Update Vault-Takeout.md

Co-authored-by: jay0lee <4623536+jay0lee@users.noreply.github.com>

.github/workflows/build.yml

@@ -165,7 +165,7 @@ jobs:
         with:
           path: |
             cache.tar.xz
-          key: gam-${{ matrix.jid }}-20260508
+          key: gam-${{ matrix.jid }}-20260611
 
       - name: Untar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit == 'true'
@@ -713,16 +713,16 @@ jobs:
           write-host "sleeping during login..."
           Start-Sleep 10
 
-#      - name: Archive artifacts
+      - name: Archive artifacts
-#        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
-#        if: runner.os == 'Windows'
+        if: runner.os == 'Windows'
-#        with:
+        with:
-#          archive: true
+          archive: true
-#          name: images-${{ matrix.os }}
+          name: images-${{ matrix.os }}
-#          if-no-files-found: ignore
+          if-no-files-found: ignore
-#          path: |
+          path: |
-#            ${{ github.workspace }}/*.png
+            ${{ github.workspace }}/*.png
-#            ${{ github.workspace }}/*.log
+            ${{ github.workspace }}/*.log
 
       - name: Sign gam.exe
         if: runner.os == 'Windows'

pyproject.toml

@@ -10,15 +10,15 @@ authors = [
 dependencies = [
     "arrow==1.4.0",
     "chardet==7.4.3",
-    "cryptography==47.0.0",
+    "cryptography==48.0.0",
     "distro==1.9.0 ; sys_platform=='linux'",
     "filelock==3.29.0",
-    "google-api-python-client==2.195.0",
+    "google-api-python-client==2.197.0",
-    "google-auth-httplib2==0.3.1",
+    "google-auth-httplib2==0.4.0",
-    "google-auth-oauthlib==1.3.1",
+    "google-auth-oauthlib==1.4.0",
-    "google-auth==2.50.0",
+    "google-auth==2.53.0",
     "httplib2==0.31.2",
-    "lxml==6.1.0",
+    "lxml==6.1.1",
     "passlib==1.7.4",
     "pathvalidate==3.3.1",
     "pysocks==1.7.1",

src/GamCommands.txt

@@ -270,7 +270,7 @@ If an item contains spaces, it should be surrounded by ".
         assuredcontrolsplus | 1010390002 | Assured Controls Plus |
         bce | beyondcorp | beyondcorpenterprise | cep | chromeenterprisepremium | 1010400001 | Chrome Enterprise Premium |
         cdm | chrome | googlechromedevicemanagement | Google-Chrome-Device-Management |
-        cloudidentity | identity | 1010010001 | Cloud Identity |
+        cloudidentityfree | cloudidentity | identity | 1010010001 | Cloud Identity Free |
         cloudidentitypremium | identitypremium | 1010050001 | Cloud Identity Premium |
         cloudsearch | 1010350001 | Cloud Search |
         colabpro | 1010500001 | Colab Pro |
@@ -560,9 +560,9 @@ If an item contains spaces, it should be surrounded by ".
         See: https://cloud.google.com/access-context-manager/docs/custom-access-level-spec
 <QueryContact> ::= <String>
         See: https://developers.google.com/google-apps/contacts/v3/reference#contacts-query-parameters-reference
-<QueryCrOS> ::= <String>
+<QueryCrOS> ::= <String>:<String>
         See: https://support.google.com/chrome/a/answer/1698333
-<QueryDevice> ::= <String>
+<QueryDevice> ::= <String>:<String>
         See: https://support.google.com/a/answer/7549103
 <QueryDriveFile> ::= <String>
         See: https://developers.google.com/drive/api/v3/search-files
@@ -575,7 +575,7 @@ If an item contains spaces, it should be surrounded by ".
 <QueryItem> ::= <UniqueID>|<String>
 <QueryMemberRestrictions> ::= <String>
         See: https://cloud.google.com/identity/docs/reference/rest/v1beta1/SecuritySettings#MemberRestriction
-<QueryMobile> ::= <String>
+<QueryMobile> ::= <String>:<String>
         See: https://support.google.com/a/answer/7549103
 <QueryTeamDrive> ::= <String>
         See: https://developers.google.com/drive/api/v3/search-parameters
@@ -1618,7 +1618,8 @@ gam print alias|aliases [todrive <ToDriveAttribute>*]
          [limittoou <OrgUnitItem>])
         [user|users <EmailAddressList>] [group|groups <EmailAddressList>]
         [select <UserTypeEntity>]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        [issuspended [<Boolean>]] [isarchived [<Boolean>]]
+        [aliasmatchpattern <REMatchPattern>]
         [shownoneditable] [nogroups] [nousers]
         [onerowpertarget] [delimiter <Character>]
         [suppressnoaliasrows]
@@ -1665,11 +1666,15 @@ gam <UserTypeEntity> show analyticdatastreams
 <CalendarEntity> ::=
         <CalendarList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 
-<CalendarACLRole> ::= editor|freebusy|freebusyreader|owner|reader|writer|none
+<CalendarACLRole> ::=
-<CalendarACLScope> ::= <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|domain:<DomainName>|domain|default
+         editor|freebusy|freebusyreader|owner|reader|writer|writerwithoutprivateaccess|none
-<CalendarACLScopeList> ::= "<CalendarACLScope>(,<CalendarACLScope>)*"
+<CalendarACLScope> ::=
-<CalendarACLScopeEntity> ::=
+        <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|
-        <CalendarACLScopeList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+        domain:<DomainName>|domain|default
+<CalendarACLScopeList> ::=
+        "<CalendarACLScope>(,<CalendarACLScope>)*"
+<CalendarACLScopeEntity>::=
+        <CalendarACLScopeList> | <FileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 
 gam calendars <CalendarEntity> create|add acls|calendaracls <CalendarACLRole> <CalendarACLScopeEntity> [sendnotifications <Boolean>]
 gam calendars <CalendarEntity> update acls|calendaracls <CalendarACLRole> <CalendarACLScopeEntity> [sendnotifications <Boolean>]
@@ -2511,6 +2516,7 @@ gam <CrOSTypeEntity> update <CrOSAttribute>+ [quickcrosmove [<Boolean>]] [nobatc
         autoupdateexpiration|
         autoupdatethrough|
         backlightinfo|
+        bluetoothadapterinfo|
         bootmode|
         chromeostype|
         cpuinfo|
@@ -2544,6 +2550,7 @@ gam <CrOSTypeEntity> update <CrOSAttribute>+ [quickcrosmove [<Boolean>]] [nobatc
         orgunitpath|org|ou|
         osupdatestatus|
         osversion|
+        osversioncompliance|
         platformversion|
         recentusers|
         screenshotfiles|
@@ -2725,25 +2732,30 @@ gam <CrOSTypeEntity> get devicefile [select <DeviceFileEntity>] [targetfolder <F
 Print telemetry data for specified CrOS devices.
 
 <CrOSTelemetryFieldName> ::=
+        appreport|
         audiostatusreport|
         batteryinfo|
         batterystatusreport|
-        bootPerformancereport|
+        bootperformancereport|
         cpuinfo|
         cpustatusreport|
         customer|
         deviceid|
         graphicsinfo|
         graphicsstatusreport|
+        heartbeatstatusreport|
+        kioskappstatusreport|
         memoryinfo|
         memorystatusreport|
         name|
+        networkbandwidthreport|
         networkdiagnosticsreport|
         networkinfo|
         networkstatusreport|
         orgunitid|
         osupdatestatus|
         peripheralsreport|
+        runtimecountersreport|
         serialnumber|
         storageinfo|
         storagestatusreport|
@@ -2751,20 +2763,22 @@ Print telemetry data for specified CrOS devices.
 <CrOSTelemetryFieldNameList> ::= "<CrOSTelemetryFieldName>(,<CrOSTelemetryFieldName>)*"
 
 <CrOSTelemetryListFieldName> ::=
+        appreport|
         audiostatusreport|
-        batteryinfo|
         batterystatusreport|
         bootperformancereport|
-        cpuinfo|
         cpustatusreport|
         graphicsstatusreport|
+        heartbeatstatusreport|
+        kioskappstatusreport|
         memorystatusreport|
+        networkbandwidthreport|
         networkdiagnosticsreport|
         networkstatusreport|
         osupdatestatus|
         peripheralsreport|
-        storagestatusreport|
+        runtimecountersreport|
-        thunderboltinfo
+        storagestatusreport
 <CrOSTelemetryListFieldNameList> ::= "<CrOSTelemetryListFieldName>(,<CrOSTelemetryLIstFieldName>)*"
 
 gam info crostelemetry <SerialNumber>
@@ -2781,7 +2795,7 @@ gam show crostelemetry
 gam print crostelemetry [todrive <ToDriveAttribute>*]
         [(ou|org|orgunit|ou_and_children <OrgUnitItem>)|(cros_sn <SerialNumber>)|(filter <String>)]
         <CrOSTelemetryFieldName>* [fields <CrOSTelemetryFieldNameList>]
-        [reverselists <CrOSTelemetryListFieldNameList>]
+        [reverselists <CrOSTelemetryListFieldNameList>] [oneitemperrow]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [formatjson [quotechar <Character>]]
 
@@ -4364,6 +4378,14 @@ gam show policies
         [group <REMatchPattern>] [ou|org|orgunit <REMatchPattern>]
         [formatjson]
 
+gam create policy
+        json <JSONData>
+        [(ou|orgunit <OrgUnitItem>)|(group <GroupItem>)|(query <String>)]
+gam update policy
+        json <JSONData>
+        [(ou|orgunit <OrgUnitItem>)|(group <GroupItem>)|(query <String>)]
+gam delete policies <CIPolicyNameEntity>
+
 # Inbound SSO
 
 <SSOProfileDisplayName> ::= <String>
@@ -4885,10 +4907,15 @@ gam print resources [todrive <ToDriveAttribute>*] [allfields|<ResourceFieldName>
         [formatjson [quotechar <Character>]]
         [showitemcountonly]
 
-<CalendarACLRole> ::= editor|freebusy|freebusyreader|owner|reader|writer|none
+<CalendarACLRole> ::=
-<CalendarACLScope> ::= <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|domain:<DomainName>|domain|default
+         editor|freebusy|freebusyreader|owner|reader|writer|writerwithoutprivateaccess|none
-<CalendarACLScopeList> ::= "<CalendarACLScope>(,<CalendarACLScope>)*"
+<CalendarACLScope> ::=
-<CalendarACLScopeEntity> ::= <CalendarACLScopeList> | <FileSelector> | <CSVFileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+        <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|
+        domain:<DomainName>|domain|default
+<CalendarACLScopeList> ::=
+        "<CalendarACLScope>(,<CalendarACLScope>)*"
+<CalendarACLScopeEntity>::=
+        <CalendarACLScopeList> | <FileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 
 gam resource <ResourceID> create|add acls|calendaracls <CalendarACLRole> <CalendarACLScopeEntity> [sendnotifications <Boolean>]
 gam resource <ResourceID> update acls|calendaracls <CalendarACLRole> <CalendarACLScopeEntity> [sendnotifications <Boolean>]
@@ -6012,7 +6039,9 @@ gam print users [todrive <ToDriveAttribute>*]
         (filtermultiattrcustom <UserMultiAttributeFilterName> <String>)*
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        ([issuspended [<Boolean>]] [isarchived [<Boolean>]])|(isdisabled [<Boolean>])]
+        [disabledafter <DateTime>] [disabledbefore <DateTime>]
+        [aliasmatchpattern <REMatchPattern>]
         [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
@@ -6031,7 +6060,9 @@ gam print users [todrive <ToDriveAttribute>*] select <UserTypeEntity>
         (filtermultiattrcustom <UserMultiAttributeFilterName> <String>)*
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        ([issuspended [<Boolean>]] [isarchived [<Boolean>]])|(isdisabled [<Boolean>])]
+        [disabledafter <DateTime>] [disabledbefore <DateTime>]
+        [aliasmatchpattern <REMatchPattern>]
         [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
@@ -6048,7 +6079,9 @@ gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         (filtermultiattrcustom <UserMultiAttributeFilterName> <String>)*
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        ([issuspended [<Boolean>]] [isarchived [<Boolean>]])|(isdisabled [<Boolean>])]
+        [disabledafter <DateTime>] [disabledbefore <DateTime>]
+        [aliasmatchpattern <REMatchPattern>]
         [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
         [showitemcountonly]
 
@@ -6117,7 +6150,8 @@ gam <UserTypeEntity> print businessprofileaccounts [todrive <ToDriveAttribute>*]
 
 # Users - Calendars
 
-<CalendarACLRole> ::= editor|freebusy|freebusyreader|owner|reader|writer
+<CalendarACLRole> ::=
+         editor|freebusy|freebusyreader|owner|reader|writer|writerwithoutprivateaccess|none
 
