Add Keys, Script and Signing Service to dev environment #1076

rochacbruno · 2021-12-09T19:00:56Z

This PR adds the following features

metadata

Issue: AAH-1181
env:LOCK_REQUIREMENTS=0
env:PULP_ANSIBLE_REVISION=main

rochacbruno · 2021-12-20T11:48:30Z

Signing

gpg --batch --import /tmp/ansible-sign.key &>/dev/null

django-admin shell_plus

ss = AsciiArmoredDetachedSigningService.objects.filter(name="ansible-default").first()
repo = AnsibleRepository.objects.filter(name="published").first()


from pulp_ansible.app.tasks.signature import sign
from pulpcore.plugin.tasking import dispatch

task = dispatch(
    sign, 
    exclusive_resources=[repo], 
    kwargs=dict(
        repository_href=repo.pk, 
        content_hrefs=["*"], 
        signing_service_href=ss.pk
   )
 )

Acessing signatures

Collection Version
GET /api/automation-hub/content/published/v3/collections/tosigntest/tosignf/versions/1.0.0/
HTTP 200 OK
Allow: GET, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "version": "1.0.0",
    "href": "/api/automation-hub/content/published/v3/collections/tosigntest/tosignf/versions/1.0.0/",
    "created_at": "2021-12-16T18:43:21.748529Z",
    "updated_at": "2021-12-16T18:43:21.748551Z",
    "requires_ansible": ">=2",
    "artifact": {
        "filename": "tosigntest-tosignf-1.0.0.tar.gz",
        "sha256": "cd5eb8b5c089dbfff708b37b2bbbe60741fa0cedcb65a5a32ba9674306a74ac3",
        "size": 1574
    },
    "collection": {
        "id": "044ef4c9-7df4-4465-aedb-36c82d97095f",
        "name": "tosignf",
        "href": "/api/automation-hub/content/published/v3/collections/tosigntest/tosignf/"
    },
    "download_url": "http://localhost:5001/api/automation-hub/v3/artifacts/collections/published/tosigntest-tosignf-1.0.0.tar.gz",
    "name": "tosignf",
    "namespace": {
        "name": "tosigntest"
    },
    "signatures": [
        {
            "signature": "-----BEGIN PGP SIGNATURE-----\n\niQHIBAABCAAyFiEE6+0XDoyUgOIqHQWbFSUOnsCmJXcFAmHhg0EUHGdhbGF4eTNA\nYW5zaWJsZS5jb20ACgkQFSUOnsCmJXeKmgv/ed8eSOLr4SMbjP+cJILG5749UqfT\nmUz3+3eDfpe2YJpNGfWavWuMbuYAiujWDXsN46qhOdAFwvdkWxRj2GDK/V+1qB+P\nixtQQZ7Drpc8eEOVYYjFIH8+NoXmoeJCKL9ifOmIgtpapzBt09H1qVTIWuzPhmb0\nSt98nGLcEQeXHxzfebSx06NlKEt0n607hur9nZ+Lwy5I7jZtiEgcyezejQAzoQFv\nwcA52IgOnruyMLP6QdjVPJg/ZzqrvrlLe33zSIGr5271TW4YVgOHzV7aOcUVWpKr\nR4m2GXFEQ+fcEeZf65bprb4ndxFlNlpc4yXiDP3vTvBwKoxzYKdtUzlZmO2zN32A\nozRBClFiw0W++NUL/6zl/cUNGuA0CUBGzsRFF8uOijCFVTZ3pvnF+2hk4RpzUkcc\n52VGddFiFvcPhdMVLNitk2J3qhybGHETi0CP4opDUTHXkZC0hsIOLfRlqg7KxtXl\nl99SrE5bsWnpaVAFRinSGcopRWsd28iQbXvJ\n=8dHK\n-----END PGP SIGNATURE-----\n",
            "pubkey_fingerprint": "EBED170E8C9480E22A1D059B15250E9EC0A62577",
            "signing_service": "ansible-default",
            "pulp_created": "2022-01-14T14:05:53.835605Z"
        }
    ],
    "metadata": {
        "authors": [
            "Orion User 1"
        ],
        "contents": [],
        "dependencies": {
            "tosigntest.tosignh": "<=3.0.0"
        },
        "description": "a collection with some deps on other collections",
        "documentation": "",
        "homepage": "",
        "issues": "",
        "license": [
            "GPL-3.0-or-later"
        ],
        "repository": "http://github.example.com/orionuser1/skeleton",
        "tags": [
            "collectiontest"
        ]
    },
    "manifest": {},
    "files": {}
}

