@@ -100,7 +100,7 @@ github.com/docker/containerd 8517738ba4b82aff5662c97ca4627e7e4d03b531

 github.com/tonistiigi/fifo 1405643975692217d6720f8b54aeee1bf2cd5cf4

 # cluster

-github.com/docker/swarmkit 00890359d8bfba630824b66b848dbf7851149fef

+github.com/docker/swarmkit bddd3f0fb45491987d3dec5fb48311d289d21393

 github.com/golang/mock bd3c8e81be01eef76d4b503f5e687d2d1354d2d9

 github.com/gogo/protobuf v0.3

 github.com/cloudflare/cfssl 7fb22c8cba7ecaf98e4082d22d65800cf45e042a

@@ -89,6 +89,22 @@ func (m *GetRootCACertificateResponse) Reset()                    { *m = GetRoot

 func (*GetRootCACertificateResponse) ProtoMessage()               {}

 func (*GetRootCACertificateResponse) Descriptor() ([]byte, []int) { return fileDescriptorCa, []int{5} }

+type GetUnlockKeyRequest struct {

+}

+

+func (m *GetUnlockKeyRequest) Reset()                    { *m = GetUnlockKeyRequest{} }

+func (*GetUnlockKeyRequest) ProtoMessage()               {}

+func (*GetUnlockKeyRequest) Descriptor() ([]byte, []int) { return fileDescriptorCa, []int{6} }

+

+type GetUnlockKeyResponse struct {

+	UnlockKey []byte  `protobuf:"bytes,1,opt,name=unlock_key,json=unlockKey,proto3" json:"unlock_key,omitempty"`

+	Version   Version `protobuf:"bytes,2,opt,name=version" json:"version"`

+}

+

+func (m *GetUnlockKeyResponse) Reset()                    { *m = GetUnlockKeyResponse{} }

+func (*GetUnlockKeyResponse) ProtoMessage()               {}

+func (*GetUnlockKeyResponse) Descriptor() ([]byte, []int) { return fileDescriptorCa, []int{7} }

+

 func init() {

 	proto.RegisterType((*NodeCertificateStatusRequest)(nil), "docker.swarmkit.v1.NodeCertificateStatusRequest")

 	proto.RegisterType((*NodeCertificateStatusResponse)(nil), "docker.swarmkit.v1.NodeCertificateStatusResponse")

@@ -96,6 +112,8 @@ func init() {

 	proto.RegisterType((*IssueNodeCertificateResponse)(nil), "docker.swarmkit.v1.IssueNodeCertificateResponse")

 	proto.RegisterType((*GetRootCACertificateRequest)(nil), "docker.swarmkit.v1.GetRootCACertificateRequest")

 	proto.RegisterType((*GetRootCACertificateResponse)(nil), "docker.swarmkit.v1.GetRootCACertificateResponse")

+	proto.RegisterType((*GetUnlockKeyRequest)(nil), "docker.swarmkit.v1.GetUnlockKeyRequest")

+	proto.RegisterType((*GetUnlockKeyResponse)(nil), "docker.swarmkit.v1.GetUnlockKeyResponse")

 }

 type authenticatedWrapperCAServer struct {

@@ -115,6 +133,14 @@ func (p *authenticatedWrapperCAServer) GetRootCACertificate(ctx context.Context,

 	return p.local.GetRootCACertificate(ctx, r)

 }

+func (p *authenticatedWrapperCAServer) GetUnlockKey(ctx context.Context, r *GetUnlockKeyRequest) (*GetUnlockKeyResponse, error) {

+

+	if err := p.authorize(ctx, []string{"swarm-manager"}); err != nil {

+		return nil, err

+	}

+	return p.local.GetUnlockKey(ctx, r)

+}

+

 type authenticatedWrapperNodeCAServer struct {

 	local     NodeCAServer

 	authorize func(context.Context, []string) error

@@ -211,6 +237,29 @@ func (m *GetRootCACertificateResponse) Copy() *GetRootCACertificateResponse {

 	return o

 }

+func (m *GetUnlockKeyRequest) Copy() *GetUnlockKeyRequest {

+	if m == nil {

+		return nil

+	}

+

+	o := &GetUnlockKeyRequest{}

+

+	return o

+}

+

+func (m *GetUnlockKeyResponse) Copy() *GetUnlockKeyResponse {

+	if m == nil {

+		return nil

+	}

+

+	o := &GetUnlockKeyResponse{

+		UnlockKey: m.UnlockKey,

+		Version:   *m.Version.Copy(),

+	}

+

+	return o

+}

+

 func (this *NodeCertificateStatusRequest) GoString() string {

 	if this == nil {

 		return "nil"

@@ -278,6 +327,26 @@ func (this *GetRootCACertificateResponse) GoString() string {

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

+func (this *GetUnlockKeyRequest) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 4)

+	s = append(s, "&api.GetUnlockKeyRequest{")

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

+func (this *GetUnlockKeyResponse) GoString() string {

+	if this == nil {

+		return "nil"

+	}

+	s := make([]string, 0, 6)

+	s = append(s, "&api.GetUnlockKeyResponse{")

+	s = append(s, "UnlockKey: "+fmt.Sprintf("%#v", this.UnlockKey)+",\n")

+	s = append(s, "Version: "+strings.Replace(this.Version.GoString(), `&`, ``, 1)+",\n")

+	s = append(s, "}")

+	return strings.Join(s, "")

+}

 func valueToGoStringCa(v interface{}, typ string) string {

 	rv := reflect.ValueOf(v)

 	if rv.IsNil() {

@@ -317,6 +386,9 @@ const _ = grpc.SupportPackageIsVersion3

 type CAClient interface {

 	GetRootCACertificate(ctx context.Context, in *GetRootCACertificateRequest, opts ...grpc.CallOption) (*GetRootCACertificateResponse, error)

+	// GetUnlockKey returns the current unlock key for the cluster for the role of the client

+	// asking.

