uprobe digest partial load by andrewstrohman · Pull Request #5301 · cilium/tetragon

andrewstrohman · 2026-07-17T21:28:55Z

This is the final PR of a series of PRs that implement uprobe binary digest verification. See this parent PR for the list of related PRs and the initial feedback I received before breaking that large parent PR into a series of smaller children PRs.

The core uprobe binary digest validation logic in now in the main branch. The current behavior is to reject a policy in its entirety if any uprobes within the policy fail digest verification. This PR changes that behavior such that we salvage the uprobes that don't fail verification, and therefore partially load the policy. If all the hooks fail digest verification, the policy will still be considered loaded, even though none of its hooks were attached to.

Since a policy can be partially loaded for the first time, we need a way to communicate which hooks were attached to and which hooks we did not attach to (due to digest verification failure). This PR extends our API's TracingPolicyStatus to expose each hook's status. Initially, the hook status will only be exposed for uprobe and kprobe policies, because these are the only type of policies that can currently have partial loads. We can use this framework to expose other policy type's hook status if/when they need the ability to do partial loading.

Since our API now exposes the hook status, this PR extends the tetra tracingpolicy list command by interleaving the hook status within its pre-existing output when a policy is found to be partially loaded.

The following policy and command output demonstrates how this works.

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "uprobe-digest-example"
spec:
  uprobes:
    - path: "/home/andy/src/sleep"
      symbols:
      - "main"
      binaryDigests:
        - "sha256:1111111111111111111111111111111111111111111111111111111111111111"
        - "sha256:2222222222222222222222222222222222222222222222222222222222222222"
      ignore:
        digestVerificationFailure: true
    - path: "/home/andy/src/sleep"
      symbols:
      - "main"
      binaryDigests:
        - "sha256:2222222222222222222222222222222222222222222222222222222222222222"
        - "sha256:8bc8c492483d324eecd6a3630e61f43524da590e3cafeb298e43f5d0d63f6814"
    - path: "/home/andy/src/my_program"
      symbols:
      - "main"
      binaryDigests:
        - "sha256:77603eb0809fb6b95c69d79772943a11f18ad22cbd5d0c2efc50171760ff98e4"
        - "sha256:2222222222222222222222222222222222222222222222222222222222222222"

andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy add ~/uprobe-digest-mismatch.yaml
tracing policy "/home/andy/uprobe-digest-mismatch.yaml" added
andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy list
ID   NAME                    DOMAIN   STATE               FILTERID   NAMESPACE   SENSORS          KERNELMEMORY   MODE           NPOST   NENFORCE   NMONITOR
2    uprobe-digest-example   grpc     partially_enabled   0          (global)    generic_uprobe   380.79 kB      monitor_only   0       0          0
     SECTION   CFGIDX   DESCRIPTION                 STATUS
     uprobes   0        /home/andy/src/sleep        digest_rejected
     uprobes   1        /home/andy/src/sleep        loaded
     uprobes   2        /home/andy/src/my_program   loaded

Tetragon also logs which hooks failed verification when the policy is loaded:

level=info msg="spec.uprobes[0]: digest verification failed for path \"/home/andy/src/sleep\""

netlify · 2026-07-17T21:29:19Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`b1d12be`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/6a67a540b6991d000861b99d
😎 Deploy Preview	https://deploy-preview-5301--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

FedeDP

So, i am bit confused: which is the final state for an uprobe sensor with all its hook in HookState_STATUS_DIGEST_REJECTED state?
Would it be TP_STATE_ENABLED?

My proposal is to add a new state PARTIALLY_ENABLED and:

all hooks loaded -> TP_STATE_ENABLED
some hooks loaded -> TP_STATE_PARTIALLY_ENABLED
no hooks loaded -> TP_STATE_LOAD_ERROR

FedeDP · 2026-07-20T08:11:48Z

 		for _, sens := range col.sensors {
 			pol.Sensors = append(pol.Sensors, sens.GetName())
 			pol.KernelMemoryBytes += uint64(sens.TotalMemlock())
+			sens.SetStatus(&pol)


I am wondering whether exposing a Status() API would fit better with other already exposed methods; then let handler.go do the append.
Eg, if you look at other 2 fields in this for loop, we are doing that.

Thanks, yes, that's better. This approach also helped with you other suggestion, TP_STATE_PARTIALLY_ENABLED.

andrewstrohman · 2026-07-20T21:17:29Z

So, i am bit confused: which is the final state for an uprobe sensor with all its hook in HookState_STATUS_DIGEST_REJECTED state? Would it be TP_STATE_ENABLED?

