pyGoEdge-UserPanel/.venv/Lib/site-packages/dns/__pycache__/dnssec.cpython-312.pyc

<EFBFBD>
g<>
i<><69><00><00><00>dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlmZ
d
dlm	Z	m
Z
mZmZm
Z
mZmZ
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dlmZmZmZ
d
dlm Z 
d
dlm!Z!m"Z"m#Z#
d
dl$m%Z%
d
d	l&m'Z'
d
d
l(m)Z)
d
dl*m+Z+
d
dl,m-Z-m.Z.
d
d
l/m0Z0
d
dl1m2Z2m3Z3
d
dl4m5Z5
edZ6edZ7e	ejpjrejtjvgdfZ<de=defd<14>Z>dee?zde=fd<16>Z@dee=zeAze?zde?fd<17>ZBde)e%zde?fd<19>ZCGd<1A>d<1B>ZDGd<1C>deD<65>ZEeEej<>ej<>ej<>ej<>hej<>ej<>ej<>hej<>ej<>ej<>hej<>h
<01>ZMeEeN<65>eN<65>eN<65>eN<65><00>ZOeMZP			dadej<>j<>e=zdej<>j<>d ee=zd!ej<>j<>dzd"eDdzd#eUde+fd$<24>ZV	dbdej<>j<>e=zdej<>j<>d ee=zd!ej<>j<>dzde'f
d%<25>ZWd&e
ej<>j<>ej<>j<>ej<>j<>zfd'e2dee)dzfd(<28>Z\d)ejtjve
ej<>j<>ej<>j<>fzde
ej<>j<>ej<>j<>ffd*<2A>Z]d+e^d,e^de)ddfd-<2D>Z_			dcd)ejtjve
ej<>j<>ej<>j<>fzd'e2d&e
ej<>j<>ej<>j<>ej<>j<>zfd!ej<>j<>dzd.eAdzd"eDdzddfd/<2F>Z`			dcd)ejtjve
ej<>j<>ej<>j<>fzd0ejtjve
ej<>j<>ej<>j<>fzd&e
ej<>j<>ej<>j<>ej<>j<>zfd!ej<>j<>dzd.eAdzd"eDdzddfd1<64>Za							ddd)ejtjve
ej<>j<>ej<>j<>fzd3e7d4ej<>j<>d5e)d6ee=ze?zeAzdzd7ee=ze?zeAzdzd8e?dzd9eUd"eDdzd!ej<>j<>dzd:eUde2fd;<3B>Zb	dbd)ejtjve
ej<>j<>ej<>j<>fzd'e2d!ej<>j<>dzde^fd<<3C>Zce5j<35>d=fd>e6d e?e=zd?e?d@e?de)f
dA<EFBFBD>Zee5j<35>d=fd>e6d e?e=zd?e?d@e?de%f
dB<EFBFBD>ZfdCej<>j<>e=zdDe=e^zdzdEe?d e?e=zde=f
dF<EFBFBD>Zg	dbd)ejtjve
ej<>j<>ej<>j<>fzdGeee=zd!ej<>j<>dzdej<>j<>fdH<64>ZhdIej<>j<>dej<>j<>fdJ<64>Zi	dbdej<>j<>e=zdIej<>j<>d ee=zd!ej<>j<>dzdej<>j<>f
dK<EFBFBD>ZjdIej<>j<>dej<>j<>fdL<64>Zk						dedMejpjrd)ejtjvd4ej<>j<>dNee
e7e)fdOee
e7e)fd6ee=ze?zeAzdzd7ee=ze?zeAzdzd8e?dzd"eDdzd!ej<>j<>dzd:eUddfdP<64>Zl											dfdQej<>j<>dMejpjrdzd&ee
e7e)fdzdReUdSe?dzd6ee=ze?zeAzdzd7ee=ze?zeAzdzd8e?dzdTe0dzdUe<dzd"eDdzd:eUddfdV<64>Zo	dbdQej<>j<>dMejpjrdUe<dzddfdW<64>ZpdX<64>Zqej<>j<>dY<64>
r;d
dZltmuZu
d
d[lvmwZw
d
d\lvmxZx
d
d]lvmyZy
d
d^lvmzZz
d
d_l{m|Z|m}Z}
d
d`l~mZm<7F>Z<EFBFBD>
eaZ<61>e`Z<>ebZ<62>eeZ<65>efZ<66>d2Z<32>neqZ<71>eqZ<71>eqZ<71>eqZ<71>eqZ<71>dZ<>ej<>ZFe<1C>
jZ<>ej<>ZGe<1C>
jZ<>e<1C>
jZ<>ej<>ZHe<1C>
jZ<>e<1C>
jZ<>e<1C>
jZ<>ej<>ZIe<1C>
jZ<>e<1C>
jZ<>e<1C>
jZ<>e<1C>
j Z<>e<1C>
j"Z<>e<1C>
j$Z<>e<1C>
j&Z<>y)gz.Common DNSSEC-related functions and constants.<2E>N)
<01>datetime)<07>Callable<6C>Dict<63>List<73>Set<65>Tuple<6C>Union<6F>cast)<03>	Algorithm<68>DSDigest<73>	NSEC3Hash)
<01>AlgorithmKeyMismatch)<03>DeniedByPolicy<63>UnsupportedAlgorithm<68>ValidationFailure)
<01>CDNSKEY)
<01>CDS)
<01>DNSKEY)
<01>DS)<02>NSEC<45>Bitmap)
<01>
NSEC3PARAM)<02>RRSIG<49>sigtime_to_posixtime)
<01>Flag)<05>GenericPublicKeyzrsa.RSAPublicKeyzec.EllipticCurvePublicKeyzed25519.Ed25519PublicKeyzed448.Ed448PublicKey)<05>GenericPrivateKeyzrsa.RSAPrivateKeyzec.EllipticCurvePrivateKeyzed25519.Ed25519PrivateKeyzed448.Ed448PrivateKey<65>text<78>returnc
<00>,<00>t
j|<00>
S)
z<>Convert text into a DNSSEC algorithm value.

    *text*, a ``str``, the text to convert to into an algorithm value.

    Returns an ``int``.
    )r<00>	from_text)
rs
 <20>9E:\Project\pygoedge\.venv\Lib\site-packages\dns/dnssec.py<70>algorithm_from_textr#Hs<00><00><15><1E><1E>t<EFBFBD>$<24>$<24><00>valuec
<00>,<00>t
j|<00>
S)
z<>Convert a DNSSEC algorithm value to text

    *value*, a ``dns.dnssec.Algorithm``.

    Returns a ``str``, the name of a DNSSEC algorithm.
    )r<00>to_text<78>
r%s
 r"<00>algorithm_to_textr)Ss<00><00><15><1C><1C>U<EFBFBD>#<23>#r$c
<00><><00>t
|t<00>rt|j<00><00>
St
|t<00>rt|<00>
St
|t<00>rt|<00>
St
|t<00>r|Std
<01>
<00>
)z%Convert various format to a timestampzUnsupported timestamp type)<08>
isinstancer<00>int<6E>	timestamp<6D>strr<00>float<61>	TypeErrorr(s
 r"<00>to_timestampr1^sb<00><00><11>%<25><18>"<22><12>5<EFBFBD>?<3F>?<3F>$<24>%<25>%<25>	<13>E<EFBFBD>3<EFBFBD>	<1F>#<23>E<EFBFBD>*<2A>*<2A>	<13>E<EFBFBD>5<EFBFBD>	!<21><12>5<EFBFBD>z<EFBFBD><19>	<13>E<EFBFBD>3<EFBFBD>	<1F><14><0C><17>4<>5<>5r$<00>keyc
<00>`
<00>|j
<00>}
|
<01>J<00>
|jtjk(r|
d
dz|
dzSd}t	t|
<01>
dz<00>
D]}||
d|zdz|
d|zdzzz
}<02>t|
<01>
dzdk7r||
t|
<01>
dz
dzz
}||dz	dz
z
}|dz
S)	z<>Return the key id (a 16-bit number) for the specified key.

