From d7a7dda0e57a76a320dac5bdbdab7656b8b3e0df Mon Sep 17 00:00:00 2001 From: Toshaan Bharvani Date: Mon, 16 May 2022 18:42:33 +0200 Subject: [PATCH] initial package creation Signed-off-by: Toshaan Bharvani --- ...-tests-for-test-passphrase-parameter.patch | 56 +++ ....0-Do-not-use-too-small-key-in-tests.patch | 45 ++ ...BKDF-benchmark-in-OpenSSL3-FIPS-mode.patch | 47 ++ ...ssphrase-when-device-in-reencryption.patch | 106 +++++ ...etup-2.5.0-Fix-typo-in-repair-prompt.patch | 12 + ...setup-2.5.0-Get-rid-of-SHA1-in-tests.patch | 441 ++++++++++++++++++ .../cryptsetup-add-system-library-paths.patch | 22 + SOURCES/tests.tar.xz | Bin 0 -> 66656 bytes SPECS/cryptsetup.spec | 181 +++++++ 9 files changed, 910 insertions(+) create mode 100644 SOURCES/cryptsetup-2.5.0-Add-more-tests-for-test-passphrase-parameter.patch create mode 100644 SOURCES/cryptsetup-2.5.0-Do-not-use-too-small-key-in-tests.patch create mode 100644 SOURCES/cryptsetup-2.5.0-Fix-PBKDF-benchmark-in-OpenSSL3-FIPS-mode.patch create mode 100644 SOURCES/cryptsetup-2.5.0-Fix-test-passphrase-when-device-in-reencryption.patch create mode 100644 SOURCES/cryptsetup-2.5.0-Fix-typo-in-repair-prompt.patch create mode 100644 SOURCES/cryptsetup-2.5.0-Get-rid-of-SHA1-in-tests.patch create mode 100644 SOURCES/cryptsetup-add-system-library-paths.patch create mode 100644 SOURCES/tests.tar.xz create mode 100644 SPECS/cryptsetup.spec diff --git a/SOURCES/cryptsetup-2.5.0-Add-more-tests-for-test-passphrase-parameter.patch b/SOURCES/cryptsetup-2.5.0-Add-more-tests-for-test-passphrase-parameter.patch new file mode 100644 index 0000000..fa075eb --- /dev/null +++ b/SOURCES/cryptsetup-2.5.0-Add-more-tests-for-test-passphrase-parameter.patch @@ -0,0 +1,56 @@ +From f671febe64d8f40cdcb1677a08436a8907ccbb7e Mon Sep 17 00:00:00 2001 +From: Ondrej Kozina +Date: Wed, 23 Feb 2022 12:27:57 +0100 +Subject: [PATCH 2/3] Add more tests for --test-passphrase parameter. + +--- + tests/compat-test-args | 4 ++++ + tests/luks2-reencryption-test | 18 ++++++++++++++++++ + 2 files changed, 22 insertions(+) + +diff --git a/tests/compat-test-args b/tests/compat-test-args +index faeddd00..8bbe5563 100755 +--- a/tests/compat-test-args ++++ b/tests/compat-test-args +@@ -258,6 +258,10 @@ exp_fail luksAddKey DEV --unbound --key-size 0 + exp_pass luksAddKey DEV --unbound --key-size 8 + exp_pass luksDump DEV --unbound -S5 + exp_fail luksDump DEV --unbound ++exp_pass open DEV --unbound --test-passphrase ++exp_pass open DEV --unbound --test-passphrase -S5 ++exp_fail open DEV --unbound NAME ++exp_fail open DEV --unbound -S5 NAME + + exp_fail resize NAME --refresh + exp_fail open DEV NAME --test-passphrase --refresh +diff --git a/tests/luks2-reencryption-test b/tests/luks2-reencryption-test +index 6f156016..73818b5d 100755 +--- a/tests/luks2-reencryption-test ++++ b/tests/luks2-reencryption-test +@@ -1606,5 +1606,23 @@ if [ -n "$DM_SECTOR_SIZE" ]; then + reencrypt_recover_online 4096 journal $HASH1 + fi + ++echo "[27] Verify test passphrase mode works with reencryption metadata" ++echo $PWD1 | $CRYPTSETUP -S5 -q luksFormat --type luks2 $FAST_PBKDF_ARGON $DEV || fail ++echo -e "$PWD1\n$PWD1" | $CRYPTSETUP luksAddKey --unbound -s80 -S0 $FAST_PBKDF_ARGON $DEV || fail ++echo $PWD1 | $CRYPTSETUP reencrypt --init-only $DEV || fail ++echo $PWD1 | $CRYPTSETUP open --test-passphrase $DEV || fail ++ ++echo $PWD1 | $CRYPTSETUP -q luksFormat -S5 --header $IMG_HDR --type luks2 $FAST_PBKDF_ARGON $DEV || fail ++echo -e "$PWD1\n$PWD1" | $CRYPTSETUP luksAddKey --unbound -s80 -S0 $FAST_PBKDF_ARGON $IMG_HDR || fail ++echo $PWD1 | $CRYPTSETUP reencrypt --decrypt --init-only --header $IMG_HDR $DEV || fail ++echo $PWD1 | $CRYPTSETUP open --test-passphrase $IMG_HDR || fail ++ ++echo $PWD1 | $CRYPTSETUP reencrypt -q --encrypt --init-only --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail ++echo $PWD1 | $CRYPTSETUP open --test-passphrase $IMG_HDR || fail ++ ++wipe_dev_head $DEV 1 ++echo $PWD1 | $CRYPTSETUP reencrypt --encrypt --init-only --reduce-device-size 8M $FAST_PBKDF_ARGON $DEV || fail ++echo $PWD1 | $CRYPTSETUP open --test-passphrase $DEV || fail ++ + remove_mapping + exit 0 +-- +2.27.0 + diff --git a/SOURCES/cryptsetup-2.5.0-Do-not-use-too-small-key-in-tests.patch b/SOURCES/cryptsetup-2.5.0-Do-not-use-too-small-key-in-tests.patch new file mode 100644 index 0000000..40f7269 --- /dev/null +++ b/SOURCES/cryptsetup-2.5.0-Do-not-use-too-small-key-in-tests.patch @@ -0,0 +1,45 @@ +From 34f033b2549d95833270d657cf099ee4f6faff37 Mon Sep 17 00:00:00 2001 +From: Milan Broz +Date: Fri, 21 Jan 2022 09:55:34 +0100 +Subject: [PATCH 3/3] Do not use too small key in tests. + +Apparently FIPS mode enforces somewhere minimal key size. +As 64bit key is no longer useful anyway, just remove it. + +Apparently cipher_null is now more safer with the longer key, +isn't? :-) +--- + tests/align-test | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/tests/align-test b/tests/align-test +index 9ae606ca..a00103c2 100755 +--- a/tests/align-test ++++ b/tests/align-test +@@ -262,11 +262,6 @@ cleanup + echo "# Offset check: 512B sector drive" + add_device dev_size_mb=16 sector_size=512 num_tgts=1 + # |k| expO reqO expected slot offsets +-format_null 64 2048 0 8:72:136:200:264:328:392:456 +-format_null 64 520 1 +-format_null 64 520 8 +-format_null 64 640 128 +-format_null 64 2048 2048 + format_null 128 2048 0 8:136:264:392:520:648:776:904 + format_null 128 1032 1 + format_null 128 1032 8 +@@ -286,11 +281,6 @@ cleanup + + echo "# Offset check: 4096B sector drive" + add_device dev_size_mb=16 sector_size=4096 num_tgts=1 opt_blks=64 +-format_null 64 2048 0 8:72:136:200:264:328:392:456 +-format_null 64 520 1 +-format_null 64 520 8 +-format_null 64 640 128 +-format_null 64 2048 2048 + format_null 128 2048 0 8:136:264:392:520:648:776:904 + format_null 128 1032 1 + format_null 128 1032 8 +-- +2.27.0 + diff --git a/SOURCES/cryptsetup-2.5.0-Fix-PBKDF-benchmark-in-OpenSSL3-FIPS-mode.patch b/SOURCES/cryptsetup-2.5.0-Fix-PBKDF-benchmark-in-OpenSSL3-FIPS-mode.patch new file mode 100644 index 0000000..aebf06e --- /dev/null +++ b/SOURCES/cryptsetup-2.5.0-Fix-PBKDF-benchmark-in-OpenSSL3-FIPS-mode.patch @@ -0,0 +1,47 @@ +From 05a237be2a6c7a342fb5aba4433aec487a08317f Mon Sep 17 00:00:00 2001 +From: Milan Broz +Date: Fri, 21 Jan 2022 09:47:13 +0100 +Subject: [PATCH 1/3] Fix PBKDF benchmark in OpenSSL3 FIPS mode. + +OpenSSL now enforces minimal parameters for PBKDF2 according to SP 800-132 +key length (112 bits), minimal salt length (128 bits) and minimal number +of iterations (1000). + +Our benchmark violates this, causeing cryptsetup misbehave for luksFormat. + +Just inrease tet salt to 16 bytes here, it will little bit influence benchmark, +but there is no way back. +--- + lib/utils_benchmark.c | 2 +- + src/cryptsetup.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/utils_benchmark.c b/lib/utils_benchmark.c +index 7a9736d8..24e7bccc 100644 +--- a/lib/utils_benchmark.c ++++ b/lib/utils_benchmark.c +@@ -184,7 +184,7 @@ int crypt_benchmark_pbkdf_internal(struct crypt_device *cd, + pbkdf->parallel_threads = 0; /* N/A in PBKDF2 */ + pbkdf->max_memory_kb = 0; /* N/A in PBKDF2 */ + +- r = crypt_benchmark_pbkdf(cd, pbkdf, "foo", 3, "bar", 3, ++ r = crypt_benchmark_pbkdf(cd, pbkdf, "foo", 3, "01234567890abcdef", 16, + volume_key_size, &benchmark_callback, &u); + pbkdf->time_ms = ms_tmp; + if (r < 0) { +diff --git a/src/cryptsetup.c b/src/cryptsetup.c +index e529b7ac..37d35c92 100644 +--- a/src/cryptsetup.c ++++ b/src/cryptsetup.c +@@ -860,7 +860,7 @@ static int action_benchmark_kdf(const char *kdf, const char *hash, size_t key_si + .time_ms = 1000, + }; + +- r = crypt_benchmark_pbkdf(NULL, &pbkdf, "foo", 3, "bar", 3, key_size, ++ r = crypt_benchmark_pbkdf(NULL, &pbkdf, "foo", 3, "0123456789abcdef", 16, key_size, + &benchmark_callback, &pbkdf); + if (r < 0) + log_std(_("PBKDF2-%-9s N/A\n"), hash); +-- +2.27.0 + diff --git a/SOURCES/cryptsetup-2.5.0-Fix-test-passphrase-when-device-in-reencryption.patch b/SOURCES/cryptsetup-2.5.0-Fix-test-passphrase-when-device-in-reencryption.patch new file mode 100644 index 0000000..4aaa5a4 --- /dev/null +++ b/SOURCES/cryptsetup-2.5.0-Fix-test-passphrase-when-device-in-reencryption.patch @@ -0,0 +1,106 @@ +diff -rupN cryptsetup-2.4.3.old/man/cryptsetup.8 cryptsetup-2.4.3/man/cryptsetup.8 +--- cryptsetup-2.4.3.old/man/cryptsetup.8 2022-02-23 16:33:42.449525744 +0100 ++++ cryptsetup-2.4.3/man/cryptsetup.8 2022-02-24 08:57:43.036396289 +0100 +@@ -321,7 +321,8 @@ the command prompts for it interactively + \-\-keyfile\-size, \-\-readonly, \-\-test\-passphrase, + \-\-allow\-discards, \-\-header, \-\-key-slot, \-\-master\-key\-file, \-\-token\-id, + \-\-token\-only, \-\-token-type, \-\-disable\-external\-tokens, \-\-disable\-keyring, +-\-\-disable\-locks, \-\-type, \-\-refresh, \-\-serialize\-memory\-hard\-pbkdf]. ++\-\-disable\-locks, \-\-type, \-\-refresh, \-\-serialize\-memory\-hard\-pbkdf, ++\-\-unbound]. + .PP + \fIluksSuspend\fR + .IP +@@ -1465,10 +1466,14 @@ aligned to page size and page-cache init + integrity tag. + .TP + .B "\-\-unbound" +- + Creates new or dumps existing LUKS2 unbound keyslot. See \fIluksAddKey\fR or + \fIluksDump\fR actions for more details. + ++When used in \fIluksOpen\fR action (allowed only together with ++\-\-test\-passphrase parameter), it allows to test passphrase for unbound LUKS2 ++keyslot. Otherwise, unbound keyslot passphrase can be tested only when specific ++keyslot is selected via \-\-key\-slot parameter. ++ + .TP + .B "\-\-tcrypt\-hidden" + .B "\-\-tcrypt\-system" +diff -rupN cryptsetup-2.4.3.old/src/cryptsetup_args.h cryptsetup-2.4.3/src/cryptsetup_args.h +--- cryptsetup-2.4.3.old/src/cryptsetup_args.h 2022-02-23 16:33:42.450525749 +0100 ++++ cryptsetup-2.4.3/src/cryptsetup_args.h 2022-02-24 08:57:43.036396289 +0100 +@@ -75,7 +75,7 @@ + #define OPT_TCRYPT_HIDDEN_ACTIONS { OPEN_ACTION, TCRYPTDUMP_ACTION } + #define OPT_TCRYPT_SYSTEM_ACTIONS { OPEN_ACTION, TCRYPTDUMP_ACTION } + #define OPT_TEST_PASSPHRASE_ACTIONS { OPEN_ACTION } +-#define OPT_UNBOUND_ACTIONS { ADDKEY_ACTION, LUKSDUMP_ACTION } ++#define OPT_UNBOUND_ACTIONS { ADDKEY_ACTION, LUKSDUMP_ACTION, OPEN_ACTION } + #define OPT_USE_RANDOM_ACTIONS { FORMAT_ACTION } + #define OPT_USE_URANDOM_ACTIONS { FORMAT_ACTION } + #define OPT_UUID_ACTIONS { FORMAT_ACTION, UUID_ACTION } +diff -rupN cryptsetup-2.4.3.old/src/cryptsetup.c cryptsetup-2.4.3/src/cryptsetup.c +--- cryptsetup-2.4.3.old/src/cryptsetup.c 2022-02-23 16:33:42.450525749 +0100 ++++ cryptsetup-2.4.3/src/cryptsetup.c 2022-02-24 08:57:43.036396289 +0100 +@@ -140,7 +140,8 @@ static void _set_activation_flags(uint32 + *flags |= CRYPT_ACTIVATE_IGNORE_PERSISTENT; + + /* Only for LUKS2 but ignored elsewhere */ +- if (ARG_SET(OPT_TEST_PASSPHRASE_ID)) ++ if (ARG_SET(OPT_TEST_PASSPHRASE_ID) && ++ (ARG_SET(OPT_KEY_SLOT_ID) || ARG_SET(OPT_UNBOUND_ID))) + *flags |= CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY; + + if (ARG_SET(OPT_SERIALIZE_MEMORY_HARD_PBKDF_ID)) +@@ -3982,6 +3983,18 @@ int main(int argc, const char **argv) + _("Option --tcrypt-hidden, --tcrypt-system or --tcrypt-backup is supported only for TCRYPT device."), + poptGetInvocationName(popt_context)); + ++ if (ARG_SET(OPT_UNBOUND_ID) && !strcmp(aname, OPEN_ACTION) && device_type && ++ strncmp(device_type, "luks", 4)) ++ usage(popt_context, EXIT_FAILURE, ++ _("Option --unbound is allowed only for open of luks device."), ++ poptGetInvocationName(popt_context)); ++ ++ if (ARG_SET(OPT_UNBOUND_ID) && !ARG_SET(OPT_TEST_PASSPHRASE_ID) && ++ !strcmp(aname, OPEN_ACTION)) ++ usage(popt_context, EXIT_FAILURE, ++ _("Option --unbound cannot be used without --test-passphrase."), ++ poptGetInvocationName(popt_context)); ++ + if (ARG_SET(OPT_TCRYPT_HIDDEN_ID) && ARG_SET(OPT_ALLOW_DISCARDS_ID)) + usage(popt_context, EXIT_FAILURE, + _("Option --tcrypt-hidden cannot be combined with --allow-discards."), +diff -rupN cryptsetup-2.4.3.old/tests/compat-test2 cryptsetup-2.4.3/tests/compat-test2 +--- cryptsetup-2.4.3.old/tests/compat-test2 2022-02-23 16:33:42.444525716 +0100 ++++ cryptsetup-2.4.3/tests/compat-test2 2022-02-24 09:05:38.716422307 +0100 +@@ -699,7 +699,7 @@ $CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOP + # otoh it should be allowed to test for proper passphrase + prepare "" new + echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail +-echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail ++echo $PWD1 | $CRYPTSETUP open --unbound --test-passphrase $HEADER_KEYU || fail + echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail + [ -b /dev/mapper/$DEV_NAME ] && fail + echo $PWD1 | $CRYPTSETUP open $HEADER_KEYU $DEV_NAME 2>/dev/null && fail +@@ -708,7 +708,7 @@ echo $PWD0 | $CRYPTSETUP open -S1 --test + $CRYPTSETUP luksKillSlot -q $HEADER_KEYU 0 + $CRYPTSETUP luksDump $HEADER_KEYU | grep -q "0: luks2" && fail + echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail +-echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail ++echo $PWD1 | $CRYPTSETUP open --unbound --test-passphrase $HEADER_KEYU || fail + echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail + + prepare "[28] Detached LUKS header" wipe +@@ -967,11 +967,9 @@ echo $PWD3 | $CRYPTSETUP -q luksAddKey - + # do not allow to replace keyslot by unbound slot + echo $PWD1 | $CRYPTSETUP -q luksAddKey -S5 --unbound -s 32 $LOOPDEV 2>/dev/null && fail + echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail +-echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail + echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV $DEV_NAME 2> /dev/null && fail + echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV --test-passphrase || fail + echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail +-echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail + # check we're able to change passphrase for unbound keyslot + echo -e "$PWD2\n$PWD3" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail + echo $PWD3 | $CRYPTSETUP open --test-passphrase $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail diff --git a/SOURCES/cryptsetup-2.5.0-Fix-typo-in-repair-prompt.patch b/SOURCES/cryptsetup-2.5.0-Fix-typo-in-repair-prompt.patch new file mode 100644 index 0000000..5bf54fb --- /dev/null +++ b/SOURCES/cryptsetup-2.5.0-Fix-typo-in-repair-prompt.patch @@ -0,0 +1,12 @@ +diff -rupN cryptsetup-2.4.3.old/src/cryptsetup.c cryptsetup-2.4.3/src/cryptsetup.c +--- cryptsetup-2.4.3.old/src/cryptsetup.c 2022-01-21 13:14:56.864817351 +0100 ++++ cryptsetup-2.4.3/src/cryptsetup.c 2022-01-21 13:15:15.579947027 +0100 +@@ -1188,7 +1188,7 @@ static int reencrypt_metadata_repair(str + _("Operation aborted.\n"))) + return -EINVAL; + +- r = tools_get_key(_("Enter passphrase to protect and uppgrade reencryption metadata: "), ++ r = tools_get_key(_("Enter passphrase to protect and upgrade reencryption metadata: "), + &password, &passwordLen, ARG_UINT64(OPT_KEYFILE_OFFSET_ID), + ARG_UINT32(OPT_KEYFILE_SIZE_ID), ARG_STR(OPT_KEY_FILE_ID), ARG_UINT32(OPT_TIMEOUT_ID), + _verify_passphrase(0), 0, cd); diff --git a/SOURCES/cryptsetup-2.5.0-Get-rid-of-SHA1-in-tests.patch b/SOURCES/cryptsetup-2.5.0-Get-rid-of-SHA1-in-tests.patch new file mode 100644 index 0000000..4708329 --- /dev/null +++ b/SOURCES/cryptsetup-2.5.0-Get-rid-of-SHA1-in-tests.patch @@ -0,0 +1,441 @@ +diff -rupN cryptsetup-2.4.3.old/tests/api-test.c cryptsetup-2.4.3/tests/api-test.c +--- cryptsetup-2.4.3.old/tests/api-test.c 2022-02-17 16:37:09.535345938 +0100 ++++ cryptsetup-2.4.3/tests/api-test.c 2022-02-17 16:37:29.156459763 +0100 +@@ -312,7 +312,7 @@ static int _setup(void) + static void AddDevicePlain(void) + { + struct crypt_params_plain params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + .size = 0 +@@ -322,7 +322,7 @@ static void AddDevicePlain(void) + + const char *passphrase = PASSPHRASE; + // hashed hex version of PASSPHRASE +- const char *mk_hex = "bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a"; ++ const char *mk_hex = "ccadd99b16cd3d200c22d6db45d8b6630ef3d936767127347ec8a76ab992c2ea"; + size_t key_size = strlen(mk_hex) / 2; + const char *cipher = "aes"; + const char *cipher_mode = "cbc-essiv:sha256"; +@@ -438,7 +438,7 @@ static void AddDevicePlain(void) + OK_(crypt_deactivate(cd,CDEVICE_1)); + + CRYPT_FREE(cd); +- params.hash = "sha1"; ++ params.hash = "sha256"; + params.offset = 0; + params.size = 0; + params.skip = 0; +@@ -620,7 +620,7 @@ static void new_log(int level, const cha + static void CallbacksTest(void) + { + struct crypt_params_plain params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + }; +@@ -1116,7 +1116,7 @@ static void LuksHeaderRestore(void) + .data_alignment = 2048, // 4M, data offset will be 4096 + }; + struct crypt_params_plain pl_params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + .size = 0 +@@ -1203,7 +1203,7 @@ static void LuksHeaderLoad(void) + .data_alignment = 2048, + }; + struct crypt_params_plain pl_params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + .size = 0 +diff -rupN cryptsetup-2.4.3.old/tests/api-test-2.c cryptsetup-2.4.3/tests/api-test-2.c +--- cryptsetup-2.4.3.old/tests/api-test-2.c 2022-02-17 16:37:09.535345938 +0100 ++++ cryptsetup-2.4.3/tests/api-test-2.c 2022-02-17 16:37:29.155459758 +0100 +@@ -1232,7 +1232,7 @@ static void Luks2HeaderRestore(void) + .sector_size = 512 + }; + struct crypt_params_plain pl_params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + .size = 0 +@@ -1242,7 +1242,7 @@ static void Luks2HeaderRestore(void) + }; + uint32_t flags = 0; + +- const char *mk_hex = "bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a"; ++ const char *mk_hex = "ccadd99b16cd3d200c22d6db45d8b6630ef3d936767127347ec8a76ab992c2ea"; + size_t key_size = strlen(mk_hex) / 2; + const char *cipher = "aes"; + const char *cipher_mode = "cbc-essiv:sha256"; +@@ -1337,7 +1337,7 @@ static void Luks2HeaderLoad(void) + .sector_size = 512 + }; + struct crypt_params_plain pl_params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + .size = 0 +@@ -2142,7 +2142,7 @@ static void LuksConvert(void) + .parallel_threads = 1 + }, pbkdf2 = { + .type = CRYPT_KDF_PBKDF2, +- .hash = "sha1", ++ .hash = "sha256", + .time_ms = 1 + }; + +@@ -2675,7 +2675,7 @@ static void Pbkdf(void) + .hash = default_luks1_hash + }; + struct crypt_params_plain params = { +- .hash = "sha1", ++ .hash = "sha256", + .skip = 0, + .offset = 0, + .size = 0 +@@ -2874,11 +2874,11 @@ static void Pbkdf(void) + pbkdf2.time_ms = 9; + pbkdf2.hash = NULL; + FAIL_(crypt_set_pbkdf_type(cd, &pbkdf2), "Hash is mandatory for pbkdf2"); +- pbkdf2.hash = "sha1"; ++ pbkdf2.hash = "sha256"; + OK_(crypt_set_pbkdf_type(cd, &pbkdf2)); + + argon2.time_ms = 9; +- argon2.hash = "sha1"; // will be ignored ++ argon2.hash = "sha256"; // will be ignored + OK_(crypt_set_pbkdf_type(cd, &argon2)); + argon2.hash = NULL; + OK_(crypt_set_pbkdf_type(cd, &argon2)); +@@ -3839,7 +3839,7 @@ static void Luks2Reencryption(void) + struct crypt_params_reencrypt retparams = {}, rparams = { + .direction = CRYPT_REENCRYPT_FORWARD, + .resilience = "checksum", +- .hash = "sha1", ++ .hash = "sha256", + .luks2 = ¶ms2, + }; + dev_t devno; +@@ -3983,7 +3983,7 @@ static void Luks2Reencryption(void) + rparams.hash = "hamSter"; + FAIL_(crypt_reencrypt_init_by_passphrase(cd, NULL, PASSPHRASE, strlen(PASSPHRASE), 21, 9, "aes", "xts-plain64", &rparams), "Invalid resilience hash."); + +- rparams.hash = "sha1"; ++ rparams.hash = "sha256"; + OK_(crypt_reencrypt_init_by_passphrase(cd, NULL, PASSPHRASE, strlen(PASSPHRASE), 21, 9, "aes", "xts-plain64", &rparams)); + OK_(crypt_reencrypt_run(cd, NULL, NULL)); + +diff -rupN cryptsetup-2.4.3.old/tests/compat-test cryptsetup-2.4.3/tests/compat-test +--- cryptsetup-2.4.3.old/tests/compat-test 2022-02-17 16:37:09.541345973 +0100 ++++ cryptsetup-2.4.3/tests/compat-test 2022-02-17 16:37:29.157459769 +0100 +@@ -302,8 +302,8 @@ $CRYPTSETUP -q luksUUID $IMG | grep -q $ + prepare "[1] open - compat image - acceptance check" new + echo $PWD0 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail + check_exists +-ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ') +-[ "$ORG_SHA1" = 676062b66ebf36669dab705442ea0762dfc091b0 ] || fail ++ORG_SHA256=$(sha256sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ') ++[ "$ORG_SHA256" = 7428e8f2436882a07eb32765086f5c899474c08b5576f556b573d2aabdf923e8 ] || fail + $CRYPTSETUP -q luksClose $DEV_NAME || fail + + # Check it can be opened from header backup as well +@@ -315,6 +315,7 @@ $CRYPTSETUP -q luksClose $DEV_NAME || f + $CRYPTSETUP luksHeaderRestore -q $IMG --header-backup-file $HEADER_IMG || fail + + # Repeat for V1.0 header - not aligned first keyslot ++if [ ! fips_mode ] ; then + echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME || fail + check_exists + ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ') +@@ -326,6 +327,7 @@ $CRYPTSETUP luksHeaderBackup $IMG10 --he + echo $PWD0 | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail + check_exists + $CRYPTSETUP -q luksClose $DEV_NAME || fail ++fi + + prepare "[2] open - compat image - denial check" new + echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +@@ -526,7 +528,7 @@ $CRYPTSETUP luksDump $LOOPDEV | grep -q + + prepare "[19] create & status & resize" wipe + echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash xxx 2>/dev/null && fail +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --cipher aes-cbc-essiv:sha256 --offset 3 --skip 4 --readonly || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha256 --cipher aes-cbc-essiv:sha256 --offset 3 --skip 4 --readonly || fail + $CRYPTSETUP -q status $DEV_NAME | grep "offset:" | grep -q "3 sectors" || fail + $CRYPTSETUP -q status $DEV_NAME | grep "skipped:" | grep -q "4 sectors" || fail + $CRYPTSETUP -q status $DEV_NAME | grep "mode:" | grep -q "readonly" || fail +@@ -546,15 +548,15 @@ $CRYPTSETUP -q resize $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "32765 sectors" || fail + $CRYPTSETUP -q remove $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME >/dev/null && fail +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha256 $LOOPDEV || fail + $CRYPTSETUP -q remove $DEV_NAME || fail +-echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 $LOOPDEV || fail ++echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha256 $LOOPDEV || fail + $CRYPTSETUP -q remove $DEV_NAME || fail +-echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 --size 100 $LOOPDEV || fail ++echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha256 --size 100 $LOOPDEV || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail + $CRYPTSETUP -q remove $DEV_NAME || fail + # 4k sector resize (if kernel supports it) +-echo $PWD1 | $CRYPTSETUP -q open --type plain $LOOPDEV $DEV_NAME --sector-size 4096 --size 8 >/dev/null 2>&1 ++echo $PWD1 | $CRYPTSETUP -q open --type plain --hash sha256 $LOOPDEV $DEV_NAME --sector-size 4096 --size 8 >/dev/null 2>&1 + if [ $? -eq 0 ] ; then + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "8 sectors" || fail + $CRYPTSETUP -q resize $DEV_NAME --size 16 || fail +@@ -567,7 +569,7 @@ if [ $? -eq 0 ] ; then + fi + # Resize not aligned to logical block size + add_scsi_device dev_size_mb=32 sector_size=4096 +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $DEV || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha256 $DEV || fail + OLD_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/') + $CRYPTSETUP resize $DEV_NAME -b 7 2> /dev/null && fail + dmsetup info $DEV_NAME | grep -q SUSPENDED && fail +@@ -575,10 +577,10 @@ NEW_SIZE=$($CRYPTSETUP status $DEV_NAME + test $OLD_SIZE -eq $NEW_SIZE || fail + $CRYPTSETUP close $DEV_NAME || fail + # Add check for unaligned plain crypt activation +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $DEV -b 7 2>/dev/null && fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha256 $DEV -b 7 2>/dev/null && fail + $CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 && fail + # verify is ignored on non-tty input +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --verify-passphrase 2>/dev/null || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha256 --verify-passphrase 2>/dev/null || fail + $CRYPTSETUP -q remove $DEV_NAME || fail + $CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size 255 2>/dev/null && fail + $CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size -1 2>/dev/null && fail +@@ -695,15 +697,15 @@ $CRYPTSETUP luksChangeKey $LOOPDEV $FAST + dmsetup remove --retry $DEV_NAME2 + + prepare "[25] Create shared segments" wipe +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --offset 0 --size 256 || fail +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 2>/dev/null && fail +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 --shared || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha256 --offset 0 --size 256 || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha256 --offset 512 --size 256 2>/dev/null && fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha256 --offset 512 --size 256 --shared || fail + $CRYPTSETUP -q remove $DEV_NAME2 || fail + $CRYPTSETUP -q remove $DEV_NAME || fail + + prepare "[26] Suspend/Resume" wipe + # only LUKS is supported +-echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail ++echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha256 $LOOPDEV || fail + $CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail + $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail + $CRYPTSETUP -q remove $DEV_NAME || fail +diff -rupN cryptsetup-2.4.3.old/tests/compat-test2 cryptsetup-2.4.3/tests/compat-test2 +--- cryptsetup-2.4.3.old/tests/compat-test2 2022-02-17 16:37:09.541345973 +0100 ++++ cryptsetup-2.4.3/tests/compat-test2 2022-02-17 16:37:29.158459775 +0100 +@@ -774,7 +774,7 @@ $CRYPTSETUP luksDump $LOOPDEV | grep -q + $CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail + $CRYPTSETUP -q convert --type luks1 $LOOPDEV || fail + # hash test +-$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 512 $LOOPDEV $KEY5 -S 0 --hash sha1 || fail ++$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 512 $LOOPDEV $KEY5 -S 0 --hash sha512 || fail + $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 --hash sha256 || fail + $CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail + $CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail +diff -rupN cryptsetup-2.4.3.old/tests/discards-test cryptsetup-2.4.3/tests/discards-test +--- cryptsetup-2.4.3.old/tests/discards-test 2022-02-17 16:37:09.541345973 +0100 ++++ cryptsetup-2.4.3/tests/discards-test 2022-02-17 16:37:29.158459775 +0100 +@@ -80,7 +80,7 @@ dmsetup table $DEV_NAME | grep allow_dis + $CRYPTSETUP luksClose $DEV_NAME || fail + + echo "[2] Allowing discards for plain device" +-echo $PWD1 | $CRYPTSETUP create -q $DEV_NAME $DEV --hash sha1 --allow-discards || fail ++echo $PWD1 | $CRYPTSETUP create -q $DEV_NAME $DEV --hash sha256 --allow-discards || fail + $CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail + $CRYPTSETUP resize $DEV_NAME --size 100 || fail + $CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail +diff -rupN cryptsetup-2.4.3.old/tests/integrity-compat-test cryptsetup-2.4.3/tests/integrity-compat-test +--- cryptsetup-2.4.3.old/tests/integrity-compat-test 2022-02-17 16:37:09.542345979 +0100 ++++ cryptsetup-2.4.3/tests/integrity-compat-test 2022-02-17 16:37:29.159459781 +0100 +@@ -168,7 +168,7 @@ intformat() # alg alg_out tagsize outtag + echo -n "[FORMAT]" + $INTSETUP format --integrity-legacy-padding -q --integrity $1 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV >/dev/null 2>&1 + if [ $? -ne 0 ] ; then +- if [[ $1 =~ "sha" || $1 =~ "crc" ]] ; then ++ if [[ $1 =~ "sha2" || $1 =~ "crc" ]] ; then + fail "Cannot format device." + fi + echo "[N/A]" +@@ -214,7 +214,14 @@ int_error_detection() # mode alg tagsize + + echo -n "[INTEGRITY:$1:$2:$4:$5]" + echo -n "[FORMAT]" +- $INTSETUP format -q --integrity $2 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV $INT_MODE >/dev/null || fail "Cannot format device." ++ $INTSETUP format -q --integrity $2 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV $INT_MODE >/dev/null 2>&1 ++ if [ $? -ne 0 ] ; then ++ if [[ $2 =~ "sha2" || $2 =~ "crc" ]] ; then ++ fail "Cannot format device." ++ fi ++ echo "[N/A]" ++ return ++ fi + echo -n "[ACTIVATE]" + $INTSETUP open $DEV $DEV_NAME --integrity $2 --integrity-no-journal $KEY_PARAMS $INT_MODE || fail "Cannot activate device." + +diff -rupN cryptsetup-2.4.3.old/tests/keyring-compat-test cryptsetup-2.4.3/tests/keyring-compat-test +--- cryptsetup-2.4.3.old/tests/keyring-compat-test 2022-02-17 16:37:09.542345979 +0100 ++++ cryptsetup-2.4.3/tests/keyring-compat-test 2022-02-17 16:39:07.132028140 +0100 +@@ -119,7 +119,7 @@ add_device() { + which dmsetup >/dev/null 2>&1 || skip "Cannot find dmsetup, test skipped" + which keyctl >/dev/null 2>&1 || skip "Cannot find keyctl, test skipped" + which xxd >/dev/null 2>&1 || skip "Cannot find xxd, test skipped" +-which sha1sum > /dev/null 2>&1 || skip "Cannot find sha1sum, test skipped" ++which sha256sum >/dev/null 2>&1 || skip "Cannot find sha256sum, test skipped" + modprobe dm-crypt >/dev/null 2>&1 || fail "dm-crypt failed to load" + dm_crypt_keyring_support || skip "dm-crypt doesn't support kernel keyring, test skipped." + +@@ -132,23 +132,23 @@ dd if=/dev/urandom of=$DEV bs=1M count=$ + #test aes cipher with xts mode, plain IV + echo -n "Testing $CIPHER_XTS_PLAIN..." + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail ++sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail + dmsetup remove --retry $NAME || fail + load_key "$HEXKEY_32" logon $LOGON_KEY_32_OK "$TEST_KEYRING" || fail "Cannot load 32 byte logon key type" + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN :32:logon:$LOGON_KEY_32_OK 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail ++sha256sum /dev/mapper/$NAME > $CHKS_KEYRING || fail + dmsetup remove --retry $NAME || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" + # same test using message + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail ++sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail + dmsetup remove --retry $NAME || fail + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail + dmsetup suspend $NAME || fail + dmsetup message $NAME 0 key wipe || fail + dmsetup message $NAME 0 "key set :32:logon:$LOGON_KEY_32_OK" || fail + dmsetup resume $NAME || fail +-sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail ++sha256sum /dev/mapper/$NAME > $CHKS_KEYRING || fail + dmsetup remove --retry $NAME || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" + echo "OK" +@@ -156,23 +156,23 @@ echo "OK" + #test aes cipher, xts mode, essiv IV + echo -n "Testing $CIPHER_CBC_ESSIV..." + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail ++sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail + dmsetup remove --retry $NAME || fail + load_key "$HEXKEY_16" logon $LOGON_KEY_16_OK "$TEST_KEYRING" || fail "Cannot load 16 byte logon key type" + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV :16:logon:$LOGON_KEY_16_OK 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail ++sha256sum /dev/mapper/$NAME > $CHKS_KEYRING || fail + dmsetup remove --retry $NAME || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" + # same test using message + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail ++sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail + dmsetup remove --retry $NAME || fail + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail + dmsetup suspend $NAME || fail + dmsetup message $NAME 0 key wipe || fail + dmsetup message $NAME 0 "key set :16:logon:$LOGON_KEY_16_OK" || fail + dmsetup resume $NAME || fail +-sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail ++sha256sum /dev/mapper/$NAME > $CHKS_KEYRING || fail + dmsetup remove --retry $NAME || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" + echo "OK" +@@ -181,23 +181,23 @@ echo "OK" + fips_mode || { + echo -n "Testing $CIPHER_CBC_TCW..." + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail ++sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail + dmsetup remove --retry $NAME || fail + load_key "$HEXKEY_64" logon $LOGON_KEY_64_OK "$TEST_KEYRING" || fail "Cannot load 16 byte logon key type" + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW :64:logon:$LOGON_KEY_64_OK 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail ++sha256sum /dev/mapper/$NAME > $CHKS_KEYRING || fail + dmsetup remove --retry $NAME || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksum mismatch (corruption)" + # same test using message + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail +-sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail ++sha256sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail + dmsetup remove --retry $NAME || fail + dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail + dmsetup suspend $NAME || fail + dmsetup message $NAME 0 key wipe || fail + dmsetup message $NAME 0 "key set :64:logon:$LOGON_KEY_64_OK" || fail + dmsetup resume $NAME || fail +-sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail ++sha256sum /dev/mapper/$NAME > $CHKS_KEYRING || fail + dmsetup remove --retry $NAME || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" + echo "OK" +@@ -207,10 +207,10 @@ echo -n "Test LUKS2 key refresh..." + echo $PWD | $CRYPTSETUP luksFormat --type luks2 --luks2-metadata-size 16k --luks2-keyslots-size 4064k --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --force-password $DEV || fail + echo $PWD | $CRYPTSETUP open $DEV $NAME || fail + $CRYPTSETUP status $NAME | grep -q -i "location:.*keyring" || skip "LUKS2 can't use keyring. Test skipped." +-dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha1sum > $CHKS_KEYRING || fail ++dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha256sum > $CHKS_KEYRING || fail + echo $PWD | $CRYPTSETUP refresh $NAME --disable-keyring || fail + $CRYPTSETUP status $NAME | grep -q -i "location:.