 <CalendarSelectProperty> ::=
         (minaccessrole <CalendarACLRole>)|
@@ -6768,13 +6802,41 @@ gam <UserTypeEntity> info chatmessage name <ChatMessage>
         [formatjson]
 gam <UserTypeEntity> show chatmessages
         <ChatSpace>+
-        [showdeleted [<Boolean>]] [filter <String>]
+        [showdeleted [<Boolean>]
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
         [fields <ChatMessageFieldNameList>]
+        [orderby createtime [ascending|descending]]
         [formatjson]
 gam <UserTypeEntity> print chatmessages [todrive <ToDriveAttribute>*]
         <ChatSpace>+
-        [showdeleted [<Boolean>]] [filter <String>]
+        [showdeleted [<Boolean>]
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [thread <ChatThread>])
         [fields <ChatMessageFieldNameList>]
+        [orderby createtime [ascending|descending]]
+        [formatjson [quotechar <Character>]]
+
+gam <UserTypeEntity> show chatsearchmessages
+        keywords <StringList>
+        <ChatSpace>*
+        [displaynames [all|any] <StringList>]
+        [senders <EmailAddressEntity>]*
+        [usermentions [all|any] <EmailAddressEntity>]*
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [hasattachment]
+        [fields <ChatMessageFieldNameList>]
+        [orderby createtime|relevance]
+        [formatjson]
+gam <UserTypeEntity> print chatsearchmessages [todrive <ToDriveAttribute>*]
+        keywords <StringList>
+        <ChatSpace>*
+        [displaynames [all|any] <StringList>]
+        [senders <EmailAddressEntity>]*
+        [usermentions [all|any] <EmailAddressEntity>]*
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [hasattachment]
+        [fields <ChatMessageFieldNameList>]
+        [orderby createtime|relevance]
         [formatjson [quotechar <Character>]]
 
 gam <UserTypeEntity> info chatevent name <ChatEvent>
@@ -7004,6 +7066,7 @@ gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileNam
         [copysubfolderpermissions [<Boolean>]]
         [copysubfolderinheritedpermissions [<Boolean>]]
         [copysubfoldernoniheritedpermissions never|always|syncallfolders|syncupdatedfolders]
+        [movefilepermissions [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
         (mappermissionsemail <EmailAddress> <EmailAddress>)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
@@ -8031,12 +8094,12 @@ gam <UserTypeEntity> export thread|threads
          [quick|notquick] [doit] [max_to_export <Number>])|(ids <ThreadIDEntity>)
         [targetfolder <FilePath>] [targetname <FileName>] [overwrite [<Boolean>]]
 
-gam <UserTypeEntity> forward message|messages recipient|to <RecipientEntity>
+gam <UserTypeEntity> forward message|messages [recipient|to] <RecipientEntity>
         (((query <QueryGmail> [querytime<String> <Date>]*) (matchlabel <LabelName>) [or|and])+
          [labelids <LabelIDList>]
          [quick|notquick] [doit] [max_to_forward <Number>])|(ids <MessageIDEntity>)
         [subject <String>] [addorigfieldstosubject [<Boolean>]] [altcharset <String>]
-gam <UserTypeEntity> forward thread|thtreads recipient|to <RecipientEntity>
+gam <UserTypeEntity> forward thread|thtreads [recipient|to] <RecipientEntity>
         (((query <QueryGmail> [querytime<String> <Date>]*) (matchlabel <LabelName>) [or|and])+
          [labelids <LabelIDList>]
          quick|notquick] [doit] [max_to_forward <Number>])|(ids <ThreadIDEntity>)

src/GamUpdate.txt

@@ -1,3 +1,104 @@
+7.46.01
+
+Fixed bug in `gam <CrOSTypeEntity> issuecommand command <CrOSCommand> ... csv` where
+command execution status lines were improperly indented.
+
+Upgraded to Python 3.14.6.
+
+7.46.00
+
+Added commands to create, update and delete Cloud Identity policies for data loss prevention (DLP) rules and detectors.
+
+* See: https://github.com/GAM-team/GAM/wiki/Cloud-Identity-Policies
+* See: https://workspaceupdates.googleblog.com/2026/06/introducing-workspace-policy-api-mutate-endpoints-for-DLP.html
+
+7.45.00
+
+Added options `isdisabled [<Boolean>]`, `disabledafter <DateTime>` and  `disabledbefore <DateTime>`
+to `gam print users`. These options along with `issuspended [<Boolean>]` and `isarchived [<Boolean>]`
+are useful when identifying users to deprovision.
+
+Added option `movefilepermissions [<Boolean>]]` to `gam <UserTypeEntity> move drivefile` that, when False,
+causes GAM to remove ACLs from a file before moving it; this will be most useful when moving files to
+Shared Drives so that only the Shared Drive ACls apply. When not specified or set True, file permissions
+are not removed; this is the current GAM behavior.
+
+Upgraded to OpenSSL 4.0.1.
+
+7.44.03
+
+Added `writerwithoutprivateaccess` to `<CalendarACLRole>`; this will become effective 2026-06-29.
+* See: https://developers.google.com/workspace/calendar/release-notes#June_01_2026
+
+7.44.02
+
+Added fields `bluetoothadapterinfo` and `osversioncompliance` to `<CrOSFieldName>` for use
+in `gam info|print cros`.
+
+7.44.01
+
+Added option `oneitemperrow` to `gam print crostelemetry` to have each of a device's
+report field entries displayed on a separate row with all of the other device fields.
+
+Added additional fields to `<CrOSTelemetryFieldName>`and `<CrOSTelemetryListFieldName>`:
+```
+appreport
+heartbeatstatusreport
+kioskappstatusreport
+networkbandwidthreport
+runtimecountersreport
+```
+
+7.44.00
+
+Added support for User data `archivalTime` and `suspensionTime` that is available
+when fields `archived` and `suspended` are requested in `gam info user` and `gam print users`.
+
+Added the following options to `gam <UserTypeEntity> show chatmessages` to simplify specifying a filter.
+```
+start|starttime <Date>|<Time>
+end|endtime <Date>|<Time>
+range <Date>|<Time> <Date>|<Time>
+thread <ChatThread>
+```
+
+Added commands to search for and display chat messages.
+* See: https://github.com/GAM-team/GAM/wiki/Users-Chat#display-chat-messages-by-searching
+
+These commands are in Developer Preview; to use them you must have these values set in `gam.cfg`.
+```
+developer_preview_apis = chat
+developer_preview_api_key = <DeveloperPreviewKey>
+```
+
+Upgraded to Python 3.14.5.
+
+7.43.10
+
+Updated `gam <UserTypeEntity> forward message|thread [recipient|to] <RecipientEntity>` to not forward messages
+to the `Bcc` recipients of the original message.
+
+Fixed bug in `gam <UserTypeEntity> forward message|thread [recipient|to] <RecipientEntity> addorigfieldstosubject`
+where the recipient of the forwarded message was added to the subject line instead of the recipient of the original message.
+
+7.43.09
+
+Fixed bug in `gam <UserTypeEntity> print filelist` that caused a trap.
+
+7.43.08
+
+Fixed bug and formatting issues in `gam info device <DeviceEntity>`.
+
+7.43.07
+
+Improved validation of `<QueryCrOS>`, `<QueryDevice>` and `<QueryMobile>`.
+
+7.43.06
+
+Updated commands that use `<QueryCrOS>`, `<QueryDevice>` or `<QueryMobile>` to validate
+that it is of the form `field:value` and that `value` does not contain a '?'.
+Without validation, Google can return many more devices than are expected.
+
 7.43.05
 
 Added option `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` to `<EventMatchProperty>`

src/gam/cacerts.pem

@@ -67,35 +67,149 @@ tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1
 /q4AaOeMSQ+2b1tbFfLn
 -----END CERTIFICATE-----
 
-# Operating CA: DigiCert
+# Operating CA: Google Trust Services LLC
-# Issuer: CN=DigiCert Assured ID Root CA O=DigiCert Inc OU=www.digicert.com
+# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R1
-# Subject: CN=DigiCert Assured ID Root CA O=DigiCert Inc OU=www.digicert.com
+# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
-# Label: "DigiCert Assured ID Root CA"
+# Label: "GTS Root R1"
-# Serial: 17154717934120587862167794914071425081
+# Serial: 0203E5936F31B01349886BA217
-# MD5 Fingerprint: 87:ce:0b:7b:2a:0e:49:00:e1:58:71:9b:37:a8:93:72
+# MD5 Fingerprint: 05:FE:D0:BF:71:A8:A3:76:63:DA:01:E0:D8:52:DC:40
-# SHA1 Fingerprint: 05:63:b8:63:0d:62:d7:5a:bb:c8:ab:1e:4b:df:b5:a8:99:b2:4d:43
+# SHA1 Fingerprint: E5:8C:1C:C4:91:3B:38:63:4B:E9:10:6E:E3:AD:8E:6B:9D:D9:81:4A
-# SHA256 Fingerprint: 3e:90:99:b5:01:5e:8f:48:6c:00:bc:ea:9d:11:1e:e7:21:fa:ba:35:5a:89:bc:f1:df:69:56:1e:3d:c6:32:5c
+# SHA256 Fingerprint: D9:47:43:2A:BD:E7:B7:FA:90:FC:2E:6B:59:10:1B:12:80:E0:E1:C7:E4:E4:0F:A3:C6:88:7F:FF:57:A7:F4:CF
 -----BEGIN CERTIFICATE-----
-MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl
+MIIFVzCCAz+gAwIBAgINAgPlk28xsBNJiGuiFzANBgkqhkiG9w0BAQwFADBHMQsw
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
-d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
+MBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
-b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG
+MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
-EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
+Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0GCSqGSIb3DQEBAQUA
-cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi
+A4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaMf/vo
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c
+27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vXmX7w
-JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP
+Cl7raKb0xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7zUjw
-mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+
+TcLCeoiKu7rPWRnWr4+wB7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0Pfybl
-wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4
+qAj+lug8aJRT7oM6iCsVlgmy4HqMLnXWnOunVmSPlk9orj2XwoSPwLxAwAtcvfaH
-VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/
+szVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk9+aCEI3oncKKiPo4Zor8
-AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB
+Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zqkUspzBmk
-AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+MiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOORc92
-BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun
+wO1AK/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYWk70p
-pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC
+aDPvOmbsB4om3xPXV2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+DVrN
-dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf
+VjzRlwW5y0vtOUucxD/SVRNuJLDWcfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgFlQID
-fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm
+AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
-NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx
+FgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQADggIBAJ+qQibb
-H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe
+C5u+/x6Wki4+omVKapi6Ist9wTrYggoGxval3sBOh2Z5ofmmWJyq+bXmYOfg6LEe
-+o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
+QkEzCzc9zolwFcq1JKjPa7XSQCGYzyI0zzvFIoTgxQ6KfF2I5DUkzps+GlQebtuy
+h6f88/qBVRRiClmpIgUxPoLW7ttXNLwzldMXG+gnoot7TiYaelpkttGsN/H9oPM4
+7HLwEXWdyzRSjeZ2axfG34arJ45JK3VmgRAhpuo+9K4l/3wV3s6MJT/KYnAK9y8J
+ZgfIPxz88NtFMN9iiMG1D53Dn0reWVlHxYciNuaCp+0KueIHoI17eko8cdLiA6Ef
+MgfdG+RCzgwARWGAtQsgWSl4vflVy2PFPEz0tv/bal8xa5meLMFrUKTX5hgUvYU/
+Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT
+6u9AWpQKXCBfTkBdYiJ23//OYb2MI3jSNwLgjt7RETeJ9r/tSQdirpLsQBqvFAnZ
+0E6yove+7u7Y/9waLd64NnHi/Hm3lCXRSHNboTXns5lndcEZOitHTtNCjv0xyBZm
+2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb
+bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c
+-----END CERTIFICATE-----
+
+# Operating CA: Google Trust Services LLC
+# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R2
+# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
+# Label: "GTS Root R2"
+# Serial: 0203E5AEC58D04251AAB1125AA
+# MD5 Fingerprint=1E:39:C0:53:E6:1E:29:82:0B:CA:52:55:36:5D:57:DC
+# SHA1 Fingerprint=9A:44:49:76:32:DB:DE:FA:D0:BC:FB:5A:7B:17:BD:9E:56:09:24:94
+# SHA256 Fingerprint=8D:25:CD:97:22:9D:BF:70:35:6B:DA:4E:B3:CC:73:40:31:E2:4C:F0:0F:AF:CF:D3:2D:C7:6E:B5:84:1C:7E:A8
+-----BEGIN CERTIFICATE-----
+MIIFVzCCAz+gAwIBAgINAgPlrsWNBCUaqxElqjANBgkqhkiG9w0BAQwFADBHMQsw
+CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
+MBIGA1UEAxMLR1RTIFJvb3QgUjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
+MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
+Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3LvCvpt
+nfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3KgGjSY
+6Dlo7JUle3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9BuXvAu
+MC6C/Pq8tBcKSOWIm8Wba96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOdre7k
+RXuJVfeKH2JShBKzwkCX44ofR5GmdFrS+LFjKBC4swm4VndAoiaYecb+3yXuPuWg
+f9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7MkogwTZq9TwtImoS1mKPV
++3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJGr61K8Yzo
+dDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqjx5RW
+Ir9qS34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsRnTKa
+G73VululycslaVNVJ1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0kzCq
+gc7dGtxRcw1PcOnlthYhGXmy5okLdWTK1au8CcEYof/UVKGFPP0UJAOyh9OktwID
+AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQADggIBAB/Kzt3H
+vqGf2SdMC9wXmBFqiN495nFWcrKeGk6c1SuYJF2ba3uwM4IJvd8lRuqYnrYb/oM8
+0mJhwQTtzuDFycgTE1XnqGOtjHsB/ncw4c5omwX4Eu55MaBBRTUoCnGkJE+M3DyC
+B19m3H0Q/gxhswWV7uGugQ+o+MePTagjAiZrHYNSVc61LwDKgEDg4XSsYPWHgJ2u
+NmSRXbBoGOqKYcl3qJfEycel/FVL8/B/uWU9J2jQzGv6U53hkRrJXRqWbTKH7QMg
+yALOWr7Z6v2yTcQvG99fevX4i8buMTolUVVnjWQye+mew4K6Ki3pHrTgSAai/Gev
+HyICc/sgCq+dVEuhzf9gR7A/Xe8bVr2XIZYtCtFenTgCR2y59PYjJbigapordwj6
+xLEokCZYCDzifqrXPW+6MYgKBesntaFJ7qBFVHvmJ2WZICGoo7z7GJa7Um8M7YNR
+TOlZ4iBgxcJlkoKM8xAfDoqXvneCbT+PHV28SSe9zE8P4c52hgQjxcCMElv924Sg
+JPFI/2R80L5cFtHvma3AH/vLrrw4IgYmZNralw4/KBVEqE8AyvCazM90arQ+POuV
+7LXTWtiBmelDGDfrs7vRWGJB82bSj6p4lVQgw1oudCvV0b4YacCs1aTPObpRhANl
+6WLAYv7YTVWW4tAR+kg0Eeye7QUd5MjWHYbL
+-----END CERTIFICATE-----
+
+# Operating CA: Google Trust Services LLC
+# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R3
+# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
+# Label: "GTS Root R3"
+# Serial: 0203E5B882EB20F825276D3D66
+# MD5 Fingerprint: 3E:E7:9D:58:02:94:46:51:94:E5:E0:22:4A:8B:E7:73
+# SHA1 Fingerprint: ED:E5:71:80:2B:C8:92:B9:5B:83:3C:D2:32:68:3F:09:CD:A0:1E:46
+# SHA256 Fingerprint: 34:D8:A7:3E:E2:08:D9:BC:DB:0D:95:65:20:93:4B:4E:40:E6:94:82:59:6E:8B:6F:73:C8:42:6B:01:0A:6F:48
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYD
+VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
+A1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
+WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
+IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
+AAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736G
+jOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL2
+4CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+BBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7
+VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/Jdm
+ZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X
+-----END CERTIFICATE-----
+
+# Operating CA: Google Trust Services LLC
+# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R4
+# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
+# Label: "GTS Root R4"
+# Serial: 0203E5C068EF631A9C72905052
+# MD5 Fingerprint=43:96:83:77:19:4D:76:B3:9D:65:52:E4:1D:22:A5:E8
+# SHA1 Fingerprint=77:D3:03:67:B5:E0:0C:15:F6:0C:38:61:DF:7C:E1:3B:92:46:4D:47
+# SHA256 Fingerprint=34:9D:FA:40:58:C5:E2:63:12:3B:39:8A:E7:95:57:3C:4E:13:13:C8:3F:E6:8F:93:55:6C:D5:E8:03:1B:3C:7D
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYD
+VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
+A1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
+WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
+IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
+AATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzuhXyi
+QHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvR
+HYqjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+BBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D
+9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/Cr8deVl5c1RxYIigL9zC2L7F8AjEA8GE8
+p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh4rsUecrNIdSUtUlD
+-----END CERTIFICATE-----
+
+# Operating CA: Google Trust Services LLC
+# Subject: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
+# Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
+# Label: "GlobalSign R4"
+# Serial: 0203E57EF53F93FDA50921B2A6
+# MD5 Fingerprint: 26:29:F8:6D:E1:88:BF:A2:65:7F:AA:C4:CD:0F:7F:FC
+# SHA1 Fingerprint: 6B:A0:B0:98:E1:71:EF:5A:AD:FE:48:15:80:77:10:F4:BD:6F:0B:28
+# SHA256 Fingerprint: B0:85:D7:0B:96:4F:19:1A:73:E4:AF:0D:54:AE:7A:0E:07:AA:FD:AF:9B:71:DD:08:62:13:8A:B7:32:5A:24:A2
+-----BEGIN CERTIFICATE-----
+MIIB3DCCAYOgAwIBAgINAgPlfvU/k/2lCSGypjAKBggqhkjOPQQDAjBQMSQwIgYD
+VQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkdsb2Jh
+bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTIxMTEzMDAwMDAwWhcNMzgw
+MTE5MDMxNDA3WjBQMSQwIgYDVQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0g
+UjQxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wWTAT
+BgcqhkjOPQIBBggqhkjOPQMBBwNCAAS4xnnTj2wlDp8uORkcA6SumuU5BwkWymOx
+uYb4ilfBV85C+nOh92VC/x7BALJucw7/xyHlGKSq2XE/qNS5zowdo0IwQDAOBgNV
+HQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVLB7rUW44kB/
++wpu+74zyTyjhNUwCgYIKoZIzj0EAwIDRwAwRAIgIk90crlgr/HmnKAWBVBfw147
+bmF0774BxL4YSFlhgjICICadVGNA3jdgUM/I2O2dgq43mLyjj0xMqTQrbO/7lZsm
 -----END CERTIFICATE-----
 