    *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY``

    Returns an ``int`` between 0 and 65535
    <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>r<00><00>
<00>i<><69>)<06>to_wire<72>	algorithmr<00>RSAMD5<44>range<67>len)r2<00>rdata<74>total<61>
is    r"<00>key_idrBls<><00><00>
<10>K<EFBFBD>K<EFBFBD>M<EFBFBD>E<EFBFBD><10><1C><1C><1C>
<EFBFBD>}<7D>}<7D>	<09>(<28>(<28>(<28><15>b<EFBFBD>	<09>Q<EFBFBD><0E>%<25><02>)<29>+<2B>+<2B><11><05><16>s<EFBFBD>5<EFBFBD>z<EFBFBD>Q<EFBFBD><EFBFBD>'<27>A<EFBFBD><11>e<EFBFBD>A<EFBFBD>
<01>E<EFBFBD>l<EFBFBD>a<EFBFBD>'<27>5<EFBFBD><11>Q<EFBFBD><15><11><19>+;<3B>;<3B>;<3B>E<EFBFBD>(<28><0E>u<EFBFBD>:<3A>
<01>><3E>Q<EFBFBD><1E><11>U<EFBFBD>3<EFBFBD>u<EFBFBD>:<3A>
<01>><3E>*<2A>a<EFBFBD>/<2F>/<2F>E<EFBFBD>
<0A>%<25>2<EFBFBD>+<2B><16>'<27>'<27><05><14>v<EFBFBD>~<7E>r$c<00>R<00>eZ
dZd
<01>Zdedefd<04>Zdedefd<05>Zdedefd<07>Z	dedefd<08>Z
y	)
<EFBFBD>Policyc
<00><00>y<00>
N<>)
<01>selfs
 r"<00>__init__zPolicy.__init__<5F>s<00><00>r$r2rc<00><00>y
<01>NFrG<00>rHr2s  r"<00>
ok_to_signzPolicy.ok_to_sign<67><00><00><00>r$c<00><00>y
rKrGrLs  r"<00>ok_to_validatezPolicy.ok_to_validate<74>rNr$r;c<00><00>y
rKrG<00>rHr;s  r"<00>ok_to_create_dszPolicy.ok_to_create_ds<64>rNr$c<00><00>y
rKrGrRs  r"<00>ok_to_validate_dszPolicy.ok_to_validate_ds<64>rNr$N)<0B>__name__<5F>
__module__<EFBFBD>__qualname__rIr<00>boolrMrPrrSrUrGr$r"rDrD<00>sS<00><00>

<0A>
<15>f<EFBFBD>
<15><14>
<15>
<15>&<26>
<15>T<EFBFBD>
<15>
<15><18>
<15>d<EFBFBD>
<15>
<15>8<EFBFBD>
<15><04>
r$rDc<00>^<00><00>eZ
dZ<02>f
d
<01>Zdedefd<04>Zdedefd<05>Zdedefd<07>Z	dedefd<08>Z
<EFBFBD>x
ZS)	<09>
SimpleDenyc<00>Z<00>
<01>t<00>|<00><00>
|
|_||_||_||_yrF)<06>superrI<00>
_deny_sign<EFBFBD>_deny_validate<74>_deny_create_ds<64>_deny_validate_ds)rH<00>	deny_sign<67>
deny_validate<74>deny_create_ds<64>deny_validate_ds<64>	__class__s     <20>r"rIzSimpleDeny.__init__<5F>s-<00><><00>
<0A><07><18><1A>#<23><04><0F>+<2B><04><1B>-<2D><04><1C>!1<><04>r$r2rc<00>2<00>|
j|jv
SrF)r;r^rLs  r"rMzSimpleDeny.ok_to_sign<67>s<00><00><12>}<7D>}<7D>D<EFBFBD>O<EFBFBD>O<EFBFBD>3<>3r$c<00>2<00>|
j|jv
SrF)r;r_rLs  r"rPzSimpleDeny.ok_to_validate<74>s<00><00><12>}<7D>}<7D>D<EFBFBD>$7<>$7<>7<>7r$r;c<00><00>|
|jv
SrF)
r`rRs  r"rSzSimpleDeny.ok_to_create_ds<64>s<00><00><18><04> 4<> 4<>4<>4r$c<00><00>|
|jv
SrF)
rarRs  r"rUzSimpleDeny.ok_to_validate_ds<64>s<00><00><18><04> 6<> 6<>6<>6r$)rVrWrXrIrrYrMrPrrSrU<00>
__classcell__)
rfs
@r"r[r[<00>sT<00><><00>2<>
4<>f<EFBFBD>
4<><14>
4<>
8<>&<26>
8<>T<EFBFBD>
8<>
5<><18>
5<>d<EFBFBD>
5<>
7<>8<EFBFBD>
7<><04>
7r$r[F<>namer;<00>origin<69>policy<63>
validatingc	<00><><00>|<04>t}	t|t<00>rt|j	<00>}|r
|j}n|j}||<02>
st<00>
t|
ttz<00>std<03>
<00>
|tjk(rtj<00>}n_|tj k(rtj"<00>}n7|tj$k(rtj&<00>}nt
d
|<02>d<02><03>
<00>
t|t<00>r t(j*j-||<03>}|j/<00>j1<00>}|
j1|<03><04>
}	|<08>|	<09>J<00>
|j3|<08>

|j3|	<09>

|j5<00>}
t7j8dt;|
<01>
|
j<|<02>|
z}t(j>jAt(jBjDt(jFjH|dtK|<0B>
<00>}tMtH|<0C>S#t
$r
t
d
|<02>d<02><03>
<00>
wxYw
)a<>Create a DS record for a DNSSEC key.

    *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record.

    *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``,
    the key the DS is about.

    *algorithm*, a ``str`` or ``int`` specifying the hash algorithm.
    The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
    does not matter for these strings.

    *origin*, a ``dns.name.Name`` or ``None``.  If *key* is a relative name,
    then it will be made absolute using the specified origin.

    *policy*, a ``dns.dnssec.Policy`` or ``None``.  If ``None``, the default policy,
    ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.

    *validating*, a ``bool``.  If ``True``, then policy is checked in
    validating mode, i.e. "Is it ok to validate using this digest algorithm?".
    Otherwise the policy is checked in creating mode, i.e. "Is it ok to create a DS with
    this digest algorithm?".

    Raises ``UnsupportedAlgorithm`` if the algorithm is unknown.

    Raises ``DeniedByPolicy`` if the algorithm is denied by policy.

    Returns a ``dns.rdtypes.ANY.DS.DS``
    <20>unsupported algorithm "<22>
"zkey is not a DNSKEY | CDNSKEY<45>
rmz!HBBr)'<27>default_policyr+r.r<00>upper<65>	ExceptionrrUrSrrr<00>
ValueError<EFBFBD>SHA1<41>hashlib<69>sha1<61>SHA256<35>sha256<35>SHA384<38>sha384<38>dnsrlr!<00>canonicalizer:<00>update<74>digest<73>struct<63>packrBr;r?<00>	from_wire<72>
rdataclass<EFBFBD>IN<49>	rdatatyperr>r
)
rlr2r;rmrnro<00>check<63>dshash<73>wire<72>kwirer<65><00>dsrdata<74>dss
             r"<00>make_dsr<73><00>s<>
<00><00>J
<0E>~<7E><1F><06>K
<01><15>i<EFBFBD><13>%<25> <20><19><1F><1F>!2<>3<>I<EFBFBD><12><16>(<28>(<28><05><16>&<26>&<26><05><10><19><1B><1C><1C><15>c<EFBFBD>6<EFBFBD>G<EFBFBD>+<2B>,<2C><18>8<>9<>9<><10>H<EFBFBD>M<EFBFBD>M<EFBFBD>!<21><18><1C><1C><1E><06>	<12>h<EFBFBD>o<EFBFBD>o<EFBFBD>	%<25><18><1E><1E>!<21><06>	<12>h<EFBFBD>o<EFBFBD>o<EFBFBD>	%<25><18><1E><1E>!<21><06>"<22>%<<3C>Y<EFBFBD>K<EFBFBD>q<EFBFBD>#I<>J<>J<><11>$<24><03><1C><12>x<EFBFBD>x<EFBFBD>!<21>!<21>$<24><06>/<2F><04><0F><1C><1C><1E>&<26>&<26>(<28>D<EFBFBD><0F>K<EFBFBD>K<EFBFBD>v<EFBFBD>K<EFBFBD>&<26>E<EFBFBD><0F><1B><05> 1<>1<>1<>
<EFBFBD>M<EFBFBD>M<EFBFBD>$<24><17>
<EFBFBD>M<EFBFBD>M<EFBFBD>%<25><18>
<13>]<5D>]<5D>_<EFBFBD>F<EFBFBD><14>k<EFBFBD>k<EFBFBD>&<26>&<26><13>+<2B>s<EFBFBD>}<7D>}<7D>i<EFBFBD>H<>6<EFBFBD>Q<>G<EFBFBD>	<0C><19><19>	<1C>	<1C><0B><0E><0E><19><19>3<EFBFBD>=<3D>=<3D>+<2B>+<2B>W<EFBFBD>a<EFBFBD><13>W<EFBFBD><1C>
<06>B<EFBFBD><10><02>B<EFBFBD><<3C><17><>A
<15>
K
<01>"<22>%<<3C>Y<EFBFBD>K<EFBFBD>q<EFBFBD>#I<>J<>J<>
K
<01>s<00>'H5<00>5Ic<00><><00>t
||
||<03>}t|jtjj|j
|j|j|j<00>
<01>S)a<>Create a CDS record for a DNSSEC key.

    *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record.

    *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``,
    the key the DS is about.

    *algorithm*, a ``str`` or ``int`` specifying the hash algorithm.
    The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
    does not matter for these strings.

    *origin*, a ``dns.name.Name`` or ``None``.  If *key* is a relative name,
    then it will be made absolute using the specified origin.

    Raises ``UnsupportedAlgorithm`` if the algorithm is unknown.