+	GetUnlockKey(ctx context.Context, in *GetUnlockKeyRequest, opts ...grpc.CallOption) (*GetUnlockKeyResponse, error)

 }

 type cAClient struct {

@@ -336,10 +408,22 @@ func (c *cAClient) GetRootCACertificate(ctx context.Context, in *GetRootCACertif

 	return out, nil

 }

+func (c *cAClient) GetUnlockKey(ctx context.Context, in *GetUnlockKeyRequest, opts ...grpc.CallOption) (*GetUnlockKeyResponse, error) {

+	out := new(GetUnlockKeyResponse)

+	err := grpc.Invoke(ctx, "/docker.swarmkit.v1.CA/GetUnlockKey", in, out, c.cc, opts...)

+	if err != nil {

+		return nil, err

+	}

+	return out, nil

+}

+

 // Server API for CA service

 type CAServer interface {

 	GetRootCACertificate(context.Context, *GetRootCACertificateRequest) (*GetRootCACertificateResponse, error)

+	// GetUnlockKey returns the current unlock key for the cluster for the role of the client

+	// asking.

+	GetUnlockKey(context.Context, *GetUnlockKeyRequest) (*GetUnlockKeyResponse, error)

 }

 func RegisterCAServer(s *grpc.Server, srv CAServer) {

@@ -364,6 +448,24 @@ func _CA_GetRootCACertificate_Handler(srv interface{}, ctx context.Context, dec

 	return interceptor(ctx, in, info, handler)

 }

+func _CA_GetUnlockKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {

+	in := new(GetUnlockKeyRequest)

+	if err := dec(in); err != nil {

+		return nil, err

+	}

+	if interceptor == nil {

+		return srv.(CAServer).GetUnlockKey(ctx, in)

+	}

+	info := &grpc.UnaryServerInfo{

+		Server:     srv,

+		FullMethod: "/docker.swarmkit.v1.CA/GetUnlockKey",

+	}

+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {

+		return srv.(CAServer).GetUnlockKey(ctx, req.(*GetUnlockKeyRequest))

+	}

+	return interceptor(ctx, in, info, handler)

+}

+

 var _CA_serviceDesc = grpc.ServiceDesc{

 	ServiceName: "docker.swarmkit.v1.CA",

 	HandlerType: (*CAServer)(nil),

@@ -372,6 +474,10 @@ var _CA_serviceDesc = grpc.ServiceDesc{

 			MethodName: "GetRootCACertificate",

 			Handler:    _CA_GetRootCACertificate_Handler,

 		},

+		{

+			MethodName: "GetUnlockKey",

+			Handler:    _CA_GetUnlockKey_Handler,

+		},

 	},

 	Streams:  []grpc.StreamDesc{},

 	Metadata: fileDescriptorCa,

@@ -642,6 +748,56 @@ func (m *GetRootCACertificateResponse) MarshalTo(data []byte) (int, error) {

 	return i, nil

 }

+func (m *GetUnlockKeyRequest) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *GetUnlockKeyRequest) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	return i, nil

+}

+

+func (m *GetUnlockKeyResponse) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *GetUnlockKeyResponse) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	if len(m.UnlockKey) > 0 {

+		data[i] = 0xa

+		i++

+		i = encodeVarintCa(data, i, uint64(len(m.UnlockKey)))

+		i += copy(data[i:], m.UnlockKey)

+	}

+	data[i] = 0x12

+	i++

+	i = encodeVarintCa(data, i, uint64(m.Version.Size()))

+	n3, err := m.Version.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n3

+	return i, nil

+}

+

 func encodeFixed64Ca(data []byte, offset int, v uint64) int {

 	data[offset] = uint8(v)

 	data[offset+1] = uint8(v >> 8)

@@ -767,6 +923,37 @@ func (p *raftProxyCAServer) GetRootCACertificate(ctx context.Context, r *GetRoot

 	return resp, err

 }

+func (p *raftProxyCAServer) GetUnlockKey(ctx context.Context, r *GetUnlockKeyRequest) (*GetUnlockKeyResponse, error) {

+

+	conn, err := p.connSelector.LeaderConn(ctx)

+	if err != nil {

+		if err == raftselector.ErrIsLeader {

+			return p.local.GetUnlockKey(ctx, r)

+		}

+		return nil, err

+	}

+	modCtx, err := p.runCtxMods(ctx)

+	if err != nil {

+		return nil, err

+	}

+

+	resp, err := NewCAClient(conn).GetUnlockKey(modCtx, r)

+	if err != nil {

+		if !strings.Contains(err.Error(), "is closing") && !strings.Contains(err.Error(), "the connection is unavailable") && !strings.Contains(err.Error(), "connection error") {

+			return resp, err

+		}

+		conn, err := p.pollNewLeaderConn(ctx)

+		if err != nil {

+			if err == raftselector.ErrIsLeader {

+				return p.local.GetUnlockKey(ctx, r)

+			}

+			return nil, err

+		}

+		return NewCAClient(conn).GetUnlockKey(modCtx, r)

+	}

+	return resp, err

+}

+

 type raftProxyNodeCAServer struct {

 	local        NodeCAServer

 	connSelector raftselector.ConnProvider

@@ -965,6 +1152,24 @@ func (m *GetRootCACertificateResponse) Size() (n int) {

 	return n

 }

+func (m *GetUnlockKeyRequest) Size() (n int) {

+	var l int

+	_ = l

+	return n

+}

+

+func (m *GetUnlockKeyResponse) Size() (n int) {

+	var l int

+	_ = l

+	l = len(m.UnlockKey)

+	if l > 0 {

+		n += 1 + l + sovCa(uint64(l))

+	}

+	l = m.Version.Size()

+	n += 1 + l + sovCa(uint64(l))

+	return n

+}

+

 func sovCa(x uint64) (n int) {

 	for {

 		n++

@@ -1041,6 +1246,26 @@ func (this *GetRootCACertificateResponse) String() string {

 	}, "")

 	return s

 }

+func (this *GetUnlockKeyRequest) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&GetUnlockKeyRequest{`,

+		`}`,

+	}, "")

+	return s

+}

+func (this *GetUnlockKeyResponse) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&GetUnlockKeyResponse{`,

+		`UnlockKey:` + fmt.Sprintf("%v", this.UnlockKey) + `,`,

+		`Version:` + strings.Replace(strings.Replace(this.Version.String(), "Version", "Version", 1), `&`, ``, 1) + `,`,

+		`}`,

+	}, "")

