python-ldap-dev — discussion among developers

Re: ldapsearch vs. python-ldap

[Michael S. <mi...@st...>]

You might also have hit the problem with automatic referral chasing
within libldap as anonymous.

Try this to switch that off:

l = ldap.initialize('ldap://<host>:389')
l.set_option(ldap.OPT_REFERRALS,0)

> try:
> 	#l.simple_bind_s('fir...@ex...', getpass.getpass())
> l.simple_bind_s('<place>\<shortname>', getpass.getpass())			# Works
> 
> except Exception, e:

You should rather catch ldap.LDAPError here.

Ciao, Michael.

Re: using Kerberos to authenticate to Active Directory from python ldap

[Michael S. <mi...@st...>]

Olivier Sessink wrote:
>> ld = ldap.initialize('ldap://foobar')
>> ld.set_option(ldap.OPT_REFERRALS,0)
> 
> you saved my day!
> 
> it works.

Glad that worked.

> sorry for my limited knowledge, but what does "referrals should be
> automatically chased" mean?

Referrals are basically LDAP URLs returned potentially pointing to other
LDAP servers where to look for. The client has to chase the referrals.
This is a broken concept since the LDAPv3 standard says nothing about
which credentials to use when chasing the referral. libldap by default
chased referrals anonymously.

Ciao, Michael.

Re: using Kerberos to authenticate to Active Directory from python ldap

[Olivier S. <oli...@gm...>]

2009/4/10 Michael Ströder <mi...@st...>:
> Olivier Sessink wrote:
>> 2009/4/10 Michael Ströder <mi...@st...>:
>>> You can bind with SASL/GSSAPI to AD with plain python-ldap provided you
>>> obtained a valid TGT with kinit before (just like with command-line tool
>>> ldapsearch).
>>
>> thanks, that's what I need to know.
>>
>> I can't get it to work though..
>>
>> ld = ldap.initialize('ldap://foobar')
>> sasl = ldap.sasl.gssapi()
>> ld.sasl_interactive_bind_s('', sasl)
>> ld.search_s('DC=foo,DC=foo', ldap.SCOPE_SUBTREE, '(CN=blabla)', ['Member'])
>>
>> ldap.OPERATIONS_ERROR: {'info': '00000000: LdapErr: DSID-0C090627,
>> comment: In order to perform this operation a successful bind must be
>> completed on the connection., data 0, vece', 'desc': 'Operations
>> error'}
>>
>> this shell command works:
>>
>> ldapsearch -YGSSAPI  -H ldap://foobar -bDC=foo,DC=foo '(CN=blabla)' Member
>>
>> I've tried different ldap URL's, but from an ldapsearch strace I'm
>> pretty sure I use the right ldap server.
>
> Hmm, this should simply work just like the ldapsearch usage. Since
> you're searching from domain level it would be worth to try to
> explicitly switch off referral chasing within libldap:
>
> ld = ldap.initialize('ldap://foobar')
> ld.set_option(ldap.OPT_REFERRALS,0)

you saved my day!

it works.

sorry for my limited knowledge, but what does "referrals should be
automatically chased" mean?

many thanks

Olivier

Re: using Kerberos to authenticate to Active Directory from python ldap

[Michael S. <mi...@st...>]

Olivier Sessink wrote:
> 2009/4/10 Michael Ströder <mi...@st...>:
>> You can bind with SASL/GSSAPI to AD with plain python-ldap provided you
>> obtained a valid TGT with kinit before (just like with command-line tool
>> ldapsearch).
> 
> thanks, that's what I need to know.
> 
> I can't get it to work though..
> 
> ld = ldap.initialize('ldap://foobar')
> sasl = ldap.sasl.gssapi()
> ld.sasl_interactive_bind_s('', sasl)
> ld.search_s('DC=foo,DC=foo', ldap.SCOPE_SUBTREE, '(CN=blabla)', ['Member'])
> 
> ldap.OPERATIONS_ERROR: {'info': '00000000: LdapErr: DSID-0C090627,
> comment: In order to perform this operation a successful bind must be
> completed on the connection., data 0, vece', 'desc': 'Operations
> error'}
> 
> this shell command works:
> 
> ldapsearch -YGSSAPI  -H ldap://foobar -bDC=foo,DC=foo '(CN=blabla)' Member
> 
> I've tried different ldap URL's, but from an ldapsearch strace I'm
> pretty sure I use the right ldap server.

