Bump version to 2.11.0-rc2 (#17852)

Signed-off-by: GitHub <noreply@github.com>
Co-authored-by: pasha-codefresh <pasha-codefresh@users.noreply.github.com>

Dockerfile

@@ -6,7 +6,7 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:22.04@sha256:0bced47fffa3361afa981854fca
 ####################################################################################################
 FROM docker.io/library/golang:1.21.9@sha256:7d0dcbe5807b1ad7272a598fbf9d7af15b5e2bed4fd6c4c2b5b3684df0b317dd AS builder
 
-RUN echo 'deb http://deb.debian.org/debian buster-backports main' >> /etc/apt/sources.list
+RUN echo 'deb http://archieve.debian.org/debian buster-backports main' >> /etc/apt/sources.list
 
 RUN apt-get update && apt-get install --no-install-recommends -y \
     openssh-server \

VERSION

@@ -1 +1 @@
-2.11.0
+2.11.0-rc2

assets/swagger.json

@@ -975,6 +975,25 @@
             "type": "string",
             "name": "project",
             "in": "query"
+          },
+          {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "format": "int64"
+            },
+            "collectionFormat": "multi",
+            "name": "sourcePositions",
+            "in": "query"
+          },
+          {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "collectionFormat": "multi",
+            "name": "revisions",
+            "in": "query"
           }
         ],
         "responses": {

cmd/argocd/commands/app.go

@@ -730,9 +730,9 @@ func getServer(app *argoappv1.Application) string {
 // NewApplicationSetCommand returns a new instance of an `argocd app set` command
 func NewApplicationSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		appOpts      cmdutil.AppOptions
-		appNamespace string
-		sourceIndex  int
+		appOpts        cmdutil.AppOptions
+		appNamespace   string
+		sourcePosition int
 	)
 	var command = &cobra.Command{
 		Use:   "set APPNAME",
@@ -750,8 +750,8 @@ func NewApplicationSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Com
   # Set and override application parameters with a parameter file
   argocd app set my-app --parameter-file path/to/parameter-file.yaml
 
-  # Set and override application parameters for a source at index 1 under spec.sources of app my-app. source-index starts at 1.
-  argocd app set my-app --source-index 1 --repo https://github.com/argoproj/argocd-example-apps.git
+  # Set and override application parameters for a source at position 1 under spec.sources of app my-app. source-position starts at 1.
+  argocd app set my-app --source-position 1 --repo https://github.com/argoproj/argocd-example-apps.git
 
   # Set application parameters and specify the namespace
   argocd app set my-app --parameter key1=value1 --parameter key2=value2 --namespace my-namespace
@@ -772,24 +772,24 @@ func NewApplicationSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Com
 			errors.CheckError(err)
 
 			if app.Spec.HasMultipleSources() {
-				if sourceIndex <= 0 {
-					errors.CheckError(fmt.Errorf("Source index should be specified and greater than 0 for applications with multiple sources"))
+				if sourcePosition <= 0 {
+					errors.CheckError(fmt.Errorf("Source position should be specified and must be greater than 0 for applications with multiple sources"))
 				}
-				if len(app.Spec.GetSources()) < sourceIndex {
-					errors.CheckError(fmt.Errorf("Source index should be less than the number of sources in the application"))
+				if len(app.Spec.GetSources()) < sourcePosition {
+					errors.CheckError(fmt.Errorf("Source position should be less than the number of sources in the application"))
 				}
 			}
 
-			// sourceIndex startes with 1, thus, it needs to be decreased by 1 to find the correct index in the list of sources
-			sourceIndex = sourceIndex - 1
-			visited := cmdutil.SetAppSpecOptions(c.Flags(), &app.Spec, &appOpts, sourceIndex)
+			// sourcePosition startes with 1, thus, it needs to be decreased by 1 to find the correct index in the list of sources
+			sourcePosition = sourcePosition - 1
+			visited := cmdutil.SetAppSpecOptions(c.Flags(), &app.Spec, &appOpts, sourcePosition)
 			if visited == 0 {
 				log.Error("Please set at least one option to update")
 				c.HelpFunc()(c, args)
 				os.Exit(1)
 			}
 
-			setParameterOverrides(app, appOpts.Parameters, sourceIndex)
+			setParameterOverrides(app, appOpts.Parameters, sourcePosition)
 			_, err = appIf.UpdateSpec(ctx, &application.ApplicationUpdateSpecRequest{
 				Name:         &app.Name,
 				Spec:         &app.Spec,
@@ -799,7 +799,7 @@ func NewApplicationSetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Com
 			errors.CheckError(err)
 		},
 	}
-	command.Flags().IntVar(&sourceIndex, "source-index", -1, "Index of the source from the list of sources of the app. Index starts at 1.")
+	command.Flags().IntVar(&sourcePosition, "source-position", -1, "Position of the source from the list of sources of the app. Counting starts at 1.")
 	cmdutil.AddAppFlags(command, &appOpts)
 	command.Flags().StringVarP(&appNamespace, "app-namespace", "N", "", "Set application parameters in namespace")
 	return command
@@ -836,7 +836,7 @@ func (o *unsetOpts) KustomizeIsZero() bool {
 // NewApplicationUnsetCommand returns a new instance of an `argocd app unset` command
 func NewApplicationUnsetCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		sourceIndex int
+		sourcePosition int
 	)
 	appOpts := cmdutil.AppOptions{}
 	opts := unsetOpts{}
@@ -850,8 +850,8 @@ func NewApplicationUnsetCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
   # Unset kustomize override suffix
   argocd app unset my-app --namesuffix
 
-  # Unset kustomize override suffix for source at index 1 under spec.sources of app my-app. source-index starts at 1.
-  argocd app unset my-app --source-index 1 --namesuffix
+  # Unset kustomize override suffix for source at position 1 under spec.sources of app my-app. source-position starts at 1.
+  argocd app unset my-app --source-position 1 --namesuffix
 
   # Unset parameter override
   argocd app unset my-app -p COMPONENT=PARAM`,
@@ -871,15 +871,15 @@ func NewApplicationUnsetCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
 			errors.CheckError(err)
 
 			if app.Spec.HasMultipleSources() {
-				if sourceIndex <= 0 {
-					errors.CheckError(fmt.Errorf("Source index should be specified and greater than 0 for applications with multiple sources"))
+				if sourcePosition <= 0 {
+					errors.CheckError(fmt.Errorf("Source position should be specified and must be greater than 0 for applications with multiple sources"))
 				}
-				if len(app.Spec.GetSources()) < sourceIndex {
-					errors.CheckError(fmt.Errorf("Source index should be less than the number of sources in the application"))
+				if len(app.Spec.GetSources()) < sourcePosition {
+					errors.CheckError(fmt.Errorf("Source position should be less than the number of sources in the application"))
 				}
 			}
 
-			source := app.Spec.GetSourcePtr(sourceIndex)
+			source := app.Spec.GetSourcePtr(sourcePosition)
 
 			updated, nothingToUnset := unset(source, opts)
 			if nothingToUnset {
@@ -890,7 +890,7 @@ func NewApplicationUnsetCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
 				return
 			}
 
-			cmdutil.SetAppSpecOptions(c.Flags(), &app.Spec, &appOpts, sourceIndex)
+			cmdutil.SetAppSpecOptions(c.Flags(), &app.Spec, &appOpts, sourcePosition)
 			_, err = appIf.UpdateSpec(ctx, &application.ApplicationUpdateSpecRequest{
 				Name:         &app.Name,
 				Spec:         &app.Spec,
@@ -914,7 +914,7 @@ func NewApplicationUnsetCommand(clientOpts *argocdclient.ClientOptions) *cobra.C
 	command.Flags().StringArrayVar(&opts.pluginEnvs, "plugin-env", []string{}, "Unset plugin env variables (e.g --plugin-env name)")
 	command.Flags().BoolVar(&opts.passCredentials, "pass-credentials", false, "Unset passCredentials")
 	command.Flags().BoolVar(&opts.ref, "ref", false, "Unset ref on the source")
-	command.Flags().IntVar(&sourceIndex, "source-index", -1, "Index of the source from the list of sources of the app. Index starts at 1.")
+	command.Flags().IntVar(&sourcePosition, "source-position", -1, "Position of the source from the list of sources of the app. Counting starts at 1.")
 	return command
 }
 
@@ -1126,7 +1126,7 @@ func NewApplicationDiffCommand(clientOpts *argocdclient.ClientOptions) *cobra.Co
 		localIncludes      []string
 		appNamespace       string
 		revisions          []string
-		sourceIndexes      []int64
+		sourcePositions    []int64
 	)
 	shortDesc := "Perform a diff against the target and live state."
 	var command = &cobra.Command{
@@ -1141,8 +1141,8 @@ func NewApplicationDiffCommand(clientOpts *argocdclient.ClientOptions) *cobra.Co
 				os.Exit(2)
 			}
 
-			if len(revisions) != len(sourceIndexes) {
-				errors.CheckError(fmt.Errorf("While using revisions and source-indexes, length of values for both flags should be same."))
+			if len(revisions) != len(sourcePositions) {
+				errors.CheckError(fmt.Errorf("While using revisions and source-positions, length of values for both flags should be same."))
 			}
 
 			clientset := headless.NewClientOrDie(clientOpts, c)
@@ -1163,26 +1163,26 @@ func NewApplicationDiffCommand(clientOpts *argocdclient.ClientOptions) *cobra.Co
 			argoSettings, err := settingsIf.Get(ctx, &settings.SettingsQuery{})
 			errors.CheckError(err)
 			diffOption := &DifferenceOption{}
-			if app.Spec.HasMultipleSources() && len(revisions) > 0 && len(sourceIndexes) > 0 {
-
-				revisionSourceMappings := make(map[int64]string, 0)
-				for i, index := range sourceIndexes {
-					if index <= 0 {
-						errors.CheckError(fmt.Errorf("source-index cannot be less than or equal to 0. Index starts at 1."))
+			if app.Spec.HasMultipleSources() && len(revisions) > 0 && len(sourcePositions) > 0 {
+				numOfSources := int64(len(app.Spec.GetSources()))
+				for _, pos := range sourcePositions {
+					if pos <= 0 || pos > numOfSources {
+						log.Fatal("source-position cannot be less than 1 or more than number of sources in the app. Counting starts at 1.")
 					}
-					revisionSourceMappings[index] = revisions[i]
 				}
 
 				q := application.ApplicationManifestQuery{
-					Name:                   &appName,
-					AppNamespace:           &appNs,
-					RevisionSourceMappings: revisionSourceMappings,
+					Name:            &appName,
+					AppNamespace:    &appNs,
+					Revisions:       revisions,
+					SourcePositions: sourcePositions,
 				}
 				res, err := appIf.GetManifests(ctx, &q)
 				errors.CheckError(err)
 
 				diffOption.res = res
-				diffOption.revisionSourceMappings = &revisionSourceMappings
+				diffOption.revisions = revisions
+				diffOption.sourcePositions = sourcePositions
 			} else if revision != "" {
 				q := application.ApplicationManifestQuery{
 					Name:         &appName,
@@ -1233,20 +1233,21 @@ func NewApplicationDiffCommand(clientOpts *argocdclient.ClientOptions) *cobra.Co
 	command.Flags().BoolVar(&serverSideGenerate, "server-side-generate", false, "Used with --local, this will send your manifests to the server for diffing")
 	command.Flags().StringArrayVar(&localIncludes, "local-include", []string{"*.yaml", "*.yml", "*.json"}, "Used with --server-side-generate, specify patterns of filenames to send. Matching is based on filename and not path.")
 	command.Flags().StringVarP(&appNamespace, "app-namespace", "N", "", "Only render the difference in namespace")
-	command.Flags().StringArrayVar(&revisions, "revisions", []string{}, "Show manifests at specific revisions for the index of sources in source-indexes")
-	command.Flags().Int64SliceVar(&sourceIndexes, "source-indexes", []int64{}, "List of source indexes. Default is empty array. Indexes start at 1.")
+	command.Flags().StringArrayVar(&revisions, "revisions", []string{}, "Show manifests at specific revisions for source position in source-positions")
+	command.Flags().Int64SliceVar(&sourcePositions, "source-positions", []int64{}, "List of source positions. Default is empty array. Counting start at 1.")
 	return command
 }
 
 // DifferenceOption struct to store diff options
 type DifferenceOption struct {
-	local                  string
-	localRepoRoot          string
-	revision               string
-	cluster                *argoappv1.Cluster
-	res                    *repoapiclient.ManifestResponse
-	serversideRes          *repoapiclient.ManifestResponse
-	revisionSourceMappings *map[int64]string
+	local           string
+	localRepoRoot   string
+	revision        string
+	cluster         *argoappv1.Cluster
+	res             *repoapiclient.ManifestResponse
+	serversideRes   *repoapiclient.ManifestResponse
+	revisions       []string
+	sourcePositions []int64
 }
 
 // findandPrintDiff ... Prints difference between application current state and state stored in git or locally, returns boolean as true if difference is found else returns false
@@ -1258,7 +1259,7 @@ func findandPrintDiff(ctx context.Context, app *argoappv1.Application, proj *arg
 	if diffOptions.local != "" {
 		localObjs := groupObjsByKey(getLocalObjects(ctx, app, proj, diffOptions.local, diffOptions.localRepoRoot, argoSettings.AppLabelKey, diffOptions.cluster.Info.ServerVersion, diffOptions.cluster.Info.APIVersions, argoSettings.KustomizeOptions, argoSettings.TrackingMethod), liveObjs, app.Spec.Destination.Namespace)
 		items = groupObjsForDiff(resources, localObjs, items, argoSettings, app.InstanceName(argoSettings.ControllerNamespace), app.Spec.Destination.Namespace)
-	} else if diffOptions.revision != "" || (diffOptions.revisionSourceMappings != nil) {
+	} else if diffOptions.revision != "" || (diffOptions.revisions != nil && len(diffOptions.revisions) > 0) {
 		var unstructureds []*unstructured.Unstructured
 		for _, mfst := range diffOptions.res.Manifests {
 			obj, err := argoappv1.UnmarshalToUnstructured(mfst)
@@ -2495,11 +2496,11 @@ func waitOnApplicationStatus(ctx context.Context, acdClient argocdclient.Client,
 // setParameterOverrides updates an existing or appends a new parameter override in the application
 // the app is assumed to be a helm app and is expected to be in the form:
 // param=value
-func setParameterOverrides(app *argoappv1.Application, parameters []string, index int) {
+func setParameterOverrides(app *argoappv1.Application, parameters []string, sourcePosition int) {
 	if len(parameters) == 0 {
 		return
 	}
-	source := app.Spec.GetSourcePtr(index)
+	source := app.Spec.GetSourcePtr(sourcePosition)
 	var sourceType argoappv1.ApplicationSourceType
 	if st, _ := source.ExplicitType(); st != nil {
 		sourceType = *st
@@ -2736,12 +2737,12 @@ func printOperationResult(opState *argoappv1.OperationState) {
 // NewApplicationManifestsCommand returns a new instance of an `argocd app manifests` command
 func NewApplicationManifestsCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		source        string
-		revision      string
-		revisions     []string
-		sourceIndexes []int64
-		local         string
-		localRepoRoot string
+		source          string
+		revision        string
+		revisions       []string
+		sourcePositions []int64
+		local           string
+		localRepoRoot   string
 	)
 	var command = &cobra.Command{
 		Use:   "manifests APPNAME",
@@ -2754,7 +2755,7 @@ func NewApplicationManifestsCommand(clientOpts *argocdclient.ClientOptions) *cob
   argocd app manifests my-app --revision 0.0.1
 
   # Get manifests for a multi-source application at specific revisions for specific sources
-  argocd app manifests my-app --revisions 0.0.1 --source-indexes 1 --revisions 0.0.2 --source-indexes 2
+  argocd app manifests my-app --revisions 0.0.1 --source-positions 1 --revisions 0.0.2 --source-positions 2
   		`),
 		Run: func(c *cobra.Command, args []string) {
 			ctx := c.Context()
@@ -2764,8 +2765,14 @@ func NewApplicationManifestsCommand(clientOpts *argocdclient.ClientOptions) *cob
 				os.Exit(1)
 			}
 
-			if len(revisions) != len(sourceIndexes) {
-				errors.CheckError(fmt.Errorf("While using revisions and source-indexes, length of values for both flags should be same."))
+			if len(revisions) != len(sourcePositions) {
+				errors.CheckError(fmt.Errorf("While using revisions and source-positions, length of values for both flags should be same."))
+			}
+
+			for _, pos := range sourcePositions {
+				if pos <= 0 {
+					log.Fatal("source-position cannot be less than or equal to 0, Counting starts at 1")
+				}
 			}
 
 			appName, appNs := argo.ParseFromQualifiedName(args[0], "")
@@ -2798,21 +2805,14 @@ func NewApplicationManifestsCommand(clientOpts *argocdclient.ClientOptions) *cob
 
 					proj := getProject(c, clientOpts, ctx, app.Spec.Project)
 					unstructureds = getLocalObjects(context.Background(), app, proj.Project, local, localRepoRoot, argoSettings.AppLabelKey, cluster.ServerVersion, cluster.Info.APIVersions, argoSettings.KustomizeOptions, argoSettings.TrackingMethod)
-				} else if len(revisions) > 0 && len(sourceIndexes) > 0 {
-
-					revisionSourceMappings := make(map[int64]string, 0)
-					for i, index := range sourceIndexes {
-						if index <= 0 {
-							errors.CheckError(fmt.Errorf("source-index cannot be less than or equal to 0, Index starts at 1"))
-						}
-						revisionSourceMappings[index] = revisions[i]
-					}
+				} else if len(revisions) > 0 && len(sourcePositions) > 0 {
 
 					q := application.ApplicationManifestQuery{
-						Name:                   &appName,
-						AppNamespace:           &appNs,
-						Revision:               pointer.String(revision),
-						RevisionSourceMappings: revisionSourceMappings,
+						Name:            &appName,
+						AppNamespace:    &appNs,
+						Revision:        pointer.String(revision),
+						Revisions:       revisions,
+						SourcePositions: sourcePositions,
 					}
 					res, err := appIf.GetManifests(ctx, &q)
 					errors.CheckError(err)
@@ -2859,8 +2859,8 @@ func NewApplicationManifestsCommand(clientOpts *argocdclient.ClientOptions) *cob
 	}
 	command.Flags().StringVar(&source, "source", "git", "Source of manifests. One of: live|git")
 	command.Flags().StringVar(&revision, "revision", "", "Show manifests at a specific revision")
-	command.Flags().StringArrayVar(&revisions, "revisions", []string{}, "Show manifests at specific revisions for the index of sources in source-indexes")
-	command.Flags().Int64SliceVar(&sourceIndexes, "source-indexes", []int64{}, "List of source indexes. Default is empty array. Indexes start at 1.")
+	command.Flags().StringArrayVar(&revisions, "revisions", []string{}, "Show manifests at specific revisions for the source at position in source-positions")
+	command.Flags().Int64SliceVar(&sourcePositions, "source-positions", []int64{}, "List of source positions. Default is empty array. Counting start at 1.")
 	command.Flags().StringVar(&local, "local", "", "If set, show locally-generated manifests. Value is the absolute path to app manifests within the manifest repo. Example: '/home/username/apps/env/app-1'.")
 	command.Flags().StringVar(&localRepoRoot, "local-repo-root", ".", "Path to the local repository root. Used together with --local allows setting the repository root. Example: '/home/username/apps'.")
 	return command
@@ -3040,11 +3040,11 @@ func NewApplicationAddSourceCommand(clientOpts *argocdclient.ClientOptions) *cob
 			if len(app.Spec.Sources) > 0 {
 				appSource, _ := cmdutil.ConstructSource(&argoappv1.ApplicationSource{}, appOpts, c.Flags())
 
-				// sourceIndex is the index at which new source will be appended to spec.Sources
-				sourceIndex := len(app.Spec.GetSources())
+				// sourcePosition is the index at which new source will be appended to spec.Sources
+				sourcePosition := len(app.Spec.GetSources())
 				app.Spec.Sources = append(app.Spec.Sources, *appSource)
 
-				setParameterOverrides(app, appOpts.Parameters, sourceIndex)
+				setParameterOverrides(app, appOpts.Parameters, sourcePosition)
 
 				_, err = appIf.UpdateSpec(ctx, &application.ApplicationUpdateSpecRequest{
 					Name:         &app.Name,
@@ -3068,14 +3068,14 @@ func NewApplicationAddSourceCommand(clientOpts *argocdclient.ClientOptions) *cob
 // NewApplicationRemoveSourceCommand returns a new instance of an `argocd app remove-source` command
 func NewApplicationRemoveSourceCommand(clientOpts *argocdclient.ClientOptions) *cobra.Command {
 	var (
-		sourceIndex  int
-		appNamespace string
+		sourcePosition int
+		appNamespace   string
 	)
 	command := &cobra.Command{
 		Use:   "remove-source APPNAME",
-		Short: "Remove a source from multiple sources application. Index starts with 1. Default value is -1.",
-		Example: `  # Remove the source at index 1 from application's sources. Index starts at 1.
-  argocd app remove-source myapplication --source-index 1`,
+		Short: "Remove a source from multiple sources application. Counting starts with 1. Default value is -1.",
+		Example: `  # Remove the source at position 1 from application's sources. Counting starts at 1.
+  argocd app remove-source myapplication --source-position 1`,
 		Run: func(c *cobra.Command, args []string) {
 			ctx := c.Context()
 
@@ -3084,8 +3084,8 @@ func NewApplicationRemoveSourceCommand(clientOpts *argocdclient.ClientOptions) *
 				os.Exit(1)
 			}
 
-			if sourceIndex <= 0 {
-				errors.CheckError(fmt.Errorf("Index value of source must be greater than 0"))
+			if sourcePosition <= 0 {
+				errors.CheckError(fmt.Errorf("Value of source-position must be greater than 0"))
 			}
 
 			argocdClient := headless.NewClientOrDie(clientOpts, c)
@@ -3109,11 +3109,11 @@ func NewApplicationRemoveSourceCommand(clientOpts *argocdclient.ClientOptions) *
 				errors.CheckError(fmt.Errorf("Cannot remove the only source remaining in the app"))
 			}
 
-			if len(app.Spec.GetSources()) < sourceIndex {
-				errors.CheckError(fmt.Errorf("Application does not have source at %d\n", sourceIndex))
+			if len(app.Spec.GetSources()) < sourcePosition {
+				errors.CheckError(fmt.Errorf("Application does not have source at %d\n", sourcePosition))
 			}
 
-			app.Spec.Sources = append(app.Spec.Sources[:sourceIndex-1], app.Spec.Sources[sourceIndex:]...)
+			app.Spec.Sources = append(app.Spec.Sources[:sourcePosition-1], app.Spec.Sources[sourcePosition:]...)
 