+	return s

+}

 func valueToStringCa(v interface{}) string {

 	rv := reflect.ValueOf(v)

 	if rv.IsNil() {

@@ -1602,6 +1827,167 @@ func (m *GetRootCACertificateResponse) Unmarshal(data []byte) error {

 	}

 	return nil

 }

+func (m *GetUnlockKeyRequest) Unmarshal(data []byte) error {

+	l := len(data)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowCa

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := data[iNdEx]

+			iNdEx++

+			wire |= (uint64(b) & 0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: GetUnlockKeyRequest: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: GetUnlockKeyRequest: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		default:

+			iNdEx = preIndex

+			skippy, err := skipCa(data[iNdEx:])

+			if err != nil {

+				return err

+			}

+			if skippy < 0 {

+				return ErrInvalidLengthCa

+			}

+			if (iNdEx + skippy) > l {

+				return io.ErrUnexpectedEOF

+			}

+			iNdEx += skippy

+		}

+	}

+

+	if iNdEx > l {

+		return io.ErrUnexpectedEOF

+	}

+	return nil

+}

+func (m *GetUnlockKeyResponse) Unmarshal(data []byte) error {

+	l := len(data)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowCa

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := data[iNdEx]

+			iNdEx++

+			wire |= (uint64(b) & 0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: GetUnlockKeyResponse: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: GetUnlockKeyResponse: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		case 1:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field UnlockKey", wireType)

+			}

+			var byteLen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowCa

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				byteLen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			if byteLen < 0 {

+				return ErrInvalidLengthCa

+			}

+			postIndex := iNdEx + byteLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.UnlockKey = append(m.UnlockKey[:0], data[iNdEx:postIndex]...)

+			if m.UnlockKey == nil {

+				m.UnlockKey = []byte{}

+			}

+			iNdEx = postIndex

+		case 2:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowCa

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				msglen |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			if msglen < 0 {

+				return ErrInvalidLengthCa

+			}

+			postIndex := iNdEx + msglen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			if err := m.Version.Unmarshal(data[iNdEx:postIndex]); err != nil {

+				return err

+			}

+			iNdEx = postIndex

+		default:

+			iNdEx = preIndex

+			skippy, err := skipCa(data[iNdEx:])

+			if err != nil {

+				return err

+			}

+			if skippy < 0 {

+				return ErrInvalidLengthCa

+			}

+			if (iNdEx + skippy) > l {

+				return io.ErrUnexpectedEOF

+			}

+			iNdEx += skippy

+		}

+	}

+

+	if iNdEx > l {

+		return io.ErrUnexpectedEOF

+	}

+	return nil

+}

 func skipCa(data []byte) (n int, err error) {

 	l := len(data)

 	iNdEx := 0

@@ -1710,36 +2096,42 @@ var (

 func init() { proto.RegisterFile("ca.proto", fileDescriptorCa) }

 var fileDescriptorCa = []byte{

-	// 493 bytes of a gzipped FileDescriptorProto

-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x94, 0xcf, 0x6e, 0xd3, 0x40,

-	0x10, 0xc6, 0xbb, 0x0e, 0xa4, 0x65, 0x52, 0x05, 0xb4, 0x04, 0x29, 0xa4, 0xa9, 0x53, 0x99, 0x03,

-	0x9c, 0x9c, 0xd6, 0x70, 0xe2, 0x44, 0x62, 0x24, 0x94, 0x03, 0x08, 0x6d, 0x1e, 0x00, 0xb9, 0xf6,

-	0x10, 0xac, 0x24, 0x5e, 0xe3, 0xdd, 0x80, 0xb8, 0x21, 0x81, 0x38, 0x70, 0x47, 0x70, 0xe2, 0x11,

-	0x78, 0x8e, 0x8a, 0x13, 0x47, 0x4e, 0x15, 0xf1, 0x03, 0x20, 0x1e, 0x01, 0xed, 0xda, 0x21, 0xfd,

-	0xb3, 0x89, 0xca, 0xc9, 0x3b, 0xb3, 0xf3, 0x7d, 0xfe, 0xed, 0x8c, 0xd7, 0xb0, 0x15, 0x06, 0x6e,

-	0x9a, 0x71, 0xc9, 0x29, 0x8d, 0x78, 0x38, 0xc6, 0xcc, 0x15, 0xaf, 0x83, 0x6c, 0x3a, 0x8e, 0xa5,

-	0xfb, 0xea, 0xa0, 0x55, 0x93, 0x6f, 0x52, 0x14, 0x45, 0x41, 0xab, 0x26, 0x52, 0x0c, 0x17, 0x41,

-	0x63, 0xc4, 0x47, 0x5c, 0x2f, 0xbb, 0x6a, 0x55, 0x66, 0xaf, 0xa7, 0x93, 0xd9, 0x28, 0x4e, 0xba,

-	0xc5, 0xa3, 0x48, 0x3a, 0x3e, 0xb4, 0x9f, 0xf0, 0x08, 0x7d, 0xcc, 0x64, 0xfc, 0x3c, 0x0e, 0x03,

-	0x89, 0x43, 0x19, 0xc8, 0x99, 0x60, 0xf8, 0x72, 0x86, 0x42, 0xd2, 0x5b, 0xb0, 0x99, 0xf0, 0x08,

-	0x9f, 0xc5, 0x51, 0x93, 0xec, 0x91, 0x3b, 0x57, 0xfa, 0x90, 0x1f, 0x77, 0xaa, 0x4a, 0x32, 0x78,

-	0xc8, 0xaa, 0x6a, 0x6b, 0x10, 0x39, 0x5f, 0x09, 0xec, 0xae, 0x70, 0x11, 0x29, 0x4f, 0x04, 0xd2,

-	0xfb, 0x50, 0x15, 0x3a, 0xa3, 0x5d, 0x6a, 0x9e, 0xe3, 0x9e, 0x3f, 0x90, 0x3b, 0x10, 0x62, 0x16,

-	0x24, 0xe1, 0x42, 0x5b, 0x2a, 0x68, 0x0f, 0x6a, 0xe1, 0xd2, 0xb8, 0x69, 0x69, 0x83, 0x8e, 0xc9,

