTEVWRUwKLQogIGFjdGlvbjogc2h1dGRvd24tc3lzdGVtCiAgb2JqZWN0OgogICAgd2hhdDogc3lzdGVtCiAgcmVjb3JkX3R5cGVzOiBTWVNURU1fU0hVVERPV04KLQogIGFjdGlvbjogc2VudC10ZXN0CiAgcmVjb3JkX3R5cGVzOiBURVNUCi0KICBhY3Rpb246IHVua25vd24KICByZWNvcmRfdHlwZXM6IFRSVVNURURfQVBQCi0KICBhY3Rpb246IHNlbnQtbWVzc2FnZQogIG9iamVjdDoKICAgIHByaW1hcnk6IGFkZHIKICByZWNvcmRfdHlwZXM6IFVTRVIKLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiB3YXMtYXV0aG9yaXplZAogIHJlY29yZF90eXBlczogVVNFUl9BQ0NUCi0KICA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogIGFjdGlvbjogYXV0aGVudGljYXRlZAogIHJlY29yZF90eXBlczogVVNFUl9BVVRICi0KICBhY3Rpb246IGFjY2Vzcy1wZXJtaXNzaW9uCiAgcmVjb3JkX3R5cGVzOiBVU0VSX0FWQwotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IGNoYW5nZWQtcGFzc3dvcmQKICByZWNvcmRfdHlwZXM6IFVTRVJfQ0hBVVRIVE9LCi0KICBhY3Rpb246IHJhbi1jb21tYW5kCiAgb2JqZWN0OgogICAgcHJpbWFyeTogY21kCiAgICB3aGF0OiBwcm9jZXNzCiAgcmVjb3JkX3R5cGVzOiBVU0VSX0NNRAogIGRlc2NyaXB0aW9uOiA+CiAgICBUaGVzZSBtZXNzYWdlcyBhcmUgZnJvbSB1c2VyLXNwYWNlIGFwcHMsIGxpa2Ugc3VkbywgdGhhdCBsb2cgY29tbWFuZHMKICAgIGJlaW5nIHJ1biBieSBhIHVzZXIuIFRoZSB1aWQgY29udGFpbmVkIGluIHRoZXNlIG1lc3NhZ2VzIGlzIHVzZXIncyBVSUQgYXQKICAgIHRoZSB0aW1lIHRoZSBjb21tYW5kIHdhcyBydW4uIEl0IGlzIG5vdCB0aGUgInRhcmdldCIgVUlEIHVzZWQgdG8gcnVuIHRoZQogICAgY29tbWFuZCwgd2hpY2ggaXMgbm9ybWFsbHkgcm9vdC4KLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiBlbmRlZC1zZXNzaW9uCiAgcmVjb3JkX3R5cGVzOiBVU0VSX0VORAotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IGVycm9yCiAgcmVjb3JkX3R5cGVzOiBVU0VSX0VSUgogIHNvdXJjZV9pcDogW2FkZHJdCi0KICA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogIGFjdGlvbjogbG9nZ2VkLWluCiAgcmVjb3JkX3R5cGVzOiBVU0VSX0xPR0lOCiAgc291cmNlX2lwOiBbYWRkcl0KLQogIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgYWN0aW9uOiBsb2dnZWQtb3V0CiAgcmVjb3JkX3R5cGVzOiBVU0VSX0xPR09VVAotCiAgYWN0aW9uOiBjaGFuZ2VkLW1hYy1jb25maWd1cmF0aW9uCiAgcmVjb3JkX3R5cGVzOiBVU0VSX01BQ19DT05GSUdfQ0hBTkdFCi0KICBhY3Rpb246IGxvYWRlZC1tYWMtcG9saWN5CiAgcmVjb3JkX3R5cGVzOiBVU0VSX01BQ19QT0xJQ1lfTE9BRAotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IG1vZGlmaWVkLXVzZXItYWNjb3VudAogIHJlY29yZF90eXBlczogVVNFUl9NR01UCi0KICA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogIGFjdGlvbjogY2hhbmdlZC1yb2xlLXRvCiAgb2JqZWN0OgogICAgcHJpbWFyeTogc2VsZWN0ZWQtY29udGV4dAogICAgd2hhdDogdXNlci1zZXNzaW9uCiAgcmVjb3JkX3R5cGVzOiBVU0VSX1JPTEVfQ0hBTkdFCi0KICBhY3Rpb246IGFjY2Vzcy1lcnJvcgogIHJlY29yZF90eXBlczogVVNFUl9TRUxJTlVYX0VSUgotCiAgPDw6ICptYWNyby11c2VyLXNlc3Npb24KICBhY3Rpb246IHN0YXJ0ZWQtc2Vzc2lvbgogIHJlY29yZF90eXBlczogVVNFUl9TVEFSVAogIHNvdXJjZV9pcDogW2FkZHJdCi0KICBhY3Rpb246IGNoYW5nZWQtY29uZmlndXJhdGlvbgogIG9iamVjdDoKICAgIHByaW1hcnk6IG9wCiAgICB3aGF0OiBzeXN0ZW0KICByZWNvcmRfdHlwZXM6IFVTWVNfQ09ORklHCi0KICBhY3Rpb246IGlzc3VlZC12bS1jb250cm9sCiAgb2JqZWN0OgogICAgcHJpbWFyeTogb3AKICAgIHNlY29uZGFyeTogdm0KICAgIHdoYXQ6IHZpcnR1YWwtbWFjaGluZQogIHJlY29yZF90eXBlczogVklSVF9DT05UUk9MCi0KICBhY3Rpb246IGNyZWF0ZWQtdm0taW1hZ2UKICByZWNvcmRfdHlwZXM6IFZJUlRfQ1JFQVRFCi0KICBhY3Rpb246IGRlbGV0ZWQtdm0taW1hZ2UKICByZWNvcmRfdHlwZXM6IFZJUlRfREVTVFJPWQotCiAgYWN0aW9uOiBjaGVja2VkLWludGVncml0eS1vZgogIHJlY29yZF90eXBlczogVklSVF9JTlRFR1JJVFlfQ0hFQ0sKLQogIGFjdGlvbjogYXNzaWduZWQtdm0taWQKICBvYmplY3Q6CiAgICBwcmltYXJ5OiB2bQogICAgd2hhdDogdmlydHVhbC1tYWNoaW5lCiAgcmVjb3JkX3R5cGVzOiBWSVJUX01BQ0hJTkVfSUQKLQogIGFjdGlvbjogbWlncmF0ZWQtdm0tZnJvbQogIHJlY29yZF90eXBlczogVklSVF9NSUdSQVRFX0lOCi0KICBhY3Rpb246IG1pZ3JhdGVkLXZtLXRvCiAgcmVjb3JkX3R5cGVzOiBWSVJUX01JR1JBVEVfT1VUCi0KICBhY3Rpb246IGFzc2lnbmVkLXZtLXJlc291cmNlCiAgb2JqZWN0OgogICAgcHJpbWFyeTogcmVzcmMKICAgIHNlY29uZGFyeTogdm0KICAgIHdoYXQ6IHZpcnR1YWwtbWFjaGluZQogIHJlY29yZF90eXBlczogVklSVF9SRVNPVVJDRQotIGFjdGlvbjogdHlwZWQKICBvYmplY3Q6CiAgICBwcmltYXJ5OiBkYXRhCiAgICB3aGF0OiBrZXlzdHJva2VzCiAgaG93OiBbY29tbSwgZXhlXQogIHJlY29yZF90eXBlczoKICAtIFRUWQogIC0gVVNFUl9UVFkK")
+		value, _ = base64.StdEncoding.DecodeString("LS0tCiMgTWFjcm9zIGRlY2xhcmVzIHNvbWUgWUFNTCBhbmNob3JzIHRoYXQgY2FuIGJlIHJlZmVyZW5jZWQgZm9yIHNvbWUgY29tbW9uCiMgb2JqZWN0IHR5cGUgbm9ybWFsaXphdGlvbnMgbGlrZSB1c2VyLXNlc3Npb24sIHNvY2tldCwgb3IgcHJvY2Vzcy4KbWFjcm9zOgogIC0gJmRlZmF1bHRzCiAgICBzdWJqZWN0OgogICAgICBwcmltYXJ5OiBhdWlkCiAgICAgIHNlY29uZGFyeTogdWlkCiAgICBob3c6IFtleGUsIGNvbW1dCgogIC0gJm1hY3JvLXVzZXItc2Vzc2lvbgogICAgc3ViamVjdDoKICAgICAgcHJpbWFyeTogYXVpZAogICAgICBzZWNvbmRhcnk6IFthY2N0LCBpZCwgdWlkXQogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiB0ZXJtaW5hbAogICAgICBzZWNvbmRhcnk6IFthZGRyLCBob3N0bmFtZV0KICAgICAgd2hhdDogdXNlci1zZXNzaW9uCiAgICBob3c6IFtleGUsIHRlcm1pbmFsXQoKICAtICZtYWNyby1zb2NrZXQKICAgIDw8OiAqZGVmYXVsdHMKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogW2FkZHIsIHBhdGhdCiAgICAgIHNlY29uZGFyeTogcG9ydAogICAgICB3aGF0OiBzb2NrZXQKCiAgLSAmbWFjcm8tcHJvY2VzcwogICAgPDw6ICpkZWZhdWx0cwogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBbY21kLCBleGUsIGNvbW1dCiAgICAgIHNlY29uZGFyeTogcGlkCiAgICAgIHdoYXQ6IHByb2Nlc3MKICAgIGhvdzogdGVybWluYWwKCiAgLSAmZWNzLWlhbQogICAgY2F0ZWdvcnk6IGlhbQogICAgdHlwZTogaW5mbwoKICAtICZlY3MtYXV0aAogICAgY2F0ZWdvcnk6IGF1dGhlbnRpY2F0aW9uCiAgICB0eXBlOiBpbmZvCgogIC0gJmVjcy1ob3N0CiAgICBjYXRlZ29yeTogaG9zdAogICAgdHlwZTogaW5mbwoKICAtICZlY3MtcHJvY2VzcwogICAgY2F0ZWdvcnk6IHByb2Nlc3MKICAgIHR5cGU6IGluZm8KCiAgLSAmZWNzLWZpbGUKICAgIGNhdGVnb3J5OiBmaWxlCiAgICB0eXBlOiBpbmZvCgogIC0gJmVjcy1kcml2ZXIKICAgIGNhdGVnb3J5OiBkcml2ZXIKICAgIHR5cGU6IGluZm8KCiAgLSAmZWNzLW5ldHdvcmsKICAgIGNhdGVnb3J5OiBuZXR3b3JrCiAgICB0eXBlOgogICAgICAtIGNvbm5lY3Rpb24KICAgICAgLSBpbmZvCgojIE5vcm1hbGl6YXRpb25zIGlzIGEgbGlzdCBvZiBkZWNsYXJhdGlvbnMgc3BlY2lmeWluZyBob3cgdG8gbm9ybWFsaXplIHRoZSBkYXRhCiMgY29udGFpbmVkIGluIGFuIGV2ZW50LiBUaGUgbm9ybWFsaXphdGlvbiBjYW4gYmUgYXBwbGllZCBiYXNlZCBvbiB0aGUgc3lzY2FsbAojIG5hbWUgKGUuZy4gY29ubmVjdCwgb3Blbikgb3IgYmFzZWQgb24gdGhlIHJlY29yZCB0eXBlIChlLmcuIFVTRVJfTE9HSU4pLgojIE5vIHR3byBub3JtYWxpemF0aW9ucyBjYW4gYXBwbHkgdG8gdGhlIHNhbWUgc3lzY2FsbCBvciByZWNvcmQgdHlwZS4gVGhpcwojIHdpbGwgcmVzdWx0IGluIGEgZmFpbHVyZSBhdCBsb2FkIHRpbWUuCiMKIyBFYWNoIG5vcm1hbGl6YXRpb24gc2hvdWxkIHNwZWNpZnk6CiMgICBhY3Rpb24gLSB3aGF0IGhhcHBlbmVkCiMgICBhY3RvciAgLSB3aG8gZGlkIHRoaXMgb3Igd2hvIHRyaWdnZXJlZCB0aGUgZXZlbnQKIyAgIG9iamVjdCAtIHdoYXQgd2FzIHRoZSAidGhpbmciIGludm9sdmVkIGluIHRoZSBhY3Rpb24gKGUuZy4gcHJvY2Vzcywgc29ja2V0KQojICAgaG93ICAgIC0gaG93IHdhcyB0aGUgYWN0aW9uIHBlcmZvcm1lZCAoZS5nLiBleGUgb3IgdGVybWluYWwpCm5vcm1hbGl6YXRpb25zOgogIC0gZWNzOiAqZWNzLXByb2Nlc3MKICAgIHN5c2NhbGxzOgogICAgICAtICcqJyAjIHRoaXMgaXMgYSBjYXRjaCBhbGwKICAtIGFjdGlvbjogb3BlbmVkLWZpbGUKICAgIG9iamVjdDoKICAgICAgd2hhdDogZmlsZQogICAgc3lzY2FsbHM6CiAgICAgICMgY3JlYXQgLSBvcGVuIGFuZCBwb3NzaWJseSBjcmVhdGUgYSBmaWxlCiAgICAgIC0gY3JlYXQKICAgIGVjczoKICAgICAgPDw6ICplY3MtZmlsZQogICAgICB0eXBlOiBjcmVhdGlvbgogIC0gYWN0aW9uOiBvcGVuZWQtZmlsZQogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyBmYWxsb2NhdGUgLSBtYW5pcHVsYXRlIGZpbGUgc3BhY2UKICAgICAgLSBmYWxsb2NhdGUKICAgICAgIyB0cnVuY2F0ZSAtIHRydW5jYXRlIGEgZmlsZSB0byBhIHNwZWNpZmllZCBsZW5ndGgKICAgICAgLSB0cnVuY2F0ZQogICAgICAjIGZ0cnVuY2F0ZSAtIHRydW5jYXRlIGEgZmlsZSB0byBhIHNwZWNpZmllZCBsZW5ndGgKICAgICAgLSBmdHJ1bmNhdGUKICAgIGVjczoKICAgICAgPDw6ICplY3MtZmlsZQogICAgICAjIHRlY2huaWNhbGx5IHlvdSBjYW4gdHJ1bmNhdGUgYSBmaWxlIHRvIHRoZSBzYW1lIGxlbmd0aAogICAgICAjIGJ1dCByZWdhcmRsZXNzLCB3ZSBjb25zaWRlciB0aGlzIGEgY2hhbmdlCiAgICAgIHR5cGU6IGNoYW5nZQogIC0gYWN0aW9uOiBvcGVuZWQtZmlsZQogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyBvcGVuIC0gb3BlbiBhbmQgcG9zc2libHkgY3JlYXRlIGEgZmlsZQogICAgICAtIG9wZW4KICAgICAgIyBvcGVuYXQgLSBvcGVuIGFuZCBwb3NzaWJseSBjcmVhdGUgYSBmaWxlCiAgICAgIC0gb3BlbmF0CiAgICAgICMgcmVhZGxpbmsgLSByZWFkIHZhbHVlIG9mIGEgc3ltYm9saWMgbGluawogICAgICAtIHJlYWRsaW5rCiAgICAgICMgcmVhZGxpbmthdCAtIHJlYWQgdmFsdWUgb2YgYSBzeW1ib2xpYyBsaW5rCiAgICAgIC0gcmVhZGxpbmthdAogICAgZWNzOiAqZWNzLWZpbGUKICAtIGFjdGlvbjogcmVhZC1maWxlCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IGZpbGUKICAgIHN5c2NhbGxzOgogICAgICAjIHJlYWQgLSByZWFkIGZyb20gYSBmaWxlIGRlc2NyaXB0b3IKICAgICAgLSByZWFkCiAgICBlY3M6ICplY3MtZmlsZQogIC0gYWN0aW9uOiB3cm90ZS10by1maWxlCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IGZpbGUKICAgIHN5c2NhbGxzOgogICAgICAjIHdyaXRlIC0gd3JpdGUgdG8gYSBmaWxlIGRlc2NyaXB0b3IKICAgICAgLSB3cml0ZQogICAgZWNzOgogICAgICA8PDogKmVjcy1maWxlCiAgICAgIHR5cGU6IGNoYW5nZQogIC0gYWN0aW9uOiBjaGFuZ2VkLWZpbGUtYXR0cmlidXRlcy1vZgogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyBzZXR4YXR0ciAtIHNldCBhbiBleHRlbmRlZCBhdHRyaWJ1dGUgdmFsdWUKICAgICAgLSBzZXR4YXR0cgogICAgICAjIGZzZXR4YXR0ciAtIHNldCBhbiBleHRlbmRlZCBhdHRyaWJ1dGUgdmFsdWUKICAgICAgLSBmc2V0eGF0dHIKICAgICAgIyBsc2V0eGF0dHIgLSBzZXQgYW4gZXh0ZW5kZWQgYXR0cmlidXRlIHZhbHVlCiAgICAgIC0gbHNldHhhdHRyCiAgICAgICMgcmVtb3ZleGF0dHIgLSByZW1vdmUgYW4gZXh0ZW5kZWQgYXR0cmlidXRlCiAgICAgIC0gcmVtb3ZleGF0dHIKICAgICAgIyBmcmVtb3ZleGF0dHIgLSByZW1vdmUgYW4gZXh0ZW5kZWQgYXR0cmlidXRlCiAgICAgIC0gZnJlbW92ZXhhdHRyCiAgICAgICMgbHJlbW92ZXhhdHRyIC0gcmVtb3ZlIGFuIGV4dGVuZGVkIGF0dHJpYnV0ZQogICAgICAtIGxyZW1vdmV4YXR0cgogICAgZWNzOgogICAgICA8PDogKmVjcy1maWxlCiAgICAgIHR5cGU6IGNoYW5nZQogIC0gYWN0aW9uOiBjaGFuZ2VkLWZpbGUtcGVybWlzc2lvbnMtb2YKICAgIG9iamVjdDoKICAgICAgd2hhdDogZmlsZQogICAgc3lzY2FsbHM6CiAgICAgICMgY2htb2QgLSBjaGFuZ2UgcGVybWlzc2lvbnMgb2YgYSBmaWxlCiAgICAgIC0gY2htb2QKICAgICAgIyBmY2htb2QgLSBjaGFuZ2UgcGVybWlzc2lvbnMgb2YgYSBmaWxlCiAgICAgIC0gZmNobW9kCiAgICAgICMgZmNobW9kYXQgLSBjaGFuZ2UgcGVybWlzc2lvbnMgb2YgYSBmaWxlCiAgICAgIC0gZmNobW9kYXQKICAgIGVjczoKICAgICAgPDw6ICplY3MtZmlsZQogICAgICB0eXBlOiBjaGFuZ2UKICAtIGFjdGlvbjogY2hhbmdlZC1maWxlLW93bmVyc2hpcC1vZgogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyBjaG93biAtIGNoYW5nZSBvd25lcnNoaXAgb2YgYSBmaWxlCiAgICAgIC0gY2hvd24KICAgICAgIyBmY2hvd24gLSBjaGFuZ2Ugb3duZXJzaGlwIG9mIGEgZmlsZQogICAgICAtIGZjaG93bgogICAgICAjIGZjaG93bmF0IC0gY2hhbmdlIG93bmVyc2hpcCBvZiBhIGZpbGUKICAgICAgLSBmY2hvd25hdAogICAgICAjIGxjaG93biAtIGNoYW5nZSBvd25lcnNoaXAgb2YgYSBmaWxlCiAgICAgIC0gbGNob3duCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWZpbGUKICAgICAgdHlwZTogY2hhbmdlCiAgLSBhY3Rpb246IGxvYWRlZC1rZXJuZWwtbW9kdWxlCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IGZpbGUKICAgICAgcHJpbWFyeTogbmFtZQogICAgcmVjb3JkX3R5cGVzOgogICAgICAtIEtFUk5fTU9EVUxFCiAgICBzeXNjYWxsczoKICAgICAgIyBmaW5pdF9tb2R1bGUgLSBsb2FkIGEga2VybmVsIG1vZHVsZQogICAgICAtIGZpbml0X21vZHVsZQogICAgICAjIGluaXRfbW9kdWxlIC0gbG9hZCBhIGtlcm5lbCBtb2R1bGUKICAgICAgLSBpbml0X21vZHVsZQogICAgZWNzOgogICAgICA8PDogKmVjcy1kcml2ZXIKICAgICAgdHlwZTogc3RhcnQKICAtIGFjdGlvbjogdW5sb2FkZWQta2VybmVsLW1vZHVsZQogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyBkZWxldGVfbW9kdWxlIC0gdW5sb2FkIGEga2VybmVsIG1vZHVsZQogICAgICAtIGRlbGV0ZV9tb2R1bGUKICAgIGVjczoKICAgICAgPDw6ICplY3MtZHJpdmVyCiAgICAgIHR5cGU6IGVuZAogIC0gYWN0aW9uOiBjcmVhdGVkLWRpcmVjdG9yeQogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICAgIHBhdGhfaW5kZXg6IDEKICAgIHN5c2NhbGxzOgogICAgICAjIG1rZGlyIC0gY3JlYXRlIGEgZGlyZWN0b3J5CiAgICAgIC0gbWtkaXIKICAgICAgIyBta2RpcmF0IC0gY3JlYXRlIGEgZGlyZWN0b3J5CiAgICAgIC0gbWtkaXJhdAogICAgZWNzOgogICAgICA8PDogKmVjcy1maWxlCiAgICAgIHR5cGU6IGNyZWF0aW9uCiAgLSBhY3Rpb246IG1vdW50ZWQKICAgIG9iamVjdDoKICAgICAgd2hhdDogZmlsZXN5c3RlbQogICAgICBwYXRoX2luZGV4OiAxCiAgICBzeXNjYWxsczoKICAgICAgIyBtb3VudCAtIG1vdW50IGZpbGVzeXN0ZW0KICAgICAgLSBtb3VudAogICAgZWNzOgogICAgICA8PDogKmVjcy1maWxlCiAgICAgICMgc2luY2UgYSBuZXcgbW91bnQgYXBwZWFycyBvbiB0aGUgc3lzdGVtCiAgICAgICMgd2UgY29uc2lkZXIgdGhpcyBhIGhpZ2gtbGV2ZWwgImNyZWF0aW9uIiBldmVudAogICAgICB0eXBlOiBjcmVhdGlvbgogIC0gYWN0aW9uOiByZW5hbWVkCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IGZpbGUKICAgICAgcGF0aF9pbmRleDogMgogICAgc3lzY2FsbHM6CiAgICAgICMgcmVuYW1lIC0gY2hhbmdlIHRoZSBuYW1lIG9yIGxvY2F0aW9uIG9mIGEgZmlsZQogICAgICAtIHJlbmFtZQogICAgICAjIHJlbmFtZWF0IC0gY2hhbmdlIHRoZSBuYW1lIG9yIGxvY2F0aW9uIG9mIGEgZmlsZQogICAgICAtIHJlbmFtZWF0CiAgICAgICMgcmVuYW1lYXQyIC0gY2hhbmdlIHRoZSBuYW1lIG9yIGxvY2F0aW9uIG9mIGEgZmlsZQogICAgICAtIHJlbmFtZWF0MgogICAgZWNzOgogICAgICA8PDogKmVjcy1maWxlCiAgICAgIHR5cGU6IGNoYW5nZQogIC0gYWN0aW9uOiBjaGVja2VkLW1ldGFkYXRhLW9mCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IGZpbGUKICAgIHN5c2NhbGxzOgogICAgICAjIGFjY2VzcyAtIGNoZWNrIHVzZXIncyBwZXJtaXNzaW9ucyBmb3IgYSBmaWxlCiAgICAgIC0gYWNjZXNzCiAgICAgICMgZmFjY2Vzc2F0IC0gY2hlY2sgdXNlcidzIHBlcm1pc3Npb25zIGZvciBhIGZpbGUKICAgICAgLSBmYWNjZXNzYXQKICAgICAgIyBmc3RhdGF0IC0gZ2V0IGZpbGUgc3RhdHVzCiAgICAgIC0gZnN0YXRhdAogICAgICAjIG5ld2ZzdGF0YXQgLSBnZXQgZmlsZSBzdGF0dXMKICAgICAgLSBuZXdmc3RhdGF0CiAgICAgICMgc3RhdCAtIGdldCBmaWxlIHN0YXR1cwogICAgICAtIHN0YXQKICAgICAgIyBzdGF0NjQgLSBnZXQgZmlsZSBzdGF0dXMKICAgICAgLSBzdGF0NjQKICAgICAgIyBmc3RhdCAtIGdldCBmaWxlIHN0YXR1cwogICAgICAtIGZzdGF0CiAgICAgICMgbHN0YXQgLSBnZXQgZmlsZSBzdGF0dXMKICAgICAgLSBsc3RhdAogICAgICAjIGdldHhhdHRyIC0gcmV0cmlldmUgYW4gZXh0ZW5kZWQgYXR0cmlidXRlIHZhbHVlCiAgICAgIC0gZ2V0eGF0dHIKICAgICAgIyBsZ2V0eGF0dHIgLSByZXRyaWV2ZSBhbiBleHRlbmRlZCBhdHRyaWJ1dGUgdmFsdWUKICAgICAgLSBsZ2V0eGF0dHIKICAgICAgIyBmZ2V0eGF0dHIgLSByZXRyaWV2ZSBhbiBleHRlbmRlZCBhdHRyaWJ1dGUgdmFsdWUKICAgICAgLSBmZ2V0eGF0dHIKICAgIGVjczogKmVjcy1maWxlCiAgLSBhY3Rpb246IGNoZWNrZWQtZmlsZXN5c3RlbS1tZXRhZGF0YS1vZgogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlc3lzdGVtCiAgICBzeXNjYWxsczoKICAgICAgIyBzdGF0ZnMgLSBnZXQgZmlsZXN5c3RlbSBzdGF0aXN0aWNzCiAgICAgIC0gc3RhdGZzCiAgICAgICMgZnN0YXRmcyAtIGdldCBmaWxlc3lzdGVtIHN0YXRpc3RpY3MKICAgICAgLSBmc3RhdGZzCiAgICBlY3M6ICplY3MtZmlsZQogIC0gYWN0aW9uOiBzeW1saW5rZWQKICAgIG9iamVjdDoKICAgICAgd2hhdDogZmlsZQogICAgc3lzY2FsbHM6CiAgICAgICMgc3ltbGluayAtIG1ha2UgYSBuZXcgbmFtZSBmb3IgYSBmaWxlCiAgICAgIC0gc3ltbGluawogICAgICAjIHN5bWxpbmthdCAtIG1ha2UgYSBuZXcgbmFtZSBmb3IgYSBmaWxlCiAgICAgIC0gc3ltbGlua2F0CiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWZpbGUKICAgICAgIyAiY3JlYXRpb24iIHNpbmNlIHdlJ3JlIGNyZWF0aW5nIGEgbmV3IGZpbGUgc3lzdGVtCiAgICAgICMgZW50cnkgZm9yIHRoZSBzeW1saW5rCiAgICAgIHR5cGU6IGNyZWF0aW9uCiAgLSBhY3Rpb246IHVubW91bnRlZAogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlc3lzdGVtCiAgICBzeXNjYWxsczoKICAgICAgIyB1bW91bnQgLSB1bm1vdW50IGZpbGVzeXN0ZW0KICAgICAgLSB1bW91bnQKICAgICAgIyB1bW91bnQyIC0gdW5tb3VudCBmaWxlc3lzdGVtCiAgICAgIC0gdW1vdW50MgogICAgZWNzOgogICAgICA8PDogKmVjcy1maWxlCiAgICAgICMgImRlbGV0aW9uIiB0byBtaXJyb3IgdGhlICJjcmVhdGlvbiIgb2YgdGhlIG1vdW50CiAgICAgIHR5cGU6IGRlbGV0aW9uCiAgLSBhY3Rpb246IGRlbGV0ZWQKICAgIG9iamVjdDoKICAgICAgd2hhdDogZmlsZQogICAgc3lzY2FsbHM6CiAgICAgICMgcm1kaXIgLSBkZWxldGUgYSBkaXJlY3RvcnkKICAgICAgLSBybWRpcgogICAgICAjIHVubGluayAtIGRlbGV0ZSBhIG5hbWUgYW5kIHBvc3NpYmx5IHRoZSBmaWxlIGl0IHJlZmVycyB0bwogICAgICAtIHVubGluawogICAgICAjIHVubGlua2F0IC0gZGVsZXRlIGEgbmFtZSBhbmQgcG9zc2libHkgdGhlIGZpbGUgaXQgcmVmZXJzIHRvCiAgICAgIC0gdW5saW5rYXQKICAgIGVjczoKICAgICAgPDw6ICplY3MtZmlsZQogICAgICB0eXBlOiBkZWxldGlvbgogIC0gYWN0aW9uOiBjaGFuZ2VkLXRpbWVzdGFtcC1vZgogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyB1dGltZSAtIGNoYW5nZSBmaWxlIGxhc3QgYWNjZXNzIGFuZCBtb2RpZmljYXRpb24gdGltZXMKICAgICAgLSB1dGltZQogICAgICAjIHV0aW1lcyAtIGNoYW5nZSBmaWxlIGxhc3QgYWNjZXNzIGFuZCBtb2RpZmljYXRpb24gdGltZXMKICAgICAgLSB1dGltZXMKICAgICAgIyBmdXRpbWVzYXQgLSBjaGFuZ2UgdGltZXN0YW1wcyBvZiBhIGZpbGUgcmVsYXRpdmUgdG8gYSBcIGRpcmVjdG9yeSBmaWxlIGRlc2NyaXB0b3IKICAgICAgLSBmdXRpbWVzYXQKICAgICAgIyBmdXRpbWVucyAtIGNoYW5nZSBmaWxlIHRpbWVzdGFtcHMgd2l0aCBuYW5vc2Vjb25kIHByZWNpc2lvbgogICAgICAtIGZ1dGltZW5zCiAgICAgICMgdXRpbWVuc2F0IC0gY2hhbmdlIGZpbGUgdGltZXN0YW1wcyB3aXRoIG5hbm9zZWNvbmQgcHJlY2lzaW9uCiAgICAgIC0gdXRpbWVuc2F0CiAgICBlY3M6ICplY3MtZmlsZQogIC0gYWN0aW9uOiBleGVjdXRlZAogICAgb2JqZWN0OgogICAgICB3aGF0OiBmaWxlCiAgICBzeXNjYWxsczoKICAgICAgIyBleGVjdmUgLSBleGVjdXRlIHByb2dyYW0KICAgICAgLSBleGVjdmUKICAgICAgIyBleGVjdmVhdCAtIGV4ZWN1dGUgcHJvZ3JhbSByZWxhdGl2ZSB0byBhIGRpcmVjdG9yeSBmaWxlIGRlc2NyaXB0b3IKICAgICAgLSBleGVjdmVhdAogICAgZWNzOgogICAgICA8PDogKmVjcy1wcm9jZXNzCiAgICAgIHR5cGU6IHN0YXJ0CiAgLSBhY3Rpb246IGxpc3Rlbi1mb3ItY29ubmVjdGlvbnMKICAgIG9iamVjdDoKICAgICAgd2hhdDogc29ja2V0CiAgICBzeXNjYWxsczoKICAgICAgIyBsaXN0ZW4tIGxpc3RlbiBmb3IgY29ubmVjdGlvbnMgb24gYSBzb2NrZXQKICAgICAgLSBsaXN0ZW4KICAgIGVjczoKICAgICAgPDw6ICplY3MtbmV0d29yawogICAgICB0eXBlOiBzdGFydAogIC0gYWN0aW9uOiBhY2NlcHRlZC1jb25uZWN0aW9uLWZyb20KICAgIG9iamVjdDoKICAgICAgd2hhdDogc29ja2V0CiAgICBzeXNjYWxsczoKICAgICAgIyBhY2NlcHQgLSBhY2NlcHQgYSBjb25uZWN0aW9uIG9uIGEgc29ja2V0CiAgICAgIC0gYWNjZXB0CiAgICAgICMgYWNjZXB0NCAtIGFjY2VwdCBhIGNvbm5lY3Rpb24gb24gYSBzb2NrZXQKICAgICAgLSBhY2NlcHQ0CiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLW5ldHdvcmsKICAgICAgdHlwZToKICAgICAgICAtIGNvbm5lY3Rpb24KICAgICAgICAtIHN0YXJ0CiAgLSBhY3Rpb246IGJvdW5kLXNvY2tldAogICAgb2JqZWN0OgogICAgICB3aGF0OiBzb2NrZXQKICAgIHN5c2NhbGxzOgogICAgICAjIGJpbmQgLWJpbmQgYSBuYW1lIHRvIGEgc29ja2V0CiAgICAgIC0gYmluZAogICAgZWNzOgogICAgICA8PDogKmVjcy1uZXR3b3JrCiAgICAgIHR5cGU6IHN0YXJ0CiAgLSBhY3Rpb246IGNvbm5lY3RlZC10bwogICAgb2JqZWN0OgogICAgICB3aGF0OiBzb2NrZXQKICAgIHN5c2NhbGxzOgogICAgICAtIGNvbm5lY3QKICAgIGVjczoKICAgICAgPDw6ICplY3MtbmV0d29yawogICAgICB0eXBlOgogICAgICAgIC0gY29ubmVjdGlvbgogICAgICAgIC0gc3RhcnQKICAtIGFjdGlvbjogcmVjZWl2ZWQtZnJvbQogICAgb2JqZWN0OgogICAgICB3aGF0OiBzb2NrZXQKICAgIHN5c2NhbGxzOgogICAgICAjIHJlY3YgLSByZWNlaXZlIGEgbWVzc2FnZSBmcm9tIGEgc29ja2V0CiAgICAgIC0gcmVjdgogICAgICAjIHJlY3Zmcm9tIC0gcmVjZWl2ZSBhIG1lc3NhZ2UgZnJvbSBhIHNvY2tldAogICAgICAtIHJlY3Zmcm9tCiAgICAgICMgcmVjdm1zZyAtIHJlY2VpdmUgYSBtZXNzYWdlIGZyb20gYSBzb2NrZXQKICAgICAgLSByZWN2bXNnCiAgICAgICMgcmVjdm1tc2cgLSByZWNlaXZlIG11bHRpcGxlIG1lc3NhZ2VzIG9uIGEgc29ja2V0CiAgICAgIC0gcmVjdm1tc2cKICAgIGVjczoKICAgICAgPDw6ICplY3MtbmV0d29yawogIC0gYWN0aW9uOiBzZW50LXRvCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHNvY2tldAogICAgc3lzY2FsbHM6CiAgICAgICMgc2VuZCAtIHNlbmQgYSBtZXNzYWdlIG9uIGEgc29ja2V0CiAgICAgIC0gc2VuZAogICAgICAjIHNlbmR0byAtIHNlbmQgYSBtZXNzYWdlIG9uIGEgc29ja2V0CiAgICAgIC0gc2VuZHRvCiAgICAgICMgc2VuZG1zZyAtIHNlbmQgYSBtZXNzYWdlIG9uIGEgc29ja2V0CiAgICAgIC0gc2VuZG1zZwogICAgICAjIHNlbmRtbXNnIC0gc2VuZCBtdWx0aXBsZSBtZXNzYWdlcyBvbiBhIHNvY2tldAogICAgICAtIHNlbmRtbXNnCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLW5ldHdvcmsKICAtIGFjdGlvbjoga2lsbGVkLXBpZAogICAgb2JqZWN0OgogICAgICB3aGF0OiBwcm9jZXNzCiAgICBzeXNjYWxsczoKICAgICAgIyBraWxsIC0gc2VuZCBzaWduYWwgdG8gYSBwcm9jZXNzCiAgICAgIC0ga2lsbAogICAgICAjIHRraWxsIC0gc2VuZCBhIHNpZ25hbCB0byBhIHRocmVhZAogICAgICAtIHRraWxsCiAgICAgICMgdGdraWxsIC0gc2VuZCBhIHNpZ25hbCB0byBhIHRocmVhZAogICAgICAtIHRna2lsbAogICAgZWNzOgogICAgICA8PDogKmVjcy1wcm9jZXNzCiAgICAgIHR5cGU6IGVuZAogIC0gYWN0aW9uOiBjaGFuZ2VkLWlkZW50aXR5LW9mCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHByb2Nlc3MKICAgIGhvdzogc3lzY2FsbAogICAgc3lzY2FsbHM6CiAgICAgICMgc2V0dWlkIC0gc2V0IHVzZXIgaWRlbnRpdHkKICAgICAgLSBzZXR1aWQKICAgICAgIyBzZXRldWlkIC0gc2V0IGVmZmVjdGl2ZSB1c2VyIG9yIGdyb3VwIElECiAgICAgIC0gc2V0ZXVpZAogICAgICAjIHNldGZzdWlkIC0gc2V0IHVzZXIgaWRlbnRpdHkgdXNlZCBmb3IgZmlsZXN5c3RlbSBjaGVja3MKICAgICAgLSBzZXRmc3VpZAogICAgICAjIHNldHJldWlkIC0gc2V0IHJlYWwgYW5kL29yIGVmZmVjdGl2ZSB1c2VyIG9yIGdyb3VwIElECiAgICAgIC0gc2V0cmV1aWQKICAgICAgIyBzZXRnaWQgLSBzZXQgZ3JvdXAgaWRlbnRpdHkKICAgICAgLSBzZXRnaWQKICAgICAgIyBzZXRlZ2lkIC0gc2V0IGVmZmVjdGl2ZSB1c2VyIG9yIGdyb3VwIElECiAgICAgIC0gc2V0ZWdpZAogICAgICAjIHNldGZzZ2lkIC0gc2V0IGdyb3VwIGlkZW50aXR5IHVzZWQgZm9yIGZpbGVzeXN0ZW0gY2hlY2tzCiAgICAgIC0gc2V0ZnNnaWQKICAgICAgIyBzZXRyZWdpZCAtIHNldCByZWFsIGFuZC9vciBlZmZlY3RpdmUgdXNlciBvciBncm91cCBJRAogICAgICAtIHNldHJlZ2lkCiAgICAgICMgc2V0cmVzdWlkIC0gc2V0IHJlYWwsIGVmZmVjdGl2ZSBhbmQgc2F2ZWQgdXNlciBvciBncm91cCBJRAogICAgICAtIHNldHJlc3VpZAogICAgICAjIHNldHJlc2dpZCAtIHNldCByZWFsLCBlZmZlY3RpdmUgYW5kIHNhdmVkIHVzZXIgb3IgZ3JvdXAgSUQKICAgICAgLSBzZXRyZXNnaWQKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBjaGFuZ2UKICAtIGFjdGlvbjogY2hhbmdlZC1zeXN0ZW0tdGltZQogICAgb2JqZWN0OgogICAgICB3aGF0OiBzeXN0ZW0KICAgIHN5c2NhbGxzOgogICAgICAjIHNldHRpbWVvZmRheSAtIGdldCAvIHNldCB0aW1lCiAgICAgIC0gc2V0dGltZW9mZGF5CiAgICAgICMgY2xvY2tfc2V0dGltZSAtIGNsb2NrIGFuZCB0aW1lIGZ1bmN0aW9ucwogICAgICAtIGNsb2NrX3NldHRpbWUKICAgICAgIyBzdGltZSAtIHNldCB0aW1lCiAgICAgIC0gc3RpbWUKICAgICAgIyBhZGp0aW1leCAtIHR1bmUga2VybmVsIGNsb2NrCiAgICAgIC0gYWRqdGltZXgKICAgIGVjczoKICAgICAgPDw6ICplY3MtaG9zdAogICAgICB0eXBlOiBjaGFuZ2UKICAtIGFjdGlvbjogbWFrZS1kZXZpY2UKICAgIG9iamVjdDoKICAgICAgd2hhdDogZmlsZQogICAgc3lzY2FsbHM6CiAgICAgICMgbWtub2QgLSBjcmVhdGUgYSBzcGVjaWFsIG9yIG9yZGluYXJ5IGZpbGUKICAgICAgLSBta25vZAogICAgICAjIG1rbm9kYXQgLSBjcmVhdGUgYSBzcGVjaWFsIG9yIG9yZGluYXJ5IGZpbGUKICAgICAgLSBta25vZGF0CiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWZpbGUKICAgICAgdHlwZTogY3JlYXRpb24KICAtIGFjdGlvbjogY2hhbmdlZC1zeXN0ZW0tbmFtZQogICAgb2JqZWN0OgogICAgICB3aGF0OiBzeXN0ZW0KICAgIHN5c2NhbGxzOgogICAgICAjIHNldGhvc3RuYW1lIC0gZ2V0L3NldCBob3N0bmFtZQogICAgICAtIHNldGhvc3RuYW1lCiAgICAgICMgc2V0ZG9tYWlubmFtZSAtIGdldC9zZXQgTklTIGRvbWFpbiBuYW1lCiAgICAgIC0gc2V0ZG9tYWlubmFtZQogICAgZWNzOgogICAgICA8PDogKmVjcy1ob3N0CiAgICAgIHR5cGU6IGNoYW5nZQogIC0gYWN0aW9uOiBhbGxvY2F0ZWQtbWVtb3J5CiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IG1lbW9yeQogICAgc3lzY2FsbHM6CiAgICAgICMgbW1hcCAtIG1hcCBvciB1bm1hcCBmaWxlcyBvciBkZXZpY2VzIGludG8gbWVtb3J5CiAgICAgIC0gbW1hcAogICAgICAjIG1tYXAyIC0gbWFwIGZpbGVzIG9yIGRldmljZXMgaW50byBtZW1vcnkKICAgICAgLSBtbWFwMgogICAgICAjIGJyayAtIGNoYW5nZSBkYXRhIHNlZ21lbnQgc2l6ZQogICAgICAtIGJyawogICAgZWNzOiAqZWNzLXByb2Nlc3MKICAtIGFjdGlvbjogYWRqdXN0ZWQtc2NoZWR1bGluZy1wb2xpY3ktb2YKICAgIG9iamVjdDoKICAgICAgd2hhdDogcHJvY2VzcwogICAgaG93OiBzeXNjYWxsCiAgICBzeXNjYWxsczoKICAgICAgIyBzY2hlZF9zZXRwYXJhbSAtIHNldCBhbmQgZ2V0IHNjaGVkdWxpbmcgcGFyYW1ldGVycwogICAgICAtIHNjaGVkX3NldHBhcmFtCiAgICAgICMgc2NoZWRfc2V0c2NoZWR1bGVyIC0gc2V0IGFuZCBnZXQgc2NoZWR1bGluZyBwb2xpY3kvcGFyYW1ldGVycwogICAgICAtIHNjaGVkX3NldHNjaGVkdWxlcgogICAgICAjIHNjaGVkX3NldGF0dHIgLSBzZXQgYW5kIGdldCBzY2hlZHVsaW5nIHBvbGljeSBhbmQgYXR0cmlidXRlcwogICAgICAtIHNjaGVkX3NldGF0dHIKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBjaGFuZ2UKCiAgIyBDdXJyZW50bHkgdW5oYW5kbGVkCiAgIyB0aGlzIGxpc3QgY29tZXMgZnJvbSBwYXJzaW5nIGxpbnV4IG1hbiBwYWdlcyBhdCBodHRwczovL2dpdC5rZXJuZWwub3JnL3B1Yi9zY20vZG9jcy9tYW4tcGFnZXMvbWFuLXBhZ2VzLmdpdAoKICAjIHNpZ2FjdGlvbiAtIGV4YW1pbmUgYW5kIGNoYW5nZSBhIHNpZ25hbCBhY3Rpb24KICAjIHJ0X3NpZ2FjdGlvbiAtIGV4YW1pbmUgYW5kIGNoYW5nZSBhIHNpZ25hbCBhY3Rpb24KICAjIHByZWFkIC0gcmVhZCBmcm9tIG9yIHdyaXRlIHRvIGEgZmlsZSBkZXNjcmlwdG9yIGF0IGEgZ2l2ZW4gb2Zmc2V0CiAgIyBwd3JpdGUgLSByZWFkIGZyb20gb3Igd3JpdGUgdG8gYSBmaWxlIGRlc2NyaXB0b3IgYXQgYSBnaXZlbiBvZmZzZXQKICAjIHMzOTBfZ3VhcmRlZF9zdG9yYWdlIC0gb3BlcmF0aW9ucyB3aXRoIHovQXJjaGl0ZWN0dXJlIGd1YXJkZWQgc3RvcmFnZSBmYWNpbGl0eQogICMgc2NoZWRfZ2V0YXR0ciAtIHNldCBhbmQgZ2V0IHNjaGVkdWxpbmcgcG9saWN5IGFuZCBhdHRyaWJ1dGVzCiAgIyBnZXRydXNhZ2UgLSBnZXQgcmVzb3VyY2UgdXNhZ2UKICAjIGZsb2NrIC0gYXBwbHkgb3IgcmVtb3ZlIGFuIGFkdmlzb3J5IGxvY2sgb24gYW4gb3BlbiBmaWxlCiAgIyBwaWRmZF9nZXRmZCAtIG9idGFpbiBhIGR1cGxpY2F0ZSBvZiBhbm90aGVyIHByb2Nlc3MncyBmaWxlIGRlc2NyaXB0b3IKICAjIGNsb2NrX25hbm9zbGVlcCAtIGhpZ2gtcmVzb2x1dGlvbiBzbGVlcCB3aXRoIHNwZWNpZmlhYmxlIGNsb2NrCiAgIyBnZXRwYWdlc2l6ZSAtIGdldCBtZW1vcnkgcGFnZSBzaXplCiAgIyBwaWRmZF9vcGVuIC0gb2J0YWluIGEgZmlsZSBkZXNjcmlwdG9yIHRoYXQgcmVmZXJzIHRvIGEgcHJvY2VzcwogICMgc3BsaWNlIC0gc3BsaWNlIGRhdGEgdG8vZnJvbSBhIHBpcGUKICAjIGdldHJlc3VpZCAtIGdldCByZWFsLCBlZmZlY3RpdmUgYW5kIHNhdmVkIHVzZXIvZ3JvdXAgSURzCiAgIyBnZXRyZXNnaWQgLSBnZXQgcmVhbCwgZWZmZWN0aXZlIGFuZCBzYXZlZCB1c2VyL2dyb3VwIElEcwogICMgcmVtYXBfZmlsZV9wYWdlcyAtIGNyZWF0ZSBhIG5vbmxpbmVhciBmaWxlIG1hcHBpbmcKICAjIGlvX2NhbmNlbCAtIGNhbmNlbCBhbiBvdXRzdGFuZGluZyBhc3luY2hyb25vdXMgSS9PIG9wZXJhdGlvbgogICMgcHJjdGwgLSBvcGVyYXRpb25zIG9uIGEgcHJvY2VzcyBvciB0aHJlYWQKICAjIGNsb2NrX2dldHJlcyAtIGNsb2NrIGFuZCB0aW1lIGZ1bmN0aW9ucwogICMgY2xvY2tfZ2V0dGltZSAtIGNsb2NrIGFuZCB0aW1lIGZ1bmN0aW9ucwogICMgZ2V0Z3JvdXBzIC0gZ2V0L3NldCBsaXN0IG9mIHN1cHBsZW1lbnRhcnkgZ3JvdXAgSURzCiAgIyBzZXRncm91cHMgLSBnZXQvc2V0IGxpc3Qgb2Ygc3VwcGxlbWVudGFyeSBncm91cCBJRHMKICAjIHZtc3BsaWNlIC0gc3BsaWNlIHVzZXIgcGFnZXMgdG8vZnJvbSBhIHBpcGUKICAjIGVwb2xsX2NyZWF0ZSAtIG9wZW4gYW4gZXBvbGwgZmlsZSBkZXNjcmlwdG9yCiAgIyBlcG9sbF9jcmVhdGUxIC0gb3BlbiBhbiBlcG9sbCBmaWxlIGRlc2NyaXB0b3IKICAjIHBvc2l4X2ZhZHZpc2UgLSBwcmVkZWNsYXJlIGFuIGFjY2VzcyBwYXR0ZXJuIGZvciBmaWxlIGRhdGEKICAjIHNpZ3dhaXRpbmZvIC0gc3luY2hyb25vdXNseSB3YWl0IGZvciBxdWV1ZWQgc2lnbmFscwogICMgc2lndGltZWR3YWl0IC0gc3luY2hyb25vdXNseSB3YWl0IGZvciBxdWV1ZWQgc2lnbmFscwogICMgcnRfc2lndGltZWR3YWl0IC0gc3luY2hyb25vdXNseSB3YWl0IGZvciBxdWV1ZWQgc2lnbmFscwogICMgc2lncmV0dXJuIC0gcmV0dXJuIGZyb20gc2lnbmFsIGhhbmRsZXIgYW5kIGNsZWFudXAgc3RhY2sgZnJhbWUKICAjIHJ0X3NpZ3JldHVybiAtIHJldHVybiBmcm9tIHNpZ25hbCBoYW5kbGVyIGFuZCBjbGVhbnVwIHN0YWNrIGZyYW1lCiAgIyBnZXRyYW5kb20gLSBvYnRhaW4gYSBzZXJpZXMgb2YgcmFuZG9tIGJ5dGVzCiAgIyBrZXljdGwgLSBtYW5pcHVsYXRlIHRoZSBrZXJuZWwncyBrZXkgbWFuYWdlbWVudCBmYWNpbGl0eQogICMgc2NoZWRfZ2V0c2NoZWR1bGVyIC0gc2V0IGFuZCBnZXQgc2NoZWR1bGluZyBwb2xpY3kvcGFyYW1ldGVycwogICMgbWJpbmQgLSBzZXQgbWVtb3J5IHBvbGljeSBmb3IgYSBtZW1vcnkgcmFuZ2UKICAjIGdldHByaW9yaXR5IC0gZ2V0L3NldCBwcm9ncmFtIHNjaGVkdWxpbmcgcHJpb3JpdHkKICAjIHNldHByaW9yaXR5IC0gZ2V0L3NldCBwcm9ncmFtIHNjaGVkdWxpbmcgcHJpb3JpdHkKICAjIGlub3RpZnlfaW5pdCAtIGluaXRpYWxpemUgYW4gaW5vdGlmeSBpbnN0YW5jZQogICMgaW5vdGlmeV9pbml0MSAtIGluaXRpYWxpemUgYW4gaW5vdGlmeSBpbnN0YW5jZQogICMgc2VtY3RsIC0gU3lzdGVtIFYgc2VtYXBob3JlIGNvbnRyb2wgb3BlcmF0aW9ucwogICMgZ2V0aG9zdG5hbWUgLSBnZXQvc2V0IGhvc3RuYW1lCiAgIyBwdHJhY2UgLSBwcm9jZXNzIHRyYWNlCiAgIyBzeXNjdGwgLSByZWFkL3dyaXRlIHN5c3RlbSBwYXJhbWV0ZXJzCiAgIyBnZXRwZWVybmFtZSAtIGdldCBuYW1lIG9mIGNvbm5lY3RlZCBwZWVyIHNvY2tldAogICMgZm9yayAtIGNyZWF0ZSBhIGNoaWxkIHByb2Nlc3MKICAjIHF1ZXJ5X21vZHVsZSAtIHF1ZXJ5IHRoZSBrZXJuZWwgZm9yIHZhcmlvdXMgYml0cyBwZXJ0YWluaW5nIHRvIG1vZHVsZXMKICAjIGlvY3RsX2xpc3QgLSBsaXN0IG9mIGlvY3RsIGNhbGxzIGluIExpbnV4L2kzODYga2VybmVsCiAgIyBtc2dnZXQgLSBnZXQgYSBTeXN0ZW0gViBtZXNzYWdlIHF1ZXVlIGlkZW50aWZpZXIKICAjIHNwdV9jcmVhdGUgLSBjcmVhdGUgYSBuZXcgc3B1IGNvbnRleHQKICAjIHN1YnBhZ2VfcHJvdCAtIGRlZmluZSBhIHN1YnBhZ2UgcHJvdGVjdGlvbiBmb3IgYW4gYWRkcmVzcyByYW5nZQogICMgcXVvdGFjdGwgLSBtYW5pcHVsYXRlIGRpc2sgcXVvdGFzCiAgIyBuZnNzZXJ2Y3RsIC0gc3lzY2FsbCBpbnRlcmZhY2UgdG8ga2VybmVsIG5mcyBkYWVtb24KICAjIG9wZW5hdDIgLSBvcGVuIGFuZCBwb3NzaWJseSBjcmVhdGUgYSBmaWxlIChleHRlbmRlZCkKICAjIGdldHJsaW1pdCAtIGdldC9zZXQgcmVzb3VyY2UgbGltaXRzCiAgIyBzZXRybGltaXQgLSBnZXQvc2V0IHJlc291cmNlIGxpbWl0cwogICMgcHJsaW1pdCAtIGdldC9zZXQgcmVzb3VyY2UgbGltaXRzCiAgIyB0ZWUgLSBkdXBsaWNhdGluZyBwaXBlIGNvbnRlbnQKICAjIHNobWdldCAtIGFsbG9jYXRlcyBhIFN5c3RlbSBWIHNoYXJlZCBtZW1vcnkgc2VnbWVudAogICMgY3JlYXRlX21vZHVsZSAtIGNyZWF0ZSBhIGxvYWRhYmxlIG1vZHVsZSBlbnRyeQogICMgZ2V0dGltZW9mZGF5IC0gZ2V0IC8gc2V0IHRpbWUKICAjIHRpbWVyX2NyZWF0ZSAtIGNyZWF0ZSBhIFBPU0lYIHBlci1wcm9jZXNzIHRpbWVyCiAgIyBmYW5vdGlmeV9tYXJrIC0gYWRkLCByZW1vdmUsIG9yIG1vZGlmeSBhbiBmYW5vdGlmeSBtYXJrIG9uIGEgZmlsZXN5c3RlbSBvYmplY3QKICAjIHBpcGUgLSBjcmVhdGUgcGlwZQogICMgcGlwZTIgLSBjcmVhdGUgcGlwZQogICMgaW50cm8gLSBpbnRyb2R1Y3Rpb24gdG8gc3lzdGVtIGNhbGxzCiAgIyBsb29rdXBfZGNvb2tpZSAtIHJldHVybiBhIGRpcmVjdG9yeSBlbnRyeSdzIHBhdGgKICAjIHN5c2ZzIC0gZ2V0IGZpbGVzeXN0ZW0gdHlwZSBpbmZvcm1hdGlvbgogICMgczM5MF9ydW50aW1lX2luc3RyIC0gZW5hYmxlL2Rpc2FibGUgczM5MCBDUFUgcnVuLXRpbWUgaW5zdHJ1bWVudGF0aW9uCiAgIyBzZXRucyAtIHJlYXNzb2NpYXRlIHRocmVhZCB3aXRoIGEgbmFtZXNwYWNlCiAgIyBzZXRfbWVtcG9saWN5IC0gc2V0IGRlZmF1bHQgTlVNQSBtZW1vcnkgcG9saWN5IGZvciBhIHRocmVhZCBhbmQgaXRzIGNoaWxkcmVuCiAgIyBuaWNlIC0gY2hhbmdlIHByb2Nlc3MgcHJpb3JpdHkKICAjIGlvX3NldHVwIC0gY3JlYXRlIGFuIGFzeW5jaHJvbm91cyBJL08gY29udGV4dAogICMgbWluY29yZSAtIGRldGVybWluZSB3aGV0aGVyIHBhZ2VzIGFyZSByZXNpZGVudCBpbiBtZW1vcnkKICAjIGlvY3RsX2NvbnNvbGUgLSBpb2N0bHMgZm9yIGNvbnNvbGUgdGVybWluYWwgYW5kIHZpcnR1YWwgY29uc29sZXMKICAjIHBvbGwgLSB3YWl0IGZvciBzb21lIGV2ZW50IG9uIGEgZmlsZSBkZXNjcmlwdG9yCiAgIyBwcG9sbCAtIHdhaXQgZm9yIHNvbWUgZXZlbnQgb24gYSBmaWxlIGRlc2NyaXB0b3IKICAjIGNhcGdldCAtIHNldC9nZXQgY2FwYWJpbGl0aWVzIG9mIHRocmVhZChzKQogICMgY2Fwc2V0IC0gc2V0L2dldCBjYXBhYmlsaXRpZXMgb2YgdGhyZWFkKHMpCiAgIyBpb2N0bF90dHkgLSBpb2N0bHMgZm9yIHRlcm1pbmFscyBhbmQgc2VyaWFsIGxpbmVzCiAgIyBpb3BsIC0gY2hhbmdlIEkvTyBwcml2aWxlZ2UgbGV2ZWwKICAjIGlvX2dldGV2ZW50cyAtIHJlYWQgYXN5bmNocm9ub3VzIEkvTyBldmVudHMgZnJvbSB0aGUgY29tcGxldGlvbiBxdWV1ZQogICMgcHJvY2Vzc192bV9yZWFkdiAtIHRyYW5zZmVyIGRhdGEgYmV0d2VlbiBwcm9jZXNzIGFkZHJlc3Mgc3BhY2VzCiAgIyBwcm9jZXNzX3ZtX3dyaXRldiAtIHRyYW5zZmVyIGRhdGEgYmV0d2VlbiBwcm9jZXNzIGFkZHJlc3Mgc3BhY2VzCiAgIyBwY2ljb25maWdfcmVhZCAtIHBjaSBkZXZpY2UgaW5mb3JtYXRpb24gaGFuZGxpbmcKICAjIHBjaWNvbmZpZ193cml0ZSAtIHBjaSBkZXZpY2UgaW5mb3JtYXRpb24gaGFuZGxpbmcKICAjIHBjaWNvbmZpZ19pb2Jhc2UgLSBwY2kgZGV2aWNlIGluZm9ybWF0aW9uIGhhbmRsaW5nCiAgIyBzYnJrIC0gY2hhbmdlIGRhdGEgc2VnbWVudCBzaXplCiAgIyBzZXRfdGlkX2FkZHJlc3MgLSBzZXQgcG9pbnRlciB0byB0aHJlYWQgSUQKICAjIHBrZXlfYWxsb2MgLSBhbGxvY2F0ZSBvciBmcmVlIGEgcHJvdGVjdGlvbiBrZXkKICAjIHBrZXlfZnJlZSAtIGFsbG9jYXRlIG9yIGZyZWUgYSBwcm90ZWN0aW9uIGtleQogICMgc2VsZWN0IC0gc3luY2hyb25vdXMgSS9PIG11bHRpcGxleGluZwogICMgcHNlbGVjdCAtIHN5bmNocm9ub3VzIEkvTyBtdWx0aXBsZXhpbmcKICAjIGtleGVjX2xvYWQgLSBsb2FkIGEgbmV3IGtlcm5lbCBmb3IgbGF0ZXIgZXhlY3V0aW9uCiAgIyBrZXhlY19maWxlX2xvYWQgLSBsb2FkIGEgbmV3IGtlcm5lbCBmb3IgbGF0ZXIgZXhlY3V0aW9uCiAgIyBwZXJzb25hbGl0eSAtIHNldCB0aGUgcHJvY2VzcyBleGVjdXRpb24gZG9tYWluCiAgIyBpb2N0bF9nZXRmc21hcCAtIHJldHJpZXZlIHRoZSBwaHlzaWNhbCBsYXlvdXQgb2YgdGhlIGZpbGVzeXN0ZW0KICAjIGlub3RpZnlfcm1fd2F0Y2ggLSByZW1vdmUgYW4gZXhpc3Rpbmcgd2F0Y2ggZnJvbSBhbiBpbm90aWZ5IGluc3RhbmNlCiAgIyBwZXJmX2V2ZW50X29wZW4gLSBzZXQgdXAgcGVyZm9ybWFuY2UgbW9uaXRvcmluZwogICMgdGltZXJfZ2V0b3ZlcnJ1biAtIGdldCBvdmVycnVuIGNvdW50IGZvciBhIFBPU0lYIHBlci1wcm9jZXNzIHRpbWVyCiAgIyB3YWl0MyAtIHdhaXQgZm9yIHByb2Nlc3MgdG8gY2hhbmdlIHN0YXRlLCBCU0Qgc3R5bGUKICAjIHdhaXQ0IC0gd2FpdCBmb3IgcHJvY2VzcyB0byBjaGFuZ2Ugc3RhdGUsIEJTRCBzdHlsZQogICMgbGluayAtIG1ha2UgYSBuZXcgbmFtZSBmb3IgYSBmaWxlCiAgIyBsaW5rYXQgLSBtYWtlIGEgbmV3IG5hbWUgZm9yIGEgZmlsZQogICMgc2NoZWRfcnJfZ2V0X2ludGVydmFsIC0gZ2V0IHRoZSBTQ0hFRF9SUiBpbnRlcnZhbCBmb3IgdGhlIG5hbWVkIHByb2Nlc3MKICAjIG11bm1hcCAtIG1hcCBvciB1bm1hcCBmaWxlcyBvciBkZXZpY2VzIGludG8gbWVtb3J5CiAgIyBzb2NrZXRjYWxsIC0gc29ja2V0IHN5c3RlbSBjYWxscwogICMgbXJlbWFwIC0gcmVtYXAgYSB2aXJ0dWFsIG1lbW9yeSBhZGRyZXNzCiAgIyB2Zm9yayAtIGNyZWF0ZSBhIGNoaWxkIHByb2Nlc3MgYW5kIGJsb2NrIHBhcmVudAogICMgc2VjY29tcCAtIG9wZXJhdGUgb24gU2VjdXJlIENvbXB1dGluZyBzdGF0ZSBvZiB0aGUgcHJvY2VzcwogICMgcmVxdWVzdF9rZXkgLSByZXF1ZXN0IGEga2V5IGZyb20gdGhlIGtlcm5lbCdzIGtleSBtYW5hZ2VtZW50IGZhY2lsaXR5CiAgIyBzeXNjYWxsIC0gaW5kaXJlY3Qgc3lzdGVtIGNhbGwKICAjIGtjbXAgLSBjb21wYXJlIHR3byBwcm9jZXNzZXMgdG8gZGV0ZXJtaW5lIGlmIHRoZXkgc2hhcmUgYSBrZXJuZWwgcmVzb3VyY2UKICAjIHJlYWRkaXIgLSByZWFkIGRpcmVjdG9yeSBlbnRyeQogICMgaW9wZXJtIC0gc2V0IHBvcnQgaW5wdXQvb3V0cHV0IHBlcm1pc3Npb25zCiAgIyBzcHVfcnVuIC0gZXhlY3V0ZSBhbiBTUFUgY29udGV4dAogICMgcmVib290IC0gcmVib290IG9yIGVuYWJsZS9kaXNhYmxlIEN0cmwtQWx0LURlbAogICMgcmVhZGFoZWFkIC0gaW5pdGlhdGUgZmlsZSByZWFkYWhlYWQgaW50byBwYWdlIGNhY2hlCiAgIyBzY2hlZF9nZXRwYXJhbSAtIHNldCBhbmQgZ2V0IHNjaGVkdWxpbmcgcGFyYW1ldGVycwogICMgYWNjdCAtIHN3aXRjaCBwcm9jZXNzIGFjY291bnRpbmcgb24gb3Igb2ZmCiAgIyBzaWdzdXNwZW5kIC0gd2FpdCBmb3IgYSBzaWduYWwKICAjIHJ0X3NpZ3N1c3BlbmQgLSB3YWl0IGZvciBhIHNpZ25hbAogICMgZXhpdF9ncm91cCAtIGV4aXQgYWxsIHRocmVhZHMgaW4gYSBwcm9jZXNzCiAgIyBzb2NrZXQgLSBjcmVhdGUgYW4gZW5kcG9pbnQgZm9yIGNvbW11bmljYXRpb24KICAjIGlvY3RsX3VzZXJmYXVsdGZkIC0gY3JlYXRlIGEgZmlsZSBkZXNjcmlwdG9yIGZvciBoYW5kbGluZyBwYWdlIGZhdWx0cyBpbiB1c2VyIHNwYWNlCiAgIyBzY2hlZF9nZXRfcHJpb3JpdHlfbWF4IC0gZ2V0IHN0YXRpYyBwcmlvcml0eSByYW5nZQogICMgc2NoZWRfZ2V0X3ByaW9yaXR5X21pbiAgLSBnZXQgc3RhdGljIHByaW9yaXR5IHJhbmdlCiAgIyBnZXRkZW50cyAtIGdldCBkaXJlY3RvcnkgZW50cmllcwogICMgZ2V0ZGVudHM2NCAtIGdldCBkaXJlY3RvcnkgZW50cmllcwogICMgc2VsZWN0IC0gc3luY2hyb25vdXMgSS9PIG11bHRpcGxleGluZwogICMgcHNlbGVjdCAtIHN5bmNocm9ub3VzIEkvTyBtdWx0aXBsZXhpbmcKICAjIGFsbG9jX2h1Z2VwYWdlcyAtIGFsbG9jYXRlIG9yIGZyZWUgaHVnZSBwYWdlcwogICMgZnJlZV9odWdlcGFnZXMgLSBhbGxvY2F0ZSBvciBmcmVlIGh1Z2UgcGFnZXMKICAjIGZzeW5jIC0gc3luY2hyb25pemUgYSBmaWxlJ3MgaW4tY29yZSBzdGF0ZSB3aXRoIHN0b3JhZ2UgZGV2aWNlCiAgIyBmZGF0YXN5bmMgLSBzeW5jaHJvbml6ZSBhIGZpbGUncyBpbi1jb3JlIHN0YXRlIHdpdGggc3RvcmFnZSBkZXZpY2UKICAjIHN5c2NhbGxzIC0gTGludXggc3lzdGVtIGNhbGxzCiAgIyBtZW1mZF9jcmVhdGUgLSBjcmVhdGUgYW4gYW5vbnltb3VzIGZpbGUKICAjIG1vZGlmeV9sZHQgLSBnZXQgb3Igc2V0IGEgcGVyLXByb2Nlc3MgTERUIGVudHJ5CiAgIyBnZXRfa2VybmVsX3N5bXMgLSByZXRyaWV2ZSBleHBvcnRlZCBrZXJuZWwgYW5kIG1vZHVsZSBzeW1ib2xzCiAgIyBsc2VlayAtIHJlcG9zaXRpb24gcmVhZC93cml0ZSBmaWxlIG9mZnNldAogICMgc2htYXQgLSBTeXN0ZW0gViBzaGFyZWQgbWVtb3J5IG9wZXJhdGlvbnMKICAjIHNobWR0IC0gU3lzdGVtIFYgc2hhcmVkIG1lbW9yeSBvcGVyYXRpb25zCiAgIyB0aW1lcl9kZWxldGUgLSBkZWxldGUgYSBQT1NJWCBwZXItcHJvY2VzcyB0aW1lcgogICMgcGVyZm1vbmN0bCAtIGludGVyZmFjZSB0byBJQS02NCBwZXJmb3JtYW5jZSBtb25pdG9yaW5nIHVuaXQKICAjIG1vdmVfcGFnZXMgLSBtb3ZlIGluZGl2aWR1YWwgcGFnZXMgb2YgYSBwcm9jZXNzIHRvIGFub3RoZXIgbm9kZQogICMgY2hkaXIgLSBjaGFuZ2Ugd29ya2luZyBkaXJlY3RvcnkKICAjIGZjaGRpciAtIGNoYW5nZSB3b3JraW5nIGRpcmVjdG9yeQogICMgdGltZSAtIGdldCB0aW1lIGluIHNlY29uZHMKICAjIF9leGl0IC0gdGVybWluYXRlIHRoZSBjYWxsaW5nIHByb2Nlc3MKICAjIF9FeGl0IC0gdGVybWluYXRlIHRoZSBjYWxsaW5nIHByb2Nlc3MKICAjIHMzOTBfc3RoeWkgLSBlbXVsYXRlIFNUSFlJIGluc3RydWN0aW9uCiAgIyBpb19zdWJtaXQgLSBzdWJtaXQgYXN5bmNocm9ub3VzIEkvTyBibG9ja3MgZm9yIHByb2Nlc3NpbmcKICAjIG1sb2NrIC0gbG9jayBhbmQgdW5sb2NrIG1lbW9yeQogICMgbWxvY2syIC0gbG9jayBhbmQgdW5sb2NrIG1lbW9yeQogICMgbXVubG9jayAtIGxvY2sgYW5kIHVubG9jayBtZW1vcnkKICAjIG1sb2NrYWxsIC0gbG9jayBhbmQgdW5sb2NrIG1lbW9yeQogICMgbXVubG9ja2FsbCAtIGxvY2sgYW5kIHVubG9jayBtZW1vcnkKICAjIHVtYXNrIC0gc2V0IGZpbGUgbW9kZSBjcmVhdGlvbiBtYXNrCiAgIyBhcmNoX3ByY3RsIC0gc2V0IGFyY2hpdGVjdHVyZS1zcGVjaWZpYyB0aHJlYWQgc3RhdGUKICAjIHVzZWxpYiAtIGxvYWQgc2hhcmVkIGxpYnJhcnkKICAjIHNlbmRmaWxlIC0gdHJhbnNmZXIgZGF0YSBiZXR3ZWVuIGZpbGUgZGVzY3JpcHRvcnMKICAjIHNobWN0bCAtIFN5c3RlbSBWIHNoYXJlZCBtZW1vcnkgY29udHJvbAogICMgZXBvbGxfd2FpdCAtIHdhaXQgZm9yIGFuIEkvTyBldmVudCBvbiBhbiBlcG9sbCBmaWxlIGRlc2NyaXB0b3IKICAjIGVwb2xsX3B3YWl0IC0gd2FpdCBmb3IgYW4gSS9PIGV2ZW50IG9uIGFuIGVwb2xsIGZpbGUgZGVzY3JpcHRvcgogICMgc2lnYWx0c3RhY2sgLSBzZXQgYW5kL29yIGdldCBzaWduYWwgc3RhY2sgY29udGV4dAogICMgaW9jdGwgLSBjb250cm9sIGRldmljZQogICMgc2lnbmFsZmQgLSBjcmVhdGUgYSBmaWxlIGRlc2NyaXB0b3IgZm9yIGFjY2VwdGluZyBzaWduYWxzCiAgIyB1bnNoYXJlIC0gZGlzYXNzb2NpYXRlIHBhcnRzIG9mIHRoZSBwcm9jZXNzIGV4ZWN1dGlvbiBjb250ZXh0CiAgIyBjaHJvb3QgLSBjaGFuZ2Ugcm9vdCBkaXJlY3RvcnkKICAjIG1hZHZpc2UgLSBnaXZlIGFkdmljZSBhYm91dCB1c2Ugb2YgbWVtb3J5CiAgIyBnZXR0aWQgLSBnZXQgdGhyZWFkIGlkZW50aWZpY2F0aW9uCiAgIyBnZXRzb2NrbmFtZSAtIGdldCBzb2NrZXQgbmFtZQogICMgaW9fZGVzdHJveSAtIGRlc3Ryb3kgYW4gYXN5bmNocm9ub3VzIEkvTyBjb250ZXh0CiAgIyBzZXR1cCAtIHNldHVwIGRldmljZXMgYW5kIGZpbGVzeXN0ZW1zLCBtb3VudCByb290IGZpbGVzeXN0ZW0KICAjIG50cF9hZGp0aW1lIC0gdHVuZSBrZXJuZWwgY2xvY2sKICAjIHNlbWdldCAtIGdldCBhIFN5c3RlbSBWIHNlbWFwaG9yZSBzZXQgaWRlbnRpZmllcgogICMgZ2V0dWlkIC0gZ2V0IHVzZXIgaWRlbnRpdHkKICAjIGdldGV1aWQgLSBnZXQgdXNlciBpZGVudGl0eQogICMgX3N5c2NhbGwgLSBpbnZva2luZyBhIHN5c3RlbSBjYWxsIHdpdGhvdXQgbGlicmFyeSBzdXBwb3J0IChPQlNPTEVURSkKICAjIHNjaGVkX3NldGFmZmluaXR5IC0gXCBzZXQgYW5kIGdldCBhIHRocmVhZCdzIENQVSBhZmZpbml0eSBtYXNrCiAgIyBzY2hlZF9nZXRhZmZpbml0eSAtIFwgc2V0IGFuZCBnZXQgYSB0aHJlYWQncyBDUFUgYWZmaW5pdHkgbWFzawogICMgY2FjaGVmbHVzaCAtIGZsdXNoIGNvbnRlbnRzIG9mIGluc3RydWN0aW9uIGFuZC9vciBkYXRhIGNhY2hlCiAgIyBwaXZvdF9yb290IC0gY2hhbmdlIHRoZSByb290IG1vdW50CiAgIyBtc2djdGwgLSBTeXN0ZW0gViBtZXNzYWdlIGNvbnRyb2wgb3BlcmF0aW9ucwogICMgaW9jdGxfZmF0IC0gbWFuaXB1bGF0aW5nIHRoZSBGQVQgZmlsZXN5c3RlbQogICMgc2V0cGdpZCAtIHNldC9nZXQgcHJvY2VzcyBncm91cAogICMgZ2V0cGdpZCAtIHNldC9nZXQgcHJvY2VzcyBncm91cAogICMgc2V0cGdycCAtIHNldC9nZXQgcHJvY2VzcyBncm91cAogICMgZ2V0cGdycCAtIHNldC9nZXQgcHJvY2VzcyBncm91cAogICMgc29ja2V0cGFpciAtIGNyZWF0ZSBhIHBhaXIgb2YgY29ubmVjdGVkIHNvY2tldHMKICAjIGJkZmx1c2ggLSBzdGFydCwgZmx1c2gsIG9yIHR1bmUgYnVmZmVyLWRpcnR5LWZsdXNoIGRhZW1vbgogICMgYWxhcm0gLSBzZXQgYW4gYWxhcm0gY2xvY2sgZm9yIGRlbGl2ZXJ5IG9mIGEgc2lnbmFsCiAgIyB0aW1lcl9zZXR0aW1lIC0gYXJtL2Rpc2FybSBhbmQgZmV0Y2ggc3RhdGUgb2YgUE9TSVggcGVyLXByb2Nlc3MgdGltZXIKICAjIHRpbWVyX2dldHRpbWUgLSBhcm0vZGlzYXJtIGFuZCBmZXRjaCBzdGF0ZSBvZiBQT1NJWCBwZXItcHJvY2VzcyB0aW1lcgogICMgYWRkX2tleSAtIGFkZCBhIGtleSB0byB0aGUga2VybmVsJ3Mga2V5IG1hbmFnZW1lbnQgZmFjaWxpdHkKICAjIHJ0X3NpZ3F1ZXVlaW5mbyAtIHF1ZXVlIGEgc2lnbmFsIGFuZCBkYXRhCiAgIyBydF90Z3NpZ3F1ZXVlaW5mbyAtIHF1ZXVlIGEgc2lnbmFsIGFuZCBkYXRhCiAgIyB1c2VyZmF1bHRmZCAtIGNyZWF0ZSBhIGZpbGUgZGVzY3JpcHRvciBmb3IgaGFuZGxpbmcgcGFnZSBmYXVsdHMgaW4gdXNlciBzcGFjZQogICMgc2Vtb3AgLSBTeXN0ZW0gViBzZW1hcGhvcmUgb3BlcmF0aW9ucwogICMgc2VtdGltZWRvcCAtIFN5c3RlbSBWIHNlbWFwaG9yZSBvcGVyYXRpb25zCiAgIyBnZXRnaWQgLSBnZXQgZ3JvdXAgaWRlbnRpdHkKICAjIGdldGVnaWQgLSBnZXQgZ3JvdXAgaWRlbnRpdHkKICAjIGdldHBpZCAtIGdldCBwcm9jZXNzIGlkZW50aWZpY2F0aW9uCiAgIyBnZXRwcGlkIC0gZ2V0IHByb2Nlc3MgaWRlbnRpZmljYXRpb24KICAjIHNpZ3Byb2NtYXNrIC0gZXhhbWluZSBhbmQgY2hhbmdlIGJsb2NrZWQgc2lnbmFscwogICMgcnRfc2lncHJvY21hc2sgLSBleGFtaW5lIGFuZCBjaGFuZ2UgYmxvY2tlZCBzaWduYWxzCiAgIyB1bmFtZSAtIGdldCBuYW1lIGFuZCBpbmZvcm1hdGlvbiBhYm91dCBjdXJyZW50IGtlcm5lbAogICMgc3RhdHggLSBnZXQgZmlsZSBzdGF0dXMgKGV4dGVuZGVkKQogICMgaW9jdGxfZmljbG9uZXJhbmdlIC0gc2hhcmUgc29tZSB0aGUgZGF0YSBvZiBvbmUgZmlsZSB3aXRoIGFub3RoZXIgZmlsZQogICMgaW9jdGxfZmljbG9uZSAtIHNoYXJlIHNvbWUgdGhlIGRhdGEgb2Ygb25lIGZpbGUgd2l0aCBhbm90aGVyIGZpbGUKICAjIG1xX2dldHNldGF0dHIgLSBnZXQvc2V0IG1lc3NhZ2UgcXVldWUgYXR0cmlidXRlcwogICMgaW9wcmlvX2dldCAtIGdldC9zZXQgSS9PIHNjaGVkdWxpbmcgY2xhc3MgYW5kIHByaW9yaXR5CiAgIyBpb3ByaW9fc2V0IC0gZ2V0L3NldCBJL08gc2NoZWR1bGluZyBjbGFzcyBhbmQgcHJpb3JpdHkKICAjIGVwb2xsX2N0bCAtIGNvbnRyb2wgaW50ZXJmYWNlIGZvciBhbiBlcG9sbCBmaWxlIGRlc2NyaXB0b3IKICAjIHN5bmMgLSBjb21taXQgZmlsZXN5c3RlbSBjYWNoZXMgdG8gZGlzawogICMgc3luY2ZzIC0gY29tbWl0IGZpbGVzeXN0ZW0gY2FjaGVzIHRvIGRpc2sKICAjIHNldHNpZCAtIGNyZWF0ZXMgYSBzZXNzaW9uIGFuZCBzZXRzIHRoZSBwcm9jZXNzIGdyb3VwIElECiAgIyBzaHV0ZG93biAtIHNodXQgZG93biBwYXJ0IG9mIGEgZnVsbC1kdXBsZXggY29ubmVjdGlvbgogICMgZ2V0c2lkIC0gZ2V0IHNlc3Npb24gSUQKICAjIGdldF90aHJlYWRfYXJlYSAtIG1hbmlwdWxhdGUgdGhyZWFkLWxvY2FsIHN0b3JhZ2UgaW5mb3JtYXRpb24KICAjIHNldF90aHJlYWRfYXJlYSAtIG1hbmlwdWxhdGUgdGhyZWFkLWxvY2FsIHN0b3JhZ2UgaW5mb3JtYXRpb24KICAjIHRpbWVyZmRfY3JlYXRlIC0gdGltZXJzIHRoYXQgbm90aWZ5IHZpYSBmaWxlIGRlc2NyaXB0b3JzCiAgIyB0aW1lcmZkX3NldHRpbWUgLSB0aW1lcnMgdGhhdCBub3RpZnkgdmlhIGZpbGUgZGVzY3JpcHRvcnMKICAjIHRpbWVyZmRfZ2V0dGltZSAtIHRpbWVycyB0aGF0IG5vdGlmeSB2aWEgZmlsZSBkZXNjcmlwdG9ycwogICMgaW9jdGxfZmlkZWR1cGVyYW5nZSAtIHNoYXJlIHNvbWUgdGhlIGRhdGEgb2Ygb25lIGZpbGUgd2l0aCBhbm90aGVyIGZpbGUKICAjIG5hbWVfdG9faGFuZGxlX2F0IC0gb2J0YWluIGhhbmRsZSBmb3IgYSBwYXRobmFtZSBhbmQgb3BlbiBmaWxlIHZpYSBhIGhhbmRsZQogICMgb3Blbl9ieV9oYW5kbGVfYXQgLSBvYnRhaW4gaGFuZGxlIGZvciBhIHBhdGhuYW1lIGFuZCBvcGVuIGZpbGUgdmlhIGEgaGFuZGxlCiAgIyBmdXRleCAtIGZhc3QgdXNlci1zcGFjZSBsb2NraW5nCiAgIyBpb2N0bF9ucyAtIGlvY3RsKCkgb3BlcmF0aW9ucyBmb3IgTGludXggbmFtZXNwYWNlcwogICMgcGlkZmRfc2VuZF9zaWduYWwgLSBzZW5kIGEgc2lnbmFsIHRvIGEgcHJvY2VzcyBzcGVjaWZpZWQgYnkgYSBmaWxlIGRlc2NyaXB0b3IKICAjIGNsb25lIC0gY3JlYXRlIGEgY2hpbGQgcHJvY2VzcwogICMgX19jbG9uZTIgLSBjcmVhdGUgYSBjaGlsZCBwcm9jZXNzCiAgIyBjbG9uZTMgLSBjcmVhdGUgYSBjaGlsZCBwcm9jZXNzCiAgIyB0aW1lcyAtIGdldCBwcm9jZXNzIHRpbWVzCiAgIyBzeXNpbmZvIC0gcmV0dXJuIHN5c3RlbSBpbmZvcm1hdGlvbgogICMgaXBjIC0gU3lzdGVtIFYgSVBDIHN5c3RlbSBjYWxscwogICMgZXZlbnRmZCAtIGNyZWF0ZSBhIGZpbGUgZGVzY3JpcHRvciBmb3IgZXZlbnQgbm90aWZpY2F0aW9uCiAgIyB3YWl0IC0gd2FpdCBmb3IgcHJvY2VzcyB0byBjaGFuZ2Ugc3RhdGUKICAjIHdhaXRwaWQgLSB3YWl0IGZvciBwcm9jZXNzIHRvIGNoYW5nZSBzdGF0ZQogICMgd2FpdGlkIC0gd2FpdCBmb3IgcHJvY2VzcyB0byBjaGFuZ2Ugc3RhdGUKICAjIGdldGRvbWFpbm5hbWUgLSBnZXQvc2V0IE5JUyBkb21haW4gbmFtZQogICMgaWRsZSAtIG1ha2UgcHJvY2VzcyAwIGlkbGUKICAjIGlub3RpZnlfYWRkX3dhdGNoIC0gYWRkIGEgd2F0Y2ggdG8gYW4gaW5pdGlhbGl6ZWQgaW5vdGlmeSBpbnN0YW5jZQogICMgZ2V0X21lbXBvbGljeSAtIHJldHJpZXZlIE5VTUEgbWVtb3J5IHBvbGljeSBmb3IgYSB0aHJlYWQKICAjIGJwZiAtIHBlcmZvcm0gYSBjb21tYW5kIG9uIGFuIGV4dGVuZGVkIEJQRiBtYXAgb3IgcHJvZ3JhbQogICMgZ2V0c29ja29wdCAtIGdldCBhbmQgc2V0IG9wdGlvbnMgb24gc29ja2V0cwogICMgc2V0c29ja29wdCAtIGdldCBhbmQgc2V0IG9wdGlvbnMgb24gc29ja2V0cwogICMgZ2V0aXRpbWVyIC0gZ2V0IG9yIHNldCB2YWx1ZSBvZiBhbiBpbnRlcnZhbCB0aW1lcgogICMgc2V0aXRpbWVyIC0gZ2V0IG9yIHNldCB2YWx1ZSBvZiBhbiBpbnRlcnZhbCB0aW1lcgogICMgbWVtYmFycmllciAtIGlzc3VlIG1lbW9yeSBiYXJyaWVycyBvbiBhIHNldCBvZiB0aHJlYWRzCiAgIyBtcHJvdGVjdCAtIHNldCBwcm90ZWN0aW9uIG9uIGEgcmVnaW9uIG9mIG1lbW9yeQogICMgcGtleV9tcHJvdGVjdCAtIHNldCBwcm90ZWN0aW9uIG9uIGEgcmVnaW9uIG9mIG1lbW9yeQogICMgZ2V0Y3B1IC0gZGV0ZXJtaW5lIENQVSBhbmQgTlVNQSBub2RlIG9uIHdoaWNoIHRoZSBjYWxsaW5nIHRocmVhZCBpcyBydW5uaW5nCiAgIyBpb2N0bF9mc2xhYmVsIC0gZ2V0IG9yIHNldCBhIGZpbGVzeXN0ZW0gbGFiZWwKICAjIGxpc3R4YXR0ciAtIGxpc3QgZXh0ZW5kZWQgYXR0cmlidXRlIG5hbWVzCiAgIyBsbGlzdHhhdHRyIC0gbGlzdCBleHRlbmRlZCBhdHRyaWJ1dGUgbmFtZXMKICAjIGZsaXN0eGF0dHIgLSBsaXN0IGV4dGVuZGVkIGF0dHJpYnV0ZSBuYW1lcwogICMgX2xsc2VlayAtIHJlcG9zaXRpb24gcmVhZC93cml0ZSBmaWxlIG9mZnNldAogICMgZmNudGwgLSBtYW5pcHVsYXRlIGZpbGUgZGVzY3JpcHRvcgogICMgdXN0YXQgLSBnZXQgZmlsZXN5c3RlbSBzdGF0aXN0aWNzCiAgIyBzaWduYWwgLSBBTlNJIEMgc2lnbmFsIGhhbmRsaW5nCiAgIyBuYW5vc2xlZXAgLSBoaWdoLXJlc29sdXRpb24gc2xlZXAKICAjIGNvbm5lY3QgLSBpbml0aWF0ZSBhIGNvbm5lY3Rpb24gb24gYSBzb2NrZXQKICAjIHZtODZvbGQgLSBlbnRlciB2aXJ0dWFsIDgwODYgbW9kZQogICMgdm04NiAtIGVudGVyIHZpcnR1YWwgODA4NiBtb2RlCiAgIyBmYW5vdGlmeV9pbml0IC0gY3JlYXRlIGFuZCBpbml0aWFsaXplIGZhbm90aWZ5IGdyb3VwCiAgIyBtaWdyYXRlX3BhZ2VzIC0gbW92ZSBhbGwgcGFnZXMgaW4gYSBwcm9jZXNzIHRvIGFub3RoZXIgc2V0IG9mIG5vZGVzCiAgIyByZXN0YXJ0X3N5c2NhbGwgLSByZXN0YXJ0IGEgc3lzdGVtIGNhbGwgYWZ0ZXIgaW50ZXJydXB0aW9uIGJ5IGEgc3RvcCBzaWduYWwKICAjIGNsb3NlIC0gY2xvc2UgYSBmaWxlIGRlc2NyaXB0b3IKICAjIG1zZ3JjdiAtIFN5c3RlbSBWIG1lc3NhZ2UgcXVldWUgb3BlcmF0aW9ucwogICMgbXNnc25kIC0gU3lzdGVtIFYgbWVzc2FnZSBxdWV1ZSBvcGVyYXRpb25zCiAgIyByZWFkdiAtIHJlYWQgb3Igd3JpdGUgZGF0YSBpbnRvIG11bHRpcGxlIGJ1ZmZlcnMKICAjIHdyaXRldiAtIHJlYWQgb3Igd3JpdGUgZGF0YSBpbnRvIG11bHRpcGxlIGJ1ZmZlcnMKICAjIHByZWFkdiAtIHJlYWQgb3Igd3JpdGUgZGF0YSBpbnRvIG11bHRpcGxlIGJ1ZmZlcnMKICAjIHB3cml0ZXYgLSByZWFkIG9yIHdyaXRlIGRhdGEgaW50byBtdWx0aXBsZSBidWZmZXJzCiAgIyBwcmVhZHYyIC0gcmVhZCBvciB3cml0ZSBkYXRhIGludG8gbXVsdGlwbGUgYnVmZmVycwogICMgcHdyaXRldjIgLSByZWFkIG9yIHdyaXRlIGRhdGEgaW50byBtdWx0aXBsZSBidWZmZXJzCiAgIyBzeXNsb2cgLSByZWFkIGFuZC9vciBjbGVhciBrZXJuZWwgbWVzc2FnZSByaW5nIGJ1ZmZlcjsgc2V0IGNvbnNvbGVfbG9nbGV2ZWwKICAjIGtsb2djdGwgLSByZWFkIGFuZC9vciBjbGVhciBrZXJuZWwgbWVzc2FnZSByaW5nIGJ1ZmZlcjsgc2V0IGNvbnNvbGVfbG9nbGV2ZWwKICAjIHNjaGVkX3lpZWxkIC0geWllbGQgdGhlIHByb2Nlc3NvcgogICMgdmhhbmd1cCAtIHZpcnR1YWxseSBoYW5ndXAgdGhlIGN1cnJlbnQgdGVybWluYWwKICAjIGlvY3RsX2lmbGFncyAtIGlvY3RsKCkgb3BlcmF0aW9ucyBmb3IgaW5vZGUgZmxhZ3MKICAjIHNnZXRtYXNrIC0gbWFuaXB1bGF0aW9uIG9mIHNpZ25hbCBtYXNrIChvYnNvbGV0ZSkKICAjIHNzZXRtYXNrIC0gbWFuaXB1bGF0aW9uIG9mIHNpZ25hbCBtYXNrIChvYnNvbGV0ZSkKICAjIHN5bmNfZmlsZV9yYW5nZSAtIHN5bmMgYSBmaWxlIHNlZ21lbnQgd2l0aCBkaXNrCiAgIyBjb3B5X2ZpbGVfcmFuZ2UgLSBDb3B5IGEgcmFuZ2Ugb2YgZGF0YSBmcm9tIG9uZSBmaWxlIHRvIGFub3RoZXIKICAjIHNpZ3BlbmRpbmcgLSBleGFtaW5lIHBlbmRpbmcgc2lnbmFscwogICMgcnRfc2lncGVuZGluZyAtIGV4YW1pbmUgcGVuZGluZyBzaWduYWxzCiAgIyBnZXR1bndpbmQgLSBjb3B5IHRoZSB1bndpbmQgZGF0YSB0byBjYWxsZXIncyBidWZmZXIKICAjIG1zeW5jIC0gc3luY2hyb25pemUgYSBmaWxlIHdpdGggYSBtZW1vcnkgbWFwCiAgIyBnZXRfcm9idXN0X2xpc3QgLSBnZXQvc2V0IGxpc3Qgb2Ygcm9idXN0IGZ1dGV4ZXMKICAjIHNldF9yb2J1c3RfbGlzdCAtIGdldC9zZXQgbGlzdCBvZiByb2J1c3QgZnV0ZXhlcwogICMgZHVwIC0gZHVwbGljYXRlIGEgZmlsZSBkZXNjcmlwdG9yCiAgIyBkdXAyIC0gZHVwbGljYXRlIGEgZmlsZSBkZXNjcmlwdG9yCiAgIyBkdXAzIC0gZHVwbGljYXRlIGEgZmlsZSBkZXNjcmlwdG9yCiAgIyBzMzkwX3BjaV9tbWlvX3dyaXRlIC0gdHJhbnNmZXIgZGF0YSB0by9mcm9tIFBDSSBNTUlPIG1lbW9yeSBwYWdlCiAgIyBzMzkwX3BjaV9tbWlvX3JlYWQgLSB0cmFuc2ZlciBkYXRhIHRvL2Zyb20gUENJIE1NSU8gbWVtb3J5IHBhZ2UKICAjIHBhdXNlIC0gd2FpdCBmb3Igc2lnbmFsCiAgIyBzd2Fwb24gLSBzdGFydC9zdG9wIHN3YXBwaW5nIHRvIGZpbGUvZGV2aWNlCiAgIyBzd2Fwb2ZmIC0gc3RhcnQvc3RvcCBzd2FwcGluZyB0byBmaWxlL2RldmljZQoKICAjIFJlY29yZCB0eXBlIG5vcm1hbGl6YXRpb25zCiAgIyBVc2VmdWwgbGlua3M6CiAgIyBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vdG9ydmFsZHMvbGludXgvdjQuMTYvaW5jbHVkZS91YXBpL2xpbnV4L2F1ZGl0LmgKICAjIGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9saW51eC1hdWRpdC9hdWRpdC11c2Vyc3BhY2UvNGQ5MzMzMDFiMTgzNWNhZmEwOGI5ZTllZjcwNWM4ZmI2Yzk2Y2I2Mi9saWIvbGliYXVkaXQuaAogICMgaHR0cHM6Ly93d3cuZWxhc3RpYy5jby9ndWlkZS9lbi9lY3MvY3VycmVudC9lY3MtYWxsb3dlZC12YWx1ZXMtZXZlbnQtY2F0ZWdvcnkuaHRtbAoKICAjIElBTSByZWxhdGVkIGV2ZW50cwoKICAjIEFVRElUX0FDQ1RfTE9DSyAtIFVzZXIncyBhY2NvdW50IGxvY2tlZCBieSBhZG1pbgogIC0gcmVjb3JkX3R5cGVzOiBBQ0NUX0xPQ0sKICAgIGFjdGlvbjogbG9ja2VkLWFjY291bnQKICAgIGVjczoKICAgICAgPDw6ICplY3MtaWFtCiAgICAgIHR5cGU6CiAgICAgICAgLSB1c2VyCiAgICAgICAgLSBpbmZvCiAgIyBBVURJVF9BQ0NUX1VOTE9DSyAtIFVzZXIncyBhY2NvdW50IHVubG9ja2VkIGJ5IGFkbWluCiAgLSByZWNvcmRfdHlwZXM6IEFDQ1RfVU5MT0NLCiAgICBhY3Rpb246IHVubG9ja2VkLWFjY291bnQKICAgIGVjczoKICAgICAgPDw6ICplY3MtaWFtCiAgICAgIHR5cGU6CiAgICAgICAgLSB1c2VyCiAgICAgICAgLSBpbmZvCiAgIyBBVURJVF9BRERfR1JPVVAgLSBHcm91cCBhY2NvdW50IGFkZGVkCiAgLSByZWNvcmRfdHlwZXM6IEFERF9HUk9VUAogICAgYWN0aW9uOiBhZGRlZC1ncm91cC1hY2NvdW50LXRvCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IFtpZCwgYWNjdF0KICAgICAgd2hhdDogYWNjb3VudAogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIGdyb3VwCiAgICAgICAgLSBjcmVhdGlvbgogICMgQVVESVRfQUREX1VTRVIgLSBVc2VyIGFjY291bnQgYWRkZWQKICAtIHJlY29yZF90eXBlczogQUREX1VTRVIKICAgIGFjdGlvbjogYWRkZWQtdXNlci1hY2NvdW50CiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IFtpZCwgYWNjdF0KICAgICAgd2hhdDogYWNjb3VudAogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIHVzZXIKICAgICAgICAtIGNyZWF0aW9uCiAgIyBBVURJVF9ERUxfR1JPVVAgLSBHcm91cCBhY2NvdW50IGRlbGV0ZWQKICAtIHJlY29yZF90eXBlczogREVMX0dST1VQCiAgICBhY3Rpb246IGRlbGV0ZWQtZ3JvdXAtYWNjb3VudC1mcm9tCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IFtpZCwgYWNjdF0KICAgICAgd2hhdDogYWNjb3VudAogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIGdyb3VwCiAgICAgICAgLSBkZWxldGlvbgogICMgQVVESVRfREVMX1VTRVIgLSBVc2VyIGFjY291bnQgZGVsZXRlZAogIC0gcmVjb3JkX3R5cGVzOiBERUxfVVNFUgogICAgYWN0aW9uOiBkZWxldGVkLXVzZXItYWNjb3VudAogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICAgIHdoYXQ6IGFjY291bnQKICAgIGVjczoKICAgICAgPDw6ICplY3MtaWFtCiAgICAgIHR5cGU6CiAgICAgICAgLSB1c2VyCiAgICAgICAgLSBkZWxldGlvbgogICMgQVVESVRfR1JQX01HTVQgLSBHcm91cCBhY2NvdW50IGF0dHIgd2FzIG1vZGlmaWVkCiAgLSByZWNvcmRfdHlwZXM6IEdSUF9NR01UCiAgICBhY3Rpb246IG1vZGlmaWVkLWdyb3VwLWFjY291bnQKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogW2lkLCBhY2N0XQogICAgICB3aGF0OiBhY2NvdW50CiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWlhbQogICAgICB0eXBlOgogICAgICAgIC0gZ3JvdXAKICAgICAgICAtIGNoYW5nZQogICMgQVVESVRfUk9MRV9BU1NJR04gLSBBZG1pbiBhc3NpZ25lZCB1c2VyIHRvIHJvbGUKICAtIHJlY29yZF90eXBlczogUk9MRV9BU1NJR04KICAgIGFjdGlvbjogYXNzaWduZWQtdXNlci1yb2xlLXRvCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IFtpZCwgYWNjdF0KICAgICAgd2hhdDogYWNjb3VudAogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIHVzZXIKICAgICAgICAtIGNoYW5nZQogICMgQVVESVRfUk9MRV9NT0RJRlkgLSBBZG1pbiBtb2RpZmllZCBhIHJvbGUKICAtIHJlY29yZF90eXBlczogUk9MRV9NT0RJRlkKICAgIGFjdGlvbjogbW9kaWZpZWQtcm9sZQogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIGNoYW5nZQogICMgQVVESVRfUk9MRV9SRU1PVkUgLSBBZG1pbiByZW1vdmVkIHVzZXIgZnJvbSByb2xlCiAgLSByZWNvcmRfdHlwZXM6IFJPTEVfUkVNT1ZFCiAgICBhY3Rpb246IHJlbW92ZWQtdXNlLXJvbGUtZnJvbQogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBbaWQsIGFjY3RdCiAgICAgIHdoYXQ6IGFjY291bnQKICAgIGVjczoKICAgICAgPDw6ICplY3MtaWFtCiAgICAgIHR5cGU6CiAgICAgICAgLSB1c2VyCiAgICAgICAgLSBjaGFuZ2UKICAjIEFVRElUX1VTRVJfTUdNVCAtIFVzZXIgYWNjdCBhdHRyaWJ1dGUgY2hhbmdlCiAgLSA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogICAgcmVjb3JkX3R5cGVzOiBVU0VSX01HTVQKICAgIGFjdGlvbjogbW9kaWZpZWQtdXNlci1hY2NvdW50CiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWlhbQogICAgICB0eXBlOgogICAgICAgIC0gdXNlcgogICAgICAgIC0gY2hhbmdlCiAgIyBBVURJVF9VU0VSX0NIQVVUSFRPSyAtIFVzZXIgYWNjdCBwYXNzd29yZCBvciBwaW4gY2hhbmdlZAogIC0gPDw6ICptYWNyby11c2VyLXNlc3Npb24KICAgIHJlY29yZF90eXBlczogVVNFUl9DSEFVVEhUT0sKICAgIGFjdGlvbjogY2hhbmdlZC1wYXNzd29yZAogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIHVzZXIKICAgICAgICAtIGNoYW5nZQogICMgQVVESVRfR1JQX0NIQVVUSFRPSyAtIEdyb3VwIGFjY3QgcGFzc3dvcmQgb3IgcGluIGNoYW5nZWQKICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IEdSUF9DSEFVVEhUT0sKICAgIGFjdGlvbjogY2hhbmdlZC1ncm91cC1wYXNzd29yZAogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBhY2N0CiAgICAgIHdoYXQ6IHVzZXItc2Vzc2lvbgogICAgZWNzOgogICAgICA8PDogKmVjcy1pYW0KICAgICAgdHlwZToKICAgICAgICAtIGdyb3VwCiAgICAgICAgLSBjaGFuZ2UKCiAgIyBBdXRoZW50aWNhdGlvbiByZWxhdGVkIGV2ZW50cwoKICAjIEFVRElUX0NSRURfQUNRIC0gVXNlciBjcmVkZW50aWFsIGFjcXVpcmVkCiAgLSA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogICAgcmVjb3JkX3R5cGVzOiBDUkVEX0FDUQogICAgYWN0aW9uOiBhY3F1aXJlZC1jcmVkZW50aWFscwogICAgZWNzOiAqZWNzLWF1dGgKICAjIEFVRElUX0NSRURfRElTUCAtIFVzZXIgY3JlZGVudGlhbCBkaXNwb3NlZAogIC0gPDw6ICptYWNyby11c2VyLXNlc3Npb24KICAgIHJlY29yZF90eXBlczogQ1JFRF9ESVNQCiAgICBhY3Rpb246IGRpc3Bvc2VkLWNyZWRlbnRpYWxzCiAgICBlY3M6ICplY3MtYXV0aAogICMgQVVESVRfQ1JFRF9SRUZSIC0gVXNlciBjcmVkZW50aWFsIHJlZnJlc2hlZAogIC0gPDw6ICptYWNyby11c2VyLXNlc3Npb24KICAgIHJlY29yZF90eXBlczogQ1JFRF9SRUZSCiAgICBhY3Rpb246IHJlZnJlc2hlZC1jcmVkZW50aWFscwogICAgZWNzOiAqZWNzLWF1dGgKICAjIEFVRElUX0dSUF9BVVRIIC0gQXV0aGVudGljYXRpb24gZm9yIGdyb3VwIHBhc3N3b3JkCiAgLSByZWNvcmRfdHlwZXM6IEdSUF9BVVRICiAgICBhY3Rpb246IGF1dGhlbnRpY2F0ZWQtdG8tZ3JvdXAKICAgIGVjczogKmVjcy1hdXRoCiAgIyBBVURJVF9MT0dJTiAtIERlZmluZSB0aGUgbG9naW4gaWQgYW5kIGluZm9ybWF0aW9uCiAgLSByZWNvcmRfdHlwZXM6IExPR0lOCiAgICBhY3Rpb246IGNoYW5nZWQtbG9naW4taWQtdG8KICAgIHN1YmplY3Q6CiAgICAgIHByaW1hcnk6IFtvbGRfYXVpZCwgb2xkLWF1aWRdCiAgICAgIHNlY29uZGFyeTogdWlkCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGF1aWQKICAgICAgd2hhdDogdXNlci1zZXNzaW9uCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWF1dGgKICAgICAgdHlwZTogc3RhcnQKICAjIEFVRElUX1VTRVJfQUNDVCAtIFVzZXIgc3lzdGVtIGFjY2VzcyBhdXRob3JpemF0aW9uCiAgLSA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogICAgcmVjb3JkX3R5cGVzOiBVU0VSX0FDQ1QKICAgIGFjdGlvbjogd2FzLWF1dGhvcml6ZWQKICAgIGVjczogKmVjcy1hdXRoCiAgIyBBVURJVF9VU0VSX0FVVEggLSBVc2VyIHN5c3RlbSBhY2Nlc3MgYXV0aGVudGljYXRpb24KICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IFVTRVJfQVVUSAogICAgYWN0aW9uOiBhdXRoZW50aWNhdGVkCiAgICBlY3M6ICplY3MtYXV0aAogICMgQVVESVRfVVNFUl9FTkQgLSBVc2VyIHNlc3Npb24gZW5kCiAgLSA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogICAgcmVjb3JkX3R5cGVzOiBVU0VSX0VORAogICAgYWN0aW9uOiBlbmRlZC1zZXNzaW9uCiAgICBlY3M6ICplY3MtYXV0aAogICMgQVVESVRfVVNFUl9FUlIgLSBVc2VyIGFjY3Qgc3RhdGUgZXJyb3IKICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IFVTRVJfRVJSCiAgICBhY3Rpb246IGVycm9yCiAgICBzb3VyY2VfaXA6IFthZGRyXQogICAgZWNzOiAqZWNzLWF1dGgKICAjIEFVRElUX1VTRVJfTE9HSU4gLSBVc2VyIGhhcyBsb2dnZWQgaW4KICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IFVTRVJfTE9HSU4KICAgIGFjdGlvbjogbG9nZ2VkLWluCiAgICBzb3VyY2VfaXA6IFthZGRyXQogICAgZWNzOgogICAgICA8PDogKmVjcy1hdXRoCiAgICAgIHR5cGU6IHN0YXJ0CiAgIyBBVURJVF9VU0VSX0xPR09VVCAtIFVzZXIgaGFzIGxvZ2dlZCBvdXQKICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IFVTRVJfTE9HT1VUCiAgICBhY3Rpb246IGxvZ2dlZC1vdXQKICAgIGVjczoKICAgICAgPDw6ICplY3MtYXV0aAogICAgICB0eXBlOiBlbmQKICAjIEFVRElUX1VTRVJfUk9MRV9DSEFOR0UgLSBVc2VyIGNoYW5nZWQgdG8gYSBuZXcgcm9sZQogIC0gPDw6ICptYWNyby11c2VyLXNlc3Npb24KICAgIHJlY29yZF90eXBlczogVVNFUl9ST0xFX0NIQU5HRQogICAgYWN0aW9uOiBjaGFuZ2VkLXJvbGUtdG8KICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogc2VsZWN0ZWQtY29udGV4dAogICAgICB3aGF0OiB1c2VyLXNlc3Npb24KICAjIEFVRElUX1VTRVJfU1RBUlQgLSBVc2VyIHNlc3Npb24gc3RhcnQKICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IFVTRVJfU1RBUlQKICAgIGFjdGlvbjogc3RhcnRlZC1zZXNzaW9uCiAgICBzb3VyY2VfaXA6IFthZGRyXQogICAgZWNzOiAqZWNzLWF1dGgKCiAgIyBIb3N0IHZpcnR1YWxpemF0aW9uIGV2ZW50cwoKICAjIEFVRElUX1ZJUlRfQ09OVFJPTCAtIFN0YXJ0LCBQYXVzZSwgU3RvcCBWTQogIC0gcmVjb3JkX3R5cGVzOiBWSVJUX0NPTlRST0wKICAgIGFjdGlvbjogaXNzdWVkLXZtLWNvbnRyb2wKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogb3AKICAgICAgc2Vjb25kYXJ5OiB2bQogICAgICB3aGF0OiB2aXJ0dWFsLW1hY2hpbmUKICAgIGVjczogKmVjcy1ob3N0CiAgIyBBVURJVF9WSVJUX0NSRUFURSAtIENyZWF0aW9uIG9mIGd1ZXN0IGltYWdlCiAgLSByZWNvcmRfdHlwZXM6IFZJUlRfQ1JFQVRFCiAgICBhY3Rpb246IGNyZWF0ZWQtdm0taW1hZ2UKICAgIGVjczogKmVjcy1ob3N0CiAgIyBBVURJVF9WSVJUX0RFU1RST1kgLSBEZXN0cnVjdGlvbiBvZiBndWVzdCBpbWFnZQogIC0gcmVjb3JkX3R5cGVzOiBWSVJUX0RFU1RST1kKICAgIGFjdGlvbjogZGVsZXRlZC12bS1pbWFnZQogICAgZWNzOiAqZWNzLWhvc3QKICAjIEFVRElUX1ZJUlRfSU5URUdSSVRZX0NIRUNLIC0gR3Vlc3QgaW50ZWdyaXR5IHJlc3VsdHMKICAtIHJlY29yZF90eXBlczogVklSVF9JTlRFR1JJVFlfQ0hFQ0sKICAgIGFjdGlvbjogY2hlY2tlZC1pbnRlZ3JpdHktb2YKICAgIGVjczogKmVjcy1ob3N0CiAgIyBBVURJVF9WSVJUX01BQ0hJTkVfSUQgLSBCaW5kaW5nIG9mIGxhYmVsIHRvIFZNCiAgLSByZWNvcmRfdHlwZXM6IFZJUlRfTUFDSElORV9JRAogICAgYWN0aW9uOiBhc3NpZ25lZC12bS1pZAogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiB2bQogICAgICB3aGF0OiB2aXJ0dWFsLW1hY2hpbmUKICAgIGVjczogKmVjcy1ob