*keyring" && fail "Key is still in keyring" +-dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha1sum > $CHKS_DMCRYPT || fail ++dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha256sum > $CHKS_DMCRYPT || fail + diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksum mismatch (corruption)" + echo "OK" + +diff -rupN cryptsetup-2.4.3.old/tests/password-hash-test cryptsetup-2.4.3/tests/password-hash-test +--- cryptsetup-2.4.3.old/tests/password-hash-test 2022-02-17 16:37:09.541345973 +0100 ++++ cryptsetup-2.4.3/tests/password-hash-test 2022-02-17 16:37:29.160459787 +0100 +@@ -75,7 +75,7 @@ crypt_key() # hash keysize pwd/file name + esac + + # ignore these cases, not all libs/kernel supports it +- if [ "$1" != "sha1" -a "$1" != "sha256" ] || [ $2 -gt 256 ] ; then ++ if [ "$1" != "sha256" ] || [ $2 -gt 256 ] ; then + if [ $ret -ne 0 ] ; then + echo " [N/A] ($ret, SKIPPED)" + return +diff -rupN cryptsetup-2.4.3.old/tests/reencryption-compat-test cryptsetup-2.4.3/tests/reencryption-compat-test +--- cryptsetup-2.4.3.old/tests/reencryption-compat-test 2022-02-17 16:37:09.541345973 +0100 ++++ cryptsetup-2.4.3/tests/reencryption-compat-test 2022-02-17 16:37:29.160459787 +0100 +@@ -338,7 +338,7 @@ simple_scsi_reenc "[4096/512 sector]" + echo "[OK]" + + echo "[8] Header only reencryption (hash and iteration time)" +-echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 --hash sha1 $FAST_PBKDF $LOOPDEV1 || fail ++echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 --hash sha512 $FAST_PBKDF $LOOPDEV1 || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key || fail +diff -rupN cryptsetup-2.4.3.old/tests/verity-compat-test cryptsetup-2.4.3/tests/verity-compat-test +--- cryptsetup-2.4.3.old/tests/verity-compat-test 2022-02-17 16:37:09.541345973 +0100 ++++ cryptsetup-2.4.3/tests/verity-compat-test 2022-02-17 16:37:29.161459793 +0100 +@@ -148,7 +148,13 @@ function check_root_hash() # $1 size, $2 + for fail in data hash; do + wipe + echo -n "V$4(sb=$sb root_hash_as_file=$root_hash_as_file) $5 block size $1: " +- $VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >$DEV_OUT || fail ++ $VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >$DEV_OUT ++ if [ $? -ne 0 ] ; then ++ if [[ $1 =~ "sha2" ]] ; then ++ fail "Cannot format device." ++ fi ++ return ++ fi + + echo -n "[root hash]" + compare_out "root hash" $2 diff --git a/SOURCES/cryptsetup-add-system-library-paths.patch b/SOURCES/cryptsetup-add-system-library-paths.patch new file mode 100644 index 0000000..0a5d753 --- /dev/null +++ b/SOURCES/cryptsetup-add-system-library-paths.patch @@ -0,0 +1,22 @@ +diff -rupN cryptsetup-2.2.0.old/configure cryptsetup-2.2.0/configure +--- cryptsetup-2.2.0.old/configure 2019-08-14 20:45:07.000000000 +0200 ++++ cryptsetup-2.2.0/configure 2019-08-15 09:11:14.775184005 +0200 +@@ -12294,6 +12294,9 @@ fi + # before this can be enabled. + hardcode_into_libs=yes + ++ # Add ABI-specific directories to the system library path. ++ sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /lib /usr/lib" ++ + # Ideally, we could use ldconfig to report *all* directores which are + # searched for libraries, however this is still not possible. Aside from not + # being certain /sbin/ldconfig is available, command +@@ -12302,7 +12305,7 @@ fi + # appending ld.so.conf contents (and includes) to the search path. + if test -f /etc/ld.so.conf; then + lt_ld_extra=`awk '/^include / { system(sprintf("cd /etc; cat %s 2>/dev/null", \$2)); skip = 1; } { if (!skip) print \$0; skip = 0; }' < /etc/ld.so.conf | $SED -e 's/#.*//;/^[ ]*hwcap[ ]/d;s/[:, ]/ /g;s/=[^=]*$//;s/=[^= ]* / /g;s/"//g;/^$/d' | tr '\n' ' '` +- sys_lib_dlsearch_path_spec="/lib /usr/lib $lt_ld_extra" ++ sys_lib_dlsearch_path_spec="$sys_lib_dlsearch_path_spec $lt_ld_extra" + fi + + # We used to test for /lib/ld.so.1 and disable shared libraries on diff --git a/SOURCES/tests.tar.xz b/SOURCES/tests.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..250c4bf3fa2a2a5bb15643c1d44c1894e3310150 GIT binary patch literal 66656 zcmV(oK=Hr*H+ooF000E$*0e?hz@3N$fUpE10TuuN0001#g?;tl@J#RjT>v^6O3omx zSFM@r^UN%LclO3S=$UBwrFxZO%iGk!&W^8vFWs_oAd_j)WuDbBSjmV@r!Y7*( zCVP9C)cBaC1eRCHb+XupzIbwcNu+NyBBIv>IH#yqbzD$0!Md=z+hhz>BFZlxg2I)y zk%jzfz=l9GPoP}SaoJoaa$yI8)*>^E<9CLNSyeJP$463t-tO7O~$_B!7p5FXv#6hcpV=%pdC zp908h@~_#LN@s?Y8z4_$ zId)d5gv3EPSZjPDB_^b2YuNuO98JVF!Rug(-T$GT(yc9+-Djm1>r}8>6=LLc_MaY0 z%(&oip^QV-kq|V?-hCO+q;28y?xCf)Q?J9_QLvJ$rnVP_xMeE-bUJFY z(~QSej5hCNQ=cT#NU!DQp(69Zi}hZ|3@f1hIXMclm%^Zvz;~c|MEZ6g!27nBWu*>w zw|P2KOnO5f9S|4vp(5#6B#DG+_4fF@r6eSeGLFkzkBLW%l0Q^AYzKAXjVT5npHAm4 zU_N}d_lR03?1`l2;yM#H^slkgr5Fe+lycl@l4p>9Q#{krXQ96u3Z)zWk>$4KBk}=H{X` z^1*49AD6nS_1}iu?mLb1xC?!LkOlr48}qYsF&pL~i0!+M4gt3P^>2-K0@<())i3zA zs<%=$x+4ecsQTp+H0yrb;ze;qY`>;NTc9eu&dtMqXNX<%M+zmZL=KetPIl!tx9nbv zB}-dN*)6Q;Cg^jW)Z7C%ff_YnCQ;3m0MpCO53VqfMSkLVu6Dcj#)$C{+}v1o47n4n zn%W;WfIYZz2-U}A=tj^d`F^=lLEax=jaPAhM>xZ+mR8)s*~23P=aeQTY%jxgY^f=+?gjj@I{vLY+$^CE8(DP0#PGyS zS9wl(^uYLM;^WB{i}=i9281QVRiRiskca7fn4hb|E>u5sQW(cz6Jv=kzwfSx7mj)@ zS3x<0^?xW{qJeOB@`JV@kTS}wYNl*{!FM;U10*++o{8@&ZJL=9ts5OFWfS~C1#y9r zpR~hn`4H@gT9;{Pij(u&tVFqGuMU!(O4ci%@R^wudS7|aaDVJrO4_yJamz#+My?)# zJ8@x~<7y)Sd^@QBL&oJA;QJiUZOmUPLO#5ndQIX_`jqbC+rNybu6jlPrPFyk_f zuN%5&ZsPxU&N=u`43b6jtVG$Yrbzv=$5e7+gX<_B%!W<9t+oR$)kve4f8*dy%6GAZ ziJOjnTxh7Ofg5Uu6y6{un(wdS#RFaoAVFl2W?t$mw1J$3ov89%|00bbuIB-x6SO&i zQ&7jNS2yLuTnZoUZmlM-M7vDv{1hynypp{u=t$DM#BWNzUx?$+zM}H}B#-Wy@nF!# zlMJ)rGj0)N?BsE6H7zIpIbw5M(0!+!v8oyv@wI|v9iuEI^+Zk&xCNgN=00qm1nS`C?kF5OmJRYXT^>2IQy5JYLLt2n zZy>V5yJdnq9##!|sc_rMq&$*({n z8JLaI&@liA%nBWROmYpY+>qgJ+nDfBK=j40w>UFFGQ5)_qr2(xsJnjvQhfK@N;A_g zgJD<@{qOelhK~tlN+Cs!k#pu)(*dQ9@I~yXZS(z)x?}Wxz_yazR}-rI#L*g2<0$XS zen->BtE0)bT*O3!qGF$zlSNC)#DK}*Z}Cajo?3Bv@7h?>n?px^HopMYc-b+$m=w;{ zrLF8ZdwSA&cH{qo9K!VXw!GaR(XD9Kk`(MhNX-X!yxgP|@73Yi1OG4x0A}*Bb--Va z4U(U}sYK8c-fI;U3WW9M%Z#ICI1!GGAQg||eCVej-@~Yh-Bb^uKA|sQS@G1b!xOhJ z-s@s_3%7h@$0@xtPxMUu@yWvHtTcj@wx+stO6z8UceLFY=SuX^>dQ@3rFU}beYQXn z4w9S5c?q(^U1dcWBgtNSk@cwl+cXj>$531PI?2c343zoS@Y->u*mcfxH1&rNT^RAN zgJCg;_{-Uq<(0=CiSZ3#3z&*A z9rK)(ZCwW8vZ%7rFiQ24m^i))|Z2EaF%#%hW)aWwwzqvNl&zgq{#6 zP~>u$aR>Dh#jWo4TrQ@*E1`{K$mlT;+Ojq@k7IKUqUi|oV4-v1{Smb*DCu?*?DAP9 zEITbY5h}Es(a840{MIBgZ#S!`p?qDt5Q)91PGKMK-d-#&mWvJ-tvHKL5W1UWb|>#w zJXSakG)Qnz6NrYbDmfhIFpUy~;6Hn;E=R*YllOV0UOyX0Q zt|qU15nh+s#|8%b&T|A1G-es{`<>mlC`f>?9c0<^vWsqH!E^gIk5eBO0xPYFVBnh> zxRcvu2sAjpWX-~LkKys6YCyqr(w;b3PxB>z)j6}dn6ZvNXNMUZ>%4bKdQ~K1)S9!n zi)^MhvRvE{Uy5=9tYQ2Bnz9hASTIYat9cSs&+TEL>euKKrVz9WZ zX$$%N#27utvaI&B)vdqw$W;R+k@_WuCRPAl6dOetlM{-5b_evCYXA!2ye23>sHg6V zJ+3gSfKInHW~__hBY!4kNsX+^bJ<}iYSeKTK=pAfE%5DL!LTY17B=ZtF9tc8HV(n< zUVRRNaSOH7!O{mD=T&wDYl{m%Slxl_sx1M4W@cokH7qP+0AVGb?Fi;@d;9g1mC(lh$~U`J5X^HU z{9ZsKDGaqEouA6UY#+>UfmN@vFg{@dZUH$X)aE-7?3A0D1b8KoQEG2?RAi;;?@4h= zM=zp)DRc(T{)Z(`#$15wk;^28DN6D_3gy^-r#)sNc6XZq4#Hq=gEwLP2vUykMw^0Q zlZRDws-Q*>1m*JYskQ=RbyS3fAU`#63sVVYk;>K7W!skJnK6 zQV5KBcJBpjDkf;_DS9~S&C&-R(Y{V$+>?nRbEyc>>=9y3r%g2KWEht7u)Z0H9}6B{ zn49kJ`@Pu@QOus(Ey`mwpOW1>^UKOx|2i~`I_5X7Jj@(EdNU^lAjppRc+(g~HD>_% zHCM^fZoE`Bx#6$3T=;}M2K_#Hc2jL^^ezGtS~|xsmq6Uh@cf(eg-5e9LzF}Sbv3a^ z!o?j{Hv98R5w=J55k}y9s+r-28oH`Dfo2;@lk_&wzTU|kZlyL8XLv9c zILH|JbOSap93h~dEEf-y0f{oqUDaDg$3-w%-&m5;4a{xRx#`$H1dK<#$RQe^xGn7Q&M; zF$?#%;X%4VJF(Ib)1%Xde9GQ@$CB=bk0ywcs!>gRC(TArd*&&h9(<1YLz_)Q7n+qb zUzJ{S^Uo04@vq+H!>#@(RC2K`plFto&r30!2@>~7Vjt$0N!#kie^ww>+- znRn1X=gLF@6oV>WuqB|)*qV>B2-6r%-vh3EG0yjxm}s%)YQ2Dd_OTm~`(PoiwDtkk z4G&rMS5q-)P7gZSieP4qi;B@MdCqwhm|(8Pe8Z`UmeNuHzPYmLs{G;%v%yhy{U2?3 zbH?@a!@NYRJ^6708WLznTIUd6DxYPPoUVMU5UKHfJ_z*)PGLQ#+#L&u9)+)^zi1vM z4?>xwWXgRnq&U9V`;nc1J%~~mx$m z_bBSPV(Pztyayt{@z9K*K)(fr&Q;~N7!!6HoCL+%_Vza3Z?VndT@Wg-E=em=?yNlg zYc6Ypm_rhW!okklf%Jpn-B%RU0{tX8EV*N-cOo9|LN^;MIqkSgz6uVqcWCYfL#A1+=Rc89n+JK^JFpm8JhFijq4ZP z19+DSNw*1P;2o{;0tp^cg{)Oo8o|3%1Y+QplLg5)&+^nC7@3_N|AO-59d#Lx4X5?a z?-=;vvzY-NgHefWoN~gLCL8Gj!>%v9!jEI1We<{OJ4xZHY*3ET8;;U)T--Mk)fMMg z2@P&|f21MGusrSNY`3-x@}4vd)W~Rq-zOD{a5|uYwGERouV(?m1Nb*~Vp)gX%w5|V_q0@Pj34I&NfEUltE14ZR*j%qNH^-oF&au^p|PngwY zR^*cN1yEITFa}39AKY0X-hDCD85wU;tULrj8%X!zsxmV{Lu7`Wfl-;`*{goPZF#$5 zEdQceF(ce#+oNpX>)>^&ETeMCnq3s#gwG1Lld@i4KuW?E2P6UKERr1;-k zk7Q*4aM;wo!Wg(6H%-#wJ0G#)6o{HG>La}*!>l-(Mj4Fcl{lpTP4Gl!aIpM196+?z zTvTQ>#Fx5#0MVPAM-qj!7T?zZ>HJx-;l-SE{A5Rk&?{{eW-FK+Kfdh)`^vnaff+{km5fpLW z;Jao_HV+dSEbmpQG?XSFX*CO8A^Ov*O2cBaZ3`6xfY}xMlUSdqL2^s-Jv1irUV_bh ze-W`wy5rS-Z&g|N04wisJKs(QOKH+K6(+_Hon~cWmM&4HbG2&>P(WTxMj>oRNt@!u z(C*FzQRa~(_2x5dK-*9tmF5$WJLXY`sK^O}ko6geo|hdF$id~=8*mL41S9XL&NGUb zlAQCunHKwCeB2|`@ICv~psZRaS#J6za~soR>oA;OMjJ7syzH+%G>%|_d}$+~ZHK(~ z_x&kLD7*aTvy0!aTlEmT-*y{b^twT@vL^g{e{YZH;YmQjQ<MobHM8I#mJe zRm(?6(}AM1nWE2x)CHt<9cl?2#^hnAklSxppp}wg;)j->v`OmNH3e_~N5d|+SZ(v_ zZI&mkgWUzCw`?gVOVnOw8D3?zRTmMBA>8(_Z>Ehi-Xzxd%{|3j-GHeQ`c~zwy@u#M zZiKDF@unkcF7}S@R0{#D|5q!)sy~%+*@ZiwT%q-vIcEJw^>$K)e0tF|mL8tjecJZ` z*eabZ@+-j34V9)fvdTbqN_&#wF0FTH;m*^Co#NouWM76RA2*qS+3(+Lg zKW6}Rl}`q7+?jPJ;M%mD3#yq~VZJ$$Ce~->W3=$ICku(+_)Te5l$_N87Ry-i$NyXe z1CQcrR6!|#>FiuSUNZ=6B88`b2F9bGI};`pT*Bb-Q(WDw$M@ZNHe4*vGx>Po`LsS{ z#M9vbBHXy)B$j&}me&b^;{&B!g6}TzjX!vWeTCcJAc^v(7wVfReD2Vih7;LqmU?#U>o5~LkXYx7GmK4=RpT%fa*b>mbMgM?S7dhb?Vx&DpcJsV2 z@badc{3Fd{4ZH2zlB%0zkcTs*oLwR#0XqsbbSbt#Lrc6LBGOq0t+_BE{GLY~fPjTF z&yTdHb`}ampSM{V&#^9!7t|%bvwfOXl|bOS()C4Fno{gujx3&u9v>bK(V(MA4tc#K zaYLTp9e0QR`7v{krFOPGWQIO>GyYc9KOmpj>X7} z3weAK-G9kMd|qCmXjIysiM!NXy$fSE61DIv-7yS2^+pjl9&nbpUgp*QE6peI){is^ z16>+x9Fw~3L74M$sR#PRJ8vk3;)BZCp#`=_44cc!ruA7$DDebjDW(Q2d!>uR)AWB_ zE<_EQBJ?Mnv^3<--;?KiZMv_Wk)qYYsIE~ULJs^q3qWjMn*4#J_w%oX^TC@0BEQP8Iu?UKe*!qjmQZ zxknIt{<+(ySgcQ@V*OfG_h(#sJT#?U%DOx?&|!u zDIv(va8T7GhoA$OWj|QcCi7&l0);6^=#1>3h8)$lwR z6Zf`*0gZ?x%4=Ge-oje}Otg!_cj-(GVV*D(NcBH_6tU-`4gw^$mIs&xJy)*|)gH{s z6lnbNRDr0=f`wNAG-r-Zi_G40lflNc{gp-J);=Zy=kp1g;XJsTOwcCQCg%^k%td#6 z6=TJgH;&Dm@>g<;({w4(pk&qO1`DLD_HiC|xAFQI!T&F5G0_hNt`dNm{Jjd;^DL|& zK<4x91msuL_Woe23k=ECAc6&yT7OZ>NTD*3QOTfX>hf6z5e6~mE9cEC*xS*JCTuKh zs#week>&{&+Qys?aLG;z-#rCp%eMiCle!(ZKvNeldDPpe2|cBM1T~;}K*7qNM1nxTmNeIdJce*0ZleBu5o##}qxSF0{+F8kc77#avg z3QO17tZTvXwyFC9Nds9mhD=Y|EaZmnG5B<2Hn}yaCHD9Tt`z}LA~EO(JhyJGLb0La zTGS5~uD-Dwp?135GiSq_rJNSI3^p&D2$vu3YPxx~RTh1Y;8U_tNgHxh(^ z7yvg3Klkjqx2TbEcJ^Q#$J+G7Djo5&c%R*HNr@^$8ugN{O67~SQqddP!2nS4cBR)? zh{2!mrWdasFStyYZnG0z1ng&FK&f-O1Sph*feB>~&US#GfAz)IrxyB8Ey^yg?AC?( z?TDxVV3==Apc^~-c*VvVgIt9DVWty$EI}#^yd?s)|2Qr_1yyM_W?Ht^%xQ0G&P=QS zJ$~RMSQwM6==DnxWq(7x`y$RA7(g0cwuPz6Z<<(6la#J20HxFn@ksQiOg#;YEECsU zY}C#WG}K)Vf0epQyw!XtG!5rX23WQ17R46cITXH2+Nl%P1lC4cC@Cr4#S#VlaVALT z+tB1WTw>YLyogQ4Mvo0m;!VA8_4hVjm#uTS6e@e_@t~D8jjrj-)>ga6UWHLQ%5iHL z>iM&HR{9=6#<)9CySLXZubEE2iD*U73?SHOg<;cWKe{LmD3f4ivYbreKL<7QRC*j7 zgRj&4Yrv>QZQRnT)pCF5^`0QP9;MhoW<4tv6~If)PrO9XSt~%%4;it@SFdr>mQtE8 zk+xE0{RY+!g;fk{iApsg5OalUUf4I;?5ygrFajlW79f?@g~pD^2dJ^O8VA5tEv%MeMHcU;Y1z#Y60-V>R;2-UGXBo z506UQR}W@81f=An0-!~PHr`o1nQUZA6YBYt4SeFZBpmZ#MODDJN29 zB#bQq-&uZkS+^JT+|Q~REy1K+etaH7@lKl3MX0)uYUo*X%*7X{j@e_(Dk%&0jyODAM1)f3XUj%3~Ap2Lg-UNl+5 zd2W!vXm3rAWOXe~%I;vRoaguI>UOojYV8pT5ESU>weKAWZK48~t_OSw7T{N1X=972 zf4A$FPs5c!YCE;}?U3HeH-~XGXnV5p>$m4&A!=`rqz>j+3W^xnWx!~RU0H+`0+!?s zyR-_>7CvfL{<1ADu?h2WfSg9nosOU7pjUm^JP>-{BdxQ5f& z;K9FL^!^rq3M)$2k1SCklM@h=*7cf0cfo*ToesRja>Z3x_DqC0@ZnXdu^*{zilaf* zqzdSENXqu|*Pb+*^4T&fgAvV88-4$7HI%HbhRROp^0JWw1FikqbDI!1A#%Wfd?uR3 zhK}W9A4NpZ3~EM(Aw*k43py9kqHvixIZ_8A)~!UI8(`kA~L~MUTH( zINV1#PREq#J2T_9Md9vYsP-St>NgVpqF6)qPupP`*msc#QwH9m|7!)8YR7KD*kF%e zSM%SA^sVjLJ~JFE=*u~*3tnz}YQnLYnbypjyOC9WIGl!UPDEp79JLC`d53}x@UJ&w zC#h2gA(dl5E+!|O(xh89k*L13g*ndyC`^wQEB#x_!0pR*jhUxWmt#8+aph}NOYA~c zT32+BBB`;a9-2fHgzmwycja(>v&3t_EMtt!pz9ZIx-7ObPwx7d9*C1kv3ug~w7A!i z5W$5=NFsTFpde&ChN;9fFOFa)$Pd;wa{@@hMz%3AwBfa3aEUx4JY&WtpQ&)vp+v#2 zqc#S8{l|2LE5=0vGBW3;Vb@dsvTuu|FOKyK)K?44K?jn3=G?Zl&%=iV zV9waD7@*Pf=AcdkV=#d&a?6${hBcl*$7)+I9tysCd@!M9!GZw|jrn6Zj5%+UkA_Z$ z(875E^Yo~?4ha7vp-Y`OR#?Lm2Oa0?ITl-Xo zG_@0D6ap&ZxfeOZHd_9B$B*6D%Bp`>^`!hDAMXl28hJ4Yn_;@ta~Bx#*sx8qHqKb3 z#@6PPat4~L>W!T0z(Sq8YKs^^EwLY$D=npA*cR=qS^CcuQjP$b%TEUp0+-guam=)J z(RLprCpXhR(gkb7C1>>u6vD=fnwKRLG-mErCkS#UFd5e9aBIJHS)I)k2>ngt)5zw@q1fm2X_O?3!t9-jrPb`EJy)|0c{e z7E$)B;7$Y$kq9olDwNW9veZ)|{2hs6Ze9c;bAQ4Frm0o|3aL%_t1^iNHU1#nNR$Z<~>YYQLhdAvU`LFLUK0O9Zhu_!%W+ z%$ZCenwKk-m`?Z>@ZH{Ku04K69?Pr|1(>)s)D<_l+W$emq_>RPF_Wm?WhsMfHp*+-QC4~q&OJXk z`Y;$aj>jC1l=zx%S-2|wK|*ap=>O=nYGfN_6fP$)4lhvX>LU?#Eb1z5Ycu`L-1v%K zMo9V@fs>bXyk18!w;mE%2R>dKmPgMdrX4L+Ooax?$Jalk9-a&OdO~&wE^MXZ_yr3i z2l<88vl{+(pD3_+xx!4xzI%YSB5QBpr&&Cmx#Z|Q;l%ccvUz;3eo5`c{a)=PU7`Zt zhdgU$c176>AWOlhB6_%aMu4(}sTgm3J^;AXK^Wx4GN17-G~Ygy*r*xcA6cj(j*M7l zeoje)G?9s^I^o=84%!UHfIpgNG|CeX`)J7Mn+8N06Y*Y2n(RBcAblPEt7W$G{u1T8 zv;XW%W!_(djA2f3e%kIH4Md?G^9O7^DbF3Ao)(4FbUbr3#5c_svuHi_5h*0yg?fpX zlpoKJ%+Y7fv0@!$gE-Yc^u&^XfTA*)#1{iGt%^qnj6Z{Vd=0btZ*KWvHUY7;EP3JM9_k^&~iGJ#I+fobMtvHAewu> zSHzfa3r+>xQHAg;tR2R`U8W!QYeL3U)%NCg(vi@Am9rX1Woz`VFvA^04QdANLvOD3 z0PW<`>!qIz2@3?G@!R7Hz?Y&)1AD=W@xU&N*3d?aIMG@!sPiiEoqtoQ&v~+~pGur4*N?rt(qiShue6rK z3c+ik(zj2FHOdE@{!8sy4S-yuGt2e1PMu$6Byv-xeIhh7{I(2Jra9{EKre)bYp|F!q@}Q4-llV=GNWRtol} zp#<09y2hz{04X=Nfz;~{>-`wZ5X1~T)zlNImsKaey3Jjce4c8i5qdml_WJwK4-^$2 zb%}h*RRnC}VpPnfM5Gnl6SEqKdN-Mp3h7wipm5f%Z?xt1R@^9$_cA0Ys_cC(4NBS# zRf;N%t?9bt6klVe@9?X%l%iTii^i_R-Y!t>OK2%8n|;5;KaSvNjq@A8M7VvoeuF*c z@#&l&jUm!ExT42Io$&Ye?`Bh=rUNLMICMaJY@TblQNYv-4$lfy`pI^;?Xi5E5ngaZ zXZzS~6YC|GnPh%t;aqkNv1a~&<&y@S!d;u9_0LTs%!EP8;%506Oj-Zj~8hC&GA-jJiC7vveg^qs_P*GP@+3Dps4s-gi?wLR9?wC60_>=I(lnmW$abEkt68 z?R#Pi54x@=(jwNT{L=n|V)K?