Yes, TP_STATE_ENABLED is the final state in this scenario.

My proposal is to add a new state PARTIALLY_ENABLED and:

all hooks loaded -> TP_STATE_ENABLED

some hooks loaded -> TP_STATE_PARTIALLY_ENABLED

no hooks loaded -> TP_STATE_LOAD_ERROR

I added TP_STATE_PARTIALLY_ENABLED for "some hooks loaded". But, I did not do "no hooks loaded -> TP_STATE_LOAD_ERROR"

Since I am headed towards doing an ignore approach, like what is done here, this situation does not feel like an error to me, because the policy will be rejected unless the user specified that it's OK to ignore all the hooks. Please let me know if you still think that we should set that state of the policy to TP_STATE_LOAD_ERROR when no hook are attached.

FedeDP · 2026-07-21T07:20:53Z

Since I am headed towards doing an ignore approach, like what is done #3825, this situation does not feel like an error to me, because the policy will be rejected unless the user specified that it's OK to ignore all the hooks. Please let me know if you still think that we should set that state of the policy to TP_STATE_LOAD_ERROR when no hook are attached.

In this scenario, i agree with you since it's the user telling us what to do :)
Thank you so much!

FedeDP · 2026-07-21T07:41:50Z

The only thing i am not sure of is:

an uprobe with ignore.digestVerificationFailure: true would result in a state TracingPolicyState_TP_STATE_PARTIALLY_ENABLED when at least an hook gets rejected
a kprobe with ignore.callNotFound: true gets set to TracingPolicyState_TP_STATE_ENABLED in any case, even when some of its hooks were not found

Do we want to unify the behavior? (Just a discussion, it can be done in subsequent PR of course since it is tangent to this PR)

olsajiri

I can't really say the HookState is the best way to carry this info, but the ignore part makes sense to me, left one comment, thanks

olsajiri · 2026-07-21T08:52:09Z

 			}
 		}

+		hook_status := &tetragon.HookStatus{


we don't use _ in variable name

Thanks for pointing this out. I've fixed it.

FedeDP

Patch LGTM aside the concern expressed in #5301 (comment) that IMO is not meant to be fixed in this PR.
Thank you very much!

andrewstrohman · 2026-07-21T19:35:56Z

I can't really say the HookState is the best way to carry this info

How can I improve it? Are you saying that you don't like the structure of the schema that was added to the API, or that we should use a separate, internal-only data structure during sensor construction, and then translate that to HookState only for the API?

andrewstrohman · 2026-07-21T23:13:36Z

Here is what kprobes look like after unifying:

The policy:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "pizza-and-bpf"
spec:
  kprobes:
  - call: "pizza_is_the_best"
    syscall: false
    ignore:
      callNotFound: true
  - call: "sys_bpf"
    syscall: true

andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy add ~/kprobe-call-not-found.yaml
tracing policy "/home/andy/kprobe-call-not-found.yaml" added
andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy list
ID   NAME            DOMAIN   STATE               FILTERID   NAMESPACE   SENSORS          KERNELMEMORY   MODE           NPOST   NENFORCE   NMONITOR
2    pizza-and-bpf   grpc     partially_enabled   0          (global)    generic_kprobe   506.32 kB      monitor_only   9       0          0
andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy list --hook-status
ID   NAME            DOMAIN   SECTION   CFGIDX   DESCRIPTION         STATUS
2    pizza-and-bpf   grpc     kprobes   0        pizza_is_the_best   call_not_found
                              kprobes   1        sys_bpf             loaded

FedeDP · 2026-07-22T07:00:41Z

So, i now want a 🍕 😆

Here is what kprobes look like after unifying:

I think it looks great, actually; this is what i had in mind. Thanks for doing that.

This PR's proposed status schema is not expressive enough to communicate which call(s) in the list were ignored. I'm hesitant to introduce another layer/level of status to expose this until we find that users need this level of detail

I agree with you, better not invest too much effort on this until we know there is a real use case for it.

kkourt

LGTM, thanks!

kkourt · 2026-07-22T14:41:54Z

+			hookStatus.State = tetragon.HookState_STATUS_DIGEST_REJECTED
+			logger.GetLogger().Info(
+				fmt.Sprintf("spec.uprobes[%d]: %s", cfgIdx, mismatchErr.Error()),
+			)


Should this be a Debug? Not sure if it's an error condition or not.

I'd like to keep this as Info. When I spoke with users about what they'd like to see when a partial load occurs, they said they want to see that it happened in tetragon's logs. IMHO, I think having this in the log would help us debug as well.