Hmm, this should simply work just like the ldapsearch usage. Since
you're searching from domain level it would be worth to try to
explicitly switch off referral chasing within libldap:

ld = ldap.initialize('ldap://foobar')
ld.set_option(ldap.OPT_REFERRALS,0)

Note that automatic referral chasing within libldap was always using
anonymous bind.

> However, this is on a suse linux enterprise box, which has python-ldap
> 2.0.11. Could it be that this is too old?

Glancing over CHANGES there were no related fixes to SASL but maybe the
default for ldap.OPT_REFERRALS was changed. But you should upgrade
anyway for various reasons...

Ciao, Michael.

Re: Limited the usage of SF services for python-ldap

[charlie d. <cd...@si...>]

Michael Ströder wrote:
> Zhang Huangbin wrote:
>> Try google code project hosting?
>> http://code.google.com/
> 
> Nope!
> 
> I strongly prefer to cooperate with people who are not a big company and
> are personally committed to either directly support Python or OpenLDAP.
> I won't go for an infrastructure like SF anymore where download and
> admin pages are getting more and more complicated with mandantory
> Javascript, banner ads and all this crap. Even if such a service looks
> ok for now, the experience in the past showed that it's getting worse
> after some time.
> 
> I will inform here about the decision taken.
> 
> Ciao, Michael.
> 


Kudos for your clear thinking on this.  In my estimation, you're absolutely choosing the correct path by proceeding this way.

	~c





> ------------------------------------------------------------------------------
> This SF.net email is sponsored by:
> High Quality Requirements in a Collaborative Environment.
> Download a free trial of Rational Requirements Composer Now!
> http://p.sf.net/sfu/www-ibm-com
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev

Re: using Kerberos to authenticate to Active Directory from python ldap

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> Hmm, this should simply work just like the ldapsearch usage.

BTW: If you're using MS AD of W2K8 (not W2K3) you can check whether your
bound with ld.whoami_s() which on W2K8 returns 'u:DOMAIN\SAMACCOUNTNAME'.

Ciao, Michael.

Re: using Kerberos to authenticate to Active Directory from python ldap

[Olivier S. <oli...@gm...>]

2009/4/10 Michael Ströder <mi...@st...>:
> You can bind with SASL/GSSAPI to AD with plain python-ldap provided you
> obtained a valid TGT with kinit before (just like with command-line tool
> ldapsearch).

thanks, that's what I need to know.

I can't get it to work though..

ld = ldap.initialize('ldap://foobar')
sasl = ldap.sasl.gssapi()
ld.sasl_interactive_bind_s('', sasl)
ld.search_s('DC=foo,DC=foo', ldap.SCOPE_SUBTREE, '(CN=blabla)', ['Member'])

ldap.OPERATIONS_ERROR: {'info': '00000000: LdapErr: DSID-0C090627,
comment: In order to perform this operation a successful bind must be
completed on the connection., data 0, vece', 'desc': 'Operations
error'}

this shell command works:

ldapsearch -YGSSAPI  -H ldap://foobar -bDC=foo,DC=foo '(CN=blabla)' Member

I've tried different ldap URL's, but from an ldapsearch strace I'm
pretty sure I use the right ldap server.

However, this is on a suse linux enterprise box, which has python-ldap
2.0.11. Could it be that this is too old?

thanks,
   Olivier

Re: Limited the usage of SF services for python-ldap

[Michael S. <mi...@st...>]

Zhang Huangbin wrote:
> Try google code project hosting?
> http://code.google.com/

Nope!

I strongly prefer to cooperate with people who are not a big company and
are personally committed to either directly support Python or OpenLDAP.
I won't go for an infrastructure like SF anymore where download and
admin pages are getting more and more complicated with mandantory
Javascript, banner ads and all this crap. Even if such a service looks
ok for now, the experience in the past showed that it's getting worse
after some time.