`?2Z;MOI?ZJeQBD%g?5GOj|6Edjs~yW>d<)SjE&$7 z5ujFBHD(x5SeOMjckR>)8Hm^YM>w%!?V0_lp9Ziwa$|gMgm!NUjMdQARa3yPHbW5z z*qY2svH$q?Zd&RXFv52)tswI7?#w%#s7WX<9Eos6ncmi@!G6(pMEoZJ# z`T%hReje&l?9{&_+E5!+nnMpDmW0w%(Noh%{pFyR=T4BPm_n65l#<}(zc`dUna9C( zl?2RW7Y(zQX#fxkDID*5TDQ6$eaD;!-+s9C9yImaAaP#8K3Wa|gA*^M8Yk*568?(t zttK+=h!Mo7l?hN{gc972H`L5@F(%mxPe<0(0bOl3chRgl|rY~ns9T=+Ke-EW4 z7t?27+wtQOh~ev>v{CaC;Mzv|Ylp3&UpwI+8`)v*Xa0bQz^U8)xb>@SA-2WndJ{>qlI_24Fd9(T8-30ybPPv%FQLb6)y*x&*%0 z&FXy{z+6K|5`&x_p>^2kMXp+3Io5F!x}J%Km(RgR>{q-r9%MI703+xPSh|EZUlXJ1 zj<-~tlaAG9=~ z^l39Ev;ZrElP(5jgFx&GmU^@*cgolPVrO$@zE>eoJWiQ|%{DXOSF$5G^~%flxb0}- zr%ubyme?Y#+iX9z3I@!y;jM9PDOm+R65qj3M=4vQcJ3{KT7-S(v@hA&xu>_KSL_ns zSs=fiU>0qrN6kH}a1mBN{+W2Eg6-oGL4pWe0aluOuz}f;ItgMJXzBxAGqkUW6tr%_8evk80ze1{`sQ z4vnpk&$as0a+rQrx`pX4Iq zZbVJ)$x||kF19x3lnY*rYIKcNayc-UwXs0H5APb~a#*nFF0|e%Z^vCId#>vtxD~%u z_R?Ol96l9Ykp; zMnaZXJUpsC_{r>X4Ox-sKAjDVFTlt?&cJVVvSEolt4uBOff;v-l51A{iq!MW3bXbos#8 zZ}Gp{IK@?==3#PBw1H^@EGNjqNRMWUqiv-JU0p^{h=`VzZ*>ZnCf(SY_cKa2?4&vN33vLhBXlC0MaVM?N06}>euj{1p z;79I%T+7_@iL{~n+F<8(C`Iz`q`Q-*W_qh#tbFvNExScxmdTx{YxTJ<9BIXHWhpu> z=&_ERnJpwE-zY%2A}*q1%t>6M*j)??%JvxuZk2GT7wGxA{s!@$w*d4i4M;tx^29>& zW_gE}Ma%&K5P~c4^ZNfy_CO$nxJmPGxd&dZZF2qB%gFxIIU2;%(M)U3$cqoKH?cB9v%Y&L445Mr*rwZAcR2 z1&o)~_K>~>5v954=zrzI@~gV^Xeo|Y5Pcv2dkScSZhYjuT|rVvP8~PL*#fPvS4K3UF6tB8trNEv*68!dcr%4tEgk#@pRe(VP@2sEM=A|IEB@v_o zLh1bw;mH3qhJH7DkeyB{Tl%~;&iWHBFHtJR;MYJM!0lTHCoqXqnWvnOqnAtFf%jW= zMgpf-?43lq^^AR2vCGa3u7l{DvDIz^5Zsz+@{6G%Y;Ho@eE4XFDopYsmi&Z>g;yPD z+q{&r&ATN~qOaOF!h4fkRP1{i*LN;+R7V!kGaE@t@N_EPn@U`3)gKZ0&Wl0F)TyvE zhHTTy2S%!nF%br*n-AfN^Xy!>uT6NlHgkt_MChM>IUdyu8| z3S?0G!C|-=sHr`cnu3uoAT!dvrDiR2amv*X0f}qx)K)KU`HV$u7PA@(t21L;On92k z-feSMJV?csWACEK&8*EE7d~JKR0M*e*<2V(=X4;nVuRf6@kXDkhNZm@VBg8|g_tU& z#*CIR1;Xs4>2v#^w^{j(&IEg;T7hwC-I?wFrCz6K$F0+d2-=0+4Fdhln`^f~Z(0Sm zvop;b2$~JY(uBv&sQB(@*+uY7+Pug+_nNG4jU;|?Y))MDOH|_Ie8pFNw*Z7D1h8U0 z`P9J}@9Ssi5#onqZif3q+pD0q@nac`3xBf!_Y!xUbfLqY7k1`Y?6Ydq(+5?*&o@z5 z#4uGt@c$*UmTFve4#UOUO>2IAotu(; z7{t>!b@=26G%SN6ltnfA22~%$svFU{Q>blthUC&op%3e&`f02IH9%al8ot=9o^q1~ z9YZIIK6W>a1=zt3_TDGktxAt)R6*o+hTaoB6d;=wo)0Jb!W7k9(sRPqDJ*=ZV)eWXS3?rz@;+*gJ`yQWaAv zTn($jEYQ!ZqM%3Co>BRUd+$94aG$w&6HiBT-DBg72DJJ8FVzd(s8|p=tg4z;_4ur4 z(<`a8KQCVLX&nNqprZGQ0E1vEHOP0e99=szU=EiXJ2=cpg^s#|u0__SO|jZ~E@5$S zvC7=r!eKSxiT0ag^C&2u?)rk+(PGWJyD7@KOCZeS4MlT`^>g_i0^pvMZxGJ*bjAoj zltR$rFt((Xq4)@KN5!rzR}gn~z)e%4i`d8l{Ex<`W{K^j9I-{+B3mZ!TUKfUB*C zg?A??o87OJ+Cc!hZD$+RL+P>qCwy^XQ3jiG(Mw1(gROVa`}mC;gv8mnNiSJxJp0E) zDuQx2zyYSBKG_i7|H2cVh#Ce7PYPp={`gY5q0^#R*ouHmT?-Vwa9k=@(M~AcL26{# zr}Hbm1yNm}XCDZqR-eVWCbfuZs3 zHysA!m}H7Qjr*T0TlP=h6xnF;8n^PZmdlrm|MU)nkkDJZmdq)yc}Oi8&I)08eITOQVSbsSeN19G-AiwwHX-(s;_V@`K zkeiZnB#h}Hv~JHij*31SMq-=VavtrEKU;E`zW?MH@J}}zjk|%zX-8uc5;Wi&m@MbZ zUoboqY^T9WJ)ba%7>Ja>G3+ZsE4-WwT&{QFtvl#X(@_TNo^rXtL;c=~=jof)J_lU@ z(b_m?XA)W^C4E)o5mL6+vali)fZ(8A4-Z9mc(`dHN4{)UgIm)y`XaKyczCCQ4Br%v z>YeZ#xvB5!Q_X{si2!bNy=a8);RbFX7RmY8qWr1qVtozU5%qU11Ok!y?^`K-P;xa4 z%}ji=a0)qugAjaVH^(UaOvuu#%}cjSU+7B!ok(nM&lA#djyv0&g*TU^ zkQn3e&9)t}$J2yQA++9l{}%;nD&E{NWrJ>GkBc2Z;yF!Ho``dd;WxoE)(v-zM+I7T z3ca6ozO(g;t<{#x^Y3NH!uWyIsLP_6ce?ZRwu8@_OtAiw4X^4`+B!OP60fGYFOB$K z2+#&V!;zvf>xP61j-8h`FPL<-N2?3vw?ybCJH_Z<`<*L z5u{K4>x%DWE>CEC-GI68LAdj>RQWaWdfo<-A#Z)itQAwzMOyAa!1}*Yn_vA1*MMgk zCT_ECqZxT!%1~zHy3ZN-r-+#vo0GDD5ok)1>W6e#Ad@DO(`R**q!p)P^E$FG8-BGN zMEj)}K0OXad9hKGzP=TolF<2TfEj85l0E{i7g@tRW&)LM{?f&>OKvS@WXtOMgbZ+e zO&X+CXq%#J@V-F zSc|5t{QR9t(gG&)2`)J5RM3N;6|qf1H-GaaK)Ja46$%Jq8xYXgKJfL18@(gP$-nV} z>nd&Dn+X$nZ`WSus$98~Fy`tx$Iyvvj_do}Kfk#8jy_umOx6WK_TG>mLlW-zQkM%Dr``lBKM1o8sLjJ_5In5KP+{!Xr<_5nJng zlf%1Y9r6~vV3@)Dh~89Q3Pytp9|KVOLR+`vHY9{WICE$}-;u`4fb--wUwq&A zeSRmI8VV8%C9E_KvzNN-L3Kv!d5xY9DyQf#YweXw?+WyLAfSxRef~WeZPYnMXBze-MOvYMG&wJbc=hrZ@^WGIM;kZ({HiGMyA%njfV^w@HfX&>>;Moxb;B4oO|+d zY{dfOiSa^T89q{7gu_F47Qt5hn%Z&#!sj?S#Ee+8Lc|JrXw`vbKd97`d^4}ZhbWPs z=^rRq_L$4XYhRDxCU2l7REpB&~UKJ|8&hfRwBCWh69uj&9 zlxnA_dabslmmc3K3*~U|0=?V+2ky1(k&skYarTj2DxGVXG zOVz@=4Si{^$dJv+jm|_B(%TghF$c{rzs;fLWK1y3x=pgdUjlhECe7>vg6I~vWYz?o z4d(53u_=+NOVdD-${GE{4a%9}^BJ9c984p(dDkf`609`ly)Xo@z*4{}NU^bW@_p^W zZ9@CM{zHAe{Go)v{XD1(qNfl${%c6b$t~*&*6*tO9N51wBYv&|ejs{B`ZJVUy}RmC zMY!PoB2_CxjsL#GD?$73y3mE{$(95g;|GK#@N!fO_kat`cRQusw{xXH>@JMmO(BjA zv2g8sc@^fW1(>gx52ZX*>_M6enj+?&Mb?_nls={eL#49AE1m)`(|pp98M78|>xD^x z@#zxfN!&Uj0d{z#W0M=SRF9tuG%c+M%a&Pa-sDikDvpRjc)Zo<{92gr$E9oCq6+EH zAyC80iPH@aCLPOTC)+f%9zS$qPdOx3bBTdrM-b6sOg~)R@_hPL>sUvwF{YKL43MJSP2N>bzwRk$lRzMM3#JxF#v3|;c2GPgtPCTC<&+4qb3-IY8~3wPXZ&qFRR-Y)+_)JOY~D}t}n{_R80Ng#O3 zJw`@OCt#SYWx9`2OA)hz>S|(xr%eXp(52^WFqBp zoklH{5$8UI@wj|ew75*PU`OMSt5B~d>6BF^1eYq8%4b={J-j^#{8_!q(a6j?TFv4d zVD)GTW+}~R#}~swhYk_whn}JMRc`8mLm3Kaw?KWLg+=`<|KdV8`y1CRFH5`@+Z--c zr9m==8WEoVhBOvi){u4W8EF{$C4|8tZHKPsezg;~*rqQdttf>3K9m&4BtH84uUI=V z3UB@h=c&k|*~gpzFGyU%@4Czu!RI1AhIlsx{zKc=8F9u2a%iuP(3tHbb{cmKjZ%GC zFDoSW@DCJ53YOV66u5b}o*DQA%MeLaUKC5?7@06|>r5V+Gv4SWv)~cPxhZ*c=QKSp zVZg$~bk*D!GW<-0P=bIhHYp~%*9?nYd5VD($56UV|&5xFk!^75fW6COaa0nq>9mKSQJm(%!_B;AQ7N(?}2 zNaFvhSnn%pF&F4|jsdvW80lI&{c-2;04VGzockDn6eyXodL0)3XY=Luk83vLwSHe0 zY9$$K8S|mL?>=F(BS^=fxp?ymNX@%vxeaato#poxD z{N#CakK6-G+1;^iYR$o1_@zZ7yAgZ*?$WQIMeUK%w_%P~Z&C5>d}MnBl(#rOtfM}r z?g2j&urSU~=H!}EZzANIDcU&?O|t>igSh2gUTO%i0V-g8QFiA@>aBd!&u1Yy`X`8n zULak8X1=2?2hI94g8NAlM3s!5e?Nyad(c&!`z&6Ko(mI^ZHH_A-B#l)(la!aNT9#m z2?;%%Zgg#_?i#yC^Dra1@mCdLNe!MZJ#H3DoGy4g10*f0>EO>KOw3hOz-+*NHl%N; ztTy}4v0JZQe42q@^}JZNv8Q!V{o&d5p=p=qgh-rIRT!S>=lxII0FK;Lcwb3H+izc^ zzxD*zSdr}=ms&DHBaO!1)5fkV{WU#8P;W+MkV{HO(fr|Ls9>LnHbeRysfoijQWWTar?6S6=r>~g+efI=LcL34qw+td%>9Cr~!N7Cg&OjJt{u{0+CsRG2_`iFv zx*sob)?mw-4?70a>eq^HDN(vKnGxY0d0wPjB~0_Q4;%)&tQJn;9c>hgdddWKYY@y& zO07Yd7GG}Oo9{e@#CDW$E$NL$0BaRfJ-+w9G#XHSnGW;dzPZ&yIxtPX-B?9eMI z#(iYMC=J*!E7knV6>@e7#Lcz_5-lHEwuK3u|6#qwAE;c7l@i3xr$e^q=c*|>RtTOC zOWO?AERq+F6-bZl@cK6+Y?^fXt#W;%s5N<94^X{iyEGe#7q3KVs(xYQ3)2X$E?lz zLjqM|dV1Pl_IgUn-^hH~#|?s)E=G|?7O2}_5v!AZ%x@94;mgwo8b53vQ6Hl?g>OqLuG`2n&y}8sw4FQK?I8Cktw@i`%48+JsqT zb#2}%w&q!qJ9`yQfite6b!s(*0V!-tLpQa7bi>xWps#Z6!=mvO({l^~>`i=q+*=v4 zj(v8#9O@!Z6&&qIiSeE~cwBKwt%T4DNh?lxXa75xB+DBBckzT~6Y}KQMf+*;zg6%# zFa#(v;COA|KtT1Q7H?bh*Mq|nkciV4^{(XGJq{ytc@rItaO=xwv57;xd-Ap+4U<}^D=WXC0xd1~k;kQiSs%6K#;ovo%x<+Wr} zj#b1LLUeHbd>s|mAB~dd^~E;+&}GQ1G3#MPb(5f73Ez-N1tP1*+v{7;l@1fTx3<*C z%*hS`-?I~{csY7UNaZ?epn_%6$2nz@(1Xg|K#So-C@1fNeg)c5RR}6Fw@*5EZl}yG zceab3&~zR4V`<_lbM&LLo%Kmtj1Eh}Dhy@X0?Di0T~LvrEP({-OOOO{1R);6^GyaUE!mgc+m8Bo;I5+oOvR z;gm^swJ-j-v1&|Ys6RBg?4pza9?^xa6zPqTL>wmg6jz6B2tXqqTL%2H^;=!f=%b(E zt;KegowW}IQ$VpIE#?G|i)4i^`0eb`Hc0RY-fp&@-V4ZK=MYynbU+nFW-NYGgA02N zJb*JDtY8U7QxDiQ=t5Gwh})N}L_dt-1VvY6vx(uQky;2xLRp5Zg?MC?&M~X0V&!dL zJ$^lPH_L)Ji70lhz%=Jd%?Z_6aN0Zvw2m0t@Jx-_pGU`qT(cJY2L}cWard#e%H%8kt?O1) zpscwfJlR15eb1xS#yegOz! z{jWHbXF`;_^I(jshIR2zt{{zur7c+o7pYEsNAhD_7(d69Y5Hd%Iq1~{PV+qX@cWy} zOSty>;$@;IeGKw3S_9e8Nk(Z>T?h~%9%St$Ys*q-QD1cysYm;X6jOG@(#>kkJw9T) z3+*EsQKhJBbnpd3s*e5<^gAvA+pM`ZQVWL_TZ1>5<>sZluDgQgi@sN9~fIja*XXz)7Gt0PUYrVYvTqNA)zc|M)jz z*&Sn=3|eRzY3%M4h1PQbGfiR2+0wA^Sr`2;ErObx$u5%h7gO{8Xq;z-dAMJa9IHze zw=9;rM@AsWyJ3Ox9TrDax5P=IvVr%t%FO~PV2^nI=W9g3*5B#PfG3eHxU%hP!Rozs zTOC$WjW$>CP%F<3H)^lglz;wu8VHpSAOtz*Ul+^0qM*-d!w1pP>>KIh6vr<VKi%rw-ob8kmAqO%o^OwNI?bjwcmVnA#3nX~CCrDK@CmJx z+$^;3>clF5u_~LYr^!_Ot{j2fsDk7zCZyDqkY?+B3i?tXw|lj4U%vmE!L>MK?Md8S zfJN_GbgdIAiF%W9U}N1C2>(&Y+e#Y1*)H9?KQxEe3mlNmF}T0tVc7~CyYj`hCCvtQ z=2(~L_#=%cZnx6TUMg=3VA^PS;r)#lbcr76S&AYM=llFYD7RarRKnZeKwrzQ-stKw zG(-gkgeNfy39Bhtx>`SSfpTr`i#y27=P}W>7tVeO?M@p`+3rsL-0g;wP&UH@q%LjT z927O$@rc&il0R8;w177@ynS{osj~GPK8;CdfC{lAS0RztxT<`$Vt4gr?g)=bCb=s)>FNB z2F4B5#fDdmzR+BH#2J8-Xa%;gGJaZfWupb|=%%oCW`P>==U@0p5M$^*N$Zb#Q~>hn z|2?SGU1G1@jkD$XoFVq%8J`zKAoOwK6J#nYb=fDFg_TTuJBZ0|v<(Yvq7E7%rM*?h zCxAe5eG58uoYT2cr4F$08&3_pa!<&G%RgIeXB}_Jm{n2Bt|b@zY{Pcr1X#BA?5h+f z5}dnW>+ZkcM00pWevppjyL~TWog+%?Ja^dL*;f-X(QlUw)Cc#fh;^sb514CIT4*0` zx{K31XOf>_tf2ZZMAuBs**oYFNyw3>U(Q?2%v<;>GCK7;%X~coDDFNI8&+`rj;I1g z^0=n|e#l@}=c~yj<`B-27!A!hq}RccvMe-1cWCH&YGC&Q<_tStb0t=GVIy~5cF$QL zRsLqM9iS)BZ(Q*RZ&Kx89@_@j{6uH2xef#>#aeSqwUNA=!kRDcL@|Fn^{_LN;sa>Ke~#h9Mu2t9AHuC@co?0t~$PyC+WCXz9L>Yv0q&d;AtTR>?X| z)>$Ao^1+|j>>5^?dM881DySX7F!d}Hu)9^bZy#F?~0xb3YN5(yi?uWlb#O*pX6 z-Le|zH>={otA7z=mNqd$&IT2NB(H`rq5?J$wY>Ty-2iNG$EUIFcS7Bn^DMKKFOfRe z6dkmi&AK>=kn?@yo^S+J4U(MBB%U?)OAaF6@RnLF0y(f4EJU({y0+l98V`v?{++F)I{rKm&?H7gqanPRdU2rTl2 zbdB7W%vHO4kjW4g@bPOBGs8v)H5%6js@X!T2t{pxR#4ox;X3eiOj9;oP*YlhgCY=7 z!a|se6~&>h?)`XEedGJHq$~)L;>DshgDazTrKx*B>xZ`?HYcHe>RuUmeInpwkgqv{ zI|viB5M`Iyt%J6w;sgxvyUO}0T9fn*pOW44JGw-1-y;`bgO_RxJmk!^@$opY9^5O| zU$b^%=x4Gc&-Z3%h3SD{-5in^edWufY-kP)@@~wO?GW2y2rXVzD0USFRV4FEG&Li< z81k%#)f7Q1HVN|$*IXYjL>?_@@Sxlm8?TyweMGOmjqr>D4WiG0vU9IZU3j9uoe3Ia z9+Gpzkx6=B=a$EV+%IuP z`4Jx zpRVGpOND%R$^pP6r-1pO=aEbiC4P#F85|9j;=%$it%!q>3Tx4OmUgZk>bAn~GF`KO z$BERa>i2`=;4Uv3-(}tb#qGVZ7Jp2vk0MjIRken&b?Kf7uHTA$QnHrv+%wYHZ1*;+ z3vdGGgAnpbQ*IR{r9uthX47OFDza?L0P^$()z{wd1N_GA2yiR)X5QR6eNJ}+$LI<^ z90om-?-g&IsbW&FZZEm6F1N4jqXH#RPTIm}BMDnDou^vJ1TD^h22~KP6yX55NZ2H_ zHX|@H=dx~`H4t4A101tPsKe$ypXapvoZy1~Phb&%-_{_r4~QQ8`BZ3BD#c-)}UZ@ z=uaLaZ}Hj*9v$b)^IqO-bM$Ckdq>(`RF}2e?CO(LePe$3!={)VrxEe9V0#yU-@Ke z9K~I&beENyGMTn$mzV3m^O!7RM^*G~l$vqYU_0AUXGZLkDeq5TY<(W|_fReb7a-V4 zI;fZk>q0G3$!@oyF#EH=10b7h~Z_v`wv&B<_~qycelXCiOy?gaOoa?JSo$m{L^p zD4|M>i(75T1N;KMaamCvLp%M!CqG=r%7jDa$qk=5x$?5gJR&)T=1kUTxj2z|^B=ZF zTO_4?jUqzRF!eh|aaSYsiMfYMgWVfr1+JH6I6A5&_lWWah@sT(QNM@!=m>3x0=tm5 zIGnYPO7J!QW9y7$MyfYkw|9QFuU_$!l}tToG+jCuaZ*LClm12+C6fxVc{kbxKzvR$ zqEw!ybjpoT!AMaq&kW(GNh&oKXE{J)J98Gc>f=yhRn{e;jDCb%C#yi%@k#z;S-IUB zEP@ldZ66L{NmbNlwG=kc4fwRGs6i~7WmT>s=s|aR zqT9!iT16eqkiru`oU!%d;om*gq{~BUdqDKihW}MXzh;PdKcuCZ?u7-Q?q44m@7_&oZDH+Cx|I6f6DYgrKc3s#i-27 zM4nD_I9{`!ycqHRsV^1Q4A|Bz!m@PRr6i*c!3&TFkAe#+23ST~Yc0zHpdSisEXo+n zWVW>I=2sXM9k~rx_BOxHnbY3IO;XZ^_}fyMQqNhQZ^;UX-;0P>)lB zd`fpoyuMPuTVsdke!dHlmSjgbiBT_sV&;I?^M%#Pos5~Euq@J?_Q~|#)PL}P>&MES zss*tEd26Tvp{`F;PvJIx8?I~D^xQ^_5+xbzsG+OiG~m?Gmrtk*yuSQ3JBT|JlQ1uZ~(?X_BP_Wpx%E{UsG#9-tB|#Ac8D; z;4!^oz7+}1kWbyHRFIw3l^rqO;llIHWX~#a-y6~d4j2I)mK2m_Tb;0%N*e;UZ9$3u zqO4lZ%$}d>Wp*$U{2ZR*418LGEQ@yDtGtxlja;}cI=^4H*dj#&aouAmsudCuD+`vY zm>rf)ZsQfS9RRIBK2V?4nK*#d8iMF8e71oLKe>wP=eV{Xt|8G!nBUcJpPGkc zkmIl)!ErM*ntC1kSeZVGarhu=O-d+A;9{_=npiSmqak2BBo>9Usg;u}NQo6&v9Znq z<`wo7lXu`Oi4cBPDgQK)>uxjTFzH0kx>YANh1Os@^7gZ`jPj+clQ6*#H`Nv_>^b7F zqXli|qy?^O@HK%U?g*vRyzVU{IUB*S?h}H?X%NYpd)(FUDSdm=?dPw*&~ne8r{Li+^e-p5URO6cA^&*VL3=ZR z8^G2mi9pjlzUEzsKST57OmtfxZxcg~GJPx<_3IrLzdqI0Y_RbYtAmi#|07z&FP#E4A~9b`riHhVI?VqxQTLt;J$bnpFv0XyoGWMB=wQF?}|NrTOiME zsu*tWKfGJDXkuNb@;JU(gXx!Mz*~d2WuycscAgdO0>|VuJnqU`Xp*pZqH)w_X9f{AKW#x zWpfOho!CZtc*!P$ORnr9@4@OSVD=MrXJ^d+k)#+Vl4_f2j`n`#2-TQX`nCqj{OQwX zk3=up_M5yn^Hu)!OPNFrIkRXOa&vHpy!H&vv%I0HYP;{^d|8kM3yMDplfEA^WGi*w zNsJ!VhU#i?o_mq_lJN~8u7!{u8)TVg&iaQ700G`QnWM0ew1scZ)n- z=Mu;i7o|odkDyUC0E=)F?T@hEP?-W68xRz!K(z}!ZO^XPVy4XC$F8c@rJGYfRhe>6B2(9fe-Rm(mA>Q?(HjfF$?=6>56<29DzeWX9tvIHoN1FJPA_x9sMN6gSi*=+g zM$PQv1tQAEW|FMKGEPEdf@`7z&F=N!XX&ZJzWi{~8`*IjGMFs!9Q{H^j1FFr{Sfuo zrXrg~e zeJeSrR`w!(5W@YI?qlV*r+5}CGW%cYW@=Nr;^n>F4k>+XpUHX&l9zvYZW51P&||GO zu{2$jC}}-XD7>)D2YBbrUU5Pu=O2SYJ)FD0tKLe9ZN_>_RxSLa(WQQV^&S6UCd#LLKAupYaxGe zx&+_U{w9%l3eEAT%L4-rp2VadtS+V<tT2h%zN(Q-gH*`Hv zTAJ6ZKAd~-5ezmFcB4zv@+ z=-SHgO2^O?h2nGqUtLTtubcQ=)b1k*ufEV|%jqVcM)R7RYE`rMt#7rc zC&l9&cQSR-adGvcMm(J-X^`PyNU4fz6_b(z@MEKHcA<4PsZk9nER!#5}gG>!0@wH04 z5`j&cyxNxeDfa;70r!Sdv=p}~LMap9R4+OgF5-Dj#=m45VGcvCb^)*`s3EA;XIwlM z`|Fi3Fd3kP%a=H#kmac=ed9cAY=f^SbRV7M<|y=Yd@-~6Cz*e1f1X?YsIzr1TLjbw zEdA`_Yn8q0D4H$r*73+B$Y>4KfA}z*0kcrHRs8$y-nzNyP)O|4RJgQ!m-7mEK;+-x z>E@d*93pUmZ#B2-n9;dL&N|*fUnB9m#DB5XBUEm7YUK!(`q@Py9b2IO5tn&{4r_eO zanuas)eGvrOCp(ASyp|Y|8L43ilvP5DvXjw|0>wxQ#KvHBS8%JtzG{cR=+^kAq6#& ztL4x)eV?wd2xWWmFh%d3pS?(kJ!_JO>jND*YzFYH$%=LNM+Yy&x9z+4TCnV@%}7S) zh&MZ^sy+v-1kBRn$(~pOMFPqI)-Y}3Fw~uMxPK&joXA)57{JH46%d@u#Ueaf{S8pi z+O|;KPHtwD=$$w_kbM&*XhN4D90>PVwv%!}TXK=27G-)5-?gz4BYk9=>BhnL;(^gu zD9Xs&{m2#FdnE}$kFiZYuz4R#$aHh6f8K3dZ%h4R`tRGReA6Gh7wNy1Wc{wPpY_&K zWVEF3_<^exdGkux&TjhFrc{6G?;aLq4u2T(OE+lBw|!L+67d^8GO=qDwnRH?qhfQ0 z2(Puqr@-6>Rthxl%GI3an6q_&ejpXTi$B;>?P{Pw_8WgXep5f-XBEnVN1YN3m4fQL zF8@30EYI}{s!!TfeB-V7Fi0QtG(|Mz-KW(Va1u4NwFx0Zt(J-lIk$1|{_5orE~-I4 zj9EVW%Eu#3cB?