Logging at info level is consistent with how ignored kprobes are handled:

tetragon/pkg/sensors/tracing/generickprobe.go

Line 420 in 8d10f87

log.Info("kprobe call ignored because it was not found", "idx", idx, "call", call)

OK, let's keep it.

kkourt · 2026-07-22T14:42:45Z

-	} else {
-		progs, maps, err = createSingleUprobeSensor(polInfo, ids, has)
-	}
+	if len(ids) != 0 {


Just curious, is this check in case all hooks were skipped?

Yes, this for when all hooks are skipped. I'm trying to avoid loading programs/maps in this case. Without this condition, this happens:

level=warn msg="Server AddTracingPolicy request failed" error="sensor generic_uprobe from collection uprobe-digest-empty failed to load: tetragon, aborting could not load sensor BPF maps: failed to load map 'config_map' for sensor 'generic_uprobe': failed to create map 'config_map': creating map: map create: invalid argument (MaxEntries may be incorrectly set to zero)" metadata.namespace="" metadata.name=uprobe-digest-empty

So instead of make that code cope, I opted to prevent it from running, because loading those program/maps is of no use.

This ties into a discussion about whether a policy should be considered TP_STATE_LOAD_ERROR when all of the hooks are ignored. Folks that advocated for TP_STATE_LOAD_ERROR previously, seem to be OK with TP_STATE_PARTIALLY_ENABLED now, because the user is signaling intent with their ignore configurations.

I wanted to create the empty sensor because that's the way that I communicate which hooks were attached (none in this case). But the consequence of this is that I needed to add and check additional state for the sensor in order to prevent spurious error logs. See the last commit of this series for what that entails. It's also worth noting that I changed kprobes to do this too, for the same reason.

mtardy

Docs lgtm, just a few questionns on the STATUS_PARTIAL_CALL_NOT_FOUND = 4; that I might misunderstand.

mtardy · 2026-07-27T09:59:20Z

+	}
+}
+
+func (c *collection) getEnabledState() TracingPolicyState {


maybe I would put a name a bit more explicit that states it could return partially enabled in some situations.

I've change this to getEnabledStateType(). If you can think of a better name, please suggest it, and I'll change it.

mtardy · 2026-07-27T10:17:05Z

+func PrintTracingPolicies(output io.Writer, policies []*tetragon.TracingPolicyStatus, hookStatus bool, skipPolicy func(pol *tetragon.TracingPolicyStatus) bool) {
 	// tabwriter config imitates kubectl default output, i.e. 3 spaces padding
 	w := tabwriter.NewWriter(output, 0, 0, 3, ' ', 0)
 	header := "ID\tNAME\tDOMAIN\tSTATE\tFILTERID\tNAMESPACE\tSENSORS\tKERNELMEMORY\tMODE\tNPOST\tNENFORCE\tNMONITOR"
+	if hookStatus {
+		header = "ID\tNAME\tDOMAIN\tSECTION\tCFGIDX\tDESCRIPTION\tSTATUS"
+	}


Could we do better and instead of having the manual --hook-status print the hook status when you hit a partially enabled TP?

Like for a partially enabled TP you maybe inline this new tab print at indentation +1? I wonder if it's too complicated or just doable with tabwriter.

andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy list ID NAME DOMAIN STATE FILTERID NAMESPACE SENSORS KERNELMEMORY MODE NPOST NENFORCE NMONITOR 2 uprobe-digest-example grpc partially_enabled 0 (global) generic_uprobe 380.79 kB monitor_only 0 0 0 SECTION CFGIDX DESCRIPTION STATUS uprobes 0 /home/andy/src/sleep digest_rejected uprobes 1 /home/andy/src/sleep loaded uprobes 2 /home/andy/src/my_program loade 3 uprobe-othero-example grpc enabled 1 (global) generic_uprobe 380.79 kB monitor_only 0 0 0

Ok, I was able to do this by using multiple tabwriters, and manually interleaving the hook status:

andy@builder:~/src/tetragon$ sudo ./tetra tracingpolicy list ID NAME DOMAIN STATE FILTERID NAMESPACE SENSORS KERNELMEMORY MODE NPOST NENFORCE NMONITOR 2 uprobe-digest-example grpc partially_enabled 0 (global) generic_uprobe 380.79 kB monitor_only 0 0 0 SECTION CFGIDX DESCRIPTION STATUS uprobes 0 /home/andy/src/sleep digest_rejected uprobes 1 /home/andy/src/sleep loaded uprobes 2 /home/andy/src/my_program loaded 3 pizza-and-bpf grpc partially_enabled 0 (global) generic_kprobe 0 B unknown 0 0 0 SECTION CFGIDX DESCRIPTION STATUS kprobes 0 pizza_is_the_best call_not_found 4 uprobe-selectors grpc enabled 0 (global) generic_uprobe 380.79 kB monitor_only 0 0 0