 			_, err = appIf.UpdateSpec(ctx, &application.ApplicationUpdateSpecRequest{
 				Name:         &app.Name,
@@ -3126,6 +3126,6 @@ func NewApplicationRemoveSourceCommand(clientOpts *argocdclient.ClientOptions) *
 		},
 	}
 	command.Flags().StringVarP(&appNamespace, "app-namespace", "N", "", "Namespace of the target application where the source will be appended")
-	command.Flags().IntVar(&sourceIndex, "source-index", -1, "Index of the source from the list of sources of the app. Index starts from 1.")
+	command.Flags().IntVar(&sourcePosition, "source-position", -1, "Position of the source from the list of sources of the app. Counting starts at 1.")
 	return command
 }

cmd/util/app_test.go

@@ -174,12 +174,12 @@ func (f *appOptionsFixture) SetFlag(key, value string) error {
 	return err
 }
 
-func (f *appOptionsFixture) SetFlagWithSourceIndex(key, value string, index int) error {
+func (f *appOptionsFixture) SetFlagWithSourcePosition(key, value string, sourcePosition int) error {
 	err := f.command.Flags().Set(key, value)
 	if err != nil {
 		return err
 	}
-	_ = SetAppSpecOptions(f.command.Flags(), f.spec, f.options, index)
+	_ = SetAppSpecOptions(f.command.Flags(), f.spec, f.options, sourcePosition)
 	return err
 }
 
@@ -251,34 +251,34 @@ func newMultiSourceAppOptionsFixture() *appOptionsFixture {
 
 func Test_setAppSpecOptionsMultiSourceApp(t *testing.T) {
 	f := newMultiSourceAppOptionsFixture()
-	index := 0
-	index1 := 1
-	index2 := 2
+	sourcePosition := 0
+	sourcePosition1 := 1
+	sourcePosition2 := 2
 	t.Run("SyncPolicy", func(t *testing.T) {
-		assert.NoError(t, f.SetFlagWithSourceIndex("sync-policy", "automated", index1))
+		assert.NoError(t, f.SetFlagWithSourcePosition("sync-policy", "automated", sourcePosition1))
 		assert.NotNil(t, f.spec.SyncPolicy.Automated)
 
 		f.spec.SyncPolicy = nil
-		assert.NoError(t, f.SetFlagWithSourceIndex("sync-policy", "automatic", index1))
+		assert.NoError(t, f.SetFlagWithSourcePosition("sync-policy", "automatic", sourcePosition1))
 		assert.NotNil(t, f.spec.SyncPolicy.Automated)
 	})
-	t.Run("Helm - Index 0", func(t *testing.T) {
-		assert.NoError(t, f.SetFlagWithSourceIndex("helm-version", "v2", index))
+	t.Run("Helm - SourcePosition 0", func(t *testing.T) {
+		assert.NoError(t, f.SetFlagWithSourcePosition("helm-version", "v2", sourcePosition))
 		assert.Equal(t, len(f.spec.GetSources()), 2)
-		assert.Equal(t, f.spec.GetSources()[index].Helm.Version, "v2")
+		assert.Equal(t, f.spec.GetSources()[sourcePosition].Helm.Version, "v2")
 	})
 	t.Run("Kustomize", func(t *testing.T) {
-		assert.NoError(t, f.SetFlagWithSourceIndex("kustomize-replica", "my-deployment=2", index1))
-		assert.Equal(t, f.spec.Sources[index1-1].Kustomize.Replicas, v1alpha1.KustomizeReplicas{{Name: "my-deployment", Count: intstr.FromInt(2)}})
-		assert.NoError(t, f.SetFlagWithSourceIndex("kustomize-replica", "my-deployment=4", index2))
-		assert.Equal(t, f.spec.Sources[index2-1].Kustomize.Replicas, v1alpha1.KustomizeReplicas{{Name: "my-deployment", Count: intstr.FromInt(4)}})
+		assert.NoError(t, f.SetFlagWithSourcePosition("kustomize-replica", "my-deployment=2", sourcePosition1))
+		assert.Equal(t, f.spec.Sources[sourcePosition1-1].Kustomize.Replicas, v1alpha1.KustomizeReplicas{{Name: "my-deployment", Count: intstr.FromInt(2)}})
+		assert.NoError(t, f.SetFlagWithSourcePosition("kustomize-replica", "my-deployment=4", sourcePosition2))
+		assert.Equal(t, f.spec.Sources[sourcePosition2-1].Kustomize.Replicas, v1alpha1.KustomizeReplicas{{Name: "my-deployment", Count: intstr.FromInt(4)}})
 	})
 	t.Run("Helm", func(t *testing.T) {
-		assert.NoError(t, f.SetFlagWithSourceIndex("helm-version", "v2", index1))
-		assert.NoError(t, f.SetFlagWithSourceIndex("helm-version", "v3", index2))
+		assert.NoError(t, f.SetFlagWithSourcePosition("helm-version", "v2", sourcePosition1))
+		assert.NoError(t, f.SetFlagWithSourcePosition("helm-version", "v3", sourcePosition2))
 		assert.Equal(t, len(f.spec.GetSources()), 2)
-		assert.Equal(t, f.spec.GetSources()[index1-1].Helm.Version, "v2")
-		assert.Equal(t, f.spec.GetSources()[index2-1].Helm.Version, "v3")
+		assert.Equal(t, f.spec.GetSources()[sourcePosition1-1].Helm.Version, "v2")
+		assert.Equal(t, f.spec.GetSources()[sourcePosition2-1].Helm.Version, "v3")
 	})
 }
 

docs/operator-manual/tested-kubernetes-versions.md

@@ -1,6 +1,5 @@
 | Argo CD version | Kubernetes versions |
 |-----------------|---------------------|
-| 2.7 | v1.26, v1.25, v1.24, v1.23 |
-| 2.6 | v1.24, v1.23, v1.22 |
-| 2.5 | v1.24, v1.23, v1.22 |
-
+| 2.11 | v1.29, v1.28, v1.27, v1.26, v1.25 |
+| 2.10 | v1.28, v1.27, v1.26, v1.25 |
+| 2.9 | v1.28, v1.27, v1.26, v1.25 |

docs/user-guide/commands/argocd_app.md

@@ -91,7 +91,7 @@ argocd app [flags]
 * [argocd app manifests](argocd_app_manifests.md)	 - Print manifests of an application
 * [argocd app patch](argocd_app_patch.md)	 - Patch application
 * [argocd app patch-resource](argocd_app_patch-resource.md)	 - Patch resource in an application
-* [argocd app remove-source](argocd_app_remove-source.md)	 - Remove a source from multiple sources application. Index starts with 1. Default value is -1.
+* [argocd app remove-source](argocd_app_remove-source.md)	 - Remove a source from multiple sources application. Counting starts with 1. Default value is -1.
 * [argocd app resources](argocd_app_resources.md)	 - List resource of application
 * [argocd app rollback](argocd_app_rollback.md)	 - Rollback application to a previous deployed version by History ID, omitted will Rollback to the previous version
 * [argocd app set](argocd_app_set.md)	 - Set application parameters

docs/user-guide/commands/argocd_app_diff.md

@@ -18,18 +18,18 @@ argocd app diff APPNAME [flags]
 ### Options
 
 ```
-  -N, --app-namespace string        Only render the difference in namespace
-      --exit-code                   Return non-zero exit code when there is a diff (default true)
-      --hard-refresh                Refresh application data as well as target manifests cache
-  -h, --help                        help for diff
-      --local string                Compare live app to a local manifests
-      --local-include stringArray   Used with --server-side-generate, specify patterns of filenames to send. Matching is based on filename and not path. (default [*.yaml,*.yml,*.json])
-      --local-repo-root string      Path to the repository root. Used together with --local allows setting the repository root (default "/")
-      --refresh                     Refresh application data when retrieving
-      --revision string             Compare live app to a particular revision
-      --revisions stringArray       Show manifests at specific revisions for the index of sources in source-indexes
-      --server-side-generate        Used with --local, this will send your manifests to the server for diffing
-      --source-indexes int64Slice   List of source indexes. Default is empty array. Indexes start at 1. (default [])
+  -N, --app-namespace string          Only render the difference in namespace
+      --exit-code                     Return non-zero exit code when there is a diff (default true)
+      --hard-refresh                  Refresh application data as well as target manifests cache
+  -h, --help                          help for diff
+      --local string                  Compare live app to a local manifests
+      --local-include stringArray     Used with --server-side-generate, specify patterns of filenames to send. Matching is based on filename and not path. (default [*.yaml,*.yml,*.json])
+      --local-repo-root string        Path to the repository root. Used together with --local allows setting the repository root (default "/")
+      --refresh                       Refresh application data when retrieving
+      --revision string               Compare live app to a particular revision
+      --revisions stringArray         Show manifests at specific revisions for source position in source-positions
+      --server-side-generate          Used with --local, this will send your manifests to the server for diffing
+      --source-positions int64Slice   List of source positions. Default is empty array. Counting start at 1. (default [])
 ```
 
 ### Options inherited from parent commands

docs/user-guide/commands/argocd_app_manifests.md

@@ -18,19 +18,19 @@ argocd app manifests APPNAME [flags]
   argocd app manifests my-app --revision 0.0.1
   
   # Get manifests for a multi-source application at specific revisions for specific sources
-  argocd app manifests my-app --revisions 0.0.1 --source-indexes 1 --revisions 0.0.2 --source-indexes 2
+  argocd app manifests my-app --revisions 0.0.1 --source-positions 1 --revisions 0.0.2 --source-positions 2
 ```
 
 ### Options
 
 ```
-  -h, --help                        help for manifests
-      --local string                If set, show locally-generated manifests. Value is the absolute path to app manifests within the manifest repo. Example: '/home/username/apps/env/app-1'.
-      --local-repo-root string      Path to the local repository root. Used together with --local allows setting the repository root. Example: '/home/username/apps'. (default ".")
-      --revision string             Show manifests at a specific revision
-      --revisions stringArray       Show manifests at specific revisions for the index of sources in source-indexes
-      --source string               Source of manifests. One of: live|git (default "git")
-      --source-indexes int64Slice   List of source indexes. Default is empty array. Indexes start at 1. (default [])
+  -h, --help                          help for manifests
+      --local string                  If set, show locally-generated manifests. Value is the absolute path to app manifests within the manifest repo. Example: '/home/username/apps/env/app-1'.
+      --local-repo-root string        Path to the local repository root. Used together with --local allows setting the repository root. Example: '/home/username/apps'. (default ".")
+      --revision string               Show manifests at a specific revision
+      --revisions stringArray         Show manifests at specific revisions for the source at position in source-positions
+      --source string                 Source of manifests. One of: live|git (default "git")
+      --source-positions int64Slice   List of source positions. Default is empty array. Counting start at 1. (default [])
 ```
 
 ### Options inherited from parent commands

docs/user-guide/commands/argocd_app_remove-source.md

@@ -2,7 +2,7 @@
 
 ## argocd app remove-source
 
-Remove a source from multiple sources application. Index starts with 1. Default value is -1.
+Remove a source from multiple sources application. Counting starts with 1. Default value is -1.
 
 ```
 argocd app remove-source APPNAME [flags]
@@ -11,8 +11,8 @@ argocd app remove-source APPNAME [flags]
 ### Examples
 
 ```
-  # Remove the source at index 1 from application's sources. Index starts at 1.
-  argocd app remove-source myapplication --source-index 1
+  # Remove the source at position 1 from application's sources. Counting starts at 1.
+  argocd app remove-source myapplication --source-position 1
 ```
 
 ### Options
@@ -20,7 +20,7 @@ argocd app remove-source APPNAME [flags]
 ```
   -N, --app-namespace string   Namespace of the target application where the source will be appended
   -h, --help                   help for remove-source
-      --source-index int       Index of the source from the list of sources of the app. Index starts from 1. (default -1)
+      --source-position int    Position of the source from the list of sources of the app. Counting starts at 1. (default -1)
 ```
 
 ### Options inherited from parent commands

docs/user-guide/commands/argocd_app_set.md

@@ -23,8 +23,8 @@ argocd app set APPNAME [flags]
   # Set and override application parameters with a parameter file
   argocd app set my-app --parameter-file path/to/parameter-file.yaml
   
-  # Set and override application parameters for a source at index 1 under spec.sources of app my-app. source-index starts at 1.
-  argocd app set my-app --source-index 1 --repo https://github.com/argoproj/argocd-example-apps.git
+  # Set and override application parameters for a source at position 1 under spec.sources of app my-app. source-position starts at 1.
+  argocd app set my-app --source-position 1 --repo https://github.com/argoproj/argocd-example-apps.git
   
   # Set application parameters and specify the namespace
   argocd app set my-app --parameter key1=value1 --parameter key2=value2 --namespace my-namespace
@@ -79,7 +79,7 @@ argocd app set APPNAME [flags]
       --revision string                            The tracking source branch, tag, commit or Helm chart version the application will sync to
       --revision-history-limit int                 How many items to keep in revision history (default 10)
       --self-heal                                  Set self healing when sync is automated
-      --source-index int                           Index of the source from the list of sources of the app. Index starts at 1. (default -1)
+      --source-position int                        Position of the source from the list of sources of the app. Counting starts at 1. (default -1)
       --sync-option Prune=false                    Add or remove a sync option, e.g add Prune=false. Remove using `!` prefix, e.g. `!Prune=false`
       --sync-policy string                         Set the sync policy (one of: manual (aliases of manual: none), automated (aliases of automated: auto, automatic))
       --sync-retry-backoff-duration duration       Sync retry backoff base duration. Input needs to be a duration (e.g. 2m, 1h) (default 5s)

docs/user-guide/commands/argocd_app_unset.md

@@ -17,8 +17,8 @@ argocd app unset APPNAME parameters [flags]
   # Unset kustomize override suffix
   argocd app unset my-app --namesuffix
 
-  # Unset kustomize override suffix for source at index 1 under spec.sources of app my-app. source-index starts at 1.
-  argocd app unset my-app --source-index 1 --namesuffix
+  # Unset kustomize override suffix for source at position 1 under spec.sources of app my-app. source-position starts at 1.
+  argocd app unset my-app --source-position 1 --namesuffix
 