I will inform here about the decision taken.

Ciao, Michael.

New python-ldap home page

[Michael S. <mi...@st...>]

HI!

The web pages of python-ldap were moved to

http://www.python-ldap.org/

Ciao, Michael.

Re: using Kerberos to authenticate to Active Directory from python ldap

[Michael S. <mi...@st...>]

Olivier Sessink wrote:
> 2009/4/10 Geert Jansen <ge...@bo...>:
>> As a related solution, you could have a look at python-ad [1].
>> Python-AD is built on top of python-ldap and provides lots of
>> functionality that you normally need to connect to AD built in. For
>> example, service discovery, credential management and multi-domain
>> functionality. There's a few examples on the site, including how to
>> use Kerberos credentials with AD.
> 
> I noticed that there is some C code related to Kerberos in python-ad.
> Is this code required to initialize a kerberos authentication, or is
> this just to change passwords and things like that?

You can bind with SASL/GSSAPI to AD with plain python-ldap provided you
obtained a valid TGT with kinit before (just like with command-line tool
ldapsearch).

Ciao, Michael.

Re: using Kerberos to authenticate to Active Directory from python ldap

[Olivier S. <oli...@gm...>]

2009/4/10 Geert Jansen <ge...@bo...>:
> As a related solution, you could have a look at python-ad [1].
> Python-AD is built on top of python-ldap and provides lots of
> functionality that you normally need to connect to AD built in. For
> example, service discovery, credential management and multi-domain
> functionality. There's a few examples on the site, including how to
> use Kerberos credentials with AD.

I noticed that there is some C code related to Kerberos in python-ad.
Is this code required to initialize a kerberos authentication, or is
this just to change passwords and things like that?

thanks,

  Olivier

Re: Limited the usage of SF services for python-ldap

[Zhang H. <zhb...@gm...>]

Michael Ströder wrote:
> HI!
>
> Please note that from now on python-ldap releases and docs will not be
> made available trough SF's file release area anymore. SF's new web
> interface is even worse than the old one. The download pages are much
> too complicated for implementing automatic installation.
>
> The web page
> http://python-ldap.sourceforge.net/download.shtml
> already points to:
> http://pypi.python.org/pypi/python-ldap/
>
> I think this is the appropriate place for providing python-ldap
> distribution files. I'd encourage others to upload their Win32 builds or
> whatever there. Let me know if you need access to python-ldap's PyPI entry.
>
> Also the docs are stored directly in the web space:
> http://python-ldap.sourceforge.net/docs.shtml
>
> I also disabled SF services for python-ldap's SF project entry which
> were not used anyway and only spammed ("News" and "Documentation").
>
> More news on that to come.
>
> Ciao, Michael.

Try google code project hosting?
http://code.google.com/


-- 
Best regards.

Zhang Huangbin

- Open Source Mail Server Solution for RHEL/CentOS 5.x:
  http://code.google.com/p/iredmail/

Re: using Kerberos to authenticate to Active Directory from python ldap

[Michael S. <mi...@st...>]

Olivier Sessink wrote:
> 
> So I'm rewriting the script for python. However, I cannot get the 
> kerberos authentication right.
> 
> ld = ldap.initialize('activedirectory-dns')
> ld.sasl_interactive_bind_s('', ldap.sasl.gssapi('user@REALM'))
> ld.search_s(self.base, ldap.SCOPE_SUBTREE, '(CN=groupname)', ['Member'])
> 
> I get an error that I don't have the right credentials.
> 
> However it works with ldapsearch, so the Kerberos ticket is valid and 
> correct for this query..

I cannot see how your parameters are. Note that SASL-Bind with GSSAPI is
quite picky about using the right DNS names.

Especially it should be something like

ld = ldap.initialize('ldap://dc1.dom2.adtest.domain')

with dc1.dom2.adtest.domain being one of the names listed with service
prefix ldap/ in servicePrincipalName on the domain controller.

> Or an example script that uses Kerberos?