3N0CiAgIyBBVURJVF9WSVJUX01JR1JBVEVfSU4gLSBJbmJvdW5kIGd1ZXN0IG1pZ3JhdGlvbiBpbmZvCiAgLSByZWNvcmRfdHlwZXM6IFZJUlRfTUlHUkFURV9JTgogICAgYWN0aW9uOiBtaWdyYXRlZC12bS1mcm9tCiAgICBlY3M6ICplY3MtaG9zdAogICMgQVVESVRfVklSVF9NSUdSQVRFX09VVCAtIE91dGJvdW5kIGd1ZXN0IG1pZ3JhdGlvbiBpbmZvCiAgLSByZWNvcmRfdHlwZXM6IFZJUlRfTUlHUkFURV9PVVQKICAgIGFjdGlvbjogbWlncmF0ZWQtdm0tdG8KICAgIGVjczogKmVjcy1ob3N0CiAgIyBBVURJVF9WSVJUX1JFU09VUkNFIC0gUmVzb3VyY2UgYXNzaWdubWVudAogIC0gcmVjb3JkX3R5cGVzOiBWSVJUX1JFU09VUkNFCiAgICBhY3Rpb246IGFzc2lnbmVkLXZtLXJlc291cmNlCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IHJlc3JjCiAgICAgIHNlY29uZGFyeTogdm0KICAgICAgd2hhdDogdmlydHVhbC1tYWNoaW5lCiAgICBlY3M6ICplY3MtaG9zdAoKICAjIFVzZXJzcGFjZSBwcm9jZXNzIGV2ZW50cwoKICAjIEFVRElUX0NIR1JQX0lEIC0gVXNlciBzcGFjZSBncm91cCBJRCBjaGFuZ2VkCiAgLSByZWNvcmRfdHlwZXM6IENIR1JQX0lECiAgICBhY3Rpb246IGNoYW5nZWQtZ3JvdXAKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBjaGFuZ2UKICAjIEFVRElUX0NIVVNFUl9JRCAtIENoYW5nZWQgdXNlciBJRCBzdXBwbGVtZW50YWwgZGF0YQogIC0gcmVjb3JkX3R5cGVzOiBDSFVTRVJfSUQKICAgIGFjdGlvbjogY2hhbmdlZC11c2VyLWlkCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLXByb2Nlc3MKICAgICAgdHlwZTogY2hhbmdlCiAgIyBBVURJVF9URVNUIC0gVXNlZCBmb3IgdGVzdCBzdWNjZXNzIG1lc3NhZ2VzCiAgLSByZWNvcmRfdHlwZXM6IFRFU1QKICAgIGFjdGlvbjogc2VudC10ZXN0CiAgICBlY3M6ICplY3MtcHJvY2VzcwogICMgQVVESVRfVFJVU1RFRF9BUFAgLSBUcnVzdGVkIGFwcCBtc2cgLSBmcmVlc3R5bGUgdGV4dAogIC0gcmVjb3JkX3R5cGVzOiBUUlVTVEVEX0FQUAogICAgYWN0aW9uOiB1bmtub3duCiAgICBlY3M6ICplY3MtcHJvY2VzcwogICMgQVVESVRfVVNFUl9DTUQgLSBVc2VyIHNoZWxsIGNvbW1hbmQgYW5kIGFyZ3MKICAtIHJlY29yZF90eXBlczogVVNFUl9DTUQKICAgIGFjdGlvbjogcmFuLWNvbW1hbmQKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogY21kCiAgICAgIHdoYXQ6IHByb2Nlc3MKICAgIGRlc2NyaXB0aW9uOiA+CiAgICAgIFRoZXNlIG1lc3NhZ2VzIGFyZSBmcm9tIHVzZXItc3BhY2UgYXBwcywgbGlrZSBzdWRvLCB0aGF0IGxvZyBjb21tYW5kcwogICAgICBiZWluZyBydW4gYnkgYSB1c2VyLiBUaGUgdWlkIGNvbnRhaW5lZCBpbiB0aGVzZSBtZXNzYWdlcyBpcyB1c2VyJ3MgVUlEIGF0CiAgICAgIHRoZSB0aW1lIHRoZSBjb21tYW5kIHdhcyBydW4uIEl0IGlzIG5vdCB0aGUgInRhcmdldCIgVUlEIHVzZWQgdG8gcnVuIHRoZQogICAgICBjb21tYW5kLCB3aGljaCBpcyBub3JtYWxseSByb290LgogICAgZWNzOgogICAgICA8PDogKmVjcy1wcm9jZXNzCiAgICAgIHR5cGU6IHN0YXJ0CgogICMgSG9zdC1sZXZlbCBldmVudHMKCiAgIyBBVURJVF9TWVNURU1fQk9PVCAtIFN5c3RlbSBib290CiAgLSByZWNvcmRfdHlwZXM6IFNZU1RFTV9CT09UCiAgICBhY3Rpb246IGJvb3RlZC1zeXN0ZW0KICAgIG9iamVjdDoKICAgICAgd2hhdDogc3lzdGVtCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWhvc3QKICAgICAgdHlwZTogc3RhcnQKICAjIEFVRElUX1NZU1RFTV9SVU5MRVZFTCAtIFN5c3RlbSBydW5sZXZlbCBjaGFuZ2UKICAtIHJlY29yZF90eXBlczogU1lTVEVNX1JVTkxFVkVMCiAgICBhY3Rpb246IGNoYW5nZWQtdG8tcnVubGV2ZWwKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogbmV3LWxldmVsCiAgICAgIHdoYXQ6IHN5c3RlbQogICAgZWNzOgogICAgICA8PDogKmVjcy1ob3N0CiAgICAgIHR5cGU6IGNoYW5nZQogICMgQVVESVRfU1lTVEVNX1NIVVRET1dOIC0gU3lzdGVtIHNodXRkb3duCiAgLSByZWNvcmRfdHlwZXM6IFNZU1RFTV9TSFVURE9XTgogICAgYWN0aW9uOiBzaHV0ZG93bi1zeXN0ZW0KICAgIG9iamVjdDoKICAgICAgd2hhdDogc3lzdGVtCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLWhvc3QKICAgICAgdHlwZTogZW5kCgogICMgU2VydmljZS1sZXZlbCBldmVudHMKCiAgIyBBVURJVF9TRVJWSUNFX1NUQVJUIC0gU2VydmljZSAoZGFlbW9uKSBzdGFydAogIC0gcmVjb3JkX3R5cGVzOiBTRVJWSUNFX1NUQVJUCiAgICBhY3Rpb246IHN0YXJ0ZWQtc2VydmljZQogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiB1bml0CiAgICAgIHdoYXQ6IHNlcnZpY2UKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBzdGFydAogICMgQVVESVRfU0VSVklDRV9TVE9QIC0gU2VydmljZSAoZGFlbW9uKSBzdG9wCiAgLSByZWNvcmRfdHlwZXM6IFNFUlZJQ0VfU1RPUAogICAgYWN0aW9uOiBzdG9wcGVkLXNlcnZpY2UKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogdW5pdAogICAgICB3aGF0OiBzZXJ2aWNlCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLXByb2Nlc3MKICAgICAgdHlwZTogc3RvcAoKICAjIEF1ZGl0ZCBpbnRlcm5hbCBldmVudHMKCiAgIyBBVURJVF9DT05GSUdfQ0hBTkdFIC0gQXVkaXQgc3lzdGVtIGNvbmZpZ3VyYXRpb24gY2hhbmdlCiAgLSByZWNvcmRfdHlwZXM6IENPTkZJR19DSEFOR0UKICAgIGFjdGlvbjogY2hhbmdlZC1hdWRpdC1jb25maWd1cmF0aW9uCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6CiAgICAgICAgW29wLCBrZXksIGF1ZGl0X2VuYWJsZWQsIGF1ZGl0X3BpZCwgYXVkaXRfYmFja2xvZ19saW1pdCwgYXVkaXRfZmFpbHVyZV0KICAgICAgd2hhdDogYXVkaXQtY29uZmlnCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLXByb2Nlc3MKICAgICAgdHlwZTogY2hhbmdlCiAgIyBBVURJVF9EQUVNT05fQUJPUlQgLSBEYWVtb24gZXJyb3Igc3RvcCByZWNvcmQKICAtIHJlY29yZF90eXBlczogREFFTU9OX0FCT1JUCiAgICBhY3Rpb246IGFib3J0ZWQtYXVkaXRkLXN0YXJ0dXAKICAgIG9iamVjdDoKICAgICAgd2hhdDogc2VydmljZQogICAgZWNzOgogICAgICA8PDogKmVjcy1wcm9jZXNzCiAgICAgIHR5cGU6IHN0b3AKICAjIEFVRElUX0RBRU1PTl9BQ0NFUFQgLSBBdWRpdGQgYWNjZXB0ZWQgcmVtb3RlIGNvbm5lY3Rpb24KICAtIHJlY29yZF90eXBlczogREFFTU9OX0FDQ0VQVAogICAgYWN0aW9uOiByZW1vdGUtYXVkaXQtY29ubmVjdGVkCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHNlcnZpY2UKICAgIGVjczoKICAgICAgPDw6ICplY3MtbmV0d29yawogICAgICB0eXBlOgogICAgICAgIC0gY29ubmVjdGlvbgogICAgICAgIC0gc3RhcnQKICAjIEFVRElUX0RBRU1PTl9DTE9TRSAtIEF1ZGl0ZCBjbG9zZWQgcmVtb3RlIGNvbm5lY3Rpb24KICAtIHJlY29yZF90eXBlczogREFFTU9OX0NMT1NFCiAgICBhY3Rpb246IHJlbW90ZS1hdWRpdC1kaXNjb25uZWN0ZWQKICAgIG9iamVjdDoKICAgICAgd2hhdDogc2VydmljZQogICAgZWNzOgogICAgICA8PDogKmVjcy1uZXR3b3JrCiAgICAgIHR5cGU6CiAgICAgICAgLSBjb25uZWN0aW9uCiAgICAgICAgLSBzdGFydAogICMgQVVESVRfREFFTU9OX0NPTkZJRyAtIERhZW1vbiBjb25maWcgY2hhbmdlCiAgLSByZWNvcmRfdHlwZXM6IERBRU1PTl9DT05GSUcKICAgIGFjdGlvbjogY2hhbmdlZC1hdWRpdGQtY29uZmlndXJhdGlvbgogICAgb2JqZWN0OgogICAgICB3aGF0OiBzZXJ2aWNlCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLXByb2Nlc3MKICAgICAgdHlwZTogc3RvcAogICMgQVVESVRfREFFTU9OX0VORCAtIERhZW1vbiBub3JtYWwgc3RvcCByZWNvcmQKICAtIHJlY29yZF90eXBlczogREFFTU9OX0VORAogICAgYWN0aW9uOiBzaHV0ZG93bi1hdWRpdAogICAgb2JqZWN0OgogICAgICB3aGF0OiBzZXJ2aWNlCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLXByb2Nlc3MKICAgICAgdHlwZTogc3RvcAogICMgQVVESVRfREFFTU9OX0VSUiAtIEF1ZGl0ZCBpbnRlcm5hbCBlcnJvcgogIC0gcmVjb3JkX3R5cGVzOiBEQUVNT05fRVJSCiAgICBhY3Rpb246IGF1ZGl0LWVycm9yCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHNlcnZpY2UKICAgIGVjczogKmVjcy1wcm9jZXNzCiAgIyBBVURJVF9EQUVNT05fUkVDT05GSUcgLSBBdWRpdGQgc2hvdWxkIHJlY29uZmlndXJlCiAgLSByZWNvcmRfdHlwZXM6IERBRU1PTl9SRUNPTkZJRwogICAgYWN0aW9uOiByZWNvbmZpZ3VyZWQtYXVkaXRkCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHNlcnZpY2UKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBjaGFuZ2UKICAjIEFVRElUX0RBRU1PTl9SRVNVTUUgLSBBdWRpdGQgc2hvdWxkIHJlc3VtZSBsb2dnaW5nCiAgLSByZWNvcmRfdHlwZXM6IERBRU1PTl9SRVNVTUUKICAgIGFjdGlvbjogcmVzdW1lZC1hdWRpdC1sb2dnaW5nCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHNlcnZpY2UKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBjaGFuZ2UKICAjIEFVRElUX0RBRU1PTl9ST1RBVEUgLSBBdWRpdGQgc2hvdWxkIHJvdGF0ZSBsb2dzCiAgLSByZWNvcmRfdHlwZXM6IERBRU1PTl9ST1RBVEUKICAgIGFjdGlvbjogcm90YXRlZC1hdWRpdC1sb2dzCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHNlcnZpY2UKICAgIGVjczoKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBjaGFuZ2UKICAjIEFVRElUX0RBRU1PTl9TVEFSVCAtIERhZW1vbiBzdGFydHVwIHJlY29yZAogIC0gcmVjb3JkX3R5cGVzOiBEQUVNT05fU1RBUlQKICAgIGFjdGlvbjogc3RhcnRlZC1hdWRpdAogICAgb2JqZWN0OgogICAgICB3aGF0OiBzZXJ2aWNlCiAgICBlY3M6CiAgICAgIDw8OiAqZWNzLXByb2Nlc3MKICAgICAgdHlwZTogc3RhcnQKICAjIEFVRElUX0tFUk5FTCAtIEFzeW5jaHJvbm91cyBhdWRpdCByZWNvcmQuIE5PVCBBIFJFUVVFU1QuCiAgLSByZWNvcmRfdHlwZXM6IEtFUk5FTAogICAgYWN0aW9uOiBpbml0aWFsaXplZC1hdWRpdC1zdWJzeXN0ZW0KICAgIGVjczogKmVjcy1wcm9jZXNzCgogICMgQ29uZmlndXJhdGlvbiBjaGFuZ2UgZXZlbnRzCgogICMgQVVESVRfVVNZU19DT05GSUcgLSBVc2VyIHNwYWNlIHN5c3RlbSBjb25maWcgY2hhbmdlCiAgLSByZWNvcmRfdHlwZXM6IFVTWVNfQ09ORklHCiAgICBhY3Rpb246IGNoYW5nZWQtY29uZmlndXJhdGlvbgogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBvcAogICAgICB3aGF0OiBzeXN0ZW0KICAjIEFVRElUX05FVEZJTFRFUl9DRkcgLSBOZXRmaWx0ZXIgY2hhaW4gbW9kaWZpY2F0aW9ucwogIC0gcmVjb3JkX3R5cGVzOiBORVRGSUxURVJfQ0ZHCiAgICBhY3Rpb246IGxvYWRlZC1maXJld2FsbC1ydWxlLXRvCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IHRhYmxlCiAgICAgIHdoYXQ6IGZpcmV3YWxsCiAgIyBBVURJVF9GRUFUVVJFX0NIQU5HRSAtIGF1ZGl0IGxvZyBsaXN0aW5nIGZlYXR1cmUgY2hhbmdlcwogIC0gcmVjb3JkX3R5cGVzOiBGRUFUVVJFX0NIQU5HRQogICAgYWN0aW9uOiBjaGFuZ2VkLWF1ZGl0LWZlYXR1cmUKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogZmVhdHVyZQogICAgICB3aGF0OiBzeXN0ZW0KICAjIEFVRElUX1JFUExBQ0UgLSBSZXBsYWNlIGF1ZGl0ZCBpZiB0aGlzIHBhY2tldCB1bmFuc3dlcmQKCiAgIyBUVFkgZXZlbnRzCgogIC0gcmVjb3JkX3R5cGVzOgogICAgICAjIEFVRElUX1RUWSAtIElucHV0IG9uIGFuIGFkbWluaXN0cmF0aXZlIFRUWQogICAgICAtIFRUWQogICAgICAjIEFVRElUX1VTRVJfVFRZIC0gTm9uLUlDQU5PTiBUVFkgaW5wdXQgbWVhbmluZwogICAgICAtIFVTRVJfVFRZCiAgICBhY3Rpb246IHR5cGVkCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGRhdGEKICAgICAgd2hhdDoga2V5c3Ryb2tlcwogICAgaG93OiBbY29tbSwgZXhlXQoKICAjIFBvbGljeSBldmVudHMKCiAgIyBBVURJVF9BVkMgLSBTRSBMaW51eCBhdmMgZGVuaWFsIG9yIGdyYW50IChzZWxpbnV4KQogIC0gcmVjb3JkX3R5cGVzOiBBVkMKICAgIGFjdGlvbjogdmlvbGF0ZWQtc2VsaW51eC1wb2xpY3kKICAgIHN1YmplY3Q6CiAgICAgIHByaW1hcnk6IHNjb250ZXh0CiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IHRjb250ZXh0CiAgICAgIHNlY29uZGFyeTogdGNsYXNzCiAgICBoYXNfZmllbGRzOgogICAgICAtIHNlcmVzdWx0CiAgIyBBVURJVF9BVkMgLSBTRSBMaW51eCBhdmMgZGVuaWFsIG9yIGdyYW50IChhcHBhcm1vcikKICAtIHJlY29yZF90eXBlczogQVZDCiAgICBhY3Rpb246IHZpb2xhdGVkLWFwcGFybW9yLXBvbGljeQogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBvcGVyYXRpb24KICAgICAgc2Vjb25kYXJ5OiBbcmVxdWVzdGVkX21hc2ssIGRlbmllZF9tYXNrLCBjYXBuYW1lXQogICAgICB3aGF0OiBwb2xpY3kKICAgIGhhc19maWVsZHM6CiAgICAgIC0gYXBwYXJtb3IKICAjIEFVRElUX0ZTX1JFTEFCRUwgLSBGaWxlc3lzdGVtIHJlbGFiZWxlZAogIC0gcmVjb3JkX3R5cGVzOiBGU19SRUxBQkVMCiAgICBhY3Rpb246IHJlbGFiZWxlZC1maWxlc3lzdGVtCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IG1hYy1jb25maWcKICAjIEFVRElUX0xBQkVMX0xFVkVMX0NIQU5HRSAtIE9iamVjdCdzIGxldmVsIHdhcyBjaGFuZ2VkCiAgLSByZWNvcmRfdHlwZXM6IExBQkVMX0xFVkVMX0NIQU5HRQogICAgYWN0aW9uOiBtb2RpZmllZC1sZXZlbC1vZgogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBwcmludGVyCiAgICAgIHdoYXQ6IHByaW50ZXIKICAjIEFVRElUX0xBQkVMX09WRVJSSURFIC0gQWRtaW4gaXMgb3ZlcnJpZGluZyBhIGxhYmVsCiAgLSByZWNvcmRfdHlwZXM6IExBQkVMX09WRVJSSURFCiAgICBhY3Rpb246IG92ZXJyb2RlLWxhYmVsLW9mCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IG1hYy1jb25maWcKICAjIEFVRElUX01BQ19DSEVDSyAtIFVzZXIgc3BhY2UgTUFDIGRlY2lzaW9uIHJlc3VsdHMKICAtIHJlY29yZF90eXBlczogTUFDX0NIRUNLCiAgICBhY3Rpb246IG1hYy1wZXJtaXNzaW9uCiAgIyBBVURJVF9NQUNfQ09ORklHX0NIQU5HRSAtIENoYW5nZXMgdG8gYm9vbGVhbnMKICAtIHJlY29yZF90eXBlczogTUFDX0NPTkZJR19DSEFOR0UKICAgIGFjdGlvbjogY2hhbmdlZC1zZWxpbnV4LWJvb2xlYW4KICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogYm9vbAogICAgICB3aGF0OiBtYWMtY29uZmlnCiAgIyBBVURJVF9NQUNfUE9MSUNZX0xPQUQgLSBQb2xpY3kgZmlsZSBsb2FkCiAgLSByZWNvcmRfdHlwZXM6IE1BQ19QT0xJQ1lfTE9BRAogICAgYWN0aW9uOiBsb2FkZWQtc2VsaW51eC1wb2xpY3kKICAgIG9iamVjdDoKICAgICAgd2hhdDogbWFjLWNvbmZpZwogICMgQVVESVRfTUFDX1NUQVRVUyAtIENoYW5nZWQgZW5mb3JjaW5nLHBlcm1pc3NpdmUsb2ZmCiAgLSByZWNvcmRfdHlwZXM6IE1BQ19TVEFUVVMKICAgIGFjdGlvbjogY2hhbmdlZC1zZWxpbnV4LWVuZm9yY2VtZW50CiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGVuZm9yY2luZwogICAgICB3aGF0OiBtYWMtY29uZmlnCiAgIyBBVURJVF9VU0VSX0FWQyAtIFVzZXIgc3BhY2UgYXZjIG1lc3NhZ2UKICAtIHJlY29yZF90eXBlczogVVNFUl9BVkMKICAgIGFjdGlvbjogYWNjZXNzLXBlcm1pc3Npb24KICAjIEFVRElUX1VTRVJfTUFDX0NPTkZJR19DSEFOR0UgLSBDaGFuZ2UgbWFkZSB0byBNQUMgcG9saWN5CiAgLSByZWNvcmRfdHlwZXM6IFVTRVJfTUFDX0NPTkZJR19DSEFOR0UKICAgIGFjdGlvbjogY2hhbmdlZC1tYWMtY29uZmlndXJhdGlvbgogICAgb2JqZWN0OgogICAgICB3aGF0OiBtYWMtY29uZmlnCiAgIyBBVURJVF9VU0VSX01BQ19QT0xJQ1lfTE9BRCAtIFVzZXJzcGMgZGFlbW9uIGxvYWRlZCBwb2xpYwogIC0gcmVjb3JkX3R5cGVzOiBVU0VSX01BQ19QT0xJQ1lfTE9BRAogICAgYWN0aW9uOiBsb2FkZWQtbWFjLXBvbGljeQogICAgb2JqZWN0OgogICAgICB3aGF0OiBtYWMtY29uZmlnCiAgIyBBVURJVF9VU0VSX1NFTElOVVhfRVJSIC0gU0UgTGludXggdXNlciBzcGFjZSBlcnJvcgogIC0gcmVjb3JkX3R5cGVzOiBVU0VSX1NFTElOVVhfRVJSCiAgICBhY3Rpb246IGFjY2Vzcy1lcnJvcgogICMgQVVESVRfU0VDQ09NUCAtIFNlY3VyZSBDb21wdXRpbmcgZXZlbnQKICAtIHJlY29yZF90eXBlczogU0VDQ09NUAogICAgYWN0aW9uOiB2aW9sYXRlZC1zZWNjb21wLXBvbGljeQogICAgb2JqZWN0OgogICAgICBwcmltYXJ5OiBzeXNjYWxsCiAgICAgIHdoYXQ6IHByb2Nlc3MKICAjIEFVRElUX1NFTElOVVhfRVJSIC0gSW50ZXJuYWwgU0UgTGludXggRXJyb3JzCiAgLSBhY3Rpb246IGNhdXNlZC1tYWMtcG9saWN5LWVycm9yCiAgICBvYmplY3Q6CiAgICAgIHdoYXQ6IHN5c3RlbQogICAgcmVjb3JkX3R5cGVzOiBTRUxJTlVYX0VSUgogICMgQVVESVRfQVBQQVJNT1JfQUxMT1dFRAogICMgQVVESVRfQVBQQVJNT1JfREVOSUVECiAgIyBBVURJVF9BUFBBUk1PUl9FUlJPUgogICMgQVVESVRfQVZDX1BBVEggLSBkZW50cnksIHZmc21vdW50IHBhaXIgZnJvbSBhdmMKICAjIEFVRElUX0FQUEFSTU9SX0FVRElUCiAgIyBBVURJVF9BUFBBUk1PUl9ISU5UCiAgIyBBVURJVF9BUFBBUk1PUl9TVEFUVVMKICAjIEFVRElUX0FQUEFSTU9SX0VSUk9SCiAgIyBBVURJVF9ERVZfQUxMT0MgLSBEZXZpY2Ugd2FzIGFsbG9jYXRlZAogICMgQVVESVRfREVWX0RFQUxMT0MgLSBEZXZpY2Ugd2FzIGRlYWxsb2NhdGVkCiAgIyBBVURJVF9NQUNfVU5MQkxfQUxMT1cgLSBOZXRMYWJlbDogYWxsb3cgdW5sYWJlbGVkIHRyYWZmaWMKICAjIEFVRElUX01BQ19DSVBTT1Y0X0FERCAtIE5ldExhYmVsOiBhZGQgQ0lQU092NCBET0kgZW50cnkKICAjIEFVRElUX01BQ19DSVBTT1Y0X0RFTCAtIE5ldExhYmVsOiBkZWwgQ0lQU092NCBET0kgZW50cnkKICAjIEFVRElUX01BQ19NQVBfQUREIC0gTmV0TGFiZWw6IGFkZCBMU00gZG9tYWluIG1hcHBpbmcKICAjIEFVRElUX01BQ19NQVBfREVMIC0gTmV0TGFiZWw6IGRlbCBMU00gZG9tYWluIG1hcHBpbmcKICAjIEFVRElUX01BQ19JUFNFQ19FVkVOVCAtIEF1ZGl0IGFuIElQU2VjIGV2ZW50CiAgIyBBVURJVF9NQUNfVU5MQkxfU1RDQUREIC0gTmV0TGFiZWw6IGFkZCBhIHN0YXRpYyBsYWJlbAogICMgQVVESVRfTUFDX1VOTEJMX1NUQ0RFTCAtIE5ldExhYmVsOiBkZWwgYSBzdGF0aWMgbGFiZWwKICAjIEFVRElUX01BQ19DQUxJUFNPX0FERCAtIE5ldExhYmVsOiBhZGQgQ0FMSVBTTyBET0kgZW50cnkKICAjIEFVRElUX01BQ19DQUxJUFNPX0RFTCAtIE5ldExhYmVsOiBkZWwgQ0FMSVBTTyBET0kgZW50cnkKICAjIEFVRElUX1VTRVJfTEFCRUxFRF9FWFBPUlQgLSBPYmplY3QgZXhwb3J0ZWQgd2l0aCBsYWJlbAogICMgQVVESVRfVVNFUl9VTkxBQkVMRURfRVhQT1JUIC0gT2JqZWN0IGV4cG9ydGVkIHdpdGhvdXQgbGFiZWwKCiAgIyBDcnlwdG8gZXZlbnRzCgogIC0gPDw6ICptYWNyby11c2VyLXNlc3Npb24KICAgIGFjdGlvbjogbmVnb3RpYXRlZC1jcnlwdG8ta2V5CiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGZwCiAgICAgIHNlY29uZGFyeTogW2FkZHIsIGhvc3RuYW1lXQogICAgICB3aGF0OiB1c2VyLXNlc3Npb24KICAgIHJlY29yZF90eXBlczogQ1JZUFRPX0tFWV9VU0VSCiAgICBzb3VyY2VfaXA6IFthZGRyXQogICAgZWNzOiAqZWNzLXByb2Nlc3MKICAtIGFjdGlvbjogY3J5cHRvLW9mZmljZXItbG9nZ2VkLWluCiAgICByZWNvcmRfdHlwZXM6IENSWVBUT19MT0dJTgogIC0gYWN0aW9uOiBjcnlwdG8tb2ZmaWNlci1sb2dnZWQtb3V0CiAgICByZWNvcmRfdHlwZXM6IENSWVBUT19MT0dPVVQKICAgIGVjczogKmVjcy1wcm9jZXNzCiAgLSA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogICAgYWN0aW9uOiBzdGFydGVkLWNyeXB0by1zZXNzaW9uCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGFkZHIKICAgICAgc2Vjb25kYXJ5OiBbcnBvcnRdCiAgICByZWNvcmRfdHlwZXM6IENSWVBUT19TRVNTSU9OCiAgICBzb3VyY2VfaXA6IFthZGRyXQogICAgZWNzOiAqZWNzLXByb2Nlc3MKICAtIGFjdGlvbjogYWNjZXNzLXJlc3VsdAogICAgcmVjb3JkX3R5cGVzOiBEQUNfQ0hFQ0sKCiAgIyBBbm9tYWxpZXMKCiAgIyBBVURJVF9BTk9NX0FCRU5EIC0gUHJvY2VzcyBlbmRlZCBhYm5vcm1hbGx5CiAgLSByZWNvcmRfdHlwZXM6IEFOT01fQUJFTkQKICAgIGFjdGlvbjogY3Jhc2hlZC1wcm9ncmFtCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IFtjb21tLCBleGVdCiAgICAgIHNlY29uZGFyeTogcGlkCiAgICAgIHdoYXQ6IHByb2Nlc3MKICAgIGhvdzogc2lnCiAgICBlY3M6CiAgICAgICMgY29uc2lkZXIgYWRkaW5nIGFuIGFub21hbHkgY2F0ZWdvcnkgd2hlbiB3ZSBpbnRyb2R1Y2UKICAgICAgIyB0byBFQ1MKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBlbmQKICAjIEFVRElUX0FOT01fRVhFQyAtIEV4ZWN1dGlvbiBvZiBmaWxlCiAgLSByZWNvcmRfdHlwZXM6IEFOT01fRVhFQwogICAgYWN0aW9uOiBhdHRlbXB0ZWQtZXhlY3V0aW9uLW9mLWZvcmJpZGRlbi1wcm9ncmFtCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGNtZAogICAgICB3aGF0OiBwcm9jZXNzCiAgICBob3c6IHRlcm1pbmFsCiAgICBlY3M6CiAgICAgICMgY29uc2lkZXIgYWRkaW5nIGFuIGFub21hbHkgY2F0ZWdvcnkgd2hlbiB3ZSBpbnRyb2R1Y2UKICAgICAgIyB0byBFQ1MKICAgICAgPDw6ICplY3MtcHJvY2VzcwogICAgICB0eXBlOiBzdGFydAogICMgQVVESVRfQU5PTV9MSU5LIC0gU3VzcGljaW91cyB1c2Ugb2YgZmlsZSBsaW5rcwogIC0gcmVjb3JkX3R5cGVzOiBBTk9NX0xJTksKICAgIGFjdGlvbjogdXNlZC1zdXNwY2lvdXMtbGluawogICMgQVVESVRfQU5PTV9MT0dJTl9GQUlMVVJFUyAtIEZhaWxlZCBsb2dpbiBsaW1pdCByZWFjaGVkCiAgLSA8PDogKm1hY3JvLXVzZXItc2Vzc2lvbgogICAgcmVjb3JkX3R5cGVzOiBBTk9NX0xPR0lOX0ZBSUxVUkVTCiAgICBhY3Rpb246IGZhaWxlZC1sb2ctaW4tdG9vLW1hbnktdGltZXMtdG8KICAjIEFVRElUX0FOT01fTE9HSU5fTE9DQVRJT04gLSBMb2dpbiBmcm9tIGZvcmJpZGRlbiBsb2NhdGlvbgogIC0gPDw6ICptYWNyby11c2VyLXNlc3Npb24KICAgIHJlY29yZF90eXBlczogQU5PTV9MT0dJTl9MT0NBVElPTgogICAgYWN0aW9uOiBhdHRlbXB0ZWQtbG9nLWluLWZyb20tdW51c3VhbC1wbGFjZS10bwogICMgQVVESVRfQU5PTV9MT0dJTl9TRVNTSU9OUyAtIE1heCBjb25jdXJyZW50IHNlc3Npb25zIHJlYWNoZWQKICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IEFOT01fTE9HSU5fU0VTU0lPTlMKICAgIGFjdGlvbjogb3BlbmVkLXRvby1tYW55LXNlc3Npb25zLXRvCiAgIyBBVURJVF9BTk9NX0xPR0lOX1RJTUUgLSBMb2dpbiBhdHRlbXB0ZWQgYXQgYmFkIHRpbWUKICAtIDw8OiAqbWFjcm8tdXNlci1zZXNzaW9uCiAgICByZWNvcmRfdHlwZXM6IEFOT01fTE9HSU5fVElNRQogICAgYWN0aW9uOiBhdHRlbXB0ZWQtbG9nLWluLWR1cmluZy11bnVzdWFsLWhvdXItdG8KICAjIEFVRElUX0FOT01fUFJPTUlTQ1VPVVMgLSBEZXZpY2UgY2hhbmdlZCBwcm9taXNjdW91cyBtb2RlCiAgLSByZWNvcmRfdHlwZXM6IEFOT01fUFJPTUlTQ1VPVVMKICAgIGFjdGlvbjogY2hhbmdlZC1wcm9taXNjdW91cy1tb2RlLW9uLWRldmljZSAjIENvdWxkIGJlIGVudGVyZWQgb3IgZXhpdGVkIGJhc2VkIG9uIHByb20gZmllbGQuCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGRldgogICAgICB3aGF0OiBuZXR3b3JrLWRldmljZQogICMgQVVESVRfQU5PTV9SQkFDX0lOVEVHUklUWV9GQUlMIC0gUkJBQyBmaWxlIGludGVncml0eSBmYWlsdXJlCiAgLSByZWNvcmRfdHlwZXM6IEFOT01fUkJBQ19JTlRFR1JJVFlfRkFJTAogICAgYWN0aW9uOiB0ZXN0ZWQtZmlsZS1zeXN0ZW0taW50ZWdyaXR5LW9mCiAgICBvYmplY3Q6CiAgICAgIHByaW1hcnk6IGhvc3RuYW1lCiAgICAgIHdoYXQ6IGZpbGVzeXN0ZW0KICAjIEFVRElUX0FOT01fTE9HSU5fQUNDVCAtIExvZ2luIGF0dGVtcHRlZCB0byB3YXRjaGVkIGFjY3QKICAjIEFVRElUX0FOT01fTUFYX0RBQyAtIE1heCBEQUMgZmFpbHVyZXMgcmVhY2hlZAogICMgQVVESVRfQU5PTV9NQVhfTUFDIC0gTWF4IE1BQyBmYWlsdXJlcyByZWFjaGVkCiAgIyBBVURJVF9BTk9NX0FNVFVfRkFJTCAtIEFNVFUgZmFpbHVyZQogICMgQVVESVRfQU5PTV9SQkFDX0ZBSUwgLSBSQkFDIHNlbGYgdGVzdCBmYWlsdXJlCiAgIyBBVURJVF9BTk9NX0NSWVBUT19GQUlMIC0gQ3J5cHRvIHN5c3RlbSB0ZXN0IGZhaWx1cmUKICAjIEFVRElUX0FOT01fTUtfRVhFIC0gTWFrZSBhbiBleGVjdXRhYmxlCiAgIyBBVURJVF9BTk9NX0FDQ0VTU19GUyAtIEFjY2VzcyBvZiBmaWxlIG9yIGRpcgogICMgQVVESVRfQU5PTV9BRERfQUNDVCAtIEFkZGluZyBhbiBhY2N0CiAgIyBBVURJVF9BTk9NX0RFTF9BQ0NUIC0gRGVsZXRpbmcgYW4gYWNjdAogICMgQVVESVRfQU5PTV9NT0RfQUNDVCAtIENoYW5naW5nIGFuIGFjY3QKICAjIEFVRElUX0FOT01fUk9PVF9UUkFOUyAtIFVzZXIgYmVjYW1lIHJvb3QKICAjIEFVRElUX0FOT01fTE9HSU5fU0VSVklDRSAtIFNlcnZpY2UgYWNjdCBhdHRlbXB0ZWQgbG9naW4KCiAgIyBBbm9tYWx5IHJlc3BvbnNlcwoKICAjIEFVRElUX1JFU1BfQU5PTUFMWSAtIEFub21hbHkgbm90IHJlYWN0ZWQgdG8KICAjIEFVRElUX1JFU1BfQUxFUlQgLSBBbGVydCBlbWFpbCB3YXMgc2VudAogICMgQVVESVRfUkVTUF9LSUxMX1BST0MgLSBLaWxsIHByb2dyYW0KICAjIEFVRElUX1JFU1BfVEVSTV9BQ0NFU1MgLSBUZXJtaW5hdGUgc2Vzc2lvbgogICMgQVVESVRfUkVTUF9BQ0NUX1JFTU9URSAtIEFjY3QgbG9ja2VkIGZyb20gcmVtb3RlIGFjY2VzcwogICMgQVVESVRfUkVTUF9BQ0NUX0xPQ0tfVElNRUQgLSBVc2VyIGFjY3QgbG9ja2VkIGZvciB0aW1lCiAgIyBBVURJVF9SRVNQX0FDQ1RfVU5MT0NLX1RJTUVEIC0gVXNlciBhY2N0IHVubG9ja2VkIGZyb20gdGltZQogICMgQVVESVRfUkVTUF9BQ0NUX0xPQ0sgLSBVc2VyIGFjY3Qgd2FzIGxvY2tlZAogICMgQVVESVRfUkVTUF9URVJNX0xPQ0sgLSBUZXJtaW5hbCB3YXMgbG9ja2VkCiAgIyBBVURJVF9SRVNQX1NFQk9PTCAtIFNldCBhbiBTRSBMaW51eCBib29sZWFuCiAgIyBBVURJVF9SRVNQX0VYRUMgLSBFeGVjdXRlIGEgc2NyaXB0CiAgIyBBVURJVF9SRVNQX1NJTkdMRSAtIEdvIHRvIHNpbmdsZSB1c2VyIG1vZGUKICAjIEFVRElUX1JFU1BfSEFMVCAtIHRha2UgdGhlIHN5c3RlbSBkb3duCiAgIyBBVURJVF9SRVNQX09SSUdJTl9CTE9DSyAtIEFkZHJlc3MgYmxvY2tlZCBieSBpcHRhYmxlcwogICMgQVVESVRfUkVTUF9PUklHSU5fQkxPQ0tfVElNRUQgLSBBZGRyZXNzIGJsb2NrZWQgZm9yIHRpbWUKCiAgIyBBdWRpdCBydWxlIGV2ZW50cwoKICAjIEFVRElUX1NZU0NBTEwgLSBTeXNjYWxsIGV2ZW50CiAgIyBBVURJVF9QQVRIIC0gRmlsZW5hbWUgcGF0aCBpbmZvcm1hdGlvbgogICMgQVVESVRfSVBDIC0gSVBDIHJlY29yZAogICMgQVVESVRfU09DS0VUQ0FMTCAtIHN5c19zb2NrZXRjYWxsIGFyZ3VtZW50cwogICMgQVVESVRfU09DS0FERFIgLSBzb2NrYWRkciBjb3BpZWQgYXMgc3lzY2FsbCBhcmcKICAjIEFVRElUX0NXRCAtIEN1cnJlbnQgd29ya2luZyBkaXJlY3RvcnkKICAjIEFVRElUX0VYRUNWRSAtIGV4ZWN2ZSBhcmd1bWVudHMKICAjIEFVRElUX0lQQ19TRVRfUEVSTSAtIElQQyBuZXcgcGVybWlzc2lvbnMgcmVjb3JkIHR5cGUKICAjIEFVRElUX01RX09QRU4gLSBQT1NJWCBNUSBvcGVuIHJlY29yZCB0eXBlCiAgIyBBVURJVF9NUV9TRU5EUkVDVi0gUE9TSVggTVEgc2VuZC9yZWNlaXZlIHJlY29yZCB0eXBlCiAgIyBBVURJVF9NUV9OT1RJRlkgLSBQT1NJWCBNUSBub3RpZnkgcmVjb3JkIHR5cGUKICAjIEFVRElUX01RX0dFVFNFVEFUVFIgLSBQT1NJWCBNUSBnZXQvc2V0IGF0dHJpYnV0ZSByZWNvcmQgdHlwZQogICMgQVVESVRfRkRfUEFJUiAtIGF1ZGl0IHJlY29yZCBmb3IgcGlwZS9zb2NrZXRwYWlyCiAgIyBBVURJVF9PQkpfUElEIC0gcHRyYWNlIHRhcmdldAogICMgQVVESVRfQlBSTV9GQ0FQUyAtIEluZm9ybWF0aW9uIGFib3V0IGZjYXBzIGluY3JlYXNpbmcgcGVybXMKICAjIEFVRElUX0NBUFNFVCAtIFJlY29yZCBzaG93aW5nIGFyZ3VtZW50IHRvIHN5c19jYXBzZXQKICAjIEFVRElUX01NQVAgLSBSZWNvcmQgc2hvd2luZyBkZXNjcmlwdG9yIGFuZCBmbGFncyBpbiBtbWFwCiAgIyBBVURJVF9ORVRGSUxURVJfUEtUIC0gUGFja2V0cyB0cmF2ZXJzaW5nIG5ldGZpbHRlciBjaGFpbnMKCiAgIyBJbnRlZ3JpdHkgY2hlY2tzCgogICMgQVVESVRfSU5URUdSSVRZX0RBVEEgLSBEYXRhIGludGVncml0eSB2ZXJpZmljYXRpb24KICAjIEFVRElUX0lOVEVHUklUWV9NRVRBREFUQSAtIE1ldGFkYXRhIGludGVncml0eSB2ZXJpZmljYXRpb24KICAjIEFVRElUX0lOVEVHUklUWV9TVEFUVVMgLSBJbnRlZ3JpdHkgZW5hYmxlIHN0YXR1cwogICMgQVVESVRfSU5URUdSSVRZX0hBU0ggLSBJbnRlZ3JpdHkgSEFTSCB0eXBlCiAgIyBBVURJVF9JTlRFR1JJVFlfUENSIC0gUENSIGludmFsaWRhdGlvbiBtc2dzCiAgIyBBVURJVF9JTlRFR1JJVFlfUlVMRSAtIFBvbGljeSBydWxlCgogICMgVmFyaW91cwoKICAjIEFVRElUX1VTRVIgLSBNZXNzYWdlIGZyb20gdXNlcnNwYWNlIC0tIGRlcHJlY2F0ZWQKICAtIHJlY29yZF90eXBlczogVVNFUgogICAgYWN0aW9uOiBzZW50LW1lc3NhZ2UKICAgIG9iamVjdDoKICAgICAgcHJpbWFyeTogYWRkcgo=")