   # Unset parameter override
   argocd app unset my-app -p COMPONENT=PARAM
@@ -40,7 +40,7 @@ argocd app unset APPNAME parameters [flags]
       --pass-credentials                Unset passCredentials
       --plugin-env stringArray          Unset plugin env variables (e.g --plugin-env name)
       --ref                             Unset ref on the source
-      --source-index int                Index of the source from the list of sources of the app. Index starts at 1. (default -1)
+      --source-position int             Position of the source from the list of sources of the app. Counting starts at 1. (default -1)
       --values stringArray              Unset one or more Helm values files
       --values-literal                  Unset literal Helm values block
 ```

manifests/base/kustomization.yaml

@@ -5,7 +5,7 @@ kind: Kustomization
 images:
 - name: quay.io/argoproj/argocd
   newName: quay.io/argoproj/argocd
-  newTag: latest
+  newTag: v2.11.0-rc2
 resources:
 - ./application-controller
 - ./dex

manifests/core-install.yaml

@@ -21184,7 +21184,7 @@ spec:
               key: applicationsetcontroller.enable.scm.providers
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-applicationset-controller
         ports:
@@ -21514,7 +21514,7 @@ spec:
           value: /helm-working-dir
         - name: HELM_DATA_HOME
           value: /helm-working-dir
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -21566,7 +21566,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         name: copyutil
         securityContext:
           allowPrivilegeEscalation: false
@@ -21827,7 +21827,7 @@ spec:
               key: controller.diff.server.side
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-application-controller
         ports:

manifests/core-install/kustomization.yaml

@@ -12,4 +12,4 @@ resources:
 images:
 - name: quay.io/argoproj/argocd
   newName: quay.io/argoproj/argocd
-  newTag: latest
+  newTag: v2.11.0-rc2

manifests/ha/base/kustomization.yaml

@@ -12,7 +12,7 @@ patches:
 images:
 - name: quay.io/argoproj/argocd
   newName: quay.io/argoproj/argocd
-  newTag: latest
+  newTag: v2.11.0-rc2
 resources:
 - ../../base/application-controller
 - ../../base/applicationset-controller

manifests/ha/install.yaml

@@ -22547,7 +22547,7 @@ spec:
               key: applicationsetcontroller.enable.scm.providers
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-applicationset-controller
         ports:
@@ -22670,7 +22670,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: copyutil
         securityContext:
@@ -22752,7 +22752,7 @@ spec:
               key: notificationscontroller.selfservice.enabled
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           tcpSocket:
@@ -23113,7 +23113,7 @@ spec:
           value: /helm-working-dir
         - name: HELM_DATA_HOME
           value: /helm-working-dir
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -23165,7 +23165,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         name: copyutil
         securityContext:
           allowPrivilegeEscalation: false
@@ -23484,7 +23484,7 @@ spec:
               key: server.api.content.types
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           httpGet:
@@ -23772,7 +23772,7 @@ spec:
               key: controller.diff.server.side
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-application-controller
         ports:

manifests/ha/namespace-install.yaml

@@ -1668,7 +1668,7 @@ spec:
               key: applicationsetcontroller.enable.scm.providers
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-applicationset-controller
         ports:
@@ -1791,7 +1791,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: copyutil
         securityContext:
@@ -1873,7 +1873,7 @@ spec:
               key: notificationscontroller.selfservice.enabled
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           tcpSocket:
@@ -2234,7 +2234,7 @@ spec:
           value: /helm-working-dir
         - name: HELM_DATA_HOME
           value: /helm-working-dir
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -2286,7 +2286,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         name: copyutil
         securityContext:
           allowPrivilegeEscalation: false
@@ -2605,7 +2605,7 @@ spec:
               key: server.api.content.types
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           httpGet:
@@ -2893,7 +2893,7 @@ spec:
               key: controller.diff.server.side
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-application-controller
         ports:

manifests/install.yaml

@@ -21642,7 +21642,7 @@ spec:
               key: applicationsetcontroller.enable.scm.providers
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-applicationset-controller
         ports:
@@ -21765,7 +21765,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: copyutil
         securityContext:
@@ -21847,7 +21847,7 @@ spec:
               key: notificationscontroller.selfservice.enabled
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           tcpSocket:
@@ -22159,7 +22159,7 @@ spec:
           value: /helm-working-dir
         - name: HELM_DATA_HOME
           value: /helm-working-dir
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -22211,7 +22211,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         name: copyutil
         securityContext:
           allowPrivilegeEscalation: false
@@ -22528,7 +22528,7 @@ spec:
               key: server.api.content.types
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           httpGet:
@@ -22816,7 +22816,7 @@ spec:
               key: controller.diff.server.side
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-application-controller
         ports:

manifests/namespace-install.yaml

@@ -763,7 +763,7 @@ spec:
               key: applicationsetcontroller.enable.scm.providers
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-applicationset-controller
         ports:
@@ -886,7 +886,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: copyutil
         securityContext:
@@ -968,7 +968,7 @@ spec:
               key: notificationscontroller.selfservice.enabled
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           tcpSocket:
@@ -1280,7 +1280,7 @@ spec:
           value: /helm-working-dir
         - name: HELM_DATA_HOME
           value: /helm-working-dir
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -1332,7 +1332,7 @@ spec:
         - -n
         - /usr/local/bin/argocd
         - /var/run/argocd/argocd-cmp-server
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         name: copyutil
         securityContext:
           allowPrivilegeEscalation: false
@@ -1649,7 +1649,7 @@ spec:
               key: server.api.content.types
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         livenessProbe:
           httpGet:
@@ -1937,7 +1937,7 @@ spec:
               key: controller.diff.server.side
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:latest
+        image: quay.io/argoproj/argocd:v2.11.0-rc2
         imagePullPolicy: Always
         name: argocd-application-controller
         ports:

pkg/apiclient/application/application.pb.go

@@ -372,14 +372,15 @@ func (m *ApplicationResourceEventsQuery) GetProject() string {
 
 // ManifestQuery is a query for manifest resources
 type ApplicationManifestQuery struct {
-	Name                   *string          `protobuf:"bytes,1,req,name=name" json:"name,omitempty"`
-	Revision               *string          `protobuf:"bytes,2,opt,name=revision" json:"revision,omitempty"`
-	AppNamespace           *string          `protobuf:"bytes,3,opt,name=appNamespace" json:"appNamespace,omitempty"`
-	Project                *string          `protobuf:"bytes,4,opt,name=project" json:"project,omitempty"`
-	RevisionSourceMappings map[int64]string `protobuf:"bytes,5,rep,name=revisionSourceMappings" json:"revisionSourceMappings,omitempty" protobuf_key:"varint,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	XXX_NoUnkeyedLiteral   struct{}         `json:"-"`
-	XXX_unrecognized       []byte           `json:"-"`
-	XXX_sizecache          int32            `json:"-"`
+	Name                 *string  `protobuf:"bytes,1,req,name=name" json:"name,omitempty"`
+	Revision             *string  `protobuf:"bytes,2,opt,name=revision" json:"revision,omitempty"`
+	AppNamespace         *string  `protobuf:"bytes,3,opt,name=appNamespace" json:"appNamespace,omitempty"`
+	Project              *string  `protobuf:"bytes,4,opt,name=project" json:"project,omitempty"`
+	SourcePositions      []int64  `protobuf:"varint,5,rep,name=sourcePositions" json:"sourcePositions,omitempty"`
+	Revisions            []string `protobuf:"bytes,6,rep,name=revisions" json:"revisions,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *ApplicationManifestQuery) Reset()         { *m = ApplicationManifestQuery{} }
@@ -443,9 +444,16 @@ func (m *ApplicationManifestQuery) GetProject() string {
 	return ""
 }
 
-func (m *ApplicationManifestQuery) GetRevisionSourceMappings() map[int64]string {
+func (m *ApplicationManifestQuery) GetSourcePositions() []int64 {
 	if m != nil {
-		return m.RevisionSourceMappings
+		return m.SourcePositions
+	}
+	return nil
+}
+
+func (m *ApplicationManifestQuery) GetRevisions() []string {
+	if m != nil {
+		return m.Revisions
 	}
 	return nil
 }
@@ -2763,7 +2771,6 @@ func init() {
 	proto.RegisterType((*RevisionMetadataQuery)(nil), "application.RevisionMetadataQuery")
 	proto.RegisterType((*ApplicationResourceEventsQuery)(nil), "application.ApplicationResourceEventsQuery")
 	proto.RegisterType((*ApplicationManifestQuery)(nil), "application.ApplicationManifestQuery")
-	proto.RegisterMapType((map[int64]string)(nil), "application.ApplicationManifestQuery.RevisionSourceMappingsEntry")
 	proto.RegisterType((*FileChunk)(nil), "application.FileChunk")
 	proto.RegisterType((*ApplicationManifestQueryWithFiles)(nil), "application.ApplicationManifestQueryWithFiles")
 	proto.RegisterType((*ApplicationManifestQueryWithFilesWrapper)(nil), "application.ApplicationManifestQueryWithFilesWrapper")
@@ -2801,179 +2808,176 @@ func init() {
 }
 
 var fileDescriptor_df6e82b174b5eaec = []byte{
-	// 2738 bytes of a gzipped FileDescriptorProto
+	// 2704 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x5a, 0xcd, 0x8f, 0x1b, 0x49,
-	0x15, 0xa7, 0xec, 0xf9, 0xb0, 0x9f, 0x67, 0x92, 0x49, 0xed, 0x66, 0xe8, 0xed, 0x4c, 0xc2, 0xa4,
-	0xf3, 0x35, 0x99, 0x64, 0xec, 0xc4, 0x04, 0x94, 0x9d, 0xdd, 0x15, 0x24, 0x93, 0x4f, 0x98, 0xc9,
-	0x86, 0x9e, 0x84, 0xa0, 0xe5, 0x00, 0xb5, 0xed, 0x1a, 0x4f, 0x33, 0xed, 0xee, 0x4e, 0x77, 0xdb,
-	0x91, 0x15, 0x72, 0x59, 0x94, 0x0b, 0x5a, 0x81, 0x80, 0x3d, 0x20, 0x84, 0x00, 0x2d, 0x5a, 0x09,
-	0x21, 0x10, 0x17, 0xb4, 0x42, 0x42, 0x48, 0x70, 0x41, 0x70, 0x00, 0x21, 0x38, 0x72, 0x41, 0x11,
-	0xe2, 0x08, 0x97, 0xfd, 0x03, 0x50, 0x55, 0x57, 0xb5, 0xab, 0xfd, 0xd1, 0xf6, 0x60, 0xa3, 0xcd,
-	0xad, 0x5f, 0xb9, 0xea, 0xbd, 0xdf, 0x7b, 0xf5, 0xea, 0xbd, 0x57, 0xaf, 0x0c, 0x27, 0x43, 0x1a,
-	0xb4, 0x68, 0x50, 0x21, 0xbe, 0xef, 0xd8, 0x16, 0x89, 0x6c, 0xcf, 0x55, 0xbf, 0xcb, 0x7e, 0xe0,
-	0x45, 0x1e, 0x2e, 0x29, 0x43, 0xfa, 0x52, 0xdd, 0xf3, 0xea, 0x0e, 0xad, 0x10, 0xdf, 0xae, 0x10,
-	0xd7, 0xf5, 0x22, 0x3e, 0x1c, 0xc6, 0x53, 0x75, 0x63, 0xef, 0x72, 0x58, 0xb6, 0x3d, 0xfe, 0xab,
-	0xe5, 0x05, 0xb4, 0xd2, 0xba, 0x58, 0xa9, 0x53, 0x97, 0x06, 0x24, 0xa2, 0x35, 0x31, 0xe7, 0x52,
-	0x67, 0x4e, 0x83, 0x58, 0xbb, 0xb6, 0x4b, 0x83, 0x76, 0xc5, 0xdf, 0xab, 0xb3, 0x81, 0xb0, 0xd2,
-	0xa0, 0x11, 0xe9, 0xb7, 0x6a, 0xb3, 0x6e, 0x47, 0xbb, 0xcd, 0x37, 0xcb, 0x96, 0xd7, 0xa8, 0x90,
-	0xa0, 0xee, 0xf9, 0x81, 0xf7, 0x15, 0xfe, 0xb1, 0x66, 0xd5, 0x2a, 0xad, 0x6a, 0x87, 0x81, 0xaa,
-	0x4b, 0xeb, 0x22, 0x71, 0xfc, 0x5d, 0xd2, 0xcb, 0xed, 0xfa, 0x10, 0x6e, 0x01, 0xf5, 0x3d, 0x61,
-	0x1b, 0xfe, 0x69, 0x47, 0x5e, 0xd0, 0x56, 0x3e, 0x63, 0x36, 0xc6, 0x07, 0x08, 0x16, 0xae, 0x74,
-	0xe4, 0x7d, 0xae, 0x49, 0x83, 0x36, 0xc6, 0x30, 0xe5, 0x92, 0x06, 0xd5, 0xd0, 0x32, 0x5a, 0x29,
-	0x9a, 0xfc, 0x1b, 0x6b, 0x30, 0x1b, 0xd0, 0x9d, 0x80, 0x86, 0xbb, 0x5a, 0x8e, 0x0f, 0x4b, 0x12,
-	0xeb, 0x50, 0x60, 0xc2, 0xa9, 0x15, 0x85, 0x5a, 0x7e, 0x39, 0xbf, 0x52, 0x34, 0x13, 0x1a, 0xaf,
-	0xc0, 0xc1, 0x80, 0x86, 0x5e, 0x33, 0xb0, 0xe8, 0xe7, 0x69, 0x10, 0xda, 0x9e, 0xab, 0x4d, 0xf1,
-	0xd5, 0xdd, 0xc3, 0x8c, 0x4b, 0x48, 0x1d, 0x6a, 0x45, 0x5e, 0xa0, 0x4d, 0xf3, 0x29, 0x09, 0xcd,
-	0xf0, 0x30, 0xe0, 0xda, 0x4c, 0x8c, 0x87, 0x7d, 0x63, 0x03, 0xe6, 0x88, 0xef, 0xdf, 0x21, 0x0d,
-	0x1a, 0xfa, 0xc4, 0xa2, 0xda, 0x2c, 0xff, 0x2d, 0x35, 0xc6, 0x30, 0x0b, 0x24, 0x5a, 0x81, 0x03,
-	0x93, 0xa4, 0xb1, 0x01, 0xc5, 0x3b, 0x5e, 0x8d, 0x0e, 0x56, 0xb7, 0x9b, 0x7d, 0xae, 0x97, 0xbd,
-	0xf1, 0x14, 0xc1, 0x61, 0x93, 0xb6, 0x6c, 0x86, 0x7f, 0x8b, 0x46, 0xa4, 0x46, 0x22, 0xd2, 0xcd,
-	0x31, 0x97, 0x70, 0xd4, 0xa1, 0x10, 0x88, 0xc9, 0x5a, 0x8e, 0x8f, 0x27, 0x74, 0x8f, 0xb4, 0x7c,
-	0xb6, 0x32, 0xb1, 0x09, 0x13, 0x65, 0xfe, 0x85, 0xe0, 0x98, 0xb2, 0x87, 0xa6, 0xb0, 0xec, 0xf5,
-	0x16, 0x75, 0xa3, 0x70, 0x30, 0xa0, 0xf3, 0x70, 0x48, 0x6e, 0x42, 0xb7, 0x9e, 0xbd, 0x3f, 0x30,
-	0x88, 0xea, 0xa0, 0x84, 0xa8, 0x8e, 0xe1, 0x65, 0x28, 0x49, 0xfa, 0xfe, 0xed, 0x6b, 0x02, 0xa6,
-	0x3a, 0xd4, 0xa3, 0xe8, 0x74, 0xb6, 0xa2, 0x33, 0x69, 0x45, 0xff, 0x9c, 0x03, 0x4d, 0x51, 0x74,
-	0x8b, 0xb8, 0xf6, 0x0e, 0x0d, 0xa3, 0x51, 0x6d, 0x8e, 0x26, 0x67, 0x73, 0xdc, 0x86, 0x45, 0xc9,
-	0x69, 0x9b, 0x6b, 0xb7, 0x45, 0x7c, 0xdf, 0x76, 0xeb, 0xa1, 0x36, 0xbd, 0x9c, 0x5f, 0x29, 0x55,
-	0xaf, 0x94, 0xd5, 0x28, 0x34, 0x08, 0x74, 0xd9, 0xec, 0xcb, 0xe3, 0xba, 0x1b, 0x05, 0x6d, 0x73,
-	0x80, 0x00, 0xfd, 0x36, 0x1c, 0xc9, 0x58, 0x86, 0x17, 0x20, 0xbf, 0x47, 0xdb, 0xdc, 0x99, 0xf3,
-	0x26, 0xfb, 0xc4, 0x2f, 0xc2, 0x74, 0x8b, 0x38, 0x4d, 0xb9, 0xb9, 0x31, 0xb1, 0x9e, 0xbb, 0x8c,
-	0x8c, 0xe3, 0x50, 0xbc, 0x61, 0x3b, 0x74, 0x63, 0xb7, 0xe9, 0xee, 0xb1, 0x69, 0x16, 0xfb, 0xe0,
-	0x16, 0x9c, 0x33, 0x63, 0xc2, 0xf8, 0x16, 0x82, 0xe3, 0x83, 0xe0, 0x3f, 0xb0, 0xa3, 0x5d, 0xb6,
-	0x3e, 0x1c, 0x64, 0x7c, 0x6b, 0x97, 0x5a, 0x7b, 0x61, 0xb3, 0x21, 0x1d, 0x5e, 0xd2, 0x63, 0x3a,
-	0xfc, 0x4f, 0x11, 0xac, 0x0c, 0xc5, 0xf4, 0x20, 0x20, 0xbe, 0x4f, 0x03, 0x7c, 0x03, 0xa6, 0x1f,
-	0xb2, 0x1f, 0xb8, 0x45, 0x4a, 0xd5, 0xf2, 0x48, 0x1b, 0x93, 0x70, 0xb9, 0xf5, 0x11, 0x33, 0x5e,
-	0x8e, 0xcb, 0xd2, 0x3c, 0x39, 0xce, 0x67, 0x31, 0xc5, 0x27, 0xb1, 0x22, 0x9b, 0xcf, 0xa7, 0x5d,
-	0x9d, 0x81, 0x29, 0x9f, 0x04, 0x91, 0x71, 0x18, 0x5e, 0x48, 0x1f, 0x4e, 0xdf, 0x73, 0x43, 0x6a,
-	0xfc, 0x1a, 0xa5, 0x7c, 0x79, 0x23, 0xa0, 0x24, 0xa2, 0x26, 0x7d, 0xd8, 0xa4, 0x61, 0x84, 0xf7,
-	0x40, 0xcd, 0x58, 0xdc, 0xaa, 0xa5, 0xea, 0xed, 0x72, 0x27, 0xe4, 0x97, 0x65, 0xc8, 0xe7, 0x1f,
-	0x5f, 0xb2, 0x6a, 0xe5, 0x56, 0xb5, 0xec, 0xef, 0xd5, 0xcb, 0x2c, 0x81, 0xa4, 0x90, 0xc9, 0x04,
-	0xa2, 0xaa, 0x6a, 0xaa, 0xdc, 0xf1, 0x22, 0xcc, 0x34, 0xfd, 0x90, 0x06, 0x11, 0xd7, 0xac, 0x60,
-	0x0a, 0x8a, 0xed, 0x5f, 0x8b, 0x38, 0x76, 0x8d, 0x44, 0xf1, 0xfe, 0x14, 0xcc, 0x84, 0x36, 0x7e,
-	0x93, 0x46, 0x7f, 0xdf, 0xaf, 0x7d, 0x58, 0xe8, 0x55, 0x94, 0xb9, 0x34, 0x4a, 0xd5, 0x83, 0xf2,