>`87A|48aPgB0l2xwmGFQj=JxQt(XG^27qwk{ z1xZWzFsB88P`uHhXy!(|YHu~;;K$hgDs+AbaX$s+d7Z9zWo4+6YA9L#NY0DH7Z=S( zEe)e_3WAZ@PCp$hN3tSg9^xNz1y;<9`YRh8Bdu(^cNwColGb!bB|^BO$xI{Yxk`s2 zBkKq3O4O3w(#Ay_KA2n4{rk7y{;^Hmv9J7@Z%uwO5H=)(bkH|!HvztTTRKg}AJ3Ol z;fE?WP=rFk#$2s?xzyRUSV`g(_}Jty*g#){PL;f9h45Q6T#JufR7!)7E#$I^zv>sk zZ+Rq|z9-fpTW}I^A{luI6ZY~J@oT!nWu4&{1KR;9+Y_zbP+O~1!}lVVb^^YGET zVRtpYR9br^S%z?%x@L+O=%lOBXz?ZV#x~F4YXuDVP+R<8lz1fS z_hEs-j;P}(nBuUN6D|CRu037m%rB3=ap!Ac{JL#J!+}TqrO5rHNH_W0Z7_)o;7Ljh zDPasM>XuPFRTBB{5~<<)H6?HIf=Bq_2KnM;ZfUK^jY1C7d%RSj4>qPy36a7?@FIJ+ z+`jYFhwoVKcTV7@!Ow`uO)l?|tO!upzUWrtR{9;?3cT>4^Tx#OPTz4A(pgokFrTsy zbR(x4O-c0rh^Xq}J1vzpQMyZx^vsi>ZF=|1%KOn%7ppv`IC!q5nGzbcnbAWycVbyv z<+r>|i+96O!myc+lcP#5!}T04avzs(veZqfuavB@NwX0i@@4R1+%P+d$&y4}q-HKI zowkisrtb)i&Rw%Gi1Sa|P6uvYw>(l0-yASptik5Aq_uHhL=m4?wF{zIzp0nDzYw9q z!};UPbFTdecmyc+oC$f+uD$)h*pbrya#F-N zy7a9B%>t;(q(UGO3jc9!&E(mn6*uHw!9q!bQ%r6BQKO8oO&0G=4S`-1r67$z7!#HJ zd$tfNa9N|kWH#zDBRrOd`uAylOCPaUJ!1Ax_SL>rpsK_8-l0a}d0rD0T9#|p@BTCu zKNo1rIF|+sdu|Hf`}8|8|1R-X>crJetq>gU=W?Z}jPRrJUc^S<26CwD$ZDVOMq;v^ z=n<>Y%`muLmOUp~N4f5SZN`%aqzf>Kl#tG01mq#3=@7v?k|CgMOu*EC37rQ}C)%jP zMdR#Wk$Z$X@D{Wz{JgYnvIGM`N6jGX0T)Ql8UB^I76{&VN6^FL1|HLwj-g&%yojBQ z!Rdh6`IXl)kYuAf2xMf#oAPz7^wftEr>$Hb}iVmn{D&M2p=YamsgIE!wq_7+M zeSWcUeK@1ALyriMfh}mQXupy+*(^h-e;vA+VkQhC2NsUrF3S9(P#%h%qxM(R0l&hB zH#jP#)QM~6$yn(Lje`_(GH|NTx^z-tS0=kf-QkC|DEko$KhJ#ymdj@am#6JyZwe#h zGck8a&|xaK*vCqO8J4ZnC|y}=AgT9sl5`kzdQNnO6MZNoR!_oQGe$f`WZk&xQ)};< z4dy{A@!)^)>qWo<@&O*!H!A!Y6K&Jb6d}fH#2Ps0%aK#><%iqk0oR=2pcuj|l>B)6 zSJj+W*%pC=$|msDF_Or-SG)$|S4}RFT#;0RlNy%Wm)ojCe6PuiOy~3E17N;d ztkfH?iZSN!i%llsGi`au@8Cfdr{ShI6L)5I9@YcgAr1d9<|ihtRaKW8;Yh95K?ms@ zKaX0qwWNJYn$+H#5T?KgYv@M@QwtPrI+zVuz-<|__vmy;@8my!JUc{BO85gy_vaSa za0o8sKi`r5lu!m4?azI>C*mjLzAR4GaSCK*Vnc?cd7Q#~bDu$h`|YGf8;i zp@KMwN4ByOnUk1~M93w{wYXp!jA|~%XLu)d=l3>dwV{!CaO3pN*4{sxfze>RGGn%m zcrO0=*0Y6Lk>@VQ?X3&_xvDevC`AO>IFK{D+?}-Y=Bqy@7DAL(Rp=D$46Z1)w4o8m zTl+f(uy0EDzHx4IA1c^Iqt~L4h=Nsw0}+EVw9Z8z%dq* zo-l?vq4!S{nIQekQD^S1WHYdjSifbc4F4kB2*?})y9t6h=3-3{g|6O{$9Vq3IC>mY zYfqC4_i&F$EmClJ{mvaC^t`%NP?p)2wdb<0cr4E$Hv}_Vguq?(-M>B{mqay9Os?vH(D zs1Nb|EwrmQ{V-zkucwoY#Jm#Mv8Q`ic|28VcHILowXh9)ZjYsLo%gYG8!Z1P77SH+ zgb9^vi~CFSl2dKsg8DMqk!%8BS}R{6aOU@|8PVpXi%%2zm>vn!oMlldES{$CX<3BKE=Bieg~+z zy1q(T%|WOPxhaAiR)dhx*volpee*X>Wtwtq2JG63ZjKRC%?#XU9DS};+k=Sb=*{uh z$Rm?)fCl~tgWo@&JO4iQYpS`yCuG}ZH*%X{;acCJWt@!DV}6I8kC|Q9H4v6N=4>oX z|4j!Q;=-?rIBY63U3QiSfJS>56&bo#j<|4s8vBI+B_15e!)s_8K|T<~g3R4Ib}x1b zlj0g-1UiBEWgj0kNAsZ7MhVN?Vhq&~9hlTAatfZ}+_c^91UBI9jyaZA&C6V7BRn=z zi+)Kd5~L%v@#)AyLYJ_5y@*q6oMKvC0`ZLSY@5JG0@}LJs`LSL3NpFiyAG6cdl07x}@{U$7^qv%5);C z5(G!q$|G-2R;9FkJ}x)}vdaB_h+#+8ak~0_AeDT=`gt#sqLxk?T7eQ*VnEIeavNEr z8=Wm>oh<2QTMe!Fh7i`lVqB@kLX=qEfKmwWG8kmn5?9I;4VkkFGbi(@k}DnnsaEIX zKP&;B36k;MM3P^6E_v=TgltZBjGrEUh0i03y3_`SdOs&x&`tk30ceK1Ju3L@zV=^K$`W z!TP`)R?|W*{|)cOx}{S({F(3M!=h?;{tUvSym;Ubw@JJk?T}I#Q%%2xTP>a_U8bo4 zUd9Hj{fnKuO#-`>Qht9)N^S1V(A*?_NUO)mDY6iS_WtAx|jQU`lv-> ze!W!R7dONa+*7!$C6XF7e=!(KO96u=U*@kJN)ch;P>yK8r0HJ{)4?jwHHBbij*iRS zke6j3XZ;#fUgBtG(opUQ(;T41j?SU1z@tC|5+s35R}D0l(KG$=4zj^iQbk}%7|Ma* zj!J(#n4_SVJb>u~bxzsJexd51i%!AcWw`B{B5ItRHi&^FYiH}k9a<0t!9HqR>HFelD|O?uF9${qJouxzlDvMQ(FKh1!G?_ zNv6@!91tw-hE*0M-eirfXIlfeI&7Z7Vsi=)8kaSN0fv1I1e&+0+v|vM=FefZd)H$- zu3=Yk6Jv;f|CdF$IQh9nVsb=ms=S>9oU+UIm)#@*alk;<#n{r-0mvMoIFBu~ky!IY z?kIL;=w&`t+3SOeSh7Tl^3?odyC);y6 zImz(-rXB+6vLrnFQ0;NA3NpeQ(yLT?828=k?D)GJvC=rN-Q{#eZL2FrG1i`ka>m&I zJtx)P=7j2|EPSkR%u#*p$dws5yV{;o1sN+rfo%KYG=qi!ZsLjWz93p3Tm2ghPSQaK zA5~7rp^lBtbD^tFV0Tt(PsbSZlmA)6-Xf^x`H8~6z+d5fh1_uca^fzpc?*A(*S za5N`eMK3DsZ6%Ha(dkz}!~{}G8Dp$m9%`*x*5TvXKf!aPlwYh|AXY4PfzI|dE+oTI z?dWp@;9P_c;=c>M zun(I5xCOGIXjM?p8`00Bn3^Q%x(27n2^FQak2tkn3^Mz^(|z=gXYsr-0Md5|=m9YL z*LJI5_5?@Jq7>_O(uT@BldMqlW0%wWj9pFB=y+6V9a9U)euUj0X(7g-Cf{t}H4vtk z_gx{65(K?;@yG!q2l-C8b>PG$V#}8BQq5in6!n<)QzN}<+%_dyMw&Ggf=u|A3LFbe>xDG~S)!G}8gQ05sxNQQKOPvs@t}W0I9Ge+ zU3dHrhCz#uQ5HgIGn7c)(VlXWi@L*qwG)T4uViAjsn@<3<$@c0qB9|N9CCg5P>`J% zdg_HUd8vsdE_8Nj@D63OPFJ&T(LDbp7D~NZ;%oUjRk5zR{<5=O=Y7d!x0>B~g(u@o zjF!SFA^%0mS|w5ORScT3r^O}mo?Xw!vijE_e!&pRQnx5h%N6ILpE9fun5;ku;YK6J zca|~zje82$d@BFg_|roYooT-tpyf-d%0rN$(5h_PoEr=vxjMVZ0R-icBr)zzkhZc| z0Y>mgaLamEZWIt&)TynG&G}PYrxKkQ7abjP6y$fcs!HYZK#-pJwrhK`CJKpSEVj2{ zCg^!9Ey`ln!~sk#aDnpX9z;r4qv|#;s!_g&s$e|G*einD$EFk6UhD$vV=wUt8iGC6tL2HAeLd|O9WZX&}UV?*bi^Nh6 zy;_D}7v)e}Vy$Y{_+`vRfk34}`fg}(Qc2=7uhABr8G^c43Vg}{RY0o0@D4zmcRSK` z@%9Ax?iA4jNY8kmmRUUFJh9$+H<4d5`R9t8yPi$UC!gQ72~`g!WVg&s^H zPLA|K87OI*v~`wR7;0+B%Fy$chXX#xU@i45q-EtYrp%yfI_X(a7{gC{y3T@!U{C{EqQ|MD&=A`OsM^3^pZr4O2}BtAugC6APU$ zmjU9}J(A8$=YlYcO`|4zqL`G_s&UXcOk0%|5g6wW<=b*Ow;9n(e;6D2CGq5Jy8WWx z&wb~1ca~r|Vk?ymbI~y#0}ta{nh0J2x#}gT2FWO3TSk%c2`U{C9=pdM1APT^x(p}| zi;>O%v&P25r@2n_Ni#A)*C(Jk%nQ2?`hQ;LGRpm=uEv4ow0}vSUIS$v0yS%GMurrE zS<^&Rq-U5+<1-gPY7-!Y^|%t2)GP4^z4N{HLmfd2wVaG7EhtZLTTXDYzN4^SW|`TH zeSm(Us$$plH3e#>X8DY_3PanBNzZ?@)Q;shKu18{k6cWFHn6vz9W<~F3iVb>3d9$& z-p_G*MUVM9Kpkp83gNB*meu~ahbrcupOm1^-^%qtu6_3-IdN%=kZKA^)TEJ>jybz4 zCiN6~_JIs1sjA7ye*2MI4|FFq=670?#Uo_UXvDW`ujd&CdX1tteS)|zvslXcp6XXO z!b$&oSx6}|a@$;~j|AkDtc?~UGbgY6{Kc$!+L|`$0cw7j>uT#H$^C&KqZgTnH4Nw6 z^W6OVI}V!Nho$6Ux4&f8<4sm8y?qk8e=1W_x8V`X8`?qSK^S*6(zcIt=V?m9zp8xQ)ZjegAI# zvV|Ol+D};^#Vy3zsRVtl{|B+=IG4kt+zx!ozUE|~#DbyhMvW+d1x%OVFg0zsJ+Ui%`e6`SoWFks z)r%ZjoWoH8~8nr=-)trKm#Ki6S&r#J#nA2iw|B}scr7g)qY zY)KJbqds1PK(CCnmrub#IL+K9`mJ|JU@&FCnycCTfbzTTguF1cMz8ya%PFdZ%SEB-OW&qD7`MeZ}oG4GXE2-0#H-iYCz%ESnSArR2iAp_5Mpp5$TVu=(AFP zU3Bs7A+lCsu3vKUfah5I1`rUOP45=`-1(Ivgb9pzJcR!>I*-a5S2-<5kURr*-L{M4 z;s3(v;tai-NIvlAXWWTXBU&S-zs2M{w1S(}e@y2G(bas`C?$jk7X!Yq>mD4y4N_q# zX@+FXm4^g9-B80={^^p~cM6>eGqc4iNu~@Le)rnfs2eQWk+8NNN4H)ExB$$0kYcLP zQ3r+lZGw=|C2k#!-~xQHT&eJViQ+u42@tIuuHj(hjrpncyeQOn$Eh!0B~3I1Jm_Fw zA~vjf0J76~#uiZTG29R7*Bqg$JfC}`_JSIEf{yL|OB1d0!!YaG1E1dzyEK0b3r&ZK z=b}g4u`V_l160l07bc)!P|jz!RG&qOG{TPatkx(-gn%nzR!tsqdOf2T#SkDHTy*z- z&L=OTF((=kR<9If%51lZ8Tklf%>QD^S29~X>N@49w&Hl^2ABR+3V_2nmgG43E6@AUT+3Qs|&h+ zS`L~@;JVPE8;;mo&HHLtEf})L85gVfBNh8-}+!toRvNyb4#UnBnx6rwSkt<&St#vEcFR9ZaW{qTd7<{>-N;&ou4}la>3;i zfWMTz(ens*k)Pxl;VDcQm`StKm5;d@cB3=|T4544v;qsXx8^d_&pw~^)~M11O~C-{ zzP}2^`Q^#hOhi~Vuq3X+5UJ|<7cCAs^5kFaSPfR8uKYT{aTHPE6ox?HQkq6 zb~dE;*P!Z0erIzZoFXsk zTRY3>m`qWoY^x4Zyfd5}Md;?x9w55MUFT&t&P>?Mhs$$EcLCMpJdbBj?FrE1gY2g^ z1fG9YAjk4oIzr5!){fXRCn@s_ws)|f`0BxozwZ^u``85`8IDz8q{^4p6!YIyu_#b@ z!Ny}a^quknKd;5Y{Wx#Re?T@52OW{49B}6?L3BYCA}_})`YugZkiQ{2EiZH&+ldV! zaL-2|n@HZ`>CV=7e0cZRHG2-oDGP1ZJp161(<=WWkC5^Qn;J8Z48AGAb^z+?gC-!s3zDvRLFhBd@Uzogc>Q^nnF*uolsPXOtpU<^-_+Gaz+ z5}2sA`BEwrY1jWv^Y~+~EHK@dCA<}v{OssFa`0H`GN~k^To0WPp&*?34r&M*H#%0t z7}Cd}TH$?6B5(B54xDMtd;PcFXEBNLWf7PlN2PZXfIv{B#;#r_3gp@#&&SA?3e@>A z(43I)lTrKPl4#(e1ZhNN__h6b;}&eZ?ue1j@#mGs;-xQiv|4P&w6|*MR)bM(TPN@`v>|3k z>n0}<6KR)8bKI`!CeJWCT<4$s0EmGf>9@y#M%1oQ97K$xND1LmpN>+9M6VgW+f55h zpnlbh0?z4^YgA7Jn=iE&*R}os3Ns8w08MvH6CMzVfx-7Mvp9Ta3|N7y-~cf3x4Z&6 zgsYY~Z^J%AZe)1vjrjjpTJn+t(tCe6mCaOIE4>|aqP_Mfx_TVopyEJ``heou#ao#i zr2oquzqbo{qthpnobzW*){qI@RP&)`L7jBWW3ENPpE^6AZkIRs)(+Cjl+vw}SmvRX z{mn%u3>E{@WV*C`y%RG?tWOrN=XS|igOhZb%!U*()$9e6%u>oAA}z*iyzxCw^5Xgs zyf}Gd_W$LRPq;n&R%iv6VP`ZyKLwpiek#PMjps((0)YW4SeLC@O@|cd)e}@&qH1-> zbF*oVr*Wkv9}|x5@BaUFb1+p8wP3Lb3Jrp9AGZik_8-W$$8~J9YxbMEj5C>R zM=)L}_xl7`vHWu0V$^h?S!3G5f{bPx)NVH4azO7u77$n#=H1%)k#xBW>SycJchalU z+)}@i7^Tlz)fnmCqpsmd6h=f|fB++v_`Hr$f<7hGFy56yg4y1UwVb3IjjBkjHPUws z3Xg6jKRk&`?Gd?QW*v{%%yx|uJ_M+v@-$JI9=vK!Hf{K1tMm?w4sE$v(#e~3yNV!M zN9GCVJ-mn#+wEa;jF_Q()(Be)JP?MGYn|8T2W6cl9{Aee4%NZp0d32j{E0qoITZ>b zHJWM`3{}wBoJ|WKgZjw9D)GyOuL-p}R1M`DP*eX|UsYv>tCVrqXWNLX?H!TBdyjv1Ku7iwR=q9B1zmE5#|IR zlD@Dk_B%0ArgS#+e8cuiEfrT}oJ*Ey#d`%l9en|rVgUfB>(uuD)@n72yOEG!gi8ddrP}qZ;KHG=?=J$7sN$Zw)@<7 zt&V}vEa9#MIMTCd$uXzDb*fa&e~T$ncR%Fx!^jsT#0EC!>v_yQa3PFFn*Rk1I035z z3-dD@Kwo~{D;XepO}jrXr^AmGX7f}4iW+d3g^l1{_ITj8%_!b?BOIDlgCd&G`2~R| z0RMfYVlg#Yq2Ds}tjNDwqU$^j)b;cVPuyZ&s(~84y4j(n)=KmKuR-#mb31T*?XaF5 zr8#H4y*e%ff$2#uJ$VljKxcFZesN9uS|chBovVX?@NkE5pH>gk_x6-TXiOA%I()M` zXH&WhWSg~Z_cgR>QLkR_)SX!<>Bp98aaf8PCR!W%q-s&mh>#0TLPn#CY7^Q-`8#?} zZhci$HeIQh8ll-F_vJvfhb1w+Ms%QMN`!~_YK^LK!tH#NJOsHH@TwD??{y+;H z5fnR^K-4Pay0KELY7BLY9?f5UZ&2~q%uF#@g&`2q;TJj_z)?7n|Z8Fk=f{4rzg(7(j zc2sErKIti7#@{DItoKd}QUzQqU*Co?%~FO^K=9N?ZyaJFzyqLMR#A7!)=y0t+&MHx zPZhL3+(`8$Xd#iX>-;G=o4ty0&!^wawe|#YV;*0MAr6(zU)=8N zvc-mVVV0-f&@T}*Z@3U4cd-*38pV8gOI`ap%m1$`M95VN9Kmy2J(shS=L2p(+BixcNO4vBXu+ONq~V5TP&00hv}K#GOg% zKSu7A1zK0^40cXlaOL#^pI6)62|{%of=C`YYCZHG*A(n#a>>0|tm?`OT~xC( zY}q!`jm{%IiwlHExLiidaXb%M<@4B1fb@e39Zx zv@+`@eDX2)xBIY97luk_&rag@H=%UmXK=mz;fi|SM9pokx^#D?T9OI@)Ocwcf9dCz z>sk-stL1Jex;a-9zej^Q`*cumto(KP_Y)BY7Q>wooP*8OH-yrlr6yj@*+B?$sY9z& zrTwKvOoJhR4#`fkG~yL&edIl7 zn*;eYa;1rdsxfB97R9H#)l6qwGZoo? z`&N1+CCwwc&%n`bTQ0UPHc5mDgLh=S!6fKYRxgK|1^K_;FW_{c;&sIIVy|(Oh9>qV zM&D}{rho`hKRCx<$2PJ?Z*&bguLhqTTKBx^j^F$JsXcbZx=J%*do}}@LcHz1#47K0 zOFd%3P;RtSi%5PGHNJcRhzEu5grLBSGgr zn+c+7IDOtH2QIP&6c9++gvR9EiiI3Ad6-}>#xC`Z*O z)yOf`wf$cw7f!wU%J*-R8|E2==nA0%#O!G$!pYm#uUjd65J}hsKMTmX(={lhgIQ^` zTo^0iC#GE8y!^{Ma7EI|EG z!^$_V51IhhI3|+7yF+aq&zU(hIY$LOB{hy&430qR_XrXJ{k<@Xg26xilZgC&h?wfd z0F~d0>GpE>kmMeaBZVb?_1W*w@`h^KjFBScZ9^&}LnUM~HfaQ*wM0~F0Z(z3?*f58 z=nfL*bWq2aTVxlAFT8-0pnelUEGUfDs&wG9P_4~Qch{RBJ|x2gewS_N-k>B0{shTz zOrWX2{TDTla<=&DasR@wg?qpXL#fBId2K|Y0Xov^!SSI^g-8`ur9U$haCGb>A`L63 z&QS5iFy@?vzz`DVqT@81{>tqX>AVM{6^9qWSWUBGl$z_r;NHg*@~AbO8I}ap7?&WZ zBmM`bO9!N($Zbs+$MIM=kWGw@^hgnHG8v5{G-mR?E$0K2F++Fr7DJ$A?E#&IhAgy8 zFxOIV*mD)n26Btse~a1>Z0zfkWeze92?s91?d_0$C+@*m9~`7l3w54fjgPNpx!8=4a=Y0D zpRmELbi!5UqciIW&c;>W>s+h==H!%-Zt1PA|IGG1@$gv!RE=gnK;Ro4+StgN4p{p= z#w-AVSd?nUlB)&m|L#YGF@dI6^Ce@u2_GCSi_MI#V#B}8`(7?|pk+dq_z7J}h5|4^ zAszx52df{L=@X%1rqZ+9520?0%i+@@Nr~55UNmyOR@NFxvY-<8Boa<*ZSzPmVnX4V z^A|cLh(|ZtpyoHq!48!!`^in}15M0Q9xTovb`yl8x+Iy_**^`^kR&d#!J4FmnPwPrBkcitx1_cAB;M2P_xG4Yw} zbVc=A?MPtS83atBkR+tQAkyxh6F#P3#E{$M*W;%Um#ZX8#`~g+F0-^N zQiLw{{>fXm+&#on%CuDVpZzW^jHJ`Q6uD|F16)Q+)~te4#Vgkbvj~Pv_|C9IHc9O;Y z20FGD&Vl-2)kKTk+w3P|FUMzC?L2s$Xvr&tMM7LLyD!$yn8oDcc;BjXE6=JV*z zk&AdmWlp8(n+~M>eh>b?pecaN*QX_uIw}yoBifvlTAN^&bq%Jf=e6Dppm>(b53P9U zrE0I=udjp)ND?6`IiWu_Zk5ZF1-OLYXu?w!({_zl08THwQiXDKF=aKeAZ1^K9H^)V z=;BxSl)?Thq~Ix@^k)M&IlSo+iw&kf88tKQ!qY;$%`{0Il1?3B`Y<^Oiat!<&3)fw z4sWsj_qKlJhXzJ?5%o;W%vG_Zx@^E{58k#1R3PF3z*fKN!){W$+D(=CHi05U*A5x- zpe!29Y?s5=%1TZF7?ZD&cfw@XC#UhSpE3R?<`e z5Hk%V3k7Yg>Rmmb|^BRoH5Xp#35o&b!#s$PrKM%*} z|EUmOh&-fBMus7MLTRO+g*PdbLWv_6yPyTgoRjA~zTob&k3AAx>9%W|!6Jth7O_oX zk}Z0Hf_?D1sjNgt)lUkpCpV;oFb3ql^{Qk!2viJlf=S3RnSw=au6CKuQtzonMSK+a zev3$xcWb(_TuTHDesd}rLFVYXzII9b*c`PZpDVMN^!YJi<0wMYG88?swHbD~`&TN* zL;bkkHX$tOPbGw^O-^{FZC?6vw6{&9{6S3TFqE)st6t5j@^wH)Ls@KjpjF&Qe=nDS z#`ln|$U9TsBQ*#I?nwhFyc?MM<}6M%Mspo04UmjB;?D|yQZQ|+D#;1>x!A_0!(mLS zP|s|-u^Y@YFDDUMN*(zWzV!YRojqfr0Q9s{=``9-cR}jwU?Hn;lHHjirW8)9(hWpU z)EHQ(M&aKsC;8)}^Ip8C;AsMHrHh(o<9NK%Yu5cIMEOMfp^{+(PIc7CO2A`rNqw$9 ziXp)ppFnD_WO(FPl_7xX3`cByu&mN%i0R+{p>V9Z6b{Z}ja(L^UH2J?T z{?;DvsYPY($yoLA-)5=jJd($%Wu;Hu8(y;Q|1xU)Cl{&~i(dKq-sAm+SZmV)Tm5_y zx>zeac65A<>h>0Y9H z%xrJ=TFt+3b2WWvfbf=W3|ChrNeNlSG`4Q_0R;=Nc8*L3Rj-~3dZTm~Nk)Y6-Tq4K z+mw}Gjm`k>KXS>d`IX{qQ zTq0$5<97pnOQ9{AF>(ZpQ3U`L(De7@GF&s16X-#~cndRF$vZu@rp4V~ro;?b(anjQ zCoXsIrX0a4!|%%@fDn%mow0ql;A;~7?WH~er<8Unif5Z~W>RR>p)RltWu3L&o0)Cah z>iF;#IJ?da_(Pe%Xq$+fQxa*ojw+a2xm;|He_lw1D`VUlNO?;ARCXg|Q^q~U1Ss#w z4OUc`Fral`wb$tKo?baCZi|lUN~iv8S|!$jwv<@^Vq)Xxe@8N8}JVTBq8@WesbJ3 zZjb+7&PE~-t(#}|HZHx?fTYeg)Q4j=2}M#zBKYOBAgULYpurX^TGx=fXe>5dKCS#-~kkRgflmkb**ZI!4g!L7GI8)n3> z=g#`mR3y7+(sv~`i7y}p67dE~avmBtB(8~20!W9%>*LoKhu34KM4hpV4nStqNvzHR z{FrRK(^HBa84E|`R0GF;0ZL{OG5^exj5N!DtSO?3!R#tj3IvPh`6Ny9+nEO5NavtM zS$e1m$wLzw+SoHKg_pO+oQl`tdm&6q$Xo#5!K|oHgzH-OIm0u6jHXKk6(J$X{;V9^ zj~N*M+*(Kr5C||L}d`2u!vyr!@}Rb`11Hp|JkvEEI^c?Z5K%QF{i96K|iA zBzalWN0!ms%HJF|3U@2Rd9gqz!6t+QDM;D^)OrVSDm>gVWc`0 zyGTT4nU0V^+vRW-<6)sjRjxl0rAE3t+8oF)R>87}MCw@ATQ%f#oYljRBt9#o?}>FT zqeU8*w|WwdE8Zkm>AtXTdn6QNofPtEvbkog0>bVedBDR0y!Bz~*G*m)aUA!B!5_c3 zk%k@~D0S!$8zU>HZBd$KI-yM(iwAPN!YPeAcC{gEp&{el)ZLA4Z>+t!