-	0xe0, 0xc4, 0xfb, 0xd9, 0x49, 0x8d, 0xf3, 0x9e, 0xc0, 0x8e, 0x72, 0xc7, 0x33, 0x94, 0x8b, 0x53,

-	0xde, 0x83, 0x4b, 0x19, 0x9f, 0xa0, 0x86, 0xab, 0x7b, 0x6d, 0x93, 0xb7, 0x52, 0x32, 0x3e, 0xc1,

-	0xbe, 0xd5, 0x24, 0x4c, 0x57, 0xd3, 0x9b, 0x50, 0x09, 0x45, 0xa6, 0x81, 0xb6, 0xfb, 0x9b, 0xf9,

-	0x71, 0xa7, 0xe2, 0x0f, 0x19, 0x53, 0x39, 0xda, 0x80, 0xcb, 0x92, 0x8f, 0x31, 0x69, 0x56, 0x54,

-	0xd3, 0x58, 0x11, 0x38, 0x9f, 0x08, 0xb4, 0xcd, 0x18, 0x65, 0x9b, 0x2e, 0xd2, 0x6d, 0xfa, 0x14,

-	0xae, 0xea, 0xa2, 0x29, 0x4e, 0x0f, 0x31, 0x13, 0x2f, 0xe2, 0x54, 0x23, 0xd4, 0xbd, 0xdb, 0xab,

-	0xb8, 0x87, 0x29, 0x86, 0xee, 0xe3, 0x7f, 0xe5, 0xac, 0xae, 0xf4, 0xcb, 0xd8, 0xd9, 0x85, 0x9d,

-	0x47, 0x28, 0x19, 0xe7, 0xd2, 0xef, 0x9d, 0xef, 0x8e, 0xf3, 0x00, 0xda, 0xe6, 0xed, 0x92, 0x7a,

-	0xef, 0xf4, 0x80, 0x14, 0xf9, 0xf6, 0xa9, 0xfe, 0x7b, 0x1f, 0x09, 0x58, 0x7e, 0x8f, 0xbe, 0x23,

-	0xd0, 0x30, 0x39, 0xd1, 0xae, 0x89, 0x7c, 0x0d, 0x52, 0x6b, 0xff, 0xe2, 0x82, 0x02, 0xd2, 0xd9,

-	0xfa, 0xfe, 0xed, 0xf7, 0x17, 0xcb, 0xba, 0x46, 0xbc, 0xcf, 0x16, 0xe8, 0x96, 0x96, 0x40, 0xa6,

-	0x81, 0x98, 0x81, 0xd6, 0x7c, 0x41, 0x66, 0xa0, 0x75, 0xb3, 0x5e, 0x02, 0xd1, 0x0f, 0x04, 0x6e,

-	0x18, 0xaf, 0x0f, 0xdd, 0x5f, 0x35, 0xd1, 0x55, 0xf7, 0xb5, 0x75, 0xf0, 0x1f, 0x8a, 0xb3, 0x20,

-	0xfd, 0xf6, 0xd1, 0xdc, 0xde, 0xf8, 0x39, 0xb7, 0x37, 0xfe, 0xcc, 0x6d, 0xf2, 0x36, 0xb7, 0xc9,

-	0x51, 0x6e, 0x93, 0x1f, 0xb9, 0x4d, 0x7e, 0xe5, 0x36, 0x39, 0xac, 0xea, 0x3f, 0xc6, 0xdd, 0xbf,

-	0x01, 0x00, 0x00, 0xff, 0xff, 0xb3, 0xf8, 0x41, 0xef, 0x96, 0x04, 0x00, 0x00,

+	// 586 bytes of a gzipped FileDescriptorProto

+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x54, 0xcb, 0x6e, 0xd3, 0x40,

+	0x14, 0xcd, 0x38, 0x25, 0x69, 0x6f, 0x42, 0x8a, 0xa6, 0x89, 0x14, 0xf2, 0x70, 0x2a, 0xb3, 0x68,

+	0x37, 0x38, 0x6d, 0x60, 0x05, 0x1b, 0x92, 0x20, 0x55, 0x11, 0x02, 0x21, 0x47, 0xb0, 0xad, 0x5c,

+	0x67, 0x08, 0x56, 0x12, 0x8f, 0xf1, 0x8c, 0x0b, 0xd9, 0x21, 0x51, 0xf1, 0x07, 0x08, 0x56, 0x7c,

+	0x02, 0xdf, 0x11, 0xb1, 0x62, 0xc9, 0x2a, 0x22, 0xfe, 0x00, 0xc4, 0x27, 0x20, 0x8f, 0x6d, 0x9a,

+	0x87, 0x13, 0xda, 0x55, 0x3c, 0xd7, 0xe7, 0x9c, 0x7b, 0xee, 0xc9, 0xf5, 0xc0, 0xb6, 0xa1, 0xab,

+	0xb6, 0x43, 0x39, 0xc5, 0xb8, 0x47, 0x8d, 0x01, 0x71, 0x54, 0xf6, 0x56, 0x77, 0x46, 0x03, 0x93,

+	0xab, 0xe7, 0xc7, 0xa5, 0x0c, 0x1f, 0xdb, 0x84, 0x05, 0x80, 0x52, 0x86, 0xd9, 0xc4, 0x88, 0x0e,

+	0xf9, 0x3e, 0xed, 0x53, 0xf1, 0x58, 0xf7, 0x9f, 0xc2, 0xea, 0x9e, 0x3d, 0x74, 0xfb, 0xa6, 0x55,

+	0x0f, 0x7e, 0x82, 0xa2, 0xd2, 0x86, 0xca, 0x33, 0xda, 0x23, 0x6d, 0xe2, 0x70, 0xf3, 0x95, 0x69,

+	0xe8, 0x9c, 0x74, 0xb9, 0xce, 0x5d, 0xa6, 0x91, 0x37, 0x2e, 0x61, 0x1c, 0xdf, 0x81, 0xb4, 0x45,

+	0x7b, 0xe4, 0xd4, 0xec, 0x15, 0xd1, 0x3e, 0x3a, 0xdc, 0x69, 0x81, 0x37, 0xad, 0xa5, 0x7c, 0x4a,

+	0xe7, 0xb1, 0x96, 0xf2, 0x5f, 0x75, 0x7a, 0xca, 0x57, 0x04, 0xd5, 0x35, 0x2a, 0xcc, 0xa6, 0x16,