Demo/sasl_bind.py

Ciao, Michael.

using Kerberos to authenticate to Active Directory from python ldap

[Olivier S. <oli...@gm...>]

Hi all,

I'm trying to script a function that can retrieve if a user is member of 
a group in active directory. The previous script was a shell script with 
a ldapsearch call for every user. You can image that took long on a 
thousand users.

So I'm rewriting the script for python. However, I cannot get the 
kerberos authentication right.

ld = ldap.initialize('activedirectory-dns')
ld.sasl_interactive_bind_s('', ldap.sasl.gssapi('user@REALM'))
ld.search_s(self.base, ldap.SCOPE_SUBTREE, '(CN=groupname)', ['Member'])

I get an error that I don't have the right credentials.

However it works with ldapsearch, so the Kerberos ticket is valid and 
correct for this query..

Anybody a tip how to continue? Or an example script that uses Kerberos?

thanks,
	Olivier

Limited the usage of SF services for python-ldap

[Michael S. <mi...@st...>]

HI!

Please note that from now on python-ldap releases and docs will not be
made available trough SF's file release area anymore. SF's new web
interface is even worse than the old one. The download pages are much
too complicated for implementing automatic installation.

The web page
http://python-ldap.sourceforge.net/download.shtml
already points to:
http://pypi.python.org/pypi/python-ldap/

I think this is the appropriate place for providing python-ldap
distribution files. I'd encourage others to upload their Win32 builds or
whatever there. Let me know if you need access to python-ldap's PyPI entry.

Also the docs are stored directly in the web space:
http://python-ldap.sourceforge.net/docs.shtml

I also disabled SF services for python-ldap's SF project entry which
were not used anyway and only spammed ("News" and "Documentation").

More news on that to come.

Ciao, Michael.

ANN: python-ldap-2.3.7

[Michael S. <mi...@st...>]

Find a new release of python-ldap:

  http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

Note that the download page has changed recently. You can now find the
source distribution at PyPI:

  http://pypi.python.org/pypi/python-ldap/

Ciao, Michael.

-- 
Michael Ströder
E-Mail: mi...@st...
http://www.stroeder.com

----------------------------------------------------------------
Released 2.3.7 2009-04-09

Changes since 2.3.6:

Lib/
* urllib.quote() is now used in LDAPUrlExtension.unparse() to quote
  all special URL characters in extension values

Modules/
* Fixed ldapcontrol.c not to raise ldap.ENCODING_ERROR in
  function encode_rfc2696() on 64-bit systems
* Fixed seg fault if error code in a LDAP response was outside
  the known error codes and could not be mapped to a specific
  exception class (thanks to Sean)
* errors.c: LDAP_ERROR_MAX set to LDAP_PROXIED_AUTHORIZATION_DENIED
  if available in OpenLDAP header
* new exception class ldap.PROXIED_AUTHORIZATION_DENIED
  if available in OpenLDAP header
* Fixed functions.c not to raise ldap.ENCODING_ERROR in
  function l_ldap_str2dn() on 64-bit systems (see SF#2725356)

----------------------------------------------------------------
Released 2.3.6 2009-02-22

Changes since 2.3.5:

Lib/
* Importing ldap.str2dn() which directly imported _ldap.str2dn()
  is prohibited now (see SF#2181141)

Modules/
* get_option(): Added support for reading more SASL options.
  (OPT_X_SASL_MECH, OPT_X_SASL_REALM, OPT_X_SASL_AUTHCID and
  OPT_X_SASL_AUTHZID)
* Added some explicit type casts to fix issues while building
  with SunStudio
* Fixed compiling issue with GCC 4.4
  (see SF#2555793, thanks to Matej and Martin)

Doc/
* Clarified not to use ldap_get_dn() directly
* Fixed description of ldap.SASL_AVAIL and ldap.TLS_AVAIL
  (see SF#2555804, thanks to Matej and Martin)

Re: tarball vs. download URL

[Waldemar O. <wal...@gm...>]

2009/4/7 Michael Ströder <mi...@st...>:
> Jens Vagelpohl wrote:
>>
>> Personally, I haven't had the need to search for a service that offers
>> something like SF, including version control and bug tracking. I
>> either use my own systems, or those used by the Zope developer
>> community.
>
> I tend to either ask the folks at python.org what they could provide or
> set up a separate thing. Another option I'd like would be to ask the
> OpenLDAP project to host python-ldap. At the moment there are not many
> contributions by other developers so I'd keep things simple anyway.
>
>> One candidate you could look at, if you have a minute, is Launchpad.
>> They have all kinds of nice services, but there's one big drawback:
>> They force you onto their own VCS (bzr).
>
> That's a show-stopper. I don't a want proprietary VCS.