-	0x69, 0x0f, 0xfa, 0x65, 0x1a, 0xff, 0x35, 0xea, 0xd0, 0x0e, 0xfe, 0x7e, 0xce, 0xac, 0xc1, 0xac,
-	0x45, 0x42, 0x8b, 0xd4, 0xa4, 0x14, 0x49, 0xb2, 0x30, 0xea, 0x07, 0x9e, 0x4f, 0xea, 0x9c, 0xd3,
-	0x5d, 0xcf, 0xb1, 0xad, 0xb6, 0x10, 0xd7, 0xfb, 0x43, 0x8f, 0xe3, 0x4f, 0x65, 0x3b, 0xfe, 0x74,
-	0x1a, 0xf6, 0x09, 0x28, 0x6d, 0xb7, 0x5d, 0xeb, 0x75, 0x9f, 0x57, 0x2c, 0xec, 0xc4, 0xda, 0x11,
-	0x6d, 0x84, 0x1a, 0xe2, 0xd9, 0x2d, 0x26, 0x8c, 0xf7, 0xa7, 0x61, 0x51, 0xd1, 0x8d, 0x2d, 0xc8,
-	0xd2, 0x2c, 0x2b, 0x46, 0x2e, 0xc2, 0x4c, 0x2d, 0x68, 0x9b, 0x4d, 0x57, 0x38, 0x80, 0xa0, 0x98,
-	0x60, 0x3f, 0x68, 0xba, 0x31, 0xfc, 0x82, 0x19, 0x13, 0x78, 0x07, 0x0a, 0x61, 0xc4, 0x6a, 0x94,
-	0x7a, 0x9b, 0x03, 0x2f, 0x55, 0x3f, 0x33, 0xde, 0xa6, 0x33, 0xe8, 0xdb, 0x82, 0xa3, 0x99, 0xf0,
-	0xc6, 0x0f, 0xa1, 0x28, 0x73, 0x4a, 0xa8, 0xcd, 0xf2, 0x70, 0xbb, 0x3d, 0xbe, 0xa0, 0xd7, 0x7d,
-	0x56, 0x5f, 0x29, 0xf9, 0xd3, 0xec, 0x48, 0xc1, 0x4b, 0x50, 0x6c, 0x88, 0xf8, 0x10, 0x8a, 0x5a,
-	0xa2, 0x33, 0x80, 0xbf, 0x00, 0xd3, 0xb6, 0xbb, 0xe3, 0x85, 0x5a, 0x91, 0x83, 0xb9, 0x3a, 0x1e,
-	0x98, 0xdb, 0xee, 0x8e, 0x67, 0xc6, 0x0c, 0xf1, 0x43, 0x98, 0x0f, 0x68, 0x14, 0xb4, 0xa5, 0x15,
-	0x34, 0xe0, 0x76, 0xfd, 0xec, 0x78, 0x12, 0x4c, 0x95, 0xa5, 0x99, 0x96, 0x80, 0xd7, 0xa1, 0x14,
-	0x76, 0x7c, 0x4c, 0x2b, 0x71, 0x81, 0x5a, 0x8a, 0x91, 0xe2, 0x83, 0xa6, 0x3a, 0xb9, 0xc7, 0xbb,
-	0xe7, 0xb2, 0xbd, 0x7b, 0x3e, 0xed, 0xdd, 0xff, 0x41, 0xb0, 0xd4, 0x13, 0x54, 0xb6, 0x7d, 0x9a,
-	0xe9, 0xbe, 0x04, 0xa6, 0x42, 0x9f, 0x5a, 0x3c, 0xc3, 0x94, 0xaa, 0x5b, 0x13, 0x8b, 0x32, 0x5c,
-	0x2e, 0x67, 0x9d, 0x15, 0x08, 0xc7, 0x3c, 0xcf, 0x3f, 0x44, 0xf0, 0x51, 0x45, 0xe6, 0x5d, 0x12,
-	0x59, 0xbb, 0x59, 0xca, 0xb2, 0x73, 0xc7, 0xe6, 0x88, 0x7c, 0x1a, 0x13, 0xcc, 0x39, 0xf9, 0xc7,
-	0xbd, 0xb6, 0xcf, 0x00, 0xb2, 0x5f, 0x3a, 0x03, 0x63, 0x96, 0x5c, 0x3f, 0x43, 0xa0, 0xab, 0xb1,
-	0xd7, 0x73, 0x9c, 0x37, 0x89, 0xb5, 0x97, 0x05, 0xf2, 0x00, 0xe4, 0xec, 0x1a, 0x47, 0x98, 0x37,
-	0x73, 0x76, 0x6d, 0x9f, 0x41, 0xa4, 0x1b, 0xee, 0x4c, 0x36, 0xdc, 0xd9, 0x34, 0xdc, 0x0f, 0xba,
-	0xe0, 0xca, 0xa3, 0x9c, 0x01, 0x77, 0x09, 0x8a, 0x6e, 0x57, 0xf9, 0xdb, 0x19, 0xe8, 0x53, 0xf6,
-	0xe6, 0x7a, 0xca, 0x5e, 0x0d, 0x66, 0x5b, 0xc9, 0xe5, 0x86, 0xfd, 0x2c, 0x49, 0xa6, 0x62, 0x3d,
-	0xf0, 0x9a, 0xbe, 0x30, 0x7a, 0x4c, 0x30, 0x14, 0x7b, 0xb6, 0x5b, 0xd3, 0x66, 0x62, 0x14, 0xec,
-	0x7b, 0xff, 0xd7, 0x99, 0x94, 0xda, 0x3f, 0xcf, 0xc1, 0xc7, 0xfa, 0xa8, 0x3d, 0xd4, 0x9f, 0x9e,
-	0x0f, 0xdd, 0x13, 0xaf, 0x9e, 0x1d, 0xe8, 0xd5, 0x85, 0x61, 0x5e, 0x5d, 0xcc, 0xb6, 0x17, 0xa4,
-	0xed, 0xf5, 0x93, 0x1c, 0x2c, 0xf7, 0xb1, 0xd7, 0xf0, 0x32, 0xe0, 0xb9, 0x31, 0xd8, 0x8e, 0x17,
-	0x08, 0x2f, 0x29, 0x98, 0x31, 0xc1, 0xce, 0x99, 0x17, 0xf8, 0xbb, 0xc4, 0xe5, 0xde, 0x51, 0x30,
-	0x05, 0x35, 0xa6, 0xa9, 0xbe, 0x9e, 0x03, 0x4d, 0xda, 0xe7, 0x8a, 0xc5, 0xad, 0xd5, 0x74, 0x9f,
-	0x7f, 0x13, 0x2d, 0xc2, 0x0c, 0xe1, 0x68, 0x85, 0x53, 0x09, 0xaa, 0xc7, 0x18, 0x85, 0x6c, 0x63,
-	0x14, 0xd3, 0xc6, 0x78, 0x8a, 0xd8, 0xdd, 0x4b, 0x35, 0x46, 0xb8, 0x69, 0x87, 0x91, 0x2c, 0xea,
-	0xf1, 0x0e, 0xcc, 0xc6, 0x72, 0xe2, 0x92, 0xac, 0x54, 0xdd, 0x1c, 0x37, 0x51, 0xa7, 0x0c, 0x2f,
-	0x99, 0x1b, 0x2f, 0xc3, 0x91, 0xbe, 0x51, 0x4e, 0xc0, 0xd0, 0xa1, 0x20, 0x8b, 0x13, 0xb1, 0x35,
-	0x09, 0x6d, 0x3c, 0x9d, 0x4a, 0xa7, 0x1c, 0xaf, 0xb6, 0xe9, 0xd5, 0x33, 0xba, 0x04, 0xd9, 0xdb,
-	0xc9, 0x4c, 0xe5, 0xd5, 0x94, 0x86, 0x80, 0x24, 0xd9, 0x3a, 0xcb, 0x73, 0x23, 0x62, 0xbb, 0x34,
-	0x10, 0x59, 0xb1, 0x33, 0xc0, 0xb6, 0x21, 0xb4, 0x5d, 0x8b, 0x6e, 0x53, 0xcb, 0x73, 0x6b, 0x21,
-	0xdf, 0xcf, 0xbc, 0x99, 0x1a, 0xc3, 0xb7, 0xa0, 0xc8, 0xe9, 0x7b, 0x76, 0x23, 0x4e, 0x03, 0xa5,
-	0xea, 0x6a, 0x39, 0xee, 0xbc, 0x95, 0xd5, 0xce, 0x5b, 0xc7, 0x86, 0x0d, 0x1a, 0x91, 0x72, 0xeb,
-	0x62, 0x99, 0xad, 0x30, 0x3b, 0x8b, 0x19, 0x96, 0x88, 0xd8, 0xce, 0xa6, 0xed, 0xf2, 0x82, 0x91,
-	0x89, 0xea, 0x0c, 0x30, 0x57, 0xd9, 0xf1, 0x1c, 0xc7, 0x7b, 0x24, 0xcf, 0x4d, 0x4c, 0xb1, 0x55,
-	0x4d, 0x37, 0xb2, 0x1d, 0x2e, 0x3f, 0x76, 0x84, 0xce, 0x00, 0x5f, 0x65, 0x3b, 0x11, 0x0d, 0xc4,
-	0x81, 0x11, 0x54, 0xe2, 0x8c, 0xa5, 0xb8, 0x99, 0x24, 0xcf, 0x6b, 0xec, 0xb6, 0x73, 0xaa, 0xdb,
-	0x76, 0x1f, 0x85, 0xf9, 0x3e, 0x1d, 0x15, 0xde, 0x5b, 0xa3, 0x2d, 0xdb, 0x6b, 0x86, 0xda, 0x81,
-	0xb8, 0xf4, 0x90, 0x74, 0x8f, 0x2b, 0x1f, 0xcc, 0x76, 0xe5, 0x85, 0xb4, 0x2b, 0xff, 0x16, 0x41,
-	0x61, 0xd3, 0xab, 0xc7, 0x3d, 0x03, 0x76, 0xbb, 0xf1, 0xdc, 0x88, 0xba, 0xd2, 0x5f, 0x24, 0xc9,
-	0x36, 0x21, 0xb2, 0x1b, 0x74, 0x3b, 0x22, 0x0d, 0x5f, 0xd4, 0x58, 0xfb, 0xda, 0x84, 0x64, 0x31,
-	0x33, 0x8c, 0x43, 0xc2, 0x88, 0x9f, 0xf8, 0x82, 0xc9, 0xbf, 0x99, 0x0a, 0xc9, 0x84, 0xed, 0x28,
-	0x10, 0xc7, 0x3d, 0x35, 0xa6, 0xba, 0xd8, 0x74, 0x8c, 0x4d, 0x90, 0x46, 0x03, 0x5e, 0x4a, 0x8a,
-	0xf6, 0x7b, 0x34, 0x68, 0xd8, 0x2e, 0xc9, 0x8e, 0xde, 0x23, 0x34, 0xf5, 0x32, 0xee, 0x8c, 0x5e,
-	0xea, 0xd0, 0xb1, 0x1a, 0xf8, 0x81, 0xed, 0xd6, 0xbc, 0x47, 0x19, 0x87, 0x67, 0x3c, 0x81, 0x7f,
-	0x4d, 0xf7, 0xf5, 0x14, 0x89, 0xc9, 0x49, 0xbf, 0x05, 0xf3, 0x2c, 0x26, 0xb4, 0xa8, 0xf8, 0x41,
-	0x84, 0x1d, 0x63, 0x50, 0x93, 0xa3, 0xc3, 0xc3, 0x4c, 0x2f, 0xc4, 0x9b, 0x70, 0x90, 0x84, 0xa1,
-	0x5d, 0x77, 0x69, 0x4d, 0xf2, 0xca, 0x8d, 0xcc, 0xab, 0x7b, 0x69, 0x7c, 0x5d, 0xe6, 0x33, 0xc4,
-	0x7e, 0x4b, 0xd2, 0xf8, 0x1a, 0x82, 0xc3, 0x7d, 0x99, 0x24, 0x27, 0x07, 0x29, 0x61, 0x5c, 0x87,
-	0x42, 0x68, 0xed, 0xd2, 0x5a, 0xd3, 0xa1, 0xb2, 0x87, 0x24, 0x69, 0xf6, 0x5b, 0xad, 0x19, 0xef,
-	0xbe, 0x48, 0x23, 0x09, 0x8d, 0x8f, 0x01, 0x34, 0x88, 0xdb, 0x24, 0x0e, 0x87, 0x30, 0xc5, 0x21,
-	0x28, 0x23, 0xc6, 0x12, 0xe8, 0xfd, 0x5c, 0x47, 0xf4, 0x66, 0xfe, 0x8d, 0xe0, 0x80, 0x0c, 0xaa,
-	0x62, 0x77, 0x57, 0xe0, 0xa0, 0x62, 0x86, 0x3b, 0x9d, 0x8d, 0xee, 0x1e, 0x1e, 0x12, 0x30, 0xa5,
-	0x97, 0xe4, 0xd3, 0xad, 0xf5, 0x56, 0xaa, 0x39, 0x3e, 0x72, 0xbe, 0x43, 0x13, 0xaa, 0x1f, 0xbf,
-	0x0a, 0xda, 0x16, 0x71, 0x49, 0x9d, 0xd6, 0x12, 0xb5, 0x13, 0x17, 0xfb, 0xb2, 0xda, 0x64, 0x18,
-	0xfb, 0x4a, 0x9f, 0x94, 0x5a, 0xf6, 0xce, 0x8e, 0x6c, 0x58, 0x04, 0x50, 0xd8, 0xb4, 0xdd, 0x3d,
-	0x76, 0xef, 0x65, 0x1a, 0x47, 0x76, 0xe4, 0x48, 0xeb, 0xc6, 0x04, 0x5e, 0x80, 0x7c, 0x33, 0x70,
-	0x84, 0x07, 0xb0, 0x4f, 0xbc, 0x0c, 0xa5, 0x1a, 0x0d, 0xad, 0xc0, 0xf6, 0xc5, 0xfe, 0xf3, 0x56,
-	0xb3, 0x32, 0xc4, 0xf6, 0xc1, 0xb6, 0x3c, 0x77, 0xc3, 0x21, 0x61, 0x28, 0x13, 0x50, 0x32, 0x60,
-	0xbc, 0x0a, 0xf3, 0x4c, 0x66, 0x47, 0xcd, 0x73, 0x69, 0x35, 0x0f, 0xa7, 0xe0, 0x4b, 0x78, 0x12,
-	0x31, 0x81, 0x17, 0x58, 0xde, 0xbf, 0xe2, 0xfb, 0x82, 0xc9, 0x88, 0xe5, 0x50, 0xbe, 0x5f, 0xfe,
-	0xec, 0xdb, 0xe3, 0xac, 0xfe, 0xfd, 0x04, 0x60, 0xf5, 0x9c, 0xd0, 0xa0, 0x65, 0x5b, 0x14, 0x7f,
-	0x1b, 0xc1, 0x14, 0x13, 0x8d, 0x8f, 0x0e, 0x3a, 0x96, 0xdc, 0x5f, 0xf5, 0xc9, 0x5d, 0x84, 0x99,
-	0x34, 0x63, 0xe9, 0xad, 0xbf, 0xfd, 0xf3, 0x3b, 0xb9, 0x45, 0xfc, 0x22, 0x7f, 0x17, 0x6b, 0x5d,
-	0x54, 0xdf, 0xa8, 0x42, 0xfc, 0x36, 0x02, 0x2c, 0xea, 0x20, 0xe5, 0xe5, 0x01, 0x9f, 0x1b, 0x04,
-	0xb1, 0xcf, 0x0b, 0x85, 0x7e, 0x54, 0xc9, 0x2a, 0x65, 0xcb, 0x0b, 0x28, 0xcb, 0x21, 0x7c, 0x02,
-	0x07, 0xb0, 0xca, 0x01, 0x9c, 0xc4, 0x46, 0x3f, 0x00, 0x95, 0xc7, 0xcc, 0xa2, 0x4f, 0x2a, 0x34,
-	0x96, 0xfb, 0x2e, 0x82, 0xe9, 0x07, 0xfc, 0x0e, 0x31, 0xc4, 0x48, 0xdb, 0x13, 0x33, 0x12, 0x17,
-	0xc7, 0xd1, 0x1a, 0x27, 0x38, 0xd2, 0xa3, 0xf8, 0x88, 0x44, 0x1a, 0x46, 0x01, 0x25, 0x8d, 0x14,
-	0xe0, 0x0b, 0x08, 0xbf, 0x87, 0x60, 0x26, 0x6e, 0xfa, 0xe2, 0x53, 0x83, 0x50, 0xa6, 0x9a, 0xc2,
-	0xfa, 0xe4, 0x3a, 0xa8, 0xc6, 0x59, 0x8e, 0xf1, 0x84, 0xd1, 0x77, 0x3b, 0xd7, 0x53, 0xfd, 0xd5,
-	0x77, 0x10, 0xe4, 0x6f, 0xd2, 0xa1, 0xfe, 0x36, 0x41, 0x70, 0x3d, 0x06, 0xec, 0xb3, 0xd5, 0xf8,
-	0xc7, 0x08, 0x5e, 0xba, 0x49, 0xa3, 0xfe, 0xe9, 0x11, 0xaf, 0x0c, 0xcf, 0x59, 0xc2, 0xed, 0xce,
-	0x8d, 0x30, 0x33, 0xc9, 0x0b, 0x15, 0x8e, 0xec, 0x2c, 0x3e, 0x93, 0xe5, 0x84, 0x61, 0xdb, 0xb5,
-	0x1e, 0x09, 0x1c, 0x7f, 0x44, 0xb0, 0xd0, 0xfd, 0x42, 0x88, 0xd3, 0x09, 0xb5, 0xef, 0x03, 0xa2,
-	0x7e, 0x67, 0xdc, 0x28, 0x9b, 0x66, 0x6a, 0x5c, 0xe1, 0xc8, 0x5f, 0xc1, 0x2f, 0x67, 0x21, 0x97,
-	0x6d, 0xdf, 0xb0, 0xf2, 0x58, 0x7e, 0x3e, 0xe1, 0xaf, 0xd9, 0x1c, 0xf6, 0x9f, 0x10, 0xbc, 0x28,
-	0xf9, 0x6e, 0xec, 0x92, 0x20, 0xba, 0x46, 0x59, 0x0d, 0x1d, 0x8e, 0xa4, 0xcf, 0x98, 0x59, 0x43,
-	0x95, 0x67, 0x5c, 0xe7, 0xba, 0x7c, 0x0a, 0xbf, 0xb6, 0x6f, 0x5d, 0x2c, 0xc6, 0xa6, 0x26, 0x60,
-	0xbf, 0x85, 0x60, 0xee, 0x26, 0x8d, 0xb6, 0x92, 0x2e, 0xee, 0xa9, 0x91, 0x5e, 0x86, 0xf4, 0xa5,
-	0xb2, 0xf2, 0x88, 0x2e, 0x7f, 0x4a, 0x5c, 0x64, 0x8d, 0x83, 0x3b, 0x83, 0x4f, 0x65, 0x81, 0xeb,
-	0x74, 0x8e, 0xdf, 0x45, 0x70, 0x58, 0x05, 0xd1, 0x79, 0x51, 0xfb, 0xc4, 0xfe, 0xde, 0xa9, 0xc4,
-	0x6b, 0xd7, 0x10, 0x74, 0x55, 0x8e, 0xee, 0xbc, 0xd1, 0xdf, 0x81, 0x1b, 0x3d, 0x28, 0xd6, 0xd1,
-	0xea, 0x0a, 0xc2, 0xbf, 0x43, 0x30, 0x13, 0x37, 0x63, 0x07, 0xdb, 0x28, 0xf5, 0x02, 0x34, 0xc9,
-	0x68, 0x20, 0x76, 0x5b, 0xbf, 0xd0, 0xdf, 0xa0, 0xea, 0x7a, 0xe9, 0xaa, 0x65, 0x6e, 0xe5, 0x74,
-	0x18, 0x7b, 0x1f, 0x01, 0x74, 0x1a, 0xca, 0xf8, 0x6c, 0xb6, 0x1e, 0x4a, 0xd3, 0x59, 0x9f, 0x6c,
-	0x4b, 0xd9, 0x28, 0x73, 0x7d, 0x56, 0xf4, 0xe5, 0xcc, 0x18, 0xe2, 0x53, 0x6b, 0x3d, 0x6e, 0x3e,
-	0xff, 0x08, 0xc1, 0x34, 0xef, 0xe3, 0xe1, 0x93, 0x83, 0x30, 0xab, 0x6d, 0xbe, 0x49, 0x9a, 0xfe,
-	0x34, 0x87, 0xba, 0x5c, 0xcd, 0x0a, 0xc4, 0xeb, 0x68, 0x15, 0xb7, 0x60, 0x26, 0xee, 0x9c, 0x0d,
-	0x76, 0x8f, 0x54, 0x67, 0x4d, 0x5f, 0xce, 0x28, 0x0c, 0x62, 0x47, 0x15, 0x39, 0x60, 0x75, 0x58,
-	0x0e, 0x98, 0x62, 0x61, 0x1a, 0x9f, 0xc8, 0x0a, 0xe2, 0xff, 0x07, 0xc3, 0x9c, 0xe3, 0xe8, 0x4e,
-	0x19, 0xcb, 0xc3, 0xf2, 0x00, 0xb3, 0xce, 0x77, 0x11, 0x2c, 0x74, 0x17, 0xd7, 0xf8, 0x48, 0x57,
-	0xcc, 0x54, 0xef, 0x1a, 0x7a, 0xda, 0x8a, 0x83, 0x0a, 0x73, 0xe3, 0xd3, 0x1c, 0xc5, 0x3a, 0xbe,
-	0x3c, 0xf4, 0x64, 0xdc, 0x91, 0x51, 0x87, 0x31, 0x5a, 0xeb, 0xbc, 0x6a, 0xfd, 0x0a, 0xc1, 0x9c,
-	0xe4, 0x7b, 0x2f, 0xa0, 0x34, 0x1b, 0xd6, 0xe4, 0x0e, 0x02, 0x93, 0x65, 0xbc, 0xca, 0xe1, 0x7f,
-	0x12, 0x5f, 0x1a, 0x11, 0xbe, 0x84, 0xbd, 0x16, 0x31, 0xa4, 0xbf, 0x47, 0x70, 0xe8, 0x41, 0xec,
-	0xf7, 0x1f, 0x12, 0xfe, 0x0d, 0x8e, 0xff, 0x35, 0xfc, 0x4a, 0x46, 0x9d, 0x37, 0x4c, 0x8d, 0x0b,
-	0x08, 0xff, 0x02, 0x41, 0x41, 0xbe, 0xaa, 0xe0, 0x33, 0x03, 0x0f, 0x46, 0xfa, 0xdd, 0x65, 0x92,
-	0xce, 0x2c, 0x8a, 0x1a, 0xe3, 0x64, 0x66, 0x3a, 0x15, 0xf2, 0x99, 0x43, 0xbf, 0x83, 0x00, 0x27,
-	0x77, 0xe6, 0xe4, 0x16, 0x8d, 0x4f, 0xa7, 0x44, 0x0d, 0x6c, 0xcc, 0xe8, 0x67, 0x86, 0xce, 0x4b,
-	0xa7, 0xd2, 0xd5, 0xcc, 0x54, 0xea, 0x25, 0xf2, 0xbf, 0x81, 0xa0, 0x74, 0x93, 0x26, 0x77, 0x90,
-	0x0c, 0x5b, 0xa6, 0x1f, 0x85, 0xf4, 0x95, 0xe1, 0x13, 0x05, 0xa2, 0xf3, 0x1c, 0xd1, 0x69, 0x9c,
-	0x6d, 0x2a, 0x09, 0xe0, 0xfb, 0x08, 0xe6, 0xef, 0xaa, 0x2e, 0x8a, 0xcf, 0x0f, 0x93, 0x94, 0x8a,
-	0xe4, 0xa3, 0xe3, 0xfa, 0x38, 0xc7, 0xb5, 0x66, 0x8c, 0x84, 0x6b, 0x5d, 0xbc, 0xaf, 0xfc, 0x00,
-	0xc5, 0x97, 0xd8, 0xae, 0x7e, 0xf6, 0xff, 0x6a, 0xb7, 0x8c, 0xb6, 0xb8, 0x71, 0x89, 0xe3, 0x2b,
-	0xe3, 0xf3, 0xa3, 0xe0, 0xab, 0x88, 0x26, 0x37, 0xfe, 0x1e, 0x82, 0x43, 0xfc, 0xad, 0x41, 0x65,
-	0xdc, 0x95, 0x62, 0x06, 0xbd, 0x4c, 0x8c, 0x90, 0x62, 0x44, 0xfc, 0x31, 0xf6, 0x05, 0x6a, 0x5d,
-	0xbe, 0x23, 0x7c, 0x13, 0xc1, 0x01, 0x99, 0xd4, 0xc4, 0xee, 0xae, 0x0d, 0x33, 0xdc, 0x7e, 0x93,
-	0xa0, 0x70, 0xb7, 0xd5, 0xd1, 0xdc, 0xed, 0x3d, 0x04, 0xb3, 0xa2, 0x9b, 0x9f, 0x51, 0x2a, 0x28,
-	0xed, 0x7e, 0xbd, 0xab, 0xc7, 0x21, 0x9a, 0xc1, 0xc6, 0x17, 0xb9, 0xd8, 0xfb, 0xb8, 0x92, 0x25,
-	0xd6, 0xf7, 0x6a, 0x61, 0xe5, 0xb1, 0xe8, 0xc4, 0x3e, 0xa9, 0x38, 0x5e, 0x3d, 0x7c, 0xc3, 0xc0,
-	0x99, 0x09, 0x91, 0xcd, 0xb9, 0x80, 0x70, 0x04, 0x45, 0xe6, 0x1c, 0xbc, 0x71, 0x82, 0x97, 0xbb,
-	0xda, 0x2c, 0x3d, 0x3d, 0x15, 0x5d, 0xef, 0x69, 0xc4, 0x74, 0x32, 0xa0, 0xb8, 0xc6, 0xe2, 0xe3,
-	0x99, 0x62, 0xb9, 0xa0, 0xb7, 0x11, 0x1c, 0x52, 0xbd, 0x3d, 0x16, 0x3f, 0xb2, 0xaf, 0x67, 0xa1,
-	0x10, 0x45, 0x35, 0x5e, 0x1d, 0xc9, 0x91, 0x38, 0x9c, 0xab, 0x37, 0xfe, 0xf0, 0xec, 0x18, 0xfa,
-	0xcb, 0xb3, 0x63, 0xe8, 0x1f, 0xcf, 0x8e, 0xa1, 0x37, 0x2e, 0x8f, 0xf6, 0xcf, 0x60, 0xcb, 0xb1,
-	0xa9, 0x1b, 0xa9, 0xec, 0xff, 0x1b, 0x00, 0x00, 0xff, 0xff, 0x5e, 0x21, 0x6e, 0x60, 0xff, 0x2c,
-	0x00, 0x00,
+	0x15, 0xa7, 0xec, 0xb1, 0xc7, 0xf3, 0x3c, 0x93, 0x8f, 0xda, 0x64, 0xe8, 0x75, 0x66, 0x83, 0xd3,
+	0xf9, 0x9a, 0x4c, 0x32, 0x76, 0x62, 0x02, 0xca, 0xce, 0xee, 0x0a, 0x92, 0xc9, 0x27, 0x4c, 0xb2,
+	0xa1, 0x27, 0x21, 0x68, 0x39, 0x40, 0x6d, 0xbb, 0xc6, 0xd3, 0x4c, 0xbb, 0xbb, 0xd3, 0xdd, 0x76,
+	0x34, 0x0a, 0xb9, 0x2c, 0xca, 0x05, 0xad, 0x40, 0xc0, 0x1e, 0x10, 0x42, 0x80, 0x16, 0xad, 0x84,
+	0x10, 0x88, 0x0b, 0x5a, 0x21, 0x21, 0x24, 0xb8, 0x20, 0x38, 0x20, 0xad, 0xe0, 0xc8, 0x05, 0x45,
+	0x88, 0x23, 0x5c, 0xf6, 0x0f, 0x40, 0x55, 0x5d, 0xd5, 0x5d, 0xed, 0x8f, 0xb6, 0x07, 0x1b, 0x6d,
+	0x6e, 0xfd, 0xca, 0xdd, 0xef, 0xfd, 0xde, 0xab, 0x5f, 0xbd, 0x57, 0xf5, 0xca, 0x70, 0x22, 0xa0,
+	0x7e, 0x97, 0xfa, 0x75, 0xe2, 0x79, 0xb6, 0x65, 0x92, 0xd0, 0x72, 0x1d, 0xf5, 0xb9, 0xe6, 0xf9,
+	0x6e, 0xe8, 0xe2, 0xb2, 0x32, 0x54, 0x59, 0x6a, 0xb9, 0x6e, 0xcb, 0xa6, 0x75, 0xe2, 0x59, 0x75,
+	0xe2, 0x38, 0x6e, 0xc8, 0x87, 0x83, 0xe8, 0xd5, 0x8a, 0xbe, 0x73, 0x29, 0xa8, 0x59, 0x2e, 0xff,
+	0xd5, 0x74, 0x7d, 0x5a, 0xef, 0x5e, 0xa8, 0xb7, 0xa8, 0x43, 0x7d, 0x12, 0xd2, 0xa6, 0x78, 0xe7,
+	0x62, 0xf2, 0x4e, 0x9b, 0x98, 0xdb, 0x96, 0x43, 0xfd, 0xdd, 0xba, 0xb7, 0xd3, 0x62, 0x03, 0x41,
+	0xbd, 0x4d, 0x43, 0x32, 0xe8, 0xab, 0x8d, 0x96, 0x15, 0x6e, 0x77, 0xde, 0xac, 0x99, 0x6e, 0xbb,
+	0x4e, 0xfc, 0x96, 0xeb, 0xf9, 0xee, 0xd7, 0xf8, 0xc3, 0xaa, 0xd9, 0xac, 0x77, 0x1b, 0x89, 0x02,
+	0xd5, 0x97, 0xee, 0x05, 0x62, 0x7b, 0xdb, 0xa4, 0x5f, 0xdb, 0xb5, 0x11, 0xda, 0x7c, 0xea, 0xb9,
+	0x22, 0x36, 0xfc, 0xd1, 0x0a, 0x5d, 0x7f, 0x57, 0x79, 0x8c, 0xd4, 0xe8, 0x1f, 0x22, 0x38, 0x70,
+	0x39, 0xb1, 0xf7, 0x85, 0x0e, 0xf5, 0x77, 0x31, 0x86, 0x19, 0x87, 0xb4, 0xa9, 0x86, 0xaa, 0x68,
+	0x79, 0xce, 0xe0, 0xcf, 0x58, 0x83, 0x59, 0x9f, 0x6e, 0xf9, 0x34, 0xd8, 0xd6, 0x72, 0x7c, 0x58,
+	0x8a, 0xb8, 0x02, 0x25, 0x66, 0x9c, 0x9a, 0x61, 0xa0, 0xe5, 0xab, 0xf9, 0xe5, 0x39, 0x23, 0x96,
+	0xf1, 0x32, 0xec, 0xf7, 0x69, 0xe0, 0x76, 0x7c, 0x93, 0x7e, 0x91, 0xfa, 0x81, 0xe5, 0x3a, 0xda,
+	0x0c, 0xff, 0xba, 0x77, 0x98, 0x69, 0x09, 0xa8, 0x4d, 0xcd, 0xd0, 0xf5, 0xb5, 0x02, 0x7f, 0x25,
+	0x96, 0x19, 0x1e, 0x06, 0x5c, 0x2b, 0x46, 0x78, 0xd8, 0x33, 0xd6, 0x61, 0x9e, 0x78, 0xde, 0x1d,
+	0xd2, 0xa6, 0x81, 0x47, 0x4c, 0xaa, 0xcd, 0xf2, 0xdf, 0x52, 0x63, 0x0c, 0xb3, 0x40, 0xa2, 0x95,
+	0x38, 0x30, 0x29, 0xea, 0xeb, 0x30, 0x77, 0xc7, 0x6d, 0xd2, 0xe1, 0xee, 0xf6, 0xaa, 0xcf, 0xf5,
+	0xab, 0xd7, 0x9f, 0x22, 0x38, 0x6c, 0xd0, 0xae, 0xc5, 0xf0, 0xdf, 0xa6, 0x21, 0x69, 0x92, 0x90,
+	0xf4, 0x6a, 0xcc, 0xc5, 0x1a, 0x2b, 0x50, 0xf2, 0xc5, 0xcb, 0x5a, 0x8e, 0x8f, 0xc7, 0x72, 0x9f,
+	0xb5, 0x7c, 0xb6, 0x33, 0x51, 0x08, 0x63, 0x67, 0xfe, 0x85, 0xe0, 0xa8, 0x32, 0x87, 0x86, 0x88,
+	0xec, 0xb5, 0x2e, 0x75, 0xc2, 0x60, 0x38, 0xa0, 0x73, 0x70, 0x50, 0x4e, 0x42, 0xaf, 0x9f, 0xfd,
+	0x3f, 0x30, 0x88, 0xea, 0xa0, 0x84, 0xa8, 0x8e, 0xe1, 0x2a, 0x94, 0xa5, 0x7c, 0xff, 0xd6, 0x55,
+	0x01, 0x53, 0x1d, 0xea, 0x73, 0xb4, 0x90, 0xed, 0x68, 0x31, 0xed, 0xe8, 0x07, 0x08, 0x34, 0xc5,
+	0xd1, 0xdb, 0xc4, 0xb1, 0xb6, 0x68, 0x10, 0x8e, 0x1b, 0x73, 0x34, 0xbd, 0x98, 0x33, 0x62, 0x47,