While I don't think this is a problem, note how the pizza-and-bpf policy has different hook status column widths compared to the uprobe-digest-example hook status.

mtardy · 2026-07-27T10:18:57Z

+  // probe was partially loaded due to call not found
+  STATUS_PARTIAL_CALL_NOT_FOUND = 4;


I don't think this enum entry belongs here but on the upper TP status?

This is intentional. When a kprobe's hook's call config specifies a list, the hook itself can be partially loaded. This is related to your other comment as well: #5301 (comment)

mtardy · 2026-07-27T10:20:53Z

+		if valInfo[i].ignoredCount == 0 {
+			hookStatus.State = tetragon.HookState_STATUS_LOADED
+		} else {
+			hookStatus.State = tetragon.HookState_STATUS_PARTIAL_CALL_NOT_FOUND
+		}


I'm not following why it's not applied on the TP status not hookStatus

There is some disussion/explanation about this in this comment.

When a kprobe hook specifies a list for call:, then multiple kprobes are generated, one for each function in the list. Some of those functions may not be found while others are. When this happens, we can have a partial load at the hook level too.

In a subsequent commit, when we encounter uprobe binary digest verification failures, we will partially load the policy instead of rejecting the policy in its entirety. We will salvage the uprobes where verification did not fail. With that change, we need a way to communicate which hooks we attached to and which hooks were not attached due to digest mismatch. This interface is meant to expose that. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This state will reflect that fact that not all hooks were loaded. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

The previous commits altered sensors.proto. This commit is the result of running "make protogen" to generate code based on that interface change. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This lays the groundwork for sensors to report their hook status. Each sensor type will need an implementation to set their status. Uprobes will be the first sensor to do this in a subsequent commit. The remaining sensors will report status on an as-needed basis. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This signifies that the policy loaded, but not all hooks were attached. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

Now that digest verification does not cause the policy to be rejected in its entirety, update our docs to reflect this. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This is similar to Ignore for kprobes, where users can specify a reason to ignore a specific hook given a specific condition. When a hook is ignored, this results in a partial load of the policy. Currently the only reason to ignore a uprobe/hook is that the digest verification failed. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

The previous commits altered pkg/k8s, so we need to run "make crds" in order to do code generation. This commit is the result of running that command. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

Re-generate the tracing-policy reference documentation to reflect the fact that a binaryDigests verification failure will no longer cause a policy to be rejected in its entirety. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

Allow partial policy loading when uprobe binary digest verification fails. Instead of rejecting the policy in its entirety, load the probes for the hooks where digest verification does not fail. The user needs to specify the digestVerificationFailure ignore configuration in order prevent policy rejection. Expose the resulting hook status in the policy status, so that users can can understand which hooks are in effect. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This alters the output of "tetra tracingpolicy list" to include the state of the policy's hook status inline, when the overall policy state is partially loaded. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

The previous commit changed the behavior when digest verification failures happen. Before, we would reject the policy in its entirety. Now, we salvage the uprobes within the policy where digest verification did not fail. As such, we need to update the unit tests to reflect this change in behavior. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This is needed in order to expose the hook status when all hooks are ignored. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

To cover hook statuses for kprobes. Since kprobes allow specifying a list for "Call", a hook can be partially loaded. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

The previous commits altered sensors.proto. This commit is the result of running "make protogen" to generate code based on that interface change. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

This is exposed via TracingPolicyStatus. By setting a hook status that is not STATUS_LOADED, we set the overall TracingPolicyState to TP_STATE_PARTIALLY_ENABLED. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

A previous commit made it so that sensors are still created when no hooks are attached. This was needed in order to convey hook status when every hook is ignored. There are code paths that assume sensor/collection state exists if the sensor was created. These locations need a way to detect if the sensor is empty, in order to avoid logging a spurious error. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

andrewstrohman mentioned this pull request Jul 17, 2026

add uprobe digest verification #4994

Closed

andrewstrohman added the release-note/minor This PR introduces a minor user-visible change label Jul 17, 2026

andrewstrohman changed the title ~~Pr/andrewstrohman/uprobe digest partial load~~ uprobe digest partial load Jul 17, 2026