FYI.
Bazaar [http://bazaar-vcs.org/] is not a proprietary.
It is licensed under GPL-2 and coded in Python, same as Mercurial.
It's usage is dictated by the service, similar to others:
Launchpad -> bzr
Google -> svn
BitBucket -> hg
GitHub -> git

Waldemar

Re: tarball vs. download URL

[Sidnei da S. <si...@en...>]

2009/4/7 Michael Ströder <mi...@st...>:
>> One candidate you could look at, if you have a minute, is Launchpad.
>> They have all kinds of nice services, but there's one big drawback:
>> They force you onto their own VCS (bzr).
>
> That's a show-stopper. I don't a want proprietary VCS.

bzr is not proprietary. It's a GNU project.

-- 
Sidnei da Silva

Re: tarball vs. download URL

[Jens V. <je...@da...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 7, 2009, at 18:38 , Sidnei da Silva wrote:

> On Tue, Apr 7, 2009 at 1:28 PM, Jens Vagelpohl <je...@da...>  
> wrote:
>> Personally, I haven't had the need to search for a service that  
>> offers
>> something like SF, including version control and bug tracking. I
>> either use my own systems, or those used by the Zope developer
>> community.
>>
>> One candidate you could look at, if you have a minute, is Launchpad.
>> They have all kinds of nice services, but there's one big drawback:
>> They force you onto their own VCS (bzr). I have not looked at any
>> other sites like Google Code.
>
> That's not true. You are not required to use bzr, you can easily host
> your code somewhere. When setting up a project you have the option to
> specify a CVS or Subversion repo URL. Regular code imports from CVS
> and SVN are supported too, and many Zope projects are being mirrored
> in Launchpad's Code Hosting. Soon git  will be supported for code
> mirroring too.

Code mirroring != code repository. I was listing examples which offer  
both code hosting and additional services. Separating it up doesn't  
seem desirable unless there's no other solution.

jens



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)

iEYEARECAAYFAknbiU0ACgkQRAx5nvEhZLKQdwCguFMIv5PBNV/wZXYRTugYUMXa
lXQAn0sArkZlf/AttshRVT5bFiNPPkSI
=U2ds
-----END PGP SIGNATURE-----

Re: tarball vs. download URL

[Michael S. <mi...@st...>]

Jens Vagelpohl wrote:
> 
> On Apr 7, 2009, at 19:03 , Michael Ströder wrote:
> 
>> Jens Vagelpohl wrote:
>>> One candidate you could look at, if you have a minute, is Launchpad.
>>> They have all kinds of nice services, but there's one big drawback:
>>> They force you onto their own VCS (bzr).
>> That's a show-stopper. I don't a want proprietary VCS.
> 
>>> I have not looked at any other sites like Google Code.
>> I don't like to put things on Google either.
> 
> I fully agree on both points, I was just trying to list alternatives ;-)

Thanks for raising the alternatives so we can preclude quickly them
without further investigation.. ;-)

Ciao, Michael.

Re: tarball vs. download URL

[Jens V. <je...@da...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 7, 2009, at 19:03 , Michael Ströder wrote:

> Jens Vagelpohl wrote:
>> One candidate you could look at, if you have a minute, is Launchpad.
>> They have all kinds of nice services, but there's one big drawback:
>> They force you onto their own VCS (bzr).
>
> That's a show-stopper. I don't a want proprietary VCS.
>
>> I have not looked at any other sites like Google Code.
>
> I don't like to put things on Google either.