+	0x23, 0xf8, 0x01, 0xa4, 0x98, 0xa8, 0x08, 0x95, 0x4c, 0x43, 0x51, 0x57, 0x07, 0x52, 0x3b, 0x8c,

+	0xb9, 0xba, 0x65, 0x44, 0xdc, 0x90, 0x81, 0x9b, 0x90, 0x31, 0x2e, 0x85, 0x8b, 0x92, 0x10, 0xa8,

+	0xc5, 0x09, 0xcc, 0xf5, 0xd7, 0xe6, 0x39, 0xca, 0x05, 0x82, 0xb2, 0xaf, 0x4e, 0x96, 0x5c, 0x46,

+	0x53, 0xde, 0x87, 0x2d, 0x87, 0x0e, 0x89, 0x30, 0x97, 0x6b, 0x54, 0xe2, 0xb4, 0x7d, 0xa6, 0x46,

+	0x87, 0xa4, 0x25, 0x15, 0x91, 0x26, 0xd0, 0xf8, 0x36, 0x24, 0x0d, 0xe6, 0x08, 0x43, 0xd9, 0x56,

+	0xda, 0x9b, 0xd6, 0x92, 0xed, 0xae, 0xa6, 0xf9, 0x35, 0x9c, 0x87, 0x1b, 0x9c, 0x0e, 0x88, 0x55,

+	0x4c, 0xfa, 0xa1, 0x69, 0xc1, 0x41, 0xf9, 0x84, 0xa0, 0x12, 0x6f, 0x23, 0x8c, 0xe9, 0x2a, 0x69,

+	0xe3, 0xe7, 0xb0, 0x2b, 0x40, 0x23, 0x32, 0x3a, 0x23, 0x0e, 0x7b, 0x6d, 0xda, 0xc2, 0x42, 0xae,

+	0x71, 0xb0, 0xce, 0x77, 0xd7, 0x26, 0x86, 0xfa, 0xf4, 0x1f, 0x5c, 0xcb, 0xf9, 0xfc, 0xcb, 0xb3,

+	0x52, 0x85, 0xf2, 0x09, 0xe1, 0x1a, 0xa5, 0xbc, 0xdd, 0x5c, 0x4d, 0x47, 0x79, 0x04, 0x95, 0xf8,

+	0xd7, 0xa1, 0xeb, 0xfd, 0xc5, 0x3f, 0xc8, 0x77, 0x9e, 0x5d, 0xcc, 0xbf, 0x00, 0x7b, 0x27, 0x84,

+	0xbf, 0xb0, 0x86, 0xd4, 0x18, 0x3c, 0x21, 0xe3, 0x48, 0xd8, 0x81, 0xfc, 0x62, 0x39, 0x14, 0xac,

+	0x02, 0xb8, 0xa2, 0x78, 0x3a, 0x20, 0xe3, 0x50, 0x6f, 0xc7, 0x8d, 0x60, 0xf8, 0x21, 0xa4, 0xcf,

+	0x89, 0xc3, 0x4c, 0x6a, 0x85, 0xcb, 0x50, 0x8e, 0x1b, 0xfc, 0x65, 0x00, 0x69, 0x6d, 0x4d, 0xa6,

+	0xb5, 0x84, 0x16, 0x31, 0x1a, 0x17, 0x12, 0x48, 0xed, 0x26, 0xfe, 0x80, 0x44, 0xef, 0x95, 0xa1,

+	0x70, 0x3d, 0x4e, 0x6b, 0x43, 0x3a, 0xa5, 0xa3, 0xab, 0x13, 0x82, 0xf1, 0x94, 0xed, 0xef, 0xdf,

+	0x7e, 0x7f, 0x91, 0xa4, 0x5b, 0x08, 0xbf, 0x83, 0xec, 0x7c, 0x00, 0xf8, 0x60, 0x8d, 0xd6, 0x72,

+	0x72, 0xa5, 0xc3, 0xff, 0x03, 0xc3, 0x66, 0x05, 0xd1, 0x6c, 0x17, 0x6e, 0x0a, 0xe4, 0xdd, 0x91,

+	0x6e, 0xe9, 0x7d, 0xe2, 0x34, 0x3e, 0x4b, 0x20, 0xf6, 0x2a, 0x8c, 0x22, 0x6e, 0x2b, 0xe3, 0xa3,

+	0xd8, 0xf0, 0x19, 0xc5, 0x47, 0xb1, 0x69, 0xe1, 0xe7, 0xa2, 0xf8, 0x88, 0xa0, 0x10, 0x7b, 0x87,

+	0xe0, 0xa3, 0x75, 0x6b, 0xbd, 0xee, 0xd2, 0x2a, 0x1d, 0x5f, 0x83, 0xb1, 0x6c, 0xa4, 0x55, 0x99,

+	0xcc, 0xe4, 0xc4, 0xcf, 0x99, 0x9c, 0xf8, 0x33, 0x93, 0xd1, 0x7b, 0x4f, 0x46, 0x13, 0x4f, 0x46,

+	0x3f, 0x3c, 0x19, 0xfd, 0xf2, 0x64, 0x74, 0x96, 0x12, 0xd7, 0xe6, 0xbd, 0xbf, 0x01, 0x00, 0x00,

+	0xff, 0xff, 0xe7, 0x80, 0x3b, 0x00, 0x9b, 0x05, 0x00, 0x00,

 }

@@ -13,6 +13,11 @@ service CA {

 	rpc GetRootCACertificate(GetRootCACertificateRequest) returns (GetRootCACertificateResponse) {

 		option (docker.protobuf.plugin.tls_authorization) = { insecure: true };

 	};

+	// GetUnlockKey returns the current unlock key for the cluster for the role of the client

+	// asking.