    Returns a ``dns.rdtypes.ANY.DS.CDS``
    <20><06>rdclass<73>rdtype<70>key_tagr;<00>digest_typer<65>)	r<>rr<>rr<>r<>r;r<>r<>)rlr2r;rmr<>s     r"<00>make_cdsr<73>
sQ<00><00>2
<11><14>s<EFBFBD>I<EFBFBD>v<EFBFBD>	.<2E>B<EFBFBD><0E><12>
<EFBFBD>
<EFBFBD><12>}<7D>}<7D> <20> <20><12>
<EFBFBD>
<EFBFBD><14>,<2C>,<2C><16>N<EFBFBD>N<EFBFBD><11>y<EFBFBD>y<EFBFBD>
<06>r$<00>keys<79>rrsigc<00>2<00>|j
|
j<00>
}t|tjj
<00>rC|j
tjjtjj<00>}n|}|<03>
y|D<00>cgc]<5D>}|j|
jk(ret|<04>
|
jk(rM|jtj z
tj k(r|j"d
k(rt%t|<04><00><02><>c}Sc
c}w)N<>)<13>get<65>signerr+r<00>node<64>Node<64>get_rdatasetr<74>r<>r<>rr;rBr<><00>flagsr<00>ZONE<4E>protocolr
)r<>r<>r%<00>rdataset<65>rds     r"<00>_find_candidate_keysr<73>&
s<><00><00>
<11>H<EFBFBD>H<EFBFBD>U<EFBFBD>\<5C>\<5C>"<22>E<EFBFBD><11>%<25><13><18><18><1D><1D>'<27><18>%<25>%<25>c<EFBFBD>n<EFBFBD>n<EFBFBD>&7<>&7<><13><1D><1D>9M<39>9M<39>N<><08><18><08><0F><17><13><1B><06><1A>B<EFBFBD>
<0A><<3C><<3C>5<EFBFBD>?<3F>?<3F>*<2A><12>2<EFBFBD>J<EFBFBD>%<25>-<2D>-<2D>'<27>
<0F>X<EFBFBD>X<EFBFBD><04>	<09>	<09>
!<21>d<EFBFBD>i<EFBFBD>i<EFBFBD>/<2F><0E>K<EFBFBD>K<EFBFBD>1<EFBFBD><1C>	
<0A>V<EFBFBD>R<EFBFBD><18><1A><06><06><>s<00>BD<04>rrsetc
<00>R<00>t
|t<00>r
|d
|dfS|j|fS)Nrr8)r+<00>tuplerl)
r<>s
 r"<00>_get_rrname_rdatasetr<74>:
s0<00><00><12>%<25><15><1F><14>Q<EFBFBD>x<EFBFBD><15>q<EFBFBD><18>!<21>!<21><14>z<EFBFBD>z<EFBFBD>5<EFBFBD> <20> r$<00>sig<69>datac<00><><00>t
|<02>
j}	|j|<02>
}|j||
<01>
y#t$r
t	d
<01>
<00>
wxYw
)Nzinvalid public key)<06>get_algorithm_cls_from_dnskey<65>
public_cls<EFBFBD>from_dnskeyrwr<00>verify)r<>r<>r2r<><00>
public_keys     r"<00>_validate_signaturer<65>C
sV<00><00>.<2E>s<EFBFBD>3<>><3E>><3E>J<EFBFBD>6<><1F>+<2B>+<2B>C<EFBFBD>0<>
<EFBFBD><0F><15><15>c<EFBFBD>4<EFBFBD> <20><><16>
6<><1F> 4<>5<>5<>
6<>s	<00>;<00>A<03>nowc<00><>
<00>|<05>t}t||
<01>}|<06>td<02>
<00>
|<04>tj<00>}|
j|krtd<03>
<00>
|
j
|kDrtd<04>
<00>
t
||
|<03>}|D]-}|j|<08>
s
<01>	t|
j||<08>

y
td<05>
<00>
#ttf$r
Y<00>LwxYw
)a<>Validate an RRset against a single signature rdata, throwing an
    exception if validation is not successful.

    *rrset*, the RRset to validate.  This can be a
    ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
    tuple.

    *rrsig*, a ``dns.rdata.Rdata``, the signature to validate.

    *keys*, the key dictionary, used to find the DNSKEY associated
    with a given name.  The dictionary is keyed by a
    ``dns.name.Name``, and has ``dns.node.Node`` or
    ``dns.rdataset.Rdataset`` values.

    *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative
    names.

    *now*, a ``float`` or ``None``, the time, in seconds since the epoch, to
    use as the current time when validating.  If ``None``, the actual current
    time is used.

    *policy*, a ``dns.dnssec.Policy`` or ``None``.  If ``None``, the default policy,
    ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.

    Raises ``ValidationFailure`` if the signature is expired, not yet valid,
    the public key is invalid, the algorithm is unknown, the verification
    fails, etc.

    Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by
    dnspython but not implemented.
    Nzunknown key<65>expiredz
not yet validzverify failure)rtr<>r<00>time<6D>
expiration<EFBFBD>	inception<6F>_make_rrsig_signature_datarPr<><00>	signature<72>InvalidSignature)	r<>r<>r<>rmr<>rn<00>candidate_keysr<73><00>
candidate_keys	         r"<00>_validate_rrsigr<67>M
s<><00><00>P
<0E>~<7E><1F><06>)<29>$<24><05>6<>N<EFBFBD><15><1D><1F>
<0A>.<2E>.<2E>
<EFBFBD>{<7B><12>i<EFBFBD>i<EFBFBD>k<EFBFBD><03><0C><17><17>#<23><1D><1F>	<09>*<2A>*<2A><0C><EFBFBD><EFBFBD><13><1C><1F><0F>0<>0<>%<25>e<EFBFBD>U<EFBFBD>F<EFBFBD>;<3B>D<EFBFBD>(<28>
<0A><15>$<24>$<24>]<5D>3<><14>	<15><1F><05><0F><0F><14>}<7D>E<><12>(<28><1C>,<2C>
-<2D>-<2D><>	!<21>"3<>4<>	<15><14>	<15>s<00>B6<02>6C<05>
C<05>rrsigsetc	<00>D<00>|<05>t}t|t<00>r8tjj|tjj<00>}t|t<00>r|d}n|j}t|
t<00>r|
d}|
d}n|
j}|
}|j|<03>
}|j|<03>
}||k7rtd<04>
<00>
|D]/}	t|	t<00>std<05>
<00>
	t||	||||<05>

y
td<06>
<00>
#ttf$r
Y<00>NwxYw
)a<>Validate an RRset against a signature RRset, throwing an exception
    if none of the signatures validate.

    *rrset*, the RRset to validate.  This can be a
    ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
    tuple.

    *rrsigset*, the signature RRset.  This can be a
    ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
    tuple.

    *keys*, the key dictionary, used to find the DNSKEY associated
    with a given name.  The dictionary is keyed by a
    ``dns.name.Name``, and has ``dns.node.Node`` or
    ``dns.rdataset.Rdataset`` values.

    *origin*, a ``dns.name.Name``, the origin to use for relative names;
    defaults to None.

    *now*, an ``int`` or ``None``, the time, in seconds since the epoch, to
    use as the current time when validating.  If ``None``, the actual current
    time is used.

    *policy*, a ``dns.dnssec.Policy`` or ``None``.  If ``None``, the default policy,
    ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.

    Raises ``ValidationFailure`` if the signature is expired, not yet valid,
    the public key is invalid, the algorithm is unknown, the verification
    fails, etc.
    Nrr8zowner names do not matchzexpected an RRSIGzno RRSIGs validated)
rtr+r.rrlr!<00>rootr<74><00>choose_relativityrrr<>r)
r<EFBFBD>r<>r<>rmr<>rn<00>rrname<6D>	rrsigname<6D>
rrsigrdatasetr<74>s
          r"<00>	_validater<65><00>
s
<00><00>N
<0E>~<7E><1F><06><11>&<26>#<23><1E><14><18><18>#<23>#<23>F<EFBFBD>C<EFBFBD>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>:<3A><06><11>%<25><15><1F><16>q<EFBFBD><18><06><16><1A><1A><06><11>(<28>E<EFBFBD>"<22><1C>Q<EFBFBD>K<EFBFBD>	<09> <20><11><0B>
<0A><1C>M<EFBFBD>M<EFBFBD>	<09> <20>
<0A>
<13>
%<25>
%<25>f<EFBFBD>
-<2D>F<EFBFBD><19>+<2B>+<2B>F<EFBFBD>3<>I<EFBFBD>
<0A><19><1A><1F> :<3A>;<3B>;<3B><1E><05><19>%<25><15>'<27>#<23>$7<>8<>8<>	<11><1B>E<EFBFBD>5<EFBFBD>$<24><06><03>V<EFBFBD>D<><12><1F><1C>1<>
2<EFBFBD>2<><32>"<22>#7<>8<>
	<11><10>
	<11>s<00>/D
<02>
D<05>
DT<>private_keyr<79><00>dnskeyr<79>r<><00>lifetimer<65><00>
deterministicc
<00><><00>|<08>t}|j|<03>
st<00>
t|t<00>r3|d
j
}|d
j}|d}
|d
j}n0|j
}|j}|j}
|j}|<04>t|<04>
}nttj<00><00>
}|<05>t|<05>
}n|<06>||z}ntd<03>
<00>
|	<09>|
j|	<09>
}
t|
<0A>
d
z
}|
j<00>r|d
z}t!|t"j$j ||j&||||t)|<03>
|d<04><05>}t+|||	<09>}t|
t,<00>r|
}n	t/|<03>
}||
<01><06>
}|j5|||
<EFBFBD>}t7t |j9|<16><08>
<00>S#t0$r
t3d<07>
<00>
wxYw
)	aESign RRset using private key.

    *rrset*, the RRset to validate.  This can be a
    ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
    tuple.