 # Operating CA: DigiCert
@@ -153,36 +267,6 @@ JjZ91eQ0hjkCMHw2U/Aw5WJjOpnitqM7mzT6HtoQknFekROn3aRukswy1vUhZscv
 6pZjamVFkpUBtA==
 -----END CERTIFICATE-----
 
-# Operating CA: DigiCert
-# Issuer: CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com
-# Subject: CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com
-# Label: "DigiCert Global Root CA"
-# Serial: 10944719598952040374951832963794454346
-# MD5 Fingerprint: 79:e4:a9:84:0d:7d:3a:96:d7:c0:4f:e2:43:4c:89:2e
-# SHA1 Fingerprint: a8:98:5d:3a:65:e5:e5:c4:b2:d7:d6:6d:40:c6:dd:2f:b1:9c:54:36
-# SHA256 Fingerprint: 43:48:a0:e9:44:4c:78:cb:26:5e:05:8d:5e:89:44:b4:d8:4f:96:62:bd:26:db:25:7f:89:34:a4:43:c7:01:61
------BEGIN CERTIFICATE-----
-MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
-QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
-MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
-b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
-CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
-nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
-43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
-T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
-gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
-BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
-TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
-DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
-hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
-06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
-PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
-YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
-CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
------END CERTIFICATE-----
 
 # Operating CA: DigiCert
 # Issuer: CN=DigiCert Global Root G2 O=DigiCert Inc OU=www.digicert.com
@@ -239,37 +323,6 @@ oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34VOKa5Vt8
 sycX
 -----END CERTIFICATE-----
 
-# Operating CA: DigiCert
-# Issuer: CN=DigiCert High Assurance EV Root CA O=DigiCert Inc OU=www.digicert.com
-# Subject: CN=DigiCert High Assurance EV Root CA O=DigiCert Inc OU=www.digicert.com
-# Label: "DigiCert High Assurance EV Root CA"
-# Serial: 3553400076410547919724730734378100087
-# MD5 Fingerprint: d4:74:de:57:5c:39:b2:d3:9c:85:83:c5:c0:65:49:8a
-# SHA1 Fingerprint: 5f:b7:ee:06:33:e2:59:db:ad:0c:4c:9a:e6:d3:8f:1a:61:c7:dc:25
-# SHA256 Fingerprint: 74:31:e5:f4:c3:c1:ce:46:90:77:4f:0b:61:e0:54:40:88:3b:a9:a0:1e:d0:0b:a6:ab:d7:80:6e:d3:b1:18:cf
------BEGIN CERTIFICATE-----
-MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
-MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
-d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
-ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
-MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
-LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
-RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
-+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
-PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
-xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
-Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
-hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
-EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
-MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
-FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
-nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
-eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
-hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
-Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
-vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
-+OkuE6N36B9K
------END CERTIFICATE-----
 
 # Operating CA: DigiCert
 # Issuer: CN=DigiCert Trusted Root G4 O=DigiCert Inc OU=www.digicert.com
@@ -312,36 +365,6 @@ r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
 gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
 -----END CERTIFICATE-----
 