I fully agree on both points, I was just trying to list alternatives ;-)

jens


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)

iEYEARECAAYFAknbiBoACgkQRAx5nvEhZLJ8DgCgsm1fpYE7qXKzQ5uNnWhaFbi2
tTkAoKfisB74dNswnmQHYYJI0ZsIu+Qo
=Xzo9
-----END PGP SIGNATURE-----

Re: tarball vs. download URL

[Michael S. <mi...@st...>]

Jens Vagelpohl wrote:
> 
> Personally, I haven't had the need to search for a service that offers  
> something like SF, including version control and bug tracking. I  
> either use my own systems, or those used by the Zope developer  
> community.

I tend to either ask the folks at python.org what they could provide or
set up a separate thing. Another option I'd like would be to ask the
OpenLDAP project to host python-ldap. At the moment there are not many
contributions by other developers so I'd keep things simple anyway.

> One candidate you could look at, if you have a minute, is Launchpad.  
> They have all kinds of nice services, but there's one big drawback:  
> They force you onto their own VCS (bzr).

That's a show-stopper. I don't a want proprietary VCS.

> I have not looked at any other sites like Google Code.

I don't like to put things on Google either.

Ciao, Michael.

Please test CVS HEAD on 64-bit platforms

[Michael S. <mi...@st...>]

Given another one of this famous Integer type errors [1] I'd like to
encourage everyone to test python-ldap HEAD on 64-bit platforms.

I'd also appreciate if people with more C knowledge could review the
patches:

http://python-ldap.cvs.sourceforge.net/viewvc/python-ldap/python-ldap/Modules/functions.c?r1=1.21&r2=1.22

http://python-ldap.cvs.sourceforge.net/viewvc/python-ldap/python-ldap/Modules/ldapcontrol.c?view=log

We don't have a test suite though...

Hmm, maybe you could play with web2ldap which at least makes use of a
lot of functions within python-ldap.

Ciao, Michael.

[1]
https://sourceforge.net/tracker/?func=detail&aid=2725356&group_id=2072&atid=102072

Re: tarball vs. download URL

[Sidnei da S. <sid...@gm...>]

On Tue, Apr 7, 2009 at 1:28 PM, Jens Vagelpohl <je...@da...> wrote:
> Personally, I haven't had the need to search for a service that offers
> something like SF, including version control and bug tracking. I
> either use my own systems, or those used by the Zope developer
> community.
>
> One candidate you could look at, if you have a minute, is Launchpad.
> They have all kinds of nice services, but there's one big drawback:
> They force you onto their own VCS (bzr). I have not looked at any
> other sites like Google Code.

That's not true. You are not required to use bzr, you can easily host
your code somewhere. When setting up a project you have the option to
specify a CVS or Subversion repo URL. Regular code imports from CVS
and SVN are supported too, and many Zope projects are being mirrored
in Launchpad's Code Hosting. Soon git  will be supported for code
mirroring too.

-- 
Sidnei da Silva
Canonical Ltd.
 Landscape · Changing the way you manage your systems
http://landscape.canonical.com

Re: tarball vs. download URL

[Jens V. <je...@da...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 7, 2009, at 15:43 , Michael Ströder wrote:

> Jens Vagelpohl wrote:
>>
>> On Apr 7, 2009, at 13:48 , Michael Ströder wrote:
>>
>>> Does that look correct to you?
>>> http://pypi.python.org/pypi/python-ldap/2.3.6
>>
>> Yes, that's great, thanks a lot! :-)
>
> And please remind me to do it for newer releases if I forgot it... ;-)
>
> Anyway in the long run python-ldap should move away from SF anyway.  
> The
> new web UI is even worse...

Yes, absolutely. I can't stand SF.

Personally, I haven't had the need to search for a service that offers  
something like SF, including version control and bug tracking. I  
either use my own systems, or those used by the Zope developer  
community.

One candidate you could look at, if you have a minute, is Launchpad.  
They have all kinds of nice services, but there's one big drawback:  
They force you onto their own VCS (bzr). I have not looked at any  
other sites like Google Code.

jens


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)

iEYEARECAAYFAknbfzAACgkQRAx5nvEhZLI5WgCfalzCItnqlPZhy/dDxRtAEIZT
JXgAoJIrV3yiU6ukU91yL/Cjqpq7lE+U
=A/R8
-----END PGP SIGNATURE-----