    *private_key*, the private key to use for signing, a
    ``cryptography.hazmat.primitives.asymmetric`` private key class applicable
    for DNSSEC.

    *signer*, a ``dns.name.Name``, the Signer's name.

    *dnskey*, a ``DNSKEY`` matching ``private_key``.

    *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the
    signature inception time.  If ``None``, the current time is used.  If a ``str``, the
    format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX
    epoch in text form; this is the same the RRSIG rdata's text form.
    Values of type `int` or `float` are interpreted as seconds since the UNIX epoch.

    *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature
    expiration time.  If ``None``, the expiration time will be the inception time plus
    the value of the *lifetime* parameter.  See the description of *inception* above
    for how the various parameter types are interpreted.

    *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds.  This
    parameter is only meaningful if *expiration* is ``None``.

    *verify*, a ``bool``.  If set to ``True``, the signer will verify signatures
    after they are created; the default is ``False``.

    *policy*, a ``dns.dnssec.Policy`` or ``None``.  If ``None``, the default policy,
    ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.

    *origin*, a ``dns.name.Name`` or ``None``.  If ``None``, the default, then all
    names in the rrset (including its owner name) must be absolute; otherwise the
    specified origin will be used to make names absolute when signing.

    *deterministic*, a ``bool``. If ``True``, the default, use deterministic
    (reproducible) signatures when supported by the algorithm used for signing.
    Currently, this only affects ECDSA.

    Raises ``DeniedByPolicy`` if the signature is denied by policy.
    r8rz(expiration or lifetime must be specifiedr$)r<>r<><00>type_coveredr;<00>labels<6C>original_ttlr<6C>r<>r<>r<>r<><00>
r2zUnsupported key algorithm)
r<>)rtrMrr+r<>r<>r<><00>ttlrlr1r,r<>rw<00>derelativizer><00>is_wildrrr<>r;rBr<>rr<>rr0<00>signr
<00>replace)r<>r<>r<>r<>r<>r<>r<>r<>rnrmr<>r<>r<>r<>r<><00>rrsig_inception<6F>rrsig_expirationr<6E><00>rrsig_templater<65><00>signing_key<65>private_clsr<73>s                       r"<00>_signr<6E><00>
s<>
<00><00>t
<0E>~<7E><1F><06><11><1C><1C>V<EFBFBD>$<24><1C><1C><11>%<25><15><1F><17>
<01>(<28>"<22>"<22><07><16>q<EFBFBD><18><1F><1F><06><16>q<EFBFBD><18><06><1C>Q<EFBFBD>x<EFBFBD>|<7C>|<7C><0C><17>-<2D>-<2D><07><16><1C><1C><06><16><1A><1A><06><1C>y<EFBFBD>y<EFBFBD><0C><10><1C>&<26>y<EFBFBD>1<><0F><1D>d<EFBFBD>i<EFBFBD>i<EFBFBD>k<EFBFBD>*<2A><0F><11><1D>'<27>
<EFBFBD>3<><18>	<11>	<1D>*<2A>X<EFBFBD>5<><18><18>C<>D<>D<><0E><19><17>$<24>$<24>V<EFBFBD>,<2C><06>
<10><16>[<5B>1<EFBFBD>_<EFBFBD>F<EFBFBD><0E>~<7E>~<7E><17><0E>!<21><0B><06><1A><17><12>}<7D>}<7D>"<22>"<22><1B><18>"<22>"<22><15>!<21>#<23>!<21><16>v<EFBFBD><0E><15><15><06>N<EFBFBD>&<26>e<EFBFBD>^<5E>V<EFBFBD>D<>D<EFBFBD><12>+<2B>0<>1<>!<21><0B>	9<>7<><06>?<3F>K<EFBFBD>%<25>+<2B>6<>K<EFBFBD><1C> <20> <20><14>v<EFBFBD>}<7D>=<3D>I<EFBFBD><0F><05>~<7E>-<2D>-<2D>	<09>-<2D>B<>C<>C<><43>$<24>
	9<><1B>7<>8<>8<>
	9<>s<00>7F><00>>Gc<00><><00>t
|t<00>r8tjj	|tjj
<00>}|
j}|j<00>s|<02>td<02>
<00>
|j|<02>
}t|<00>
\}}d}|
j|<03><04>
}|<07>J<00>
||d
dz
}||
jj|<03>
z
}|j<00>s|<02>td<02>
<00>
|j|<02>
}t|<04>
}|j<00>r|
j|dz
k7rtd<07>
<00>
|dz
|
jkrtd	<09>
<00>
|
j|dz
krA|j!|
jdz<00>
d}	tjj	d
|	<09>}|j<00>}
t#j$d|j&|j(|
j*<00>}|D<00>cgc]}|j|<02>
<00><02>}
}t-|
<0A>
D]5}||
z
}||z
}t#j$dt|<0C>
<00>}||z
}||z
}<06>7|Sc
c}w)
a<>
Create signature rdata.

    *rrset*, the RRset to sign/validate.  This can be a
    ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
    tuple.

    *rrsig*, a ``dns.rdata.Rdata``, the signature to validate, or the
    signature template used when signing.

    *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative
    names.

    Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by
    dnspython but not implemented.
    Nz,relative RR name without an origin specifiedr$rs<00>r7z&wild owner name has wrong label lengthr8z#owner name longer than RRSIG labels<6C>
*z!HHIz!H)r+r.rrlr!r<>r<><00>is_absoluterr<>r<>r:<00>
to_digestabler>r<>r<><00>splitr<74>r<>r<>r<>r<><00>sorted)r<>r<>rmr<>r<>r<>r<>r<><00>name_len<65>suffix<69>	rrnamebuf<75>rrfixedr?<00>rdatas<61>rrlens               r"r<>r<>[s<00><00>*<12>&<26>#<23><1E><14><18><18>#<23>#<23>F<EFBFBD>C<EFBFBD>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>:<3A><06>
<12>\<5C>\<5C>F<EFBFBD><11><1D><1D><1F><11>><3E>#<23>$R<>S<>S<><17>$<24>$<24>V<EFBFBD>,<2C><06>,<2C>E<EFBFBD>2<><14>F<EFBFBD>H<EFBFBD><0E>D<EFBFBD><10>=<3D>=<3D><06>=<3D>'<27>D<EFBFBD><0F><1B><1B><1B><08>D<EFBFBD><13>"<22>I<EFBFBD><15>D<EFBFBD><08>E<EFBFBD>L<EFBFBD>L<EFBFBD>&<26>&<26>v<EFBFBD>.<2E>.<2E>D<EFBFBD><12><1D><1D><1F><11>><3E>#<23>$R<>S<>S<><17>$<24>$<24>V<EFBFBD>,<2C><06><12>6<EFBFBD>{<7B>H<EFBFBD>
<0A>~<7E>~<7E><17>E<EFBFBD>L<EFBFBD>L<EFBFBD>H<EFBFBD>q<EFBFBD>L<EFBFBD>8<><1F> H<>I<>I<><0F>!<21>|<7C>e<EFBFBD>l<EFBFBD>l<EFBFBD>"<22><1F> E<>F<>F<>	<0E><1C><1C><08>1<EFBFBD><0C>	$<24><17><1C><1C>e<EFBFBD>l<EFBFBD>l<EFBFBD>Q<EFBFBD>.<2E>/<2F>
<01>2<><06><14><18><18>#<23>#<23>C<EFBFBD><16>0<><06><16>$<24>$<24>&<26>I<EFBFBD><14>k<EFBFBD>k<EFBFBD>&<26>(<28>/<2F>/<2F>8<EFBFBD>3C<33>3C<33>U<EFBFBD>EW<45>EW<45>X<>G<EFBFBD>7?<3F>
@<40>x<EFBFBD>e<EFBFBD>e<EFBFBD>!<21>!<21>&<26>)<29>x<EFBFBD>F<EFBFBD>
@<40><17><06><1E><05><0C>	<09><19><04><0C><07><0F><04><16><0B><0B>D<EFBFBD>#<23>e<EFBFBD>*<2A>-<2D><05><0C><05>
<0A><04><0C><05>
<0A><04> <20><10>K<EFBFBD><4B>A
s<00>/Ir<>r<>r<>r<>c<00><><00>t
j|
<01>
}
t|t<00>r|j	||<03>
<01>St|
<01>
j}||<00><02>
j	||<03>
<01>S)a<>Convert a public key to DNSKEY Rdata

    *public_key*, a ``PublicKey`` (``GenericPublicKey`` or
    ``cryptography.hazmat.primitives.asymmetric``) to convert.

    *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm.

    *flags*: DNSKEY flags field as an integer.

    *protocol*: DNSKEY protocol field as an integer.

    Raises ``ValueError`` if the specified key algorithm parameters are not
    unsupported, ``TypeError`` if the key type is unsupported,
    `UnsupportedAlgorithm` if the algorithm is unknown and
    `AlgorithmKeyMismatch` if the algorithm does not match the key type.