+	0x5e, 0xdd, 0x65, 0xeb, 0x89, 0xe5, 0x0f, 0xad, 0x50, 0xcd, 0x2f, 0xe7, 0x8d, 0xde, 0x61, 0xbc,
+	0x04, 0x73, 0xd2, 0x66, 0xa0, 0x15, 0x39, 0x0d, 0x93, 0x01, 0xfd, 0x18, 0xcc, 0x5d, 0xb7, 0x6c,
+	0xba, 0xbe, 0xdd, 0x71, 0x76, 0xf0, 0x21, 0x28, 0x98, 0xec, 0x81, 0xfb, 0x30, 0x6f, 0x44, 0x82,
+	0xfe, 0x1d, 0x04, 0xc7, 0x86, 0x79, 0xfd, 0xc0, 0x0a, 0xb7, 0xd9, 0xf7, 0xc1, 0x30, 0xf7, 0xcd,
+	0x6d, 0x6a, 0xee, 0x04, 0x9d, 0xb6, 0xa4, 0x9c, 0x94, 0x27, 0xa4, 0xdc, 0xcf, 0x11, 0x2c, 0x8f,
+	0xc4, 0xf4, 0xc0, 0x27, 0x9e, 0x47, 0x7d, 0x7c, 0x1d, 0x0a, 0x0f, 0xd9, 0x0f, 0x7c, 0x81, 0x95,
+	0x1b, 0xb5, 0x9a, 0x9a, 0xa0, 0x47, 0x6a, 0xb9, 0xf9, 0x31, 0x23, 0xfa, 0x1c, 0xd7, 0x64, 0x78,
+	0x72, 0x5c, 0xcf, 0x62, 0x4a, 0x4f, 0x1c, 0x45, 0xf6, 0x3e, 0x7f, 0xed, 0x4a, 0x11, 0x66, 0x3c,
+	0xe2, 0x87, 0xfa, 0x61, 0x78, 0x21, 0xbd, 0x3c, 0x3c, 0xd7, 0x09, 0xa8, 0xfe, 0xdb, 0x34, 0x9b,
+	0xd6, 0x7d, 0x4a, 0x42, 0x6a, 0xd0, 0x87, 0x1d, 0x1a, 0x84, 0x78, 0x07, 0xd4, 0x9a, 0xc1, 0xa3,
+	0x5a, 0x6e, 0xdc, 0xaa, 0x25, 0x49, 0xb7, 0x26, 0x93, 0x2e, 0x7f, 0xf8, 0x8a, 0xd9, 0xac, 0x75,
+	0x1b, 0x35, 0x6f, 0xa7, 0x55, 0x63, 0x29, 0x3c, 0x85, 0x4c, 0xa6, 0x70, 0xd5, 0x55, 0x43, 0xd5,
+	0x8e, 0x17, 0xa1, 0xd8, 0xf1, 0x02, 0xea, 0x87, 0xdc, 0xb3, 0x92, 0x21, 0x24, 0x36, 0x7f, 0x5d,
+	0x62, 0x5b, 0x4d, 0x12, 0x46, 0xf3, 0x53, 0x32, 0x62, 0x59, 0xff, 0x5d, 0x1a, 0xfd, 0x7d, 0xaf,
+	0xf9, 0x51, 0xa1, 0x57, 0x51, 0xe6, 0xd2, 0x28, 0x55, 0x06, 0xe5, 0xd3, 0x0c, 0xfa, 0x75, 0x1a,
+	0xff, 0x55, 0x6a, 0xd3, 0x04, 0xff, 0x20, 0x32, 0x6b, 0x30, 0x6b, 0x92, 0xc0, 0x24, 0x4d, 0x69,
+	0x45, 0x8a, 0x2c, 0x91, 0x79, 0xbe, 0xeb, 0x91, 0x16, 0xd7, 0x74, 0xd7, 0xb5, 0x2d, 0x73, 0x57,
+	0x98, 0xeb, 0xff, 0xa1, 0x8f, 0xf8, 0x33, 0xd9, 0xc4, 0x2f, 0xa4, 0x61, 0x1f, 0x87, 0xf2, 0xe6,
+	0xae, 0x63, 0xbe, 0xee, 0x45, 0x8b, 0xfb, 0x10, 0x14, 0xac, 0x90, 0xb6, 0x03, 0x0d, 0xf1, 0x85,
+	0x1d, 0x09, 0xfa, 0xfb, 0x05, 0x58, 0x54, 0x7c, 0x63, 0x1f, 0x64, 0x79, 0x96, 0x95, 0xa5, 0x16,
+	0xa1, 0xd8, 0xf4, 0x77, 0x8d, 0x8e, 0x23, 0x08, 0x20, 0x24, 0x66, 0xd8, 0xf3, 0x3b, 0x4e, 0x04,
+	0xbf, 0x64, 0x44, 0x02, 0xde, 0x82, 0x52, 0x10, 0xb2, 0x5d, 0x42, 0x6b, 0x97, 0x03, 0x2f, 0x37,
+	0x3e, 0x37, 0xd9, 0xa4, 0x33, 0xe8, 0x9b, 0x42, 0xa3, 0x11, 0xeb, 0xc6, 0x0f, 0x59, 0x4e, 0x8b,
+	0x12, 0x5d, 0xa0, 0xcd, 0x56, 0xf3, 0xcb, 0xe5, 0xc6, 0xe6, 0xe4, 0x86, 0x5e, 0xf7, 0xd8, 0x0e,
+	0x47, 0xa9, 0x60, 0x46, 0x62, 0x85, 0xa5, 0xd1, 0xb6, 0xc8, 0x0f, 0x81, 0xa8, 0xe6, 0xc9, 0x00,
+	0xfe, 0x12, 0x14, 0x2c, 0x67, 0xcb, 0x0d, 0xb4, 0x39, 0x0e, 0xe6, 0xca, 0x64, 0x60, 0x6e, 0x39,
+	0x5b, 0xae, 0x11, 0x29, 0xc4, 0x0f, 0x61, 0xc1, 0xa7, 0xa1, 0xbf, 0x2b, 0xa3, 0xa0, 0x01, 0x8f,
+	0xeb, 0xe7, 0x27, 0xb3, 0x60, 0xa8, 0x2a, 0x8d, 0xb4, 0x05, 0xbc, 0x06, 0xe5, 0x20, 0xe1, 0x98,
+	0x56, 0xe6, 0x06, 0xb5, 0x94, 0x22, 0x85, 0x83, 0x86, 0xfa, 0x72, 0x1f, 0xbb, 0xe7, 0xb3, 0xd9,
+	0xbd, 0x90, 0x66, 0xf7, 0x7f, 0x10, 0x2c, 0xf5, 0x25, 0x95, 0x4d, 0x8f, 0x66, 0xd2, 0x97, 0xc0,
+	0x4c, 0xe0, 0x51, 0x93, 0x57, 0x98, 0x72, 0xe3, 0xf6, 0xd4, 0xb2, 0x0c, 0xb7, 0xcb, 0x55, 0x67,
+	0x25, 0xc2, 0x09, 0xd7, 0xf3, 0x8f, 0x11, 0x7c, 0x5c, 0xb1, 0x79, 0x97, 0x84, 0xe6, 0x76, 0x96,
+	0xb3, 0x6c, 0xdd, 0xb1, 0x77, 0x44, 0x3d, 0x8d, 0x04, 0x46, 0x4e, 0xfe, 0x70, 0x6f, 0xd7, 0x63,
+	0x00, 0xd9, 0x2f, 0xc9, 0xc0, 0x84, 0x9b, 0x9e, 0x5f, 0x20, 0xa8, 0xa8, 0xb9, 0xd7, 0xb5, 0xed,
+	0x37, 0x89, 0xb9, 0x93, 0x05, 0x72, 0x1f, 0xe4, 0xac, 0x26, 0x47, 0x98, 0x37, 0x72, 0x56, 0x73,
+	0x8f, 0x49, 0xa4, 0x17, 0x6e, 0x31, 0x1b, 0xee, 0x6c, 0x1a, 0xee, 0x87, 0x3d, 0x70, 0xe5, 0x52,
+	0xce, 0x80, 0xbb, 0x04, 0x73, 0x4e, 0xcf, 0x06, 0x34, 0x19, 0x18, 0xb0, 0xf1, 0xcc, 0xf5, 0x6d,
+	0x3c, 0x35, 0x98, 0xed, 0xc6, 0xc7, 0x0b, 0xf6, 0xb3, 0x14, 0x99, 0x8b, 0x2d, 0xdf, 0xed, 0x78,
+	0x22, 0xe8, 0x91, 0xc0, 0x50, 0xec, 0x58, 0x4e, 0x53, 0x2b, 0x46, 0x28, 0xd8, 0xf3, 0xde, 0x0f,
+	0x14, 0x29, 0xb7, 0x7f, 0x99, 0x83, 0x4f, 0x0c, 0x70, 0x7b, 0x24, 0x9f, 0x9e, 0x0f, 0xdf, 0x63,
+	0x56, 0xcf, 0x0e, 0x65, 0x75, 0x69, 0x14, 0xab, 0xe7, 0xb2, 0xe3, 0x05, 0xe9, 0x78, 0xfd, 0x2c,
+	0x07, 0xd5, 0x01, 0xf1, 0x1a, 0xbd, 0x0d, 0x78, 0x6e, 0x02, 0xb6, 0xe5, 0xfa, 0x82, 0x25, 0x25,
+	0x23, 0x12, 0xd8, 0x3a, 0x73, 0x7d, 0x6f, 0x9b, 0x38, 0x9c, 0x1d, 0x25, 0x43, 0x48, 0x13, 0x86,
+	0xea, 0x9b, 0x39, 0xd0, 0x64, 0x7c, 0x2e, 0x9b, 0x3c, 0x5a, 0x1d, 0xe7, 0xf9, 0x0f, 0xd1, 0x22,
+	0x14, 0x09, 0x47, 0x2b, 0x48, 0x25, 0xa4, 0xbe, 0x60, 0x94, 0xb2, 0x83, 0x31, 0x97, 0x0e, 0xc6,
+	0x53, 0x04, 0x47, 0xd2, 0xc1, 0x08, 0x36, 0xac, 0x20, 0x94, 0x9b, 0x7a, 0xbc, 0x05, 0xb3, 0x91,
+	0x9d, 0x68, 0x4b, 0x56, 0x6e, 0x6c, 0x4c, 0x5a, 0xa8, 0x53, 0x81, 0x97, 0xca, 0xf5, 0x97, 0xe1,
+	0xc8, 0xc0, 0x2c, 0x27, 0x60, 0x54, 0xa0, 0x24, 0x37, 0x27, 0x62, 0x6a, 0x62, 0x59, 0x7f, 0x3a,
+	0x93, 0x2e, 0x39, 0x6e, 0x73, 0xc3, 0x6d, 0x65, 0x9c, 0xd3, 0xb3, 0xa7, 0x93, 0x85, 0xca, 0x6d,
+	0x2a, 0x47, 0x72, 0x29, 0xb2, 0xef, 0x4c, 0xd7, 0x09, 0x89, 0xe5, 0x50, 0x5f, 0x54, 0xc5, 0x64,
+	0x80, 0x4d, 0x43, 0x60, 0x39, 0x26, 0xdd, 0xa4, 0xa6, 0xeb, 0x34, 0x03, 0x3e, 0x9f, 0x79, 0x23,
+	0x35, 0x86, 0x6f, 0xc2, 0x1c, 0x97, 0xef, 0x59, 0xed, 0xa8, 0x0c, 0x94, 0x1b, 0x2b, 0xb5, 0xa8,
+	0xf7, 0x55, 0x53, 0x7b, 0x5f, 0x49, 0x0c, 0xdb, 0x34, 0x24, 0xb5, 0xee, 0x85, 0x1a, 0xfb, 0xc2,
+	0x48, 0x3e, 0x66, 0x58, 0x42, 0x62, 0xd9, 0x1b, 0x96, 0xc3, 0x37, 0x8c, 0xcc, 0x54, 0x32, 0xc0,
+	0xa8, 0xb2, 0xe5, 0xda, 0xb6, 0xfb, 0x48, 0xae, 0x9b, 0x48, 0x62, 0x5f, 0x75, 0x9c, 0xd0, 0xb2,
+	0xb9, 0xfd, 0x88, 0x08, 0xc9, 0x00, 0xff, 0xca, 0xb2, 0x43, 0xea, 0x8b, 0x05, 0x23, 0xa4, 0x98,
+	0x8c, 0xe5, 0xa8, 0x9d, 0x23, 0xd7, 0x6b, 0x44, 0xdb, 0x79, 0x95, 0xb6, 0xbd, 0x4b, 0x61, 0x61,
+	0x40, 0x4f, 0x83, 0x77, 0xb7, 0x68, 0xd7, 0x72, 0x3b, 0x81, 0xb6, 0x2f, 0xda, 0x7a, 0x48, 0xb9,
+	0x8f, 0xca, 0xfb, 0xb3, 0xa9, 0x7c, 0x20, 0x4d, 0xe5, 0xdf, 0x23, 0x28, 0x6d, 0xb8, 0xad, 0x6b,
+	0x4e, 0xe8, 0xef, 0xf2, 0xd3, 0x8d, 0xeb, 0x84, 0xd4, 0x91, 0x7c, 0x91, 0x22, 0x9b, 0x84, 0xd0,
+	0x6a, 0xd3, 0xcd, 0x90, 0xb4, 0x3d, 0xb1, 0xc7, 0xda, 0xd3, 0x24, 0xc4, 0x1f, 0xb3, 0xc0, 0xd8,
+	0x24, 0x08, 0xf9, 0x8a, 0x2f, 0x19, 0xfc, 0x99, 0xb9, 0x10, 0xbf, 0xb0, 0x19, 0xfa, 0x62, 0xb9,
+	0xa7, 0xc6, 0x54, 0x8a, 0x15, 0x22, 0x6c, 0x42, 0xd4, 0xdb, 0xf0, 0x62, 0xbc, 0x69, 0xbf, 0x47,
+	0xfd, 0xb6, 0xe5, 0x90, 0xec, 0xec, 0x3d, 0x46, 0x5b, 0x2d, 0xe3, 0xcc, 0xe8, 0xa6, 0x16, 0x1d,
+	0xdb, 0x03, 0x3f, 0xb0, 0x9c, 0xa6, 0xfb, 0x28, 0x63, 0xf1, 0x4c, 0x66, 0xf0, 0xaf, 0xe9, 0xce,
+	0x9a, 0x62, 0x31, 0x5e, 0xe9, 0x37, 0x61, 0x81, 0xe5, 0x84, 0x2e, 0x15, 0x3f, 0x88, 0xb4, 0xa3,
+	0x0f, 0x6b, 0x72, 0x24, 0x3a, 0x8c, 0xf4, 0x87, 0x78, 0x03, 0xf6, 0x93, 0x20, 0xb0, 0x5a, 0x0e,
+	0x6d, 0x4a, 0x5d, 0xb9, 0xb1, 0x75, 0xf5, 0x7e, 0x1a, 0x1d, 0x97, 0xf9, 0x1b, 0x62, 0xbe, 0xa5,
+	0xa8, 0x7f, 0x03, 0xc1, 0xe1, 0x81, 0x4a, 0xe2, 0x95, 0x83, 0x94, 0x34, 0x5e, 0x81, 0x52, 0x60,
+	0x6e, 0xd3, 0x66, 0xc7, 0xa6, 0xb2, 0x87, 0x24, 0x65, 0xf6, 0x5b, 0xb3, 0x13, 0xcd, 0xbe, 0x28,
+	0x23, 0xb1, 0x8c, 0x8f, 0x02, 0xb4, 0x89, 0xd3, 0x21, 0x36, 0x87, 0x30, 0xc3, 0x21, 0x28, 0x23,
+	0xfa, 0x12, 0x54, 0x06, 0x51, 0x47, 0xf4, 0x66, 0xfe, 0x8d, 0x60, 0x9f, 0x4c, 0xaa, 0x62, 0x76,
+	0x97, 0x61, 0xbf, 0x12, 0x86, 0x3b, 0xc9, 0x44, 0xf7, 0x0e, 0x8f, 0x48, 0x98, 0x92, 0x25, 0xf9,
+	0x74, 0x73, 0xbb, 0x9b, 0x6a, 0x4f, 0x8f, 0x5d, 0xef, 0xd0, 0x94, 0xf6, 0x8f, 0x5f, 0x07, 0xed,
+	0x36, 0x71, 0x48, 0x8b, 0x36, 0x63, 0xb7, 0x63, 0x8a, 0x7d, 0x55, 0x6d, 0x32, 0x4c, 0x7c, 0xa4,
+	0x8f, 0xb7, 0x5a, 0xd6, 0xd6, 0x96, 0x6c, 0x58, 0xf8, 0x50, 0xda, 0xb0, 0x9c, 0x1d, 0x76, 0xee,
+	0x65, 0x1e, 0x87, 0x56, 0x68, 0xcb, 0xe8, 0x46, 0x02, 0x3e, 0x00, 0xf9, 0x8e, 0x6f, 0x0b, 0x06,
+	0xb0, 0x47, 0x5c, 0x85, 0x72, 0x93, 0x06, 0xa6, 0x6f, 0x79, 0x62, 0xfe, 0x79, 0xb3, 0x57, 0x19,
+	0x62, 0xf3, 0x60, 0x99, 0xae, 0xb3, 0x6e, 0x93, 0x20, 0x90, 0x05, 0x28, 0x1e, 0xd0, 0x5f, 0x85,
+	0x05, 0x66, 0x33, 0x71, 0xf3, 0x6c, 0xda, 0xcd, 0xc3, 0x29, 0xf8, 0x12, 0x9e, 0x44, 0x4c, 0xe0,
+	0x05, 0x56, 0xf7, 0x2f, 0x7b, 0x9e, 0x50, 0x32, 0xe6, 0x76, 0x28, 0x3f, 0xa8, 0x7e, 0x0e, 0xec,
+	0x71, 0x36, 0xfe, 0x7e, 0x1c, 0xb0, 0xba, 0x4e, 0xa8, 0xdf, 0xb5, 0x4c, 0x8a, 0xbf, 0x8b, 0x60,
+	0x86, 0x99, 0xc6, 0x2f, 0x0d, 0x5b, 0x96, 0x9c, 0xaf, 0x95, 0xe9, 0x1d, 0x84, 0x99, 0x35, 0x7d,
+	0xe9, 0xad, 0xbf, 0xfd, 0xf3, 0x7b, 0xb9, 0x45, 0x7c, 0x88, 0xdf, 0x4c, 0x75, 0x2f, 0xa8, 0xb7,
+	0x44, 0x01, 0x7e, 0x1b, 0x01, 0x16, 0xfb, 0x20, 0xa5, 0xf7, 0x8f, 0xcf, 0x0e, 0x83, 0x38, 0xe0,
+	0x8e, 0xa0, 0xf2, 0x92, 0x52, 0x55, 0x6a, 0xa6, 0xeb, 0x53, 0x56, 0x43, 0xf8, 0x0b, 0x1c, 0xc0,
+	0x0a, 0x07, 0x70, 0x02, 0xeb, 0x83, 0x00, 0xd4, 0x1f, 0xb3, 0x88, 0x3e, 0xa9, 0xd3, 0xc8, 0xee,
+	0xbb, 0x08, 0x0a, 0x0f, 0xf8, 0x19, 0x62, 0x44, 0x90, 0x36, 0xa7, 0x16, 0x24, 0x6e, 0x8e, 0xa3,
+	0xd5, 0x8f, 0x73, 0xa4, 0x2f, 0xe1, 0x23, 0x12, 0x69, 0x10, 0xfa, 0x94, 0xb4, 0x53, 0x80, 0xcf,
+	0x23, 0xfc, 0x1e, 0x82, 0x62, 0xd4, 0xf4, 0xc5, 0x27, 0x87, 0xa1, 0x4c, 0x35, 0x85, 0x2b, 0xd3,
+	0xeb, 0xa0, 0xea, 0x67, 0x38, 0xc6, 0xe3, 0xfa, 0xc0, 0xe9, 0x5c, 0x4b, 0xf5, 0x57, 0xdf, 0x41,
+	0x90, 0xbf, 0x41, 0x47, 0xf2, 0x6d, 0x8a, 0xe0, 0xfa, 0x02, 0x38, 0x60, 0xaa, 0xf1, 0x4f, 0x11,
+	0xbc, 0x78, 0x83, 0x86, 0x83, 0xcb, 0x23, 0x5e, 0x1e, 0x5d, 0xb3, 0x04, 0xed, 0xce, 0x8e, 0xf1,
+	0x66, 0x5c, 0x17, 0xea, 0x1c, 0xd9, 0x19, 0x7c, 0x3a, 0x8b, 0x84, 0xc1, 0xae, 0x63, 0x3e, 0x12,
+	0x38, 0xfe, 0x8c, 0xe0, 0x40, 0xef, 0x1d, 0x1d, 0x4e, 0x17, 0xd4, 0x81, 0x57, 0x78, 0x95, 0x3b,
+	0x93, 0x66, 0xd9, 0xb4, 0x52, 0xfd, 0x32, 0x47, 0xfe, 0x0a, 0x7e, 0x39, 0x0b, 0x79, 0x7c, 0x2f,
+	0x54, 0x7f, 0x2c, 0x1f, 0x9f, 0xf0, 0xfb, 0x64, 0x0e, 0xfb, 0x2f, 0x08, 0x0e, 0x49, 0xbd, 0xeb,
+	0xdb, 0xc4, 0x0f, 0xaf, 0x52, 0xb6, 0x87, 0x0e, 0xc6, 0xf2, 0x67, 0xc2, 0xaa, 0xa1, 0xda, 0xd3,
+	0xaf, 0x71, 0x5f, 0x3e, 0x83, 0x5f, 0xdb, 0xb3, 0x2f, 0x26, 0x53, 0xd3, 0x14, 0xb0, 0xdf, 0x42,
+	0x30, 0x7f, 0x83, 0x86, 0xb7, 0xe3, 0x2e, 0xee, 0xc9, 0xb1, 0x6e, 0x86, 0x2a, 0x4b, 0x35, 0xe5,
+	0x1a, 0x5b, 0xfe, 0x14, 0x53, 0x64, 0x95, 0x83, 0x3b, 0x8d, 0x4f, 0x66, 0x81, 0x4b, 0x3a, 0xc7,
+	0xef, 0x22, 0x38, 0xac, 0x82, 0x48, 0x6e, 0xd4, 0x3e, 0xb5, 0xb7, 0x7b, 0x2a, 0x71, 0xdb, 0x35,
+	0x02, 0x5d, 0x83, 0xa3, 0x3b, 0xa7, 0x0f, 0x26, 0x70, 0xbb, 0x0f, 0xc5, 0x1a, 0x5a, 0x59, 0x46,
+	0xf8, 0x0f, 0x08, 0x8a, 0x51, 0x33, 0x76, 0x78, 0x8c, 0x52, 0x37, 0x40, 0xd3, 0xcc, 0x06, 0x62,
+	0xb6, 0x2b, 0xe7, 0x07, 0x07, 0x54, 0xfd, 0x5e, 0x52, 0xb5, 0xc6, 0xa3, 0x9c, 0x4e, 0x63, 0xef,
+	0x23, 0x80, 0xa4, 0xa1, 0x8c, 0xcf, 0x64, 0xfb, 0xa1, 0x34, 0x9d, 0x2b, 0xd3, 0x6d, 0x29, 0xeb,
+	0x35, 0xee, 0xcf, 0x72, 0xa5, 0x9a, 0x99, 0x43, 0x3c, 0x6a, 0xae, 0x45, 0xcd, 0xe7, 0x9f, 0x20,
+	0x28, 0xf0, 0x3e, 0x1e, 0x3e, 0x31, 0x0c, 0xb3, 0xda, 0xe6, 0x9b, 0x66, 0xe8, 0x4f, 0x71, 0xa8,
+	0xd5, 0x46, 0x56, 0x22, 0x5e, 0x43, 0x2b, 0xb8, 0x0b, 0xc5, 0xa8, 0x73, 0x36, 0x9c, 0x1e, 0xa9,
+	0xce, 0x5a, 0xa5, 0x9a, 0xb1, 0x31, 0x88, 0x88, 0x2a, 0x6a, 0xc0, 0xca, 0xa8, 0x1a, 0x30, 0xc3,
+	0xd2, 0x34, 0x3e, 0x9e, 0x95, 0xc4, 0xff, 0x0f, 0x81, 0x39, 0xcb, 0xd1, 0x9d, 0xd4, 0xab, 0xa3,
+	0xea, 0x00, 0x8b, 0xce, 0xf7, 0x11, 0x1c, 0xe8, 0xdd, 0x5c, 0xe3, 0x23, 0x3d, 0x39, 0x53, 0x3d,
+	0x6b, 0x54, 0xd2, 0x51, 0x1c, 0xb6, 0x31, 0xd7, 0x3f, 0xcb, 0x51, 0xac, 0xe1, 0x4b, 0x23, 0x57,
+	0xc6, 0x1d, 0x99, 0x75, 0x98, 0xa2, 0xd5, 0xe4, 0x56, 0xeb, 0x37, 0x08, 0xe6, 0xa5, 0xde, 0x7b,
+	0x3e, 0xa5, 0xd9, 0xb0, 0xa6, 0xb7, 0x10, 0x98, 0x2d, 0xfd, 0x55, 0x0e, 0xff, 0xd3, 0xf8, 0xe2,
+	0x98, 0xf0, 0x25, 0xec, 0xd5, 0x90, 0x21, 0xfd, 0x23, 0x82, 0x83, 0x0f, 0x22, 0xde, 0x7f, 0x44,
+	0xf8, 0xd7, 0x39, 0xfe, 0xd7, 0xf0, 0x2b, 0x19, 0xfb, 0xbc, 0x51, 0x6e, 0x9c, 0x47, 0xf8, 0x57,
+	0x08, 0x4a, 0xf2, 0x56, 0x05, 0x9f, 0x1e, 0xba, 0x30, 0xd2, 0xf7, 0x2e, 0xd3, 0x24, 0xb3, 0xd8,
+	0xd4, 0xe8, 0x27, 0x32, 0xcb, 0xa9, 0xb0, 0xcf, 0x08, 0xfd, 0x0e, 0x02, 0x1c, 0x9f, 0x99, 0xe3,
+	0x53, 0x34, 0x3e, 0x95, 0x32, 0x35, 0xb4, 0x31, 0x53, 0x39, 0x3d, 0xf2, 0xbd, 0x74, 0x29, 0x5d,
+	0xc9, 0x2c, 0xa5, 0x6e, 0x6c, 0xff, 0x5b, 0x08, 0xca, 0x37, 0x68, 0x7c, 0x06, 0xc9, 0x88, 0x65,
+	0xfa, 0x52, 0xa8, 0xb2, 0x3c, 0xfa, 0x45, 0x81, 0xe8, 0x1c, 0x47, 0x74, 0x0a, 0x67, 0x87, 0x4a,
+	0x02, 0xf8, 0x21, 0x82, 0x85, 0xbb, 0x2a, 0x45, 0xf1, 0xb9, 0x51, 0x96, 0x52, 0x99, 0x7c, 0x7c,
+	0x5c, 0x9f, 0xe4, 0xb8, 0x56, 0xf5, 0xb1, 0x70, 0xad, 0x89, 0xfb, 0x95, 0x1f, 0xa1, 0xe8, 0x10,
+	0xdb, 0xd3, 0xcf, 0xfe, 0x5f, 0xe3, 0x96, 0xd1, 0x16, 0xd7, 0x2f, 0x72, 0x7c, 0x35, 0x7c, 0x6e,
+	0x1c, 0x7c, 0x75, 0xd1, 0xe4, 0xc6, 0x3f, 0x40, 0x70, 0x90, 0xdf, 0x35, 0xa8, 0x8a, 0x7b, 0x4a,
+	0xcc, 0xb0, 0x9b, 0x89, 0x31, 0x4a, 0x8c, 0xc8, 0x3f, 0xfa, 0x9e, 0x40, 0xad, 0xc9, 0x7b, 0x84,
+	0x6f, 0x23, 0xd8, 0x27, 0x8b, 0x9a, 0x98, 0xdd, 0xd5, 0x51, 0x81, 0xdb, 0x6b, 0x11, 0x14, 0x74,
+	0x5b, 0x19, 0x8f, 0x6e, 0xef, 0x21, 0x98, 0x15, 0xdd, 0xfc, 0x8c, 0xad, 0x82, 0xd2, 0xee, 0xaf,
+	0xf4, 0xf4, 0x38, 0x44, 0x33, 0x58, 0xff, 0x32, 0x37, 0x7b, 0x1f, 0xd7, 0xb3, 0xcc, 0x7a, 0x6e,
+	0x33, 0xa8, 0x3f, 0x16, 0x9d, 0xd8, 0x27, 0x75, 0xdb, 0x6d, 0x05, 0x6f, 0xe8, 0x38, 0xb3, 0x20,
+	0xb2, 0x77, 0xce, 0x23, 0x1c, 0xc2, 0x1c, 0x23, 0x07, 0x6f, 0x9c, 0xe0, 0x6a, 0x4f, 0x9b, 0xa5,
+	0xaf, 0xa7, 0x52, 0xa9, 0xf4, 0x35, 0x62, 0x92, 0x0a, 0x28, 0x8e, 0xb1, 0xf8, 0x58, 0xa6, 0x59,
+	0x6e, 0xe8, 0x6d, 0x04, 0x07, 0x55, 0xb6, 0x47, 0xe6, 0xc7, 0xe6, 0x7a, 0x16, 0x0a, 0xb1, 0xa9,
+	0xc6, 0x2b, 0x63, 0x11, 0x89, 0xc3, 0xb9, 0x72, 0xfd, 0x4f, 0xcf, 0x8e, 0xa2, 0x0f, 0x9e, 0x1d,
+	0x45, 0xff, 0x78, 0x76, 0x14, 0xbd, 0x71, 0x69, 0xbc, 0xff, 0xe6, 0x9a, 0xb6, 0x45, 0x9d, 0x50,
+	0x55, 0xff, 0xdf, 0x00, 0x00, 0x00, 0xff, 0xff, 0xf0, 0x7f, 0x21, 0xe8, 0x81, 0x2c, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -4482,21 +4486,20 @@ func (m *ApplicationManifestQuery) MarshalToSizedBuffer(dAtA []byte) (int, error
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if len(m.RevisionSourceMappings) > 0 {
-		for k := range m.RevisionSourceMappings {
-			v := m.RevisionSourceMappings[k]
-			baseI := i
-			i -= len(v)
-			copy(dAtA[i:], v)
-			i = encodeVarintApplication(dAtA, i, uint64(len(v)))
+	if len(m.Revisions) > 0 {
+		for iNdEx := len(m.Revisions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Revisions[iNdEx])
+			copy(dAtA[i:], m.Revisions[iNdEx])
+			i = encodeVarintApplication(dAtA, i, uint64(len(m.Revisions[iNdEx])))
 			i--
-			dAtA[i] = 0x12
-			i = encodeVarintApplication(dAtA, i, uint64(k))
+			dAtA[i] = 0x32
+		}
+	}
+	if len(m.SourcePositions) > 0 {
+		for iNdEx := len(m.SourcePositions) - 1; iNdEx >= 0; iNdEx-- {
+			i = encodeVarintApplication(dAtA, i, uint64(m.SourcePositions[iNdEx]))
 			i--
-			dAtA[i] = 0x8
-			i = encodeVarintApplication(dAtA, i, uint64(baseI-i))
-			i--
-			dAtA[i] = 0x2a
+			dAtA[i] = 0x28
 		}
 	}
 	if m.Project != nil {
@@ -6742,12 +6745,15 @@ func (m *ApplicationManifestQuery) Size() (n int) {
 		l = len(*m.Project)
 		n += 1 + l + sovApplication(uint64(l))
 	}
-	if len(m.RevisionSourceMappings) > 0 {
-		for k, v := range m.RevisionSourceMappings {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + sovApplication(uint64(k)) + 1 + len(v) + sovApplication(uint64(len(v)))
-			n += mapEntrySize + 1 + sovApplication(uint64(mapEntrySize))
+	if len(m.SourcePositions) > 0 {
+		for _, e := range m.SourcePositions {