+	rpc GetUnlockKey(GetUnlockKeyRequest) returns (GetUnlockKeyResponse) {

+		option (docker.protobuf.plugin.tls_authorization) = { roles: ["swarm-manager"] };

+	};

 }

 service NodeCA {

@@ -55,3 +60,10 @@ message GetRootCACertificateRequest {}

 message GetRootCACertificateResponse {

 	bytes certificate = 1;

 }

+

+message GetUnlockKeyRequest {}

+

+message GetUnlockKeyResponse {

+	bytes unlock_key = 1;

+	Version version = 2 [(gogoproto.nullable) = false];

+}

@@ -405,16 +405,19 @@ func (m *ListClustersResponse) Reset()                    { *m = ListClustersRes

 func (*ListClustersResponse) ProtoMessage()               {}

 func (*ListClustersResponse) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{35} }

-type JoinTokenRotation struct {

-	// RotateWorkerToken tells UpdateCluster to rotate the worker secret.

-	RotateWorkerToken bool `protobuf:"varint,1,opt,name=rotate_worker_token,json=rotateWorkerToken,proto3" json:"rotate_worker_token,omitempty"`

-	// RotateManagerSecret tells UpdateCluster to rotate the manager secret.

-	RotateManagerToken bool `protobuf:"varint,2,opt,name=rotate_manager_token,json=rotateManagerToken,proto3" json:"rotate_manager_token,omitempty"`

+// KeyRotation tells UpdateCluster what items to rotate

+type KeyRotation struct {

+	// WorkerJoinToken tells UpdateCluster to rotate the worker secret token.

+	WorkerJoinToken bool `protobuf:"varint,1,opt,name=worker_join_token,json=workerJoinToken,proto3" json:"worker_join_token,omitempty"`

+	// ManagerJoinToken tells UpdateCluster to rotate the manager secret token.

+	ManagerJoinToken bool `protobuf:"varint,2,opt,name=manager_join_token,json=managerJoinToken,proto3" json:"manager_join_token,omitempty"`

+	// ManagerUnlockKey tells UpdateCluster to rotate the manager unlock key

+	ManagerUnlockKey bool `protobuf:"varint,3,opt,name=manager_unlock_key,json=managerUnlockKey,proto3" json:"manager_unlock_key,omitempty"`

 }

-func (m *JoinTokenRotation) Reset()                    { *m = JoinTokenRotation{} }

-func (*JoinTokenRotation) ProtoMessage()               {}

-func (*JoinTokenRotation) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{36} }

+func (m *KeyRotation) Reset()                    { *m = KeyRotation{} }

+func (*KeyRotation) ProtoMessage()               {}

+func (*KeyRotation) Descriptor() ([]byte, []int) { return fileDescriptorControl, []int{36} }

 type UpdateClusterRequest struct {

 	// ClusterID is the cluster ID to update.

@@ -423,8 +426,8 @@ type UpdateClusterRequest struct {

 	ClusterVersion *Version `protobuf:"bytes,2,opt,name=cluster_version,json=clusterVersion" json:"cluster_version,omitempty"`

 	// Spec is the new spec to apply to the cluster.

 	Spec *ClusterSpec `protobuf:"bytes,3,opt,name=spec" json:"spec,omitempty"`

-	// Rotation contains flags for join token rotation

-	Rotation JoinTokenRotation `protobuf:"bytes,4,opt,name=rotation" json:"rotation"`

+	// Rotation contains flags for join token and unlock key rotation

+	Rotation KeyRotation `protobuf:"bytes,4,opt,name=rotation" json:"rotation"`

 }

 func (m *UpdateClusterRequest) Reset()                    { *m = UpdateClusterRequest{} }

@@ -598,7 +601,7 @@ func init() {

 	proto.RegisterType((*ListClustersRequest)(nil), "docker.swarmkit.v1.ListClustersRequest")

 	proto.RegisterType((*ListClustersRequest_Filters)(nil), "docker.swarmkit.v1.ListClustersRequest.Filters")

 	proto.RegisterType((*ListClustersResponse)(nil), "docker.swarmkit.v1.ListClustersResponse")

-	proto.RegisterType((*JoinTokenRotation)(nil), "docker.swarmkit.v1.JoinTokenRotation")

+	proto.RegisterType((*KeyRotation)(nil), "docker.swarmkit.v1.KeyRotation")

 	proto.RegisterType((*UpdateClusterRequest)(nil), "docker.swarmkit.v1.UpdateClusterRequest")

 	proto.RegisterType((*UpdateClusterResponse)(nil), "docker.swarmkit.v1.UpdateClusterResponse")

 	proto.RegisterType((*GetSecretRequest)(nil), "docker.swarmkit.v1.GetSecretRequest")

@@ -1459,14 +1462,15 @@ func (m *ListClustersResponse) Copy() *ListClustersResponse {

 	return o

 }

-func (m *JoinTokenRotation) Copy() *JoinTokenRotation {

+func (m *KeyRotation) Copy() *KeyRotation {

 	if m == nil {

 		return nil

 	}

-	o := &JoinTokenRotation{

-		RotateWorkerToken:  m.RotateWorkerToken,

-		RotateManagerToken: m.RotateManagerToken,

+	o := &KeyRotation{

+		WorkerJoinToken:  m.WorkerJoinToken,

+		ManagerJoinToken: m.ManagerJoinToken,

+		ManagerUnlockKey: m.ManagerUnlockKey,

 	}

 	return o

@@ -2199,14 +2203,15 @@ func (this *ListClustersResponse) GoString() string {

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

-func (this *JoinTokenRotation) GoString() string {

+func (this *KeyRotation) GoString() string {

 	if this == nil {

 		return "nil"

 	}

-	s := make([]string, 0, 6)

-	s = append(s, "&api.JoinTokenRotation{")

-	s = append(s, "RotateWorkerToken: "+fmt.Sprintf("%#v", this.RotateWorkerToken)+",\n")

-	s = append(s, "RotateManagerToken: "+fmt.Sprintf("%#v", this.RotateManagerToken)+",\n")

+	s := make([]string, 0, 7)

+	s = append(s, "&api.KeyRotation{")

+	s = append(s, "WorkerJoinToken: "+fmt.Sprintf("%#v", this.WorkerJoinToken)+",\n")

+	s = append(s, "ManagerJoinToken: "+fmt.Sprintf("%#v", this.ManagerJoinToken)+",\n")

+	s = append(s, "ManagerUnlockKey: "+fmt.Sprintf("%#v", this.ManagerUnlockKey)+",\n")

 	s = append(s, "}")

 	return strings.Join(s, "")