& zyHLd6o`Oo^`AE7Xy)SACWZ+xgEN$>xNZdgS>Qz=eHI+mV?i((NhD<5VFA@l>qjHJp6`YUXffz~P^t;+ zL2{6InNYUO=nFi@e>fd3(C z5i%B-e+R7KtkczNYqkLaFypftPa`{QZvN8Uv|dL!mU&v59vSK4nMD~xyOlzDHnQ)Q z$)1EaAn`3k_w8x1JHP*U8wfJ{;e$GNf=I96fhcoO`_^psdCB^~i;>672xu;}oQo|0}SMLJ|9w;bh zr+Z2dF~aJl$O^2x<>zPx_{h0Hqo-ujB`X8oBvg&ZjZ8GCe8sK7;Q-RFL4*Qz?aE6( z+Uf`k80SoQz<*D!U{(?=r>IrIDw1|fAzdVgduAus36`iLdIE${Yj|snGYdf+2BBSaep5vpT`y&%+z*g`G~EcdYi~E+?>i=SATNSp5H5z#n2>!9 zYSn=zmK@2|s)~of_C|HX9`1yL7-ouF%xh;OOYXx8HRK$}hi~6AIDLo!Yx#lzg69g5 z2{e%^lqo?5Cs6G6k_Xs3i!Oyz`m@S;Kh1h}WAHam2&3pPi=Yp(X)}|iEmO5@aDT6Z zonKdWWeT~cR0J7zxyU4(^R=!OPvU`Il!{5kS6HGR_EU(i_$@;YpJKhvtxz~vn>2!U zifJtk?Gia8@a4J zMI%4X3e#AZ%gcRYU==*240+4X1uING zXH(&j@=EQfb%;^%nmt5=F>b&aj9FLlqjRorI}oRzJ;LM=IB>Czs@9d)m%A}ityiU< z;r#&w0;$OOjNc1Fx?x|;(|VKKFyVw6mXn~zInA@``5X@3`6W%FtzX}vD{?gjuHWy0 zBuihAUa+NB=R{Yl_>DsVWj&)SQ_HO!a%KRr3xTk=1_seRYXL&*b-$5V0v+l>pi8L z38blHE58@AbYNCeLwRSl2$EbUa_|Z{O~{TOkuFaR95vjeI71w{&O|9S2nNrPy_IDO zL!$WRpPd8Drs8E2n5=B@2hg9vG{d?BZ1^T)pJ_?-r3uk>qCMlG13m?3cA;?a5rhFO zl)C=Gdc~$dVN?1*i9p2zGNWy_ARQ@W zq5b-vDJ13w7|!-bHbgZ=8=TW~N2HX?Paf&4l#`bH@@s5S``g)o+dxTBCF^h`EMk2{ zT4RiMCcOGaq}fhY;}QBzb5x6ucqh{#h6ozc(M?y$54myhDe0C3I^5e&Ny@mRtC}>@ z4{F)>4Pn)@^7?rY`>5k=m?R!ptkI4tQk77o1$(EyS#9e)ynT$^zaRqGlZrY$%o^r! znrfRQGmI)>$rA4Da^eA!Njs8wIG_0Sppw@G9E-!lG!Brj+KuhO@fOY2^kXkFZq9vP z7yetV7vC1Vs#Yhi3utfrZlhUUkO<%2j2bvIJoa`cI9(9w)ZhL<^^h7$Sd7p3jYA;j zQDi!lM^LU}spliRPp7*pL!0&EcFMamdiZRPQHVn=8$!PCKja4O(+;|AaTy z09K55%}a1;0aXq*>x<*hE2Vt~&8uh%3%O(g^@n+UlmlPY`Bjl1CbDcqOZiGBo+$;F z48KGZLzm!^XeDuY8){RQ=S%0QSCtPMwLm?p2Af57%B*lgMVnny(Eskg+AdNKhNHg$ z*fOxf`-!@%#{ z%YsxrYX$BFd8IAxd~+Kpa_W{Q+NW`h#0>N`S$$}T3Npu6rar#xTrgWWYs7YK7 z2I#=%0IDdq-HO#K_I^U5wA1$<`P9@W!KC4VA;rp6UOOkM$sxVE(b^^9vW!gx{xPk9WosKRu)rYHYV| zedRAY79I8qjzkpjF^v3XBY576Kn)UH@7j4HQ!n>Xo~zxP^}f#~92id<;0X^Tjej(- zr*CybH}jlPWGj=YM-k{J7g_k+5kL=+o`9lmySp%Vd-b0MO!<6%=8BM1^yj&q>8tXB z7w(t4!?3$i7_Sq`eugK?^ZxY8CbOs=|YnFYwvsQVY&FO@FicKJ1N z62o<;;#}_pk&P`(QE>SmaZ&X{Ftpjp)+Ed84A^gDr%Bb97QW8liE>lprCJT5+jDzl zGTS7ZWF?ab8kl15x%}bZg1m{#kMWy#5JUXFwNyx`5-ixeT=N15`s(~zD7>p#&r==; zMg{h9e*{?;aH>;rO(pvM=Pc_egh4L_Ii=|m>s+E{o#U6F>_@pI+eq^i2DZh>>Jc;( zCG`^~;IRtp72Z}ut&uNNdXjshB|y=a+$cl-Hi3n^rJRY*SYOaMwiG3jSQ)Y|SDObY)(emsP9(* zv7#hEQ+g5WQFOLa$eeaRv=368FG)q6eFuOqZT0FdR9DC1#$idTOW)v7Xb<&7XR+0k zEl)ba!OCy?8@}FeVQx=i+xWt$dsRZPE6>EO4LDn|F1pW}1!YRB>M(kvwF4fegJa%a z45`pmB0dv}k3}QQin}5eH)s@_`s&D&B?nXZ!W5j|WP0Ap>xqih>b6>m3-$Ol zn2I~BkI{Td;Ik*yir~ZVlcj2?d?!#X@D620&PBa`m)Bi{Q)0?x*xbn{NwNdo(Mdpx zJI<>^>OSn%133kI0nK<`ZJ;)~?^~{AL}SNnqMf)(ljb=mtACWqDIFic=I~kN^|jZv zNO<+I3a%R?g11sL2hgrVxlANKK`OGW>eFUO(;Y=2_qyyPKhn`rLam+9n;;cqTNl`5 znzzgM7FcaZ(XR4Ev;Fa(IBq__sUqaDcsS9^O+L)-i^fuMOuZcoXup1^V_LeJ0j4b@ z6fGFOWP`=I{MNTf#j-?GY^N4^aw{xb{Y@#BidRL;Hx0Y`Oj;867nl{W+FF9`T>~0C zQY~Jb!Vg-zCOk@D^lbXs^I70jDVW0GE%G^}T*lJ0CcP>}cVxB6Q17bjuuX5e%^t=L zDvtkbA+@QfAo%GJz-hfq5f+U7-*Q6oMbnx=&G;%r>0v`P3b4so;JGOKhy(OZxCz$AC`_m1XDpVylLR#b896+e?+o;sc`QY@)^03Kraq@*)9`N#r#iWX_B zvgSzu6t^A#KPDjuMz5-bt|Z(?6cA0MP6U|DQ&OvMG)ps+ZM4?V8ksrmbKO05zNSRI z3CoR-*zWwhn++$pHK2+F0g3d<$Nt(H0=Xq`+8?J8tC5i(aChGH8w9?hwg@d=$z_ zoxDU|NbfF8B7))4y>XmZ{3KF=VTvY{DTo-e9$`rvJqUy*(#)pJ)1+O*ynsCdkTAKxFB3jjRjEcVZgga zdBNZOQ4JOeaw>f=s}QR7;StGR{Z2~IrekLd{up4r*+k?u5IY|*oP!T^TBEe0q#*vp z75KCpy!U}InaDx1W+v{RKrhW{N%+Wmd*+RL&hlIy-O)F{?^|O5Or;tEu|uSn7h;aIfxe+^a)R65w9NJZ3Egs`~X2PW5kOi;-#9@aAeasxk%^D2*yNfd4J zd^qNJdIW9>HdsbgS!LVKC}??`sjFugNP?zRCXz#uIcA=Em|~O`wyfDpLVLnDH54tH&>6YZlymuziUdVdzazuiR3HrnB zK+=%jr2`?h7~qjzZ(lGk>AZ-HeVE})4n2WkRZjB5gDfs*0ur1HU&3AJH~qbz=qZ6! zBe^Nn?9tpDy`Sd~vmYduST*DNM}iP&*t71bM*1$>fq8!u{q4gMS@;XXu0)0|Op+TZ zqE5QC@BFfIIlr_Jr^Y0xPX)GV`4sn-0KY-V8 zzG0|Fj=S{3ssm}x$OW>tS*6+Sm7NqiBAdgXAHb)lUFrwq$e?-NEH_5w_&AKhnZn;Lk*i1W zAn@pWKsyU}aX#x;#hc~-DZ&}Kh9(?SE~a}v(TsA20nA*rK~t~XOw*{YRG&j_Mfkga zkg0fgX&I2F%RelN07NE6<;~DGX^m#9*SQt9m&pZy_YCw-9{7=yW0LEvbas}{CNyVl z*i|^XbU0suULIEgW+Cx3YGtGF+K7`K5iY*C(yy6xtdDRGc_QWB6#E{1H$83x>9sNVS zAt$cVsX2ZlqA~@zwNoHZY(VRd2}?KGS!e!V#@a0B-j(7(5}fGxz4Fgx?oW$>xI}5! zt=2itdOUkgfiq~f?Q-MjyOziPV~kg}e&>?0z-5yHf_iuR^oqf>OIz2~gE>ZMpc zhuih3_lh%>OW5^8Dayrh{BT&74B@V19G3ECRF#$*OREBr#e6SRDTIpo-=f0JMgsI% z^?7u0^mLjlnf52ZH=WGKavkw&xs2EXH?W{DSTq)%O$juuRivH{lem%&6aC3B=&NB0 znkXZ$+Hgl|2;4Xm3aHIOyx~+zMPw?Mg8@wd%&Zz3X47fanW2{3yirb!n_v4~mNleW zbwD{Rud1{4zT{M}k!B{@GJ(b0?x^$>Cw6C2QDLK2<)o*%A6sV#3y%>hAP%`?RJ4d| zdL_KFbEzhnjqBUw3CGz;bR5(0ZuOlCi1H^)MWXPg?k>7NbDpMtmG?VR1^Q0(-vwD3 z&6H%?*A1b;wy|DD%t;R20YbwQ8q515-U+>e2KBqa=cx#~^h$3M*ZlU_lfTy;YzjRZafsG*n%r972=^X+S6 zN860N88t_ZAKvkIC{)C>> zK^?i0*S9YhkDPniEKYWZw4U=_7O-2MB2)=6dj96a2#BGYk><@n;sZg!p=ja8c^yoq zYFf=l(2&!e3$$LqZAU_&-wx}^Z0K1#wJQ#9n7uv3r~SS0ib3yReVCypy<36)Bd7Sf zFjV@hUGF$@E}q@G+KR}!o7&EU9+}3s+nSD8R)F!;5`eFU90`B`0R~zm_uF(da0a8 zyigQv_kDuTg+V+UB{P_mu#8H*cA4zJ-Sq&0yL<5{IQz|Ci5XD!IXk??I#l&e$1`cD)-twX- zZ?~KgM3875MW2sRf_d@OaJCdPCi%wVH^4%-D`99XVStvlqwLR^0ya2ajo!i#MYQv7o#{m@ zZ&DwGtY*AF1xs00CBwkE*^>w@$7RjUQR-2Ar#s=+zfg{nNbNc(1xEU z*A%r*3+(V4gN<(1W1iRn@Z_R}dC%^B7=rne#@?{Kjv$WO1n&xYlmsrP<3K23L%bjh zRZ|FzvMVsRaWYC6Y$|H0r3@_P=ijPgXs0TRde8X|UJtB_-NlMmJSOQC=d|_26gPb> zA3T5&LavZH?6#wirl-*FZsNU8XR3+#@b`+y>SKmhxJ!a7qd*b~Ip2jvEo4mdDK){ofBQa{OYT$=qLT{TZIndv)q!Nl;VUUf7705uNrm0Z8sunYOnfsE z4tD}J#~a`2b>oF{8Vx5#VJPC)^iUA-XBLw0j&BK4eo?{-WJWa>`W!=QIgP%Y97H>& zQQ9fsO;&N+NFpcX^cw9xGy_4(N)L?HpVjk*8f$mfQ9%3=AAPy=6bz_4_uxPkL=B|d zL?wnI1kNzz`yIN>kB|wk7v)KaTKuWWO#4@4MwQR(8bIRZ3GYGM%u@e{U6*Oa-aI(p z1`Sdh{D*a>v!Mbz2#Z^JYoW_4E1tc>@EFnv>i|hWw!e|CCbkx`jUh#wTqN?W$;QKX zIA&c0smBDuM)$IUZV;5D^`WHn3Sr~`)e043%Si!xChYS!w)zS2RLi&5CHRT5`Ygn>EH%jf{+cume@i0 zGF|U{&sMk`=agYR=maL1OCISC$@0|~rIyZ?%OFyJ-^xN~1gP0$PjG(3QR?)hA&RDz zttG5hx5OmWXS=pG<`BZB7;Quap9U(wX0Y})>$OoeM!4wfcz5saD1b&hoLj-FJ$&E1 zb^-F)KtImz+@0*Q&Lsb1=UPU zcvUfk4bUN++ju{wO?vDcxOV6#)e7~tQz&?gm^K={jM;JWUsV}I*~*Y(k(+J3G84p) zBhM8?iUy)v)*%5Psm3&C1Fd;s7bvg|OO%7@oo(7@`c0kEu(_pJK|r1B0&)b=7p{V3mlK0^ z?yC1g!v$z>=#o4B+ddd0Djm2wvs31RB9){rLr`wMqxp4oxKqJ>b`l@yrl`MLRW|7! zUD&S_8;kzSTbiSJsR_Lz+#u>@-PB;e`lE_*}_~8#`Prp?gwIzC- z#R1qcA#al)e1sI4PR~Vxy=>oumd!sBe_khj-=dkoUtkgHs{b+SI-0z5jMSs)3z)dw zqVu}+_)XG)iS*(!GK8{pjl-SjyukL91{eQ8AfUm30pA1Cmo3;>4C{RGW4rFwdFjy!sEcG- zwG*26T}KPFjf(MwR>1Nt5Hfv0v;e*^cpm7>YDXPT%~n;Xlz75iE`2?q-mcMK{aAvh z4T4Pmtq~@e3u;ZlViUU(Nh-JXwWnHXYI*olu}y2eky^F|xy42ndV`Z0vL$BPApw6a&@Cn2ojcZxix8srg~0A@P3X_c=tL}OoX zw=t;(Aj&63dX6!*$*1M^k~OD-l!Tkjmn=skII*oBX<}mPko65%V=iOkXe=GG9SzVh z<7)15-E>6(TAR9JNSHPgYKi)=t|{NT_VlttBPY`$3ikr4_)>Z%7E&*a@5(nVaL<<) z_x#eK(7SJsvj&9VQ6Ls-@Bz1o0(X|0ekDlVqRE1>s~=4eO{hb?FatVjw#Ua?-IlLM zXH-qUori2no+T)B-6LJfMv#-Vd=VA0bO$8l+0UlI8SbIdJdglfW3_ein1u+9o}NT$ zA1?FYM4YRB}sb(%*E8n4T zpq$10uQhrYm<22^aY8v0?lJ#}DQ#uD)`z=b+Y8sS8N#T3;4b$#K zX*@2-x$jK3(ziWB<8N$$%05E5%373)J#@(BQd0SNyh)9qQYSoDoQqqB?KfRXQK_!O z-t5X@K4(!J`n!X@3@fA+n&2y&SP(&QK;nF=8sIWc@iqtxG`G>7jBi-hKnqkSU-oHZ zf_*ba?0Gu4j}BhZU4B^(5V9qvAt`3b^p^H;q{PNCROtCuI?6okG;guGc7Bi2gvU!k2yNKD~*pZ}#tFHSV=qo}q{u zAwtDx8?~sc%nHN4{qUWzU*e}m`J;b^ddm)DH^htr7K9L82l4rk%z}UGM2q3 z%l4PZq#Gj{qF>f`>!6v)%y-kvw1Ng`+#VtK&GR~Ktbj_2BEYQ#`LFOgtmEFu_hAKj zY)v@oK+T;&>{nQK5JdcjHnWsUwX?OT)ppwbMm>ASJvHRy@UaUyaG>lKMm#lHAorcw z1W3&dI3lu`&hMInYVla!^ns5EWDIhVDM+vO2d3g65U0=IWqjaEC!`w=ZsZLkJX`9$atFeEVqu<%J-fOAWh?nasE}3og5ReCr+I%xn78i4p zL_r^dGDHf`&`$jceXi}RcUciAPcYF({qVn*j6?@>&@Fb<7UP}Vw(a%6I=WEp_QMi5 z8^Che*#L32_?~0PBP?du(4HK$lvWD%kHjexH@+1f8 zyZJo19jH-te48F6=Q=T_Pgnq8^5*69Z4P>=d(V#g57(FSD*^Av7F}S55rdirswL@h zcwI^97%&{sJ4?3uX(DS0`XpdbLLl?tqr{02>-`G2RZzuXainvV3J5dP_=Kzz#2Dkd zMHSW9^x^%#3IS`UN50DXpcZ1_$iAn!aThv*uE`u~KX)x0{wFU}{CrFfS@%1u90VVJ z0~`0?G+?yU<@^=nN;dLzDrs|4ERE^u`qeP0JV!(Odfxc!wE=B)nE;@B+(Moii~y0U z>>yV?p@j2?D`2Y{MrSc&x#8*^9cx522o2=v>ng>X7(H#tE2F zR(#rWeQMOqh-YMqG=j44oCHZnFHgp`jGK4+RXkqiBTx*Nz~(M#2+nC}Pf;FR9_v=` z@j!>HAXZqm0s5lS%I94b%OC(7*l6Hj9jv|3LiciR`28>~$*?qMOkmI0M8ja1#w8dH z)7GCn0w;v+*SJTwutH{KP1gPWY4h@g@^QvPY8cgsONHt!xYya$lR1qcHimB;S@%k> zSVZ^5Tm8#6ut_>ZvA_%@z+9+5K;Xxk4{9-g)5xU6X2mJ1jU`V8b6bKsQoomrFuDr8 zTjckSD%ye^$AXf6nO@|GuId^d25h+~O*4fuIL3Q+#nM4|ehVULOmBl{9&;)S@{C=3 ziDf?!Mebn$#*}Fie6FS>b+7L?nL-p`(o^r!P zuZHH!w@2bu^0CS50%osPM29n9AtCn0ildKio*%-4Yh_4tcC8321W~VXr*AKQ_Uui% zZ;(#SOXAF~Lu`Sg-z^Q&s0P6V(<|P;GTi`=Jwl&398LPOz9>$AsiLEGW(mGVrmqQ8 z)pB**!+o7Pba0qWB(^r7D%go{C}7roYQz>MNRQ2y`NP}7?{K!)2$NJl^CxFK8D#3+ z`puN%oM&q`f;E%AY`F(qVKCd#R+M(lEmK!bb=&&slkt_0+uo1f;gq*T2T4ktmJgXH zAEa^QV95aRcdeqsiKmBh&E{(btl~j&IHsE-IDw!Tvdz&Rc2>1iDh$$3?xW=~0FqQ4 zDm^VgS z+>7{C)#M@Pn9IDi?wEXeWEklDPSwGy^5#2kYEg*vWg__!vjO5MgZwdXz8R#Ad5~BH z>QF_9+PU>2%Zc-fq!TVJ+E>tVDL>?n_2*$R;2ITbiOvs{Wq4 z>`Ur_^=2Sm^;UR@rE=D)J{HxI)#)FX+0bI|v4|ku?Fj}#A%d)fyyB*+{ZzOtBY1-b zh0a?A#=(WPHilM|dniK%9g?0Gpn%WLsq;L0NsY+jbY?y0(!M^I{(#ELSIqD9nx9}`bd#=d1SpUc*pe~$k|wpJ;{A}76KbkC@q zna$4@2wSLSEDDVgc~__yK-Hhv5O-x5GYdU*p~1YYzET6~v4>wf2566ke^-joAMk-! zh&yJZ3wo;dtF(!RqFesDAbJ zw9(9R1mz2FWX-0b{f?QlK~|is&^uB>0a&B;_8&BGnYb&||5kAX`(Z6g%(*KAyk(UJ zp1mn6c*y3RCPN-<6`iR;ypPwBoP*W{1~H8s(FlBxY4^)DM~$KqZ)Av3lq#oe;K=~N z-vac40~hI@|K4p=TSPCop~GVm-dRcSirdD5))D&5pu=^$Sp2=tB3jiD+i)2ud-1CA zD>S;vmt7c$it!|>7lOTY6`@lF=v|;=E+Kg#@`drr4DIC&102K!#l>nnbn4K3$JfG( zKoyhF?i#36x+>}r*GnaxZ6gI%R1u%GTv{*zJr1$A(rs*2D3Vv zp-r2g!bV6a%|pD3=OenwVwf^;osS3ks(YSkEABz)i)WD~@ZhduYg2U(AH*~wG5f#5 zolvl&iK$Cn==m(MdCJ7XA{cAer1;xWt@n#(j&C>u{n9)emX0)V_TzJljZ2cR(l|KY zf{+awA$bQGTA%s0Dl0t}sU9-n<(l%pI=i`G|0T|5{2Xg`FUMos-yf$thGhbJrPWq} zQbc3uI=|gH*E74z^F(ifED2@nRam@wwmYl-9f&lcv^tTTGsAT!{(FSj&#Y zcP+h}p~;D9cYu;GIw_o?tS>tcnj8 z{L6(;8{pXSMoaU-Dg35)bP6pRfXX_Yy0zdw=H|Aflr&QWIixm>pwlAufSV#&DLK}i zPwFGuPc{C}Dvy~+LYE&Xa|R8!;MK2a56T|JKx`L_h^YpCvF(_o-$Qe&d0mf`Yb4Cp z@^9503g`XwZrF2VwK*x^k|YD>TbU_*WwjTD6ClZ0EZYO|1@XCJmb?l07oV^w!PO^` z0dHB7?_}X^cAqpGa)T4quff(cr-5${ms;Wems0)9i9vkeK;%x5HRG9e3%NE!aZN4a z0&Od9m7LAId|4s~U90g;FtYrq6J^l2H@nr8=<_%BP<;2(4a|KSU9xx{Ii0sBz;0bQ>n9rb zz+h7dsk9}CrnVLll@5Gz6P6JZtAjHGa7zxk*H?Nt0@)@(93SUoC#C1En|vR}eIfm3 zi2z^(bzAO6J1UYR&fK0(Bxyyp!XPWM%ArTMiPx`dm13s{WRuO^fJDFut4YF zL?EE_9cxBmATtQszBodA2m!ivVRzq6N9l2XO9(e*a5QC0Am>f-&s&t(@L{OM|0lJg zGR`XcjK+oc4R1f&J%@&627$8BPLc?Ik2IJZ(@w;jzrEEVE4Vg zHrx7CUO05p)veuMTpwH1p^nk&_q4KJSq^5@hnw#XiR`&%z?fO)n;cc>R7Q9ElmOVj zV1*O6uM`YCeQdHkI+J$a@DlN~NF|@D-f&Tw1nH@!3*E>2k4TB|l?g#}5lM?Eeo&Ow zjv+rUR^D~Zad@d555|JPapOaSNvXY-eKE%dws!iJ2@Q-Unrkh`!Z)7{;8K@0Y z9&M|~9mFTe9z3Yjnw~9jT)m`<9(3gal95avU!l(F|HDP=?kc}vbqwr?Had6{V2Qxy zxVl@AMMY?&`fM{Bm@2gPe4K-J1v|mgYt_ma#ikR41ax&nm8OJ;xo{0RU@uc4nT8AJ7#2Z z#-_x=i?FdpWv$telJZl=%Cx}gIlqesDpcwNO6nMmLzO;>JJdryh2E_cQwmOYGZ4pv z{khaA_A*QplHgje*?>W4JZS<%_*gM7RvX22g^gmg?FCtxuXG^sifMjmcimBp5={{$ zj^7mm)3-S8_MT10TA09RoY}@R>jJh$GnUJ{TRKet=E;%xYRz-P+6$M>_{Xd6M@pa7 zLXJfrFEGr5c0B>;m8*Exp}n`Lmc3qIxqNb1k{#^xU-Pv)nDE4NBQ=(zECNmZ&rBm~ zk|~MWrR06hcnN&?2PC|}&V9HejWr#R`&LsdT~hgYC~P^H3!vhc%^U?a9$2cAqE)E? z^UvU65e{K#4to3(v2MABPMUvW_o_TH1lL)q!RZ-Pv$Kx@VQZ*)Bvh;&un;(mC~mdv zefwl2_#jI)eSEMG&21u`mxhgm3Q%~1;J1tkNXtW%t56McIH1pA*S3lH2IW2Pu?R&g z9NGIGPjR|JmO+v;yl}eTl2{L&793PKqYgj^n2MQ1I6%>?L4Ye(n8cwI7KmH5TZV;a zAy|%OIdCg_;ohh+qae^VcM{=qmzH~uImVR$0lp17-hWRfaTUydJp-b}ef@qk@g+xi zEmIYiBTDxLLoVrO(VvC`hX_eDtov%_neNV~ed!7am_rP+kT<)7J0jdTZ&LdAwqeIO znMD+fYO(*i1%EjAAZNLJ9+mZ9Zi*(IWY@}?nSSr8bLmYm&jv;C(Z|UC;VbeN!3dzvujlIY1p3v7$fuh@hK}k>bX!_w3*|Wk@ zLdgb~W!*lK^n81bj9t=Ae(YfWs;%Pwh=862m0*2Yu{m-5zg%sp4-sM)*FDw#4cdsT zTy&Eg7E%>i`~`S`FaNb@Zgu>VDH=^LOb}w(rI$PT6;*7_KUUT}hUW;UsQaioYqcv% zcC?aAjBV(=baqd!J_nVcCxN^fup|+|#C#_vHLKoFI3cl<3h4@=ruun`Y6x&8DxF=N z>n{iS-yxu%4P#RO9GrQd2%SNQW*vUDm6l+Tw0~|~7}8WnYF9{MHnSRQQ|+D8&lZXZt7dxT*dMW1>5YnL2NTS;Ah0GX!-Did zS>!JO8?RtD(@tZ)#32z*k17O!f13ZzX^A|}Q8VG%!dA};Fdl6Kl5yponSYgb{v~3n z-cXfUU9g%BibhLUx&6&(2nHa{^WGe7(5K-7^TY55N3C@!-gwq;uiBdXYj(t&mVD$S^Xb)QZ>#vAR5zLt{_zbk1eF=?8iysXoNWl)42;r z8<_hT&*iO{mui#XWTBo_5>$MpPMoj5;Dct&+nLkpY$4}L-ZlYNb>~aSTZeGe*7MAH zIt&qGyRA$vSu!nX&tV}ru=;eYo8zC_5*h)gB-OXatBv18}IYnLW ztPcfd+GAd_uXNr1?+a{uzfmMIOPpbM2`NFE*4}ZeP#@Y~53@H|S#O5}5sO1;JO6O_ zWxs>qfq`0z_C~wASKo}+B%6g3#ZViUPW{}#uDGUHJ3||_)TFJ{(qaz9Ts(ZLc`?c| z`+KI+LQ-mh$C7(}*iCNJ83kPOCygb}F?_9k;<+#GKfg6KLN=uyQryYb*sqb2rh;Dw1w`1c=xXt$KgId9tm>6N%hy6CI%hfDuNlRLQRcxocs-y=ozX`r z1yr+MR75Z&KjZJiVVz7Ia{dfq7_`LNv&R+dK@v45X$ra@}sDoTKTlAt^^$NQ9>+ zF-?m3%FpYzQEuKP8m4Rs=5}a&VY^o4Ji-@t?