+			n += 1 + sovApplication(uint64(e))
+		}
+	}
+	if len(m.Revisions) > 0 {
+		for _, s := range m.Revisions {
+			l = len(s)
+			n += 1 + l + sovApplication(uint64(l))
 		}
 	}
 	if m.XXX_unrecognized != nil {
@@ -8728,42 +8734,8 @@ func (m *ApplicationManifestQuery) Unmarshal(dAtA []byte) error {
 			m.Project = &s
 			iNdEx = postIndex
 		case 5:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field RevisionSourceMappings", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowApplication
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthApplication
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthApplication
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.RevisionSourceMappings == nil {
-				m.RevisionSourceMappings = make(map[int64]string)
-			}
-			var mapkey int64
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
+			if wireType == 0 {
+				var v int64
 				for shift := uint(0); ; shift += 7 {
 					if shift >= 64 {
 						return ErrIntOverflowApplication
@@ -8773,13 +8745,51 @@ func (m *ApplicationManifestQuery) Unmarshal(dAtA []byte) error {
 					}
 					b := dAtA[iNdEx]
 					iNdEx++
-					wire |= uint64(b&0x7F) << shift
+					v |= int64(b&0x7F) << shift
 					if b < 0x80 {
 						break
 					}
 				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
+				m.SourcePositions = append(m.SourcePositions, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowApplication
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				if packedLen < 0 {
+					return ErrInvalidLengthApplication
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return ErrInvalidLengthApplication
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				var count int
+				for _, integer := range dAtA[iNdEx:postIndex] {
+					if integer < 128 {
+						count++
+					}
+				}
+				elementCount = count
+				if elementCount != 0 && len(m.SourcePositions) == 0 {
+					m.SourcePositions = make([]int64, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v int64
 					for shift := uint(0); ; shift += 7 {
 						if shift >= 64 {
 							return ErrIntOverflowApplication
@@ -8789,56 +8799,47 @@ func (m *ApplicationManifestQuery) Unmarshal(dAtA []byte) error {
 						}
 						b := dAtA[iNdEx]
 						iNdEx++
-						mapkey |= int64(b&0x7F) << shift
+						v |= int64(b&0x7F) << shift
 						if b < 0x80 {
 							break
 						}
 					}
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowApplication
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= uint64(b&0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthApplication
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue < 0 {
-						return ErrInvalidLengthApplication
-					}
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipApplication(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
-						return ErrInvalidLengthApplication
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
+					m.SourcePositions = append(m.SourcePositions, v)
+				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field SourcePositions", wireType)
+			}
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Revisions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowApplication
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
 				}
 			}
-			m.RevisionSourceMappings[mapkey] = mapvalue
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthApplication
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthApplication
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Revisions = append(m.Revisions, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex

pkg/apis/api-rules/violation_exceptions.list

@@ -99,6 +99,9 @@ API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/applicat
 API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,ApplicationSourcePluginParameter,String_
 API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,ClusterCacheInfo,APIsCount
 API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,ConnectionState,ModifiedAt
+API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,ErrApplicationNotAllowedToUseProject,application
+API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,ErrApplicationNotAllowedToUseProject,namespace
+API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,ErrApplicationNotAllowedToUseProject,project
 API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,HelmOptions,ValuesFileSchemes
 API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,JWTToken,ExpiresAt
 API rule violation: names_match,github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1,JWTToken,IssuedAt

pkg/apis/application/v1alpha1/app_project_types.go

@@ -17,6 +17,24 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
+type ErrApplicationNotAllowedToUseProject struct {
+	application string
+	namespace   string
+	project     string
+}
+
+func NewErrApplicationNotAllowedToUseProject(application, namespace, project string) error {
+	return &ErrApplicationNotAllowedToUseProject{
+		application: application,
+		namespace:   namespace,
+		project:     project,
+	}
+}
+
+func (err *ErrApplicationNotAllowedToUseProject) Error() string {
+	return fmt.Sprintf("application '%s' in namespace '%s' is not allowed to use project %s", err.application, err.namespace, err.project)
+}
+
 // AppProjectList is list of AppProject resources
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 type AppProjectList struct {

pkg/apis/application/v1alpha1/generated.proto

@@ -904,6 +904,9 @@ message EnvEntry {
   optional string value = 2;
 }
 
+message ErrApplicationNotAllowedToUseProject {
+}
+
 // ExecProviderConfig is config used to call an external command to perform cluster authentication
 // See: https://godoc.org/k8s.io/client-go/tools/clientcmd/api#ExecConfig
 message ExecProviderConfig {

pkg/apis/application/v1alpha1/openapi_generated.go

@@ -70,6 +70,7 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.ConnectionState":                         schema_pkg_apis_application_v1alpha1_ConnectionState(ref),
 		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.DuckTypeGenerator":                       schema_pkg_apis_application_v1alpha1_DuckTypeGenerator(ref),
 		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.EnvEntry":                                schema_pkg_apis_application_v1alpha1_EnvEntry(ref),
+		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.ErrApplicationNotAllowedToUseProject":    schema_pkg_apis_application_v1alpha1_ErrApplicationNotAllowedToUseProject(ref),
 		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.ExecProviderConfig":                      schema_pkg_apis_application_v1alpha1_ExecProviderConfig(ref),
 		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.GitDirectoryGeneratorItem":               schema_pkg_apis_application_v1alpha1_GitDirectoryGeneratorItem(ref),
 		"github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1.GitFileGeneratorItem":                    schema_pkg_apis_application_v1alpha1_GitFileGeneratorItem(ref),
@@ -3221,6 +3222,40 @@ func schema_pkg_apis_application_v1alpha1_EnvEntry(ref common.ReferenceCallback)
 	}
 }
 
+func schema_pkg_apis_application_v1alpha1_ErrApplicationNotAllowedToUseProject(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"application": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"namespace": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"project": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+				},
+				Required: []string{"application", "namespace", "project"},
+			},
+		},
+	}
+}
+
 func schema_pkg_apis_application_v1alpha1_ExecProviderConfig(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{

pkg/apis/application/v1alpha1/zz_generated.deepcopy.go

@@ -1862,6 +1862,22 @@ func (in *EnvEntry) DeepCopy() *EnvEntry {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ErrApplicationNotAllowedToUseProject) DeepCopyInto(out *ErrApplicationNotAllowedToUseProject) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ErrApplicationNotAllowedToUseProject.
+func (in *ErrApplicationNotAllowedToUseProject) DeepCopy() *ErrApplicationNotAllowedToUseProject {
+	if in == nil {
+		return nil
+	}
+	out := new(ErrApplicationNotAllowedToUseProject)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExecProviderConfig) DeepCopyInto(out *ExecProviderConfig) {
 	*out = *in

server/application/application.go

@@ -150,7 +150,7 @@ func NewServer(
 //
 // If the user does provide a "project," we can respond more specifically. If the user does not have access to the given
 // app name in the given project, we return "permission denied." If the app exists, but the project is different from
-func (s *Server) getAppEnforceRBAC(ctx context.Context, action, project, namespace, name string, getApp func() (*appv1.Application, error)) (*appv1.Application, error) {
+func (s *Server) getAppEnforceRBAC(ctx context.Context, action, project, namespace, name string, getApp func() (*appv1.Application, error)) (*appv1.Application, *appv1.AppProject, error) {
 	user := session.Username(ctx)
 	if user == "" {
 		user = "Unknown user"
@@ -172,7 +172,7 @@ func (s *Server) getAppEnforceRBAC(ctx context.Context, action, project, namespa
 			// but the app is in a different project" response. We don't want the user inferring the existence of the
 			// app from response time.
 			_, _ = getApp()
-			return nil, permissionDeniedErr
+			return nil, nil, permissionDeniedErr
 		}
 	}
 	a, err := getApp()
@@ -180,15 +180,15 @@ func (s *Server) getAppEnforceRBAC(ctx context.Context, action, project, namespa
 		if apierr.IsNotFound(err) {
 			if project != "" {
 				// We know that the user was allowed to get the Application, but the Application does not exist. Return 404.
-				return nil, status.Errorf(codes.NotFound, apierr.NewNotFound(schema.GroupResource{Group: "argoproj.io", Resource: "applications"}, name).Error())
+				return nil, nil, status.Errorf(codes.NotFound, apierr.NewNotFound(schema.GroupResource{Group: "argoproj.io", Resource: "applications"}, name).Error())
 			}
 			// We don't know if the user was allowed to get the Application, and we don't want to leak information about
 			// the Application's existence. Return 403.
 			logCtx.Warn("application does not exist")
-			return nil, permissionDeniedErr
+			return nil, nil, permissionDeniedErr
 		}
 		logCtx.Errorf("failed to get application: %s", err)
-		return nil, permissionDeniedErr
+		return nil, nil, permissionDeniedErr
 	}
 	// Even if we performed an initial RBAC check (because the request was fully parameterized), we still need to
 	// perform a second RBAC check to ensure that the user has access to the actual Application's project (not just the
@@ -202,11 +202,11 @@ func (s *Server) getAppEnforceRBAC(ctx context.Context, action, project, namespa
 			// The user specified a project. We would have returned a 404 if the user had access to the app, but the app
 			// did not exist. So we have to return a 404 when the app does exist, but the user does not have access.
 			// Otherwise, they could infer that the app exists based on the error code.
-			return nil, status.Errorf(codes.NotFound, apierr.NewNotFound(schema.GroupResource{Group: "argoproj.io", Resource: "applications"}, name).Error())
+			return nil, nil, status.Errorf(codes.NotFound, apierr.NewNotFound(schema.GroupResource{Group: "argoproj.io", Resource: "applications"}, name).Error())
 		}
 		// The user didn't specify a project. We always return permission denied for both lack of access and lack of
 		// existence.
-		return nil, permissionDeniedErr
+		return nil, nil, permissionDeniedErr
 	}
 	effectiveProject := "default"
 	if a.Spec.Project != "" {
@@ -219,15 +219,20 @@ func (s *Server) getAppEnforceRBAC(ctx context.Context, action, project, namespa
 		}).Warnf("user tried to %s application in project %s, but the application is in project %s", action, project, effectiveProject)
 		// The user has access to the app, but the app is in a different project. Return 404, meaning "app doesn't
 		// exist in that project".
-		return nil, status.Errorf(codes.NotFound, apierr.NewNotFound(schema.GroupResource{Group: "argoproj.io", Resource: "applications"}, name).Error())
+		return nil, nil, status.Errorf(codes.NotFound, apierr.NewNotFound(schema.GroupResource{Group: "argoproj.io", Resource: "applications"}, name).Error())
 	}
-	return a, nil
+	// Get the app's associated project, and make sure all project restrictions are enforced.
+	proj, err := s.getAppProject(ctx, a, logCtx)
+	if err != nil {
+		return a, nil, err
+	}
+	return a, proj, nil
 }
 
 // getApplicationEnforceRBACInformer uses an informer to get an Application. If the app does not exist, permission is
 // denied, or any other error occurs when getting the app, we return a permission denied error to obscure any sensitive
 // information.
-func (s *Server) getApplicationEnforceRBACInformer(ctx context.Context, action, project, namespace, name string) (*appv1.Application, error) {
+func (s *Server) getApplicationEnforceRBACInformer(ctx context.Context, action, project, namespace, name string) (*appv1.Application, *appv1.AppProject, error) {
 	namespaceOrDefault := s.appNamespaceOrDefault(namespace)
 	return s.getAppEnforceRBAC(ctx, action, project, namespaceOrDefault, name, func() (*appv1.Application, error) {
 		return s.appLister.Applications(namespaceOrDefault).Get(name)
@@ -237,7 +242,7 @@ func (s *Server) getApplicationEnforceRBACInformer(ctx context.Context, action,
 // getApplicationEnforceRBACClient uses a client to get an Application. If the app does not exist, permission is denied,
 // or any other error occurs when getting the app, we return a permission denied error to obscure any sensitive
 // information.
-func (s *Server) getApplicationEnforceRBACClient(ctx context.Context, action, project, namespace, name, resourceVersion string) (*appv1.Application, error) {
+func (s *Server) getApplicationEnforceRBACClient(ctx context.Context, action, project, namespace, name, resourceVersion string) (*appv1.Application, *appv1.AppProject, error) {
 	namespaceOrDefault := s.appNamespaceOrDefault(namespace)
 	return s.getAppEnforceRBAC(ctx, action, project, namespaceOrDefault, name, func() (*appv1.Application, error) {
 		if !s.isNamespaceEnabled(namespaceOrDefault) {
@@ -321,7 +326,13 @@ func (s *Server) Create(ctx context.Context, q *application.ApplicationCreateReq
 	if q.Validate != nil {
 		validate = *q.Validate
 	}
-	err := s.validateAndNormalizeApp(ctx, a, validate)
+
+	proj, err := s.getAppProject(ctx, a, log.WithField("application", a.Name))
+	if err != nil {
+		return nil, err
+	}
+
+	err = s.validateAndNormalizeApp(ctx, a, proj, validate)
 	if err != nil {
 		return nil, fmt.Errorf("error while validating and normalizing app: %w", err)
 	}
@@ -377,7 +388,7 @@ func (s *Server) Create(ctx context.Context, q *application.ApplicationCreateReq
 	return updated, nil
 }
 
-func (s *Server) queryRepoServer(ctx context.Context, a *appv1.Application, action func(
+func (s *Server) queryRepoServer(ctx context.Context, proj *appv1.AppProject, action func(