rochacbruno · 2022-01-07T00:28:40Z

URL to sign collection on demand

curl -X POST \
  'http://0.0.0.0:8002/api/automation-hub/v3/sign/collections/' \
  -H 'Accept: */*' \
  -H 'Authorization: Token a64a0ab93948c92febf2c0611dc1b189f9f37cdd' \
  -H 'Content-Type: application/json' \
  -d '{
    "signing_service": "ansible-default",
    "repository": "published",
    "namespace": "bla",
    "collection": "zaz",
    "version": "1.5.0",
    "content_units": ["*"]
}'

URL (POST ONLY)

http://0.0.0.0:8002/api/automation-hub/v3/sign/collections/

Payloads

Required

{
    "signing_service": "ansible-default",
    "repository": "published",
}

Either content_units is specified (* or a list of UUIDS)

{
    "signing_service": "ansible-default",
    "repository": "published",
    "content_units": ["*"]
}

OR sign all collections and versions under a namespace

{
    "signing_service": "ansible-default",
    "repository": "published",
    "namespace": "bla",
}

sign all versions under a specific collection

{
    "signing_service": "ansible-default",
    "repository": "published",
    "namespace": "bla",
    "collection": "zaz",
}

Sign specific by version specifier

{
    "signing_service": "ansible-default",
    "repository": "published",
    "namespace": "bla",
    "collection": "zaz",
    "version": "1.2.3"
}

rochacbruno · 2022-01-19T20:37:48Z

Added to _ui/v1 APIs

http://0.0.0.0:5001/api/automation-hub/_ui/v1/collection-versions/?limit=2

Signed collection versions gets a signatures field, this field exposes the fingerprint for the pub_key used in the signature, the SIGNATURE DATA hash is available only on the v3/ API.

"data": [
    {
      "namespace": "test",
      "name": "a",
      "version": "1.0.0",
      "requires_ansible": ">=2",
      "created_at": "2022-01-14T14:04:02.157731Z",
      "metadata": {
        "dependencies": {
          "test.b": "*"
        },
        "contents": [],
        "documentation": "",
        "homepage": "",
        "issues": "",
        "repository": "http://github.example.com/orionuser1/skeleton",
        "description": "a collection with some deps on other collections",
        "authors": [
          "Orion User 1"
        ],
        "license": [
          "GPL-3.0-or-later"
        ],
        "tags": [
          "collectiontest"
        ],
        "signatures": [
          "EBED170E8C9480E22A1D059B15250E9EC0A62577"
        ]
      },
      "contents": [],
      "repository_list": [
        "published"
      ]
    }

On http://0.0.0.0:5001/api/automation-hub/_ui/v1/repo/published/?deprecated=false