-# Operating CA: GlobalSign
-# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA
-# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA
-# Label: "GlobalSign Root CA"
-# Serial: 4835703278459707669005204
-# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a
-# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c
-# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99
------BEGIN CERTIFICATE-----
-MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
-A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
-b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
-MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
-YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
-aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
-jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
-xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
-1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
-snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
-U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
-9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
-AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
-yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
-38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
-AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
-DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
-HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
------END CERTIFICATE-----
-
 # Operating CA: GlobalSign
 # Issuer: CN=GlobalSign O=GlobalSign OU=GlobalSign Root CA - R3
 # Subject: CN=GlobalSign O=GlobalSign OU=GlobalSign Root CA - R3
@@ -669,148 +692,3 @@ VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
 L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
 jjxDah2nGN59PRbxYvnKkKj9
 -----END CERTIFICATE-----
-
-# Operating CA: Google Trust Services LLC
-# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R1
-# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R1
-# Label: "GTS Root R1"
-# Serial: 0203E5936F31B01349886BA217
-# MD5 Fingerprint: 05:FE:D0:BF:71:A8:A3:76:63:DA:01:E0:D8:52:DC:40
-# SHA1 Fingerprint: E5:8C:1C:C4:91:3B:38:63:4B:E9:10:6E:E3:AD:8E:6B:9D:D9:81:4A
-# SHA256 Fingerprint: D9:47:43:2A:BD:E7:B7:FA:90:FC:2E:6B:59:10:1B:12:80:E0:E1:C7:E4:E4:0F:A3:C6:88:7F:FF:57:A7:F4:CF
------BEGIN CERTIFICATE-----
-MIIFVzCCAz+gAwIBAgINAgPlk28xsBNJiGuiFzANBgkqhkiG9w0BAQwFADBHMQsw
-CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
-MBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
-MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
-Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaMf/vo
-27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vXmX7w
-Cl7raKb0xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7zUjw
-TcLCeoiKu7rPWRnWr4+wB7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0Pfybl
-qAj+lug8aJRT7oM6iCsVlgmy4HqMLnXWnOunVmSPlk9orj2XwoSPwLxAwAtcvfaH
-szVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk9+aCEI3oncKKiPo4Zor8
-Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zqkUspzBmk
-MiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOORc92
-wO1AK/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYWk70p
-aDPvOmbsB4om3xPXV2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+DVrN
-VjzRlwW5y0vtOUucxD/SVRNuJLDWcfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgFlQID
-AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
-FgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQADggIBAJ+qQibb
-C5u+/x6Wki4+omVKapi6Ist9wTrYggoGxval3sBOh2Z5ofmmWJyq+bXmYOfg6LEe
-QkEzCzc9zolwFcq1JKjPa7XSQCGYzyI0zzvFIoTgxQ6KfF2I5DUkzps+GlQebtuy
-h6f88/qBVRRiClmpIgUxPoLW7ttXNLwzldMXG+gnoot7TiYaelpkttGsN/H9oPM4
-7HLwEXWdyzRSjeZ2axfG34arJ45JK3VmgRAhpuo+9K4l/3wV3s6MJT/KYnAK9y8J
-ZgfIPxz88NtFMN9iiMG1D53Dn0reWVlHxYciNuaCp+0KueIHoI17eko8cdLiA6Ef
-MgfdG+RCzgwARWGAtQsgWSl4vflVy2PFPEz0tv/bal8xa5meLMFrUKTX5hgUvYU/
-Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT
-6u9AWpQKXCBfTkBdYiJ23//OYb2MI3jSNwLgjt7RETeJ9r/tSQdirpLsQBqvFAnZ
-0E6yove+7u7Y/9waLd64NnHi/Hm3lCXRSHNboTXns5lndcEZOitHTtNCjv0xyBZm
-2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb
-bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c
------END CERTIFICATE-----
-
-# Operating CA: Google Trust Services LLC
-# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R2
-# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R2
-# Label: "GTS Root R2"
-# Serial: 0203E5AEC58D04251AAB1125AA
-# MD5 Fingerprint=1E:39:C0:53:E6:1E:29:82:0B:CA:52:55:36:5D:57:DC
-# SHA1 Fingerprint=9A:44:49:76:32:DB:DE:FA:D0:BC:FB:5A:7B:17:BD:9E:56:09:24:94
-# SHA256 Fingerprint=8D:25:CD:97:22:9D:BF:70:35:6B:DA:4E:B3:CC:73:40:31:E2:4C:F0:0F:AF:CF:D3:2D:C7:6E:B5:84:1C:7E:A8
------BEGIN CERTIFICATE-----
-MIIFVzCCAz+gAwIBAgINAgPlrsWNBCUaqxElqjANBgkqhkiG9w0BAQwFADBHMQsw
-CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
-MBIGA1UEAxMLR1RTIFJvb3QgUjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
-MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
-Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3LvCvpt
-nfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3KgGjSY
-6Dlo7JUle3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9BuXvAu
-MC6C/Pq8tBcKSOWIm8Wba96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOdre7k
-RXuJVfeKH2JShBKzwkCX44ofR5GmdFrS+LFjKBC4swm4VndAoiaYecb+3yXuPuWg
-f9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7MkogwTZq9TwtImoS1mKPV
-+3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJGr61K8Yzo
-dDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqjx5RW
-Ir9qS34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsRnTKa
-G73VululycslaVNVJ1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0kzCq
-gc7dGtxRcw1PcOnlthYhGXmy5okLdWTK1au8CcEYof/UVKGFPP0UJAOyh9OktwID
-AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
-FgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQADggIBAB/Kzt3H
-vqGf2SdMC9wXmBFqiN495nFWcrKeGk6c1SuYJF2ba3uwM4IJvd8lRuqYnrYb/oM8
-0mJhwQTtzuDFycgTE1XnqGOtjHsB/ncw4c5omwX4Eu55MaBBRTUoCnGkJE+M3DyC
-B19m3H0Q/gxhswWV7uGugQ+o+MePTagjAiZrHYNSVc61LwDKgEDg4XSsYPWHgJ2u
-NmSRXbBoGOqKYcl3qJfEycel/FVL8/B/uWU9J2jQzGv6U53hkRrJXRqWbTKH7QMg
-yALOWr7Z6v2yTcQvG99fevX4i8buMTolUVVnjWQye+mew4K6Ki3pHrTgSAai/Gev
-HyICc/sgCq+dVEuhzf9gR7A/Xe8bVr2XIZYtCtFenTgCR2y59PYjJbigapordwj6
-xLEokCZYCDzifqrXPW+6MYgKBesntaFJ7qBFVHvmJ2WZICGoo7z7GJa7Um8M7YNR
-TOlZ4iBgxcJlkoKM8xAfDoqXvneCbT+PHV28SSe9zE8P4c52hgQjxcCMElv924Sg
-JPFI/2R80L5cFtHvma3AH/vLrrw4IgYmZNralw4/KBVEqE8AyvCazM90arQ+POuV
-7LXTWtiBmelDGDfrs7vRWGJB82bSj6p4lVQgw1oudCvV0b4YacCs1aTPObpRhANl
-6WLAYv7YTVWW4tAR+kg0Eeye7QUd5MjWHYbL
------END CERTIFICATE-----
-
-# Operating CA: Google Trust Services LLC
-# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R3
-# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R3
-# Label: "GTS Root R3"
-# Serial: 0203E5B882EB20F825276D3D66
-# MD5 Fingerprint: 3E:E7:9D:58:02:94:46:51:94:E5:E0:22:4A:8B:E7:73
-# SHA1 Fingerprint: ED:E5:71:80:2B:C8:92:B9:5B:83:3C:D2:32:68:3F:09:CD:A0:1E:46
-# SHA256 Fingerprint: 34:D8:A7:3E:E2:08:D9:BC:DB:0D:95:65:20:93:4B:4E:40:E6:94:82:59:6E:8B:6F:73:C8:42:6B:01:0A:6F:48
------BEGIN CERTIFICATE-----
-MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYD
-VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
-A1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
-WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
-IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
-AAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736G
-jOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL2
-4CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
-BBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7
-VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/Jdm
-ZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X
------END CERTIFICATE-----
-
-# Operating CA: Google Trust Services LLC
-# Subject: C = US, O = Google Trust Services LLC, CN = GTS Root R4
-# Issuer: C = US, O = Google Trust Services LLC, CN = GTS Root R4
-# Label: "GTS Root R4"
-# Serial: 0203E5C068EF631A9C72905052
-# MD5 Fingerprint=43:96:83:77:19:4D:76:B3:9D:65:52:E4:1D:22:A5:E8
-# SHA1 Fingerprint=77:D3:03:67:B5:E0:0C:15:F6:0C:38:61:DF:7C:E1:3B:92:46:4D:47
-# SHA256 Fingerprint=34:9D:FA:40:58:C5:E2:63:12:3B:39:8A:E7:95:57:3C:4E:13:13:C8:3F:E6:8F:93:55:6C:D5:E8:03:1B:3C:7D
------BEGIN CERTIFICATE-----
-MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYD
-VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
-A1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
-WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
-IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
-AATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzuhXyi
-QHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvR
-HYqjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
-BBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D
-9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/Cr8deVl5c1RxYIigL9zC2L7F8AjEA8GE8
-p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh4rsUecrNIdSUtUlD
------END CERTIFICATE-----
-
-# Operating CA: Google Trust Services LLC
-# Subject: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
-# Issuer: OU = GlobalSign ECC Root CA - R4, O = GlobalSign, CN = GlobalSign
-# Label: "GlobalSign R4"
-# Serial: 0203E57EF53F93FDA50921B2A6
-# MD5 Fingerprint: 26:29:F8:6D:E1:88:BF:A2:65:7F:AA:C4:CD:0F:7F:FC
-# SHA1 Fingerprint: 6B:A0:B0:98:E1:71:EF:5A:AD:FE:48:15:80:77:10:F4:BD:6F:0B:28
-# SHA256 Fingerprint: B0:85:D7:0B:96:4F:19:1A:73:E4:AF:0D:54:AE:7A:0E:07:AA:FD:AF:9B:71:DD:08:62:13:8A:B7:32:5A:24:A2
------BEGIN CERTIFICATE-----
-MIIB3DCCAYOgAwIBAgINAgPlfvU/k/2lCSGypjAKBggqhkjOPQQDAjBQMSQwIgYD
-VQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkdsb2Jh
-bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTIxMTEzMDAwMDAwWhcNMzgw
-MTE5MDMxNDA3WjBQMSQwIgYDVQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0g
-UjQxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wWTAT
-BgcqhkjOPQIBBggqhkjOPQMBBwNCAAS4xnnTj2wlDp8uORkcA6SumuU5BwkWymOx
-uYb4ilfBV85C+nOh92VC/x7BALJucw7/xyHlGKSq2XE/qNS5zowdo0IwQDAOBgNV
-HQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVLB7rUW44kB/
-+wpu+74zyTyjhNUwCgYIKoZIzj0EAwIDRwAwRAIgIk90crlgr/HmnKAWBVBfw147
-bmF0774BxL4YSFlhgjICICadVGNA3jdgUM/I2O2dgq43mLyjj0xMqTQrbO/7lZsm
------END CERTIFICATE-----

src/gam/gamlib/glapi.py

@@ -51,7 +51,6 @@ CLOUDIDENTITY_INBOUND_SSO = 'cloudidentityinboundsso'
 CLOUDIDENTITY_ORGUNITS = 'cloudidentityorgunits'
 CLOUDIDENTITY_ORGUNITS_BETA = 'cloudidentityorgunitsbeta'
 CLOUDIDENTITY_POLICY = 'cloudidentitypolicy'
-CLOUDIDENTITY_POLICY_BETA = 'cloudidentitypolicybeta'
 CLOUDIDENTITY_USERINVITATIONS = 'cloudidentityuserinvitations'
 CLOUDRESOURCEMANAGER = 'cloudresourcemanager'
 CLOUDRESOURCEMANAGERV1 = 'cloudresourcemanagerv1'
@@ -261,7 +260,6 @@ _INFO = {
   CLOUDIDENTITY_ORGUNITS: {'name': 'Cloud Identity API - OrgUnits', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDIDENTITY_ORGUNITS_BETA: {'name': 'Cloud Identity API - OrgUnits Beta', 'version': 'v1beta1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDIDENTITY_POLICY: {'name': 'Cloud Identity API - Policy', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
-  CLOUDIDENTITY_POLICY_BETA: {'name': 'Cloud Identity API - Policy Beta', 'version': 'v1beta1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDIDENTITY_USERINVITATIONS: {'name': 'Cloud Identity API - User Invitations', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudidentity'},
   CLOUDRESOURCEMANAGER: {'name': 'Resource Manager API v3', 'version': 'v3', 'v2discovery': True},
   CLOUDRESOURCEMANAGERV1: {'name': 'Resource Manager API v1', 'version': 'v1', 'v2discovery': True, 'mappedAPI': 'cloudresourcemanager'},
@@ -405,10 +403,6 @@ _CLIENT_SCOPES = [
    'subscopes': READONLY,
    'roByDefault': True,
    'scope': 'https://www.googleapis.com/auth/cloud-identity.policies'},
-  {'name': 'Cloud Identity API - Policy Beta',
-   'api': CLOUDIDENTITY_POLICY_BETA,
-   'offByDefault': True,
-   'scope': 'https://www.googleapis.com/auth/cloud-identity.policies'},
   {'name': 'Cloud Identity API - User Invitations',
    'api': CLOUDIDENTITY_USERINVITATIONS,
    'subscopes': READONLY,
@@ -641,10 +635,6 @@ _SVCACCT_SCOPES = [
 #   'subscopes': READONLY,
 #   'roByDefault': True,
 #   'scope': 'https://www.googleapis.com/auth/cloud-identity.policies'},
-#  {'name': 'Cloud Identity API - Policy Beta',
-#   'api': CLOUDIDENTITY_POLICY_BETA,
-#   'offByDefault': True,
-#   'scope': 'https://www.googleapis.com/auth/cloud-identity.policies'},
 #  {'name': 'Cloud Identity User Invitations API',
 #   'api': CLOUDIDENTITY_USERINVITATIONS,
 #   'subscopes': READONLY,

src/gam/gamlib/glclargs.py

@@ -846,6 +846,8 @@ class GamCLArgs():
   ARG_CHATMEMBERS = 'chatmembers'
   ARG_CHATMESSAGE = 'chatmessage'
   ARG_CHATMESSAGES = 'chatmessages'
+  ARG_CHATSEARCHMESSAGE = 'chatsearchmessage'
+  ARG_CHATSEARCHMESSAGES = 'chatsearchmessages'
   ARG_CHATSECTION = 'chatsection'
   ARG_CHATSECTIONS = 'chatsections'
   ARG_CHATSECTIONITEM = 'chatsectionitem'

src/gam/gamlib/glmsgs.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -312,6 +312,7 @@ INVALID_ALIAS = 'Invalid Alias'
 INVALID_ATTENDEE_CHANGE = 'Invalid attendee change "{0}"'
 INVALID_CHARSET = 'Invalid charset "{0}"'
 INVALID_DATE_TIME_RANGE = '{0} {1} must be greater than/equal to {2} {3}'
+INVALID_DEVICE_QUERY = 'Invalid {0} query "{1}"; it must be if the form "field:value" and must not contain a "?"'
 INVALID_EMOJI_NAME = '{0} does not match pattern :[0-9a-z_-]:'
 INVALID_ENTITY = 'Invalid {0}, {1}'
 INVALID_EVENT_TIMERANGE = '{0} {1} must be less than {2}'
@@ -461,6 +462,7 @@ PLEASE_CORRECT_YOUR_SYSTEM_TIME = 'Please correct your system time.'
 PLEASE_ENTER_A_OR_M = 'Please enter a or m ...\n'
 PLEASE_SELECT_ENTITY_TO_PROCESS = '{0} {1} found, please select the correct one to {2} and specify with {3}'
 PLEASE_SPECIFY_BUILDING_EXACT_CASE_NAME_OR_ID = 'Please specify building by exact case name or ID.'
+POLICY_NAME_NOT_FOUND = 'JSON key "name" not found in JSON data'
 PREVIEW_ONLY = 'Preview Only'
 PRIMARY_EMAIL_DID_NOT_MATCH_PATTERN = 'primaryEmail address did not match pattern: {0}'
 PROCESS = 'process'
@@ -474,7 +476,7 @@ REASON_ONLY_VALID_WITH_CONTENTRESTRICTIONS_READONLY_TRUE = 'reason only valid wi
 REAUTHENTICATION_IS_NEEDED = 'Reauthentication is needed, please run\n\ngam oauth create'
 RECOMMEND_RUNNING_GAM_ROTATE_SAKEY = 'Recommend running "gam rotate sakey" to get a new key\n'
 REFUSING_TO_DEPROVISION_DEVICES = 'Refusing to deprovision {0} devices because acknowledge_device_touch_requirement not specified.\nDeprovisioning a device means the device will have to be physically wiped and re-enrolled to be managed by your domain again.\nThis requires physical access to the device and is very time consuming to perform for each device.\nPlease add "acknowledge_device_touch_requirement" to the GAM command if you understand this and wish to proceed with the deprovision.\nPlease also be aware that deprovisioning can have an effect on your device license count.\nSee https://support.google.com/chrome/a/answer/3523633 for full details.'
-REFUSING_TO_DEPROVISION_N_DEVICES = 'Refusing to deprovision {0} devices due to maxtodepov {1}.'
+REFUSING_TO_DEPROVISION_N_DEVICES = 'Refusing to deprovision {0} devices due to maxtodepov {1}.\nSpecify "maxtodeprov 0" to deprovision all {0} devices'
 REPLY_TO_CUSTOM_REQUIRES_EMAIL_ADDRESS = 'replyto REPLY_TO_CUSTOM requires customReplyTo <EmailAddress>'
 REQUEST_COMPLETED_NO_FILES = 'Request completed but no results/files were returned, try requesting again'
 REQUEST_NOT_COMPLETE = 'Request needs to be completed before downloading, current status is: {0}'

src/gam/gamlib/glskus.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2025 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -22,7 +22,7 @@
 