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch from 1eacf38 to b035b31 Compare July 17, 2026 22:38

andrewstrohman marked this pull request as ready for review July 17, 2026 22:38

andrewstrohman requested review from a team and kkourt as code owners July 17, 2026 22:38

andrewstrohman requested a review from mtardy July 17, 2026 22:38

FedeDP reviewed Jul 20, 2026

View reviewed changes

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch 3 times, most recently from 62d292e to 4cea3ec Compare July 20, 2026 21:09

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch 7 times, most recently from 2a6d067 to 78a3227 Compare July 21, 2026 02:03

olsajiri approved these changes Jul 21, 2026

View reviewed changes

FedeDP approved these changes Jul 21, 2026

View reviewed changes

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch from 78a3227 to 1f087f6 Compare July 21, 2026 19:24

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch from 1f087f6 to af2d396 Compare July 21, 2026 20:31

andrewstrohman requested review from FedeDP and olsajiri July 22, 2026 00:09

FedeDP approved these changes Jul 22, 2026

View reviewed changes

kkourt approved these changes Jul 22, 2026

View reviewed changes

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch from ab51981 to 9e02b82 Compare July 22, 2026 19:24

mtardy reviewed Jul 27, 2026

View reviewed changes

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch 2 times, most recently from b1d12be to baa5b82 Compare July 27, 2026 18:41

andrewstrohman added 10 commits July 27, 2026 18:54

sensors.proto: add partially loaded TP state

5619504

This state will reflect that fact that not all hooks were loaded. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

api: run "make protogen"

60fb641

The previous commits altered sensors.proto. This commit is the result of running "make protogen" to generate code based on that interface change. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

sensors: add partially loaded state

955b9fc

This signifies that the policy loaded, but not all hooks were attached. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

uprobe: update BinaryDigest config docs

e497f81

Now that digest verification does not cause the policy to be rejected in its entirety, update our docs to reflect this. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

pkg/k8s: run "make crds"

db88226

The previous commits altered pkg/k8s, so we need to run "make crds" in order to do code generation. This commit is the result of running that command. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

docs: run "make gen-docs-references"

ae7adb9

Re-generate the tracing-policy reference documentation to reflect the fact that a binaryDigests verification failure will no longer cause a policy to be rejected in its entirety. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

andrewstrohman force-pushed the pr/andrewstrohman/uprobe-digest-partial-load branch 2 times, most recently from f0746a1 to 7568105 Compare July 27, 2026 20:19

andrewstrohman added 7 commits July 27, 2026 20:37

tetra: show hook status with TP list

147c1d5

This alters the output of "tetra tracingpolicy list" to include the state of the policy's hook status inline, when the overall policy state is partially loaded. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

kprobe: create empty sensor when all hooks ignored

e3f37b5

This is needed in order to expose the hook status when all hooks are ignored. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

tracingpolicy: extend policy hook status in API

f05b652

To cover hook statuses for kprobes. Since kprobes allow specifying a list for "Call", a hook can be partially loaded. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

api: run "make protogen"

65b0dd3

The previous commits altered sensors.proto. This commit is the result of running "make protogen" to generate code based on that interface change. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

kprobe: report hook status

1959a2e

This is exposed via TracingPolicyStatus. By setting a hook status that is not STATUS_LOADED, we set the overall TracingPolicyState to TP_STATE_PARTIALLY_ENABLED. Signed-off-by: Andy Strohman <astrohma@isovalent.com>

andrewstrohman requested a review from mtardy July 28, 2026 15:25

		// probe was partially loaded due to call not found
		STATUS_PARTIAL_CALL_NOT_FOUND = 4;

Uh oh!

Conversation

andrewstrohman commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

FedeDP left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewstrohman commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented Jul 21, 2026

Uh oh!

FedeDP commented Jul 21, 2026

Uh oh!

olsajiri left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FedeDP left a comment

Choose a reason for hiding this comment

Uh oh!

andrewstrohman commented Jul 21, 2026

Uh oh!

andrewstrohman commented Jul 21, 2026

Uh oh!

FedeDP commented Jul 22, 2026

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewstrohman Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewstrohman Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewstrohman Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewstrohman Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewstrohman commented Jul 17, 2026 •

edited

Loading

netlify Bot commented Jul 17, 2026 •

edited

Loading

andrewstrohman commented Jul 20, 2026 •

edited

Loading

andrewstrohman Jul 22, 2026 •

edited

Loading

andrewstrohman Jul 22, 2026 •

edited

Loading

andrewstrohman Jul 27, 2026 •

edited

Loading

andrewstrohman Jul 27, 2026 •

edited

Loading