There is now 2 fields, the same signatures as above and also a sign_state

"data": [
    {
      "id": "5e094530-4439-4188-9f83-6c278583d981",
      "namespace": {
        "id": 1,
        "name": "test",
        "company": "",
        "email": "",
        "avatar_url": "",
        "description": "",
        "groups": [
          {
            "id": 1,
            "name": "system:partner-engineers",
            "object_permissions": [
              "upload_to_namespace",
              "change_namespace",
              "delete_namespace"
            ]
          }
        ]
      },
      "name": "a",
      "download_count": 0,
      "latest_version": {
        "namespace": "test",
        "name": "a",
        "version": "1.0.0",
        "requires_ansible": ">=2",
        "created_at": "2022-01-14T14:04:02.157731Z",
        "metadata": {
          "dependencies": {
            "test.b": "*"
          },
          "contents": [],
          "documentation": "",
          "homepage": "",
          "issues": "",
          "repository": "http://github.example.com/orionuser1/skeleton",
          "description": "a collection with some deps on other collections",
          "authors": [
            "Orion User 1"
          ],
          "license": [
            "GPL-3.0-or-later"
          ],
          "tags": [
            "collectiontest"
          ],
          "signatures": [
            "EBED170E8C9480E22A1D059B15250E9EC0A62577"
          ]
        },
        "contents": []
      },
      "deprecated": false,
      "sign_state": "signed"
    }

Values are:

unsigned: collection doesn't at least one version signed.
signed: collection has all versions signed.
partial: collection has some versions signed.

c/c @himdel

himdel · 2022-01-19T22:49:23Z

Hey, checking the necessary endpoints, I think we're possibly missing a couple of changes:

the SIGNATURE DATA hash is available only on the v3/ API

I'm not sure what you mean, is that the hash in the signatures array?
Or is that some other hash the UI would want to consume? (And if so, which v3 api? :))

Add signed-only to remote configuration (API and UI)

Is this also a part of this? That's a UI change as well, right?

can_sign_collections

❓ some new permissions seem to be involved, should we also let admin assign these to groups in the UI? (or is this the other kind?)

This PR adds: - secret and public keys on dev/common/ - imports and trusts keys on container build time - add make docker/add-signing-service TODO: - [ ] Route URL to spawn sign task (subclass pulp_ansible#754 serializer) - [ ] Surface the signature on collectionversion serializer - [ ] Add test to sign a collection Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0 env:PULP_CONTAINER_REVISION=39b3000150960c554d2124ab3654e3e7b4c54352 env:PULPCORE_REVISION=f8306ac5d3af1cf9936d39abb0568e86d18cd55f env:GALAXY_IMPORTER_REVISION=7091519f38acb8e10b85baffe7c6074b02309598

Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0 env:PULP_CONTAINER_REVISION=39b3000150960c554d2124ab3654e3e7b4c54352 env:PULPCORE_REVISION=f8306ac5d3af1cf9936d39abb0568e86d18cd55f env:GALAXY_IMPORTER_REVISION=7091519f38acb8e10b85baffe7c6074b02309598

tasks on promotion e.g: copy + remove must run on the same task (or task group) in sequence and using the same locks. Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

- Added tests taken from pulp_ansible PR - Added Permissions - Auto sign only when moving to published (avoid sign rejected content) - Added permissions to /me/ endpoint - Configs to run tests on CI Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=master