 # Products/SKUs
 _PRODUCTS = {
-  '101001': 'Cloud Identity',
+  '101001': 'Cloud Identity Free',
   '101005': 'Cloud Identity Premium',
   '101031': 'Google Workspace for Education',
   '101033': 'Google Voice',
@@ -44,7 +44,7 @@ _PRODUCTS = {
   }
 _SKUS = {
   '1010010001': {
-    'product': '101001', 'aliases': ['identity', 'cloudidentity'], 'displayName': 'Cloud Identity'},
+    'product': '101001', 'aliases': ['identity', 'cloudidentity', 'cloudidentityfree'], 'displayName': 'Cloud Identity Free'},
   '1010050001': {
     'product': '101005', 'aliases': ['identitypremium', 'cloudidentitypremium'], 'displayName': 'Cloud Identity Premium'},
   '1010070001': {

src/gam/gamlib/gluprop.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-# Copyright (C) 2023 Ross Scroggs All Rights Reserved.
+# Copyright (C) 2026 Ross Scroggs All Rights Reserved.
 #
 # All Rights Reserved.
 #
@@ -145,10 +145,14 @@ PROPERTIES = {
     {CLASS: PC_BOOLEAN, TITLE: 'IP Whitelisted',},
   'archived':
     {CLASS: PC_BOOLEAN, TITLE: 'Is Archived',},
+  'archivalTime':
+    {CLASS: PC_TIME, TITLE: 'Archival Time',},
   'suspended':
     {CLASS: PC_BOOLEAN, TITLE: 'Account Suspended',},
   'suspensionReason':
     {CLASS: PC_STRING, TITLE: 'Suspension Reason',},
+  'suspensionTime':
+    {CLASS: PC_TIME, TITLE: 'Suspension Time',},
   'changePasswordAtNextLogin':
     {CLASS: PC_BOOLEAN, TITLE: 'Must Change Password',},
   'recoveryEmail':

wiki/Basic-Items.md

@@ -456,9 +456,9 @@
         See: https://cloud.google.com/access-context-manager/docs/custom-access-level-spec
 <QueryContact> ::= <String>
         See: https://developers.google.com/google-apps/contacts/v3/reference#contacts-query-parameters-reference
-<QueryCrOS> ::= <String>
+<QueryCrOS> ::= <String>:<String>
         See: https://support.google.com/chrome/a/answer/1698333
-<QueryDevice> ::= <String>
+<QueryDevice> ::= <String>:<String>
         See: https://support.google.com/a/answer/7549103
 <QueryDriveFile> ::= <String>
         See: https://developers.google.com/drive/api/v3/search-files
@@ -471,7 +471,7 @@
 <QueryItem> ::= <UniqueID>|<String>
 <QueryMemberRestrictions> ::= <String>
         See: https://cloud.google.com/identity/docs/reference/rest/v1beta1/SecuritySettings#MemberRestriction
-<QueryMobile> ::= <String>
+<QueryMobile> ::= <String>:<String>
         See: https://support.google.com/a/answer/7549103
 <QueryTeamDrive> ::= <String>
         See: https://developers.google.com/drive/api/v3/search-parameters

wiki/Calendars-Access.md

@@ -20,6 +20,9 @@ Calendar ACL roles (as seen in Calendar GUI):
   * `owner` - Make changes to events and manage sharing
   * `freebusy` & `freebusyreader` - See only free/busy (hide details)
 
+Added `writerwithoutprivateaccess` to `<CalendarACLRole>` in 7.44.03; this will become effective 2026-06-29.
+* See: https://developers.google.com/workspace/calendar/release-notes#June_01_2026
+
 ## API documentation
 * [Calendar API - ACLs](https://developers.google.com/google-apps/calendar/v3/reference/acl)
 
@@ -30,10 +33,15 @@ Calendar ACL roles (as seen in Calendar GUI):
 <CalendarEntity> ::= <CalendarList> | <FileSelector> | <CSVkmdSelector> | <CSVDataSelector>
         See: https://github.com/GAM-team/GAM/wiki/Collections-of-Items
 
-<CalendarACLRole> ::= editor|freebusy|freebusyreader|owner|reader|writer
+<CalendarACLRole> ::=
-<CalendarACLScope> ::= <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|domain:<DomainName>|domain|default
+         editor|freebusy|freebusyreader|owner|reader|writer|writerwithoutprivateaccess|none
-<CalendarACLScopeList> ::= "<CalendarACLScope>(,<CalendarACLScope>)*"
+<CalendarACLScope> ::=
-<CalendarACLScopeEntity>::= <CalendarACLScopeList> | <FileSelector> | <CSVkmdSelector> | <CSVDataSelector>
+        <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|
+        domain:<DomainName>|domain|default
+<CalendarACLScopeList> ::=
+        "<CalendarACLScope>(,<CalendarACLScope>)*"
+<CalendarACLScopeEntity>::=
+        <CalendarACLScopeList> | <FileSelector> | <CSVkmdSelector> | <CSVDataSelector>
 ```
 ## Manage calendar access
 ```

wiki/ChromeOS-Devices.md

@@ -68,7 +68,8 @@ gam oauth create
  
 ```
 <OrgUnitPath> ::= /|(/<String)+
-<QueryCrOS> ::= <String> See: https://support.google.com/chrome/a/answer/1698333
+<QueryCrOS> ::= <String>:<String>
+        See: https://support.google.com/chrome/a/answer/1698333
 <CommandID> ::= <String>
 <CrOSID> ::= <String>
 <CrOSIDList> ::= "<CrOSID>(,<CrOSID>)*"
@@ -97,6 +98,7 @@ gam oauth create
         autoupdateexpiration|
         autoupdatethrough|
         backlightinfo|
+        bluetoothadapterinfo|
         bootmode|
         chromeostype|
         cpuinfo|
@@ -130,6 +132,7 @@ gam oauth create
         orgunitpath|org|ou|
         osupdatestatus|
         osversion|
+        osversioncompliance|
         platformversion|
         recentusers|
         screenshotfiles|
@@ -184,25 +187,30 @@ gam oauth create
 <CrOSActivityListFieldNameList> ::= "<CrOSActivityListFieldName>(,<CrOSActivityListFieldName>)*"
 
 <CrOSTelemetryFieldName> ::=
+        appreport|
         audiostatusreport|
         batteryinfo|
         batterystatusreport|
-        bootPerformancereport|
+        bootperformancereport|
         cpuinfo|
         cpustatusreport|
         customer|
         deviceid|
         graphicsinfo|
         graphicsstatusreport|
+        heartbeatstatusreport|
+        kioskappstatusreport|
         memoryinfo|
         memorystatusreport|
         name|
+        networkbandwidthreport|
         networkdiagnosticsreport|
         networkinfo|
         networkstatusreport|
         orgunitid|
         osupdatestatus|
         peripheralsreport|
+        runtimecountersreport|
         serialnumber|
         storageinfo|
         storagestatusreport|
@@ -210,20 +218,22 @@ gam oauth create
 <CrOSTelemetryFieldNameList> ::= "<CrOSTelemetryFieldName>(,<CrOSTelemetryFieldName>)*"
 
 <CrOSTelemetryListFieldName> ::=
+        appreport|
         audiostatusreport|
-        batteryinfo|
         batterystatusreport|
         bootperformancereport|
-        cpuinfo|
         cpustatusreport|
         graphicsstatusreport|
+        heartbeatstatusreport|
+        kioskappstatusreport|
         memorystatusreport|
+        networkbandwidthreport|
         networkdiagnosticsreport|
         networkstatusreport|
         osupdatestatus|
         peripheralsreport|
-        storagestatusreport|
+        runtimecountersreport|
-        thunderboltinfo
+        storagestatusreport
 <CrOSTelemetryListFieldNameList> ::= "<CrOSTelemetryListFieldName>(,<CrOSTelemetryLIstFieldName>)*"
 ```
 
@@ -409,11 +419,13 @@ gam update ou csvkmd cros.csv keyfield OU datafield deviceId add croscsvdata dev
         reenable
 
 gam <CrOSTypeEntity> update action <CrOSAction> [acknowledge_device_touch_requirement]
-        [actionbatchsize <Integer>]
+        [actionbatchsize <Integer>] [maxtodeprov <Integer>]
 ```
 ChromeOS devices are now processed in batches.
 The batch size defaults to 10, the `actionbatchsize <Integer>` option can be used to set a batch size between 10 and 250.
 
+### Deprovisioning
+
 As deprovisioning ChromeOS devices is not reversible, you must enter `acknowledge_device_touch_requirement`
 when `<CrOSAction>` is `deprovision_same_model_replace`, `deprovision_different_model_replace`,
 `deprovision_retiring_device` or `deprovision_upgrade_transfer`.
@@ -424,6 +436,20 @@ each device. Please also be aware that deprovisioning can have an effect on your
 
 See https://support.google.com/chrome/a/answer/3523633 for full details.
 
+Prior to version 7.43.05, all devices in `<CrOSEntity>` would be deprovisioned. When `<CrOSEntity>`
+was derived from an OU, this was desirable. However, if `<CrOSEntity>` was derived from a query,
+more devices than desired may have been deprovisioned. In version 7.43.05 and higher,
+GAM defaults to not deprovisioning devices if the number of devices exceeds one.
+
+The  option `max_to_deprov <Integer>` can be used to verify the number of devices to be deprovisioned;
+no deprovisions are processed if the number of devices in `<CrOSEntity>` exceeds `<Integer>`;
+the default value is one; set `<Number>` to 0 for no limit.
+
+When `<CrOSEntity>` is derived from an OU, set `max_to_deprov 0` and all devices will be deprovisioned.
+
+When `<CrOSEntity>` is derived from a query, e.g., `cros_sn <SerialNumber>`, the default `max_to_deprov 1`
+protects you from accidentally deprovisioning more devices than desired.
+
 ## Send remote commands to ChromeOS devices
 Thanks to Jay for most of the following.
 
@@ -947,19 +973,21 @@ By default, Gam displays the information as an indented list of keys and values:
 gam print crostelemetry [todrive <ToDriveAttribute>*]
         [(ou|org|orgunit|ou_and_children <OrgUnitItem>)|(cros_sn <SerialNumber>)|(filter <String>)]
         <CrOSTelemetryFieldName>* [fields <CrOSTelemetryFieldNameList>]
-        [reverselists <CrOSTelemetryListFieldNameList>]
+        [reverselists <CrOSTelemetryListFieldNameList>] [oneitemperrow]
         [start <Date>] [end <Date>] [listlimit <Number>]
         [formatjson [quotechar <Character>]]
 ```
 Use these options to select CrOS devices; if none are chosen, all CrOS devices in the account are selected.
-
 - `ou|org|orgunit <OrgUnitItem>` - Select CrOS devices directly in the OU `<OrgUnitItem>`
 - `ou_and_children <OrgUnitItem>` - Select CrOS devices in the OU `<OrgUnitItem>` and its sub OUs
 - `cros_sn <SerialNumber>` - Select the CrOS device with serial number `<SerialNumber>`.
 - `filter <String>` - Select the CrOS device with a filter.
+
+Use these options to limit/modify the displayed lists.
 - `listlimit <Number>` - Limits the number of repetitions to `<Number>`; if not specified or `<Number>` equals zero, there is no limit.
 - `start <Date>` and `end <Date>` - Constrain list `reportTime` to fall within the specified `<Dates>`. If a `<Date>` isn't specified, there is no filtering in that range.
-- `reverselists <CrOSTelemetryListFieldNameList>` - For each list, change order from ascending (oldest to newest) to descending (newest to oldest); this makes it easy to get the `N` most recent values with `listlimit N reverselists cpustatusreport,memorystatusreport`
+- `reverselists <CrOSTelemetryListFieldNameList>` - For each list, change order from descending (newest to oldest) to ascending (oldest to newest)
+- `oneitemrerrow` - Display each instance of a list item on a separate row; by default, all list items are displayed on a single row
 
 By default, all telemetry data is displayed, use the following to select specific fields:
 - `<CrOSTelemetryFieldName>*` - Specify fields individually

wiki/Cloud-Identity-Devices.md

@@ -56,7 +56,7 @@ Use this table to filter/query for specific device types:
 ```
 <AssetTag> ::= <String>
 <AssetTagList> ::= "<AssetTag>(,<AssetTag>)*"
-<QueryDevice> ::= <String>
+<QueryDevice> ::= <String>:<String>
         See: https://support.google.com/a/answer/7549103
 <QueryDeviceList> ::= "<QueryDevice>(,<QueryDevice>)*"
 <DeviceID> ::= devices/<String>
@@ -133,6 +133,8 @@ Use this table to filter/query for specific device types:
 