 		assets["normalizationData"] = value
 	}
 


Test patch:
diff --git a/aucoalesce/testdata/random-internet.json.golden b/aucoalesce/testdata/random-internet.json.golden
index 31a7cb1..30079f0 100644
--- a/aucoalesce/testdata/random-internet.json.golden
+++ b/aucoalesce/testdata/random-internet.json.golden
@@ -41,6 +41,16 @@
       "data": {
         "reason": "memory violation",
         "sig": "11"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "end"
+          ]
+        }
       }
     }
   }
diff --git a/aucoalesce/testdata/rhel-7-linux-3.10.0.json.golden b/aucoalesce/testdata/rhel-7-linux-3.10.0.json.golden
index e8aab6a..f199597 100644
--- a/aucoalesce/testdata/rhel-7-linux-3.10.0.json.golden
+++ b/aucoalesce/testdata/rhel-7-linux-3.10.0.json.golden
@@ -36,6 +36,16 @@
       "data": {
         "list": "4",
         "op": "add_rule"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "change"
+          ]
+        }
       }
     }
   },
@@ -73,6 +83,16 @@
       "data": {
         "audit_backlog_limit": "64",
         "old": "8192"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "change"
+          ]
+        }
       }
     }
   },
@@ -127,6 +147,16 @@
         "kind": "server",
         "op": "destroy",
         "spid": "1299"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     }
   },
@@ -186,6 +216,16 @@
         "pfs": "curve25519-sha256@libssh.org",
         "rport": "63927",
         "spid": "1299"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     }
   },
@@ -228,6 +268,16 @@
       },
       "data": {
         "old-ses": "4294967295"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -280,6 +330,16 @@
         "acct": "root",
         "op": "login",
         "terminal": "ssh"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -325,6 +385,16 @@
         "id": "1000",
         "op": "login",
         "terminal": "/dev/pts/1"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "end"
+          ]
+        }
       }
     },
     "warnings": [
@@ -389,6 +459,16 @@
         "items": "0",
         "syscall": "adjtimex",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "host"
+          ],
+          "type": [
+            "change"
+          ]
+        }
       }
     }
   },
@@ -497,7 +577,17 @@
           "ouid": "0",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "file"
+          ],
+          "type": [
+            "creation"
+          ]
+        }
+      }
     }
   },
   {
@@ -595,7 +685,17 @@
           "ouid": "0",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "file"
+          ],
+          "type": [
+            "creation"
+          ]
+        }
+      }
     }
   }
 ]
diff --git a/aucoalesce/testdata/ubuntu-16.04-linux-4.13.0.json.golden b/aucoalesce/testdata/ubuntu-16.04-linux-4.13.0.json.golden
index cc7c603..0a2d2e1 100644
--- a/aucoalesce/testdata/ubuntu-16.04-linux-4.13.0.json.golden
+++ b/aucoalesce/testdata/ubuntu-16.04-linux-4.13.0.json.golden
@@ -56,6 +56,16 @@
         "requested_mask": "trace",
         "syscall": "read",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "file"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -168,7 +178,17 @@
           "ouid": "100",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "file"
+          ],
+          "type": [
+            "deletion"
+          ]
+        }
+      }
     },
     "warnings": [
       "duplicate key (apparmor) from AVC message",
diff --git a/aucoalesce/testdata/ubuntu-16.10-linux-4.8.0.json.golden b/aucoalesce/testdata/ubuntu-16.10-linux-4.8.0.json.golden
index 3dd1c22..c6ac177 100644
--- a/aucoalesce/testdata/ubuntu-16.10-linux-4.8.0.json.golden
+++ b/aucoalesce/testdata/ubuntu-16.10-linux-4.8.0.json.golden
@@ -56,6 +56,16 @@
         "syscall": "ioctl",
         "tty": "pts0",
         "uid": "0"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     }
   },
@@ -90,6 +100,16 @@
       "data": {
         "list": "4",
         "op": "remove_rule"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "change"
+          ]
+        }
       }
     }
   },
@@ -125,6 +145,16 @@
         "list": "4",
         "op": "updated_rules",
         "path": "/etc/gshadow"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "change"
+          ]
+        }
       }
     }
   },
@@ -219,7 +249,17 @@
           "ouid": "0",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "start"
+          ]
+        }
+      }
     }
   },
   {
@@ -275,6 +315,16 @@
         "syscall": "setsockopt",
         "table": "filter",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     }
   },
@@ -312,6 +362,16 @@
       },
       "data": {
         "unit": "rsyslog"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -350,6 +410,16 @@
         "acct": "root",
         "op": "PAM:session_close",
         "terminal": "cron"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -398,6 +468,16 @@
         "acct": "(invalid user)",
         "op": "login",
         "terminal": "sshd"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -444,6 +524,16 @@
         "id": "1001",
         "op": "login",
         "terminal": "/dev/pts/1"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -490,6 +580,16 @@
         "hostname": "72.83.230.100",
         "op": "PAM:session_open",
         "terminal": "ssh"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     }
   },
@@ -557,6 +657,17 @@
         "socket_port": "58140",
         "syscall": "accept",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "network"
+          ],
+          "type": [
+            "connection",
+            "start"
+          ]
+        }
       }
     }
   },
@@ -612,6 +723,16 @@
         "exit": "0",
         "syscall": "adjtimex",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "host"
+          ],
+          "type": [
+            "change"
+          ]
+        }
       }
     }
   },
@@ -679,6 +800,17 @@
         "socket_port": "80",
         "syscall": "connect",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "network"
+          ],
+          "type": [
+            "connection",
+            "start"
+          ]
+        }
       }
     }
   },
@@ -734,6 +866,16 @@
         "exit": "0",
         "syscall": "listen",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "network"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   }
diff --git a/aucoalesce/testdata/ubuntu-17.04-linux-4.10.0.json.golden b/aucoalesce/testdata/ubuntu-17.04-linux-4.10.0.json.golden
index e1bd41f..a368e5a 100644
--- a/aucoalesce/testdata/ubuntu-17.04-linux-4.10.0.json.golden
+++ b/aucoalesce/testdata/ubuntu-17.04-linux-4.10.0.json.golden
@@ -34,6 +34,16 @@
         "acct": "root",
         "op": "PAM:setcred",
         "terminal": "cron"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -75,6 +85,16 @@
         "acct": "root",
         "op": "PAM:setcred",
         "terminal": "cron"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -174,7 +194,17 @@
           "ouid": "0",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "start"
+          ]
+        }
+      }
     }
   },
   {
@@ -212,6 +242,16 @@
         "acct": "root",
         "op": "PAM:accounting",
         "terminal": "cron"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -253,6 +293,16 @@
         "acct": "root",
         "op": "PAM:authentication",
         "terminal": "/dev/pts/0"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -294,6 +344,17 @@
         "acct": "akroh",
         "op": "PAM:chauthtok",
         "terminal": "pts/0"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "iam"
+          ],
+          "type": [
+            "user",
+            "change"
+          ]
+        }
       }
     },
     "warnings": [
@@ -333,6 +394,16 @@
       "data": {
         "cmd": "su",
         "terminal": "pts/0"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -371,6 +442,16 @@
         "acct": "root",
         "op": "PAM:session_close",
         "terminal": "cron"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -419,6 +500,16 @@
         "hostname": "185.56.82.22",
         "op": "PAM:bad_ident",
         "terminal": "ssh"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     }
   },
@@ -464,6 +555,16 @@
         "acct": "(invalid user)",
         "op": "login",
         "terminal": "sshd"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "start"
+          ]
+        }
       }
     }
   },
@@ -502,6 +603,16 @@
         "acct": "root",
         "op": "PAM:session_open",
         "terminal": "cron"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "authentication"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
     },
     "warnings": [
@@ -561,11 +672,18 @@
         "socket_port": "60192",
         "syscall": "getpeername",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
-    },
-    "warnings": [
-      "no normalization found for event"
-    ]
+    }
   },
   {
     "test_name": "getsockname syscall",
@@ -619,11 +737,18 @@
         "socket_port": "53989",
         "syscall": "getsockname",
         "tty": "(none)"
+      },
+      "ecs": {
+        "event": {
+          "category": [
+            "process"
+          ],
+          "type": [
+            "info"
+          ]
+        }
       }
-    },
-    "warnings": [
-      "no normalization found for event"
-    ]
+    }
   },
   {
     "test_name": "rename syscall",
@@ -733,7 +858,17 @@
           "ouid": "0",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "file"
+          ],
+          "type": [
+            "change"
+          ]
+        }
+      }
     }
   },
   {
@@ -822,7 +957,17 @@
           "ouid": "0",
           "rdev": "00:00"
         }
-      ]
+      ],
+      "ecs": {
+        "event": {
+          "category": [
+            "file"
+          ],
+          "type": [
+            "deletion"
+          ]
+        }
+      }
     }
   }
 ]