rochacbruno · 2022-01-27T17:04:45Z

@brumik

{
  "id": "f006b2b0-e044-4e0f-b167-8c169f0a6d4d",
  "namespace": {
    "id": 5,
    "name": "vittest",
    "company": "",
    "email": "",
    "avatar_url": "",
    "description": "",
    "groups": [
      {
        "id": 1,
        "name": "system:partner-engineers",
        "object_permissions": [
          "upload_to_namespace",
          "change_namespace",
          "delete_namespace"
        ]
      }
    ]
  },
  "name": "vith",
  "download_count": 0,
  "latest_version": {
    "namespace": "vittest",
    "name": "vith",
    "version": "4.0.0",
    "requires_ansible": ">=2",
    "created_at": "2022-01-24T17:04:33.344202Z",
    "metadata": {
      "dependencies": {},
      "contents": [],
      "documentation": "",
      "homepage": "",
      "issues": "",
      "repository": "http://github.example.com/orionuser1/skeleton",
      "description": "a collection with some deps on other collections",
      "authors": [
        "Orion User 1"
      ],
      "license": [
        "GPL-3.0-or-later"
      ],
      "tags": [
        "collectiontest"
      ],
      "signatures": []
    },
    "contents": [],
    "version_sign_state": "unsigned",
    "docs_blob": {
      "contents": [],
      "collection_readme": {
        "html": "<p>This is collection_reqs_test collection</p>",
        "name": "README.md"
      },
      "documentation_files": []
    }
  },
  "all_versions": [
    {
      "version": "4.0.0",
      "created": "2022-01-24 17:04:33.344202+00:00",
      "version_sign_state": "unsigned"
    },
    {
      "version": "3.0.0",
      "created": "2022-01-24 17:04:32.851448+00:00",
      "version_sign_state": "unsigned"
    },
    {
      "version": "2.0.0",
      "created": "2022-01-24 17:04:32.366363+00:00",
      "version_sign_state": "unsigned"
    },
    {
      "version": "1.0.0",
      "created": "2022-01-24 17:04:31.887908+00:00",
      "version_sign_state": "signed"
    }
  ],
  "sign_state": "partial",
  "total_versions": 4,
  "signed_versions": 1,
  "unsigned_versions": 3
}

and

{
  "id": "bd1f6b5c-cf75-4752-af08-c37ec166d38d",
  "namespace": {
    "id": 5,
    "name": "vittest",
    "company": "",
    "email": "",
    "avatar_url": "",
    "description": "",
    "groups": [
      {
        "id": 1,
        "name": "system:partner-engineers",
        "object_permissions": [
          "upload_to_namespace",
          "change_namespace",
          "delete_namespace"
        ]
      }
    ]
  },
  "name": "vith",
  "download_count": 0,
  "latest_version": {
    "namespace": "vittest",
    "name": "vith",
    "version": "5.0.0",
    "requires_ansible": ">=2",
    "created_at": "2022-01-24T17:04:33.904249Z",
    "metadata": {
      "dependencies": {},
      "contents": [],
      "documentation": "",
      "homepage": "",
      "issues": "",
      "repository": "http://github.example.com/orionuser1/skeleton",
      "description": "a collection with some deps on other collections",
      "authors": [
        "Orion User 1"
      ],
      "license": [
        "GPL-3.0-or-later"
      ],
      "tags": [
        "collectiontest"
      ],
      "signatures": [
        {
          "signature": "-----BEGIN PGP SIGNATURE-----\n\niQHIBAABCAAyFiEE6+0XDoyUgOIqHQWbFSUOnsCmJXcFAmHu3C8UHGdhbGF4eTNA\nYW5zaWJsZS5jb20ACgkQFSUOnsCmJXeCBwv+KRukj6gRuNxfx+buJvqztzFkNdQz\nm9M/nrAKrLZngOgYBE1oAw4wH9vrcayDay/WvOF3ESgZLBdP1pMTWam403zXHESL\nEzOK3SkikHw2kh2tnBO+3yimLf0EhPNBYbp9CGw4zQ0BhloKqwRODAIr5iOT3L0y\nB1dp6l7MvS068dbtLnHYaEpm7XYcnVH+mewHcmpcTwli6DPoTU7ff82fbunMRT1W\n3KiRjMeEbRqgMC9QazXTU9MREYQ5CSxBR8uCekKJRKw6bij5bX5LHj4KFy2HA2PI\nRDFdy+ir6cqaJgfmr2tfAN4c6dzUnxLDMmZvuywrbw3qnYaGjOUGHZbl3DFaG9Zp\no60dnseIhPjFaHeFfydV6IyaehGml5Http1gdv60e7qbBsto1CbEKigI5BNfqJTu\nRp9Cz34lbZLpSNZnq/XUMqsuqNcCP1mze4g5Xq6AvT98TG27jN3zPyMb+0dmkN+A\n21GAOPFzAjnFhoQp0LwrheTLYbMeRrg9qkPz\n=ZQbE\n-----END PGP SIGNATURE-----\n",
          "pubkey_fingerprint": "EBED170E8C9480E22A1D059B15250E9EC0A62577",
          "signing_service": "ansible-default"
        }
      ]
    },
    "contents": [],
    "version_sign_state": "signed",
    "docs_blob": {
      "contents": [],
      "collection_readme": {
        "html": "<p>This is collection_reqs_test collection</p>",
        "name": "README.md"
      },
      "documentation_files": []
    }
  },
  "all_versions": [
    {
      "version": "5.0.0",
      "created": "2022-01-24 17:04:33.904249+00:00",
      "version_sign_state": "signed"
    }
  ],
  "sign_state": "signed",
  "total_versions": 1,
  "signed_versions": 1,
  "unsigned_versions": 0
}