 	client apiclient.RepoServerServiceClient,
 	helmRepos []*appv1.Repository,
 	helmCreds []*appv1.RepoCreds,
@@ -391,14 +402,6 @@ func (s *Server) queryRepoServer(ctx context.Context, a *appv1.Application, acti
 	}
 	defer ioutil.Close(closer)
 
-	proj, err := argo.GetAppProject(a, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		if apierr.IsNotFound(err) {
-			return status.Errorf(codes.InvalidArgument, "application references project %s which does not exist", a.Spec.Project)
-		}
-		return fmt.Errorf("error getting application's project: %w", err)
-	}
-
 	helmRepos, err := s.db.ListHelmRepositories(ctx)
 	if err != nil {
 		return fmt.Errorf("error listing helm repositories: %w", err)
@@ -432,7 +435,7 @@ func (s *Server) GetManifests(ctx context.Context, q *application.ApplicationMan
 	if q.Name == nil || *q.Name == "" {
 		return nil, fmt.Errorf("invalid request: application name is missing")
 	}
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
+	a, proj, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
 	if err != nil {
 		return nil, err
 	}
@@ -442,7 +445,7 @@ func (s *Server) GetManifests(ctx context.Context, q *application.ApplicationMan
 	}
 
 	manifestInfos := make([]*apiclient.ManifestResponse, 0)
-	err = s.queryRepoServer(ctx, a, func(
+	err = s.queryRepoServer(ctx, proj, func(
 		client apiclient.RepoServerServiceClient, helmRepos []*appv1.Repository, helmCreds []*appv1.RepoCreds, helmOptions *appv1.HelmOptions, enableGenerateManifests map[string]bool) error {
 
 		appInstanceLabelKey, err := s.settingsMgr.GetAppInstanceLabelKey()
@@ -465,20 +468,14 @@ func (s *Server) GetManifests(ctx context.Context, q *application.ApplicationMan
 			return fmt.Errorf("error getting API resources: %w", err)
 		}
 
-		proj, err := argo.GetAppProject(a, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-		if err != nil {
-			return fmt.Errorf("error getting app project: %w", err)
-		}
-
 		sources := make([]appv1.ApplicationSource, 0)
 		if a.Spec.HasMultipleSources() {
-			for i := range a.Spec.GetSources() {
-				source := a.Spec.GetSources()[i]
-				if q.GetRevisionSourceMappings() != nil && len(q.GetRevisionSourceMappings()) > 0 {
-					if val, ok := q.GetRevisionSourceMappings()[int64(i+1)]; ok {
-						source.TargetRevision = val
-						a.Spec.GetSources()[i] = source
-					}
+			numOfSources := int64(len(a.Spec.GetSources()))
+			for i, pos := range q.SourcePositions {
+				if pos <= numOfSources {
+					a.Spec.Sources[pos-1].TargetRevision = q.Revisions[i]
+				} else {
+					return fmt.Errorf("source position cannot be greater than number of sources in the application")
 				}
 			}
 			sources = a.Spec.GetSources()
@@ -582,13 +579,13 @@ func (s *Server) GetManifestsWithFiles(stream application.ApplicationService_Get
 		return fmt.Errorf("invalid request: application name is missing")
 	}
 
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, query.GetProject(), query.GetAppNamespace(), query.GetName())
+	a, proj, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, query.GetProject(), query.GetAppNamespace(), query.GetName())
 	if err != nil {
 		return err
 	}
 
 	var manifestInfo *apiclient.ManifestResponse
-	err = s.queryRepoServer(ctx, a, func(
+	err = s.queryRepoServer(ctx, proj, func(
 		client apiclient.RepoServerServiceClient, helmRepos []*appv1.Repository, helmCreds []*appv1.RepoCreds, helmOptions *appv1.HelmOptions, enableGenerateManifests map[string]bool) error {
 
 		appInstanceLabelKey, err := s.settingsMgr.GetAppInstanceLabelKey()
@@ -713,7 +710,7 @@ func (s *Server) Get(ctx context.Context, q *application.ApplicationQuery) (*app
 	// We must use a client Get instead of an informer Get, because it's common to call Get immediately
 	// following a Watch (which is not yet powered by an informer), and the Get must reflect what was
 	// previously seen by the client.
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, project, appNs, appName, q.GetResourceVersion())
+	a, proj, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, project, appNs, appName, q.GetResourceVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -744,7 +741,7 @@ func (s *Server) Get(ctx context.Context, q *application.ApplicationQuery) (*app
 
 	if refreshType == appv1.RefreshTypeHard {
 		// force refresh cached application details
-		if err := s.queryRepoServer(ctx, a, func(
+		if err := s.queryRepoServer(ctx, proj, func(
 			client apiclient.RepoServerServiceClient,
 			helmRepos []*appv1.Repository,
 			_ []*appv1.RepoCreds,
@@ -806,7 +803,7 @@ func (s *Server) Get(ctx context.Context, q *application.ApplicationQuery) (*app
 
 // ListResourceEvents returns a list of event resources
 func (s *Server) ListResourceEvents(ctx context.Context, q *application.ApplicationResourceEventsQuery) (*v1.EventList, error) {
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
+	a, _, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
 	if err != nil {
 		return nil, err
 	}
@@ -874,12 +871,12 @@ func (s *Server) validateAndUpdateApp(ctx context.Context, newApp *appv1.Applica
 	s.projectLock.RLock(newApp.Spec.GetProject())
 	defer s.projectLock.RUnlock(newApp.Spec.GetProject())
 
-	app, err := s.getApplicationEnforceRBACClient(ctx, action, currentProject, newApp.Namespace, newApp.Name, "")
+	app, proj, err := s.getApplicationEnforceRBACClient(ctx, action, currentProject, newApp.Namespace, newApp.Name, "")
 	if err != nil {
 		return nil, err
 	}
 
-	err = s.validateAndNormalizeApp(ctx, newApp, validate)
+	err = s.validateAndNormalizeApp(ctx, newApp, proj, validate)
 	if err != nil {
 		return nil, fmt.Errorf("error validating and normalizing app: %w", err)
 	}
@@ -978,7 +975,7 @@ func (s *Server) UpdateSpec(ctx context.Context, q *application.ApplicationUpdat
 	if q.GetSpec() == nil {
 		return nil, fmt.Errorf("error updating application spec: spec is nil in request")
 	}
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionUpdate, q.GetProject(), q.GetAppNamespace(), q.GetName(), "")
+	a, _, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionUpdate, q.GetProject(), q.GetAppNamespace(), q.GetName(), "")
 	if err != nil {
 		return nil, err
 	}
@@ -997,7 +994,7 @@ func (s *Server) UpdateSpec(ctx context.Context, q *application.ApplicationUpdat
 
 // Patch patches an application
 func (s *Server) Patch(ctx context.Context, q *application.ApplicationPatchRequest) (*appv1.Application, error) {
-	app, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName(), "")
+	app, _, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName(), "")
 	if err != nil {
 		return nil, err
 	}
@@ -1040,11 +1037,35 @@ func (s *Server) Patch(ctx context.Context, q *application.ApplicationPatchReque
 	return s.validateAndUpdateApp(ctx, newApp, false, true, rbacpolicy.ActionUpdate, q.GetProject())
 }
 
+func (s *Server) getAppProject(ctx context.Context, a *appv1.Application, logCtx *log.Entry) (*appv1.AppProject, error) {
+	proj, err := argo.GetAppProject(a, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
+	if err == nil {
+		return proj, nil
+	}
+
+	// If there's a permission issue or the app doesn't exist, return a vague error to avoid letting the user enumerate project names.
+	vagueError := status.Errorf(codes.InvalidArgument, "app is not allowed in project %q, or the project does not exist", a.Spec.Project)
+
+	if apierr.IsNotFound(err) {
+		return nil, vagueError
+	}
+
+	if _, ok := err.(*appv1.ErrApplicationNotAllowedToUseProject); ok {
+		logCtx.WithFields(map[string]interface{}{
+			"project":                a.Spec.Project,
+			argocommon.SecurityField: argocommon.SecurityMedium,
+		}).Warnf("error getting app project: %s", err)
+		return nil, vagueError
+	}
+
+	return nil, vagueError
+}
+
 // Delete removes an application and all associated resources
 func (s *Server) Delete(ctx context.Context, q *application.ApplicationDeleteRequest) (*application.ApplicationResponse, error) {
 	appName := q.GetName()
 	appNs := s.appNamespaceOrDefault(q.GetAppNamespace())
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, q.GetProject(), appNs, appName, "")
+	a, _, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, q.GetProject(), appNs, appName, "")
 	if err != nil {
 		return nil, err
 	}
@@ -1199,16 +1220,7 @@ func (s *Server) Watch(q *application.ApplicationQuery, ws application.Applicati
 	}
 }
 
-func (s *Server) validateAndNormalizeApp(ctx context.Context, app *appv1.Application, validate bool) error {
-	proj, err := argo.GetAppProject(app, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		if apierr.IsNotFound(err) {
-			// Offer no hint that the project does not exist.
-			log.Warnf("User attempted to create/update application in non-existent project %q", app.Spec.Project)
-			return permissionDeniedErr
-		}
-		return fmt.Errorf("error getting application's project: %w", err)
-	}
+func (s *Server) validateAndNormalizeApp(ctx context.Context, app *appv1.Application, proj *appv1.AppProject, validate bool) error {
 	if app.GetName() == "" {
 		return fmt.Errorf("resource name may not be empty")
 	}
@@ -1312,7 +1324,7 @@ func (s *Server) getAppResources(ctx context.Context, a *appv1.Application) (*ap
 }
 
 func (s *Server) getAppLiveResource(ctx context.Context, action string, q *application.ApplicationResourceRequest) (*appv1.ResourceNode, *rest.Config, *appv1.Application, error) {
-	a, err := s.getApplicationEnforceRBACInformer(ctx, action, q.GetProject(), q.GetAppNamespace(), q.GetName())
+	a, _, err := s.getApplicationEnforceRBACInformer(ctx, action, q.GetProject(), q.GetAppNamespace(), q.GetName())
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -1449,7 +1461,7 @@ func (s *Server) DeleteResource(ctx context.Context, q *application.ApplicationR
 }
 
 func (s *Server) ResourceTree(ctx context.Context, q *application.ResourcesQuery) (*appv1.ApplicationTree, error) {
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetApplicationName())
+	a, _, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetApplicationName())
 	if err != nil {
 		return nil, err
 	}
@@ -1458,7 +1470,7 @@ func (s *Server) ResourceTree(ctx context.Context, q *application.ResourcesQuery
 }
 
 func (s *Server) WatchResourceTree(q *application.ResourcesQuery, ws application.ApplicationService_WatchResourceTreeServer) error {
-	_, err := s.getApplicationEnforceRBACInformer(ws.Context(), rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetApplicationName())
+	_, _, err := s.getApplicationEnforceRBACInformer(ws.Context(), rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetApplicationName())
 	if err != nil {
 		return err
 	}
@@ -1475,7 +1487,7 @@ func (s *Server) WatchResourceTree(q *application.ResourcesQuery, ws application
 }
 
 func (s *Server) RevisionMetadata(ctx context.Context, q *application.RevisionMetadataQuery) (*appv1.RevisionMetadata, error) {
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
+	a, proj, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
 	if err != nil {
 		return nil, err
 	}
@@ -1485,12 +1497,6 @@ func (s *Server) RevisionMetadata(ctx context.Context, q *application.RevisionMe
 	if err != nil {
 		return nil, fmt.Errorf("error getting repository by URL: %w", err)
 	}
-	// We need to get some information with the project associated to the app,
-	// so we'll know whether GPG signatures are enforced.
-	proj, err := argo.GetAppProject(a, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error getting app project: %w", err)
-	}
 	conn, repoClient, err := s.repoClientset.NewRepoServerClient()
 	if err != nil {
 		return nil, fmt.Errorf("error creating repo server client: %w", err)
@@ -1505,7 +1511,7 @@ func (s *Server) RevisionMetadata(ctx context.Context, q *application.RevisionMe
 
 // RevisionChartDetails returns the helm chart metadata, as fetched from the reposerver
 func (s *Server) RevisionChartDetails(ctx context.Context, q *application.RevisionMetadataQuery) (*appv1.ChartDetails, error) {
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
+	a, _, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
 	if err != nil {
 		return nil, err
 	}
@@ -1536,7 +1542,7 @@ func isMatchingResource(q *application.ResourcesQuery, key kube.ResourceKey) boo
 }
 
 func (s *Server) ManagedResources(ctx context.Context, q *application.ResourcesQuery) (*application.ManagedResourcesResponse, error) {
-	a, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetApplicationName())
+	a, _, err := s.getApplicationEnforceRBACInformer(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetApplicationName())
 	if err != nil {
 		return nil, err
 	}
@@ -1593,7 +1599,7 @@ func (s *Server) PodLogs(q *application.ApplicationPodLogsQuery, ws application.
 		}
 	}
 
-	a, err := s.getApplicationEnforceRBACInformer(ws.Context(), rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
+	a, _, err := s.getApplicationEnforceRBACInformer(ws.Context(), rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName())
 	if err != nil {
 		return err
 	}
@@ -1790,19 +1796,11 @@ func isTheSelectedOne(currentNode *appv1.ResourceNode, q *application.Applicatio
 
 // Sync syncs an application to its target state
 func (s *Server) Sync(ctx context.Context, syncReq *application.ApplicationSyncRequest) (*appv1.Application, error) {
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, syncReq.GetProject(), syncReq.GetAppNamespace(), syncReq.GetName(), "")
+	a, proj, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, syncReq.GetProject(), syncReq.GetAppNamespace(), syncReq.GetName(), "")
 	if err != nil {
 		return nil, err
 	}
 
-	proj, err := argo.GetAppProject(a, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		if apierr.IsNotFound(err) {
-			return a, status.Errorf(codes.InvalidArgument, "application references project %s which does not exist", a.Spec.Project)
-		}
-		return a, fmt.Errorf("error getting app project: %w", err)
-	}
-
 	s.inferResourcesStatusHealth(a)
 
 	if !proj.Spec.SyncWindows.Matches(a).CanSync(true) {
@@ -1899,7 +1897,7 @@ func (s *Server) Sync(ctx context.Context, syncReq *application.ApplicationSyncR
 }
 
 func (s *Server) Rollback(ctx context.Context, rollbackReq *application.ApplicationRollbackRequest) (*appv1.Application, error) {
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionSync, rollbackReq.GetProject(), rollbackReq.GetAppNamespace(), rollbackReq.GetName(), "")
+	a, _, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionSync, rollbackReq.GetProject(), rollbackReq.GetAppNamespace(), rollbackReq.GetName(), "")
 	if err != nil {
 		return nil, err
 	}
@@ -1958,7 +1956,7 @@ func (s *Server) Rollback(ctx context.Context, rollbackReq *application.Applicat
 }
 
 func (s *Server) ListLinks(ctx context.Context, req *application.ListAppLinksRequest) (*application.LinksResponse, error) {
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, req.GetProject(), req.GetNamespace(), req.GetName(), "")
+	a, proj, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, req.GetProject(), req.GetNamespace(), req.GetName(), "")