    Return DNSKEY ``Rdata``.
    )r<>r<>r<>)r<00>maker+r<00>	to_dnskey<65>get_algorithm_clsr<73>)r<>r;r<>r<>r<>s     r"<00>_make_dnskeyr<79><00>s`<00><00>2<1A><0E><0E>y<EFBFBD>)<29>I<EFBFBD><12>*<2A>.<2E>/<2F><19>#<23>#<23>%<25>(<28>#<23>C<>C<>&<26>y<EFBFBD>1<><<3C><<3C>
<EFBFBD><19>j<EFBFBD>)<29>3<>3<>%<25>(<28>3<>S<>Sr$c<00><><00>t
||
||<03>}t|jtjj|j
|j|j|j<00>
<01>S)a<>Convert a public key to CDNSKEY Rdata

    *public_key*, the public key to convert, a
    ``cryptography.hazmat.primitives.asymmetric`` public key class applicable
    for DNSSEC.

    *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm.

    *flags*: DNSKEY flags field as an integer.

    *protocol*: DNSKEY protocol field as an integer.

    Raises ``ValueError`` if the specified key algorithm parameters are not
    unsupported, ``TypeError`` if the key type is unsupported,
    `UnsupportedAlgorithm` if the algorithm is unknown and
    `AlgorithmKeyMismatch` if the algorithm does not match the key type.

    Return CDNSKEY ``Rdata``.
    <20>r<>r<>r<>r<>r;r2)	r<>rr<>rr<>r<>r<>r;r2)r<>r;r<>r<>r<>s     r"<00>
_make_cdnskeyr<79><00>sS<00><00>4<1A>*<2A>i<EFBFBD><15><08>
A<>F<EFBFBD><12><16><0E><0E><12>}<7D>}<7D>$<24>$<24><14>l<EFBFBD>l<EFBFBD><17><1F><1F><18>"<22>"<22><12>J<EFBFBD>J<EFBFBD>
<06>r$<00>domain<69>salt<6C>
iterationsc<00>l<00>tjd
d<02>}	t|t<00>rt|j	<00>}|tjk7rt
d<03>
<00>
|
<01>d}nDt|
t<00>r2t|
<01>
dzdk(rtj|
<01>
}n
t
d<07>
<00>
|
}t|tjj<00>stjj|<00>
}|j<00>j!<00>}|<06>J<00>
t#j$||z<00>
j'<00>}t)|<02>
D](}t#j$||z<00>
j'<00>}<07>*t+j,|<07>
j/d<08>
}	|	j1|<04>
}	|	S#t
$r
t
d<03>
<00>
wxYw
)	a<>

    Calculate the NSEC3 hash, according to
    https://tools.ietf.org/html/rfc5155#section-5

    *domain*, a ``dns.name.Name`` or ``str``, the name to hash.

    *salt*, a ``str``, ``bytes``, or ``None``, the hash salt.  If a
    string, it is decoded as a hex string.

    *iterations*, an ``int``, the number of iterations.

    *algorithm*, a ``str`` or ``int``, the hash algorithm.
    The only defined algorithm is SHA1.

    Returns a ``str``, the encoded NSEC3 hash.
    <20> ABCDEFGHIJKLMNOPQRSTUVWXYZ234567<36> 0123456789ABCDEFGHIJKLMNOPQRSTUVz-Wrong hash algorithm (only SHA1 is supported)r$r7rzInvalid salt lengthzutf-8)r.<00>	maketransr+r
rurvrwrxr><00>bytes<65>fromhexrrl<00>Namer!r<>r:ryrzr<>r=<00>base64<36>	b32encode<64>decode<64>	translate)
r<EFBFBD>r<>r<>r;<00>b32_conversion<6F>salt_encoded<65>domain_encodedr<64><00>
_<>outputs
          r"<00>
nsec3_hashr
<00>sw
<00><00>.<19>]<5D>]<5D>*<2A>,N<><06>N<EFBFBD>J
<01><15>i<EFBFBD><13>%<25>!<21>)<29>/<2F>/<2F>"3<>4<>I<EFBFBD><11>I<EFBFBD>N<EFBFBD>N<EFBFBD>"<22><18>H<>I<>I<><0B>|<7C><1A><0C>	<13>D<EFBFBD>#<23>	<1E><0E>t<EFBFBD>9<EFBFBD>q<EFBFBD>=<3D>A<EFBFBD><1D> <20>=<3D>=<3D><14>.<2E>L<EFBFBD><1C>2<>3<>3<><1B><0C><15>f<EFBFBD>c<EFBFBD>h<EFBFBD>h<EFBFBD>m<EFBFBD>m<EFBFBD>,<2C><14><18><18>#<23>#<23>F<EFBFBD>+<2B><06><1B>(<28>(<28>*<2A>2<>2<>4<>N<EFBFBD><19>%<25>%<25>%<25>
<14>\<5C>\<5C>.<2E><<3C>7<>
8<>
?<3F>
?<3F>
A<>F<EFBFBD>
<12>:<3A>
<1E>
<01><18><1C><1C>f<EFBFBD>|<7C>3<>4<>;<3B>;<3B>=<3D><06><1F><14>
<1D>
<1D>f<EFBFBD>
%<25>
,<2C>
,<2C>W<EFBFBD>
5<>F<EFBFBD>
<13>
<1D>
<1D>n<EFBFBD>
-<2D>F<EFBFBD><11>M<EFBFBD><4D>9<15>
J
<01><18>H<>I<>I<>
J
<01>s<00>'F<00>F3<03>
algorithmsc	<00><><00>t
|<00>
\}}|jtjjtjj
tjjfv
rtd
<01>
<00>
t<00>}|
D];}	t|t<00>rt|j<00>}|j|<06>

<00>=|jtjjk(rug}t!|<04>
D]"}|j"|vs
<01>|j%|<08>

<00>$t'|<07>
dk(rtd<05>
<00>
tj(j+|j,|<07>Sg}|D]}|j/t1||||<02><00>

<00>!tj(j+|j,|<07>S#t$r
td|<06>d<03><03>
<00>
wxYw
)aCreate a DS record from DNSKEY/CDNSKEY/CDS.

    *rrset*, the RRset to create DS Rdataset for.  This can be a
    ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
    tuple.

    *algorithms*, a set of ``str`` or ``int`` specifying the hash algorithms.
    The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
    does not matter for these strings. If the RRset is a CDS, only digest
    algorithms matching algorithms are accepted.

    *origin*, a ``dns.name.Name`` or ``None``.  If `key` is a relative name,
    then it will be made absolute using the specified origin.

    Raises ``UnsupportedAlgorithm`` if any of the algorithms are unknown and
    ``ValueError`` if the given RRset is not usable.

    Returns a ``dns.rdataset.Rdataset``
    zrrset not a DNSKEY/CDNSKEY/CDSrqrrrzno acceptable CDS rdata found)r<>r<>rr<>rrrrw<00>setr+r.rrurvr<00>add<64>cds_rdataset_to_ds_rdatasetr<74><00>appendr>r<><00>from_rdata_listr<74><00>extend<6E>dnskey_rdataset_to_cds_rdataset)	r<>r
rmr<>r<><00>_algorithmsr;<00>resr?s	         r"<00>make_ds_rdatasetr
$s~
<00><00>2,<2C>E<EFBFBD>2<><14>F<EFBFBD>H<EFBFBD><0F><EFBFBD><EFBFBD><0B>
<0A>
<0A><1C><1C><0B>
<0A>
<0A><1D><1D><0B>
<0A>
<0A><19><19><06><06>
<19>9<>:<3A>:<3A><15>%<25>K<EFBFBD><1F>	<09>	O
<01><19>)<29>S<EFBFBD>)<29>$<24>Y<EFBFBD>_<EFBFBD>_<EFBFBD>%6<>7<>	<09>	<14><0F><0F>	<09>"<22>
 <20><10><EFBFBD><EFBFBD>#<23>-<2D>-<2D>+<2B>+<2B>+<2B><10><03>0<><18>:<3A>E<EFBFBD><14> <20> <20>K<EFBFBD>/<2F><13>
<EFBFBD>
<EFBFBD>5<EFBFBD>!<21>;<3B><0F>s<EFBFBD>8<EFBFBD>q<EFBFBD>=<3D><1C><<3C>=<3D>=<3D><12>|<7C>|<7C>+<2B>+<2B>H<EFBFBD>L<EFBFBD>L<EFBFBD>#<23>><3E>><3E>
<0C>C<EFBFBD> <20>	<09><0B>
<EFBFBD>
<EFBFBD>2<>6<EFBFBD>8<EFBFBD>Y<EFBFBD>PV<50>W<>X<>!<21><0E><<3C><<3C>'<27>'<27><08><0C><0C>c<EFBFBD>:<3A>:<3A><>!<19>
	O
<01>&<26>)@<40><19><0B>1<EFBFBD>'M<>N<>N<>
	O
<01>s<00>'F)<02>)Gr<>c
<00><>
<00>|jtjjk7rt	d
<01>
<00>
g}
|D]l}|
jt|jtjj|j|j|j|j<00><02><00>

<00>ntjj|j|
<01>S)z<>Create a CDS record from DS.

    *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for.

    Raises ``ValueError`` if the rdataset is not CDS.