 }

@@ -4734,7 +4739,7 @@ func (m *ListClustersResponse) MarshalTo(data []byte) (int, error) {

 	return i, nil

 }

-func (m *JoinTokenRotation) Marshal() (data []byte, err error) {

+func (m *KeyRotation) Marshal() (data []byte, err error) {

 	size := m.Size()

 	data = make([]byte, size)

 	n, err := m.MarshalTo(data)

@@ -4744,25 +4749,35 @@ func (m *JoinTokenRotation) Marshal() (data []byte, err error) {

 	return data[:n], nil

 }

-func (m *JoinTokenRotation) MarshalTo(data []byte) (int, error) {

+func (m *KeyRotation) MarshalTo(data []byte) (int, error) {

 	var i int

 	_ = i

 	var l int

 	_ = l

-	if m.RotateWorkerToken {

+	if m.WorkerJoinToken {

 		data[i] = 0x8

 		i++

-		if m.RotateWorkerToken {

+		if m.WorkerJoinToken {

 			data[i] = 1

 		} else {

 			data[i] = 0

 		}

 		i++

 	}

-	if m.RotateManagerToken {

+	if m.ManagerJoinToken {

 		data[i] = 0x10

 		i++

-		if m.RotateManagerToken {

+		if m.ManagerJoinToken {

+			data[i] = 1

+		} else {

+			data[i] = 0

+		}

+		i++

+	}

+	if m.ManagerUnlockKey {

+		data[i] = 0x18

+		i++

+		if m.ManagerUnlockKey {

 			data[i] = 1

 		} else {

 			data[i] = 0

@@ -6618,13 +6633,16 @@ func (m *ListClustersResponse) Size() (n int) {

 	return n

 }

-func (m *JoinTokenRotation) Size() (n int) {

+func (m *KeyRotation) Size() (n int) {

 	var l int

 	_ = l

-	if m.RotateWorkerToken {

+	if m.WorkerJoinToken {

+		n += 2

+	}

+	if m.ManagerJoinToken {

 		n += 2

 	}

-	if m.RotateManagerToken {

+	if m.ManagerUnlockKey {

 		n += 2

 	}

 	return n

@@ -7294,13 +7312,14 @@ func (this *ListClustersResponse) String() string {

 	}, "")

 	return s

 }

-func (this *JoinTokenRotation) String() string {

+func (this *KeyRotation) String() string {

 	if this == nil {

 		return "nil"

 	}

-	s := strings.Join([]string{`&JoinTokenRotation{`,

-		`RotateWorkerToken:` + fmt.Sprintf("%v", this.RotateWorkerToken) + `,`,

-		`RotateManagerToken:` + fmt.Sprintf("%v", this.RotateManagerToken) + `,`,

+	s := strings.Join([]string{`&KeyRotation{`,

+		`WorkerJoinToken:` + fmt.Sprintf("%v", this.WorkerJoinToken) + `,`,

+		`ManagerJoinToken:` + fmt.Sprintf("%v", this.ManagerJoinToken) + `,`,

+		`ManagerUnlockKey:` + fmt.Sprintf("%v", this.ManagerUnlockKey) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -7313,7 +7332,7 @@ func (this *UpdateClusterRequest) String() string {

 		`ClusterID:` + fmt.Sprintf("%v", this.ClusterID) + `,`,

 		`ClusterVersion:` + strings.Replace(fmt.Sprintf("%v", this.ClusterVersion), "Version", "Version", 1) + `,`,

 		`Spec:` + strings.Replace(fmt.Sprintf("%v", this.Spec), "ClusterSpec", "ClusterSpec", 1) + `,`,

-		`Rotation:` + strings.Replace(strings.Replace(this.Rotation.String(), "JoinTokenRotation", "JoinTokenRotation", 1), `&`, ``, 1) + `,`,

+		`Rotation:` + strings.Replace(strings.Replace(this.Rotation.String(), "KeyRotation", "KeyRotation", 1), `&`, ``, 1) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -11855,7 +11874,7 @@ func (m *ListClustersResponse) Unmarshal(data []byte) error {

 	}

 	return nil

 }

-func (m *JoinTokenRotation) Unmarshal(data []byte) error {

+func (m *KeyRotation) Unmarshal(data []byte) error {

 	l := len(data)

 	iNdEx := 0

 	for iNdEx < l {

@@ -11878,15 +11897,15 @@ func (m *JoinTokenRotation) Unmarshal(data []byte) error {

 		fieldNum := int32(wire >> 3)

 		wireType := int(wire & 0x7)

 		if wireType == 4 {

-			return fmt.Errorf("proto: JoinTokenRotation: wiretype end group for non-group")

+			return fmt.Errorf("proto: KeyRotation: wiretype end group for non-group")

 		}

 		if fieldNum <= 0 {

-			return fmt.Errorf("proto: JoinTokenRotation: illegal tag %d (wire type %d)", fieldNum, wire)

+			return fmt.Errorf("proto: KeyRotation: illegal tag %d (wire type %d)", fieldNum, wire)

 		}

 		switch fieldNum {

 		case 1:

 			if wireType != 0 {

-				return fmt.Errorf("proto: wrong wireType = %d for field RotateWorkerToken", wireType)

+				return fmt.Errorf("proto: wrong wireType = %d for field WorkerJoinToken", wireType)

 			}

 			var v int

 			for shift := uint(0); ; shift += 7 {

@@ -11903,10 +11922,30 @@ func (m *JoinTokenRotation) Unmarshal(data []byte) error {

 					break

 				}

 			}

-			m.RotateWorkerToken = bool(v != 0)

+			m.WorkerJoinToken = bool(v != 0)

 		case 2:

 			if wireType != 0 {

-				return fmt.Errorf("proto: wrong wireType = %d for field RotateManagerToken", wireType)

+				return fmt.Errorf("proto: wrong wireType = %d for field ManagerJoinToken", wireType)

+			}

+			var v int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowControl

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := data[iNdEx]

+				iNdEx++

+				v |= (int(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			m.ManagerJoinToken = bool(v != 0)

+		case 3:

+			if wireType != 0 {

+				return fmt.Errorf("proto: wrong wireType = %d for field ManagerUnlockKey", wireType)