 	if err != nil {
 		return nil, err
 	}
@@ -1973,7 +1971,7 @@ func (s *Server) ListLinks(ctx context.Context, req *application.ListAppLinksReq
 		return nil, fmt.Errorf("failed to read application deep links from configmap: %w", err)
 	}
 
-	clstObj, _, err := s.getObjectsForDeepLinks(ctx, a)
+	clstObj, _, err := s.getObjectsForDeepLinks(ctx, a, proj)
 	if err != nil {
 		return nil, err
 	}
@@ -1988,12 +1986,7 @@ func (s *Server) ListLinks(ctx context.Context, req *application.ListAppLinksReq
 	return finalList, nil
 }
 
-func (s *Server) getObjectsForDeepLinks(ctx context.Context, app *appv1.Application) (cluster *unstructured.Unstructured, project *unstructured.Unstructured, err error) {
-	proj, err := argo.GetAppProject(app, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		return nil, nil, fmt.Errorf("error getting app project: %w", err)
-	}
-
+func (s *Server) getObjectsForDeepLinks(ctx context.Context, app *appv1.Application, proj *appv1.AppProject) (cluster *unstructured.Unstructured, project *unstructured.Unstructured, err error) {
 	// sanitize project jwt tokens
 	proj.Status = appv1.AppProjectStatus{}
 
@@ -2056,7 +2049,12 @@ func (s *Server) ListResourceLinks(ctx context.Context, req *application.Applica
 		return nil, err
 	}
 
-	clstObj, projObj, err := s.getObjectsForDeepLinks(ctx, app)
+	proj, err := s.getAppProject(ctx, app, log.WithField("application", app.GetName()))
+	if err != nil {
+		return nil, err
+	}
+
+	clstObj, projObj, err := s.getObjectsForDeepLinks(ctx, app, proj)
 	if err != nil {
 		return nil, err
 	}
@@ -2112,7 +2110,7 @@ func (s *Server) resolveRevision(ctx context.Context, app *appv1.Application, sy
 func (s *Server) TerminateOperation(ctx context.Context, termOpReq *application.OperationTerminateRequest) (*application.OperationTerminateResponse, error) {
 	appName := termOpReq.GetName()
 	appNs := s.appNamespaceOrDefault(termOpReq.GetAppNamespace())
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionSync, termOpReq.GetProject(), appNs, appName, "")
+	a, _, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionSync, termOpReq.GetProject(), appNs, appName, "")
 	if err != nil {
 		return nil, err
 	}
@@ -2185,7 +2183,7 @@ func (s *Server) ListResourceActions(ctx context.Context, q *application.Applica
 
 func (s *Server) getUnstructuredLiveResourceOrApp(ctx context.Context, rbacRequest string, q *application.ApplicationResourceRequest) (obj *unstructured.Unstructured, res *appv1.ResourceNode, app *appv1.Application, config *rest.Config, err error) {
 	if q.GetKind() == applicationType.ApplicationKind && q.GetGroup() == applicationType.Group && q.GetName() == q.GetResourceName() {
-		app, err = s.getApplicationEnforceRBACInformer(ctx, rbacRequest, q.GetProject(), q.GetAppNamespace(), q.GetName())
+		app, _, err = s.getApplicationEnforceRBACInformer(ctx, rbacRequest, q.GetProject(), q.GetAppNamespace(), q.GetName())
 		if err != nil {
 			return nil, nil, nil, nil, err
 		}
@@ -2281,6 +2279,11 @@ func (s *Server) RunResourceAction(ctx context.Context, q *application.ResourceA
 		}
 	}
 
+	proj, err := s.getAppProject(ctx, a, log.WithField("application", a.Name))
+	if err != nil {
+		return nil, err
+	}
+
 	// First, make sure all the returned resources are permitted, for each operation.
 	// Also perform create with dry-runs for all create-operation resources.
 	// This is performed separately to reduce the risk of only some of the resources being successfully created later.
@@ -2288,7 +2291,7 @@ func (s *Server) RunResourceAction(ctx context.Context, q *application.ResourceA
 	// the dry-run for relevant apply/delete operation would have to be invoked as well.
 	for _, impactedResource := range newObjects {
 		newObj := impactedResource.UnstructuredObj
-		err := s.verifyResourcePermitted(ctx, app, newObj)
+		err := s.verifyResourcePermitted(ctx, app, proj, newObj)
 		if err != nil {
 			return nil, err
 		}
@@ -2382,14 +2385,7 @@ func (s *Server) patchResource(ctx context.Context, config *rest.Config, liveObj
 	return &application.ApplicationResponse{}, nil
 }
 
-func (s *Server) verifyResourcePermitted(ctx context.Context, app *appv1.Application, obj *unstructured.Unstructured) error {
-	proj, err := argo.GetAppProject(app, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		if apierr.IsNotFound(err) {
-			return fmt.Errorf("application references project %s which does not exist", app.Spec.Project)
-		}
-		return fmt.Errorf("failed to get project %s: %w", app.Spec.Project, err)
-	}
+func (s *Server) verifyResourcePermitted(ctx context.Context, app *appv1.Application, proj *appv1.AppProject, obj *unstructured.Unstructured) error {
 	permitted, err := proj.IsResourcePermitted(schema.GroupKind{Group: obj.GroupVersionKind().Group, Kind: obj.GroupVersionKind().Kind}, obj.GetNamespace(), app.Spec.Destination, func(project string) ([]*appv1.Cluster, error) {
 		clusters, err := s.db.GetProjectClusters(context.TODO(), project)
 		if err != nil {
@@ -2449,16 +2445,11 @@ func splitStatusPatch(patch []byte) ([]byte, []byte, error) {
 }
 
 func (s *Server) GetApplicationSyncWindows(ctx context.Context, q *application.ApplicationSyncWindowsQuery) (*application.ApplicationSyncWindowsResponse, error) {
-	a, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName(), "")
+	a, proj, err := s.getApplicationEnforceRBACClient(ctx, rbacpolicy.ActionGet, q.GetProject(), q.GetAppNamespace(), q.GetName(), "")
 	if err != nil {
 		return nil, err
 	}
 
-	proj, err := argo.GetAppProject(a, applisters.NewAppProjectLister(s.projInformer.GetIndexer()), s.ns, s.settingsMgr, s.db, ctx)
-	if err != nil {
-		return nil, fmt.Errorf("error getting app project: %w", err)
-	}
-
 	windows := proj.Spec.SyncWindows.Matches(a)
 	sync := windows.CanSync(true)
 

server/application/application.proto

@@ -69,7 +69,8 @@ message ApplicationManifestQuery {
 	optional string revision = 2;
 	optional string appNamespace = 3;
 	optional string project = 4;
-	map<int64, string> revisionSourceMappings = 5;
+	repeated int64 sourcePositions = 5;
+	repeated string revisions = 6;
 }
 
 message FileChunk {

server/application/application_test.go

@@ -1819,7 +1819,7 @@ func TestServer_GetApplicationSyncWindowsState(t *testing.T) {
 		appServer := newTestAppServer(t, testApp)
 
 		active, err := appServer.GetApplicationSyncWindows(context.Background(), &application.ApplicationSyncWindowsQuery{Name: &testApp.Name})
-		assert.Contains(t, err.Error(), "not found")
+		assert.Contains(t, err.Error(), "not exist")
 		assert.Nil(t, active)
 	})
 }
@@ -2531,7 +2531,16 @@ func TestAppNamespaceRestrictions(t *testing.T) {
 	t.Run("Get application in other namespace when allowed", func(t *testing.T) {
 		testApp := newTestApp()
 		testApp.Namespace = "argocd-1"
-		appServer := newTestAppServer(t, testApp)
+		testApp.Spec.Project = "other-ns"
+		otherNsProj := &appsv1.AppProject{
+			ObjectMeta: metav1.ObjectMeta{Name: "other-ns", Namespace: "default"},
+			Spec: appsv1.AppProjectSpec{
+				SourceRepos:      []string{"*"},
+				Destinations:     []appsv1.ApplicationDestination{{Server: "*", Namespace: "*"}},
+				SourceNamespaces: []string{"argocd-1"},
+			},
+		}
+		appServer := newTestAppServer(t, testApp, otherNsProj)
 		appServer.enabledNamespaces = []string{"argocd-1"}
 		app, err := appServer.Get(context.TODO(), &application.ApplicationQuery{
 			Name:         pointer.String("test-app"),
@@ -2542,6 +2551,28 @@ func TestAppNamespaceRestrictions(t *testing.T) {
 		require.Equal(t, "argocd-1", app.Namespace)
 		require.Equal(t, "test-app", app.Name)
 	})
+	t.Run("Get application in other namespace when project is not allowed", func(t *testing.T) {
+		testApp := newTestApp()
+		testApp.Namespace = "argocd-1"
+		testApp.Spec.Project = "other-ns"
+		otherNsProj := &appsv1.AppProject{
+			ObjectMeta: metav1.ObjectMeta{Name: "other-ns", Namespace: "default"},
+			Spec: appsv1.AppProjectSpec{
+				SourceRepos:      []string{"*"},
+				Destinations:     []appsv1.ApplicationDestination{{Server: "*", Namespace: "*"}},
+				SourceNamespaces: []string{"argocd-2"},
+			},
+		}
+		appServer := newTestAppServer(t, testApp, otherNsProj)
+		appServer.enabledNamespaces = []string{"argocd-1"}
+		app, err := appServer.Get(context.TODO(), &application.ApplicationQuery{
+			Name:         pointer.String("test-app"),
+			AppNamespace: pointer.String("argocd-1"),
+		})
+		require.Error(t, err)
+		require.Nil(t, app)
+		require.ErrorContains(t, err, "app is not allowed in project")
+	})
 	t.Run("Create application in other namespace when allowed", func(t *testing.T) {
 		testApp := newTestApp()
 		testApp.Namespace = "argocd-1"
@@ -2584,7 +2615,7 @@ func TestAppNamespaceRestrictions(t *testing.T) {
 		})
 		require.Error(t, err)
 		require.Nil(t, app)
-		require.ErrorContains(t, err, "not allowed to use project")
+		require.ErrorContains(t, err, "app is not allowed in project")
 	})
 
 	t.Run("Create application in other namespace when not allowed by configuration", func(t *testing.T) {
@@ -2608,5 +2639,84 @@ func TestAppNamespaceRestrictions(t *testing.T) {
 		require.Nil(t, app)
 		require.ErrorContains(t, err, "namespace 'argocd-1' is not permitted")
 	})
-
+	t.Run("Get application sync window in other namespace when project is allowed", func(t *testing.T) {
+		testApp := newTestApp()
+		testApp.Namespace = "argocd-1"
+		testApp.Spec.Project = "other-ns"
+		otherNsProj := &appsv1.AppProject{
+			ObjectMeta: metav1.ObjectMeta{Name: "other-ns", Namespace: "default"},
+			Spec: appsv1.AppProjectSpec{
+				SourceRepos:      []string{"*"},
+				Destinations:     []appsv1.ApplicationDestination{{Server: "*", Namespace: "*"}},
+				SourceNamespaces: []string{"argocd-1"},
+			},
+		}
+		appServer := newTestAppServer(t, testApp, otherNsProj)
+		appServer.enabledNamespaces = []string{"argocd-1"}
+		active, err := appServer.GetApplicationSyncWindows(context.TODO(), &application.ApplicationSyncWindowsQuery{Name: &testApp.Name, AppNamespace: &testApp.Namespace})
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(active.ActiveWindows))
+	})
+	t.Run("Get application sync window in other namespace when project is not allowed", func(t *testing.T) {
+		testApp := newTestApp()
+		testApp.Namespace = "argocd-1"
+		testApp.Spec.Project = "other-ns"
+		otherNsProj := &appsv1.AppProject{
+			ObjectMeta: metav1.ObjectMeta{Name: "other-ns", Namespace: "default"},
+			Spec: appsv1.AppProjectSpec{
+				SourceRepos:      []string{"*"},
+				Destinations:     []appsv1.ApplicationDestination{{Server: "*", Namespace: "*"}},
+				SourceNamespaces: []string{"argocd-2"},
+			},
+		}
+		appServer := newTestAppServer(t, testApp, otherNsProj)
+		appServer.enabledNamespaces = []string{"argocd-1"}
+		active, err := appServer.GetApplicationSyncWindows(context.TODO(), &application.ApplicationSyncWindowsQuery{Name: &testApp.Name, AppNamespace: &testApp.Namespace})
+		require.Error(t, err)
+		require.Nil(t, active)
+		require.ErrorContains(t, err, "app is not allowed in project")
+	})
+	t.Run("Get list of links in other namespace when project is not allowed", func(t *testing.T) {
+		testApp := newTestApp()
+		testApp.Namespace = "argocd-1"
+		testApp.Spec.Project = "other-ns"
+		otherNsProj := &appsv1.AppProject{
+			ObjectMeta: metav1.ObjectMeta{Name: "other-ns", Namespace: "default"},
+			Spec: appsv1.AppProjectSpec{
+				SourceRepos:      []string{"*"},
+				Destinations:     []appsv1.ApplicationDestination{{Server: "*", Namespace: "*"}},
+				SourceNamespaces: []string{"argocd-2"},
+			},
+		}
+		appServer := newTestAppServer(t, testApp, otherNsProj)
+		appServer.enabledNamespaces = []string{"argocd-1"}
+		links, err := appServer.ListLinks(context.TODO(), &application.ListAppLinksRequest{
+			Name:      pointer.String("test-app"),
+			Namespace: pointer.String("argocd-1"),
+		})
+		require.Error(t, err)
+		require.Nil(t, links)
+		require.ErrorContains(t, err, "app is not allowed in project")
+	})
+	t.Run("Get list of links in other namespace when project is allowed", func(t *testing.T) {
+		testApp := newTestApp()
+		testApp.Namespace = "argocd-1"
+		testApp.Spec.Project = "other-ns"
+		otherNsProj := &appsv1.AppProject{
+			ObjectMeta: metav1.ObjectMeta{Name: "other-ns", Namespace: "default"},
+			Spec: appsv1.AppProjectSpec{
+				SourceRepos:      []string{"*"},
+				Destinations:     []appsv1.ApplicationDestination{{Server: "*", Namespace: "*"}},
+				SourceNamespaces: []string{"argocd-1"},
+			},
+		}
+		appServer := newTestAppServer(t, testApp, otherNsProj)
+		appServer.enabledNamespaces = []string{"argocd-1"}
+		links, err := appServer.ListLinks(context.TODO(), &application.ListAppLinksRequest{
+			Name:      pointer.String("test-app"),
+			Namespace: pointer.String("argocd-1"),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, 0, len(links.Items))
+	})
 }

test/e2e/app_management_ns_test.go

@@ -432,7 +432,7 @@ func TestNamespacedInvalidAppProject(t *testing.T) {
 		Then().
 		// We're not allowed to infer whether the project exists based on this error message. Instead, we get a generic
 		// permission denied error.
-		Expect(Error("", "permission denied"))
+		Expect(Error("", "is not allowed"))
 }
 
 func TestNamespacedAppDeletion(t *testing.T) {

test/e2e/app_management_test.go

@@ -547,7 +547,7 @@ func TestInvalidAppProject(t *testing.T) {
 		Then().
 		// We're not allowed to infer whether the project exists based on this error message. Instead, we get a generic
 		// permission denied error.
-		Expect(Error("", "permission denied"))
+		Expect(Error("", "is not allowed"))
 }
 
 func TestAppDeletion(t *testing.T) {

test/e2e/declarative_test.go

@@ -54,12 +54,14 @@ func TestDeclarativeInvalidProject(t *testing.T) {
 		Expect(Success("")).
 		Expect(HealthIs(health.HealthStatusUnknown)).
 		Expect(SyncStatusIs(SyncStatusCodeUnknown)).
-		Expect(Condition(ApplicationConditionInvalidSpecError, "Application referencing project garbage which does not exist")).
-		When().
-		Delete(false).
-		Then().
-		Expect(Success("")).
-		Expect(DoesNotExist())
+		Expect(Condition(ApplicationConditionInvalidSpecError, "Application referencing project garbage which does not exist"))
+	// TODO: you can`t delete application with invalid project due to enforcment that was recently added,
+	// in https://github.com/argoproj/argo-cd/security/advisories/GHSA-2gvw-w6fj-7m3c
+	//When().
+	//Delete(false).
+	//Then().
+	//Expect(Success("")).
+	//Expect(DoesNotExist())
 }
 
 func TestDeclarativeInvalidRepoURL(t *testing.T) {

util/argo/argo.go

@@ -700,8 +700,7 @@ func GetAppProject(app *argoappv1.Application, projLister applicationsv1.AppProj
 		return nil, err
 	}
 	if !proj.IsAppNamespacePermitted(app, ns) {
-		return nil, fmt.Errorf("application '%s' in namespace '%s' is not allowed to use project '%s'",
-			app.Name, app.Namespace, proj.Name)
+		return nil, argoappv1.NewErrApplicationNotAllowedToUseProject(app.Name, app.Namespace, proj.Name)
 	}
 	return proj, nil
 }