    Returns a ``dns.rdataset.Rdataset``
    zrdataset not a CDSr<53>)r<>rr<>rrwr	
r<>rr<>r;r<>r<>r<>r

r<><00>r<>r
r?s   r"r
r
^s<><00><00><10><EFBFBD><EFBFBD>#<23>-<2D>-<2D>+<2B>+<2B>+<2B><18>-<2D>.<2E>.<2E>
<0C>C<EFBFBD><19><05><0B>
<EFBFBD>
<EFBFBD><0F><1D>
<0A>
<0A><1A>}<7D>}<7D>'<27>'<27><1D>
<0A>
<0A><1F>/<2F>/<2F>!<21>-<2D>-<2D><1C>|<7C>|<7C>

<0E>		
<EFBFBD><1A><0F><<3C><<3C>'<27>'<27><08><0C><0C>c<EFBFBD>:<3A>:r$c	<00>8
<00>|
jtjjtjjfv
rtd
<01>
<00>
g}|
D]}|j
t||||<03><00>

<00>!tjj|
j|<04>S)a<>Create a CDS record from DNSKEY/CDNSKEY.

    *name*, a ``dns.name.Name`` or ``str``, the owner name of the CDS record.

    *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for.

    *algorithm*, a ``str`` or ``int`` specifying the hash algorithm.
    The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
    does not matter for these strings.

    *origin*, a ``dns.name.Name`` or ``None``.  If `key` is a relative name,
    then it will be made absolute using the specified origin.

    Raises ``UnsupportedAlgorithm`` if the algorithm is unknown or
    ``ValueError`` if the rdataset is not DNSKEY/CDNSKEY.

    Returns a ``dns.rdataset.Rdataset``
    zrdataset not a DNSKEY/CDNSKEY)r<>rr<>rrrwr	
r<>r<>r

r<>)rlr<>r;rmr
r?s      r"r
r
{sv<00><00>2<10><EFBFBD><EFBFBD>s<EFBFBD>}<7D>}<7D>3<>3<>S<EFBFBD>]<5D>]<5D>5J<35>5J<35>K<>K<><18>8<>9<>9<>
<0C>C<EFBFBD><19><05><0B>
<EFBFBD>
<EFBFBD>8<EFBFBD>D<EFBFBD>%<25><19>F<EFBFBD>;<3B><<3C><1A><0E><<3C><<3C>'<27>'<27><08><0C><0C>c<EFBFBD>:<3A>:r$c
<00><>
<00>|jtjjk7rt	d
<01>
<00>
g}
|D]^}|
jt
|j|j|j|j|j|j<00><02><00>

<00>`tjj|j|
<01>S)z<>Create a CDNSKEY record from DNSKEY.

    *rdataset*, a ``dns.rdataset.Rdataset``, to create CDNSKEY Rdataset for.

    Returns a ``dns.rdataset.Rdataset``
    zrdataset not a DNSKEYr<59>)r<>rr<>rrwr	
rr<>r<>r<>r;r2r<>r

r<>r
s   r"<00>#dnskey_rdataset_to_cdnskey_rdatasetr
<00>s<><00><00><10><EFBFBD><EFBFBD>#<23>-<2D>-<2D>.<2E>.<2E>.<2E><18>0<>1<>1<>
<0C>C<EFBFBD><19><05><0B>
<EFBFBD>
<EFBFBD><13> <20>(<28>(<28><1F><EFBFBD><EFBFBD><1B>k<EFBFBD>k<EFBFBD><1E><1E><1E><1F>/<2F>/<2F><19>I<EFBFBD>I<EFBFBD>

<0E>		
<EFBFBD><1A><0F><<3C><<3C>'<27>'<27><08><0C><0C>c<EFBFBD>:<3A>:r$<00>txn<78>ksks<6B>zsksc
<00><>
<00>|
jttjjj
tjjjtjjjg<03>
vr|}n|}|D]A\}}
t|
||
||||||	|
<EFBFBD>
<01>
}|j|
j|
j|<0E>
<00>Cy)zDefault RRset signer)
r<EFBFBD>r<>r<>r<>r<>r<>r<>rnrmr<>N)r<>r
rr<><00>	RdataTyperrrr<>r
rlr<>)r
r<>r<>r
r
r<>r<>r<>rnrmr<>r<>r<>r<>r<>s               r"<00>default_rrset_signerr
<00>s<><00><00>
<0A>|<7C>|<7C>s<EFBFBD><0F>M<EFBFBD>M<EFBFBD>#<23>#<23>*<2A>*<2A><0F>M<EFBFBD>M<EFBFBD>#<23>#<23>'<27>'<27><0F>M<EFBFBD>M<EFBFBD>#<23>#<23>+<2B>+<2B>	
<EFBFBD><06><06><14><04><13><04>#<23><1B><0B>V<EFBFBD><14><17>#<23><19><1F>!<21><1D><19><19><19>'<27>
<EFBFBD><05>	<0C><07><07><05>
<EFBFBD>
<EFBFBD>E<EFBFBD>I<EFBFBD>I<EFBFBD>u<EFBFBD>-<2D> $r$<00>zone<6E>
add_dnskey<EFBFBD>
dnskey_ttl<EFBFBD>nsec3<63>rrset_signerc
<00>l<00>g}g}
|rS|D]E}|d
jtjz
r|j|<0E>

<00>5|
j|<0E>

<00>G|s|}|
s|}
ng}|
rt	j
|
<01>
}n|j
<00>}|j<00>td<03>
<00>
|5}|r<>|<04><>|j|jtjj<00>}|r
|j}n@|j|jtjj<00>}|j}|D]"\}}|j|j||<11>
<00>$|rt!d<04>
<00>
|	x
s7
t#j$t&|j||
||||
|j|<0B><05>
}t)|||<14>cddd<02>
S#1s
w
Y

yxYw
)aSign zone.

    *zone*, a ``dns.zone.Zone``, the zone to sign.

    *txn*, a ``dns.transaction.Transaction``, an optional transaction to use for
    signing.

    *keys*, a list of (``PrivateKey``, ``DNSKEY``) tuples, to use for signing. KSK/ZSK
    roles are assigned automatically if the SEP flag is used, otherwise all RRsets are
    signed by all keys.

    *add_dnskey*, a ``bool``.  If ``True``, the default, all specified DNSKEYs are
    automatically added to the zone on signing.

    *dnskey_ttl*, a``int``, specifies the TTL for DNSKEY RRs. If not specified the TTL
    of the existing DNSKEY RRset used or the TTL of the SOA RRset.

    *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature
    inception time.  If ``None``, the current time is used.  If a ``str``, the format is
    "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text
    form; this is the same the RRSIG rdata's text form. Values of type `int` or `float`
    are interpreted as seconds since the UNIX epoch.

    *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature
    expiration time.  If ``None``, the expiration time will be the inception time plus
    the value of the *lifetime* parameter.  See the description of *inception* above for
    how the various parameter types are interpreted.

    *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds.  This
    parameter is only meaningful if *expiration* is ``None``.

    *nsec3*, a ``NSEC3PARAM`` Rdata, configures signing using NSEC3. Not yet
    implemented.

    *rrset_signer*, a ``Callable``, an optional function for signing RRsets. The
    function requires two arguments: transaction and RRset. If the not specified,
    ``dns.dnssec.default_rrset_signer`` will be used.

    *deterministic*, a ``bool``. If ``True``, the default, use deterministic
    (reproducible) signatures when supported by the algorithm used for signing.
    Currently, this only affects ECDSA.

    Returns ``None``.
    r8Nzno zone originz&Signing with NSEC3 not yet implemented)	r<>r
r
r<>r<>r<>rnrmr<>)r<>r<00>SEPr	
<00>
contextlib<EFBFBD>nullcontext<78>writerrmrwr<>rr<>rr<><00>SOAr
<00>NotImplementedError<6F>	functools<6C>partialr
<00>_sign_zone_nsec)r
r
r<>r
r
r<>r<>r<>r
r
rnr<>r
r
r2<00>cm<63>_txnr<6E><00>soar

<00>
_rrset_signers                     r"<00>	sign_zoner.
<00>s|
<00><00>v
<0E>D<EFBFBD>
<0A>D<EFBFBD><0C><17>C<EFBFBD><12>1<EFBFBD>v<EFBFBD>|<7C>|<7C>d<EFBFBD>h<EFBFBD>h<EFBFBD>&<26><14><0B><0B>C<EFBFBD> <20><14><0B><0B>C<EFBFBD> <20>	<18>
<14><17>D<EFBFBD><13><17>D<EFBFBD><11><04>
<EFBFBD>0:<3A>0F<30>0F<30>s<EFBFBD>0K<30><02>
<11>[<5B>[<5B>]<5D><02><0B>{<7B>{<7B><1A><18>)<29>*<2A>*<2A>	<0B>t<EFBFBD><15><19>!<21><1D><18><18>$<24>+<2B>+<2B>s<EFBFBD>}<7D>}<7D>/C<>/C<>D<><06><19>!'<27><1A><1A>J<EFBFBD><1E>(<28>(<28>4<EFBFBD>;<3B>;<3B><03>
<0A>
<0A>0A<30>0A<30>B<>C<EFBFBD>!$<24><17><17>J<EFBFBD>!<21>	<09>
<01>6<EFBFBD><14><08><08><14><1B><1B>j<EFBFBD>&<26>9<>"<22><11>%<25>&N<>O<>O<>(<28><0E>I<EFBFBD>,=<3D>,=<3D>$<24><1B>{<7B>{<7B><19><19>#<23>%<25>!<21><1D><1B>{<7B>{<7B>+<2B>-<0E>M<EFBFBD>#<23>4<EFBFBD><14>}<7D>=<3D>7
<0C><12><12>s
<00>DF*<03>*F3c<00><00>	d
dtjjdtjjdtjjd
zdtj
jdtdtd
zdd
fd	<09>}|j|
<01>
j}d
}d
}t|
j<00><00>
D<00>
]}|r|j|<05>
r
<01>|
j|tjj <00>r||j"k7r|}nd
}|r<>|
j%|<07>
}|r<>|j&D]<5D>}	|	j(tjj*k(r
<01>+|r(|	j(tjj,k7r
<01>Ut
j.j0||	j2g|	<09>
<01><06>}
||
|
<EFBFBD>
<00><>|<06>||
|||j4||<02>
|}<06>
<01>|r"||
||j"|j4||<02>
y
y
)zNSEC zone signerNr
rl<00>next_securer<65>r<>r
rc
<00>T<00>t
tjjjtjjj
g<02>
}|j
|
<01>
}|r<>|r<>t
|jD<00>cgc]}|j<00><02>c}<08>
|z}	tjt|	<09>
<00>
}
tjj|
|t|tjjj
||
<EFBFBD>
<01><00>}|j|<0B>