rochacbruno · 2022-01-27T17:44:05Z

How to determine if the system has signing enabled?

/api/automation-hub/_ui/v1/feature-flags/

{
  "collection_auto_sign": true,    # this system signs during approval
  "collection_signing": true,    # there is a signing service and keys for collections
  "execution_environments": true
}

Or by checking on:

/api/automation-hub/_ui/v1/settings/

"GALAXY_COLLECTION_SIGNING_SERVICE": "ansible-default",
"GALAXY_AUTO_SIGN_COLLECTIONS": true

rochacbruno · 2022-01-27T18:26:20Z

Filtering by sign state

/api/automation-hub/_ui/v1/repo/staging/?deprecated=false&sign_state=unsigned,partial
# options are [signed, unsigned, partial]

This endpoint accepts other filters such as namespace, name, version

rochacbruno · 2022-01-27T18:30:54Z

Permissions on http://0.0.0.0:5001/api/automation-hub/_ui/v1/me/

"model_permissions": {
    "sign_collections_on_namespace": true,
    "sign_collections_on_repository": true,

on approval dashboard the permission is "move_collection": true, as if user can move the sign is automatic

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

…AH-1181

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno · 2022-02-01T13:55:05Z

/retest

…AH-1181 Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno · 2022-02-01T17:48:12Z

/retest

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno · 2022-02-25T10:18:13Z

@brumik @himdel this PR is being replaced by #1145

rochacbruno force-pushed the AAH-1181 branch from 59d7db6 to d3f1de7 Compare December 9, 2021 19:03

rochacbruno marked this pull request as draft December 9, 2021 19:03

rochacbruno force-pushed the AAH-1181 branch from ea70366 to df6cbf8 Compare December 22, 2021 17:55

s-hertel mentioned this pull request Jan 7, 2022

ansible-galaxy - add signature verification of the MANIFEST.json ansible/ansible#76681

Merged

3 tasks

rochacbruno force-pushed the AAH-1181 branch 5 times, most recently from a271dfd to fd46330 Compare January 14, 2022 16:38

rochacbruno added 8 commits January 26, 2022 19:47

Add SS on entrypoint

ff00444

Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

Fixes on promotion tasks

e546f5a

tasks on promotion e.g: copy + remove must run on the same task (or task group) in sequence and using the same locks. Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

Surface signatures and sign_state on UI api

9cf2705

Issue: AAH-1181 Required PR: pulp/pulp_ansible#754 env:LOCK_REQUIREMENTS=0

Add filter for sign_state on CollectionViewset

8688259

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=master

rochacbruno force-pushed the AAH-1181 branch from ab6d400 to 8688259 Compare January 26, 2022 19:50

rochacbruno force-pushed the AAH-1181 branch from 856e4f1 to b3e7a0f Compare January 27, 2022 17:06

rochacbruno force-pushed the AAH-1181 branch 2 times, most recently from 44da326 to f9a2554 Compare January 27, 2022 18:17

rochacbruno force-pushed the AAH-1181 branch from f9a2554 to 187dd13 Compare January 27, 2022 18:45

rochacbruno force-pushed the AAH-1181 branch 9 times, most recently from 5e30c7b to 9996656 Compare January 31, 2022 19:44