`d7`dPz_1*c83HCaG*PrbUMS?yUbbP`;#|u8n*t31cnmb|P_d<7q~_J7u+|2mgson8ZS3DH~Uf z%gj*VG=;k{-M|3B6mX7qr>ie)l+o*eh;RnBoi4}1xjJk^6k~4=(u5$2$J`b-L1hNU z1mSJriRHKGf3r)?OlvLqs6S|inEJiwnoLSX<0W%J991$up~i_!a-*txN7aj^lOTqE zBW+}T-81~k#5QQSmUaliN`%hff?ISH6|==Y!iwF%46ap1nfRv9vr)g{GovEY)_@uB zl{D8-xeD0Hj0vWRhdXV11J-M=7AOk+Ge2(*P|z_+kVuezDmQCzG=an};WjE+uef=W znnLbxU4G2-FI69zQ2$x`9AVJ1udb+U(yA+(~G z!$Ffut#IQK;1Lnyi9d_LEc~zzgH05_fk9t$hKfE|xU2>8PG*8Wor`NR^_-IUZ1Jg#f!|$Z#!qey&`297xZeMN_#RhRwQ0~! zg0us6^^w{J6 z`MVfbK_7wV9$U6xJkO0}o0~jJ|A#1kVfK*aQkfLS>*$bMV)E%kdc$yi4M%fU+wq+^rL6l2vqYz|*n;vpsTog5@vy?n-*fTIJRC)_Z?^DvSv9ZM(k0^`P4n@J* z7GHQZ=SGM5JoikxFYLVxw1W6nB*I#{*t+SHX#uFf!3qp{kn{#6G1`Dsi^aZ6D zJ0qkfpJLnM_7eq+h=PGV+bQEj(56YxjYa~?&JmUb5?tu=+|2-;89RW-=9i$boUo`U zp2`;B|M=@+i%hN8k788bsEmy};0gE)PWfcwI=7~Y;mrz6W?KU-DO11ugu0VrJX_yI zn1MQL>VGuYn0Y(pup+2kZDEAP^1)DqkA*m`#bUjz6_$h}AgOc?f7gDsb`yPr4t1qL{rCbu9LE+&{ zWl2lI&1VY^z(MKye%+*MFWycbT(``2tEz80*buyaZtrlyG+IGu+64h(wc&(^SlYWB z`Fn3)mT(ERTI$$}I2>Z4cIbIE0PU7wfgQoIr>nP#mSr(H-wV$O;+xsjuU&g8q8=$Y zk22brWHE@Zr*hV=wkrE36}(ijooI|RXX3==YouNeaWZKuV1~vu&>Gfxola)!&3ZBZ z$TI_~+C3{kC$|;guTJ5CpSg%cdWinM&)SL&vdcGA1#z(Mt1@1-eJI(6&a=4Mavs@j zs8`FcG~rG&{cyC>!HG3w(20hR(#S)^_QA+eY&{4I3e+lJg@aAEkum_I@VIbpb* z5kR#foZ^UptYG#g+TX8vT zqrA2jiGiuYU)o;n^J%kF4wbh(W?U`Qy0e5dTjBHn*v3m>5kk>)Y{415c|^yGP%jvfZm z=thTjo>NuWyUh;^*YJFLM%BYdl-m+w#AmZKBhky+)|(8`T{t+TSAZ-v(W-nu`Stbe zxXhM$v`0RZbVxAGgb=)N~08txdw0RFjTMzyT zx*QZ6|G0w&DlghCTYViotY(MNdALtGbNNz@O!<(z#JN&yB&3L`1UE9oCaR$TVRm=B zL1_qoo1S@J`&8z@LN2JRgJ$q<$XIHa7J54_H$>tI2OU^wyy5vZh{Evsc-rW3&xh5x z2|icJu6VwR@U40ctS-dPE-e&RRB-8d}?RS-ZA*8hmU=Zs*aaj0|SHH>mwUhA}WtC0J zgj^(!wx7K)>=pbeMsSn_@zPK9%SG|OCn3y%iVwvWo4PA`1`H+7%uEk#A4$yY$71~O zvO%vAR#dpez=KO+dRitUKGt>=QQ0Q0v`rtgU!>urEZzpkYB(~G)U0dXfwcn&)TRdn z{{jB70}=%yz>lP%@%>Yo^F?a$47Yb(S=$jS358{JWmKt6sncK(r0X*V$G}Szk7SSU zoPF3I+Ay8p6_sC5olnJsS8Onea9Q}c8!uXr=G$eM)@ayH8NHiEK@-qUW*d3-JqdV_^S%#F0Z~j>U${Cbw zfk0%1QD_0^@J8=61?cgk|M*EO2kVPOs1x)sN!Tn+9HOedjM6ydgXvQ;K16$^NBjSBT$N+T4dTK{x!!jpMIl*j9 zJ<+o_TALc88Mu_E>)R1pp=Lz+%-0nNS?37pQ!x?T%D2|KJsp+>2q9^~5VxBOdFb~d zM3o9gMDQ@V(j|E*vpi~M(e~hl4BiUFWxWqQU(|wQ(+Y91P_#^7L zq%K13s>_Skj#yGV!Z8Cag-np_>q?-p*#(xcf)zlo9s)tGcz;m|NDA}ai1wwPx+IZGWC>O$^O&h8$ev(}poGzH2Pzq(=^0Q_?qo$p z>@Sc?q5ZySJ_!*Yu{${;6!r4qEB3(7IR_<|p#zhBM9j;4|y zeLr&V87D>N+@5X^{yrphiXu{sQyQ4G-6-T)RP_`LvrK$B6P(0U5B-uNo@+^mwcFIO zOH0e_{KH~>k&$bFgfcFmoMdH6lf0`Q)6UjJUGN>A{hjF`m^ItuGzQNiZ3joVlVy!h zdbserUpXVxsk7_&s`ZOu;0o;X_)q&Sw(amyj#2kRXBp_Uqqc_dqwboe&O%Bwwko@F zULp;i zCuqv3AIu|)&ysYAd*<3+>S^vj*%iiYz_W2OP+D4N+DaVQKnHb$43=@zdUhgs%-~ck zF30vKNmA||u@ChNjAX44kP#8)`@rdrhO7eye@JRrz- z`fVGY%HjE*TlA&}N=Z&Qzy`LiWt^bXsj0K+VtQnipGtCrgKM6E&9ou|)GSmiASuP$ z?^UKq#f+Ho**`~_OXWw5X>M;*`K58^IqI3(%-Ed2m-%KT0(ITs+TtSY$Lucnboeg7 zRbcD_T6$XG1Wsm-^{uIqL-V7vGH-bF?5No|-~L+joM`=xUHouPSd++dD&rGrgK)Jy9)s(c%8++<=J0N#dWcP7t9udQ0F;3>>_g-}Y*X)r_uk=a_S zPRWq~JmHi3ru;y!p6O-;mNa;F+iSJpb(rbP>yQ*Xih26NZ z89U5`-wc-?Dlujl?VCUmA+ndM!;&%8pLKHoD!lzN)NAv-KvyxX(vMgHZ)iTI$0W!;nApV%E{B|xL8irXvFWR_8a-`jo~!) zI&^psenSJb3oq`N0x!Y_XTrF#-Qw=LDmV{&3jDa%Vx<_4PXqdXAS+!4IAa3(wUX+U zXPp<13&M~m+$L>lrBZ7xAGurE?|cr^urC*N$Iy3c49d$9+Z z?o9w{h&PCX3?8E$nF=+OsPnUT1Hyf~% zU9CDPm``?zT;~d>O}z$KB(4y>+lyWvzNLzq;!5_^WX}_^AZG}Xo$U`%fdDQ3p1U6* zLHU%^y$|2##Tk`Rpp5gLH6#l8c@uylsU!COT-DO~zcZLi9c=zlJo3EadNj^dt4#b2 zbl+4iO1YrNFK~$!idavaxLh%by3YCCDH^BS{HVWW!3rrLLq%(BR0rW=p4EPcA2_ob z;!K`3e1%aMH%w&)m`A*JZ7fg|lJIROT&?}Bpw5Z#F@*23)E4U-fY-gzPUeBDuFPl( z3!Z?VN$M3kE7bSwJ-**OXTDwk#!ktT^ccRb7{;B0yZtb*u$(o4Y;bEzk=<^f56SU(Q57^?Sr))}3vz&Qs zYb9dXomRAQWZ1vP?FZEkj_;2+(UTrzZU*6yy2W8Ty9v4mxCQh?5q-^FswnLItee>o zl@M;G?zHmlDeb(t*ajm>Ji24I$lMMqq@creNngX0&rKOfIj&*TbOECn!t%aW@1XDG zK`wLYHl0gkKHI@ph~q+qyravgmy>X zQ?)x5)wzu=KBb1K2pdH;Ato}39!X^3>JPN(!4#FctRbz&x)a#lfeXj%qn!6x8oN-o znKdp4jPp0htb+ly8(3t#JyHx|t2LcLXH1B z8~x89d^ncphG5lN3^_e^qF1mRpLfTS4o6Wn=wsmM#t54^&r!=Q_ToS3&>g9z(s@~G zpIRQdCvOA9I2WpPop4rV7$Keo*zS_H(YcvaHz|i?XL}AIAH2~fDju z`)o$Id1}guzli!&@Q{M&t`P?ah&)(z?&TIrrte4^?Ri4$8FP$FDCexjliW(y8<}pr zB;K0ecljiWmg+G;VC1ALuA9BEPP|F&Yvh6*61hDULGA5p?DbTkb#skGhtYp`{FX%W zd;uQ|WYh`e(7X&3%m`$9oz~CB3LZAL+*5dnF3CicGFly?nZJo zwyD9opCWIWz-y2TFcX-!98@Ruz7U zCU2p`Jr2`$F2o1LZ={kmAEQTbYmka-n;K3oCUsmhMAYj2@M$!)&Xu`r6GCU@+b$`X z<;699!N%5u)ITj3f%_Q@nJMGNKy&Wa=vaFIA!sl% zj4Ilb;3!5+_;CHN&jy zDi5GiAg|rrjiJtN{p(%cphAYJFFBEr(NnM=tF>KZk5)k8_KUVnKqVxOPs0gXE9h|{ zPxs2Mh9N8``*c@?Q3_n87Y}4<Ez*2SGV=qKJKaV{*M}8!9`sp z4p}g;ADeniPTeVQP(3BfW4Fu;PKo9`hz1p89u~BuE__w+ISipHd`Up{aNs z2O4X6_mBDQ!?Q(6uYTI68+Q9A%5>HDhE@02K0)JUET59)nzW-d2N2u!l}$6bfw*$`bK(xV(F*pN~Qw=MoyDrHs6$v zju@5U`;Pk|OSh@s3KX#{XQ?lIdM-9JPC|LX3jK)EfXEH-VwiHwit16!58&(qoInQ#D%`{I2?JX6syig6fAmL}j|1cSC0Bhyc8 z7J461qH?M9$-+7-%lU@4HhO#_^C=N~vz!&Rg3mL+I!wci8L8`l>)~{@-N;}D{RH%3~IH+7n z5R2qZosT-N+MQkIaw0e$TwSIHN$W9Q{;B{7efl~sOQ~3Zf$!%~c(sbNnpOJpZVn1a zo7wHhowH`re(89s8PCycz~KvGi1wVs7ndWxZYJdc;{AN}m!_imA_6CTOd00Y48Xep zW3kGZVV&m9*S?jlF0*Q0jK^x^K{}h6O&&#? z%+%UFbgEy5Kj(mekDQ2WLH^UVq0{&^T7*Q@0x9rA=ZWaVjxMC#9&T44v2mBVx9 z=i5dWWl$a*A>x=O9YHaJ(GpzO!W1bRCPC$>gP2&HH-3c8TvJ6mf|%5wX)anf@uhlM^^D0bJMzr!!DPUknyF#!HHm^Olvs$WA8%%D__qh zfBOkSXT~^!o4-8QY)pK_i^tlSa@mg$D2pb7TI>wkkZ%l+HzseHwTbwN$A|u zG&`Z@+xQDr&E?vZ^*~+fo{QOXbFBZe82v*BW||wg70c{iZNl`{_EP0X^&R<|?*72! zk37@9L{gF_W;abS@!7O!8R%BlqXUZ(6N1uLF^_$sqo8!7aC8Erz}yNbrUu_+U4pW~ zBb-q70_a2(FMV}3U9FaI+^B|l8it8iHu++xmZz>vqyuljR)WC1V9Ev>&W) z@Rr(VA$OCrx^oe#Lm-*dU$8<1q#~d0=~{yln1U_CHFzW}RFx&$7!~PPiJCOOhP&_J zhNq>h=B11zUX$dwQ>++!J2b!b-P!X5bn1@8$B&vFi+%Mk1dobDl^;R=B>ND&=mD4I z;1GJ(|Kwx~kP;H){;9}8v0H|9&5FPN1TL(~(?E;bFH9z)?7??>t?a{`ucqfkthb5H zF;`Oa@!tWv!YKp_sTaXycF9}f6W}ET$4gUFOC*Ds+o_=1G0SP_0_11`fONrOW89a} zXfqhF8FjJagt(~-#J~cbpUrLr7HIzJ$#T$jtyce_2DZPNAU`e_>nWoqQ^0WKtQZnL zBH465x$l_40+S<^S){Pr0D2ReK{MSa*f+6hKb%l%m-u$$N2uHDnSyEDnB!8idAJrk zBa~2F$9%$3gmT6kj^}lP(UID)2{O;4q!Ztv9XGOSiel-pU~Z~je}vPzgdQNRy$Riu zOt!;Lg!f`H5y=t_-qoFU`Vc1Cf4a6{=3;M=DH8nXBNS0CFKCbMo-1Dv)>2dDW0oYB zlwaBGFY7mhsZ-b0+`xeyr|GKv5QHXQ^$OL?g}yw|6L4~Nmolc9krsK9=dZ6$2WH`F zYlW^;Aa4Oq@|r!azS@}3T`sdFS4&S~4bhBV(AVt~HErH5p8;__Oz({U_TZQn6~|(_ z!{FF0{K9#E+0Ivs^oo@Hl<-YWTOA^}qz8N)y|=l)Cej z`YTw#7;bi3#QdJvDZlV%S%N(bq;a@HEPO%Gafh>Rg8TT8Tdg_KG4S7x0`43DNwneO?kok)`5exS_x~3f zX0z))vhwBudjo|0dh^D~41Rxu{rbb|Cmb)>xZ!w=oql~?{wb{>R%iKT%e!UqhZY=d zdr!vpA?RBdRAsnG+f%eJtd`4G{Ml16JoTvAn8M+t1B_HBrgoxg5ZI|5!srGF)Akd+ ztE&oQu|g*k^2Mo!tkNh4t&~nB#;we#gHEqnA!*!-i@o3n<-jNijd#e3_@{4L4%qyQ z9fl2-Vzyn-t7j3O!|Eo;1$h9CK!)f0o|G+^3(?<`ty%!KPEv%}E~^X?$>0dwG!$b^i| zoAu3Nvlz3w<=A)~*aL)y?n&@jkqFTBIss>w4K$a@Du`_@AV%7W+_8^zT?Su8m4IQGbTA=hT1h) zWHfy`Cz6HVQQf5!$D1afsu6%4>yA;&jAJcWZ^YgQ2inur>%)QjJ*GsaanMP2zumA8 zG-_Zi#uGX41A%U$>rjtSBC+GUz=<7j;@4sY<{`P?&~^p9U`sCE>>ciI-$$V!xgRvb zXEszhQE-ZwKFCz4f{Ym)2}`7g^mt=Ro-9CmXmQRyA~t2{r;(s8BBa0WqXUL?WU`ZV zkd3;=3Yh+CoTJ_T&WQ;842_ksG)FV%b=391@%^${n~aT9=%eK^7(d(*k1Ky9+ONls z40KXr_#6@YcFH0Y>O~h5Y%R&KWNU!iQtFyF&-!z`1qMCSo)Q zeiP6tbNtLL!z7M&>v>$HqyIw7xPqU9vV^o|P%*O~1Qd1z7HFL55FTozE3#QAv2~=l zT}gA4oOc-k-+@12WbYFB(2hj{B<`dv-|EUbiA@*d%S27sDk;iixiGoi620MSXnGAu z28LZ#URx`0>VfIFFfwu5Pxh!*Y|3IyP#opA!0O}V^m`64W9= 1.2.0 + +%global upstream_version %{version} +Source0: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.4/cryptsetup-%{upstream_version}.tar.xz +# binary archive with updated compatimage.img.xz for testing (can not be patched via rpmbuild) +Source1: tests.tar.xz + +# Following patch has to applied last +Patch0000: %{name}-2.5.0-Fix-typo-in-repair-prompt.patch +Patch0001: %{name}-2.5.0-Fix-PBKDF-benchmark-in-OpenSSL3-FIPS-mode.patch +Patch0002: %{name}-2.5.0-Get-rid-of-SHA1-in-tests.patch +Patch0003: %{name}-2.5.0-Do-not-use-too-small-key-in-tests.patch +Patch0004: %{name}-2.5.0-Fix-test-passphrase-when-device-in-reencryption.patch +Patch0005: %{name}-2.5.0-Add-more-tests-for-test-passphrase-parameter.patch +Patch9999: %{name}-add-system-library-paths.patch + +%description +The cryptsetup package contains a utility for setting up +disk encryption using dm-crypt kernel module. + +%package devel +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Requires: pkgconfig +Summary: Headers and libraries for using encrypted file systems + +%description devel +The cryptsetup-devel package contains libraries and header files +used for writing code that makes use of disk encryption. + +%package libs +Summary: Cryptsetup shared library + +%description libs +This package contains the cryptsetup shared library, libcryptsetup. + +%package -n veritysetup +Summary: A utility for setting up dm-verity volumes +Requires: cryptsetup-libs = %{version}-%{release} + +%description -n veritysetup +The veritysetup package contains a utility for setting up +disk verification using dm-verity kernel module. + +%package -n integritysetup +Summary: A utility for setting up dm-integrity volumes +Requires: cryptsetup-libs = %{version}-%{release} + +%description -n integritysetup +The integritysetup package contains a utility for setting up +disk integrity protection using dm-integrity kernel module. + +%package reencrypt +Summary: A utility for offline reencryption of LUKS encrypted disks +Requires: cryptsetup-libs = %{version}-%{release} + +%description reencrypt +This package contains cryptsetup-reencrypt utility which +can be used for offline reencryption of disk in situ. + +%prep +%autosetup -n cryptsetup-%{upstream_version} -p 1 -a 1 +chmod -x misc/dracut_90reencrypt/* + +%build +%configure --enable-fips --enable-pwquality --enable-internal-sse-argon2 --disable-ssh-token +%make_build + +%install +%make_install +rm -rf %{buildroot}%{_libdir}/*.la + +%find_lang cryptsetup + +%ldconfig_scriptlets -n cryptsetup-libs + +%files +%license COPYING +%doc AUTHORS FAQ docs/*ReleaseNotes +%{_mandir}/man8/cryptsetup.8.gz +%{_sbindir}/cryptsetup + +%files -n veritysetup +%license COPYING +%{_mandir}/man8/veritysetup.8.gz +%{_sbindir}/veritysetup + +%files -n integritysetup +%license COPYING +%{_mandir}/man8/integritysetup.8.gz +%{_sbindir}/integritysetup + +%files reencrypt +%license COPYING +%doc misc/dracut_90reencrypt +%{_mandir}/man8/cryptsetup-reencrypt.8.gz +%{_sbindir}/cryptsetup-reencrypt + +%files devel +%doc docs/examples/* +%{_includedir}/libcryptsetup.h +%{_libdir}/libcryptsetup.so +%{_libdir}/pkgconfig/libcryptsetup.pc + +%files libs -f cryptsetup.lang +%license COPYING COPYING.LGPL +%{_libdir}/libcryptsetup.so.* +%dir %{_libdir}/%{name}/ +%{_tmpfilesdir}/cryptsetup.conf +%ghost %attr(700, -, -) %dir /run/cryptsetup + +%changelog +* Thu Feb 24 2022 Ondrej Kozina - 2.4.3-4 +- patch: Fix broken upstream test. +- Resolves: #2056439 + +* Wed Feb 23 2022 Ondrej Kozina - 2.4.3-3 +- patch: Fix cryptsetup --test-passphrase when device in + reencryption +- Resolves: #2056439 + +* Thu Feb 17 2022 Ondrej Kozina - 2.4.3-2 +- Various FIPS related fixes. +- Resolves: #2051630 + +* Fri Jan 21 2022 Ondrej Kozina - 2.4.3-1 +- Update to cryptsetup 2.4.3. +- patch: Fix typo in repair command prompt. + Resolves: #2022309 #2023316 #2032782 + +* Wed Sep 29 2021 Ondrej Kozina - 2.4.1-1 +- Update to cryptsetup 2.4.1. + Resolves: #2005035 #2005877 + +* Thu Aug 19 2021 Ondrej Kozina - 2.4.0-1 +- Update to cryptsetup 2.4.0. + Resolves: #1869553 #1972722 #1974271 #1975799 + +* Mon Aug 09 2021 Mohan Boddu - 2.3.6-3 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Thu Jun 17 2021 Mohan Boddu - 2.3.6-2 +- Specbump for openssl 3.0 + Related: rhbz#1971065 + +* Wed Jun 16 2021 Ondrej Kozina - 2.3.6-1 +- Update to cryptsetup 2.3.6. +- Resolves: #1961291 #1970932 + +* Tue Jun 15 2021 Mohan Boddu - 2.3.5-5 +- Rebuilt for RHEL 9 BETA for openssl 3.0 + +Related: rhbz#1971065 + +* Tue Apr 27 2021 Ondrej Kozina - 2.3.5-4 +- Drop dependency on libargon2 +- Resolves: #1936959 + +* Thu Apr 15 2021 Mohan Boddu - 2.3.5-3 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Thu Mar 11 2021 Milan Broz - 2.3.5-1 +- Update to cryptsetup 2.3.5. + +* Tue Jan 26 2021 Fedora Release Engineering - 2.3.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Thu Sep 03 2020 Milan Broz - 2.3.4-1 +- Update to cryptsetup 2.3.4. +- Fix for CVE-2020-14382 (#1874712)