|r
|||<0B>
yyyyc
c}w)zNSEC zone signer helper)r<>r<><00>next<78>windowsN)r
rr<>r
rr<00>get_node<64>	rdatasetsr<73>r<00>from_rdtypes<65>listr<74><00>
from_rdatar
)r
rlr0
r<>r<>r
<00>mandatory_typesr<73>r<><00>typesr3
r<>s            r"<00>
_txn_add_nsecz&_sign_zone_nsec.<locals>._txn_add_nsec[s<><00><00><1E>
<10>]<5D>]<5D>
$<24>
$<24>
*<2A>
*<2A>C<EFBFBD>M<EFBFBD>M<EFBFBD>,C<>,C<>,H<>,H<>I<>
<EFBFBD><0F><13>|<7C>|<7C>D<EFBFBD>!<21><04><0F>K<EFBFBD><13>T<EFBFBD>^<5E>^<5E>D<>^<5E><18>X<EFBFBD>_<EFBFBD>_<EFBFBD>^<5E>D<>E<><0F>W<>
<12><1D>)<29>)<29>$<24>u<EFBFBD>+<2B>6<>G<EFBFBD><17>I<EFBFBD>I<EFBFBD>(<28>(<28><14><13><14>#<23><1E>=<3D>=<3D>2<>2<>7<>7<>$<24>#<23>	<12>	<0E>E<EFBFBD>
<10>G<EFBFBD>G<EFBFBD>E<EFBFBD>N<EFBFBD><1B><1C>S<EFBFBD>%<25>(<28><1C>! <20>4<EFBFBD><34>Ds<00>:D%rF)r<00>transaction<6F>Transactionrlr<>r<><00>
RdataClassr,<00>RRsetSigner<65>get_soa<6F>minimumr<6D><00>
iterate_names<65>is_subdomainr<6E>r<><00>NSrmr4
r5
r<>rrr<>r8
r<>r<>)r
r
r
r;
<00>	rrsig_ttl<74>
delegation<EFBFBD>last_securerlr<>r<>r<>s           r"r)
r)
Ts<>
<00><00>,0<>
)<29>
<10>_<EFBFBD>_<EFBFBD>
(<28>
(<28>)<29><11>h<EFBFBD>h<EFBFBD>m<EFBFBD>m<EFBFBD>)<29><19>X<EFBFBD>X<EFBFBD>]<5D>]<5D>T<EFBFBD>)<29>)<29><15><1E><1E>*<2A>*<2A>	)<29>
<11>)<29>"<22>D<EFBFBD>(<28>
)<29>
<0E>)<29>@
<15><0C><0C>S<EFBFBD>!<21>)<29>)<29>I<EFBFBD><15>J<EFBFBD><16>K<EFBFBD><16>s<EFBFBD>(<28>(<28>*<2A>+<2B><04><15>$<24>+<2B>+<2B>J<EFBFBD>7<><14>
<10>W<EFBFBD>W<EFBFBD>T<EFBFBD>3<EFBFBD>=<3D>=<3D>+<2B>+<2B>
,<2C><14><14><1B><1B>1D<31><1D>J<EFBFBD><1E>J<EFBFBD><17><16><<3C><<3C><04>%<25>D<EFBFBD><13> $<24><0E><0E>H<EFBFBD><1F><EFBFBD><EFBFBD>#<23>-<2D>-<2D>*=<3D>*=<3D>=<3D> <20>#<23><08><0F><0F>3<EFBFBD>=<3D>=<3D>;K<>;K<>(K<> <20> #<23>	<09>	<09> 4<> 4<>T<EFBFBD>8<EFBFBD><<3C><<3C> S<>(<28> S<><05>$<24>S<EFBFBD>%<25>0<>!/<2F><17>"<22><19>#<23>{<7B>D<EFBFBD>$<24>,<2C>,<2C>	<09><<3C>X<><1A><0B>9,<2C><<13><15><0F><1B>d<EFBFBD>k<EFBFBD>k<EFBFBD>4<EFBFBD><<3C><<3C><19>L<EFBFBD>	
<EFBFBD>r$c<00><00>t
d
<01>
<00>
)Nz.DNSSEC validation requires python cryptography)
<01>ImportError)<02>args<67>kwargss  r"<00>
_need_pycarL
<00>s<00><00>
<15>8<><06>r$<00>dnssec)
r<>)
<01>ec)
<01>ed448)
<01>rsa)
<01>ed25519)r<>r<>)rr)NNFrF)NNN)NNNFNNT)NNNNNT)NNTNNNNNNNT)<29><>__doc__r<5F>r"
r'
ryr<>r<>r<00>typingrrrrrr	r
<00>
dns._featuresr<00>dns.name<6D>dns.node<64>	dns.rdata<74>dns.rdataclass<73>dns.rdataset<65>
dns.rdatatype<70>	dns.rrset<65>dns.transaction<6F>dns.zone<6E>dns.dnssectypesrrr
<00>
dns.exceptionrrrr<00>dns.rdtypes.ANY.CDNSKEYr<00>dns.rdtypes.ANY.CDSr<00>dns.rdtypes.ANY.DNSKEYr<00>dns.rdtypes.ANY.DSr<00>dns.rdtypes.ANY.NSECrr<00>dns.rdtypes.ANY.NSEC3PARAMr<00>dns.rdtypes.ANY.RRSIGrr<00>dns.rdtypes.dnskeybaser<00>	PublicKey<65>
PrivateKeyr<
r=
r<><00>RRsetr?
r.r#r,r)r/r1rBrDr[r<<00>DSA<53>DSANSEC3SHA1<41>ECCGOST<53>NULLrx<00>GOST<53>rfc_8624_policyr
<00>allow_all_policyrtrlr<>r?<00>RdatarYr<>r<>r<><00>Rdatasetr<74>r<>r<>r<>r<>r<>r<>r<>r<>r<>r<>r<>r<>r
r
r
r
r
r
r
<00>Zoner.
r)
rL
<00>	_features<65>have<76>cryptography.exceptionsr<73><00>)cryptography.hazmat.primitives.asymmetricrN
rO
rP
rQ
<00>dns.dnssecalgsr<73>r<><00>dns.dnssecalgs.baserr<00>validate<74>validate_rrsigr<67><00>make_dnskey<65>make_cdnskey<65>
_have_pyca<EFBFBD>DH<44>ECC<43>RSASHA1<41>RSASHA1NSEC3SHA1<41>	RSASHA256<35>	RSASHA512<31>ECDSAP256SHA256<35>ECDSAP384SHA384<38>ED25519<31>ED448<34>INDIRECT<43>
PRIVATEDNS<EFBFBD>
PRIVATEOIDrGr$r"<00><module>r<>

s7<00>


<01>$
5<>
<0E><11><10><0E>
<0A><0B><1D>@<40>@<40>@<40><14><0F><0F><10><15><13><14><10><16><0F>:<3A>:<3A>F<>Q<>Q<>+<2B>#<23>)<29>!<21>-<2D>1<>=<3D>'<27><11><1C>
<02>	<09><13><1D><02>
<EFBFBD><17><03><0F><0F>3<>3<>S<EFBFBD>Y<EFBFBD>Y<EFBFBD>_<EFBFBD>_<EFBFBD>E<>t<EFBFBD>K<>L<><0B>
%<25>c<EFBFBD>
%<25>i<EFBFBD>
%<25>
$<24>Y<EFBFBD><13>_<EFBFBD>
$<24><13>
$<24>
6<><08>3<EFBFBD><0E><15>.<2E><13>4<>
6<><13>
6<>
<1E><06><17> <20>
<1E>S<EFBFBD>
<1E>,
<15>
<15>"
7<><16>
7<>*<1D><0E><15><15>y<EFBFBD>}<7D>}<7D>i<EFBFBD>&<<3C>&<<3C>i<EFBFBD>>O<>>O<>P<><0E><15><15>y<EFBFBD>}<7D>}<7D>i<EFBFBD>&<<3C>&<<3C>=<3D>
<0A>]<5D>]<5D>H<EFBFBD>M<EFBFBD>M<EFBFBD>8<EFBFBD>=<3D>=<3D>1<>
<0A>]<5D>]<5D>O<EFBFBD>	<02><0F><1E>c<EFBFBD>e<EFBFBD>S<EFBFBD>U<EFBFBD>C<EFBFBD>E<EFBFBD>3<EFBFBD>5<EFBFBD>9<><10>!<21><0E>$(<28> <20><1C>
J