 ```
 ## Create a company device
+This method is available only to customers who have one of the following SKUs: Enterprise Standard, Enterprise Plus, Enterprise for Education, and Cloud Identity Premium.
+
 Adds a new device to the Google company-owned inventory. Once a user is assigned and enrolled on the device the device will be considered company-owned for management purposes.
 The device will also register as company-owned with Google services like [Context-Aware Access (CAA)](https://support.google.com/a/answer/9275380).
 ```

wiki/Cloud-Identity-Policies.md

@@ -5,6 +5,8 @@
 - [Definitions](#definitions)
 - [Policies](#policies)
 - [Display Cloud Identity Policies](#display-cloud-identity-policies)
+- [Create and Update Cloud Identity Policies](#create-and-update-cloud-identity-policies)
+- [Delete Cloud Identity Policies](#delete-cloud-identity-policies)
 
 ## API documentation
 * [Policy API](https://cloud.google.com/identity/docs/reference/rest/v1/policies)
@@ -35,6 +37,9 @@ You must enable access to policies in the GCP cloud console.
 * Click Organization Policy Administrator
 * Click Save
 
+The commands to create, update and delete Cloud Identity policies for data loss prevention (DLP) rules and detectors
+were added in version `7.46.00`.
+
 ## Definitions
 ```
 <CIPolicyName> ::= policies/<String>|settings/<String>|<String>
@@ -87,7 +92,7 @@ gam show policies
         [formatjson]
 ```
 By default, all policies are displayed.
-* `filter <String>` - Display filtered policies, See https://cloud.google.com/identity/docs/reference/rest/v1beta1/policies/list
+* `filter <String>` - Display filtered policies, See https://cloud.google.com/identity/docs/reference/rest/v1/policies/list
 * `group <REMatchPattern>` - Only display policies whose group email address matches the `<REMatchPattern>`
 * `ou|org|orgunit <REMatchPattern>` - Only display policies whose OU path matches the `<REMatchPattern>`
 
@@ -110,7 +115,7 @@ gam print policies [todrive <ToDriveAttribute>*]
         [formatjson [quotechar <Character>]]
 ```
 By default, all policies are displayed:
-* `filter <String>` - Display filtered policies, See https://cloud.google.com/identity/docs/reference/rest/v1beta1/policies/list
+* `filter <String>` - Display filtered policies, See https://cloud.google.com/identity/docs/reference/rest/v1/policies/list
 * `group <REMatchPattern>` - Only display policies whose group email address matches the `<REMatchPattern>`
 * `ou|org|orgunit <REMatchPattern>` - Only display policies whose OU path matches the `<REMatchPattern>`
 
@@ -152,3 +157,32 @@ Print all polices that apply to the OU "/Staff" and its sub-OUs.
 ```
 gam redirect csv ./StaffPolicies.csv print policies ou "^/Staff"
 ```
+
+## Create and Update Cloud Identity Policies
+Policies can be complex objects, it is probably easiest to create template policies in the Admin console (under Rules),
+output the JSON format data for those policies to be used in subsequent create and update commands.
+
+```
+gam create policy
+        json <JSONData>
+        [(ou|orgunit <OrgUnitItem>)|(group <GroupItem>)|(query <String>)]
+gam update policy
+        json <JSONData>
+        [(ou|orgunit <OrgUnitItem>)|(group <GroupItem>)|(query <String>)]
+```
+```
+gam redirect stdout ./policy.json info policies policies/akajj264aoclblvncu
+Make changes to policy.json and update the policy.
+gam update policy json file policy.json
+
+Update the policy to reference a different group.
+gam update policy json file policy.json group <EmailAddress>
+
+Make changes to policy.json and create a new policy in a different OU.
+gam create policy json file policy.json ou <OrgUnitPath>
+```
+
+## Delete Cloud Identity Policies
+```
+gam delete policies <CIPolicyNameEntity>
+```

wiki/Command-Line-Parsing.md

@@ -16,12 +16,12 @@ In zsh, if an argument contains a `~`, `|`, `!`, `>`, or `<`, you must enclose t
 
 To embed a `'` in a string enclosed in `"`, enter `'`; `name "Test'Group"`.
 
+To embed a `"` in a string enclosed in `"`, enter `\"`; `name "Test\"Group"`.
+
 To embed a `"` in a string enclosed in `'`, enter `"`; `name 'Test"Group'`.
 
 To embed a `'` in a string enclosed in `'`, enter `'\''`; `name 'Test'\''Group'`.
 
-To embed a `"` in a string enclosed in `"`, enter `\"`; `name "Test\"Group"`.
-
 Linux and MacOS do not recognize smart or curly quotes, `“` and `”`, they can not be used to enclose arguments.
 
 ## Windows Command Prompt

wiki/Domains.md

@@ -37,7 +37,7 @@ gam info domain [<DomainName>]
 gam show domains
         [formatjson]
 ```
-For `info`, if `<DomainName>` is omitted, information about the primary domain will be displayed.
+For `info`, if `<DomainName>` is omitted, customer information about the primary domain will be displayed.
 
 By default, Gam displays the information as an indented list of keys and values.
 * `formatjson` - Display the fields in JSON format.

wiki/GamUpdates.md

@@ -10,6 +10,126 @@ Add the `-s` option to the end of the above commands to suppress creating the `g
 
 See [Downloads-Installs-GAM7](https://github.com/GAM-team/GAM/wiki/Downloads-Installs) for Windows or other options, including manual installation
 
+### 7.46.01
+
+Fixed bug in `gam <CrOSTypeEntity> issuecommand command <CrOSCommand> ... csv` where
+command execution status lines were improperly indented.
+
+Upgraded to Python 3.14.6.
+
+### 7.46.00
+
+Added commands to create, update and delete Cloud Identity policies for data loss prevention (DLP) rules and detectors.
+
+* See: https://github.com/GAM-team/GAM/wiki/Cloud-Identity-Policies
+* See: https://workspaceupdates.googleblog.com/2026/06/introducing-workspace-policy-api-mutate-endpoints-for-DLP.html
+
+### 7.45.00
+
+Added options `isdisabled [<Boolean>]`, `disabledafter <DateTime>` and  `disabledbefore <DateTime>`
+to `gam print users`. These options along with `issuspended [<Boolean>]` and `isarchived [<Boolean>]`
+are useful when identifying users to deprovision.
+
+Added option `movefilepermissions [<Boolean>]]` to `gam <UserTypeEntity> move drivefile` that, when False,
+causes GAM to remove ACLs from a file before moving it; this will be most useful when moving files to
+Shared Drives so that only the Shared Drive ACls apply. When not specified or set True, file permissions
+are not removed; this is the current GAM behavior.
+
+Upgraded to OpenSSL 4.0.1.
+
+### 7.44.03
+
+Added `writerwithoutprivateaccess` to `<CalendarACLRole>`; this will become effective 2026-06-29.
+* See: https://developers.google.com/workspace/calendar/release-notes#June_01_2026
+
+### 7.44.02
+
+Added fields `bluetoothadapterinfo` and `osversioncompliance` to `<CrOSFieldName>` for use
+in `gam info|print cros`.
+
+### 7.44.01
+
+Added option `oneitemperrow` to `gam print crostelemetry` to have each of a device's
+report field entries displayed on a separate row with all of the other device fields.
+
+Added additional fields to `<CrOSTelemetryFieldName>`and `<CrOSTelemetryListFieldName>`:
+```
+appreport
+heartbeatstatusreport
+kioskappstatusreport
+networkbandwidthreport
+runtimecountersreport
+```
+
+### 7.44.00
+
+Added support for User data `archivalTime` and `suspensionTime` that is available
+when fields `archived` and `suspended` are requested in `gam info user` and `gam print users`.
+
+Added the following options to `gam <UserTypeEntity> show chatmessages` to simplify specifying a filter.
+```
+start|starttime <Date>|<Time>
+end|endtime <Date>|<Time>
+range <Date>|<Time> <Date>|<Time>
+thread <ChatThread>
+```
+
+Added commands to search for and display chat messages.
+* See: https://github.com/GAM-team/GAM/wiki/Users-Chat#display-chat-messages-by-searching
+
+These commands are in Developer Preview; to use them you must have these values set in `gam.cfg`.
+```
+developer_preview_apis = chat
+developer_preview_api_key = <DeveloperPreviewKey>
+```
+
+Upgraded to Python 3.14.5.
+
+### 7.43.10
+
+Updated `gam <UserTypeEntity> forward message|thread [recipient|to] <RecipientEntity>` to not forward messages
+to the `Bcc` recipients of the original message.
+
+Fixed bug in `gam <UserTypeEntity> forward message|thread [recipient|to] <RecipientEntity> addorigfieldstosubject`
+where the recipient of the forwarded message was added to the subject line instead of the recipient of the original message.
+
+### 7.43.09
+
+Fixed bug in `gam <UserTypeEntity> print filelist` that caused a trap.
+
+### 7.43.08
+
+Fixed bug and formatting issues in `gam info device <DeviceEntity>`.
+
+### 7.43.07
+
+Improved validation of `<QueryCrOS>`, `<QueryDevice>` and `<QueryMobile>`.
+
+### 7.43.06
+
+Updated commands that use `<QueryCrOS>`, `<QueryDevice>` or `<QueryMobile>` to validate
+that it is of the form `field:value` and that `value` does not contain a '?'.
+Without validation, Google can return many more devices than are expected.
+
+### 7.43.05
+
+Added option `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` to `<EventMatchProperty>`
+that is used in commands that process events. The match is true if all of the addresses in `<EmailAddressEntity>`
+are present as attendees in the event and are an organizer or not based on `<Boolean>`.
+
+Added option `max_to_deprov <Integer>` to `gam update cros <CrOSEntity> action <CrOSAction>`
+that is used when `<CrOSAction>` is any of the following:
+```
+deprovision_different_model_replace|
+deprovision_different_model_replacement|
+deprovision_retiring_device|
+deprovision_same_model_replace|
+deprovision_same_model_replacement|
+deprovision_upgrade_transfer
+```
+`max_to_deprov <Integer>` - No deprovisions are processed if the number of devices in `<CrOSEntity>` exceeds `<Integer>`;
+the default value is one; set `<Integer>` to 0 for no limit.
+
 ### 7.43.04
 
 Added option `include_suspended_zeros [<Boolean>]` to `gam print vaultcounts` that causes
@@ -28,7 +148,7 @@ gam <UserTypeEntity> print filelist ... filepath|fullpath
 
 ### 7.43.02
 
-Added option `maxactivities <Number>` to `gam <UserTypeEntity> print driveactivity` to limit
+Added option `maxactivities <Integer>` to `gam <UserTypeEntity> print driveactivity` to limit
 the number of activities displayed; the default is 0, no limit.
 
 ### 7.43.01

wiki/How-to-Upgrade-Legacy-GAM-to-GAM7.md

@@ -251,10 +251,10 @@ writes the credentials into the file oauth2.txt.
 ```
 gamteam@server:/Users/gamteam$ rm -f /Users/gamteam/GAMConfig/oauth2.txt
 gamteam@server:/Users/gamteam$ gam version
-GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.46.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.4 64-bit final
+Python 3.14.6 64-bit final
-macOS Tahoe 26.4.1 arm64
+macOS Tahoe 26.5.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 
@@ -1034,9 +1034,9 @@ writes the credentials into the file oauth2.txt.
 ```
 C:\>del C:\GAMConfig\oauth2.txt
 C:\>gam version
-GAM 7.43.04 - https://github.com/GAM-team/GAM - pythonsource
+GAM 7.46.01 - https://github.com/GAM-team/GAM - pythonsource
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.4 64-bit final
+Python 3.14.6 64-bit final
 Windows 11 10.0.26200 AMD64
 Path: C:\GAM7
 Config File: C:\GAMConfig\gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com

wiki/Licenses.md

@@ -50,7 +50,7 @@
 | Assured Controls | 1010390001 | assuredcontrols |
 | Assured Controls Plus | 1010390002 | assuredcontrolsplus |
 | Chrome Enterprise Premium | 1010400001 | cep | chromeenterprisepremium |
-| Cloud Identity | 1010010001 | cloudidentity |
+| Cloud Identity Free | 1010010001 | cloudidentity |
 | Cloud Identity Premium | 1010050001 | cloudidentitypremium |
 | Cloud Search | 1010350001 | cloudsearch |
 | Colab Pro | 1010500001 | colabpro |
@@ -163,7 +163,7 @@
         assuredcontrolsplus | 1010390002 | Assured Controls Plus |
         bce | beyondcorp | beyondcorpenterprise | cep | chromeenterprisepremium | 1010400001 | Chrome Enterprise Premium |
         cdm | chrome | googlechromedevicemanagement | Google-Chrome-Device-Management |
-        cloudidentity | identity | 1010010001 | Cloud Identity |
+        cloudidentityfree| cloudidentity | identity | 1010010001 | Cloud Identity Free |
         cloudidentitypremium | identitypremium | 1010050001 | Cloud Identity Premium |
         cloudsearch | 1010350001 | Cloud Search |
         colabpro | 1010500001 | Colab Pro |

wiki/Mobile-Devices.md

@@ -16,7 +16,7 @@
 
 ## Definitions
 ```
-<QueryMobile> ::= <String>
+<QueryMobile> ::= <String>:<String>
         See: https://support.google.com/a/answer/7549103
 <QueryMobileList> ::= "<QueryMobile>(,<QueryMobile>)*"
 <ResourceID> ::= <String>

wiki/Other-Resources.md

@@ -12,6 +12,7 @@ Thank you.
 * James Seymour - https://sites.google.com/view/gam--commands/
 * Kevin Melillo - https://github.com/KevinMelilloIEEE/gam-script
 * Korey Rideout - https://chatgpt.com/g/g-PTxxnVPMG-gam-assist-now-turbocharged-with-gam7
+* Paul Ogier (Taming.Tech) - GAM Scripts https://github.com/PaulOgier/GAMScripts
 * Paul Ogier (Taming.Tech) - GAM7 Course on Udemy https://taming.tech/GAMCourse
 * Paul Ogier (Taming.Tech) - GAM7 Tutorials https://www.youtube.com/watch?v=g9LDeyXQNLI&list=PL_dLiK09pJVhKJxZHNk9CHK0q5hkZ856w
 * Paul Ogier (Taming.Tech) - Installation videos

wiki/Users-Calendars-Access.md

@@ -14,6 +14,9 @@ Calendar ACL roles (as seen in Calendar GUI):
   * `owner` - Make changes to events and manage sharing
   * `freebusy` & `freebusyreader` - See only free/busy (hide details)
 
+Added `writerwithoutprivateaccess` to `<CalendarACLRole>` in 7.44.03; this will become effective 2026-06-29.
+* See: https://developers.google.com/workspace/calendar/release-notes#June_01_2026
+
 ## API documentation
 * [Calendar API - ACLs](https://developers.google.com/google-apps/calendar/v3/reference/acl)
 
@@ -55,10 +58,10 @@ Calendar ACL roles (as seen in Calendar GUI):
         (timezone <TimeZone>)
 
 <CalendarACLRole> ::=
-         editor|freebusy|freebusyreader|owner|reader|writer
+         editor|freebusy|freebusyreader|owner|reader|writer|writerwithoutprivateaccess|none
 <CalendarACLScope> ::=
         <EmailAddress>|user:<EmailAdress>|group:<EmailAddress>|
-         domain:<DomainName>|domain|default
+        domain:<DomainName>|domain|default
 <CalendarACLScopeList> ::=
         "<CalendarACLScope>(,<CalendarACLScope>)*"
 <CalendarACLScopeEntity>::=
@@ -150,3 +153,4 @@ This capability is no longer available, see: https://developers.google.com/works
 
 Data ownership can be transferred in the Google Calendar UI.
 