 			}

 			var v int

 			for shift := uint(0); ; shift += 7 {

@@ -11923,7 +11962,7 @@ func (m *JoinTokenRotation) Unmarshal(data []byte) error {

 					break

 				}

 			}

-			m.RotateManagerToken = bool(v != 0)

+			m.ManagerUnlockKey = bool(v != 0)

 		default:

 			iNdEx = preIndex

 			skippy, err := skipControl(data[iNdEx:])

@@ -13413,117 +13452,117 @@ var (

 func init() { proto.RegisterFile("control.proto", fileDescriptorControl) }

 var fileDescriptorControl = []byte{

-	// 1777 bytes of a gzipped FileDescriptorProto

-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xcc, 0x5a, 0xcf, 0x6f, 0xdb, 0xc6,

-	0x12, 0x8e, 0x24, 0xdb, 0xb2, 0x47, 0x96, 0x13, 0xaf, 0x95, 0x3c, 0x81, 0xc9, 0x93, 0x03, 0xe6,

-	0xc5, 0x91, 0x81, 0x3c, 0x39, 0x4f, 0x79, 0x41, 0xd3, 0x14, 0xfd, 0x65, 0xbb, 0x71, 0x95, 0x1f,

-	0x6e, 0x40, 0x27, 0x6d, 0x6f, 0x86, 0x2c, 0x6d, 0x5c, 0x56, 0xb2, 0xa8, 0x92, 0xb4, 0x93, 0xa0,

-	0x97, 0x16, 0x68, 0x81, 0xfe, 0x09, 0xbd, 0xf6, 0xda, 0x02, 0x3d, 0xf7, 0xd6, 0x6b, 0xd0, 0x53,

-	0x8f, 0x3d, 0x19, 0x8d, 0x80, 0x02, 0x3d, 0x15, 0xfd, 0x0b, 0x8a, 0x62, 0x77, 0x67, 0x49, 0x8a,

-	0x5a, 0x92, 0x92, 0xe5, 0xc2, 0x39, 0x99, 0x5c, 0x7e, 0xb3, 0x33, 0xbb, 0xf3, 0xed, 0xa7, 0xd9,

-	0x81, 0x21, 0xdf, 0xb0, 0x3a, 0xae, 0x6d, 0xb5, 0x2b, 0x5d, 0xdb, 0x72, 0x2d, 0x42, 0x9a, 0x56,

-	0xa3, 0x45, 0xed, 0x8a, 0xf3, 0xa4, 0x6e, 0xef, 0xb5, 0x4c, 0xb7, 0x72, 0xf0, 0x3f, 0x2d, 0xe7,

-	0x74, 0x69, 0xc3, 0x11, 0x00, 0x2d, 0x6f, 0xed, 0x7c, 0x4c, 0x1b, 0xae, 0x7c, 0xcd, 0xb9, 0xcf,

-	0xba, 0x54, 0xbe, 0x14, 0x76, 0xad, 0x5d, 0x8b, 0x3f, 0xae, 0xb0, 0x27, 0x1c, 0x5d, 0xe8, 0xb6,

-	0xf7, 0x77, 0xcd, 0xce, 0x8a, 0xf8, 0x23, 0x06, 0xf5, 0x1b, 0x30, 0xb7, 0x41, 0xdd, 0x4d, 0xab,

-	0x49, 0x0d, 0xfa, 0xc9, 0x3e, 0x75, 0x5c, 0x72, 0x09, 0xb2, 0x1d, 0xab, 0x49, 0xb7, 0xcd, 0x66,

-	0x31, 0x75, 0x31, 0x55, 0x9e, 0x59, 0x85, 0xde, 0xe1, 0xe2, 0x14, 0x43, 0xd4, 0xd6, 0x8d, 0x29,

-	0xf6, 0xa9, 0xd6, 0xd4, 0xdf, 0x84, 0xd3, 0x9e, 0x99, 0xd3, 0xb5, 0x3a, 0x0e, 0x25, 0x57, 0x61,

-	0x82, 0x7d, 0xe4, 0x46, 0xb9, 0x6a, 0xb1, 0x32, 0xb8, 0x80, 0x0a, 0xc7, 0x73, 0x94, 0x7e, 0x98,

-	0x81, 0x33, 0xf7, 0x4c, 0x87, 0x4f, 0xe1, 0x48, 0xd7, 0xb7, 0x21, 0xfb, 0xd8, 0x6c, 0xbb, 0xd4,

-	0x76, 0x70, 0x96, 0xab, 0xaa, 0x59, 0xc2, 0x66, 0x95, 0xdb, 0xc2, 0xc6, 0x90, 0xc6, 0xda, 0xe7,

-	0x19, 0xc8, 0xe2, 0x20, 0x29, 0xc0, 0x64, 0xa7, 0xbe, 0x47, 0xd9, 0x8c, 0x99, 0xf2, 0x8c, 0x21,

-	0x5e, 0xc8, 0x0a, 0xe4, 0xcc, 0xe6, 0x76, 0xd7, 0xa6, 0x8f, 0xcd, 0xa7, 0xd4, 0x29, 0xa6, 0xd9,

-	0xb7, 0xd5, 0xb9, 0xde, 0xe1, 0x22, 0xd4, 0xd6, 0x1f, 0xe0, 0xa8, 0x01, 0x66, 0x53, 0x3e, 0x93,

-	0x07, 0x30, 0xd5, 0xae, 0xef, 0xd0, 0xb6, 0x53, 0xcc, 0x5c, 0xcc, 0x94, 0x73, 0xd5, 0x9b, 0xa3,

-	0x44, 0x56, 0xb9, 0xc7, 0x4d, 0xdf, 0xe9, 0xb8, 0xf6, 0x33, 0x03, 0xe7, 0x21, 0x35, 0xc8, 0xed,

-	0xd1, 0xbd, 0x1d, 0x6a, 0x3b, 0x1f, 0x99, 0x5d, 0xa7, 0x38, 0x71, 0x31, 0x53, 0x9e, 0xab, 0x5e,

-	0x89, 0xda, 0xb6, 0xad, 0x2e, 0x6d, 0x54, 0xee, 0x7b, 0x78, 0x23, 0x68, 0x4b, 0xaa, 0x30, 0x69,