<18>

<0A>(<28>(<28>-<2D>-<2D>#<23>
<1D>J

<18>	<0C><19><19><1F><1F>J

<18><18>#<23>~<7E>J

<18>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>	J

<18>

<13>T<EFBFBD>M<EFBFBD>J

<18><15>
J

<18><08>J

<18>b$(<28>	!
<06>

<0A>(<28>(<28>-<2D>-<2D>#<23>
<1D>!
<06>	<0C><19><19><1F><1F>!
<06><18>#<23>~<7E>!
<06>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>	!
<06>
	<09>!
<06>H

<06>
<0E>s<EFBFBD>x<EFBFBD>x<EFBFBD>}<7D>}<7D>c<EFBFBD>l<EFBFBD>l<EFBFBD>3<>3<>c<EFBFBD>h<EFBFBD>h<EFBFBD>m<EFBFBD>m<EFBFBD>C<>C<>
D<EFBFBD>
<06>MR<4D>
<06>	<09>&<26>\<5C>D<EFBFBD><18>
<06>(
!<21><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>U<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>2G<32>2G<32>#G<>H<>H<>
!<21>
<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>/<2F>/<2F>/<2F>0<>
!<21>
!<21>U<EFBFBD>
!<21>%<25>
!<21>f<EFBFBD>
!<21><14>
!<21>$(<28><1C> <20>
C

.<2E><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>U<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>2G<32>2G<32>#G<>H<>H<>C

.<2E><10>C

.<2E><0F>s<EFBFBD>x<EFBFBD>x<EFBFBD>}<7D>}<7D>c<EFBFBD>h<EFBFBD>h<EFBFBD>m<EFBFBD>m<EFBFBD>c<EFBFBD>l<EFBFBD>l<EFBFBD>.C<>.C<>C<>C<>
D<EFBFBD>C

.<2E>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>	C

.<2E>

<0F><14><1C>C

.<2E>
<13>T<EFBFBD>M<EFBFBD>
C

.<2E>
<EFBFBD>C

.<2E>T$(<28><1C> <20>
F

3<><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>U<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>2G<32>2G<32>#G<>H<>H<>F

3<><11>i<EFBFBD>i<EFBFBD>o<EFBFBD>o<EFBFBD><05>c<EFBFBD>h<EFBFBD>h<EFBFBD>m<EFBFBD>m<EFBFBD>S<EFBFBD>\<5C>\<5C>5J<35>5J<35>&J<> K<>K<>F

3<><0F>s<EFBFBD>x<EFBFBD>x<EFBFBD>}<7D>}<7D>c<EFBFBD>h<EFBFBD>h<EFBFBD>m<EFBFBD>m<EFBFBD>c<EFBFBD>l<EFBFBD>l<EFBFBD>.C<>.C<>C<>C<>
D<EFBFBD>F

3<>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>	F

3<>

<0F><14><1C>F

3<>
<13>T<EFBFBD>M<EFBFBD>
F

3<>
<EFBFBD>F

3<>\6:<3A>6:<3A><1F><18> <20>#'<27><1E>|

D
<01><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>U<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>2G<32>2G<32>#G<>H<>H<>|

D
<01><1B>|

D
<01>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>|

D
<01>
<13>	|

D
<01>
<18>#<23>~<7E><03>#<23>e<EFBFBD>+<2B>d<EFBFBD>2<>|

D
<01><19>3<EFBFBD><0E><13>$<24>u<EFBFBD>,<2C>t<EFBFBD>3<>
|

D
<01><12>D<EFBFBD>j<EFBFBD>|

D
<01>
<11>|

D
<01>
<13>T<EFBFBD>M<EFBFBD>|

D
<01>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>|

D
<01><18>|

D
<01><0B>|

D
<01>D$(<28>@

<10><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>U<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>2G<32>2G<32>#G<>H<>H<>@

<10><10>@

<10>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>@

<10><0B>	@

<10>L<16><19><19><15>	 
T
<01><19> 
T
<01><12>S<EFBFBD>y<EFBFBD> 
T
<01><0F> 
T
<01><12>	 
T
<01>
<0C> 
T
<01>L
<16><19><19><15>	#
<06><19>#
<06><12>S<EFBFBD>y<EFBFBD>#
<06><0F>#
<06><12>	#
<06>

<0A>#
<06>L
:
<12><0F>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>C<EFBFBD><1F>:
<12>

<0A><05>+<2B><04>
<1C>:
<12><14>:
<12><13>S<EFBFBD>y<EFBFBD>	:
<12>
	<09>:
<12>@$(<28>7
;<3B><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>U<EFBFBD>3<EFBFBD>8<EFBFBD>8<EFBFBD>=<3D>=<3D>#<23>,<2C>,<2C>2G<32>2G<32>#G<>H<>H<>7
;<3B><13>H<EFBFBD>s<EFBFBD>N<EFBFBD>#<23>7
;<3B>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>7
;<3B>	<09>\<5C>\<5C><1A><1A>	7
;<3B>t

;<3B><11>l<EFBFBD>l<EFBFBD>#<23>#<23>
;<3B><08>\<5C>\<5C><1A><1A>
;<3B>B
$(<28>	
;<3B>

<0A>(<28>(<28>-<2D>-<2D>#<23>
<1D>
;<3B><11>l<EFBFBD>l<EFBFBD>#<23>#<23>
;<3B><18>#<23>~<7E>
;<3B>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>	
;<3B>
	<09>\<5C>\<5C><1A><1A>
;<3B>B

;<3B><11>l<EFBFBD>l<EFBFBD>#<23>#<23>
;<3B><08>\<5C>\<5C><1A><1A>
;<3B>B
6:<3A>6:<3A><1F> <20>#'<27><1E>'
.<2E>	<0C><1F><1F>	$<24>	$<24>'
.<2E><0E>9<EFBFBD>9<EFBFBD>?<3F>?<3F>'
.<2E>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>'
.<2E><0F>u<EFBFBD>Z<EFBFBD><16>'<27>(<28>
)<29>	'
.<2E>
<0F>u<EFBFBD>Z<EFBFBD><16>'<27>(<28>
)<29>'
.<2E><18>#<23>~<7E><03>#<23>e<EFBFBD>+<2B>d<EFBFBD>2<>
'
.<2E><19>3<EFBFBD><0E><13>$<24>u<EFBFBD>,<2C>t<EFBFBD>3<>'
.<2E><12>D<EFBFBD>j<EFBFBD>'
.<2E>
<13>T<EFBFBD>M<EFBFBD>'
.<2E>
<10>H<EFBFBD>H<EFBFBD>M<EFBFBD>M<EFBFBD>D<EFBFBD> <20>'
.<2E><18>'
.<2E>
<EFBFBD>'
.<2E>X
/3<>37<33><1B>!<21>59<35>6:<3A><1F>#<23>'+<2B> <20><1E>p

><3E>

<0A>(<28>(<28>-<2D>-<2D>p

><3E>	<0C><1F><1F>	$<24>	$<24>t<EFBFBD>	+<2B>p

><3E><0F>u<EFBFBD>Z<EFBFBD><16>'<27>(<28>
)<29>D<EFBFBD>
0<EFBFBD>p

><3E><15>	p

><3E>
<14>d<EFBFBD>
<EFBFBD>p

><3E><18>#<23>~<7E><03>#<23>e<EFBFBD>+<2B>d<EFBFBD>2<>
p

><3E><19>3<EFBFBD><0E><13>$<24>u<EFBFBD>,<2C>t<EFBFBD>3<>p

><3E><12>D<EFBFBD>j<EFBFBD>p

><3E><16><04><1C>p

><3E><1E><04>$<24>p

><3E>
<13>T<EFBFBD>M<EFBFBD>p

><3E><18>p

><3E>
<EFBFBD>p

><3E>l(,<2C>L


<EFBFBD>

<0A>(<28>(<28>-<2D>-<2D>L


<EFBFBD>	<0C><1F><1F>	$<24>	$<24>L


<EFBFBD><1E><04>$<24>L


<EFBFBD>
<EFBFBD>	L


<EFBFBD>^
<06><07>=<3D>=<3D><15><15>h<EFBFBD><1F>8<><<3C>?<3F>=<3D><06><06>H
<01><18>H<EFBFBD>$<24>N<EFBFBD><10>D<EFBFBD><1E>K<EFBFBD> <20>L<EFBFBD><15>J<EFBFBD><19>H<EFBFBD><1F>N<EFBFBD><15>D<EFBFBD><1C>K<EFBFBD><1D>L<EFBFBD><16>J<EFBFBD>
<13>	<19>	<19><06><0E>\<5C>\<5C><02><0F>m<EFBFBD>m<EFBFBD><03><0F>m<EFBFBD>m<EFBFBD><03>
<13>
<1B>
<1B><07><18>%<25>%<25><0C><1C>-<2D>-<2D><10><15><1F><1F>	<09><15><1F><1F>	<09>
<13>
<1B>
<1B><07><1B>+<2B>+<2B><0F><1B>+<2B>+<2B><0F>
<13>
<1B>
<1B><07><11><0F><0F><05><14><1D><1D><08>
<16>
!<21>
!<21>
<EFBFBD>
<16>
!<21>
!<21>
r$