+See: https://workspaceupdates.googleblog.com/2026/03/an-update-on-secondary-calendar-lifecycle-changes-and-a-new-API.html

wiki/Users-Calendars-Events.md

@@ -277,6 +277,7 @@
 
 <EventMatchProperty> ::=
         (matchfield attendees <EmailAddressEntity>)|
+        (matchfield attendeesorganizer <Boolean> <EmailAddressEntity>)|
         (matchfield attendeesonlydomainlist <DomainNameList>)|
         (matchfield attendeesdomainlist <DomainNameList>)|
         (matchfield attendeesnotdomainlist <DomainNameList>)|
@@ -460,8 +461,11 @@ The Google Calendar API processes `<EventSelectProperty>*`; you may specify none
 * `singleevents` - Whether to expand recurring events into instances and only return single one-off events and instances of recurring events, but not the underlying recurring events themselves
 * `updatedmin <Time>` - Lower bound for an event's last modification time (as a RFC3339 timestamp) to filter by. When specified, entries deleted since this time will always be included regardless of showdeletedevents
 
-GAM processes `<EventMatchProperty>*`; you may specify none or multiple properties.
+GAM processes `<EventMatchProperty>*`
-* `matchfield attendees <EmailAddressEntity>` - All of the attendees in `<EmailAddressEntity>` must be present
+; you may specify none or multiple properties.
+* `matchfield attendees <EmailAddressEntity>` - All of the addresses in `<EmailAddressEntity>` must be present as attendees
+* `matchfield attendeesorganizer <Boolean> <EmailAddressEntity>` - All of the addressed  in `<EmailAddressEntity>` must be present
+  as attendees and are an organizer or not based on `<Boolean>`
 * `matchfield attendeesonlydomainlist <DomainNameList>` - All attendee's email addresses must be in a domain in `<DomainNameList>`
   * For example, this lets you look for events with all attendees in your internal domains. You should include `resource.calendar.google.com`
     in `<DomainNameList>` if the events use resources.

wiki/Users-Chat.md

@@ -16,6 +16,7 @@
 - [Display Chat Members](#display-chat-members)
 - [Manage Chat Messages](#manage-chat-messages)
 - [Display Chat Messages](#display-chat-messages)
+- [Display Chat Messages by Searching](#display-chat-messages-by-searching)
 - [Display Chat Events](#display-chat-events)
 - [Manage Chat Emojis](#manage-chat-emojis)
 - [Display Chat Emojis](#display-chat-emojis)
@@ -65,6 +66,7 @@ Google requires that you have a Chat Bot configured in order to use the Chat API
 * [Chat API - Custom Emojis](https://developers.google.com/workspace/chat/api/reference/rest/v1/customEmojis)
 * [Chat API - Members](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.members/list)
 * [Chat API - Messages](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.messages/list)
+* [Chat API - Search Messages](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.messages/search)
 * [Chat API - Events](https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.spaceEvents/list)
 * [Chat API - User Sections](https://developers.google.com/workspace/chat/api/reference/rest/v1/users.sections)
 * [Apps in Google Chat](https://support.google.com/chat/answer/7655820)
@@ -109,8 +111,8 @@ Google requires that you have a Chat Bot configured in order to use the Chat API
 <ChatThread> ::= spaces/<String>/threads/<String>
 <ChatSpaceType> ::=
         space|
-	groupchat|
+        groupchat|
-	directmessage
+        directmessage
 <ChatSpaceTypeList> ::= "<ChatSpaceType>(,<ChatSpaceType>)*"
 <ChatMessageID> ::= client-<String>
         <String> must contain only lowercase letters, numbers, and hyphens up to 56 characters in length.
@@ -908,7 +910,7 @@ gam user user@domain.com delete chatmessage name spaces/AAAADi-pvqc/messages/PKJ
 ```
 
 ## Display Chat Messages
-Display a specific Chat message.
+Display a specific chat message.
 
 ```
 gam <UserTypeEntity> info chatmessage name <ChatMessage>
@@ -923,12 +925,15 @@ By default, Gam displays the information as an indented list of keys and values.
 gam user user@domain.com info chatmessage name spaces/AAAADi-pvqc/messages/PKJrx90ooIU.PKJrx90ooIU
 ```
 
-### Display information about all chat messages in a chat space
+### Display information about chat messages in a chat space
 ```
 gam <UserTypeEntity> show chatmessages
         <ChatSpace>+
-        [showdeleted [<Boolean>]] [filter <String>]
+        [showdeleted [<Boolean>]]
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [thread <ChatThread>])
         [fields <ChatMessageFieldNameList>]
+        [orderby createtime [ascending|descending]]
         [formatjson]
 ```
 By default, Gam displays the information as an indented list of keys and values.
@@ -937,8 +942,11 @@ By default, Gam displays the information as an indented list of keys and values.
 ```
 gam <UserTypeEntity> print chatmessages [todrive <ToDriveAttribute>*]
         <ChatSpace>+
-        [showdeleted [<Boolean>]] [filter <String>]
+        [showdeleted [<Boolean>]]
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [thread <ChatThread>])
         [fields <ChatMessageFieldNameList>]
+        [orderby createtime [ascending|descending]]
         [formatjson [quotechar <Character>]]
 ```
 By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
@@ -952,38 +960,76 @@ The `quotechar <Character>` option allows you to choose an alternate quote chara
 
 By default, deleted messages are not displayed; use `showdeleted` to also display deleted messages.
 
-Use `filter <String>` to filter messages by `createTime` and `thread.name`.
+To filter messages by the time they were created:
+  * `start|starttime <Date>|<Time>` - Display messages created on or after the `<Date>|<Time>`
+  * `end|endtime <Date>|<Time>` - Display messages created before the `<Date>|<Time>`
+  * `range <Date>|<Time> <Date>|<Time>` - Display messages created on or after the first `<Date>|<Time>` and before the second `<Date>|<Time>`
 
-To filter messages by the date they were created, specify the createTime with a timestamp in RFC-3339 format and double quotation marks. For example, "2023-04-21T11:30:00-04:00".
+Use `thread <String>` to filter messages by their thread name, e.g., `spaces/AAAAAAAAAAA/threads/123`.
-* Use the greater than operator `>` to list messages that were created after a timestamp.
-* Use the less than operator `<` to list messages that were created before a timestamp.
-* To filter messages within a time interval, use the AND operator between two timestamps.
-* To filter by thread, specify the thread.name, formatted as spaces/{space}/threads/{thread}. You can only specify one thread.name per query.
-* To filter by both thread and date, use the AND operator in your query.
 
-For example, the following queries are valid on Linux/MacOS:
+## Display Chat Messages by Searching
+These commands are in Developer Preview; to use them you must have these values set in `gam.cfg`.
 ```
-filter 'createTime > "2012-04-21T11:30:00-04:00"'
+developer_preview_apis = chat
-filter 'createTime > "2012-04-21T11:30:00-04:00" AND thread.name = spaces/AAAAAAAAAAA/threads/123'
+developer_preview_api_key = <DeveloperPreviewKey>
-filter 'createTime > "2012-04-21T11:30:00+00:00" AND createTime < "2013-01-01T00:00:00+00:00" AND thread.name = spaces/AAAAAAAAAAA/threads/123'
-filter 'thread.name = spaces/AAAAAAAAAAA/threads/123'
 ```
+See the following for search option details:
+https://developers.google.com/workspace/chat/api/reference/rest/v1/spaces.messages/search
 
-For example, the following queries are valid on Windows Command Prompt:
+You must specify `keywords <StringList>`; messages that match any word|phrase in `<StringList>` are displayed.
-```
+Phrases must be enclosed in `"`.
-filter "createTime > \"2012-04-21T11:30:00-04:00\""
+* Linux, macOS, Windows Command Prompt - `keywords "\"things to do\" urgent"`
-filter "createTime > \"2012-04-21T11:30:00-04:00\" AND thread.name = spaces/AAAAAAAAAAA/threads/123"
+* Windows Power Shell - ```keywords "`"things to do`" urgent"```
-filter "createTime > \"2012-04-21T11:30:00+00:00\" AND createTime < \"2013-01-01T00:00:00+00:00\" AND thread.name = spaces/AAAAAAAAAAA/threads/123"
-filter "thread.name = spaces/AAAAAAAAAAA/threads/123"
-```
 
-For example, the following queries are valid on Windows PowerShell:
+By default, all spaces the user has access to are searched; use the following options to limit the search.
+  * `<ChatSpace>*` - Specific chat spaces
+  * `displaynames [all|any] <StringList>` - Spaces with display names with partial matches of `all|any` of the words in `<StringList>`
+
+Use the following to limit the search to messages with specific characteristics.
+  * `senders <EmailAddressEntity>` - Messages with any sender in `<EmailAddressEntity>`
+  * `usermentions [all|any] <EmailAddressEntity>` - Messages with mentions of `all|any` users in `<EmailAddressEntity>`
+  * `start|starttime <Date>|<Time>` - Messages created on or after the `<Date>|<Time>`
+  * `end|endtime <Date>|<Time>` - Messages created before the `<Date>|<Time>`
+  * `range <Date>|<Time> <Date>|<Time>` - Messages created on or after the first `<Date>|<Time>` and before the second `<Date>|<Time>`
+  * `hasattachment` - Messages with at least one attachment
 ```
-filter 'createTime > \"2012-04-21T11:30:00-04:00\"'
+gam <UserTypeEntity> show chatsearchmessages
-filter 'createTime > \"2012-04-21T11:30:00-04:00\" AND thread.name = spaces/AAAAAAAAAAA/threads/123"'
+        keywords <StringList>
-filter 'createTime > \"2012-04-21T11:30:00+00:00\" AND createTime < \"2013-01-01T00:00:00+00:00\" AND thread.name = spaces/AAAAAAAAAAA/threads/123'
+        <ChatSpace>*
-filter 'thread.name = spaces/AAAAAAAAAAA/threads/123'
+        [displaynames [all|any] <StringList>]
+        [senders <EmailAddressEntity>]*
+        [usermentions [all|any] <EmailAddressEntity>]*
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [hasattachment]
+        [fields <ChatMessageFieldNameList>]
+        [orderby createtime|relevance]
+        [formatjson]
 ```
+By default, Gam displays the information as an indented list of keys and values.
+* `formatjson` - Display the fields in JSON format.
+
+```
+gam <UserTypeEntity> print chatsearchmessages [todrive <ToDriveAttribute>*]
+        keywords <StringList>
+        <ChatSpace>*
+        [displaynames [all|any] <StringList>]
+        [senders <EmailAddressEntity>]*
+        [usermentions [all|any] <EmailAddressEntity>]*
+        [([start|starttime <Date>|<Time>] [end|endtime <Date>|<Time>])|(range <Date>|<Time> <Date>|<Time>)]
+        [hasattachment]
+        [fields <ChatMessageFieldNameList>]
+        [orderby createtime|relevance]
+        [formatjson [quotechar <Character>]]
+```
+By default, Gam displays the information as columns of fields; the following option causes the output to be in JSON format,
+* `formatjson` - Display the fields in JSON format.
+
+By default, when writing CSV files, Gam uses a quote character of double quote `"`. The quote character is used to enclose columns that contain
+the quote character itself, the column delimiter (comma by default) and new-line characters. Any quote characters within the column are doubled.
+When using the `formatjson` option, double quotes are used extensively in the data resulting in hard to read/process output.
+The `quotechar <Character>` option allows you to choose an alternate quote character, single quote for instance, that makes for readable/processable output.
+`quotechar` defaults to `gam.cfg/csv_output_quote_char`. When uploading CSV files to Google, double quote `"` should be used.
+
 
 ## Display Chat Events
 Display a specific Chat event.

wiki/Users-Drive-Copy-Move.md

@@ -583,6 +583,7 @@ gam <UserTypeEntity> move drivefile <DriveFileEntity> [newfilename <DriveFileNam
         [copysubfolderpermissions [<Boolean>]]
         [copysubfolderinheritedpermissions [<Boolean>]]
         [copysubfoldernoninheritedpermissions never|always|syncallfolders|syncupdatedfolders]
+        [movefilepermissions [<Boolean>]]
         [excludepermissionsfromdomains|includepermissionsfromdomains <DomainNameList>]
         (mappermissionsemail <EmailAddress> <EmailAddress)* [mappermissionsemailfile <CSVFileInput> endcsv]
         (mappermissionsdomain <DomainName> <DomainName>)*
@@ -729,6 +730,8 @@ and any remaining copy errors.
 ### Moved File Permissions
 By default, the permissions of a moved file are not modified.
 
+When `movefilerpermissions false` is specified, all ACLs are removed.
+
 When `excludepermissionsfromdomains <DomainNameList>` is specified, any ACL that references a domain in `<DomainNameList>` will be removed.
 
 When `includepermissionsfromdomains <DomainNameList>` is specified, any ACLs that references a domain not in `<DomainNameList>` will be removed.

wiki/Users-Gmail-Messages-Threads.md

@@ -477,12 +477,12 @@ When `matchlabel <LabelName>` is specified, the following characters are replace
 
 ## Forward messages/threads
 ```
-gam <UserTypeEntity> forward message|messages recipient|to <RecipientEntity>
+gam <UserTypeEntity> forward message|messages [recipient|to] <RecipientEntity>
         (((query <QueryGmail> [querytime<String> <Date>]*) (matchlabel <LabelName>) [or|and])+
          [labelids <LabelIDList>]
          [quick|notquick] [doit] [max_to_forward <Number>])|(ids <MessageIDEntity>)
          [subject <String>] [addorigfieldstosubject]
-gam <UserTypeEntity> forward thread|threads recipient|to <RecipientEntity>
+gam <UserTypeEntity> forward thread|threads [recipient|to] <RecipientEntity>
         (((query <QueryGmail> [querytime<String> <Date>]*) (matchlabel <LabelName>) [or|and])+
          [labelids <LabelIDList>]
          [quick|notquick] [doit] [max_to_forward <Number>])|(ids <ThreadIDEntity>)