Attempt to build appsre

453781b

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno force-pushed the AAH-1181 branch from 9996656 to 453781b Compare January 31, 2022 19:46

rochacbruno added 2 commits February 1, 2022 13:08

Merge remote-tracking branch 'drodowic/clowder-deploy-signing' into A…

0940e1f

…AH-1181

Including drodowic PR changes for ephemeral env

7bac421

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno mentioned this pull request Feb 1, 2022

[WIP] enable collection signing for ephemeral and c.rh.c #1111

Closed

set signing-script mode to executable

2bd3030

drodowic and others added 2 commits February 1, 2022 09:13

add --homedir to signing script

9f80164

Merge remote-tracking branch 'drodowic/clowder-deploy-signing' into A…

32ef7fb

…AH-1181 Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno force-pushed the AAH-1181 branch from 283780a to 32ef7fb Compare February 1, 2022 15:54

Move signatures when moving collections

01859b4

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

rochacbruno force-pushed the AAH-1181 branch from 029b938 to 01859b4 Compare February 1, 2022 18:03

rochacbruno and others added 2 commits February 3, 2022 14:06

Add signed_only field

8fe8a60

Issue: AAH-1181 env:LOCK_REQUIREMENTS=0 env:PULP_ANSIBLE_REVISION=main

Merge branch 'master' into AAH-1181

7e2e975

himdel mentioned this pull request Feb 4, 2022

Adding signatures to UI ansible/ansible-hub-ui#1555

Closed

2 tasks

s-hertel mentioned this pull request Feb 7, 2022

ansible galaxy signature verification ansible/ansible#76961

Closed

3 tasks

awcrosby mentioned this pull request Feb 9, 2022

Combine the copy and remove tasks #1122

Merged

5 tasks

rochacbruno mentioned this pull request Feb 25, 2022

Add Collection Signing Feature - Standalone Mode #1145

Merged

5 tasks

rochacbruno closed this Feb 25, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Keys, Script and Signing Service to dev environment #1076

Add Keys, Script and Signing Service to dev environment #1076

rochacbruno commented Dec 9, 2021 •

edited

Loading

rochacbruno commented Dec 20, 2021 •

edited

Loading

rochacbruno commented Jan 7, 2022

rochacbruno commented Jan 19, 2022 •

edited

Loading

himdel commented Jan 19, 2022 •

edited by rochacbruno

Loading

rochacbruno commented Jan 27, 2022

rochacbruno commented Jan 27, 2022 •

edited

Loading

rochacbruno commented Jan 27, 2022 •

edited

Loading

rochacbruno commented Jan 27, 2022

rochacbruno commented Feb 1, 2022

rochacbruno commented Feb 1, 2022

rochacbruno commented Feb 25, 2022

Add Keys, Script and Signing Service to dev environment #1076

Add Keys, Script and Signing Service to dev environment #1076

Conversation

rochacbruno commented Dec 9, 2021 • edited Loading

metadata

rochacbruno commented Dec 20, 2021 • edited Loading

rochacbruno commented Jan 7, 2022

rochacbruno commented Jan 19, 2022 • edited Loading

himdel commented Jan 19, 2022 • edited by rochacbruno Loading

rochacbruno commented Jan 27, 2022

rochacbruno commented Jan 27, 2022 • edited Loading

rochacbruno commented Jan 27, 2022 • edited Loading

rochacbruno commented Jan 27, 2022

rochacbruno commented Feb 1, 2022

rochacbruno commented Feb 1, 2022

rochacbruno commented Feb 25, 2022

rochacbruno commented Dec 9, 2021 •

edited

Loading

rochacbruno commented Dec 20, 2021 •

edited

Loading

rochacbruno commented Jan 19, 2022 •

edited

Loading

himdel commented Jan 19, 2022 •

edited by rochacbruno

Loading

rochacbruno commented Jan 27, 2022 •

edited

Loading

rochacbruno commented Jan 27, 2022 •

edited

Loading