wiki/Users.md

@@ -1093,7 +1093,9 @@ gam print users [todrive <ToDriveAttribute>*]
         (filtermultiattrcustom <UserMultiAttributeFilterName> <String>)*
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        ([issuspended [<Boolean>]] [isarchived [<Boolean>]])|(isdisabled [<Boolean>])]
+        [disabledafter <DateTime>] [disabledbefore <DateTime>]
+        [aliasmatchpattern <REMatchPattern>]
         [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 ```
 
@@ -1103,8 +1105,45 @@ By default, users in all domains in the account are selected; these options allo
 * `(query <QueryUser>)|(queries <QueryUserList>)` - Limit users to those that match a query; each query is run against each domain
 * `limittoou <OrgUnitPath>|<OrgUnitID>` - Limit users to those in the specified `<OrgUnitItem>>`
 * `deleted_only|only_deleted` - Only display deleted users
-* `issuspended <Boolean>` - Limit users based on their status
+
-* `isarchived <Boolean>` - Limit users based on their status
+The `isarchived`, `issuspended` and `isdisabled` options can be used to select users based on their archival/suspension status.
+
+| Options | Users Displayed |
+|---------|-----------------|
+| None | All Users|
+| isarchived [true] | Archived Users |
+| isarchived false | Non-Archived Users |
+| issuspended [true] | Suspended Users |
+| issuspended false | Non-Suspended Users |
+| isarchived [true] issuspended [true] | Archived Users that are Suspended |
+| isarchived [true] issuspended false | Archived Users that are not Suspended |
+| isarchived false issuspended [true] | Suspended Users that are not Archived |
+| isarchived false issuspended false | Non-Archived and Non-Suspended Users |
+| isdisabled [true] | Archived or Suspended Users |
+| isdisabled false | Non-Archived and Non-Suspended Users |
+
+When none of `isarchived`, `issuspended`, `isdisabled` are specified,
+but one or both of `disabledafter` or `disabledbefore` is specified,
+then `isdisabled true` is selected.
+
+When any of `isarchived [true]`, `issuspended [true]`, `isdisabled [true]` are specified,
+the following options  can be used to further limit the users displayed.
+* `disabledafter <DateTime>` - Display users disabled on/after `<DateTime>`
+* `disabledbefore <DateTime>` - Display users disabled before `<DateTime>`
+
+### Examples
+Display users suspended more than 90 days ago.
+```
+gam print users issuspended disabledbefore -90d
+```
+Display users archived within the last 10 days.
+```
+gam print users isarchived disabledafter -10d
+```
+Display users archived/suspended  within a range.
+```
+gam print users isdisabled disabledafter -60d disabledbefore -30d
+```
 
 ### Print a header row and fields for users specified by `<UserTypeEntity>`
 ```
@@ -1121,7 +1160,9 @@ gam print users [todrive <ToDriveAttribute>*] select <UserTypeEntity>
         (filtermultiattrcustom <UserMultiAttributeFilterName> <String>)*
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        ([issuspended [<Boolean>]] [isarchived [<Boolean>]])|(isdisabled [<Boolean>])]
+        [disabledafter <DateTime>] [disabledbefore <DateTime>]
+        [aliasmatchpattern <REMatchPattern>]
         [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 
 gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
@@ -1137,7 +1178,9 @@ gam <UserTypeEntity> print users [todrive <ToDriveAttribute>*]
         (filtermultiattrcustom <UserMultiAttributeFilterName> <String>)*
         [delimiter <Character>] [sortheaders [<Boolean>]] [scalarsfirst [<Boolean>]]
         [formatjson [quotechar <Character>]] [quoteplusphonenumbers]
-        [issuspended <Boolean>] [isarchived <Boolean>] [aliasmatchpattern <REMatchPattern>]
+        ([issuspended [<Boolean>]] [isarchived [<Boolean>]])|(isdisabled [<Boolean>])]
+        [disabledafter <DateTime>] [disabledbefore <DateTime>]
+        [aliasmatchpattern <REMatchPattern>]
         [showvalidcolumn] (addcsvdata <FieldName> <String>)* [includecsvdatainjson [<Boolean>]]
 ```
 
@@ -1175,6 +1218,45 @@ of a specified `type` or `customType`.
 * `filtermultiattrtype <UserMultiAttributeFilterName> <String>` - Display `<UserMultiAttributeFilterName>` if its `type` is `<String>`
 * `filtermultiattrcustom <UserMultiAttributeFilterName> <String>` - Display `<UserMultiAttributeFilterName>` if its `customType` is `<String>`
 
+The `isarchived`, `issuspended` and `isdisabled` options can be used to select users from `<UserTypeEntity>`  based on their archival/suspension status.
+
+| Options | Users Displayed |
+|---------|-----------------|
+| None | All Users|
+| isarchived [true] | Archived Users |
+| isarchived false | Non-Archived Users |
+| issuspended [true] | Suspended Users |
+| issuspended false | Non-Suspended Users |
+| isarchived [true] issuspended [true] | Archived Users that are Suspended |
+| isarchived [true] issuspended false | Archived Users that are not Suspended |
+| isarchived false issuspended [true] | Suspended Users that are not Archived |
+| isarchived false issuspended false | Non-Archived and Non-Suspended Users |
+| isdisabled [true] | Archived or Suspended Users |
+| isdisabled false | Non-Archived and Non-Suspended Users |
+
+When none of `isarchived`, `issuspended`, `isdisabled` are specified,
+but one or both of `disabledafter` or `disabledbefore` is specified,
+then `isdisabled true` is selected.
+
+When any of `isarchived [true]`, `issuspended [true]`, `isdisabled [true]` are specified,
+the following options  can be used to further limit the users displayed.
+* `disabledafter <DateTime>` - Display users disabled on/after `<DateTime>`
+* `disabledbefore <DateTime>` - Display users disabled before `<DateTime>`
+
+### Examples
+Display staff users suspended more than 90 days ago.
+```
+gam ou /Staff print users issuspended disabledbefore -90d
+```
+Display staff users archived within the last 10 days.
+```
+gam ou /Staff print users isarchived disabledafter -10d
+```
+Display staff users archived/suspended  within a range.
+```
+gam ou /Staff print users isdisabled disabledafter -60d disabledbefore -30d
+```
+
 By default, when aliases are displayed, all aliases are displayed. Use `aliasmatchpattern <REMatchPattern>`
 to limit the display of aliases to those that match `<REMatchPattern>`.
 

wiki/Vault-Takeout.md

@@ -376,7 +376,7 @@ For `corpus calendar`, you can specify advanced search options:
 * `minuswords <StringList>`
   * Matches only those events that do not contain any of the words in the given set in title, description, location, or attendees.
   * Entries in the set are considered in "or".
-* `responsestatuses <AttendeeStatus>(,<AttendeeStatus>)*
+* `responsestatuses <AttendeeStatus>(,<AttendeeStatus>)*`
   * Matches only events for which the custodian gave one of these responses. If the set is empty, there will be no filtering on responses.
 * `calendarversiondate <Date>|<Time>`
   * Search the current version of the Calendar event, but export the contents of the last version saved before 12:00 AM UTC on the specified date.

wiki/Version-and-Help.md

@@ -3,10 +3,10 @@
 Print the current version of Gam with details
 ```
 gam version
-GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.46.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.4 64-bit final
+Python 3.14.6 64-bit final
-macOS Tahoe 26.4.1 arm64
+macOS Tahoe 26.5.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GamConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Time: 2026-02-15T07:51:00-08:00
@@ -15,10 +15,10 @@ Time: 2026-02-15T07:51:00-08:00
 Print the current version of Gam with details and time offset information
 ```
 gam version timeoffset
-GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.46.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.4 64-bit final
+Python 3.14.6 64-bit final
-macOS Tahoe 26.4.1 arm64
+macOS Tahoe 26.5.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/admin/GAMConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Your system time differs from www.googleapis.com by less than 1 second
@@ -27,29 +27,29 @@ Your system time differs from www.googleapis.com by less than 1 second
 Print the current version of Gam with extended details and SSL information
 ```
 gam version extended
-GAM 7.43.04 - https://github.com/GAM-team/GAM - pyinstaller
+GAM 7.46.01 - https://github.com/GAM-team/GAM - pyinstaller
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.4 64-bit final
+Python 3.14.6 64-bit final
-macOS Tahoe 26.4.1 arm64
+macOS Tahoe 26.5.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GamConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Time: 2026-02-15T07:51:00-08:00
 Your system time differs from admin.googleapis.com by less than 1 second
-OpenSSL 4.0.0 14 Apr 2026
+OpenSSL 4.0.1 9 Jun 2026
 arrow 1.4.0
-chardet 5.2.0
+chardet 7.4.3
-cryptography 46.0.5
+cryptography 48.0.0
-filelock 3.21.2
+filelock 3.29.0
-google-api-python-client 2.190.0
+google-api-python-client 2.196.0
-google-auth-httplib2 0.3.0
+google-auth-httplib2 0.4.0
-google-auth-oauthlib 1.2.4
+google-auth-oauthlib 1.4.0
-google-auth 2.48.0
+google-auth 2.53.0
-lxml 6.0.2
+lxml 6.1.1
 httplib2 0.31.2
 passlib 1.7.4
 pathvalidate 3.3.1
 pyscard 2.3.1
-yubikey-manager 5.9.0
+yubikey-manager 5.9.1
 admin.googleapis.com connects using TLSv1.3 TLS_AES_256_GCM_SHA384
 ```
 
@@ -68,7 +68,7 @@ MacOS High Sierra 10.13.6 x86_64
 Path: /Users/gamteam/bin/gam7
 Version Check:
   Current: 5.35.08
-   Latest: 7.43.04
+   Latest: 7.46.01
 echo $?
 1
 ```
@@ -76,7 +76,7 @@ echo $?
 Print the current version number without details
 ```
 gam version simple
-7.43.04
+7.46.01
 ```
 In Linux/MacOS you can do:
 ```
@@ -86,10 +86,10 @@ echo $VER
 Print the current version of Gam and address of this Wiki
 ```
 gam help
-GAM 7.43.04 - https://github.com/GAM-team/GAM
+GAM 7.46.01 - https://github.com/GAM-team/GAM
 GAM Team <google-apps-manager@googlegroups.com>
-Python 3.14.4 64-bit final
+Python 3.14.6 64-bit final
-macOS Tahoe 26.4.1 arm64
+macOS Tahoe 26.5.1 arm64
 Path: /Users/gamteam/bin/gam7
 Config File: /Users/gamteam/GamConfig/gam.cfg, Section: DEFAULT, customer_id: my_customer, domain: domain.com
 Time: 2026-02-15T07:51:00-08:00